Brave Debian/Ubuntu repositories block Tor?

[Mikaela]

Description

When attempting to check for updates on Debian (Testing) by running apt update over Tor, the Brave repository very often fails with 403 Forbidden. I think this is, because it's blocking Tor exit nodes.

Steps to Reproduce

1. Install tor and apt-transport-tor if they aren't already installed.
2. Comment the last line of /etc/apt/sources.list.d/brave-browser-dev.list
3. copy the file as anything else ending to .list and prepend tor+ to the address in order to use apt-transport-tor.

My /etc/apt/sources.list.d/brave-buster.list:

deb [arch=amd64] tor+https://s3-us-west-2.amazonaws.com/brave-apt buster main
deb [arch=amd64] tor+https://brave-browser-apt-dev.s3.brave.com/ buster main

Actual result:

Err:9 tor+https://brave-browser-apt-dev.s3.brave.com buster InRelease          
  403  Forbidden [IP: 127.0.0.1 9050]
...
E: Failed to fetch tor+https://brave-browser-apt-dev.s3.brave.com/dists/buster/InRelease  403  Forbidden [IP: 127.0.0.1 9050]                                  
E: The repository 'tor+https://brave-browser-apt-dev.s3.brave.com buster InRelease' is no longer signed.                                                       
N: Updating from such a repository can't be done securely, and is therefore disabled by default.                                                               
N: See apt-secure(8) manpage for repository creation and user configuration details.                                                                           

Expected result:

No errors from apt, update checks and upgrades are successful.

Reproduces how often:

Always, I think I have seen this for a week or at least multiple days.

Brave version (chrome://version info)

0.56.2 / 0.24.0-1, but N/A

Reproducible on current release:

Yes to both or N/A

Website problems only:

N/A

Additional Information

• Debian GNU/Linux testing (buster)
• Related to Switch: use Tor for background requests where possible #804 (update checks/update downloads) which hopefully includes having a Tor Onion Service for the repository.

[fmarier]

One thing that does work (I'm using it on my laptop) is to use the (newish) Onion service directly:

deb [signed-by=/usr/share/keyrings/brave-browser-archive-keyring.gpg arch=amd64] tor+https://brave-browser-apt-release.s3.brave4u7jddbv7cyviptqjc7jusxh72uik7zt6adtckl5f4nwy2v72qd.onion/ stable main

[fmarier]

I'm going to close this old issue because the infrastructure has changed significantly since it was filed (it moved cloud providers for example), and there is a work-around with the official .onion now.

However, if you prefer not to use the .onion and you're still having problems when pulling updates on Tor, please reopen and we'll investigate.