New Release: Tor Browser 12.0.5

by richard | April 19, 2023

Tor Browser 12.0.5 is now available from the Tor Browser download page and also from our distribution directory.

This release updates Firefox to 102.10.0esr, including bug fixes, stability improvements and important security updates. We also backported the Android-specific security updates from Firefox 112.

We use this opportunity to update various components of Tor Browser as well:

Build-Signing Infrastructure Updates

We are in the process of updating our build signing infrastructure, and unfortunately are unable to ship code-signed 12.0.5 installers for Windows systems currently. Therefore we will not be providing full Window installers for this release. However, automatic build-to-build upgrades should continue to work as expected. Everything should be back to normal for the 12.0.6 release next month!

Send us your feedback

If you find a bug or have a suggestion for how we could improve this release, please let us know.

Full changelog

The full changelog since Tor Browser 12.0.4 is:


This is a companion discussion topic for the original entry at https://blog.torproject.org/new-release-tor-browser-1205/
2 Likes

I used this link to download the English version for the Mac system, why is it still version 12.0.4 after installation

English version for Linux tarball and sig file appear to be labeled 12.04, rather than the expected 12.05.

While “about TOR” shows that the 12.0.5 update is available, when I go to download it manually from the website, the link is still for 12.0.4. if I modify the link by hand to try to pick up 12.0.5, it downloads something, but that exe has no digital signature.

What’s going on? Is the person in charge of updates on vacation?

Would be nice if they were on vacation, they deserve it. Unfortunately, most likely they’re busy working on something that keeps them fed.

If you can’t update the Tor Browser using its own auto-update mechanism that downloads a smaller incremental file, and you don’t trust the installation file you’ve downloaded from the distribution directory because it doesn’t have a digital signature, you can still verify the signature using the associated “.asc” file.

Yeah, I understand that. I usually do both. I like to have multiple corroborating indicators that I have a genuine exe.

So, it’s been several days now and things still appear to be in a broken state:

The download link points at 12.0.4
The 12.0.5 download (for those who are clever and find it) has not been built in the normal fashion, and has no signature

Is there any plan to fix the situation? I’m sorry your funding model doesn’t allow paying your workers, but I’d still like a functional website, and signed exes.

To quote the blog post:

Build-Signing Infrastructure Updates

We are in the process of updating our build signing infrastructure, and unfortunately are unable to ship code-signed 12.0.5 installers for Windows systems currently. Therefore we will not be providing full Window installers for this release. However, automatic build-to-build upgrades should continue to work as expected.
Everything should be back to normal for the 12.0.6 release next month!

2 Likes

Looks like this prediction was wrong. Here we are at 12.0.6 and the problem is still present.