Upgrade Tor to 0.3.5.8 and 0.3.4.11

[emkll]

Description

Tor has released new versions that contain security fixes: https://blog.torproject.org/new-releases-tor-0402-alpha-0358-03411-and-03312. This ticket is to track the update to Tor for all SecureDrop instances:

• 0.3.5.8 (Xenial)
• 0.3.4.11 (Trusty)

Let's target 0.12.1 instead of 0.12.0 Given that:

1. The claim in the blog post is that these bugs are not exploitable, and the fixes are issued out of an abundance of caution
2. We have been testing 0.3.4.9 and 0.3.5.7, and so close to 0.12.0, it might
3. Debs are not yet available at deb.torproject.org

[emkll]

0.3.5.8 (Xenial) has been uploaded to apt test.

0.3.4.x was the last series supported and built for Trusty, and the Tor project no longer builds and hosts trusty debs. The last version 0.3.4.9, since then, there were 2 releases in the 0.3.4.x series:

• 0.3.4.10: Bugfixes (non security) https://gitweb.torproject.org/tor.git/plain/ReleaseNotes?id=tor-0.3.4.10
• 0.3.4.11: https://gitweb.torproject.org/tor.git/plain/ReleaseNotes?id=tor-0.3.4.11, contains the same issue that is being addressed in 0.3.5.8, CVE-2019-8955 (https://trac.torproject.org/projects/tor/ticket/29168)

Note the end-of-life for 0.3.4.x series (though after Trusty)

• 0.3.4.x series will be end-of-life on June 10th 2019
• 0.3.5.x series will be end of life in Februrary 2022 (or later)

Tor 0.3.5.8 (Xenial) does not work on Trusty, we would need to compile our own deb if we would like to update the Trusty version of tor.

[conorsch]

Tor 0.3.5.8 was released (for Xenial only) as part of SecureDrop 0.12.1. During release procedures, however, we observed that there's still a test-vars update that must be required, specifically bumping the version looked for in molecule/fetch-tor-packages/tests/. We didn't catch that because we don't run the tor fetch logic in CI, but we absolutely should. Proposed actions before close-out:

• Update target tor version sought in molecule/fetch-tor-packages/tests/ - Update test var for tor 0.3.5.8 #4258
• Ensure make fetch-tor-packages runs in CI, so errors are caught
• (Optional) Consider pinning a specific tor version as part of the fetch logic, which would reduce variability particularly during the release window (in case a new version ships between when QA starts and when final release happens).

Once those tasks are complete, we should be fine to close this issue.