Distribute Tor binary with Brave

[tildelowengrimm]

For a user-facing implementation of Tor tabs, we should ship Tor with Brave and run it ourselves. We might want to look to the Widevine distribution model as a template.

[riastradh-brave]

The main cost here is a ~2.5 MB executable, judging by the Ubuntu package for tor. We could do one of two main approaches:

1. Unconditionally bundle a tor executable with Brave.

   • Pros: Simpler to implement and manage, private browsing with Tor will work instantaneously out of the box, makes it easy to decide to turn on Tor for various other services (Use Tor for analytics and reporting #12925, Use Tor for ledger proxy instead of PIA #12923, Use Tor for update checks and downloads #12924).
   • Cons: Unconditionally adds 2.5 MB to Brave, can't straightforwardly be removed.

2. Automatically download tor as an executable on demand.

   • Pros: Keeps Brave slimmer when Tor is not in use, users could maybe remove it if they want like other unwanted extensions.
   • Cons: Overhead to implement management, more code paths necessary to get started, possible backlash from free software users like https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=786909 and bad press like https://www.theregister.co.uk/2015/06/17/debian_chromium_hubbub/, would add a delay for the first time anyone tries private browsing with Tor.

[tildelowengrimm]

I definitely think we should bundle Tor with Brave. Tor will be required for the default mode of a core feature — private tabs. Having to download Tor before browsing for the first time in a private tab seems like a no-go to me. 2.5mb is a perfectly-reasonable price to pay.

[riastradh-brave]

We have decided to bundle the tor daemon with Brave rather than download it on-demand. There are two questions about how to bundle it:

1. Include the tor source code under third_party somewhere, and build it as part of our build by causing something to run ./configure && make && make install or by writing the necessary BUILD.gn files based on tor's makefiles (and also making sure to build and run the tests).

2. Include the binary builds of the tor executable from the upstream Tor Project, and implement some kind of rig to verify that upstream's builds are reproducible, even if we don't necessarily build the tor executable during our regular brave build.

For option (2), we can defer the auditing temporarily, but I would be uncomfortable if we didn't eventually create the rig to verify upstream's builds. The total effort is a bit of a tossup one we figure the cost of verifying the builds into it, and just including the source code is certainly more flexible, so I would suggest option (1).

[diracdeltas]

discussed in person

we found an unhelpful link https://dist.torproject.org/

@riastradh-brave to email torproject (cc'ing us) and ask what we should do

[riastradh-brave]

I asked upstream and isis told me that the Tor Project does not distribute binary builds of the tor daemon itself outside the Tor Browser. So, we could either try to extract it from the Tor Browser distributions, or just integrate a source build into our build system. I'm more inclined to do the latter now.

[diracdeltas]

done in tor/0.23.x