Preparation (first time)

If you don't have our torbrowser-launcher Git repo, clone it:

git clone

and add a remote for Debian, which is our immediate upstream:

git remote add debian

and add a remote for the final upstream:

git remote add upstream-repo

Make our repo up-to-date


git checkout master && \
git pull && \
git fetch debian && \
git fetch upstream-repo

Finally, make our repo up-to-date:

LATEST_TAG="$(git tag --list 'debian/*' --sort=version:refname | grep -v -E '_bpo[0-9]' | tail -n1)"
git merge --no-ff "${LATEST_TAG}"

Just pay attention that you didn't merge some unwanted version from Debian experimental!

Prepare a branch for upstream

Prepare a branch, e.g.:

git checkout -b "${UPSTREAM_FEATURE_BRANCH}" upstream-repo/master

Edit apparmor/torbrowser.Browser.firefox, adding changes that are supposed to go upstream , and commit. Then:

git checkout -b "${TAILS_FEATURE_BRANCH}" origin/master

Again, edit apparmor/torbrowser.Browser.firefox, now adding changes that are Tails-specific, and commit. Then push:


Then submit TAILS_FEATURE_BRANCH for review on the Tails' side, and ask the reviewer to submit UPSTREAM_FEATURE_BRANCH as a pull request to upstream once s/he is happy with its state (alternatively, the reviewer reminds the patch submitter to send it).