torproject · micahflee · Oct 6, 2020 · Jul 29, 2019 · Jul 29, 2019 · Aug 29, 2019
diff --git a/BUILD.md b/BUILD.md
@@ -12,15 +12,15 @@ Then install dependencies, build a package, and install:
 ### Debian, Ubuntu, Linux Mint, etc.
 
 ```sh
-sudo apt install build-essential dh-python python3-all python3-stdeb python3-pyqt5 python3-gpg python3-requests python3-socks gnupg2 tor
+sudo apt install build-essential dh-python python3-all python3-stdeb python3-pyqt5 python3-gpg python3-requests python3-socks python3-packaging gnupg2 tor
 ./build_deb.sh
 sudo dpkg -i deb_dist/torbrowser-launcher_*.deb
 ```
 
 ### Red Hat, Fedora, CentOS, etc.
 
 ```sh
-sudo dnf install rpm-build python3-qt5 python3-gpg python3-requests python3-pysocks gnupg2 tor
+sudo dnf install rpm-build python3-qt5 python3-gpg python3-requests python3-pysocks python3-packaging gnupg2 tor
 ./build_rpm.sh
 sudo yum install dist/torbrowser-launcher-*.rpm
 ```

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Tor Browser Launcher Changelog
 
+## 0.3.3
+
+* Switch to Web Key Directory to refresh signing key from torproject.org, because everything is broken
+* Use proper version comparison now that Tor Browser 10.0 is out
+* Fix DNS leak when downloading over Tor
+* Various bug fixes, as well as AppData and AppArmor fixes
+
 ## 0.3.2
 
 * Switch to keys.openpgp.org when refreshing signing key, because SKS keyservers are broken

diff --git a/README.md b/README.md
@@ -1,6 +1,6 @@
 # Tor Browser Launcher
 
-_**Are you getting an error?** Sometimes updates in Tor Browser itself will break Tor Browser Launcher. There's a good chance that the problem you're experiencing has already been fixed in the [newest version](https://github.com/micahflee/torbrowser-launcher/releases), but Linux distributions can be slow to provide up-to-date packages. In this case, you can install from the PPA (instructions below), or [build from source](/BUILD.md)._
+_**Are you getting an error?** Sometimes updates in Tor Browser itself will break Tor Browser Launcher. There's a good chance that the problem you're experiencing has already been fixed in the [newest version](https://github.com/micahflee/torbrowser-launcher/releases). Try installing from Flatpak (instructions below), or [build from source](/BUILD.md)._
 
 Tor Browser Launcher is intended to make Tor Browser easier to install and use for GNU/Linux users. You install ```torbrowser-launcher``` from your distribution's package manager and it handles everything else:
 
@@ -16,11 +16,22 @@ You might want to check out the [security design doc](/security_design.md).
 
 ![Tor Browser Launcher screenshot](/screenshot.png)
 
-# Installing from the PPA
+# Installing
 
-If you want to always have the latest version of the `torbrowser-launcher` package before your distribution gets it, you can use my PPA:
+You can install `torbrowser-launcher` from your operating system's package manager, but it might be out-of-date and have issues working. If you want to make sure you always have the latest version, use Flatpak:
 
-```sh
-sudo add-apt-repository ppa:micahflee/ppa
-sudo apt install torbrowser-launcher
+## Installing in any Linux distro using Flatpak
+
+Install Flatpak using these [instructions](https://flatpak.org/setup/).
+
+Then install `torbrowser-launcher` like this:
+
+```
+flatpak install flathub com.github.micahflee.torbrowser-launcher -y
+```
+
+Run `torbrowser-launcher` either by using the GUI desktop launcher, or by running:
+
+```
+flatpak run com.github.micahflee.torbrowser-launcher
 ```
diff --git a/apparmor/torbrowser.Browser.firefox b/apparmor/torbrowser.Browser.firefox
@@ -63,17 +63,21 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} {
   owner @{torbrowser_home_dir}/firefox rix,
   owner @{torbrowser_home_dir}/{,TorBrowser/UpdateInfo/}updates/[0-9]*/* rw,
   owner @{torbrowser_home_dir}/{,TorBrowser/UpdateInfo/}updates/[0-9]*/{,MozUpdater/bgupdate/}updater ix,
+  owner @{torbrowser_home_dir}/updater ix,
   owner @{torbrowser_home_dir}/TorBrowser/Data/Browser/.parentwritetest rw,
   owner @{torbrowser_home_dir}/TorBrowser/Data/Browser/profiles.ini r,
   owner @{torbrowser_home_dir}/TorBrowser/Data/Browser/profile.default/{,**} rwk,
   owner @{torbrowser_home_dir}/TorBrowser/Data/fontconfig/fonts.conf r,
+  owner @{torbrowser_home_dir}/fonts/* l,
   owner @{torbrowser_home_dir}/TorBrowser/Tor/tor px,
   owner @{torbrowser_home_dir}/TorBrowser/Tor/ r,
   owner @{torbrowser_home_dir}/TorBrowser/Tor/*.so mr,
   owner @{torbrowser_home_dir}/TorBrowser/Tor/*.so.* mr,
+  owner @{torbrowser_home_dir}/TorBrowser/Tor/libstdc++/*.so mr,
+  owner @{torbrowser_home_dir}/TorBrowser/Tor/libstdc++/*.so.* mr,
 
   # parent Firefox process when restarting after upgrade, Web Content processes
-  owner @{torbrowser_firefox_executable} ixmr -> torbrowser_firefox,
+  owner @{torbrowser_firefox_executable} pxmr -> torbrowser_firefox,
 
   /etc/mailcap r,
   /etc/mime.types r,
@@ -105,6 +109,7 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} {
 
   # Required for multiprocess Firefox (aka Electrolysis, i.e. e10s)
   owner /{dev,run}/shm/org.chromium.* rw,
+  owner /dev/shm/org.mozilla.ipc.[0-9]*.[0-9]* rw, # for Chromium IPC
 
   # Deny access to DRM nodes, that's granted by the X abstraction, which is
   # sourced by the gnome abstraction, that we include.
@@ -120,6 +125,8 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} {
   deny /sys/devices/system/cpu/cpufreq/policy[0-9]*/cpuinfo_max_freq r,
   deny /sys/devices/system/cpu/*/cache/index[0-9]*/size r,
   deny /run/user/[0-9]*/dconf/user rw,
+  deny /usr/bin/lsb_release x,
+  deny capability sys_admin,
 
   # Silence denial logs about PulseAudio
   deny /etc/pulse/client.conf r,
@@ -132,5 +139,14 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} {
   /etc/xfce4/defaults.list r,
   /usr/share/xfce4/applications/ r,
 
+  # u2f (tested with Yubikey 4)
+  /sys/class/ r,
+  /sys/bus/ r,
+  /sys/class/hidraw/ r,
+  /run/udev/data/c24{7,9}:* r,
+  /dev/hidraw* rw,
+  # Yubikey NEO also needs this:
+  /sys/devices/**/hidraw/hidraw*/uevent r,
+
   #include <local/torbrowser.Browser.firefox>
 }
diff --git a/apparmor/torbrowser.Tor.tor b/apparmor/torbrowser.Tor.tor
@@ -24,13 +24,17 @@ profile torbrowser_tor @{torbrowser_tor_executable} {
   # Support some of the included pluggable transports
   owner @{torbrowser_home_dir}/TorBrowser/Tor/PluggableTransports/** rix,
   @{PROC}/sys/net/core/somaxconn r,
+  #include <abstractions/ssl_certs>
 
   # Silence file_inherit logs
   deny @{torbrowser_home_dir}/{browser/,}omni.ja r,
   deny @{torbrowser_home_dir}/{browser/,}features/*.xpi r,
   deny @{torbrowser_home_dir}/TorBrowser/Data/Browser/profile.default/.parentlock rw,
   deny @{torbrowser_home_dir}/TorBrowser/Data/Browser/profile.default/extensions/*.xpi r,
   deny @{torbrowser_home_dir}/TorBrowser/Data/Browser/profile.default/startupCache/* r,
+  # Silence logs from included pluggable transports
+  deny /etc/hosts r,
+  deny /etc/services r,
 
   @{PROC}/sys/kernel/random/uuid r,
   /sys/devices/system/cpu/ r,

diff --git a/build_rpm.sh b/build_rpm.sh
@@ -6,7 +6,7 @@ VERSION=`cat share/torbrowser-launcher/version`
 rm -r build dist
 
 # build binary package
-python3 setup.py bdist_rpm --requires="python3-qt5, python3-gpg, python3-requests, python3-pysocks, gnupg2"
+python3 setup.py bdist_rpm --requires="python3-qt5, python3-gpg, python3-requests, python3-pysocks, python3-packaging, gnupg2"
 
 # install it
 echo ""

diff --git a/po/fr.po b/po/fr.po
@@ -24,12 +24,12 @@ msgstr "Tor Browser Launcher"
 
 #: __init__.py:66
 msgid "By Micah Lee, licensed under MIT"
-msgstr "Par Micah Lee, sous license MIT"
+msgstr "Par Micah Lee, sous licence MIT"
 
 #: __init__.py:67
 #, python-brace-format
 msgid "version {0}"
-msgstr ""
+msgstr "version {0}"
 
 #: common.py:100
 #, python-brace-format
@@ -48,49 +48,47 @@ msgstr "Impossible de créer le dossier {0}"
 
 #: common.py:187
 msgid "Creating GnuPG homedir"
-msgstr "Creation du dossier GnuPG"
+msgstr "Création du dossier GnuPG"
 
 #: common.py:254
 #, python-format
 msgid "Could not import key with fingerprint: %s."
-msgstr "Impossible d'importer la clé: %s"
+msgstr "Impossible d'importer la clé avec l'empreinte : %s."
 
 #: common.py:259
 msgid "Not all keys were imported successfully!"
-msgstr "Certaines clés n'ont pas pu être importées"
+msgstr "Certaines clés n'ont pas pu être importées !"
 
 #: launcher.py:83
-#, fuzzy
 msgid "Downloading Tor Browser for the first time."
-msgstr "Premier téléchargement et installation du Tor Browser"
+msgstr "Téléchargement du Navigateur Tor pour la première fois."
 
 #: launcher.py:85
-#, fuzzy
 msgid ""
 "Your version of Tor Browser is out-of-date. Downloading the newest version."
 msgstr ""
-"Votre version du Tor Browser est obsolète. Téléchargement et installation de "
-"la nouvelle version."
+"Votre version du Navigateur Tor est obsolète. Téléchargement de la nouvelle "
+"version."
 
 #: launcher.py:100
 msgid "Downloading over Tor"
 msgstr "Télécharger à travers Tor"
 
 #: launcher.py:111
 msgid "Tor Browser"
-msgstr "Tor Browser"
+msgstr "Navigateur Tor"
 
 #: launcher.py:128
 msgid "Start"
 msgstr "Démarrer"
 
 #: launcher.py:174
 msgid "Yes"
-msgstr ""
+msgstr "Oui"
 
 #: launcher.py:178
 msgid "Exit"
-msgstr ""
+msgstr "Quitter"
 
 #: launcher.py:192 settings.py:136
 msgid "Cancel"
@@ -103,11 +101,11 @@ msgstr "Téléchargement"
 
 #: launcher.py:238
 msgid "Latest version: {}"
-msgstr "Dernière version: {}"
+msgstr "Dernière version : {}"
 
 #: launcher.py:241
 msgid "Error detecting Tor Browser version."
-msgstr "Impossible de détecter la version du Tor Browser."
+msgstr "Impossible de détecter la version du Navigateur Tor."
 
 #: launcher.py:256 launcher.py:357
 msgid "Verifying Signature"
@@ -127,7 +125,7 @@ msgstr "Télécharger à nouveau"
 
 #: launcher.py:279 launcher.py:295
 msgid "(over Tor)"
-msgstr ""
+msgstr "(à travers Tor)"
 
 #: launcher.py:293
 msgid "Downloaded"
@@ -147,29 +145,29 @@ msgid ""
 "The version of Tor Browser you have installed is earlier than it should be, "
 "which could be a sign of an attack!"
 msgstr ""
-"La version du Tor Browser installée est antérieure à l'actuelle, ce qui peut "
-"être la signature d'une attaque!"
+"La version du Navigateur Tor que vous avez installé est antérieure à ce "
+"qu'elle devrait, ce qui peut être le signe d'une attaque !"
 
 #: launcher.py:446
-#, fuzzy
 msgid "Downloading Tor Browser over again."
-msgstr "Nouveau téléchargement du Tor Browser Bundle."
+msgstr "Télécharger le Navigateur Tor à nouveau."
 
 #: launcher.py:516 launcher.py:525 launcher.py:533
 msgid "Download Error:"
-msgstr "Erreur de téléchargement:"
+msgstr "Erreur de téléchargement :"
 
 #: launcher.py:517
 msgid "You are currently using a non-default mirror"
-msgstr "Vous utilisez actuellement un miroir non-défaut"
+msgstr "Vous utilisez actuellement un miroir n'étant pas celui par défaut"
 
 #: launcher.py:518
 msgid "Would you like to switch back to the default?"
-msgstr "Voulez-vous revenir à la valeur par défaut?"
+msgstr "Voulez-vous revenir à la valeur par défaut ?"
 
 #: launcher.py:527
 msgid "Would you like to try the English version of Tor Browser instead?"
-msgstr "Voulez-vous essayer la version anglophone du Tor Browser à la place?"
+msgstr ""
+"Voulez-vous essayer la version anglophone du Navigateur Tor à la place ?"
 
 #: launcher.py:548
 #, python-brace-format
@@ -179,10 +177,14 @@ msgid ""
 "\n"
 "You may be under attack."
 msgstr ""
+"Certificat SSL invalide pour :\n"
+"{0}\n"
+"\n"
+"Vous pourriez être attaqué."
 
 #: launcher.py:550
 msgid "Try the download again using Tor?"
-msgstr "Essayez de télécharger à nouveau à travers Tor?"
+msgstr "Essayer de télécharger à nouveau à travers Tor ?"
 
 #: launcher.py:559
 #, python-brace-format
@@ -194,6 +196,12 @@ msgid ""
 "Trying to download over Tor. Are you sure Tor is configured correctly and "
 "running?"
 msgstr ""
+"Impossible de démarrer le téléchargement :\n"
+"\n"
+"{0}\n"
+"\n"
+"Essayez de télécharger à travers Tor. Êtes-vous sûr que Tor est configuré "
+"correctement et fonctionne ?"
 
 #: launcher.py:563
 #, python-brace-format
@@ -204,11 +212,11 @@ msgid ""
 "\n"
 "Are you connected to the internet?"
 msgstr ""
-"Impossible de démarrer le téléchargement:\n"
+"Impossible de démarrer le téléchargement :\n"
 "\n"
 "{0}\n"
 "\n"
-"Êtes-vous connecté à Internet?"
+"Êtes-vous connecté à Internet ?"
 
 #: settings.py:46
 msgid "Tor Browser Launcher Settings"
@@ -220,34 +228,33 @@ msgstr "Télécharger à travers le Tor installé sur le système"
 
 #: settings.py:57
 msgid "Force downloading English version of Tor Browser"
-msgstr "Forcer le téléchargement de la version anglophone du Tor Browser"
+msgstr "Forcer le téléchargement de la version anglophone du Navigateur Tor"
 
 #: settings.py:66
 msgid "Tor server"
 msgstr "Serveur Tor"
 
 #: settings.py:82
 msgid "Status: Installed"
-msgstr "Status: Installé"
+msgstr "Statut : Installé"
 
 #: settings.py:84
 msgid "Status: Not Installed"
-msgstr "Status: Pas installé"
+msgstr "Statut : Pas installé"
 
 #: settings.py:87
 msgid "Install Tor Browser"
-msgstr "Installer le Tor Browser"
+msgstr "Installer le Navigateur Tor"
 
 #: settings.py:92
 msgid "Reinstall Tor Browser"
-msgstr "Réinstaller le Tor Browser"
+msgstr "Réinstaller le Navigateur Tor"
 
 #: settings.py:115
 msgid "Mirror"
 msgstr "Miroir"
 
 #: settings.py:131
-#, fuzzy
 msgid "Save && Exit"
 msgstr "Enregistrer et quitter"
 

diff --git a/screenshot.png b/screenshot.png