gh-13761: Fixed closing a split view selecting it on other windows (gh-13790)

The problem was that `input.value` was getting the raw shortcut and not
really converting it to the normalized displayable string.
There was no method to just get the `displayString` for a shortcut
without creating a new one, so I put that logic into
`gZenZenKeyboardShortcutsManager`. The static function in `KeyShortcut`
class is just to reduce code duplication.

fixes: #13767

.editorconfig

@@ -1,3 +1,7 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
 root = true
 
 [*]

.formal-git/template

@@ -0,0 +1 @@
+{bugId}: {message}

.gitattributes

@@ -1 +1,8 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
 *.patch linguist-language=C++
+*.d.ts linguist-language=TypeScript
+
+src/zen/tests/*.js linguist-language=Test

.github/FUNDING.yml

@@ -1,2 +0,0 @@
-patreon: zen_browser
-ko_fi: zen_browser

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -4,42 +4,82 @@ body:
   - type: markdown
     attributes:
       value: |
-        Thank you for filing a bug report.
+        <p align="center">
+          <a href="https://zen-browser.app">
+            <picture>
+              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/zen-browser/desktop/dev/docs/assets/zen-light.svg">
+              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/zen-browser/desktop/dev/docs/assets/zen-dark.svg">
+              <img src="https://raw.githubusercontent.com/zen-browser/desktop/dev/docs/assets/zen-light.svg" alt="Zen Logo" width="64" height="64">
+            </picture>
+            <img src="https://raw.githubusercontent.com/zen-browser/desktop/dev/docs/assets/zen-browser.svg" alt="Zen Browser Text" width="156" height="64">
+          </a>
+        </p>
 
-        ## Important
-        - Please search existing issues to avoid creating duplicates.
-        - For enhancement requests, please use GitHub Discussions.
-        - Please fill out the template below to the best of your ability.
+        <p align="center"><em>Thank you for filing a bug report!</em></p>
+
+        > [!IMPORTANT]
+        > - Please provide descriptive titles. Bad titles do more harm than good.
+        > - Please search existing issues to avoid creating duplicates.
+        > - For enhancement requests, please use GitHub Discussions.
+        > - Please fill out the template below to the best of your ability.
+        > - Please describe the issue as much as possible and provide steps to reproduce it along with visual aids if possible.
   - type: checkboxes
     id: captchas
     attributes:
-      label: Captchas
-      description: Just making sure you did actually read the instructions.
+      label: Preliminary Checks
+      description: Please confirm the following before submitting a bug report. This helps us triage and resolve issues more efficiently.
       options:
-        - label: I have read the instructions.
+        - label: I have read and understood the important section above.
+          required: true
         - label: I have searched existing issues and avoided creating duplicates.
+          required: true
         - label: I am not filing an enhancement request.
+          required: true
+        - label: I have checked that this issue cannot be reproduced on Mozilla Firefox.
+          required: true
+        - label: I have checked that this issue can be reproduced once I removed all my Mods and Custom CSS.
+          required: true
   - type: textarea
     id: what-happened
     attributes:
       label: What happened?
-      description: Also tell us, what did you expect to happen?
+      description: Describe the bug clearly and concisely.
       placeholder: Tell us what you see!
     validations:
       required: true
-  - type: checkboxes
-    id: firefox
+  - type: input
+    id: expected-behavior
     attributes:
-      label: Reproducible?
-      description: Is this issue reproducible on Firefox?
-      options:
-        - label: I have checked that this issue cannot be reproduced on Mozilla Firefox.
+      label: Expected behavior
+      description: Please write a description of what was supposed to happen.
+    validations:
+      required: true
+  - type: input
+    id: actual-behavior
+    attributes:
+      label: Actual behavior
+      description: Please write a description of what actually happened.
+    validations:
+      required: true
+  - type: textarea
+    id: how-to-reproduce
+    attributes:
+      label: Steps to reproduce
+      description: Please Provide numbered steps to reproduce this issue so developers can replicate them easily.
+    validations:
+      required: true
+  - type: textarea
+    id: screenshots
+    attributes:
+      label: Screenshots and videos
+      description: |
+        If applicable, add screenshots or videos to help explain your problem.
   - type: input
     id: version
     attributes:
       label: Version
-      description: What version of our software are you running? Please DO NOT report Classic bugs.
-      placeholder: 1.0.0
+      description: What version of our software are you running? Please do not use "latest" or "newest" as version numbers. Go to `Help -> About Zen` to find the version number.
+      placeholder: 1.0.0b
     validations:
       required: true
   - type: dropdown
@@ -48,15 +88,48 @@ body:
       label: What platform are you seeing the problem on?
       multiple: true
       options:
-        - Linux
+        - Linux (AppImage)
+        - Linux (Flatpak)
+        - Linux (Tarball)
         - macOS - aarch64
         - macOS - Intel
-        - Windows
+        - Windows - aarch64
+        - Windows - x64
+        - Other
     validations:
       required: true
+  - type: dropdown
+    id: component
+    attributes:
+      label: What component is this issue related to?
+      options:
+        - Other
+        - Bookmarks
+        - Compact Mode
+        - Customizable UI / Toolbars
+        - Extensions
+        - Glance
+        - Keyboard Shortcuts
+        - Localization
+        - Media Controler
+        - Mods / Themes
+        - Performance
+        - Privacy
+        - Security
+        - Settings
+        - Split View
+        - Sync
+        - Tab Folders
+        - Tab unloading
+        - Tabs
+        - URL Bar
+        - Workspaces
+    validations:
+      required: true
+
   - type: textarea
     id: logs
     attributes:
-      label: Relevant log output
+      label: Relevant log output if applicable
       description: Please copy and paste any relevant log output. This will be automatically formatted into code, so no need for backticks.
       render: shell

.github/advanced-issue-labeler.yml

@@ -0,0 +1,58 @@
+policy:
+  - section:
+      - id: [component]
+        label:
+          # Make sure it's in sync with the dropdown in the issue template
+          - name: "component: sync"
+            keys: ["Sync"]
+          - name: "component: compact-mode"
+            keys: ["Compact Mode"]
+          - name: "component: workspaces"
+            keys: ["Workspaces"]
+          - name: "component: mods-themes"
+            keys: ["Mods / Themes"]
+          - name: "component: bookmarks"
+            keys: ["Bookmarks"]
+          - name: "component: glance"
+            keys: ["Glance"]
+          - name: "component: url-bar"
+            keys: ["URL Bar"]
+          - name: "component: tabs"
+            keys: ["Tabs"]
+          - name: "component: settings"
+            keys: ["Settings"]
+          - name: "component: privacy"
+            keys: ["Privacy"]
+          - name: "component: split-view"
+            keys: ["Split View"]
+          - name: "component: performance"
+            keys: ["Performance"]
+          - name: "component: media-controller"
+            keys: ["Media Controler"]
+          - name: "component: tab-unloading"
+            keys: ["Tab unloading"]
+          - name: "component: tab-folders"
+            keys: ["Tab Folders"]
+          - name: "component: keyboard-shortcuts"
+            keys: ["Keyboard Shortcuts"]
+          - name: "component: security"
+            keys: ["Security"]
+          - name: "component: extensions"
+            keys: ["Extensions"]
+          - name: "component: customizable-ui-toolbars"
+            keys: ["Customizable UI / Toolbars"]
+          - name: "component: localization"
+            keys: ["Localization"]
+          - name: "component: other"
+            keys: ["Other"]
+
+      - id: [platform]
+        block-list: ["Other"]
+        label:
+          # Make sure it's in sync with the dropdown in the issue template
+          - name: "platform: linux"
+            keys: ["Linux (AppImage)", "Linux (Flatpak)", "Linux (Tarball)"]
+          - name: "platform: macOS"
+            keys: ["macOS - aarch64", "macOS - Intel"]
+          - name: "platform: windows"
+            keys: ["Windows - x64", "Windows - aarch64"]

.github/workflows/build.yml

@@ -4,92 +4,130 @@ on:
   workflow_dispatch:
     inputs:
       create_release:
-        description: 'Create a new release for this build'
+        description: "Create a new release for this build"
         required: false
         default: false
-        type: 'boolean'
+        type: "boolean"
       update_version:
-        description: 'Update the version number'
+        description: "Update the version number"
         required: false
         default: false
-        type: 'boolean'
+        type: "boolean"
       update_branch:
-        description: 'Update branch with new version'
+        description: "Update branch with new version"
         required: true
-        default: 'beta'
-        type: 'choice'
+        default: "release"
+        type: "choice"
         options:
-          - 'beta'
-          - 'twilight'
+          - "release"
+          - "twilight"
+      use-sccache:
+        description: "Use sccache"
+        required: true
+        type: "boolean"
+        default: false
   workflow_call:
     inputs:
       create_release:
-        description: 'Create a new release for this build'
+        description: "Create a new release for this build"
         required: false
         default: false
-        type: 'boolean'
+        type: "boolean"
       update_version:
-        description: 'Update the version number'
+        description: "Update the version number"
         required: false
         default: false
-        type: 'boolean'
+        type: "boolean"
       update_branch:
-        description: 'Update branch with new version'
+        description: "Update branch with new version"
         required: true
-        default: 'beta'
-        type: 'string'
+        default: "release"
+        type: "string"
+      use-sccache:
+        description: "Use sccache"
+        required: true
+        type: "boolean"
+        default: false
 
 jobs:
-  debug-inputs:
-    name: Debug inputs
+  buildid:
+    name: Generate build ID
     runs-on: ubuntu-latest
-    steps:
-      - name: Debug
-        run: |
-          echo "create_release: ${{ inputs.create_release }}"
-          echo "update_version: ${{ inputs.update_version }}"
-          echo "update_branch: ${{ inputs.update_branch }}"
-          echo "GITHUB_REPOSITORY: ${{ github.repository }}"
-          echo "GITHUB_REPOSITORY_OWNER: ${{ github.repository_owner }}"
-          echo "GITHUB_REPOSITORY_OWNER: ${{ github.repository_owner }}"
-          echo "GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}"
-
-  check-build-is-correct:
-    runs-on: ubuntu-latest
-    needs: [debug-inputs]
+    outputs:
+      buildids: ${{ steps.get.outputs.bid }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
           submodules: recursive
           token: ${{ secrets.DEPLOY_KEY }}
-          fetch-depth: 0
+
+      - id: get
+        shell: bash -xe {0}
+        run: |
+          bdat=`date +"%Y%m%d%I%M%S"`
+          echo "bid=${bdat}" >> $GITHUB_OUTPUT
+
+      - name: Debug
+        run: |
+          echo "create_release: ${{ inputs.create_release }}"
+          echo "update_version: ${{ inputs.update_version }}"
+          echo "use sccache: ${{ inputs.use-sccache }}"
+          echo "update_branch: ${{ inputs.update_branch }}"
+          echo "GITHUB_REPOSITORY: ${{ github.repository }}"
+          echo "GITHUB_REPOSITORY_OWNER: ${{ github.repository_owner }}"
+          echo "GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}"
 
       - name: Check if correct branch
+        if: ${{ inputs.create_release }}
         run: |
           echo "Checking if we are on the correct branch"
           git branch
           git status
           git branch --show-current
           branch="${{ inputs.update_branch }}"
-          if [[ $branch == "beta" ]]; then
-            branch="stable"
-          elif [[ $branch == "twilight" ]]; then
+          if [[ $branch == "twilight" ]]; then
             branch="dev"
+          elif [[ $branch == "release" ]]; then
+            branch="stable"
           fi
           if [[ $(git branch --show-current) != $branch ]]; then
             echo ">>> Branch mismatch"
-            exit 1
+          # exit 1
           else
             echo ">>> Branch matches"
           fi
 
+  start-self-host:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download aws-cli
+        if: ${{ inputs.create_release && inputs.update_branch == 'release' }}
+        run: |
+          curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
+          unzip awscliv2.zip
+          sudo ./aws/install --update
+
+      - name: Start self-hosted runner
+        if: ${{ inputs.create_release && inputs.update_branch == 'release' }}
+        run: |
+          echo "Starting self-hosted runner"
+          echo "${{ secrets.SELF_HOSTED_RUNNER_START_SCRIPT }}" | base64 -d > start.sh
+          sudo chmod +x start.sh
+          bash ./start.sh
+
+      - name: Remove self-hosted runner script
+        if: always() && ${{ inputs.create_release && inputs.update_branch == 'release' }}
+        run: |
+          echo "Removing self-hosted runner script"
+          rm start.sh || true
+
   build-data:
     permissions:
       contents: write
     name: Generate build data
     runs-on: ubuntu-latest
-    needs: check-build-is-correct
+    needs: buildid
     outputs:
       build_date: ${{ steps.data.outputs.builddate }}
       version: ${{ steps.data.outputs.version }}
@@ -102,36 +140,27 @@ jobs:
           token: ${{ secrets.DEPLOY_KEY }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: useblacksmith/setup-node@v5
         with:
-          node-version-file: '.nvmrc'
-
-      - name: Setup pnpm
-        run: npm install -g pnpm
-
-      - name: Get pnpm store directory
-        id: pnpm-cache
-        shell: bash
-        run: |
-          echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT
+          node-version-file: ".nvmrc"
 
       - name: Install dependencies
         run: |
-          pnpm install
+          npm ci
 
       - name: Setup Surfer
         run: |
           npm i -g @zen-browser/surfer
 
       - name: Bump version
-        if: ${{ inputs.update_version && inputs.update_branch == 'beta' }}
+        if: ${{ inputs.update_version && inputs.update_branch == 'release' }}
         run: |
-          pnpm surfer ci --brand ${{ inputs.update_branch }} --bump prerelease
+          npm run surfer -- ci --brand ${{ inputs.update_branch }} --bump prerelease
 
       - name: Bump version without new version
         if: ${{ !inputs.update_version || inputs.update_branch == 'twilight' }}
         run: |
-          pnpm surfer ci --brand ${{ inputs.update_branch }}
+          npm run surfer -- ci --brand ${{ inputs.update_branch }}
 
       - name: Debug
         run: |
@@ -166,22 +195,13 @@ jobs:
           token: ${{ secrets.DEPLOY_KEY }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: useblacksmith/setup-node@v5
         with:
-          node-version-file: '.nvmrc'
-
-      - name: Setup pnpm
-        run: npm install -g pnpm
-
-      - name: Get pnpm store directory
-        id: pnpm-cache
-        shell: bash
-        run: |
-          echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT
+          node-version-file: ".nvmrc"
 
       - name: Install dependencies
         run: |
-          pnpm install
+          npm ci
 
       - name: Setup Surfer
         run: |
@@ -189,15 +209,14 @@ jobs:
 
       - name: Activate Surfer CLI
         run: |
-          echo "There's a bug in the Surfer CLI, we run this so that Surfer sets everything up correctly"
-          pnpm surfer ci --brand ${{ inputs.update_branch }} --display-version ${{ needs.build-data.outputs.version }}
+          npm run surfer -- ci --brand ${{ inputs.update_branch }} --display-version ${{ needs.build-data.outputs.version }}
 
       - name: Check version
         run: |
           echo "$(pwd)"
-          ls .
-          echo "version=$(pnpm surfer get version | xargs)" >> $GITHUB_OUTPUT
-          if [[ $(pnpm surfer get version | xargs) == ${{ needs.build-data.outputs.version }} ]]; then
+          echo $(npm run --silent surfer -- get version | xargs)
+          echo "version=$(npm run --silent surfer -- get version | xargs)" >> $GITHUB_OUTPUT
+          if [[ $(npm run --silent surfer -- get version | xargs) == ${{ needs.build-data.outputs.version }} ]]; then
             echo ">>> Version matches"
           else
             echo ">>> Version mismatch"
@@ -218,62 +237,60 @@ jobs:
           token: ${{ secrets.DEPLOY_KEY }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: useblacksmith/setup-node@v5
         with:
-          node-version-file: '.nvmrc'
+          node-version-file: ".nvmrc"
 
       - name: Setup Git
         run: |
-          git config --global user.email "mauro-balades@users.noreply.github.com"
-          git config --global user.name "mauro-balades"
-
-      - name: Setup pnpm
-        run: npm install -g pnpm
-
-      - name: Get pnpm store directory
-        id: pnpm-cache
-        shell: bash
-        run: |
-          echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
 
       - name: Install dependencies
         run: |
-          pnpm install
+          npm ci
 
       - name: Load Surfer CI setup
-        run: pnpm surfer ci --brand ${{ inputs.update_branch }} --display-version ${{ needs.build-data.outputs.version }}
+        run: npm run surfer -- ci --brand ${{ inputs.update_branch }} --display-version ${{ needs.build-data.outputs.version }}
 
       - name: Download Firefox source and dependencies
-        run: pnpm surfer download --verbose
+        run: npm run download --verbose
 
       - name: Import
-        run: pnpm surfer import --verbose
+        run: npm run import -- --verbose
+
+      - name: Build language packs
+        run: sh scripts/download-language-packs.sh
 
       - name: Compress
         run: |
-          cd engine
-          tar --use-compress-program=zstd -hcf ../zen.source.tar.gz *
-          cd ..
+          tar \
+            --exclude='./.git' \
+            --use-compress-program=zstd \
+            -hcf zen.source.tar.zst \
+            -C engine .
 
       - name: Upload artifact
         uses: actions/upload-artifact@v4
         with:
           retention-days: 5
-          name: zen.source.tar.gz
-          path: ./zen.source.tar.gz
+          name: zen.source.tar.zst
+          path: ./zen.source.tar.zst
 
   windows-step-1:
     name: Windows build step 1 (PGO build)
     uses: ./.github/workflows/windows-release-build.yml
-    needs: [build-data]
+    needs: [build-data, buildid]
     permissions:
       contents: write
     secrets: inherit
     with:
+      use-sccache: ${{ inputs.use-sccache }}
       build-version: ${{ needs.build-data.outputs.version }}
       generate-gpo: true
       profile-data-path-archive: zen-windows-profile-data-and-jarlog.zip
       release-branch: ${{ inputs.update_branch }}
+      MOZ_BUILD_DATE: ${{needs.buildid.outputs.buildids}}
 
   windows-step-2:
     name: Windows build step 2 (Generate profile data)
@@ -293,11 +310,13 @@ jobs:
     permissions:
       contents: write
     secrets: inherit
-    needs: [build-data, windows-step-2]
+    needs: [build-data, windows-step-2, start-self-host, buildid]
     with:
       build-version: ${{ needs.build-data.outputs.version }}
       generate-gpo: false
       release-branch: ${{ inputs.update_branch }}
+      MOZ_BUILD_DATE: ${{needs.buildid.outputs.buildids}}
+      use-sccache: ${{ inputs.use-sccache }}
 
   linux:
     name: Linux build
@@ -305,10 +324,12 @@ jobs:
     permissions:
       contents: write
     secrets: inherit
-    needs: [build-data]
+    needs: [build-data, start-self-host, buildid]
     with:
       build-version: ${{ needs.build-data.outputs.version }}
       release-branch: ${{ inputs.update_branch }}
+      MOZ_BUILD_DATE: ${{needs.buildid.outputs.buildids}}
+      use-sccache: ${{ inputs.use-sccache }}
 
   mac:
     name: macOS build
@@ -316,7 +337,20 @@ jobs:
     permissions:
       contents: write
     secrets: inherit
-    needs: [build-data]
+    needs: [build-data, buildid]
+    with:
+      build-version: ${{ needs.build-data.outputs.version }}
+      release-branch: ${{ inputs.update_branch }}
+      MOZ_BUILD_DATE: ${{needs.buildid.outputs.buildids}}
+      use-sccache: ${{ inputs.use-sccache }}
+
+  mac-uni:
+    name: macOS build (Universal)
+    uses: ./.github/workflows/macos-universal-release-build.yml
+    permissions:
+      contents: write
+    secrets: inherit
+    needs: [build-data, mac]
     with:
       build-version: ${{ needs.build-data.outputs.version }}
       release-branch: ${{ inputs.update_branch }}
@@ -329,7 +363,7 @@ jobs:
     strategy:
       matrix:
         arch: [x86_64, aarch64]
-    needs: [linux]
+    needs: [linux, build-data]
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -338,48 +372,57 @@ jobs:
           token: ${{ secrets.DEPLOY_KEY }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: useblacksmith/setup-node@v5
         with:
-          node-version-file: '.nvmrc'
+          node-version-file: ".nvmrc"
 
       - name: Install dependencies
         run: |
-          npm install -g pnpm
+          npm ci
           sudo apt-get update
           sudo apt-get -y install libfuse2 desktop-file-utils appstream
 
       - name: Download Linux build
         uses: actions/download-artifact@v4
         with:
-          name: zen.linux-${{ matrix.arch }}.tar.bz2
+          name: zen.linux-${{ matrix.arch }}.tar.xz
 
       - name: Execute AppImage build
         run: |
           set -eux
-          rm AppDir/.DirIcon || true
-          cp configs/branding/${{ inputs.update_branch }}/logo128.png AppDir/usr/share/icons/hicolor/128x128/apps/zen.png
-          cp configs/branding/${{ inputs.update_branch }}/logo128.png AppDir/zen.png && ln -s zen.png AppDir/.DirIcon
+          export ARCH=${{ matrix.arch }}
+          UPINFO="gh-releases-zsync|$GITHUB_REPOSITORY_OWNER|desktop|latest|zen-$ARCH.AppImage.zsync"
+          rm build/AppDir/.DirIcon || true
+          cp configs/branding/${{ inputs.update_branch }}/logo128.png build/AppDir/usr/share/icons/hicolor/128x128/apps/zen.png
+          cp configs/branding/${{ inputs.update_branch }}/logo128.png build/AppDir/zen.png && ln -s zen.png build/AppDir/.DirIcon
 
           if [ "${{ inputs.update_branch }}" = "twilight" ]; then
-            sed -i -e 's/Name=Zen Browser/Name=Zen Twilight/g' AppDir/zen.desktop
-            sed -i -e 's/StartupWMClass=zen-beta/StartupWMClass=zen-twilight/g' AppDir/zen.desktop
+            sed -i -e 's/Name=Zen Browser/Name=Zen Twilight/g' build/AppDir/zen.desktop
+            sed -i -e 's/StartupWMClass=zen/StartupWMClass=zen-twilight/g' build/AppDir/zen.desktop
           fi
 
-          APPDIR=AppDir
+          sed -i -e 's/\$VERSION/${{ needs.build-data.outputs.version }}/g' build/AppDir/zen.desktop
+
+          APPDIR=build/AppDir
           tar -xvf *.tar.* && rm -rf *.tar.*
           mv zen/* $APPDIR/
-          wget https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-x86_64.AppImage
+          wget "https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-x86_64.AppImage"
+          wget "https://github.com/VHSgunzo/uruntime/releases/latest/download/uruntime-appimage-squashfs-lite-$ARCH"
           chmod +x *.AppImage
-          chmod +x ./AppDir/AppRun
+          chmod +x ./uruntime-appimage-squashfs-lite-"$ARCH"
+          chmod +x ./build/AppDir/AppRun
+
+          # keep the uruntime mountpoint (massively speeds up launch time)
+          sed -i 's|URUNTIME_MOUNT=[0-9]|URUNTIME_MOUNT=0|' ./uruntime-appimage-squashfs-lite-"$ARCH"
+
           echo "AppDir: $APPDIR"
           ls -al
           find .
           ls -al "$APPDIR"
-          ARCH=${{ matrix.arch }} ./appimagetool-x86_64.AppImage --comp zstd --mksquashfs-opt -Xcompression-level --mksquashfs-opt 10 \
-          -u "gh-releases-zsync|$GITHUB_REPOSITORY_OWNER|desktop|latest|zen-${{ matrix.arch }}.AppImage.zsync" \
-          "$APPDIR" zen-${{ matrix.arch }}.AppImage
+          ./appimagetool-x86_64.AppImage -u "$UPINFO" "$APPDIR" zen-"$ARCH".AppImage --runtime-file ./uruntime-appimage-squashfs-lite-"$ARCH"
           mkdir dist
           mv zen*AppImage* dist/.
+          unset ARCH
 
       - name: Upload artifact
         uses: actions/upload-artifact@v4
@@ -395,14 +438,50 @@ jobs:
           name: zen-${{ matrix.arch }}.AppImage.zsync
           path: ./dist/zen-${{ matrix.arch }}.AppImage.zsync
 
+  stop-self-hosted:
+    runs-on: ubuntu-latest
+    needs: [windows-step-3, linux]
+    if: always()
+    steps:
+      - name: Download aws-cli
+        if: ${{ inputs.create_release && inputs.update_branch == 'release' }}
+        run: |
+          curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
+          unzip awscliv2.zip
+          sudo ./aws/install --update
+
+      - name: Stop self-hosted runner
+        if: ${{ inputs.create_release && inputs.update_branch == 'release' }}
+        run: |
+          echo "Stopping self-hosted runner"
+          echo "${{ secrets.SELF_HOSTED_RUNNER_STOP_SCRIPT }}" | base64 -d > stop.sh
+          sudo chmod +x stop.sh
+          bash ./stop.sh > /dev/null
+
+      - name: Remove self-hosted runner script
+        if: always() && ${{ inputs.create_release && inputs.update_branch == 'release' }}
+        run: |
+          echo "Removing self-hosted runner script"
+          rm stop.sh || true
+
   release:
     if: ${{ inputs.create_release || inputs.update_branch == 'twilight' }}
     permissions: write-all
     name: Release
-    needs: [build-data, linux, windows-step-3, check-release, mac, appimage, source]
-    runs-on: ubuntu-latest
+    needs:
+      [
+        build-data,
+        linux,
+        windows-step-3,
+        check-release,
+        mac-uni,
+        appimage,
+        source,
+        stop-self-hosted,
+      ]
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     environment:
-      name: ${{ inputs.update_branch == 'beta' && 'Deploy-Release' || 'Deploy-Twilight' }}
+      name: ${{ inputs.update_branch == 'release' && 'Deploy-Release' || 'Deploy-Twilight' }}
 
     steps:
       - name: Checkout repository
@@ -411,16 +490,9 @@ jobs:
           submodules: recursive
           token: ${{ secrets.DEPLOY_KEY }}
 
-      - name: Git pull
-        run: |
-          git pull
-
       - name: Download artifact
         uses: actions/download-artifact@v4
 
-      - name: List
-        run: find .
-
       - name: Checkout updates repository
         uses: actions/checkout@v4
         with:
@@ -429,19 +501,39 @@ jobs:
           token: ${{ secrets.DEPLOY_KEY }}
 
       - name: Download object files
+        if: ${{ inputs.update_branch == 'release' }}
         run: |
-          git clone https://github.com/zen-browser/windows-binaries.git .github/workflows/object
+          git clone https://github.com/zen-browser/windows-binaries.git .github/workflows/object --depth 1
+
+      - name: Sign MAR files
+        env:
+          SIGNMAR: ${{ github.workspace }}/linux-bin-x86_64/signmar
+          ZEN_MAR_SIGNING_PASSWORD: ${{ secrets.ZEN_MAR_SIGNING_PASSWORD }}
+          ZEN_SIGNING_CERT_PEM_BASE64: ${{ secrets.ZEN_SIGNING_CERT_PEM_BASE64 }}
+          ZEN_SIGNING_PRIVATE_KEY_PEM_BASE64: ${{ secrets.ZEN_SIGNING_PRIVATE_KEY_PEM_BASE64 }}
+        run: |
+          bash scripts/mar_sign.sh -s
+
+      - name: Verify MARs and update manifests
+        env:
+          SIGNMAR: ${{ github.workspace }}/linux-bin-x86_64/signmar
+          RELEASE_BRANCH: ${{ inputs.update_branch }}
+        run: |
+          bash scripts/mar_verify.sh
 
       - name: Copy update manifests
         env:
           RELEASE_BRANCH: ${{ inputs.update_branch }}
         run: |
+          # IMPORTANT: If changing any of these names,
+          # make sure to also update the paths in the mar_sign.sh script
+
           cd updates-server
           mkdir -p updates
           cp -a ../linux_update_manifest_x86_64/.  updates/
           cp -a ../linux_update_manifest_aarch64/.  updates/
 
-          if [[ $RELEASE_BRANCH == 'beta' ]]; then
+          if [[ $RELEASE_BRANCH == 'release' ]]; then
             cp -a ../.github/workflows/object/windows-x64-signed-x86_64/update_manifest/.  updates/
             cp -a ../.github/workflows/object/windows-x64-signed-arm64/update_manifest/.  updates/
           else
@@ -449,8 +541,7 @@ jobs:
             cp -a ../windows_update_manifest_arm64/.  updates/
           fi
 
-          cp -a ../macos_update_manifest_aarch64/.  updates/
-          cp -a ../macos_update_manifest_x86_64/.  updates/
+          cp -a ../macos_update_manifest/.  updates/
 
       - name: Commit
         uses: stefanzweifel/git-auto-commit-action@v5
@@ -460,70 +551,73 @@ jobs:
           commit_user_email: zen-browser-auto@users.noreply.github.com
           repository: ./updates-server
 
+      - name: Generate Release Notes
+        env:
+          RELEASE_BRANCH: ${{ inputs.update_branch }}
+        run: bash .github/workflows/src/generate_release_notes.sh
+
         # If we are on Twilight, we want to just update the Twilight tag's release
       - name: Update Twilight tag
         if: ${{ inputs.update_branch == 'twilight' }}
-        uses: marvinpinto/action-automatic-releases@master
+        uses: softprops/action-gh-release@v2.2.2
         with:
+          body_path: release_notes.md
           files: |
-            zen.source.tar.gz
-            zen.linux-x86_64.tar.bz2
-            zen.linux-aarch64.tar.bz2
-            zen-x86_64.AppImage
-            zen-x86_64.AppImage.zsync
-            zen-aarch64.AppImage
-            zen-aarch64.AppImage.zsync
-            zen.win-x86_64.zip
-            zen.win-arm64.zip
-            linux.mar
-            linux-aarch64.mar
-            windows.mar
-            windows-arm64.mar
-            macos-x86_64.mar
-            macos-aarch64.mar
-            zen.installer.exe
-            zen.installer-arm64.exe
-            zen.macos-x86_64.dmg
-            zen.macos-aarch64.dmg
-          automatic_release_tag: 'twilight'
-          title: 'Twilight build - ${{ needs.build-data.outputs.version }} (${{ needs.build-data.outputs.build_date }} at ${{ needs.build-data.outputs.build_time }})'
+            ./zen.source.tar.zst/*
+            ./zen.linux-x86_64.tar.xz/*
+            ./zen.linux-aarch64.tar.xz/*
+            ./zen-x86_64.AppImage/*
+            ./zen-x86_64.AppImage.zsync/*
+            ./zen-aarch64.AppImage/*
+            ./zen-aarch64.AppImage.zsync/*
+            ./linux.mar/*
+            ./linux-aarch64.mar/*
+            ./windows.mar/*
+            ./windows-arm64.mar/*
+            ./macos.mar/*
+            ./zen.installer.exe/*
+            ./zen.installer-arm64.exe/*
+            ./zen.macos-universal.dmg/*
+          tag_name: "twilight-1"
+          name: "Twilight build - ${{ needs.build-data.outputs.version }} (${{ needs.build-data.outputs.build_date }} at ${{ needs.build-data.outputs.build_time }})"
           draft: false
+          generate_release_notes: false
           prerelease: true
-          repo_token: ${{ github.token }}
+          token: ${{ secrets.DEPLOY_KEY }}
+          fail_on_unmatched_files: false
         env:
           GITHUB_REPOSITORY: ${{ github.repository }}
 
       - name: Release
-        uses: marvinpinto/action-automatic-releases@master
-        if: ${{ inputs.update_branch == 'beta' }}
+        uses: softprops/action-gh-release@v2.2.2
+        if: ${{ inputs.update_branch == 'release' }}
         with:
-          repo_token: '${{ secrets.DEPLOY_KEY }}'
-          automatic_release_tag: ${{ needs.build-data.outputs.version }}
+          token: ${{ secrets.DEPLOY_KEY }}
+          tag_name: ${{ needs.build-data.outputs.version }}
           prerelease: false
-          title: 'Beta build - ${{ needs.build-data.outputs.version }} (${{ needs.build-data.outputs.build_date }})'
+          fail_on_unmatched_files: false
+          generate_release_notes: false
+          name: "Release build - ${{ needs.build-data.outputs.version }} (${{ needs.build-data.outputs.build_date }})"
+          body_path: release_notes.md
           files: |
-            zen.source.tar.gz
-            zen.linux-x86_64.tar.bz2
-            zen.linux-aarch64.tar.bz2
-            zen-x86_64.AppImage
-            zen-x86_64.AppImage.zsync
-            zen-aarch64.AppImage
-            zen-aarch64.AppImage.zsync
-            .github/workflows/object/windows-x64-signed-x86_64/zen.win-x86_64.zip
-            .github/workflows/object/windows-x64-signed-arm64/zen.win-arm64.zip
-            linux.mar
-            linux-aarch64.mar
-            .github/workflows/object/windows-x64-signed-x86_64/windows.mar
-            .github/workflows/object/windows-x64-signed-arm64/windows-arm64.mar
-            macos-x86_64.mar
-            macos-aarch64.mar
-            .github/workflows/object/windows-x64-signed-x86_64/zen.installer.exe
-            .github/workflows/object/windows-x64-signed-arm64/zen.installer-arm64.exe
-            zen.macos-x86_64.dmg
-            zen.macos-aarch64.dmg
+            ./zen.source.tar.zst/*
+            ./zen.linux-x86_64.tar.xz/*
+            ./zen.linux-aarch64.tar.xz/*
+            ./zen-x86_64.AppImage/*
+            ./zen-x86_64.AppImage.zsync/*
+            ./zen-aarch64.AppImage/*
+            ./zen-aarch64.AppImage.zsync/*
+            ./linux.mar/*
+            ./linux-aarch64.mar/*
+            ./.github/workflows/object/windows-x64-signed-x86_64/windows.mar
+            ./.github/workflows/object/windows-x64-signed-arm64/windows-arm64.mar
+            ./macos.mar/*
+            ./.github/workflows/object/windows-x64-signed-x86_64/zen.installer.exe
+            ./.github/workflows/object/windows-x64-signed-arm64/zen.installer-arm64.exe
+            ./zen.macos-universal.dmg/*
 
   prepare-flatpak:
-    if: ${{ inputs.create_release && inputs.update_branch == 'beta' }}
+    if: ${{ inputs.create_release && inputs.update_branch == 'release' }}
     permissions: write-all
     name: Prepare Flatpak
     needs: [release, linux, build-data]
@@ -540,7 +634,7 @@ jobs:
         run: |
           git pull
           sudo apt-get update
-          npm install
+          npm ci
 
       - name: Generate new Flatpak release
         run: |
@@ -566,14 +660,14 @@ jobs:
           pwd
           ls .
           ls ..
-          mv releases.xml ./flatpak/io.github.zen_browser.zen.metainfo.xml
+          mv releases.xml ./flatpak/app.zen_browser.zen.metainfo.xml
           # output the version to the file
           echo -n ${{ needs.build-data.outputs.version }} > ./flatpak/version
 
       - name: Commit
         uses: stefanzweifel/git-auto-commit-action@v5
         with:
-          commit_message: '[release]: Update Flatpak manifest'
+          commit_message: "[release]: Update Flatpak manifest"
           commit_user_name: Zen Browser Robot
           commit_user_email: zen-browser-auto@users.noreply.github.com
           repository: ./flatpak
@@ -582,7 +676,7 @@ jobs:
         run: sleep 120
 
   release-flatpak:
-    if: ${{ inputs.create_release && inputs.update_branch == 'beta' }}
+    if: ${{ inputs.create_release && inputs.update_branch == 'release' }}
     permissions: write-all
     name: Release Flatpak
     needs: [prepare-flatpak, build-data]
@@ -592,13 +686,18 @@ jobs:
       - name: Checkout Flatpak repository
         uses: actions/checkout@v4
         with:
-          repository: flathub/io.github.zen_browser.zen
+          repository: flathub/app.zen_browser.zen
           token: ${{ secrets.DEPLOY_KEY }}
 
       - name: Download Linux x86_64 build
         uses: actions/download-artifact@v4
         with:
-          name: zen.linux-x86_64.tar.bz2
+          name: zen.linux-x86_64.tar.xz
+
+      - name: Download Linux aarch64 build
+        uses: actions/download-artifact@v4
+        with:
+          name: zen.linux-aarch64.tar.xz
 
       - name: Update repository
         uses: actions/checkout@v4
@@ -620,27 +719,29 @@ jobs:
           python3 ./zen-browser/scripts/prepare-flatpak-release.py \
             --flatpak-archive archive.tar \
             --version ${{ needs.build-data.outputs.version }} \
-            --linux-archive zen.linux-x86_64.tar.bz2 \
-            --output io.github.zen_browser.zen.yml \
-            --template-root ./zen-browser/flatpak
+            --linux-archive zen.linux-x86_64.tar.xz \
+            --linux-aarch64-archive zen.linux-aarch64.tar.xz \
+            --output app.zen_browser.zen.yml \
+            --template-root ./zen-browser/build/flatpak
 
       - name: Commit changes
         run: |
-          git add io.github.zen_browser.zen.yml
+          git add app.zen_browser.zen.yml
           git commit -m "Update to version ${{ needs.build-data.outputs.version }}"
 
       - name: Clean up
         run: |
           rm -rf zen-browser
           rm -rf archive.tar
-          rm -rf zen.linux-x86_64.tar.bz2
+          rm -rf zen.linux-x86_64.tar.xz
+          rm -rf zen.linux-aarch64.tar.xz
 
       - name: Upload Flatpak manifest
         uses: actions/upload-artifact@v4
         with:
           retention-days: 5
-          name: io.github.zen_browser.zen.yml
-          path: ./io.github.zen_browser.zen.yml
+          name: app.zen_browser.zen.yml
+          path: ./app.zen_browser.zen.yml
 
       - name: Create pull request
         uses: peter-evans/create-pull-request@v7
@@ -649,8 +750,8 @@ jobs:
           GIT_CURL_VERBOSE: 1
         with:
           token: ${{ secrets.DEPLOY_KEY }}
-          commit-message: 🚀 Update to version ${{ needs.build-data.outputs.version }}
-          title: 🚀 Update to version ${{ needs.build-data.outputs.version }}
+          commit-message: Update to version `${{ needs.build-data.outputs.version }}`
+          title: Update to version `${{ needs.build-data.outputs.version }}`
           body: |
             This PR updates the Zen Browser Flatpak package to version ${{ needs.build-data.outputs.version }}.
 

.github/workflows/check-candidate-release.yml

@@ -0,0 +1,34 @@
+name: Check Firefox Candidate Release
+
+on:
+  schedule:
+    - cron: "59 4 * * 2"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  check_candidates:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v3
+
+      - name: Check for any updates
+        env:
+          DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
+          DISCORD_PING_IDS: ${{ secrets.DISCORD_PING_IDS }}
+        run: |
+          python3 scripts/check_rc_response.py
+
+  sync-upstream:
+    name: Sync Upstream
+    uses: ./.github/workflows/sync-upstream.yml
+    permissions:
+      contents: write
+    secrets: inherit
+    needs: [check_candidates]
+    with:
+      release_candidate: true

.github/workflows/clear-all-cache.yml

@@ -0,0 +1,25 @@
+name: Cleanup cache
+on:
+  workflow_dispatch:
+
+jobs:
+  cleanup:
+    runs-on: ubuntu-latest
+    permissions: write-all
+    steps:
+      - name: Cleanup
+        run: |
+          echo "Fetching list of cache key"
+          cacheKeysForPR=$(gh cache list --limit 1000 --json id --jq '.[].id')
+
+          ## Setting this to not fail the workflow while deleting cache keys.
+          set +e
+          echo "Deleting caches..."
+          for cacheKey in $cacheKeysForPR
+          do
+              gh cache delete $cacheKey
+          done
+          echo "Done"
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}

.github/workflows/clear-cache.yml

@@ -1,33 +0,0 @@
-name: Clear cache
-
-on:
-  workflow_dispatch:
-
-permissions:
-  actions: write
-
-jobs:
-  clear-cache:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Clear cache
-        uses: actions/github-script@v7
-        with:
-          script: |
-            console.log("About to clear")
-            const caches = await github.rest.actions.getActionsCacheList({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-            })
-            
-            for (const cache of caches.data.actions_caches) {
-              console.log(cache)
-              await github.rest.actions.deleteActionsCacheById({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                cache_id: cache.id,
-              })
-            }
-            
-            console.log("Clear completed")

.github/workflows/issue-labeler.yml

@@ -0,0 +1,34 @@
+name: Issue labeler
+on:
+  issues:
+    types: [opened]
+
+permissions:
+  contents: read
+
+jobs:
+  label-component:
+    runs-on: ubuntu-latest
+
+    permissions:
+      # required for all workflows
+      issues: write
+
+      # only required for workflows in private repositories
+      actions: read
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Parse issue form
+        uses: stefanbuck/github-issue-parser@v3
+        id: issue-parser
+        with:
+          template-path: .github/ISSUE_TEMPLATE/bug_report.yml
+
+      - name: Set labels based on animals field
+        uses: redhat-plumbers-in-action/advanced-issue-labeler@v2
+        with:
+          issue-form: ${{ steps.issue-parser.outputs.jsonString }}
+          token: ${{ secrets.DEPLOY_KEY }}

.github/workflows/issue-metrics.yml

@@ -1,8 +1,11 @@
 name: Monthly issue metrics
+permissions:
+  contents: write
+  issues: read
 on:
   workflow_dispatch:
   schedule:
-    - cron: '3 2 1 * *'
+    - cron: "3 2 1 * *"
 
 jobs:
   build:
@@ -10,56 +13,55 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+        with:
+          token: ${{ secrets.DEPLOY_KEY }}
 
-    - name: Checkout code
-      uses: actions/checkout@v2
-      with:
-        token: ${{ secrets.DEPLOY_KEY }}
+      - name: Get dates for last month
+        shell: bash
+        run: |
+          # Get the current date
+          current_date=$(date +'%Y-%m-%d')
 
-    - name: Get dates for last month
-      shell: bash
-      run: |
-        # Get the current date
-        current_date=$(date +'%Y-%m-%d')
+          # Calculate the previous month
+          previous_date=$(date -d "$current_date -1 month" +'%Y-%m-%d')
 
-        # Calculate the previous month
-        previous_date=$(date -d "$current_date -1 month" +'%Y-%m-%d')
+          # Extract the year and month from the previous date
+          previous_year=$(date -d "$previous_date" +'%Y')
+          previous_month=$(date -d "$previous_date" +'%m')
 
-        # Extract the year and month from the previous date
-        previous_year=$(date -d "$previous_date" +'%Y')
-        previous_month=$(date -d "$previous_date" +'%m')
+          # Calculate the first day of the previous month
+          first_day=$(date -d "$previous_year-$previous_month-01" +'%Y-%m-%d')
 
-        # Calculate the first day of the previous month
-        first_day=$(date -d "$previous_year-$previous_month-01" +'%Y-%m-%d')
+          # Calculate the last day of the previous month
+          last_day=$(date -d "$first_day +1 month -1 day" +'%Y-%m-%d')
 
-        # Calculate the last day of the previous month
-        last_day=$(date -d "$first_day +1 month -1 day" +'%Y-%m-%d')
+          echo "$first_day..$last_day"
+          echo "last_month=$first_day..$last_day" >> "$GITHUB_ENV"
+          echo "last_month_year=$previous_year" >> "$GITHUB_ENV"
 
-        echo "$first_day..$last_day"
-        echo "last_month=$first_day..$last_day" >> "$GITHUB_ENV"
-        echo "last_month_year=$previous_year" >> "$GITHUB_ENV"
+      - name: Run issue-metrics tool
+        uses: github-community-projects/issue-metrics@v2
+        env:
+          GH_TOKEN: ${{ secrets.DEPLOY_KEY }}
+          HIDE_AUTHOR: true
+          HIDE_TIME_TO_ANSWER: true
+          SEARCH_QUERY: "repo:zen-browser/desktop is:issue created:${{ env.last_month }}"
 
-    - name: Run issue-metrics tool
-      uses: github/issue-metrics@v2
-      env:
-        GH_TOKEN: ${{ secrets.DEPLOY_KEY }}
-        HIDE_AUTHOR: true
-        HIDE_TIME_TO_ANSWER: true
-        SEARCH_QUERY: 'repo:zen-browser/desktop is:issue created:${{ env.last_month }} -reason:"not planned"'
+      - name: Move metrics to docs folder
+        run: |
+          mkdir -p docs/issue-metrics
+          rm -f docs/issue-metrics/${{ env.last_month_year }}_${{ env.last_month }}.md
+          mv issue_metrics.md docs/issue-metrics/${{ env.last_month_year }}_${{ env.last_month }}.md
 
-    - name: Move metrics to docs folder
-      run: |
-        mkdir -p docs/issue-metrics
-        rm -f docs/issue-metrics/${{ env.last_month_year }}_${{ env.last_month }}.md
-        mv issue_metrics.md docs/issue-metrics/${{ env.last_month_year }}_${{ env.last_month }}.md
+      - name: Remove metrisc JSON
+        run: |
+          rm -f issue_metrics.json
 
-    - name: Remove metrisc JSON
-      run: |
-        rm -f issue_metrics.json
-
-    - name: Commit changes
-      uses: stefanzweifel/git-auto-commit-action@v5
-      with:
-        commit_message: 'Update monthly issue metrics'
-        commit_user_name: Zen Browser Robot
-        commit_user_email: zen-browser-auto@users.noreply.github.com
+      - name: Commit changes
+        uses: stefanzweifel/git-auto-commit-action@v5
+        with:
+          commit_message: "docs: Update monthly issue metrics, b=(no bug), c={docs}"
+          commit_user_name: Zen Browser Robot
+          commit_user_email: zen-browser-auto@users.noreply.github.com

.github/workflows/linux-release-build.yml

@@ -4,23 +4,37 @@ on:
   workflow_call:
     inputs:
       build-version:
-        description: 'The version to build'
+        description: "The version to build"
         required: true
         type: string
       release-branch:
-        description: 'The branch to build'
+        description: "The branch to build"
         required: true
         type: string
+      MOZ_BUILD_DATE:
+        type: string
+        required: true
+        default: ""
+      use-sccache:
+        description: "Use sccache"
+        required: true
+        type: boolean
+        default: false
 
 jobs:
   build-linux:
     permissions:
       contents: write
-    runs-on: ubuntu-latest
+    # aarch64 does not need full 16x
+    runs-on: ${{ (inputs.release-branch == 'release' && matrix.arch == 'x86_64') && 'self-hosted' || 'blacksmith-8vcpu-ubuntu-2404' }}
     strategy:
       fail-fast: false
       matrix:
         arch: [x86_64, aarch64]
+    env:
+      SCCACHE_GHA_ENABLED: ${{ inputs.use-sccache && 'true' || 'false' }}
+      CARGO_TERM_COLOR: always
+      CARGO_INCREMENTAL: 0
     name: Build Linux - ${{ matrix.arch }}
 
     steps:
@@ -36,69 +50,48 @@ jobs:
           token: ${{ secrets.DEPLOY_KEY }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: useblacksmith/setup-node@v5
         with:
-          node-version-file: '.nvmrc'
+          node-version-file: ".nvmrc"
+
+      - name: Run sccache-cache
+        uses: mozilla-actions/sccache-action@main
+        if: ${{ inputs.use-sccache }}
+        with:
+          disable_annotations: true
+
+      - name: Expose actions cache variables
+        uses: actions/github-script@v6
+        with:
+          script: |
+            core.exportVariable('ACTIONS_CACHE_URL', process.env['ACTIONS_CACHE_URL'])
+            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env['ACTIONS_RUNTIME_TOKEN'])
 
       - name: Setup Git
         run: |
-          git config --global user.email "mauro-balades@users.noreply.github.com"
-          git config --global user.name "mauro-balades"
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
 
       - name: Install system dependencies
         run: |
           set -x
           sudo apt-get update --fix-missing
           sudo apt-get update
-          sudo apt-get install -y dos2unix yasm nasm build-essential libgtk2.0-dev libpython3-dev m4 uuid libasound2-dev libcurl4-openssl-dev libdbus-1-dev libdrm-dev libdbus-glib-1-dev libgtk-3-dev libpulse-dev libx11-xcb-dev libxt-dev xvfb lld llvm
-
-      - name: Configure sccache
-        uses: actions/github-script@v7
-        with:
-          script: |
-            core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
-            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
-
-      - name: Setup sccache
-        env:
-          LINK: https://github.com/mozilla/sccache/releases/download
-          SCCACHE_VERSION: 0.2.13
-        run: |
-          SCCACHE_FILE=sccache-$SCCACHE_VERSION-x86_64-unknown-linux-musl
-          mkdir -p $HOME/.local/bin
-          curl -L "$LINK/$SCCACHE_VERSION/$SCCACHE_FILE.tar.gz" | tar xz
-          mv -f $SCCACHE_FILE/sccache $HOME/.local/bin/sccache
-          echo "$HOME/.local/bin" >> $GITHUB_PATH
-
-      - name: Save sccache
-        uses: actions/cache@v4
-        with:
-          path: /home/runner/.cache/sccache
-          key: ${{ runner.os }}-sccache
-
-      - name: Setup pnpm
-        run: npm install -g pnpm
-
-      - name: Get pnpm store directory
-        id: pnpm-cache
-        shell: bash
-        run: |
-          echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT
+          sudo apt-get install -y python3 python3-pip dos2unix yasm nasm build-essential libgtk2.0-dev libpython3-dev m4 uuid libasound2-dev libcurl4-openssl-dev libdbus-1-dev libdrm-dev libdbus-glib-1-dev libgtk-3-dev libpulse-dev libx11-xcb-dev libxt-dev xvfb lld llvm
 
       - name: Install dependencies
         run: |
-          pnpm install
+          npm ci
 
       - name: Load Surfer CI setup
-        run: pnpm surfer ci --brand ${{ inputs.release-branch }} --display-version ${{ inputs.build-version }}
+        run: npm run surfer -- ci --brand ${{ inputs.release-branch }} --display-version ${{ inputs.build-version }}
 
       - name: Download Firefox source and dependencies
-        run: pnpm surfer download
+        run: npm run download
 
       - name: Fix Rust version
         run: |
-          # Install a rust version compatible with LLVM 18
-          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain 1.79
+          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain $(cat .rust-toolchain)
           source $HOME/.cargo/env
 
           if test "${{ matrix.arch }}" = "aarch64"; then
@@ -110,7 +103,11 @@ jobs:
       - name: Import
         env:
           SURFER_COMPAT: ${{ matrix.arch }}
-        run: pnpm surfer import
+          SURFER_CERT_PATCH_ISSUER: ${{ secrets.SURFER_CERT_PATCH_ISSUER }}
+          SURFER_CERT_PATCH_NAME: ${{ secrets.SURFER_CERT_PATCH_NAME }}
+        run: |
+          . "$HOME/.cargo/env"
+          npm run import
 
       - name: Build language packs
         run: sh scripts/download-language-packs.sh
@@ -122,40 +119,73 @@ jobs:
           ./mach --no-interactive bootstrap --application-choice browser
           cd ..
 
-      - name: Build
+      - name: Build (PGO stage 1 - generate)
+        if: ${{ matrix.arch == 'x86_64' }}
         env:
           SURFER_COMPAT: ${{ matrix.arch }}
+          ZEN_RELEASE_BRANCH: ${{ inputs.release-branch }}
+          ZEN_GA_GENERATE_PROFILE: 1
+          ZEN_SAFEBROWSING_API_KEY: ${{ secrets.ZEN_SAFEBROWSING_API_KEY }}
+          ZEN_MOZILLA_API_KEY: ${{ secrets.ZEN_MOZILLA_API_KEY }}
+          ZEN_GOOGLE_LOCATION_SERVICE_API_KEY: ${{ secrets.ZEN_GOOGLE_LOCATION_SERVICE_API_KEY }}
         continue-on-error: true
         run: |
           export SURFER_PLATFORM="linux"
-          sh .github/workflows/src/release-build.sh
+          if [[ -n ${{ inputs.MOZ_BUILD_DATE }} ]];then
+            export MOZ_BUILD_DATE=${{ inputs.MOZ_BUILD_DATE }}
+          fi
+          bash .github/workflows/src/release-build.sh
 
-      - name: Build again if it failed
-        if: failure()
+      - name: Generate PGO profile data
+        if: ${{ matrix.arch == 'x86_64' }}
+        run: |
+          set -x
+          export DISPLAY=:2
+          export LLVM_PROFDATA="$HOME/.mozbuild/clang/bin/llvm-profdata"
+          export JARLOG_FILE=en-US.log
+          mkdir -p "$HOME/artifact"
+          cd engine
+          ./mach python ../scripts/download_pgo_extended_corpus.py
+          ./mach package
+          ./mach python build/pgo/profileserver.py --extended-corpus ./pgo-extended-corpus
+          mv merged.profdata "$HOME/artifact/merged.profdata"
+          mv en-US.log "$HOME/artifact/en-US.log"
+
+      - name: Build
         env:
           SURFER_COMPAT: ${{ matrix.arch }}
+          ZEN_RELEASE_BRANCH: ${{ inputs.release-branch }}
+          ZEN_SAFEBROWSING_API_KEY: ${{ secrets.ZEN_SAFEBROWSING_API_KEY }}
+          ZEN_MOZILLA_API_KEY: ${{ secrets.ZEN_MOZILLA_API_KEY }}
+          ZEN_GOOGLE_LOCATION_SERVICE_API_KEY: ${{ secrets.ZEN_GOOGLE_LOCATION_SERVICE_API_KEY }}
+        continue-on-error: true
         run: |
           export SURFER_PLATFORM="linux"
-          sh .github/workflows/src/release-build.sh
+          if [[ -n ${{ inputs.MOZ_BUILD_DATE }} ]];then
+            export MOZ_BUILD_DATE=${{ inputs.MOZ_BUILD_DATE }}
+          fi
+          bash .github/workflows/src/release-build.sh
 
       - name: Package
         env:
           SURFER_COMPAT: ${{ matrix.arch }}
+          ZEN_GA_DISABLE_PGO: true
         run: |
           export SURFER_PLATFORM="linux"
-          pnpm package
+          export ZEN_RELEASE=1
+          npm run package
 
       - name: Rename artifacts
         run: |
-          mv dist/zen-*.tar.bz2 "zen.linux-${{ matrix.arch }}.tar.bz2"
+          mv dist/zen-*.tar.xz "zen.linux-${{ matrix.arch }}.tar.xz"
           mv dist/output.mar linux${{ matrix.arch == 'aarch64' && '-aarch64' || '' }}.mar
 
       - name: Upload build artifact (binary)
         uses: actions/upload-artifact@v4
         with:
           retention-days: 5
-          name: zen.linux-${{ matrix.arch }}.tar.bz2
-          path: ./zen.linux-${{ matrix.arch }}.tar.bz2
+          name: zen.linux-${{ matrix.arch }}.tar.xz
+          path: ./zen.linux-${{ matrix.arch }}.tar.xz
 
       - name: Upload build artifact (.mar)
         uses: actions/upload-artifact@v4
@@ -170,3 +200,11 @@ jobs:
           retention-days: 5
           name: linux_update_manifest_${{ matrix.arch }}
           path: ./dist/update
+
+      - name: Upload linux bin
+        if: ${{ matrix.arch == 'x86_64' }}
+        uses: actions/upload-artifact@v4
+        with:
+          retention-days: 2
+          name: linux-bin-x86_64
+          path: engine/obj-x86_64-pc-linux-gnu/dist/bin/

.github/workflows/macos-release-build.yml

@@ -1,27 +1,41 @@
 name: macOS Release Build
+permissions:
+  contents: read
 
 on:
   workflow_call:
     inputs:
       build-version:
-        description: 'The version to build'
+        description: "The version to build"
         required: true
         type: string
       release-branch:
-        description: 'The branch to build'
+        description: "The branch to build"
         required: true
         type: string
+      MOZ_BUILD_DATE:
+        type: string
+        required: true
+        default: ""
+      use-sccache:
+        description: "Use sccache"
+        required: true
+        type: boolean
+        default: false
 
 jobs:
   mac-build:
     name: Build macOS - ${{ matrix.arch }}
-    runs-on: macos-14
+    runs-on: ${{ (inputs.release-branch == 'release') && 'blacksmith-6vcpu-macos-latest' || 'macos-26' }}
 
     strategy:
       fail-fast: false
       matrix:
         arch: [x86_64, aarch64]
-
+    env:
+      SCCACHE_GHA_ENABLED: ${{ inputs.use-sccache && 'true' || 'false' }}
+      CARGO_TERM_COLOR: always
+      CARGO_INCREMENTAL: 0
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -32,7 +46,20 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version-file: '.nvmrc'
+          node-version-file: ".nvmrc"
+
+      - name: Run sccache-cache
+        uses: mozilla-actions/sccache-action@main
+        if: ${{ inputs.use-sccache }}
+        with:
+          disable_annotations: true
+
+      - name: Expose actions cache variables
+        uses: actions/github-script@v6
+        with:
+          script: |
+            core.exportVariable('ACTIONS_CACHE_URL', process.env['ACTIONS_CACHE_URL'])
+            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env['ACTIONS_RUNTIME_TOKEN'])
 
       - name: Setup Python
         uses: actions/setup-python@v5
@@ -40,13 +67,13 @@ jobs:
 
       - name: Setup Git
         run: |
-          git config --global user.email "mauro-balades@users.noreply.github.com"
-          git config --global user.name "mauro-balades"
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
 
       - name: Install system dependencies
         run: |
           brew update
-          brew install cairo sccache gnu-tar mercurial
+          brew install cairo gnu-tar mercurial
           sudo pip install setuptools
 
           brew uninstall --ignore-dependencies python3.12 -f
@@ -62,7 +89,7 @@ jobs:
 
           brew install watchman
 
-          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain 1.79
+          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain $(cat .rust-toolchain)
           source $HOME/.cargo/env
 
           if test "${{ matrix.arch }}" = "aarch64"; then
@@ -77,119 +104,115 @@ jobs:
           echo 'export PATH="/usr/local/opt/gnu-tar/libexec/gnubin:$PATH"' >> ~/.zsh
           source ~/.bash_profile
 
-      - name: Setup pnpm
-        run: npm install -g pnpm
-
-      - name: Get pnpm store directory
-        id: pnpm-cache
-        shell: bash
-        run: |
-          echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT
-
       - name: Install dependencies
         run: |
-          pnpm install
+          npm ci
 
       - name: Load surfer CI setup
-        run: pnpm surfer ci --brand ${{ inputs.release-branch }} --display-version ${{ inputs.build-version }}
+        run: npm run surfer -- ci --brand ${{ inputs.release-branch }} --display-version ${{ inputs.build-version }}
 
       - name: Download Firefox source and dependencies
-        run: pnpm surfer download
+        run: npm run download
+
+      - name: Import
+        env:
+          SURFER_COMPAT: ${{ matrix.arch }}
+          SURFER_CERT_PATCH_ISSUER: ${{ secrets.SURFER_CERT_PATCH_ISSUER }}
+          SURFER_CERT_PATCH_NAME: ${{ secrets.SURFER_CERT_PATCH_NAME }}
+        run: npm run import
 
       - name: Bootstrap
         run: |
           cd engine
           export SURFER_PLATFORM="darwin"
           export PATH="$(python3 -m site --user-base)/bin":$PATH
-          ./mach --no-interactive bootstrap --application-choice browser --no-system-changes
+          # Always exist with 0, even if bootstrap fails
+          ./mach --no-interactive bootstrap --application-choice browser --exclude macos-sdk || true
           cd ..
 
-      - name: Import
-        env:
-          SURFER_COMPAT: ${{ matrix.arch }}
-        run: pnpm surfer import --verbose
-
       - name: Build language packs
         run: sh scripts/download-language-packs.sh
 
-      - name: Build Zen
+      - name: Build Zen (PGO stage 1 - generate)
+        env:
+          SURFER_COMPAT: ${{ matrix.arch }}
+          ZEN_RELEASE_BRANCH: ${{ inputs.release-branch }}
+          ZEN_GA_GENERATE_PROFILE: 1
+          ZEN_SAFEBROWSING_API_KEY: ${{ secrets.ZEN_SAFEBROWSING_API_KEY }}
+          ZEN_MOZILLA_API_KEY: ${{ secrets.ZEN_MOZILLA_API_KEY }}
+          ZEN_GOOGLE_LOCATION_SERVICE_API_KEY: ${{ secrets.ZEN_GOOGLE_LOCATION_SERVICE_API_KEY }}
+        run: |
+          export SURFER_PLATFORM="darwin"
+          if [[ -n ${{ inputs.MOZ_BUILD_DATE }} ]];then
+            export MOZ_BUILD_DATE=${{ inputs.MOZ_BUILD_DATE }}
+          fi
+          bash .github/workflows/src/release-build.sh
+
+      - name: Generate PGO profile data
         env:
           SURFER_COMPAT: ${{ matrix.arch }}
         run: |
-          export SURFER_PLATFORM="darwin"
-          if test "${{ matrix.arch }}" = "x86_64"; then
-            export ZEN_DISABLE_LTO=1
-          fi
-          sh .github/workflows/src/release-build.sh
+          set -x
+          export LLVM_PROFDATA="$HOME/.mozbuild/clang/bin/llvm-profdata"
+          export JARLOG_FILE=en-US.log
+          mkdir -p "$HOME/artifact"
+          cd engine
+          ./mach python ../scripts/download_pgo_extended_corpus.py
+          ./mach package
+          ./mach python build/pgo/profileserver.py --extended-corpus ./pgo-extended-corpus
+          mv merged.profdata "$HOME/artifact/merged.profdata"
+          mv en-US.log "$HOME/artifact/en-US.log"
 
-      - name: Rebuild Zen if failed
-        if: failure()
+      - name: Build Zen
+        env:
+          SURFER_COMPAT: ${{ matrix.arch }}
+          ZEN_RELEASE_BRANCH: ${{ inputs.release-branch }}
+          ZEN_SAFEBROWSING_API_KEY: ${{ secrets.ZEN_SAFEBROWSING_API_KEY }}
+          ZEN_MOZILLA_API_KEY: ${{ secrets.ZEN_MOZILLA_API_KEY }}
+          ZEN_GOOGLE_LOCATION_SERVICE_API_KEY: ${{ secrets.ZEN_GOOGLE_LOCATION_SERVICE_API_KEY }}
         run: |
           export SURFER_PLATFORM="darwin"
-          sh .github/workflows/src/release-build.sh
-
-      - name: Import APPLE DEVELOPER ID CERTIFICATE for .app
-        uses: Apple-Actions/import-codesign-certs@v3
-        with:
-          p12-file-base64: ${{ secrets.macOS_CERTIFICATES_P12_For_App_BASE64 }}
-          p12-password: ${{ secrets.macOS_CERTIFICATES_P12_PASSWORD }}
+          if [[ -n ${{ inputs.MOZ_BUILD_DATE }} ]];then
+            export MOZ_BUILD_DATE=${{ inputs.MOZ_BUILD_DATE }}
+          fi
+          bash .github/workflows/src/release-build.sh
 
       - name: Package
         env:
           SURFER_COMPAT: ${{ matrix.arch }}
+          ZEN_GA_DISABLE_PGO: true
         run: |
           export SURFER_PLATFORM="darwin"
-          export MACOS_APPLE_DEVELOPER_ID="${{ secrets.macOS_AppleDeveloperId }}"
-          pnpm package
+          export ZEN_RELEASE=1
+          npm run package
 
       - name: Rename artifacts
         run: |
-          mv ./dist/output.mar macos-${{ matrix.arch }}.mar
-
-      - name: Sign .dmg
-        run: |
+          echo "Tarballing DMG"
           set -ex
-          hdiutil convert ./dist/*.dmg -format UDZO -imagekey zlib-level=9 -o zen.macos-${{ matrix.arch }}.dmg
-          xattr -cr zen.macos-${{ matrix.arch }}.dmg
-          codesign -s "${{ secrets.macOS_AppleDeveloperId }}" zen.macos-${{ matrix.arch }}.dmg
-          xcrun notarytool submit "zen.macos-${{ matrix.arch }}.dmg" \
-            --apple-id "${{ secrets.macOS_AppleAccountId }}" \
-            --team-id "${{ secrets.macOS_AppleDeveloperIdTeamId }}" \
-            --password "${{ secrets.macOS_AppleDeveloperIdPassword }}" \
-            --wait
-          xcrun stapler staple "zen.macos-${{ matrix.arch }}.dmg"
+          mv ./dist/*.dmg ./zen-${{ matrix.arch }}-apple-darwin-dist.dmg
+          mv ./engine/obj-${{ matrix.arch }}-apple-darwin/dist/host/bin/mar ./zen-macos-host-mar
+          mv ./engine/obj-${{ matrix.arch }}-apple-darwin/dist/bin/platform.ini ./platform.ini
 
-      - name: Sign .dmg again if failed
-        if: failure()
-        run: |
-          set -ex
-          hdiutil convert ./dist/*.dmg -format UDZO -imagekey zlib-level=9 -o zen.macos-${{ matrix.arch }}.dmg
-          xattr -cr zen.macos-${{ matrix.arch }}.dmg
-          codesign -s "${{ secrets.macOS_AppleDeveloperId }}" zen.macos-${{ matrix.arch }}.dmg
-          xcrun notarytool submit "zen.macos-${{ matrix.arch }}.dmg" \
-            --apple-id "${{ secrets.macOS_AppleAccountId }}" \
-            --team-id "${{ secrets.macOS_AppleDeveloperIdTeamId }}" \
-            --password "${{ secrets.macOS_AppleDeveloperIdPassword }}" \
-            --wait
-          xcrun stapler staple "zen.macos-${{ matrix.arch }}.dmg"
-
-      - name: Upload build artifact
+      - name: Upload dist dmg
         uses: actions/upload-artifact@v4
         with:
-          retention-days: 5
-          name: zen.macos-${{ matrix.arch }}.dmg
-          path: ./zen.macos-${{ matrix.arch }}.dmg
+          retention-days: 1
+          name: zen-${{ matrix.arch }}-apple-darwin-dist.dmg
+          path: ./zen-${{ matrix.arch }}-apple-darwin-dist.dmg
 
-      - name: Upload build artifact (.mar)
+      - name: Upload host mar
         uses: actions/upload-artifact@v4
+        if: matrix.arch == 'aarch64'
         with:
-          retention-days: 5
-          name: macos-${{ matrix.arch }}.mar
-          path: ./macos-${{ matrix.arch }}.mar
+          retention-days: 1
+          name: zen-macos-host-mar
+          path: ./zen-macos-host-mar
 
-      - name: Upload build artifact (update manifests)
+      - name: Upload platform.ini
         uses: actions/upload-artifact@v4
+        if: matrix.arch == 'x86_64'
         with:
-          retention-days: 5
-          name: macos_update_manifest_${{ matrix.arch }}
-          path: ./dist/update
+          retention-days: 1
+          name: platform.ini
+          path: ./platform.ini

.github/workflows/macos-universal-release-build.yml

@@ -0,0 +1,264 @@
+name: macOS Release Build
+
+on:
+  workflow_call:
+    inputs:
+      build-version:
+        description: "The version to build"
+        required: true
+        type: string
+      release-branch:
+        description: "The branch to build"
+        required: true
+        type: string
+
+jobs:
+  mac-build:
+    name: Unify macOS (Universal)
+    runs-on: "macos-26"
+
+    strategy:
+      fail-fast: false
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+          token: ${{ secrets.DEPLOY_KEY }}
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: ".nvmrc"
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        # note: This will use the version defined in '.python-version' by default
+
+      - name: Setup Git
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Install system dependencies
+        run: |
+          brew update
+          brew install cairo gnu-tar mercurial
+          sudo pip install setuptools
+
+          brew uninstall --ignore-dependencies python3.12 -f
+
+          export PATH="$(python3 -m site --user-base)/bin":$PATH
+          python3 -m pip install --user mercurial
+
+          rm '/usr/local/bin/2to3-3.11' '/usr/local/bin/2to3-3.12' '/usr/local/bin/2to3'
+          rm '/usr/local/bin/idle3.11' '/usr/local/bin/idle3.12' '/usr/local/bin/idle3'
+          rm '/usr/local/bin/pydoc3.11' '/usr/local/bin/pydoc3.12' '/usr/local/bin/pydoc3'
+          rm '/usr/local/bin/python3.11' '/usr/local/bin/python3.12' '/usr/local/bin/python3'
+          rm '/usr/local/bin/python3.11-config' '/usr/local/bin/python3.12-config' '/usr/local/bin/python3-config'
+
+          brew install watchman
+
+          cargo install apple-codesign
+
+      - name: Force usage of gnu-tar
+        run: |
+          echo 'export PATH="/usr/local/opt/gnu-tar/libexec/gnubin:$PATH"' >> ~/.bash_profile
+          echo 'export PATH="/usr/local/opt/gnu-tar/libexec/gnubin:$PATH"' >> ~/.zsh
+          source ~/.bash_profile
+
+      - name: Install dependencies
+        run: |
+          npm ci
+
+      - name: Load surfer CI setup
+        run: npm run surfer -- ci --brand ${{ inputs.release-branch }} --display-version ${{ inputs.build-version }}
+
+      - name: Download Firefox source and dependencies
+        run: npm run download
+
+      - name: Bootstrap
+        run: |
+          cd engine
+          export SURFER_PLATFORM="darwin"
+          export PATH="$(python3 -m site --user-base)/bin":$PATH
+          ./mach --no-interactive bootstrap --application-choice browser --no-system-changes || true
+          cd ..
+
+      - name: Import
+        run: npm run import
+
+      - name: Populate mozconfig
+        env:
+          SURFER_MOZCONFIG_ONLY: true
+          ZEN_RELEASE: 1
+          ZEN_GA_DISABLE_PGO: true
+        run: |
+          npm run build
+          cd engine
+          ./mach configure
+
+      - name: Download x86_64 DMG from artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: zen-x86_64-apple-darwin-dist.dmg
+
+      - name: Download aarch64 DMG from artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: zen-aarch64-apple-darwin-dist.dmg
+
+      - name: Remove any existing .app folders
+        run: |
+          set -x
+          cd engine
+          rm -rf "./obj-x86_64-apple-darwin/" || true
+          rm -rf "./obj-aarch64-apple-darwin/" || true
+
+      - name: Extract .app from dmg
+        run: |
+          set -ex
+          cd engine
+          echo "Extracting x86_64 .app from dmg"
+          mkdir -p ./obj-x86_64-apple-darwin/dist
+          mkdir -p ./obj-aarch64-apple-darwin/dist
+          ./mach python -m mozbuild.action.unpack_dmg \
+            ../zen-x86_64-apple-darwin-dist.dmg \
+            ./obj-x86_64-apple-darwin/dist
+          echo "Extracting aarch64 .app from dmg"
+          ./mach python -m mozbuild.action.unpack_dmg \
+            ../zen-aarch64-apple-darwin-dist.dmg \
+            ./obj-aarch64-apple-darwin/dist
+
+      - name: Find first .app folder name
+        run: |
+          cd engine/obj-x86_64-apple-darwin/dist
+          export APP_NAME=${{ inputs.release-branch == 'twilight' && 'Twilight' || 'Zen' }}
+          echo "APP_NAME=$APP_NAME" >> $GITHUB_ENV
+          echo "APP_NAME=$APP_NAME"
+
+      - name: List .app folders
+        run: |
+          ls engine/
+          echo "--------------------"
+          cd engine/obj-x86_64-apple-darwin/dist
+          find . -maxdepth 1 -name "*.app" -type d
+          cd ../..
+
+      - name: create .p12 for codesign 🖊️
+        run: |
+          cd engine
+          echo "${{ secrets.macOS_CERTIFICATES_P12_For_App_BASE64 }}" > cert.txt
+          base64 --decode -i cert.txt -o zenCert.p12
+          echo "${{ secrets.macOS_CERTIFICATES_P12_PASSWORD }}" > zenpCertPassword.passwd
+
+      - name: Remove certificate sensitive information
+        run: |
+          rm engine/cert.txt || true
+
+      - name: Import provisioning profile for .app
+        run: |
+          echo "${{ secrets.macOS_PROVISIONING_PROFILE }}" | base64 --decode > ./engine/Zen_Browser.provisionprofile
+          ls -la
+
+      - name: Unify architectures
+        run: |
+          cd engine
+          ./mach python "./toolkit/mozapps/installer/unify.py" "./obj-x86_64-apple-darwin/dist/${{ env.APP_NAME }}.app" "./obj-aarch64-apple-darwin/dist/${{ env.APP_NAME }}.app"
+          echo "Merged aaarch64 into x86_64!"
+
+      - name: Import APPLE DEVELOPER ID CERTIFICATE for .app
+        uses: Apple-Actions/import-codesign-certs@v3
+        with:
+          p12-file-base64: ${{ secrets.macOS_CERTIFICATES_P12_For_App_BASE64 }}
+          p12-password: ${{ secrets.macOS_CERTIFICATES_P12_PASSWORD }}
+
+      - name: Copy provisioning profile for .app (embedded in .app)
+        run: |
+          cd engine
+          echo "Copying provisioning profile for .app on both architectures (${{ env.APP_NAME }})"
+          cp ./Zen_Browser.provisionprofile "./embedded.provisionprofile"
+
+      - name: Sign .app
+        run: |
+          cd engine
+          # TODO: Change it to "production" once we figure out the issue with the webauth
+          ./mach macos-sign -v -r -c "release" -e "production" -a "./obj-x86_64-apple-darwin/dist/${{ env.APP_NAME }}.app" --rcodesign-p12-file zenCert.p12 --rcodesign-p12-password-file zenpCertPassword.passwd
+
+      - name: Create DMG
+        run: |
+          cd engine
+          ./mach python -m mozbuild.action.make_dmg \
+            --volume-name "${{ env.APP_NAME }}" \
+            --background ./browser/branding/${{ inputs.release-branch }}/background.png \
+            --icon ./browser/branding/${{ inputs.release-branch }}/firefox.icns \
+            --dsstore ./browser/branding/${{ inputs.release-branch }}/dsstore \
+            ./obj-x86_64-apple-darwin/dist/ ../zen-macOS-universal-temp.dmg
+
+      - name: Remove sensitive information
+        run: |
+          rm -f ./engine/Zen_Browser.provisionprofile
+
+      - name: Sign .dmg
+        run: |
+          set -ex
+          hdiutil convert zen-macOS-universal-temp.dmg -format UDZO -imagekey zlib-level=9 -o zen.macos-universal.dmg
+          codesign -s "${{ secrets.macOS_AppleDeveloperId }}" zen.macos-universal.dmg
+          xcrun notarytool submit "zen.macos-universal.dmg" \
+            --apple-id "${{ secrets.macOS_AppleAccountId }}" \
+            --team-id "${{ secrets.macOS_AppleDeveloperIdTeamId }}" \
+            --password "${{ secrets.macOS_AppleDeveloperIdPassword }}" \
+            --no-s3-acceleration \
+            --wait
+          xcrun stapler staple "zen.macos-universal.dmg"
+
+      - name: Download host mar
+        uses: actions/download-artifact@v4
+        with:
+          name: zen-macos-host-mar
+
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v4
+        with:
+          retention-days: 5
+          name: zen.macos-universal.dmg
+          path: ./zen.macos-universal.dmg
+
+      - name: Download platform.ini
+        uses: actions/download-artifact@v4
+        with:
+          name: platform.ini
+
+      - name: Package for mar
+        env:
+          JUST_MAR: true
+          ZEN_GA_DISABLE_PGO: true
+        run: |
+          # we don't need it anymore
+          set -ex
+          rm -rf ./engine/obj-aarch64-apple-darwin
+          mkdir -p ./engine/obj-x86_64-apple-darwin/dist/bin
+          mv ./platform.ini ./engine/obj-x86_64-apple-darwin/dist/bin/platform.ini
+          export SURFER_PLATFORM="darwin"
+          export ZEN_RELEASE=1
+          # full path to zen-macos-host-mar
+          export MAR=$(pwd)/zen-macos-host-mar
+          chmod +x $MAR
+          echo "MAR=$MAR"
+          npm run package -- --verbose
+          mv ./dist/output.mar ./macos.mar
+
+      - name: Upload build artifact (.mar)
+        uses: actions/upload-artifact@v4
+        with:
+          retention-days: 5
+          name: macos.mar
+          path: ./macos.mar
+
+      - name: Upload build artifact (update manifests)
+        uses: actions/upload-artifact@v4
+        with:
+          retention-days: 5
+          name: macos_update_manifest
+          path: ./dist/update

.github/workflows/pr-test.yml

@@ -1,10 +1,16 @@
 name: Pull request test
+permissions:
+  contents: read
 
 on:
   pull_request:
     branches:
       - dev
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   pr-test:
     runs-on: ubuntu-latest
@@ -17,16 +23,34 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version-file: '.nvmrc'
+          node-version-file: ".nvmrc"
 
-      - name: Setup pnpm
-        run: npm install -g pnpm
+      - name: Install dependencies
+        run: npm ci
 
-      - name: Install Surfer
-        run: npm i -g @zen-browser/surfer
+      - name: Restore Surfer engine cache
+        id: surfer-engine-cache
+        uses: actions/cache@v5
+        with:
+          path: .surfer/engine/
+          key: surfer-engine-${{ hashFiles('surfer.json') }}
+
+      - name: Setup Git
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
 
       - name: Download Firefox and dependencies
-        run: surfer download
+        run: npm run download
+
+      - name: Run Bootstrap
+        run: npm run bootstrap
+
+      - name: Add .hgignore file to the engine dir
+        run: touch engine/.hgignore
 
       - name: Import patches
-        run: surfer i
+        run: npm run import
+
+      - name: Run linting
+        run: npm run lint

.github/workflows/src/generate_release_notes.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+RELEASE_NOTES_URL="https://raw.githubusercontent.com/zen-browser/www/refs/heads/main/src/release-notes/stable.json"
+
+if [ "$RELEASE_BRANCH" = "release" ]; then
+  RELEASE_TYPE="Stable"
+
+  echo "Fetching release notes from GitHub..."
+  RELEASE_NOTES_JSON=$(curl -s --retry 5 --retry-delay 5 "$RELEASE_NOTES_URL")
+
+  if [ -z "$RELEASE_NOTES_JSON" ]; then
+    echo "Error: Failed to fetch release notes from GitHub"
+    exit 1
+  fi
+
+  LATEST_RELEASE=$(echo "$RELEASE_NOTES_JSON" | jq -r 'last')
+  EXTRA_NOTES=$(echo "$LATEST_RELEASE" | jq -r '.extra // ""')
+else
+  RELEASE_TYPE="Twilight"
+fi
+
+{
+  echo "# Zen ${RELEASE_TYPE} Release"
+
+  if [ "$RELEASE_TYPE" = "Twilight" ]; then
+    echo
+    echo "> [!NOTE]"
+    echo "> You're currently in Twilight mode, this means you're downloading the latest experimental features and updates."
+    echo ">"
+    echo "> If you encounter any issues, please report them on the [issues page](https://github.com/zen-browser/desktop/issues)."
+  fi
+
+  if [ "$RELEASE_TYPE" = "Stable" ]; then
+    echo "${EXTRA_NOTES}"
+
+    if echo "$LATEST_RELEASE" | jq -e '.security != null and .security != ""' > /dev/null; then
+      echo
+      echo "## Security"
+      echo "$LATEST_RELEASE" | jq -r 'if (.security | type) == "string" then "- " + .security else .security[] | "- " + . end'
+    fi
+
+    if echo "$LATEST_RELEASE" | jq -e '(.features // []) | length > 0' > /dev/null; then
+      echo
+      echo "## New Features"
+      echo "$LATEST_RELEASE" | jq -r '.features[] | "- " + .'
+    fi
+
+    if echo "$LATEST_RELEASE" | jq -e '(.fixes // []) | length > 0' > /dev/null; then
+      echo
+      echo "## Fixes"
+      echo "$LATEST_RELEASE" | jq -r '.fixes[] | if type=="object" then "- " + .description + " ([#" + (.issue|tostring) + "](" + "https://github.com/zen-browser/desktop/issues/" + (.issue|tostring) + "))" else "- " + . end'
+    fi
+
+    if echo "$LATEST_RELEASE" | jq -e '(.breakingChanges // []) | length > 0' > /dev/null; then
+      echo
+      echo "## Breaking Changes"
+      echo "$LATEST_RELEASE" | jq -r '.breakingChanges[] | if type=="string" then "- " + . else "- " + .description + " [Learn more](" + .link + ")" end'
+    fi
+
+    if echo "$LATEST_RELEASE" | jq -e '(.themeChanges // []) | length > 0' > /dev/null; then
+      echo
+      echo "## Theme Changes"
+      echo "$LATEST_RELEASE" | jq -r '.themeChanges[] | "- " + .'
+    fi
+
+    if echo "$LATEST_RELEASE" | jq -e '(.changes // []) | length > 0' > /dev/null; then
+      echo
+      echo "## Changes"
+      echo "$LATEST_RELEASE" | jq -r '.changes[] | "- " + .'
+    fi
+
+    if echo "$LATEST_RELEASE" | jq -e '(.knownIssues // []) | length > 0' > /dev/null; then
+      echo
+      echo "## Known Issues"
+      echo "$LATEST_RELEASE" | jq -r '.knownIssues[] | "- " + .'
+    fi
+  fi
+} > "release_notes.md"
+
+echo "Release notes generated: release_notes.md"

.github/workflows/src/release-build.sh

@@ -1,27 +1,40 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
-set -ex
+set -xe
 
 if command -v apt-get &> /dev/null; then
+  sudo apt-get install python3-launchpadlib
   sudo apt-get update
-  sudo apt-get install -y xvfb
+  sudo apt-get install -y xvfb libnvidia-egl-wayland1 mesa-utils libgl1-mesa-dri
 fi
 
+mkdir -p ~/.zen-keys
+echo "$ZEN_SAFEBROWSING_API_KEY" > ~/.zen-keys/safebrowsing.dat
+echo "$ZEN_MOZILLA_API_KEY" > ~/.zen-keys/mozilla.dat
+echo "$ZEN_GOOGLE_LOCATION_SERVICE_API_KEY" > ~/.zen-keys/google_location_service.dat
+
+. $HOME/.cargo/env
+
+bash ./scripts/mar_sign.sh -i
+
 ulimit -n 4096
 
-if ! command -v Xvfb &> /dev/null; then
+if command -v Xvfb &> /dev/null; then
   if ! test "$ZEN_CROSS_COMPILING"; then
-    Xvfb :2 -screen 0 1024x768x24 &
+    Xvfb :2 -nolisten tcp -noreset -screen 0 1024x768x24 &
     export LLVM_PROFDATA=$HOME/.mozbuild/clang/bin/llvm-profdata
     export DISPLAY=:2
   fi
   export ZEN_RELEASE=1
-  pnpm build
+  npm run build
 else
   echo "Xvfb could not be found, running without it"
   echo "ASSUMING YOU ARE RUNNING THIS ON MACOS"
-  
+
   set -v
   export ZEN_RELEASE=1
-  pnpm build
+  npm run build
 fi
+
+echo "Build complete, removing API keys"
+rm -rf ~/.zen-keys

.github/workflows/sync-external-patches.yml

@@ -0,0 +1,82 @@
+name: Sync External Patches
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  check_candidates:
+    name: Sync External Patches
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v3
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        # note: This will use the version defined in '.python-version' by defaultç
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: ".nvmrc"
+
+      - name: Setup git
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Install requirements
+        run: pip3 install -r requirements.txt
+
+      - name: Import external patches
+        run: python3 scripts/update_external_patches.py
+
+      - name: Check if any files changed
+        id: git-check
+        run: |
+          if [ -n "$(git status --porcelain)" ]; then
+            echo "files_changed=true" >> $GITHUB_OUTPUT
+          else
+            echo "files_changed=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Install dependencies
+        if: steps.git-check.outputs.files_changed == 'true'
+        run: npm ci
+
+      - name: Download Firefox and dependencies
+        if: steps.git-check.outputs.files_changed == 'true'
+        run: npm run download
+
+      - name: Check if patches got applied
+        if: steps.git-check.outputs.files_changed == 'true'
+        id: check-patches
+        continue-on-error: true
+        run: |
+          echo "Checking if patches apply cleanly..."
+          npm run import
+
+      - name: Create pull request
+        uses: peter-evans/create-pull-request@v7
+        if: steps.git-check.outputs.files_changed == 'true'
+        env:
+          GIT_TRACE: 1
+          GIT_CURL_VERBOSE: 1
+        with:
+          token: ${{ secrets.DEPLOY_KEY }}
+          commit-message: "chore: Sync external patches"
+          branch: "chore/sync-external-patches-${{ github.run_id }}"
+          title: "Sync external patches"
+          body: |
+            This PR syncs the external patches automatically.
+
+            * ${{ steps.check-patches.outcome == 'failure' && '⚠️ Some patches did not apply cleanly. Please review them carefully.' || '✅ All patches applied cleanly.' }}
+
+            @${{ github.actor }} please review and merge this PR. Generated from workflow run [${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}), branch ${{ github.head_ref }}.
+          base: dev
+          git-token: ${{ secrets.DEPLOY_KEY }}
+          delete-branch: true

.github/workflows/sync-upstream.yml

@@ -0,0 +1,141 @@
+name: Sync Upstream Firefox Releases
+
+on:
+  workflow_dispatch:
+    inputs:
+      release_candidate:
+        description: "Set to true to sync release candidates"
+        required: false
+        type: boolean
+        default: false
+  workflow_call:
+    inputs:
+      release_candidate:
+        description: "Set to true to sync release candidates"
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: write
+
+jobs:
+  check_candidates:
+    name: Sync Upstream
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v3
+
+      - name: Check if upstream branch already exists
+        id: check-upstream-branch
+        run: |
+          if git ls-remote --heads origin chore/upstream-sync | grep -sw "refs/heads/chore/upstream-sync" > /dev/null; then
+            echo "branch_exists=true" >> $GITHUB_OUTPUT
+          else
+            echo "branch_exists=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        if: steps.check-upstream-branch.outputs.branch_exists == 'false'
+        with:
+          node-version-file: ".nvmrc"
+
+      - name: Install dependencies
+        if: steps.check-upstream-branch.outputs.branch_exists == 'false'
+        run: npm ci
+
+      - name: Install dependencies
+        if: steps.check-upstream-branch.outputs.branch_exists == 'false'
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Setup surfer CI
+        if: steps.check-upstream-branch.outputs.branch_exists == 'false'
+        run: |
+          if [ "${{ github.event.inputs.release_candidate }}" = "false" ]; then
+            npm run surfer -- ci --brand release 
+          fi
+
+      - name: Restore Surfer engine cache
+        id: surfer-engine-cache
+        uses: actions/cache@v5
+        with:
+          path: .surfer/engine/
+          key: surfer-engine-${{ hashFiles('surfer.json') }}
+
+      - name: Download Firefox and dependencies
+        if: steps.check-upstream-branch.outputs.branch_exists == 'false'
+        run: npm run download
+
+      - name: Sync Upstream Releases
+        if: steps.check-upstream-branch.outputs.branch_exists == 'false'
+        run: |
+          if [ "${{ github.event.inputs.release_candidate }}" = "true" ]; then
+            npm run sync:rc
+          else
+            npm run sync
+          fi
+
+      - name: Install requirements
+        run: pip3 install -r requirements.txt
+
+      - name: Check if any files changed
+        id: git-check
+        run: |
+          if [ -n "$(git status --porcelain)" ]; then
+            echo "files_changed=true" >> $GITHUB_OUTPUT
+          else
+            echo "files_changed=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Get Firefox Version
+        id: build-data
+        if: steps.git-check.outputs.files_changed == 'true'
+        run: |
+          if [ "${{ github.event.inputs.release_candidate }}" = "true" ]; then
+            VERSION=$(node -pe "require('./surfer.json').version.candidate")
+          else
+            VERSION=$(node -pe "require('./surfer.json').version.version")
+          fi
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Import external patches
+        if: steps.git-check.outputs.files_changed == 'true'
+        run: python3 scripts/update_external_patches.py || true
+
+      - name: Check if patches got applied
+        if: steps.git-check.outputs.files_changed == 'true'
+        id: check-patches
+        continue-on-error: true
+        run: |
+          echo "Checking if patches apply cleanly..."
+          npm run import
+
+      - name: Import external tests
+        if: steps.git-check.outputs.files_changed == 'true'
+        run: python3 scripts/import_external_tests.py || true
+
+      - name: Create pull request
+        uses: peter-evans/create-pull-request@v7
+        if: steps.git-check.outputs.files_changed == 'true'
+        env:
+          GIT_TRACE: 1
+          GIT_CURL_VERBOSE: 1
+        with:
+          token: ${{ secrets.DEPLOY_KEY }}
+          commit-message: "chore: Sync upstream to `Firefox ${{ steps.build-data.outputs.version }}`"
+          branch: "chore/upstream-sync"
+          title: "no-bug: Sync upstream Firefox to version ${{ steps.build-data.outputs.version }}"
+          body: |
+            This PR syncs the upstream Firefox to version ${{ steps.build-data.outputs.version }}.
+
+            * ${{ steps.check-patches.outcome == 'failure' && '⚠️ Some patches did not apply cleanly. Please review them carefully.' || '✅ All patches applied cleanly.' }}
+
+            @${{ github.actor }} please review and merge this PR.
+          base: dev
+          git-token: ${{ secrets.DEPLOY_KEY }}
+          delete-branch: true

.github/workflows/twilight-release-schedule.yml

@@ -2,8 +2,14 @@ name: Zen Twilight Scheduled Releases
 
 on:
   schedule:
-    - cron: '0 0 * * *'
+    - cron: "0 23 */2 * *"
   workflow_dispatch:
+    inputs:
+      create_release:
+        description: "Whether to do a release"
+        required: false
+        type: boolean
+        default: true
 
 jobs:
   twilight-release-schedule:
@@ -12,8 +18,9 @@ jobs:
     secrets: inherit
     uses: ./.github/workflows/build.yml
     with:
-      create_release: true
+      create_release: ${{ github.event_name != 'workflow_dispatch' && true || inputs.create_release }}
       update_branch: twilight
+      use-sccache: true
       update_version: false
 
   post-build:
@@ -27,6 +34,4 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version-file: '.nvmrc'
-
-      # TODO:
+          node-version-file: ".nvmrc"

.github/workflows/update-submodules.yml

@@ -1,31 +0,0 @@
-name: Update Components Submodules
-
-on:
-  push:
-    branches:
-      - dev
-  workflow_dispatch:
-  workflow_call:
-
-jobs:
-  update-submodules:
-    runs-on: ubuntu-latest
-    if: "!contains(github.event.head_commit.message, '[skip ci]')"
-    
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          submodules: recursive
-          token: ${{ secrets.DEPLOY_KEY }}
-
-      - name: Update submodules
-        run: |
-          git submodule update --remote --merge
-
-      - name: Commit
-        uses: stefanzweifel/git-auto-commit-action@v5
-        with:
-          commit_message: "[skip ci] 📦 Update submodules"
-          commit_user_name: Zen Browser Robot
-          commit_user_email: zen-browser-auto@users.noreply.github.com

.github/workflows/windows-profile-build.yml

@@ -1,18 +1,21 @@
 name: Windows PGO Builds
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
     inputs:
       build-version:
-        description: 'The version to build'
+        description: "The version to build"
         required: true
         type: string
       profile-data-path-archive:
-        description: 'The path to the zip archive containing the profile data'
+        description: "The path to the zip archive containing the profile data"
         required: false
         type: string
       release-branch:
-        description: 'The branch to build'
+        description: "The branch to build"
         required: true
         type: string
 
@@ -25,7 +28,7 @@ jobs:
       matrix:
         arch: [x86_64, aarch64]
 
-    runs-on: windows-latest
+    runs-on: ${{ inputs.release-branch == 'release' && 'windows-latest' || 'windows-latest' }}
 
     steps:
       - name: Checkout repository
@@ -34,19 +37,19 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version-file: '.nvmrc'
+          node-version-file: ".nvmrc"
 
       - name: Setup Git
         run: |
-          git config --global user.email "mr-cheff@users.noreply.github.com"
-          git config --global user.name "mr-cheff"
-
-      - name: Setup pnpm
-        run: npm install -g pnpm
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
 
       - name: Install Surfer
         run: npm i -g @zen-browser/surfer
 
+      - name: Load Surfer CI setup
+        run: npm run surfer -- ci --brand ${{ inputs.release-branch }} --display-version ${{ inputs.build-version }}
+
       - name: Download artifact
         if: ${{ matrix.arch == 'x86_64' }}
         uses: actions/download-artifact@v4
@@ -71,13 +74,13 @@ jobs:
         if: ${{ matrix.arch == 'x86_64' }}
         run: |
           git config --global core.safecrlf false
-          pnpm surfer download
+          npm run download
 
       - name: Import patches
         if: ${{ matrix.arch == 'x86_64' }}
         env:
           SURFER_NO_BRANDING_PATCH: true
-        run: pnpm surfer import
+        run: npm run import
 
       - name: Generate
         if: ${{ matrix.arch == 'x86_64' }}
@@ -90,15 +93,10 @@ jobs:
           echo "cd $workspace_dir" '' >> mozilla-build-run.sh
           echo 'export PATH=/c/mozilla-build/msys2/usr/bin:$PATH' '' >> mozilla-build-run.sh
           echo './mach --no-interactive bootstrap --application-choice browser' '' >> mozilla-build-run.sh
-          echo 'ls /c/Users/runneradmin/.mozbuild/clang/bin' '' >> mozilla-build-run.sh
-          echo 'LLVM_PROFDATA=/c/Users/runneradmin/.mozbuild/clang/bin/llvm-profdata.exe JARLOG_FILE=en-US.log ./mach python build/pgo/profileserver.py --binary /c/artifact/zen/zen.exe' '' >> mozilla-build-run.sh
+          echo './mach python ../scripts/download_pgo_extended_corpus.py' '' >> mozilla-build-run.sh
+          echo 'LLVM_PROFDATA=/c/Users/runneradmin/.mozbuild/clang/bin/llvm-profdata.exe JARLOG_FILE=en-US.log ./mach python build/pgo/profileserver.py --binary /c/artifact/zen/zen.exe --extended-corpus ./pgo-extended-corpus --' '' >> mozilla-build-run.sh
           C:\mozilla-build\start-shell.bat $workspace_dir_current\mozilla-build-run.sh
 
-      - name: Debug session
-        if: ${{ failure() }}
-        uses: WarpBuilds/action-debugger@v1.3
-        timeout-minutes: 15
-
       - name: Move profile data
         if: ${{ matrix.arch == 'x86_64' }}
         run: |

.github/workflows/windows-release-build.yml

@@ -1,5 +1,8 @@
 name: Windows Release Build
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
     inputs:
@@ -8,22 +11,35 @@ on:
         type: boolean
         default: false
       build-version:
-        description: 'The version to build'
+        description: "The version to build"
         required: true
         type: string
       profile-data-path-archive:
-        description: 'The path to the zip archive containing the profile data'
+        description: "The path to the zip archive containing the profile data"
         type: string
       release-branch:
-        description: 'The branch to build'
+        description: "The branch to build"
         required: true
         type: string
+      MOZ_BUILD_DATE:
+        type: string
+        required: true
+        default: ""
+      use-sccache:
+        description: "Use sccache"
+        required: true
+        type: boolean
+        default: false
 
 jobs:
   windows-build:
     name: Build Windows - ${{ matrix.arch }}
-    runs-on: ubuntu-latest
-
+    # aarch64 does not need full 16x, and we also dont use full LTO when generating GPO
+    runs-on: ${{ (inputs.release-branch == 'release' && !inputs.generate-gpo && matrix.arch == 'x86_64') && 'self-hosted' || 'blacksmith-8vcpu-ubuntu-2404' }}
+    env:
+      SCCACHE_GHA_ENABLED: ${{ inputs.use-sccache && 'true' || 'false' }}
+      CARGO_TERM_COLOR: always
+      CARGO_INCREMENTAL: 0
     strategy:
       fail-fast: false
       matrix:
@@ -32,6 +48,7 @@ jobs:
     steps:
       - name: Free Disk Space (Ubuntu)
         uses: jlumbroso/free-disk-space@main
+        if: ${{ !(inputs.generate-gpo && matrix.arch == 'aarch64') }}
         with:
           tool-cache: false
 
@@ -42,67 +59,126 @@ jobs:
           token: ${{ secrets.DEPLOY_KEY }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: useblacksmith/setup-node@v5
         with:
-          node-version-file: '.nvmrc'
+          node-version-file: ".nvmrc"
 
-      - name: Setup pnpm
-        run: npm install -g pnpm
+      - name: Run sccache-cache
+        uses: mozilla-actions/sccache-action@main
+        if: ${{ inputs.use-sccache }}
+        with:
+          disable_annotations: true
+
+      - name: Expose actions cache variables
+        uses: actions/github-script@v6
+        with:
+          script: |
+            core.exportVariable('ACTIONS_CACHE_URL', process.env['ACTIONS_CACHE_URL'])
+            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env['ACTIONS_RUNTIME_TOKEN'])
 
       - name: Setup Git
         run: |
-          git config --global user.email "mauro-balades@users.noreply.github.com"
-          git config --global user.name "mauro-balades"
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
 
       - name: Install dependencies
         run: |
-          pnpm install
+          npm ci
+          sudo apt-get update
+          sudo apt-get install -y python3 python3-pip dos2unix yasm nasm build-essential libgtk2.0-dev libpython3-dev m4 uuid libasound2-dev libcurl4-openssl-dev libdbus-1-dev libdrm-dev libdbus-glib-1-dev libgtk-3-dev libpulse-dev libx11-xcb-dev libxt-dev xvfb lld llvm --fix-missing
 
       - name: Load Surfer CI setup
-        run: pnpm surfer ci --brand ${{ inputs.release-branch }} --display-version ${{ inputs.build-version }}
+        run: npm run surfer -- ci --brand ${{ inputs.release-branch }} --display-version ${{ inputs.build-version }}
 
       - name: Download Firefox and dependencies
-        run: pnpm surfer download
+        if: ${{ !(inputs.generate-gpo && matrix.arch == 'aarch64') }}
+        run: npm run download
 
       - name: win-cross Cache
         env:
           SEGMENT_DOWNLOAD_TIMEOUT_MINS: 5
         id: cache-win-cross
-        uses: actions/cache@v4
+        uses: useblacksmith/cache@v5
         with:
           path: ${HOME}/win-cross
           key: win-cross
 
-      - name: Configure sccache
-        uses: actions/github-script@v7
-        with:
-          script: |
-            core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
-            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
-
       - name: Setup for Windows
-        if: steps.cache-win-cross.outputs.cache-hit != 'true'
+        if: steps.cache-win-cross.outputs.cache-hit != 'true' && !(inputs.generate-gpo && matrix.arch == 'aarch64')
         run: |
           set -x
           mkdir -p ~/win-cross
           cd engine/
+          sudo apt-get install python3-launchpadlib
+          sudo add-apt-repository ppa:savoury1/backports
+          sudo apt-get update
+          sudo apt-get install -y python3-pip autoconf \
+            autoconf2.13 \
+            automake \
+            bison \
+            build-essential \
+            cabextract \
+            curl \
+            cmake \
+            flex \
+            gawk \
+            gcc-multilib \
+            git \
+            gnupg \
+            jq \
+            libbz2-dev \
+            libexpat1-dev \
+            libffi-dev \
+            libncursesw5-dev \
+            libsqlite3-dev \
+            libssl-dev \
+            libtool \
+            libucl-dev \
+            libxml2-dev \
+            msitools \
+            ninja-build \
+            openssh-client \
+            p7zip-full \
+            pkg-config \
+            procps \
+            python3-requests \
+            python3-toml \
+            scons \
+            subversion \
+            tar \
+            unzip \
+            uuid \
+            uuid-dev \
+            wget \
+            zip \
+            zlib1g-dev \
+            aria2
           echo Setup wine
           aria2c "https://firefox-ci-tc.services.mozilla.com/api/index/v1/task/gecko.cache.level-1.toolchains.v3.linux64-wine.latest/artifacts/public%2Fbuild%2Fwine.tar.zst" -o wine.tar.zst
-          tar --zstd -xvf wine.tar.zst -C ~/win-cross
+          tar --zstd -xf wine.tar.zst -C ~/win-cross
           rm wine.tar.zst
           echo Setup Visual Studio
-          sudo apt install -y msitools python3-pip
-          ./mach python --virtualenv build taskcluster/scripts/misc/get_vs.py build/vs/vs2022.yaml ~/win-cross/vs2022
+          ./mach python --virtualenv build taskcluster/scripts/misc/get_vs.py build/vs/vs2026.yaml ~/win-cross/vs2026
+
+      - name: Import
+        if: ${{ !(inputs.generate-gpo && matrix.arch == 'aarch64') }}
+        env:
+          SURFER_COMPAT: ${{ matrix.arch }}
+          SURFER_CERT_PATCH_ISSUER: ${{ secrets.SURFER_CERT_PATCH_ISSUER }}
+          SURFER_CERT_PATCH_NAME: ${{ secrets.SURFER_CERT_PATCH_NAME }}
+        run: |
+          . "$HOME/.cargo/env"
+          npm run import -- --verbose
 
       - name: Bootstrap
+        if: ${{ !(inputs.generate-gpo && matrix.arch == 'aarch64') }}
         run: |
           set -x
           cd engine/
-          chmod -R +x "$(echo ~)/win-cross/vs2022" || true
+          chmod -R +x "$(echo ~)/win-cross/vs2026" || true
           cd ..
-          npm install -g pnpm
           export SURFER_PLATFORM="win32"
-          pnpm surfer bootstrap
+          npm run bootstrap
           cd engine/
           ls ~/.mozbuild/clang/lib/clang/
           echo "export LIB=\"$(cd ~/.mozbuild/clang/lib/clang/* && cd lib/windows && pwd)\"" >> ../configs/common/mozconfig
@@ -110,30 +186,29 @@ jobs:
           sudo apt-get update
           sudo apt-get install dos2unix
           ls ~/win-cross/wine || true
-          ls ~/win-cross/vs2022 || true
+          ls ~/win-cross/vs2026 || true
 
       - name: Setup Rust
+        if: ${{ !(inputs.generate-gpo && matrix.arch == 'aarch64') }}
         run: |
-          cd engine/
-          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain 1.79
+          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain $(cat .rust-toolchain)
           source $HOME/.cargo/env
           if test "${{ matrix.arch }}" = "aarch64"; then
             rustup target add aarch64-pc-windows-msvc
           else
             rustup target add x86_64-pc-windows-msvc
           fi
-          cargo install cargo-download
-          cargo download -x windows=0.58.0
+          # Stored in build/windows/.windows-rs-version
+          WINDOWS_RS_VERSION=$(cat build/windows/.windows-rs-version)
+          cd engine/
+          cargo install cargo-download --locked
+          cargo download -x windows=$WINDOWS_RS_VERSION
           export CARGO_INCREMENTAL=0
           echo "" >> ../configs/common/mozconfig
-          echo "export MOZ_WINDOWS_RS_DIR=$(pwd)/windows-0.58.0" >> ../configs/common/mozconfig
-
-      - name: Import
-        env:
-          SURFER_COMPAT: ${{ matrix.arch }}
-        run: pnpm surfer import --verbose
+          echo "export MOZ_WINDOWS_RS_DIR=$(pwd)/windows-$WINDOWS_RS_VERSION" >> ../configs/common/mozconfig
 
       - name: Build language packs
+        if: ${{ !(inputs.generate-gpo && matrix.arch == 'aarch64') }}
         run: sh scripts/download-language-packs.sh
 
       - name: Download artifact (if use profdata)
@@ -156,6 +231,10 @@ jobs:
         if: ${{ !(inputs.generate-gpo && matrix.arch == 'aarch64') }}
         env:
           SURFER_COMPAT: ${{ matrix.arch }}
+          ZEN_RELEASE_BRANCH: ${{ inputs.release-branch }}
+          ZEN_SAFEBROWSING_API_KEY: ${{ secrets.ZEN_SAFEBROWSING_API_KEY }}
+          ZEN_MOZILLA_API_KEY: ${{ secrets.ZEN_MOZILLA_API_KEY }}
+          ZEN_GOOGLE_LOCATION_SERVICE_API_KEY: ${{ secrets.ZEN_GOOGLE_LOCATION_SERVICE_API_KEY }}
         run: |
           set -x
           dos2unix configs/windows/mozconfig
@@ -164,25 +243,26 @@ jobs:
           if test ${{ inputs.generate-gpo }} = true; then
             export ZEN_GA_GENERATE_PROFILE=1
           fi
-          sh .github/workflows/src/release-build.sh
+          if [[ -n ${{ inputs.MOZ_BUILD_DATE }} ]];then
+            export MOZ_BUILD_DATE=${{ inputs.MOZ_BUILD_DATE }}
+          fi
+          bash .github/workflows/src/release-build.sh
 
       - name: Package
         if: ${{ !(inputs.generate-gpo && matrix.arch == 'aarch64') }}
         env:
           SURFER_COMPAT: ${{ matrix.arch }}
+          ZEN_GA_DISABLE_PGO: true
         run: |
           set -x
           export SURFER_PLATFORM="win32"
-          pnpm package
-          mv ./dist/zen-$(pnpm surfer get version | xargs).en-US.win64${{ matrix.arch == 'aarch64' && '-aarch64' || '' }}.zip zen.win64.zip
+          export ZEN_CROSS_COMPILING=1
+          export ZEN_RELEASE=1
+          npm run package
+          mv ./dist/zen-$(npm run --silent surfer -- get version | xargs).en-US.win64${{ matrix.arch == 'aarch64' && '-aarch64' || '' }}.zip zen.win64.zip
           ls ./dist
           ls .
 
-      - name: Debug session
-        if: ${{ failure() }}
-        uses: WarpBuilds/action-debugger@v1.3
-        timeout-minutes: 15
-
       - name: Move package for PGO upload
         if: ${{ inputs.generate-gpo && matrix.arch == 'x86_64' }}
         run: |
@@ -200,7 +280,7 @@ jobs:
         uses: actions/upload-artifact@v4
         if: ${{ inputs.generate-gpo && matrix.arch == 'x86_64' }}
         with:
-          retention-days: 5
+          retention-days: 2
           name: ${{ matrix.arch == 'aarch64' && 'arm64' || matrix.arch }}-${{ inputs.profile-data-path-archive }}
           path: ./zen.win64-pgo-stage-1.zip
 
@@ -208,29 +288,24 @@ jobs:
         if: ${{ !inputs.generate-gpo }}
         run: |
           set -x
-          if test "${{ matrix.arch }}" = "aarch64"; then
-            find engine/obj-aarch64-pc-windows-msvc/ -mindepth 1 -maxdepth 1 -type d -not -name 'dist' -exec rm -rf {} \;
-            find engine/obj-aarch64-pc-windows-msvc/ -mindepth 1 -maxdepth 1 -type f -not -name 'dist' -exec rm -f {} \;
-          else
-            find engine/obj-x86_64-pc-windows-msvc/ -mindepth 1 -maxdepth 1 -type d -not -name 'dist' -exec rm -rf {} \;
-            find engine/obj-x86_64-pc-windows-msvc/ -mindepth 1 -maxdepth 1 -type f -not -name 'dist' -exec rm -f {} \;
-          fi
+          mkdir obj-${{ matrix.arch }}-pc-windows-msvc/
+
+          rm -rf engine/obj-${{ matrix.arch }}-pc-windows-msvc/_tests
+          rm -rf engine/obj-${{ matrix.arch }}-pc-windows-msvc/config/autoconf.mk
+          rm -rf engine/obj-${{ matrix.arch }}-pc-windows-msvc/config.statusd/substs/
+          rm -rf engine/obj-${{ matrix.arch }}-pc-windows-msvc/dist/install
+
+          find engine/obj-${{ matrix.arch }}-pc-windows-msvc/dist -maxdepth 1 -type f -name "*.zip" -delete
+
+          cp -r --no-dereference engine/obj-${{ matrix.arch }}-pc-windows-msvc/* obj-${{ matrix.arch }}-pc-windows-msvc/ || true
 
       - name: Upload dist object
         if: ${{ !inputs.generate-gpo }}
         uses: actions/upload-artifact@v4
         with:
-          retention-days: 5
+          retention-days: 2
           name: windows-x64-obj-${{ matrix.arch == 'aarch64' && 'arm64' || matrix.arch }}
-          path: engine/obj-${{ matrix.arch == 'aarch64' && 'aarch64' || 'x86_64' }}-pc-windows-msvc/
-
-      - name: Upload artifact (if Twilight branch, binary)
-        if: ${{ inputs.release-branch == 'twilight' && !inputs.generate-gpo }}
-        uses: actions/upload-artifact@v4
-        with:
-          retention-days: 5
-          name: zen.win-${{ matrix.arch == 'aarch64' && 'arm64' || matrix.arch }}.zip
-          path: ./zen.win-${{ matrix.arch == 'aarch64' && 'arm64' || matrix.arch }}.zip
+          path: obj-${{ matrix.arch }}-pc-windows-msvc
 
       - name: Upload artifact (if Twilight branch, installer)
         if: ${{ inputs.release-branch == 'twilight' && !inputs.generate-gpo }}

.gitignore

@@ -1,3 +1,6 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 .dotbuild/
 engine/
@@ -8,4 +11,27 @@ node_modules/
 __pycache__/
 dist/
 
-windsign-temp/
+windsign-temp/
+venv/
+
+!firefox-cache/
+win-cross/
+
+!firefox-patches/
+target/
+.vscode/
+
+locales/firefox-l10n/
+
+!src/toolkit/themes/shared/design-system/dist/
+.DS_Store
+
+mozconfig
+
+build/signing/env/
+build/signing/nss_config/
+build/signing/cert.pem
+build/signing/private_key.pem
+build/signing/private_key.p12
+
+bloat-dump.log

.gitmodules

@@ -1,3 +0,0 @@
-[submodule "l10n"]
-	path = l10n
-	url = https://github.com/zen-browser/l10n-packs

.husky/pre-commit

@@ -1 +1 @@
-# npx lint-staged
+npx lint-staged

.nvmrc

@@ -1 +1 @@
-20
+22

.prettierignore

@@ -1,12 +0,0 @@
-engine/
-
-**/*.html
-**/*.xhtml
-**/*.inc.xhtml
-
-**/*.svg
-
-src/browser/app/profile/*.js
-pnpm-lock.yaml
-
-**/engine/

.prettierrc.json

@@ -1,12 +0,0 @@
-{
-  "bracketSameLine": true,
-  "endOfLine": "lf",
-  "trailingComma": "es5",
-  "singleQuote": true,
-  "tabWidth": 2,
-  "useTabs": false,
-  "jsxSingleQuote": false,
-  "semi": true,
-  "printWidth": 128,
-  "plugins": []
-}

.rust-toolchain

@@ -0,0 +1 @@
+1.90

.vscode/settings.json

@@ -1,30 +0,0 @@
-{
-  "files.associations": {
-    "*.inc": "cpp",
-    "typeindex": "cpp",
-    "typeinfo": "cpp",
-    "functional": "cpp",
-    "array": "cpp",
-    "*.tcc": "cpp",
-    "memory": "cpp",
-    "future": "cpp",
-    "istream": "cpp",
-    "tuple": "cpp",
-    "utility": "cpp",
-    "variant": "cpp",
-    "compare": "cpp",
-    "thread": "cpp",
-    "string": "cpp",
-    "string_view": "cpp",
-    "span": "cpp",
-    "vector": "cpp",
-    "charconv": "cpp",
-    "chrono": "cpp",
-    "optional": "cpp",
-    "format": "cpp",
-    "ratio": "cpp",
-    "system_error": "cpp",
-    "regex": "cpp",
-    "type_traits": "cpp"
-  }
-}

.well-known/funding-manifest-urls

@@ -0,0 +1 @@
+https://zen-browser.app/funding.json

AppDir/AppRun

@@ -1,14 +0,0 @@
-#!/bin/sh
-SELF=$(readlink -f "$0")
-HERE=${SELF%/*}
-export PATH="${HERE}:${HERE}/usr/bin/:${HERE}/usr/sbin/:${HERE}/usr/games/:${HERE}/bin/:${HERE}/sbin/${PATH:+:$PATH}"
-export LD_LIBRARY_PATH="${HERE}/usr/lib/:${HERE}/usr/lib/i386-linux-gnu/:${HERE}/usr/lib/x86_64-linux-gnu/:${HERE}/usr/lib32/:${HERE}/usr/lib64/:${HERE}/lib/:${HERE}/lib/i386-linux-gnu/:${HERE}/lib/x86_64-linux-gnu/:${HERE}/lib32/:${HERE}/lib64/${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
-export PYTHONPATH="${HERE}/usr/share/pyshared/${PYTHONPATH:+:$PYTHONPATH}"
-export MOZ_LEGACY_PROFILES=1 # Prevent per installation profiles
-DEFAULT_XDG_DATA_DIRS='./share/:/usr/share/gnome:/usr/local/share/:/usr/share/'
-export XDG_DATA_DIRS="${HERE}/usr/share/:${XDG_DATA_DIRS:-$DEFAULT_XDG_DATA_DIRS}"
-export PERLLIB="${HERE}/usr/share/perl5/:${HERE}/usr/lib/perl5/${PERLLIB:+:$PERLLIB}"
-export GSETTINGS_SCHEMA_DIR="${HERE}/usr/share/glib-2.0/schemas/${GSETTINGS_SCHEMA_DIR:+:$GSETTINGS_SCHEMA_DIR}"
-export QT_PLUGIN_PATH="${HERE}/usr/lib/qt4/plugins/:${HERE}/usr/lib/i386-linux-gnu/qt4/plugins/:${HERE}/usr/lib/x86_64-linux-gnu/qt4/plugins/:${HERE}/usr/lib32/qt4/plugins/:${HERE}/usr/lib64/qt4/plugins/:${HERE}/usr/lib/qt5/plugins/:${HERE}/usr/lib/i386-linux-gnu/qt5/plugins/:${HERE}/usr/lib/x86_64-linux-gnu/qt5/plugins/:${HERE}/usr/lib32/qt5/plugins/:${HERE}/usr/lib64/qt5/plugins/${QT_PLUGIN_PATH:+:$QT_PLUGIN_PATH}"
-EXEC=$(grep -e '^Exec=.*' "${HERE}"/*.desktop | head -n 1 | cut -d "=" -f 2 | cut -d " " -f 1)
-exec "${EXEC}" "$@"

AppDir/zen.desktop

@@ -1,26 +0,0 @@
-[Desktop Entry]
-Name=Zen Browser
-Comment=Experience tranquillity while browsing the web without people tracking you!
-Exec=zen %u
-Icon=zen
-Type=Application
-MimeType=text/html;text/xml;application/xhtml+xml;x-scheme-handler/http;x-scheme-handler/https;application/x-xpinstall;application/pdf;application/json;
-StartupWMClass=zen-beta
-Categories=Network;WebBrowser;
-StartupNotify=true
-Terminal=false
-X-MultipleArgs=false
-Keywords=Internet;WWW;Browser;Web;Explorer;
-Actions=new-window;new-private-window;profilemanager;
-
-[Desktop Action new-window]
-Name=Open a New Window
-Exec=zen %u
-
-[Desktop Action new-private-window]
-Name=Open a New Private Window
-Exec=zen --private-window %u
-
-[Desktop Action profilemanager]
-Name=Open the Profile Manager
-Exec=zen --ProfileManager %u

CODEOWNERS

@@ -1 +1 @@
-*                    @mr-cheff
+* @mr-cheffy

CODE_OF_CONDUCT.md

@@ -1,3 +1,9 @@
+<!--
+   - This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/.
+   -->
+
 # Contributor Covenant Code of Conduct
 
 ## Our Pledge
@@ -17,23 +23,23 @@ diverse, inclusive, and healthy community.
 Examples of behavior that contributes to a positive environment for our
 community include:
 
-* Demonstrating empathy and kindness toward other people
-* Being respectful of differing opinions, viewpoints, and experiences
-* Giving and gracefully accepting constructive feedback
-* Accepting responsibility and apologizing to those affected by our mistakes,
+- Demonstrating empathy and kindness toward other people
+- Being respectful of differing opinions, viewpoints, and experiences
+- Giving and gracefully accepting constructive feedback
+- Accepting responsibility and apologizing to those affected by our mistakes,
   and learning from the experience
-* Focusing on what is best not just for us as individuals, but for the
+- Focusing on what is best not just for us as individuals, but for the
   overall community
 
 Examples of unacceptable behavior include:
 
-* The use of sexualized language or imagery, and sexual attention or
+- The use of sexualized language or imagery, and sexual attention or
   advances of any kind
-* Trolling, insulting or derogatory comments, and personal or political attacks
-* Public or private harassment
-* Publishing others' private information, such as a physical or email
+- Trolling, insulting or derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information, such as a physical or email
   address, without their explicit permission
-* Other conduct which could reasonably be considered inappropriate in a
+- Other conduct which could reasonably be considered inappropriate in a
   professional setting
 
 ## Enforcement Responsibilities
@@ -106,7 +112,7 @@ Violating these terms may lead to a permanent ban.
 ### 4. Permanent Ban
 
 **Community Impact**: Demonstrating a pattern of violation of community
-standards, including sustained inappropriate behavior,  harassment of an
+standards, including sustained inappropriate behavior, harassment of an
 individual, or aggression toward or disparagement of classes of individuals.
 
 **Consequence**: A permanent ban from any sort of public interaction within

README.md

@@ -1,3 +1,9 @@
+<!--
+   - This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/.
+   -->
+<!-- TODO: Get a job -->
 <img src="./docs/assets/zen-dark.svg" width="100px" align="left">
 
 ### `Zen Browser`
@@ -6,8 +12,7 @@
 [![Crowdin](https://badges.crowdin.net/zen-browser/localized.svg)](https://crowdin.com/project/zen-browser)
 [![Zen Release builds](https://github.com/zen-browser/desktop/actions/workflows/build.yml/badge.svg?branch=stable)](https://github.com/zen-browser/desktop/actions/workflows/build.yml)
 
-
-✨ Experience tranquillity while browsing the web without people tracking you! Zen is a privacy-focused browser that blocks trackers, ads, and other unwanted content while offering the best browsing experience!
+Zen is a firefox-based browser with the aim of pushing your productivity to a new level!
 
 <div flex="true">
   <a href="https://zen-browser.app/download">
@@ -27,122 +32,21 @@
   </a>
 </div>
 
-## 🖥️ Compatibility
+### Firefox Versions
 
-Zen is currently built using firefox version `133.0.3`! 🚀
+- [`Release`](https://zen-browser.app/download) - Is currently built using Firefox version `151.0.1`! 🚀
+- [`Twilight`](https://zen-browser.app/download?twilight) - Is currently built using Firefox version `RC 151.0.1`!
 
-- Check out the latest [release notes](https://zen-browser.app/release-notes)!
-- Part of our mission is to keep Zen up-to-date with the latest version of Firefox, so you can enjoy the latest features and security updates!
+### Contributing
 
-## 🤝 Contribution
+If you'd like to report a bug, please do so on our [GitHub Issues page](https://github.com/zen-browser/desktop/issues/) and for feature requests, you can use [GitHub Discussions](https://github.com/zen-browser/desktop/discussions).
 
 Zen is an open-source project, and we welcome contributions from the community! Please take a look at the [contribution guidelines](./docs/contribute.md) before getting started!
 
-### Issue metrics
+#### Partners
 
-We keep track of how many issues are closed at the end of the month in [docs/issue-metrics](./docs/issue-metrics). This is to keep track of how many issues are being closed, because who doesn't like to see progress? 📈
+Thanks to all the partners of Zen for their support and contributions:
 
-### Versioning
-
-Zen uses [Semantic Versioning](https://semver.org/) for versioning. Meaning, versions are displayed as `a.b.c-d.e` where:
-
-- `a` is the major version
-- `b` is the minor version
-- `c` is the patch version
-- `d` is the branch prefix
-- `e` is the build number
-
-### Branches
-
-Zen is divided into 2 main branches. We use `dev` for development and `stable` for stable releases. The `dev` branch is where all the new features are added and where `twilight` builds are generated. The `stable` branch is where the stable releases are generated. 
-
-We divide into 2 branches in case there's any really important security update (for example) that needs to be released before the next stable release. This allows us to do patches without releasing unstable versions to the public.
-
-## ⚡ Performance
-
-Zen is built with performance in mind, and we have optimized the browser to be as fast as possible! Checkout the latest [performance benchmarks](https://docs.zen-browser.app/benchmarks)!
-
-## 📥 Installation
-
-### Supported Operating Systems
-
-Zen is available for Linux, macOS, and Windows. You can download the latest version from the official website at [zen-browser.app](https://zen-browser.app/download), or from the [GitHub Releases](https://github.com/zen-browser/desktop/releases) page.
-
-If you dont see your OS listed below, that's because we already have it in our [downloads page](https://zen-browser.app/download)! Make sure to check it out!
-
-#### Windows
-
-##### Winget
-
-```ps
-winget install --id Zen-Team.Zen-Browser
-```
-
-#### macOS
-
-- Requires macOS 10.15 or later
-- Available for ARM and Intel architectures
-
-You can also install Zen using Homebrew:
-
-```
-brew install --cask zen-browser
-```
-
-#### Linux
-
-##### Arch-based distributions
-
-```sh
-yay -S zen-browser-bin
-```
-
-##### Other Linux distributions (AppImage with automated system integration)
-
-- `native` tarball install:
-```bash <(curl -s https://updates.zen-browser.app/install.sh)```
-
-- `zsync` is required for the Update feature of the script below
-
-```sh
-bash <(curl https://updates.zen-browser.app/appimage.sh)
-```
-
-* Again, if you don't see your OS listed above, that's because we already have it in our [downloads page](https://zen-browser.app/download)! 🔄
-
-To upgrade the browser to a newer version, use the embedded update functionality in `About Zen`.
-
-## 👨‍💻 Development and Contributing
-
-Some components used by @zen-browser as an attempt to make firefox forks a better place, and for other to enjoy the beauty of OSS. You can find them [here](https://github.com/zen-browser/desktop/tree/dev/src/browser/base/zen-components).
-
-#### `Run Locally`
-
-In order to download and run zen locally, please follow [these instructions](https://docs.zen-browser.app/contribute/desktop).
-
-#### `Special Thanks`
-
-Special thanks to... EVERYONE 🎉! Checkout the team and contributors page [here](https://zen-browser.app/about)
-
-#### `Third Party Code`
-
-Zen couldn't be in its current state without the help of these amazing projects! 🙏
-
-- Zen's default preferences are based on [BetterFox](https://github.com/yokoffing/Betterfox)
-- Gradient image extracted from [Arc Palette](https://github.com/neurokitti/Arc_Palette)
-
-### 🖥️ Comparison with other browsers
-
-As you can see, chromium based browsers are the most popular browsers, help us change that by starring the project and spreading the word! 🌟
-
-<a href="https://star-history.com/#zen-browser/desktop&Date">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=zen-browser/desktop,chromium/chromium,brave/brave-browser&type=Date&theme=dark" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=zen-browser/desktop,chromium/chromium,brave/brave-browser&type=Date" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=chromium/chromium,zen-browser/desktop,brave/brave-browser&type=Date" />
- </picture>
+<a href="https://blacksmith.sh">
+  <img src="./docs/assets/blacksmith-yellow.png" width="350px"/>
 </a>
-
-## 📄 License
-
-Zen browser is under the [MPL LICENSE](./LICENSE). All the code is open-source and free to use! Attributions are appreciated but not required.

SECURITY.md

@@ -3,4 +3,9 @@
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/.
    -->
-<svg xmlns="http://www.w3.org/2000/svg" fill="context-fill" fill-opacity="context-fill-opacity" viewBox="0 -960 960 960"><path d="M200-446.667v-66.666h560v66.666H200Z"/></svg>
+
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please report security vulnerabilities [here](https://github.com/zen-browser/desktop/security/advisories/new)

babel.config.json

@@ -0,0 +1,3 @@
+{
+  "presets": ["@babel/preset-typescript"]
+}

build/AppDir/AppRun

@@ -0,0 +1,10 @@
+#!/bin/sh
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+CURRENTDIR="$(dirname "$(readlink -f "$0")")"
+export PATH="${CURRENTDIR}:${PATH}"
+export MOZ_LEGACY_PROFILES=1          # Prevent per installation profiles
+export MOZ_APP_LAUNCHER="${APPIMAGE}" # Allows setting as default browser
+exec "${CURRENTDIR}/zen" "$@"

build/AppDir/zen.desktop

@@ -0,0 +1,698 @@
+[Desktop Entry]
+Name=Zen Browser
+Comment=A fast, private and secure web browser built to improve your day-to-day experience.
+Exec=zen %u
+Icon=zen
+Type=Application
+MimeType=application/json;application/pdf;application/rdf+xml;application/rss+xml;application/x-xpinstall;application/xhtml+xml;application/xml;audio/flac;audio/ogg;audio/webm;image/avif;image/gif;image/jpeg;image/png;image/svg+xml;image/webp;text/html;text/xml;video/ogg;video/webm;x-scheme-handler/chrome;x-scheme-handler/http;x-scheme-handler/https;x-scheme-handler/mailto;
+StartupWMClass=zen
+Categories=Network;WebBrowser;
+StartupNotify=true
+Terminal=false
+X-MultipleArgs=false
+GenericName=Web Browser
+GenericName[ach]=Web Browser
+GenericName[af]=Web Browser
+GenericName[an]=Web Browser
+GenericName[ar]=متصفح الوِب
+GenericName[ast]=Web Browser
+GenericName[az]=Web Browser
+GenericName[be]=Вэб-браўзер
+GenericName[bg]=Уеб браузър
+GenericName[bn]=ওয়েব ব্রাউজার
+GenericName[bqi]=گشت گر وب
+GenericName[br]=Merdeer Web
+GenericName[brx]=Web Browser
+GenericName[bs]=Web pretraživač
+GenericName[ca]=Navegador web
+GenericName[ca_valencia]=Web Browser
+GenericName[cak]=Web Okik'amaya'l
+GenericName[ckb]=Web Browser
+GenericName[cs]=Webový prohlížeč
+GenericName[cy]=Porwr Gwe
+GenericName[da]=Webbrowser
+GenericName[de]=Internet-Browser
+GenericName[dsb]=Webwobglědowak
+GenericName[el]=Πρόγραμμα περιήγησης
+GenericName[en_CA]=Web Browser
+GenericName[en_GB]=Web Browser
+GenericName[eo]=Retumilo
+GenericName[es_AR]=Navegador web
+GenericName[es_CL]=Navegador Web
+GenericName[es_ES]=Navegador web
+GenericName[es_MX]=Navegador Web
+GenericName[et]=Web Browser
+GenericName[eu]=Web nabigatzailea
+GenericName[fa]=مرورگر وب
+GenericName[ff]=Web Browser
+GenericName[fi]=Verkkoselain
+GenericName[fr]=Navigateur web
+GenericName[fur]=Navigadôr Web
+GenericName[fy_NL]=Webbrowser
+GenericName[ga_IE]=Web Browser
+GenericName[gd]=Brabhsair-lìn
+GenericName[gl]=Navegador web
+GenericName[gn]=Ñanduti Kundahára
+GenericName[gu_IN]=Web Browser
+GenericName[he]=דפדפן אינטרנט
+GenericName[hi_IN]=Web Browser
+GenericName[hr]=Web preglednik
+GenericName[hsb]=Webwobhladowak
+GenericName[hu]=Webböngésző
+GenericName[hy_AM]=Վեբ դիտարկիչ
+GenericName[hye]=Web Browser
+GenericName[ia]=Navigator web
+GenericName[id]=Peramban Web
+GenericName[is]=Vafri
+GenericName[it]=Browser web
+GenericName[ja]=ウェブブラウザー
+GenericName[ka]=ბრაუზერი
+GenericName[kab]=Iminig web
+GenericName[kk]=Веб-браузері
+GenericName[km]=Web Browser
+GenericName[kn]=Web Browser
+GenericName[ko]=웹 브라우저
+GenericName[lij]=Navegatô Web
+GenericName[lo]=ຕົວ​ທ່ອງ​ເວັບ​ເວັບ​ໄຊ​ຕ​໌
+GenericName[lt]=Web Browser
+GenericName[ltg]=Web Browser
+GenericName[lv]=Tīmekļa pārlūks
+GenericName[meh]=Web Browser
+GenericName[mk]=Web Browser
+GenericName[ml]=ഗോളാന്തരവല അന്വേഷിയന്ത്രം
+GenericName[mr]=Web Browser
+GenericName[ms]=Web Browser
+GenericName[my]=Web Browser
+GenericName[nb_NO]=Nettleser
+GenericName[ne_NP]=वेब ब्राउजर
+GenericName[nl]=Webbrowser
+GenericName[nn_NO]=Nettlesar
+GenericName[oc]=Navegador Web
+GenericName[pa_IN]=ਵੈੱਬ ਬਰਾਊਜ਼ਰ
+GenericName[pl]=Przeglądarka internetowa
+GenericName[pt_BR]=Navegador web
+GenericName[pt_PT]=Navegador Web
+GenericName[rm]=Navigatur web
+GenericName[ro]=Browser web
+GenericName[ru]=Веб-браузер
+GenericName[sat]=ᱣᱮᱵᱽ ᱵᱽᱨᱟᱣᱡᱚᱨ
+GenericName[sc]=Navigadore web
+GenericName[sco]=Web Browser
+GenericName[si]=වියමන අතිරික්සුව
+GenericName[sk]=Webový prehliadač
+GenericName[skr]=ویب براؤزر
+GenericName[sl]=Spletni brskalnik
+GenericName[son]=Web Browser
+GenericName[sq]=Shfletues
+GenericName[sr]=Веб прегледач
+GenericName[sv_SE]=Webbläsare
+GenericName[szl]=Web Browser
+GenericName[ta]=Web Browser
+GenericName[te]=జాల విహారిణి
+GenericName[tg]=Браузери веб
+GenericName[th]=เว็บเบราว์เซอร์
+GenericName[tl]=Web Browser
+GenericName[tr]=Web Tarayıcısı
+GenericName[trs]=Web riña gāchē nu’
+GenericName[uk]=Браузер
+GenericName[ur]=Web Browser
+GenericName[uz]=Web Browser
+GenericName[vi]=Trình duyệt web
+GenericName[wo]=Web Browser
+GenericName[xh]=Web Browser
+GenericName[zh_CN]=Web 浏览器
+GenericName[zh_TW]=網頁瀏覽器
+Keywords=Internet;WWW;Browser;Web;Explorer;
+Keywords[ach]=Internet;WWW;Browser;Web;Explorer;
+Keywords[af]=Internet;WWW;Browser;Web;Explorer;
+Keywords[an]=Internet;WWW;Browser;Web;Explorer;
+Keywords[ar]=إنترنت;WWW;متصفح;ويب;مستكشف;
+Keywords[ast]=Internet;WWW;Browser;Web;Explorer;
+Keywords[az]=Internet;WWW;Browser;Web;Explorer;
+Keywords[be]=Internet;WWW;Browser;Web;Explorer;
+Keywords[bg]=Internet;WWW;Browser;Web;Explorer;
+Keywords[bn]=ইন্টারনেট;WWW;ব্রাউজার;ওয়েব;এক্সপ্লোরার;
+Keywords[bqi]=Internet;WWW;Browser;Web;Explorer;
+Keywords[br]=Internet;WWW;Merdeer;Web;Ergerzhout;
+Keywords[brx]=Internet;WWW;Browser;Web;Explorer;
+Keywords[bs]=Internet;WWW;Pretraživač;Web;Istraživač;
+Keywords[ca]=Internet;WWW;Browser;Web;Explorador;Navegador;
+Keywords[ca_valencia]=Internet;WWW;Browser;Web;Explorer;
+Keywords[cak]=K'amaya'l;WWW;Okik'amaya'l;Kanob'äl;
+Keywords[ckb]=Internet;WWW;Browser;Web;Explorer;
+Keywords[cs]=internet;WWW;prohlížeč;web;
+Keywords[cy]=Rhyngrwyd;WWW;Porwr;Gwe;Archwiliwr;
+Keywords[da]=Internet;WWW;Browser;Nettet;Explorer;
+Keywords[de]=Internet;WWW;Browser;Web;Explorer;
+Keywords[dsb]=Internet;WWW;wobglědowak;Web;Explorer;
+Keywords[el]=Internet;WWW;Browser;Web;Explorer;Διαδίκτυο;Ιστός;Ίντερνετ;
+Keywords[en_CA]=Internet;WWW;Browser;Web;Explorer;
+Keywords[en_GB]=Internet;WWW;Browser;Web;Explorer;
+Keywords[eo]=Interreto;Retumilo;TTT;Teksaĵo;Reto;Internet;WWW;Browser;Web;Explorer;
+Keywords[es_AR]=Internet;WWW;Navegador;Web;Explorador;
+Keywords[es_CL]=Internet;WWW;Navegador;Web;Explorador;
+Keywords[es_ES]=Internet;WWW;Navegador;Web;Explorador;
+Keywords[es_MX]=Internet;WWW;Navegador;Web;Explorador;
+Keywords[et]=Internet;WWW;Browser;Web;Explorer;
+Keywords[eu]=Internet;WWW;Nabigatzailea;Web;Arakatzailea;
+Keywords[fa]=Internet;WWW;Browser;Web;Explorer;
+Keywords[ff]=Internet;WWW;Browser;Web;Explorer;
+Keywords[fi]=Internet;WWW;Browser;Web;Explorer;netti;webbi;selain;
+Keywords[fr]=Internet;WWW;Navigateur;Web;Explorer;
+Keywords[fur]=Internet;WWW;Browser;Navigadôr;Web;Esploradôr;Explorer;
+Keywords[fy_NL]=Ynternet;WWW;Browser;Web;Ferkenner;
+Keywords[ga_IE]=Internet;WWW;Browser;Web;Explorer;
+Keywords[gd]=Internet;WWW;Browser;Web;Explorer;eadar-lìon;brabhsair;brobhsair;lìon;taisgealaiche;
+Keywords[gl]=Internet;WWW;Navegador;Web;Explorador;
+Keywords[gn]=Internet;WWW;Browser;Web;Explorer;
+Keywords[gu_IN]=Internet;WWW;Browser;Web;Explorer;
+Keywords[he]=אינטרנט;WWW;דפדפן;רשת;סייר;מרשתת;
+Keywords[hi_IN]=Internet;WWW;Browser;Web;Explorer;
+Keywords[hr]=Internet;WWW;Preglednik;Web;Istraživač;
+Keywords[hsb]=Internet;WWW;wobhladowak;Web;Explorer;
+Keywords[hu]=Internet;WWW;Böngésző;Web;Világháló;
+Keywords[hy_AM]=Համացանց,WWW,Զննիչ,Վեբ,Ցանցախույզ:
+Keywords[hye]=Internet;WWW;Browser;Web;Explorer;
+Keywords[ia]=Internet;WWW;Navigator;Web;Explorator;
+Keywords[id]=Internet;WWW;Browser;Web;Explorer;
+Keywords[is]=Internet;WWW; Vafri; Vefur; Explorer;
+Keywords[it]=Internet;WWW;Browser;Web;Explorer;Navigatore;
+Keywords[ja]=Internet;WWW;Browser;Web;Explorer;インターネット;ブラウザー;ウェブ;
+Keywords[ka]=ინტერნეტი;WWW;ბრაუზერი;ქსელი;ქსელთან წვდომა;
+Keywords[kab]=Internet;WWW;Browser;Web;Explorer;
+Keywords[kk]=Internet;WWW;Browser;Web;Explorer;Интернет;Ғаламтор;Браузер;Желі;Шолғыш;
+Keywords[km]=Internet;WWW;Browser;Web;Explorer;
+Keywords[kn]=Internet;WWW;Browser;Web;Explorer;
+Keywords[ko]=인터넷;브라우저;웹;탐색기;Internet;WWW;Browser;Web;Explorer;
+Keywords[lij]=Internet;WWW;Browser;Web;Explorer;Navegatô;
+Keywords[lo]=Internet;WWW;Browser;Web;Explorer;
+Keywords[lt]=Internet;WWW;Browser;Web;Explorer;
+Keywords[ltg]=Internet;WWW;Browser;Web;Explorer;
+Keywords[lv]=Internets;WWW;Pārlūkprogramma;Tīmeklis;
+Keywords[meh]=Internet;WWW;Browser;Web;Explorer;
+Keywords[mk]=Internet;WWW;Browser;Web;Explorer;
+Keywords[ml]=ഗോളാന്തരവല;WWW;അന്വേഷിയന്ത്രം;ഗോളാന്തരവല;ആരായൻ;
+Keywords[mr]=Internet;WWW;Browser;Web;Explorer;
+Keywords[ms]=Internet;WWW;Browser;Web;Explorer;
+Keywords[my]=Internet;WWW;Browser;Web;Explorer;
+Keywords[nb_NO]=Internett;WWW;Nettleser;Web;Utforsker;
+Keywords[ne_NP]=Internet;WWW;Browser;Web;Explorer;
+Keywords[nl]=Internet;WWW;Browser;Web;Verkenner;
+Keywords[nn_NO]=Internett;WWW;Nettlesar;Web;Utforskar;
+Keywords[oc]=Internet;WWW;Navegador;Navigador;Navegator;Navigator;Web;Explorer;
+Keywords[pa_IN]=ਇੰਟਰਨੈੱਟ;WWW;ਬਰਾਊਜ਼ਰ;ਵੈੱਬ;ਐਕਸਪਲਰੋਰ;ਵੈਬ;ਇੰਟਰਨੈਟ;
+Keywords[pl]=Internet;WWW;Przeglądarka;Browser;Wyszukiwarka;Web;Sieć;Explorer;Eksplorer;Strony;Witryny;internetowe;
+Keywords[pt_BR]=Internet;WWW;Browser;Web;Explorer;Navegador;
+Keywords[pt_PT]=Internet;WWW;Navegador;Web;Explorador;
+Keywords[rm]=Internet;WWW;Browser;Web;Explorer;navigatur;
+Keywords[ro]=Internet; WWW; Browser; Web; Explorer;
+Keywords[ru]=Сеть;Интернет;Браузер;Доступ в Интернет;
+Keywords[sat]=Internet;WWW;Browser;Web;Explorer;
+Keywords[sc]=Internet;WWW;Navigadore;Web;Explorer;
+Keywords[sco]=Internet;WWW;Browser;Web;Explorer;
+Keywords[si]=අන්තර්ජාලය;අතිරික්සුව;පිරික්සන්න;ගවේශකය;Internet;WWW;Browser;Web;Explorer;
+Keywords[sk]=Internet;WWW;Prehliadač;Web;Prieskumník;
+Keywords[skr]=Internet;WWW;Browser;Web;Explorer;
+Keywords[sl]=internet;www;brskalnik;splet;
+Keywords[son]=Internet;WWW;Browser;Web;Explorer;
+Keywords[sq]=Internet;WWW;Shfletues;Web;Eksplorues;
+Keywords[sr]=Internet;WWW;Browser;Web;Explorer;интернет;њњњ;веб;мрежа;прегледач;експлорер;internet;pregledač;veb;mreža;pregledač;eksplorer;
+Keywords[sv_SE]=Internet;WWW;Webbläsare;Webb;Utforskare;
+Keywords[szl]=Internet;WWW;Browser;Web;Explorer;
+Keywords[ta]=Internet;WWW;Browser;Web;Explorer;
+Keywords[te]=Internet;WWW;Browser;Web;Explorer;
+Keywords[tg]=Интернет;WWW;Браузер;Сомона;Ҷустуҷӯгар;
+Keywords[th]=อินเทอร์เน็ต;เบราว์เซอร์;เว็บ;Internet;WWW;Browser;Web;Explorer;
+Keywords[tl]=Internet;WWW;Browser;Web;Explorer;
+Keywords[tr]=Internet;WWW;Browser;Web;Explorer;İnternet;Tarayıcı;
+Keywords[trs]=Internet;WWW;Browser;Web;Explorer;
+Keywords[uk]=Інтернет;WWW;Браузер;Веб;Переглядач;
+Keywords[ur]=Internet;WWW;Browser;Web;Explorer;
+Keywords[uz]=Internet;WWW;Browser;Web;Explorer;
+Keywords[vi]=Internet;WWW;Trình duyệt;Web;Duyệt web;
+Keywords[wo]=Internet;WWW;Browser;Web;Explorer;
+Keywords[xh]=Internet;WWW;Browser;Web;Explorer;
+Keywords[zh_CN]=Internet;WWW;Browser;Web;Explorer;
+Keywords[zh_TW]=網際網路;網路;瀏覽器;網頁;上網;Internet;WWW;Browser;Web;Explorer;
+Actions=new-window;new-blank-window;new-private-window;profilemanager;
+X-AppImage-Version=$VERSION
+
+[Desktop Action new-window]
+Exec=zen %u
+Name=New Window
+Name[ach]=New Window
+Name[af]=New Window
+Name[an]=New Window
+Name[ar]=نافذة جديدة
+Name[ast]=New Window
+Name[az]=New Window
+Name[be]=Новае акно
+Name[bg]=Нов прозорец
+Name[bn]=নতুন উইন্ডো
+Name[bqi]=نیمدری نۊ
+Name[br]=Prenestr nevez
+Name[brx]=New Window
+Name[bs]=Novi prozor
+Name[ca]=Finestra nova
+Name[ca_valencia]=New Window
+Name[cak]=K'ak'a' Tzuwäch
+Name[ckb]=New Window
+Name[cs]=Nové okno
+Name[cy]=Ffenestr Newydd
+Name[da]=Nyt vindue
+Name[de]=Neues Fenster
+Name[dsb]=Nowe wokno
+Name[el]=Νέο παράθυρο
+Name[en_CA]=New Window
+Name[en_GB]=New Window
+Name[eo]=Nova fenestro
+Name[es_AR]=Nueva ventana
+Name[es_CL]=Nueva ventana
+Name[es_ES]=Nueva ventana
+Name[es_MX]=Nueva ventana
+Name[et]=New Window
+Name[eu]=Leiho berria
+Name[fa]=پنجره جدید‌
+Name[ff]=New Window
+Name[fi]=Uusi ikkuna
+Name[fr]=Nouvelle fenêtre
+Name[fur]=Gnûf barcon
+Name[fy_NL]=Nij finster
+Name[ga_IE]=New Window
+Name[gd]=Uinneag ùr
+Name[gl]=Nova xanela
+Name[gn]=Ovetã pyahu
+Name[gu_IN]=New Window
+Name[he]=חלון חדש
+Name[hi_IN]=New Window
+Name[hr]=Novi prozor
+Name[hsb]=Nowe wokno
+Name[hu]=Új ablak
+Name[hy_AM]=Նոր պատուհան
+Name[hye]=New Window
+Name[ia]=Nove fenestra
+Name[id]=Jendela Baru
+Name[is]=Nýr gluggi
+Name[it]=Nuova finestra
+Name[ja]=新しいウィンドウ
+Name[ka]=ახალი ფანჯარა
+Name[kab]=Asfaylu amaynut
+Name[kk]=Жаңа терезе
+Name[km]=បង្អួច​​​ថ្មី
+Name[kn]=New Window
+Name[ko]=새 창
+Name[lij]=Neuvo Barcon
+Name[lo]=ວິນໂດໃໝ່
+Name[lt]=New Window
+Name[ltg]=New Window
+Name[lv]=Jauns logs
+Name[meh]=New Window
+Name[mk]=New Window
+Name[ml]=പുതിയ ജാലകം
+Name[mr]=New Window
+Name[ms]=New Window
+Name[my]=New Window
+Name[nb_NO]=Nytt vindu
+Name[ne_NP]=नयाँ सञ्झ्याल
+Name[nl]=Nieuw venster
+Name[nn_NO]=Nytt vindauge
+Name[oc]=Fenèstra novèla
+Name[pa_IN]=ਨਵੀਂ ਵਿੰਡੋ
+Name[pl]=Nowe okno
+Name[pt_BR]=Nova janela
+Name[pt_PT]=Nova janela
+Name[rm]=Nova fanestra
+Name[ro]=Fereastră nouă
+Name[ru]=Новое окно
+Name[sat]=ᱱᱟᱶᱟ ᱣᱤᱱᱰᱳ
+Name[sc]=Ventana noa
+Name[sco]=New Window
+Name[si]=නව කවුළුව
+Name[sk]=Nové okno
+Name[skr]=نویں ونڈو
+Name[sl]=Novo okno
+Name[son]=New Window
+Name[sq]=Dritare e Re
+Name[sr]=Нови прозор
+Name[sv_SE]=Nytt fönster
+Name[szl]=New Window
+Name[ta]=New Window
+Name[te]=కొత్త కిటికీ
+Name[tg]=Равзанаи нав
+Name[th]=หน้าต่างใหม่
+Name[tl]=New Window
+Name[tr]=Yeni pencere
+Name[trs]=Bēntanâ nākàa
+Name[uk]=Нове вікно
+Name[ur]=New Window
+Name[uz]=New Window
+Name[vi]=Cửa sổ mới
+Name[wo]=New Window
+Name[xh]=New Window
+Name[zh_CN]=新建窗口
+Name[zh_TW]=開新視窗
+
+[Desktop Action new-blank-window]
+Exec=zen --blank-window %u
+Name=New Blank Window
+Name[ach]=New Blank Window
+Name[af]=New Blank Window
+Name[an]=New Blank Window
+Name[ar]=نافذة فارغة جديدة
+Name[ast]=New Blank Window
+Name[az]=New Blank Window
+Name[be]=Новае пустое акно
+Name[bg]=Нов празен прозорец
+Name[bn]=নতুন ফাঁকা উইন্ডো
+Name[bqi]=نیمدری نۊ خالی
+Name[br]=Prenestr goulloù nevez
+Name[brx]=New Blank Window
+Name[bs]=Novi prazni prozor
+Name[ca]=Finestra en blanc nova
+Name[ca_valencia]=New Blank Window
+Name[cak]=K'ak'a' Tzuwäch K'axk'ol
+Name[ckb]=New Blank Window
+Name[cs]=Nové prázdné okno
+Name[cy]=Ffenestr Wag Newydd
+Name[da]=Nyt tomt vindue
+Name[de]=Neues leeres Fenster
+Name[dsb]=Nowe prázdne wokno
+Name[el]=Νέο κενό παράθυρο
+Name[en_CA]=New Blank Window
+Name[en_GB]=New Blank Window
+Name[eo]=Nova malplena fenestro
+Name[es_AR]=Nueva ventana en blanco
+Name[es_CL]=Nueva ventana en blanco
+Name[es_ES]=Nueva ventana en blanco
+Name[es_MX]=Nueva ventana en blanco
+Name[et]=New Blank Window
+Name[eu]=Leiho huts berri
+Name[fa]=پنجره خالی جدید
+Name[ff]=New Blank Window
+Name[fi]=Uusi tyhjä ikkuna
+Name[fr]=Nouvelle fenêtre vierge
+Name[fur]=Gnûf barcon vuot
+Name[fy_NL]=Nij leeg finster
+Name[ga_IE]=New Blank Window
+Name[gd]=Uinneag bhàn ùr
+Name[gl]=Nova xanela en branco
+Name[gn]=Ovetã ñemi pyahu
+Name[gu_IN]=New Blank Window
+Name[he]=חלון ריק חדש
+Name[hi_IN]=New Blank Window
+Name[hr]=Novi prazni prozor
+Name[hsb]=Nowe prázdne wokno
+Name[hu]=Új üres ablak
+Name[hy_AM]=Նոր դատարկ պատուհան
+Name[hye]=New Blank Window
+Name[ia]=Nove fenestra vacue
+Name[id]=Jendela Kosong Baru
+Name[is]=Nýr tómur gluggi
+Name[it]=Nuova finestra vuota
+Name[ja]=新しい空白のウィンドウ
+Name[ka]=ახალი ცარიელი ფანჯარა
+Name[kab]=Asfaylu amaynut n tunigin tusligt
+Name[kk]=Жаңа бос терезе
+Name[km]=បង្អួច​ថ្មី​ឯកជន
+Name[kn]=New Blank Window
+Name[ko]=새 빈 창
+Name[lij]=Neuvo Barcon Vuot
+Name[lo]=ວິນໂດແອ່ງໃໝ່
+Name[lt]=New Blank Window
+Name[ltg]=New Blank Window
+Name[lv]=Jauns tukšais logs
+Name[meh]=New Blank Window
+Name[mk]=New Blank Window
+Name[ml]=പുതിയ ശൂന്യ ജാലകം
+Name[mr]=New Blank Window
+Name[ms]=New Blank Window
+Name[my]=New Blank Window
+Name[nb_NO]=Nytt tomt vindu
+Name[ne_NP]=नयाँ खाली सञ्झ्याल
+Name[nl]=Nieuw leeg venster
+Name[nn_NO]=Nytt tomt vindauge
+Name[oc]=Fenèstra en blanc novèla
+Name[pa_IN]=ਨਵੀਂ ਖਾਲੀ ਵਿੰਡੋ
+Name[pl]=Nowe puste okno
+Name[pt_BR]=Nova janela em branco
+Name[pt_PT]=Nova janela em branco
+Name[rm]=Nova fanestra vacue
+Name[ro]=Fereastră nouă și goală
+Name[ru]=Новое пустое окно
+Name[sat]=ᱱᱟᱶᱟ ᱣᱤᱱᱰᱳ ᱵᱽᱨᱟᱣᱡᱚᱨ
+Name[sc]=Ventana en blanc noa
+Name[sco]=New Blank Window
+Name[si]=නව හිස් කවුළුව
+Name[sk]=Nové prázdné okno
+Name[skr]=نویں خالی ونڈو
+Name[sl]=Novo prazno okno
+Name[son]=New Blank Window
+Name[sq]=Dritare e Re e Pafajshme
+Name[sr]=Нови празни прозор
+Name[sv_SE]=Nytt tomt fönster
+Name[szl]=New Blank Window
+Name[ta]=New Blank Window
+Name[te]=కొత్త ఖాళీ కిటికీ
+Name[tg]=Равзанаи холӣ нав
+Name[th]=หน้าต่างว่างเปล่าใหม่
+Name[tl]=New Blank Window
+Name[tr]=Yeni boş pencere
+Name[trs]=Bēntanâ huì nākàa
+Name[uk]=Нове порожнє вікно
+Name[ur]=New Blank Window
+Name[uz]=New Blank Window
+Name[vi]=Cửa sổ trống mới
+Name[wo]=New Blank Window
+Name[xh]=New Blank Window
+Name[zh_CN]=新建空白窗口
+Name[zh_TW]=開新空白視窗
+
+[Desktop Action new-private-window]
+Exec=zen --private-window %u
+Name=New Private Window
+Name[ach]=New Private Window
+Name[af]=New Private Window
+Name[an]=New Private Window
+Name[ar]=نافذة خاصة جديدة
+Name[ast]=New Private Window
+Name[az]=New Private Window
+Name[be]=Новае прыватнае акно
+Name[bg]=Нов личен прозорец
+Name[bn]=নতুন ব্যক্তিগত উইন্ডো
+Name[bqi]=نیمدری سیخومی نۊ
+Name[br]=Prenestr prevez nevez
+Name[brx]=New Private Window
+Name[bs]=Novi privatni prozor
+Name[ca]=Finestra privada nova
+Name[ca_valencia]=New Private Window
+Name[cak]=K'ak'a' Ichinan Tzuwäch
+Name[ckb]=New Private Window
+Name[cs]=Nové anonymní okno
+Name[cy]=Ffenestr Breifat Newydd
+Name[da]=Nyt privat vindue
+Name[de]=Neues privates Fenster
+Name[dsb]=Nowe priwatne wokno
+Name[el]=Νέο ιδιωτικό παράθυρο
+Name[en_CA]=New Private Window
+Name[en_GB]=New Private Window
+Name[eo]=Nova privata fenestro
+Name[es_AR]=Nueva ventana privada
+Name[es_CL]=Nueva ventana privada
+Name[es_ES]=Nueva ventana privada
+Name[es_MX]=Nueva ventana privada
+Name[et]=New Private Window
+Name[eu]=Leiho pribatu berria
+Name[fa]=پنجره ناشناس جدید
+Name[ff]=New Private Window
+Name[fi]=Uusi yksityinen ikkuna
+Name[fr]=Nouvelle fenêtre privée
+Name[fur]=Gnûf barcon privât
+Name[fy_NL]=Nij priveefinster
+Name[ga_IE]=New Private Window
+Name[gd]=Uinneag phrìobhaideach ùr
+Name[gl]=Nova xanela privada
+Name[gn]=Ovetã ñemi pyahu
+Name[gu_IN]=New Private Window
+Name[he]=חלון פרטי חדש
+Name[hi_IN]=New Private Window
+Name[hr]=Novi privatni prozor
+Name[hsb]=Nowe priwatne wokno
+Name[hu]=Új privát ablak
+Name[hy_AM]=Նոր գաղտնի պատուհան
+Name[hye]=New Private Window
+Name[ia]=Nove fenestra private
+Name[id]=Jendela Mode Pribadi Baru
+Name[is]=Nýr huliðsgluggi
+Name[it]=Nuova finestra anonima
+Name[ja]=新しいプライベートウィンドウ
+Name[ka]=ახალი პირადი ფანჯარა
+Name[kab]=Asfaylu amaynut n tunigin tusligt
+Name[kk]=Жаңа жекелік терезе
+Name[km]=បង្អួច​ឯកជន​ថ្មី
+Name[kn]=New Private Window
+Name[ko]=새 사생활 보호 창
+Name[lij]=Neuvo Barcon Privòu
+Name[lo]=ວິນໂດສ່ວນຕົວໃໝ່
+Name[lt]=New Private Window
+Name[ltg]=New Private Window
+Name[lv]=Jauns privātais logs
+Name[meh]=New Private Window
+Name[mk]=New Private Window
+Name[ml]=പുതിയ സ്വകാര്യ ജാലകം
+Name[mr]=New Private Window
+Name[ms]=New Private Window
+Name[my]=New Private Window
+Name[nb_NO]=Nytt privat vindu
+Name[ne_NP]=नयाँ निजी सञ्झ्याल
+Name[nl]=Nieuw privévenster
+Name[nn_NO]=Nytt privat vindauge
+Name[oc]=Fenèstra privada novèla
+Name[pa_IN]=ਨਵੀਂ ਪ੍ਰਾਈਵੇਟ ਵਿੰਡੋ
+Name[pl]=Nowe okno prywatne
+Name[pt_BR]=Nova janela privativa
+Name[pt_PT]=Nova janela privada
+Name[rm]=Nova fanestra privata
+Name[ro]=Fereastră privată nouă
+Name[ru]=Новое приватное окно
+Name[sat]=ᱱᱟᱶᱟ ᱱᱤᱡᱮᱨᱟᱜ ᱣᱤᱱᱰᱳ
+Name[sc]=Ventana privada noa
+Name[sco]=New Private Window
+Name[si]=නව පෞද්. කවුළුව
+Name[sk]=Nové súkromné okno
+Name[skr]=نویں نجی ونڈو
+Name[sl]=Novo zasebno okno
+Name[son]=New Private Window
+Name[sq]=Dritare e Re Private
+Name[sr]=Нови приватни прозор
+Name[sv_SE]=Nytt privat fönster
+Name[szl]=New Private Window
+Name[ta]=New Private Window
+Name[te]=కొత్త ఆంతరంగిక కిటికీ
+Name[tg]=Равзанаи хусусии нав
+Name[th]=หน้าต่างส่วนตัวใหม่
+Name[tl]=New Private Window
+Name[tr]=Yeni gizli pencere
+Name[trs]=Bēntanâ huì nākàa
+Name[uk]=Приватне вікно
+Name[ur]=New Private Window
+Name[uz]=New Private Window
+Name[vi]=Cửa sổ riêng tư mới
+Name[wo]=New Private Window
+Name[xh]=New Private Window
+Name[zh_CN]=新建隐私窗口
+Name[zh_TW]=開新隱私視窗
+
+[Desktop Action profilemanager]
+Exec=zen --ProfileManager %u
+Name=Open Profile Manager
+Name[ach]=Open Profile Manager
+Name[af]=Open Profile Manager
+Name[an]=Open Profile Manager
+Name[ar]=افتح مدير الملف الشخصي
+Name[ast]=Open Profile Manager
+Name[az]=Open Profile Manager
+Name[be]=Адкрыць менеджар профіляў
+Name[bg]=Отваряне на мениджъра на профили
+Name[bn]=Open Profile Manager
+Name[bqi]=گۊشیڌن دؽوۉداری پوروفایل
+Name[br]=Digeriñ an ardoer aeladoù
+Name[brx]=Open Profile Manager
+Name[bs]=Otvori Menadžera profila
+Name[ca]=Obre el gestor de perfils
+Name[ca_valencia]=Open Profile Manager
+Name[cak]=Open Profile Manager
+Name[ckb]=Open Profile Manager
+Name[cs]=Otevřít Správce profilů
+Name[cy]=Agorwch y Rheolwr Proffil
+Name[da]=Åbn profilhåndtering
+Name[de]=Profilverwaltung öffnen
+Name[dsb]=Profilowy zastojnik wócyniś
+Name[el]=Άνοιγμα Διαχείρισης προφίλ
+Name[en_CA]=Open Profile Manager
+Name[en_GB]=Open Profile Manager
+Name[eo]=Malfermi administranton de profiloj
+Name[es_AR]=Abrir administrador de perfiles
+Name[es_CL]=Abrir administrador de perfiles
+Name[es_ES]=Abrir administrador de perfiles
+Name[es_MX]=Abrir administrador de perfiles
+Name[et]=Open Profile Manager
+Name[eu]=Ireki profilen kudeatzailea
+Name[fa]=گشودن مدیر نمایه
+Name[ff]=Open Profile Manager
+Name[fi]=Avaa profiilien hallinta
+Name[fr]=Ouvrir le gestionnaire de profils
+Name[fur]=Vierç gjestôr profîi
+Name[fy_NL]=Profylbehearder iepenje
+Name[ga_IE]=Open Profile Manager
+Name[gd]=Fosgail manaidsear nam pròifilean
+Name[gl]=Abrir o xestor de perfís
+Name[gn]=Embojuruja mba’ete ñangarekoha
+Name[gu_IN]=Open Profile Manager
+Name[he]=פתיחת מנהל הפרופילים
+Name[hi_IN]=Open Profile Manager
+Name[hr]=Otvori upravljač profila
+Name[hsb]=Zrjadowak profilow wočinić
+Name[hu]=Profilkezelő megnyitása
+Name[hy_AM]=Բացեք պրոֆիլի կառավարիչը
+Name[hye]=Open Profile Manager
+Name[ia]=Aperir le gestor de profilo
+Name[id]=Buka Pengelola Profil
+Name[is]=Opna umsýslu notandasniða
+Name[it]=Apri gestore profili
+Name[ja]=プロファイルマネージャーを開く
+Name[ka]=პროფილის მმართველის გახსნა
+Name[kab]=Ldi amsefrak n umaɣnu
+Name[kk]=Профильдер бақарушысын ашу
+Name[km]=Open Profile Manager
+Name[kn]=Open Profile Manager
+Name[ko]=프로필 관리자 열기
+Name[lij]=Open Profile Manager
+Name[lo]=ເປີດຕົວຈັດການໂປຣໄຟລ໌
+Name[lt]=Open Profile Manager
+Name[ltg]=Open Profile Manager
+Name[lv]=Atvērt profilu pārvaldnieku
+Name[meh]=Open Profile Manager
+Name[mk]=Open Profile Manager
+Name[ml]=രൂപരേഖ മാനേചർ
+Name[mr]=Open Profile Manager
+Name[ms]=Open Profile Manager
+Name[my]=Open Profile Manager
+Name[nb_NO]=Åpne profilbehandler
+Name[ne_NP]=Open Profile Manager
+Name[nl]=Profielbeheerder openen
+Name[nn_NO]=Opne profilhandsaming
+Name[oc]=Dobrir lo gestionari de perfils
+Name[pa_IN]=ਪਰੋਫ਼ਾਈਲ ਮੈਨੇਜਰ ਖੋਲ੍ਹੋ
+Name[pl]=Menedżer profili
+Name[pt_BR]=Abrir gerenciador de perfis
+Name[pt_PT]=Abrir o Gestor de Perfis
+Name[rm]=Avrir l'administraziun da profils
+Name[ro]=Deschide managerul de profiluri
+Name[ru]=Открыть менеджер профилей
+Name[sat]=ᱢᱮᱫᱦᱟᱸ ᱢᱮᱱᱮᱡᱚᱨ ᱠᱷᱩᱞᱟᱹᱭ ᱢᱮ
+Name[sc]=Aberi su gestore de profilos
+Name[sco]=Open Profile Manager
+Name[si]=පැතිකඩ කළමනාකරු අරින්න
+Name[sk]=Otvoriť Správcu profilov
+Name[skr]=پروفائل منیجر کھولو
+Name[sl]=Odpri upravitelja profilov
+Name[son]=Open Profile Manager
+Name[sq]=Hapni Përgjegjës Profilesh
+Name[sr]=Отворите управљач профила
+Name[sv_SE]=Öppna Profilhanteraren
+Name[szl]=Open Profile Manager
+Name[ta]=Open Profile Manager
+Name[te]=Open Profile Manager
+Name[tg]=Кушодани мудири профилҳо
+Name[th]=เปิดตัวจัดการโปรไฟล์
+Name[tl]=Open Profile Manager
+Name[tr]=Profil yöneticisini aç
+Name[trs]=Sa nīkāj ñu’ūnj nej perfî huā nì’nï̀nj ïn
+Name[uk]=Відкрити менеджер профілів
+Name[ur]=Open Profile Manager
+Name[uz]=Open Profile Manager
+Name[vi]=Mở trình quản lý hồ sơ
+Name[wo]=Open Profile Manager
+Name[xh]=Open Profile Manager
+Name[zh_CN]=打开配置文件管理器
+Name[zh_TW]=開啟設定檔管理員

build/codesign/browser.developer.entitlements.xml

@@ -1,32 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<!--
-     Entitlements to apply to the main browser process executable during
-     codesigning of production channel builds.
--->
-<plist version="1.0">
-  <dict>
-    <!-- Firefox needs to create executable pages (without MAP_JIT) -->
-    <key>com.apple.security.cs.allow-unsigned-executable-memory</key><true/>
-
-    <!-- Firefox needs to create executable pages with MAP_JIT on aarch64 -->
-    <key>com.apple.security.cs.allow-jit</key><true/>
-
-    <!-- Allow loading third party libraries. Needed for Flash and CDMs -->
-    <key>com.apple.security.cs.disable-library-validation</key><true/>
-
-    <!-- Firefox needs to access the microphone on sites the user allows -->
-    <key>com.apple.security.device.audio-input</key><true/>
-
-    <!-- Firefox needs to access the camera on sites the user allows -->
-    <key>com.apple.security.device.camera</key><true/>
-
-    <!-- Firefox needs to access the location on sites the user allows -->
-    <key>com.apple.security.personal-information.location</key><true/>
-
-    <!-- Allow Firefox to send Apple events to other applications. Needed
-         for native messaging webextension helper applications launched by
-         Firefox which rely on Apple Events to signal other processes. -->
-    <key>com.apple.security.automation.apple-events</key><true/>
-  </dict>
-</plist>

build/codesign/codesign.bash

@@ -1,169 +0,0 @@
-#!/bin/bash
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# Runs codesign commands to codesign a Firefox .app bundle and enable macOS
-# Hardened Runtime. Intended to be manually run by developers working on macOS
-# 10.14+ who want to enable Hardened Runtime for manual testing. This is
-# provided as a stop-gap until automated build tooling is available that signs
-# binaries with a certificate generated during builds (bug 1522409). This
-# script requires macOS 10.14 because Hardened Runtime is only available for
-# applications running on 10.14 despite support for the codesign "-o runtime"
-# option being available in 10.13.6 and newer.
-#
-# The script requires an identity string (-i option) from an Apple Developer
-# ID certificate. This can be found in the macOS KeyChain after configuring an
-# Apple Developer ID certificate.
-#
-# Example usage on macOS 10.14:
-#
-#   $ ./mach build
-#   $ ./mach build package
-#   $ open </PATH/TO/DMG/FILE.dmg>
-#   <Drag Nightly.app to ~>
-#   $ ./security/mac/hardenedruntime/codesign.bash \
-#         -a ~/Nightly.app \
-#         -i <MY-IDENTITY-STRING> \
-#         -b security/mac/hardenedruntime/browser.developer.entitlements.xml
-#         -p security/mac/hardenedruntime/plugin-container.developer.entitlements.xml
-#   $ open ~/Nightly.app
-#
-
-usage ()
-{
-  echo  "Usage: $0 "
-  echo  "    -a <PATH-TO-BROWSER.app>"
-  echo  "    -i <IDENTITY>"
-  echo  "    -b <ENTITLEMENTS-FILE>"
-  echo  "    -p <CHILD-ENTITLEMENTS-FILE>"
-  echo  "    [-o <OUTPUT-DMG-FILE>]"
-  exit -1
-}
-
-# Make sure we are running on macOS with the sw_vers command available.
-SWVERS=/usr/bin/sw_vers
-if [ ! -x ${SWVERS} ]; then
-    echo "ERROR: macOS 10.14 or later is required"
-    exit -1
-fi
-
-# Require macOS 10.14 or newer.
-#OSVERSION=`${SWVERS} -productVersion|sed -En 's/[0-9]+\.([0-9]+)\.[0-9]+/\1/p'`;
-#if [ ${OSVERSION} \< 14 ]; then
-#    echo "ERROR: macOS 10.14 or later is required"
-#    exit -1
-#fi
-
-while getopts "a:i:b:o:p:" opt; do
-  case ${opt} in
-    a ) BUNDLE=$OPTARG ;;
-    i ) IDENTITY=$OPTARG ;;
-    b ) BROWSER_ENTITLEMENTS_FILE=$OPTARG ;;
-    p ) PLUGINCONTAINER_ENTITLEMENTS_FILE=$OPTARG ;;
-    o ) OUTPUT_DMG_FILE=$OPTARG ;;
-    \? ) usage; exit -1 ;;
-  esac
-done
-
-if [ -z "${BUNDLE}" ] ||
-   [ -z "${IDENTITY}" ] ||
-   [ -z "${PLUGINCONTAINER_ENTITLEMENTS_FILE}" ] ||
-   [ -z "${BROWSER_ENTITLEMENTS_FILE}" ]; then
-    usage
-    exit -1
-fi
-
-if [ ! -d "${BUNDLE}" ]; then
-  echo "Invalid bundle. Bundle should be a .app directory"
-  usage
-  exit -1
-fi
-
-if [ ! -e "${PLUGINCONTAINER_ENTITLEMENTS_FILE}" ]; then
-  echo "Invalid entitlements file"
-  usage
-  exit -1
-fi
-
-if [ ! -e "${BROWSER_ENTITLEMENTS_FILE}" ]; then
-  echo "Invalid entitlements file"
-  usage
-  exit -1
-fi
-
-# DMG file output flag is optional
-if [ ! -z "${OUTPUT_DMG_FILE}" ] &&
-   [ -e "${OUTPUT_DMG_FILE}" ]; then
-  echo "Output dmg file ${OUTPUT_DMG_FILE} exists. Please delete it first."
-  usage
-  exit -1
-fi
-
-echo "-------------------------------------------------------------------------"
-echo "bundle:                              $BUNDLE"
-echo "identity:                            $IDENTITY"
-echo "browser entitlements file:           $BROWSER_ENTITLEMENTS_FILE"
-echo "plugin-container entitlements file:  $PLUGINCONTAINER_ENTITLEMENTS_FILE"
-echo "output dmg file (optional):          $OUTPUT_DMG_FILE"
-echo "-------------------------------------------------------------------------"
-
-set -x
-
-# Clear extended attributes which cause codesign to fail
-xattr -cr "${BUNDLE}"
-
-# Sign these binaries first. Signing of some binaries has an ordering
-# requirement where other binaries must be signed first.
-codesign --force -o runtime --verbose --sign "$IDENTITY" \
-"${BUNDLE}/Contents/Library/LaunchServices/org.mozilla.updater" \
-"${BUNDLE}/Contents/MacOS/XUL" \
-"${BUNDLE}/Contents/MacOS/pingsender" \
-"${BUNDLE}/Contents/MacOS/*.dylib" \
-
-codesign --force -o runtime --verbose --sign "$IDENTITY" --deep \
-"${BUNDLE}"/Contents/MacOS/updater.app
-
-# Sign zen main executable
-codesign --force -o runtime --verbose --sign "$IDENTITY" --deep \
---entitlements ${BROWSER_ENTITLEMENTS_FILE} \
-"${BUNDLE}"/Contents/MacOS/zen
-
-# Sign Library/LaunchServices
-codesign --force -o runtime --verbose --sign "$IDENTITY" --deep \
-"${BUNDLE}"/Contents/Library/LaunchServices/org.mozilla.updater
-
-# Sign gmp-clearkey files
-find "${BUNDLE}"/Contents/Resources/gmp-clearkey -type f -exec \
-codesign --force -o runtime --verbose --sign "$IDENTITY" {} \;
-
-# Sign the main bundle
-codesign --force -o runtime --verbose --sign "$IDENTITY" \
---entitlements ${BROWSER_ENTITLEMENTS_FILE} "${BUNDLE}"
-
-# Sign the plugin-container bundle with deep
-codesign --force -o runtime --verbose --sign "$IDENTITY" --deep \
---entitlements ${PLUGINCONTAINER_ENTITLEMENTS_FILE} \
-"${BUNDLE}"/Contents/MacOS/plugin-container.app
-
-# Validate
-codesign -vvv --deep --strict "${BUNDLE}"
-
-# Create a DMG
-if [ ! -z "${OUTPUT_DMG_FILE}" ]; then
-  DISK_IMAGE_DIR=`mktemp -d`
-  TEMP_FILE=`mktemp`
-  TEMP_DMG=${TEMP_FILE}.dmg
-  NAME=`basename "${BUNDLE}"`
-
-  ditto "${BUNDLE}" "${DISK_IMAGE_DIR}/${NAME}"
-  hdiutil create -size 400m -fs HFS+ \
-    -volname Firefox -srcfolder "${DISK_IMAGE_DIR}" "${TEMP_DMG}"
-  hdiutil convert -format UDZO \
-    -o "${OUTPUT_DMG_FILE}" "${TEMP_DMG}"
-
-  rm ${TEMP_FILE}
-  rm ${TEMP_DMG}
-  rm -rf "${DISK_IMAGE_DIR}"
-fi

build/codesign/plugin-container.developer.entitlements.xml

@@ -1,32 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<!--
-     Entitlements to apply to the plugin-container.app bundle during
-     codesigning of production channel builds.
--->
-<plist version="1.0">
-  <dict>
-    <!-- Firefox needs to create executable pages (without MAP_JIT) -->
-    <key>com.apple.security.cs.allow-unsigned-executable-memory</key><true/>
-
-    <!-- Firefox needs to create executable pages with MAP_JIT on aarch64 -->
-    <key>com.apple.security.cs.allow-jit</key><true/>
-
-    <!-- Allow loading third party libraries. Needed for Flash and CDMs -->
-    <key>com.apple.security.cs.disable-library-validation</key><true/>
-
-    <!-- Firefox needs to access the microphone on sites the user allows -->
-    <key>com.apple.security.device.audio-input</key><true/>
-
-    <!-- Firefox needs to access the camera on sites the user allows -->
-    <key>com.apple.security.device.camera</key><true/>
-
-    <!-- Firefox needs to access the location on sites the user allows -->
-    <key>com.apple.security.personal-information.location</key><true/>
-
-    <!-- Allow Firefox to send Apple events to other applications. Needed
-         for native messaging webextension helper applications launched by
-         Firefox which rely on Apple Events to signal other processes. -->
-    <key>com.apple.security.automation.apple-events</key><true/>
-  </dict>
-</plist>

build/firefox-cache/l10n-last-commit-hash

@@ -0,0 +1 @@
+10b4efc5a79c2ab80de3b22771b1d36b9b225920

build/flatpak/app.zen_browser.zen.yml.template

@@ -0,0 +1,77 @@
+app-id: app.zen_browser.zen
+runtime: org.freedesktop.Platform
+runtime-version: '25.08'
+sdk: org.freedesktop.Sdk
+base: org.mozilla.firefox.BaseApp
+base-version: '25.08'
+add-extensions:
+  app.zen_browser.zen.systemconfig:
+    directory: etc/zen
+    no-autodownload: true
+command: launch-script.sh
+finish-args:
+  - --allow=devel
+  - --share=ipc
+  - --share=network
+  - --socket=pulseaudio
+  - --socket=wayland
+  - --socket=fallback-x11
+  - --socket=pcsc
+  - --socket=cups
+  - --persist=.zen
+  - --env=DICPATH=/usr/share/hunspell
+  - --filesystem=xdg-download:rw
+  - --filesystem=/run/.heim_org.h5l.kcm-socket
+  - --filesystem=xdg-run/speech-dispatcher:ro
+  - --device=all
+  - --talk-name=org.freedesktop.FileManager1
+  - --system-talk-name=org.freedesktop.NetworkManager
+  - --talk-name=org.a11y.Bus
+  - --talk-name=org.gtk.vfs.*
+  - --own-name=org.mpris.MediaPlayer2.firefox.*
+  - --own-name=org.mozilla.zen.*
+cleanup:
+  - /include
+  - /lib/pkgconfig
+  - /share/pkgconfig
+  - /share/aclocal
+  - /share/gtk-doc
+  - /share/doc
+  - /share/info
+  - /man
+  - /share/man
+  - '*.la'
+  - '*.a'
+modules:
+  - name: zen_browser
+    buildsystem: simple
+    build-commands:
+      - mv zen /app/
+      - mkdir -p /app/etc/zen
+
+      - install -Dm0755 metadata/launch-script.sh ${{FLATPAK_DEST}}/bin/launch-script.sh
+      - install -Dm0644 metadata/policies.json ${{FLATPAK_DEST}}/bin/distribution/policies.json
+      - install -Dm0644 metadata/icons/${{FLATPAK_ID}}.svg ${{FLATPAK_DEST}}/share/icons/hicolor/scalable/apps/${{FLATPAK_ID}}.svg
+      - install -Dm0644 metadata/${{FLATPAK_ID}}.metainfo.xml ${{FLATPAK_DEST}}/share/metainfo/${{FLATPAK_ID}}.metainfo.xml
+      - install -Dm0644 metadata/${{FLATPAK_ID}}.desktop ${{FLATPAK_DEST}}/share/applications/${{FLATPAK_ID}}.desktop
+
+    sources:
+      - type: archive
+        url: https://github.com/zen-browser/desktop/releases/download/{version}/zen.linux-x86_64.tar.xz
+        sha256: {linux_sha256}
+        strip-components: 0
+        only-arches:
+          - x86_64
+
+      - type: archive
+        url: https://github.com/zen-browser/desktop/releases/download/{version}/zen.linux-aarch64.tar.xz
+        sha256: {linux_aarch64_sha256}
+        strip-components: 0
+        only-arches:
+          - aarch64
+
+      - type: archive
+        url: https://github.com/zen-browser/flatpak/releases/download/{version}/archive.tar
+        sha256: {flatpak_sha256}
+        strip-components: 0
+        dest: metadata

build/ts/transform-ts.js

@@ -0,0 +1,14 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+const fs = require("fs");
+const MJS_FILES = ["src/zen/split-view/ZenViewSplitter.ts"];
+
+for (const file of MJS_FILES) {
+  const code = fs.readFileSync(file, "utf8");
+  require("@babel/core").transformSync(code, {
+    presets: ["@babel/preset-typescript"],
+    filename: file,
+  });
+}

build/windows/.windows-rs-version

@@ -0,0 +1 @@
+0.62.2

build/windows/bootstrap.ps1

@@ -0,0 +1,13 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+(New-Object System.Net.WebClient).DownloadFile("https://ftp.mozilla.org/pub/mozilla/libraries/win32/MozillaBuildSetup-Latest.exe", "C:\MozillaBuildSetup-Latest.exe")
+C:\MozillaBuildSetup-Latest.exe /S | out-null
+
+rustup target add aarch64-pc-windows-msvc
+rustup target add x86_64-pc-windows-msvc
+
+cd engine
+./mach python --virtualenv build taskcluster/scripts/misc/get_vs.py build/vs/vs2026.yaml ../win-cross/vs2026
+cd ..

build/windows/firefox_update.ps1

@@ -0,0 +1,15 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+Remove-Item -Recurse -Force engine
+Remove-Item -Recurse -Force .surfer
+
+npm run init
+
+$job = Start-Job -ScriptBlock {
+    npm run build
+}
+
+# Wait for job to complete with timeout (in seconds)
+$job | Wait-Job -Timeout 5

build/windows/sign.ps1

@@ -0,0 +1,236 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+param(
+    [string][Parameter(Mandatory=$true)]$SignIdentity,
+    [string][Parameter(Mandatory=$true)]$SignIdentityIssuer,
+    [string][Parameter(Mandatory=$true)]$GithubRunId
+)
+
+$ErrorActionPreference = "Stop"
+
+echo "Preparing environment"
+git pull origin dev --recurse
+mkdir windsign-temp -ErrorAction SilentlyContinue
+
+# Download in parallel
+
+#show output too
+#Start-Job -Name "DownloadGitObjectsRepo" -ScriptBlock {
+#    param($PWD)
+#    echo "Downloading git objects repo to $PWD\windsign-temp\windows-binaries"
+#    git clone https://github.com/zen-browser/windows-binaries.git $PWD\windsign-temp\windows-binaries
+#    echo "Downloaded git objects repo to"
+#} -Verbose -ArgumentList $PWD -Debug
+
+$env:SURFER_MOZCONFIG_ONLY="1"
+$env:SURFER_SIGNING_MODE=""
+
+$env:SURFER_CERT_PATCH_ISSUER=$SignIdentityIssuer
+$env:SURFER_CERT_PATCH_NAME=$SignIdentity
+
+Start-Job -Name "DownloadGitl10n" -ScriptBlock {
+    param($PWD)
+    cd $PWD
+    $env:ZEN_L10N_CURR_DIR=[regex]::replace($PWD, "^([A-Z]):", { "/" + $args.value.Substring(0, 1).toLower() }) -replace "\\", "/"
+    C:\mozilla-build\start-shell.bat $PWD\scripts\download-language-packs.sh
+    echo "Fetched l10n and Firefox's one"
+} -Verbose -ArgumentList $PWD -Debug
+
+$surferJson = Get-Content surfer.json | ConvertFrom-Json
+$version = $surferJson.brands.release.release.displayVersion
+npm run ci -- $version
+npm run import -- --verbose
+npm run build
+
+echo "Downloading artifacts info"
+$artifactsInfo=gh api repos/zen-browser/desktop/actions/runs/$GithubRunId/artifacts
+$token = gh auth token
+
+function New-TemporaryDirectory {
+    $tmp = [System.IO.Path]::GetTempPath() # Not $env:TEMP, see https://stackoverflow.com/a/946017
+    $name = (New-Guid).ToString("N")
+    New-Item -ItemType Directory -Path (Join-Path $tmp $name)
+}
+
+function DownloadFile($url, $targetFile) {
+   $uri = New-Object "System.Uri" "$url"
+   $request = [System.Net.HttpWebRequest]::Create($uri)
+   $request.UserAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3"
+   $request.Headers.Add("Authorization", "Bearer $token")
+   $response = $request.GetResponse()
+   $totalLength = [System.Math]::Floor($response.get_ContentLength()/1024)
+   $responseStream = $response.GetResponseStream()
+   $targetStream = New-Object -TypeName System.IO.FileStream -ArgumentList $targetFile, Create
+   $buffer = new-object byte[] 10KB
+   $count = $responseStream.Read($buffer,0,$buffer.length)
+   $downloadedBytes = $count
+
+    while ($count -gt 0) {
+        $targetStream.Write($buffer, 0, $count)
+        $count = $responseStream.Read($buffer,0,$buffer.length)
+        $downloadedBytes = $downloadedBytes + $count
+        Write-Progress -activity "Downloading file '$($url.split('/') | Select -Last 1)'" -status "Downloaded ($([System.Math]::Floor($downloadedBytes/1024))K of $($totalLength)K): " -PercentComplete ((([System.Math]::Floor($downloadedBytes/1024)) / $totalLength)  * 100)
+    }
+
+   Write-Progress -activity "Finished downloading file '$($url.split('/') | Select -Last 1)'"
+
+   $targetStream.Flush()
+   $targetStream.Close()
+   $targetStream.Dispose()
+   $responseStream.Dispose()
+}
+
+function DownloadArtifacts($name) {
+    echo "Downloading artifacts for $name"
+    $artifactUrl=$($artifactsInfo | jq -r --arg NAME "windows-x64-obj-$name" '.artifacts[] | select(.name == $NAME) | .archive_download_url')
+    echo "Artifact URL: $artifactUrl"
+
+    # download the artifact
+    $outputPath="$PWD\windsign-temp\windows-x64-obj-$name"
+    $tempDir = New-TemporaryDirectory
+    $tempFile = Join-Path $tempDir "artifact-$($name).zip"
+
+    echo "Downloading artifact to $tempFile"
+    DownloadFile $artifactUrl $tempFile
+
+    Start-Job -Name "UnzipArtifact$name" -ScriptBlock {
+        param($tempFile, $outputPath)
+        echo "Unzipping artifact to $outputPath"
+        Expand-Archive -Path $tempFile -DestinationPath $outputPath -Force
+        echo "Unzipped artifact to $outputPath"
+    } -ArgumentList $tempFile, $outputPath -Verbose -Debug
+}
+
+DownloadArtifacts arm64
+DownloadArtifacts x86_64
+
+# Wait for the jobs to finish
+Wait-Job -Name "UnzipArtifactarm64"
+Wait-Job -Name "UnzipArtifactx86_64"
+
+mkdir engine\obj-x86_64-pc-windows-msvc\ -ErrorAction SilentlyContinue
+
+# Collect all .exe and .dll files into a list
+$files = Get-ChildItem windsign-temp\windows-x64-obj-x86_64\ -Recurse -Include *.exe
+$files += Get-ChildItem windsign-temp\windows-x64-obj-x86_64\ -Recurse -Include *.dll
+
+$files += Get-ChildItem windsign-temp\windows-x64-obj-arm64\ -Recurse -Include *.exe
+$files += Get-ChildItem windsign-temp\windows-x64-obj-arm64\ -Recurse -Include *.dll
+
+signtool.exe sign /n "$SignIdentity" /t http://time.certum.pl/ /fd sha256 /v $files
+
+$env:ZEN_RELEASE="true"
+$env:SURFER_SIGNING_MODE="true"
+$env:SCCACHE_GHA_ENABLED="false"
+Wait-Job -Name "DownloadGitl10n"
+
+function SignAndPackage($name) {
+    echo "Executing on $name"
+    rmdir .\dist -Recurse -ErrorAction SilentlyContinue
+    rmdir engine\obj-$name-pc-windows-msvc\ -Recurse -ErrorAction SilentlyContinue
+    $objName=$name
+    # instead of arm, use aarch64
+    if ($name -eq "arm64") {
+        $objName="aarch64"
+    }
+
+    echo "Removing old obj dir"
+    rmdir engine\obj-$objName-pc-windows-msvc\ -Recurse -ErrorAction SilentlyContinue
+
+    echo "Creating new obj dir"
+    cp windsign-temp\windows-x64-obj-$name engine\obj-$objName-pc-windows-msvc\ -Recurse
+
+    echo "Copying setup.exe into obj dir"
+    $env:ZEN_SETUP_EXE_PATH="$PWD\windsign-temp\windows-x64-obj-$name\browser\installer\windows\instgen\setup.exe"
+
+    if ($name -eq "arm64") {
+        $env:WIN32_REDIST_DIR="$PWD\win-cross\vs2026\VC\Redist\MSVC\14.50.35710\arm64\Microsoft.VC145.CRT"
+    } else {
+        $env:WIN32_REDIST_DIR="$PWD\win-cross\vs2026\VC\Redist\MSVC\14.50.35710\x64\Microsoft.VC145.CRT"
+    }
+
+    $env:MAR="..\\build\\windows\\mar.exe"
+    if ($name -eq "arm64") {
+        $env:SURFER_COMPAT="aarch64"
+    } else {
+        $env:SURFER_COMPAT="x86_64"
+    }
+    echo "Compat Mode? $env:SURFER_COMPAT"
+
+    # Configure each time since we are cloning from a linux environment into
+    # a windows environment, and the build system is not smart enough to detect that
+    # we are on a different platform.
+    cd .\engine
+    echo "Configuring for $name"
+    .\mach configure
+    cd ..
+
+    echo "Packaging $name"
+    npm run package -- --verbose
+
+    # In the release script, we do the following:
+    #  tar -xvf .github/workflows/object/windows-x64-signed-x86_64.tar.gz -C windows-x64-signed-x86_64
+    # We need to create a tar with the same structure and no top-level directory
+    # Inside, we need:
+    #  - update_manifest/*
+    #  - windows.mar
+    #  - zen.installer.exe
+    echo "Creating tar for $name"
+    rm .\windsign-temp\windows-x64-signed-$name -Recurse -ErrorAction SilentlyContinue
+    mkdir windsign-temp\windows-x64-signed-$name
+
+    # Move the MAR, add the `-arm64` suffix if needed
+    echo "Moving MAR for $name"
+    if ($name -eq "arm64") {
+        mv .\dist\output.mar windsign-temp\windows-x64-signed-$name\windows-$name.mar
+    } else {
+        mv .\dist\output.mar windsign-temp\windows-x64-signed-$name\windows.mar
+    }
+
+    # Move the installer
+    echo "Moving installer for $name"
+    if ($name -eq "arm64") {
+        mv .\dist\zen.installer.exe windsign-temp\windows-x64-signed-$name\zen.installer-$name.exe
+    } else {
+        mv .\dist\zen.installer.exe windsign-temp\windows-x64-signed-$name\zen.installer.exe
+    }
+
+    # Move the manifest
+    mv .\dist\update\. windsign-temp\windows-x64-signed-$name\update_manifest
+
+    # note: We need to sign it into a parent folder, called windows-x64-signed-$name
+    rmdir .\windsign-temp\windows-binaries\windows-x64-signed-$name -Recurse -ErrorAction SilentlyContinue
+    mv windsign-temp\windows-x64-signed-$name .\windsign-temp\windows-binaries -Force
+    rmdir engine\obj-$objName-pc-windows-msvc\ -Recurse -ErrorAction SilentlyContinue
+
+    echo "Finished $name"
+}
+
+SignAndPackage arm64
+SignAndPackage x86_64
+
+$files = Get-ChildItem .\windsign-temp\windows-binaries -Recurse -Include *.exe
+signtool.exe sign /n "$SignIdentity" /t http://time.certum.pl/ /fd sha256 /v $files
+
+echo "All artifacts signed and packaged, ready for release!"
+echo "Commiting the changes to the repository"
+cd windsign-temp\windows-binaries
+git add .
+git commit -m "Sign and package windows artifacts"
+git push
+cd ..\..
+
+# Cleaning up
+
+echo "All done!"
+echo "All the artifacts (x86_64 and arm46) are signed and packaged, get a rest now!"
+Read-Host "Press Enter to continue"
+
+echo "Cleaning up"
+rmdir windsign-temp\windows-x64-obj-x86_64 -Recurse -ErrorAction SilentlyContinue
+rmdir windsign-temp\windows-x64-obj-arm64 -Recurse -ErrorAction SilentlyContinue
+
+echo "Opening visual studio code"
+code .

build/winsign/sign.ps1

@@ -1,136 +0,0 @@
-param(
-    [string][Parameter(Mandatory=$true)]$SignIdentity,
-    [string][Parameter(Mandatory=$true)]$GithubRunId
-)
-
-$ErrorActionPreference = "Stop"
-
-echo "Preparing environment"
-git pull --recurse-submodules
-mkdir windsign-temp -ErrorAction SilentlyContinue
-
-# Download in parallel
-
-#show output too
-#Start-Job -Name "DownloadGitObjectsRepo" -ScriptBlock {
-#    param($PWD)
-#    echo "Downloading git objects repo to $PWD\windsign-temp\windows-binaries"
-#    git clone https://github.com/zen-browser/windows-binaries.git $PWD\windsign-temp\windows-binaries
-#    echo "Downloaded git objects repo to"
-#} -Verbose -ArgumentList $PWD -Debug
-
-gh run download $GithubRunId --name windows-x64-obj-arm64 -D windsign-temp\windows-x64-obj-arm64
-echo "Downloaded arm64 artifacts"
-gh run download $GithubRunId --name windows-x64-obj-x86_64 -D windsign-temp\windows-x64-obj-x86_64
-echo "Downloaded x86_64 artifacts"
-
-
-#Wait-Job -Name "DownloadGitObjectsRepo"
-
-mkdir engine\obj-x86_64-pc-windows-msvc\ -ErrorAction SilentlyContinue
-
-pnpm surfer ci --brand beta
-
-function SignAndPackage($name) {
-    echo "Executing on $name"
-    rmdir .\dist -Recurse -ErrorAction SilentlyContinue
-    rmdir engine\obj-x86_64-pc-windows-msvc\ -Recurse -ErrorAction SilentlyContinue
-    cp windsign-temp\windows-x64-obj-$name engine\obj-x86_64-pc-windows-msvc\ -Recurse
-    echo "Signing $name"
-
-    # Collect all .exe and .dll files into a list
-    $files = Get-ChildItem engine\obj-x86_64-pc-windows-msvc\ -Recurse -Include *.exe
-    $files += Get-ChildItem engine\obj-x86_64-pc-windows-msvc\ -Recurse -Include *.dll
-
-    signtool.exe sign /n "$SignIdentity" /t http://time.certum.pl/ /fd sha256 /v $files
-    echo "Packaging $name"
-    $env:SURFER_SIGNING_MODE="sign"
-    $env:MAR="$PWD\\build\\winsign\\mar.exe"
-    if ($name -eq "arm64") {
-        $env:SURFER_COMPAT="aarch64"
-    } else {
-        $env:SURFER_COMPAT="x86_64"
-    }
-
-    echo "Compat Mode? $env:SURFER_COMPAT"
-    pnpm surfer package --verbose
-
-    # In the release script, we do the following:
-    #  tar -xvf .github/workflows/object/windows-x64-signed-x86_64.tar.gz -C windows-x64-signed-x86_64
-    # We need to create a tar with the same structure and no top-level directory
-    # Inside, we need:
-    #  - update_manifest/*
-    #  - windows.mar
-    #  - zen.installer.exe
-    #  - zen.win-x86_64.zip
-    echo "Creating tar for $name"
-    rm .\windsign-temp\windows-x64-signed-$name -Recurse -ErrorAction SilentlyContinue
-    mkdir windsign-temp\windows-x64-signed-$name
-
-    # Move the MAR, add the `-arm64` suffix if needed
-    echo "Moving MAR for $name"
-    if ($name -eq "arm64") {
-        mv .\dist\output.mar windsign-temp\windows-x64-signed-$name\windows-$name.mar
-    } else {
-        mv .\dist\output.mar windsign-temp\windows-x64-signed-$name\windows.mar
-    }
-
-    # Move the installer
-    echo "Moving installer for $name"
-    if ($name -eq "arm64") {
-        mv .\dist\zen.installer.exe windsign-temp\windows-x64-signed-$name\zen.installer-$name.exe
-    } else {
-        mv .\dist\zen.installer.exe windsign-temp\windows-x64-signed-$name\zen.installer.exe
-    }
-
-    # Move the zip
-    echo "Moving zip for $name"
-    if ($name -eq "arm64") {
-        mv (Get-Item .\dist\*.en-US.win64-aarch64.zip) windsign-temp\windows-x64-signed-$name\zen.win-arm64.zip
-    } else {
-        mv (Get-Item .\dist\*.en-US.win64.zip) windsign-temp\windows-x64-signed-$name\zen.win-$name.zip
-    }
-
-    # Extract the zip, sign everything inside, and repackage it
-    Expand-Archive -Path windsign-temp\windows-x64-signed-$name\zen.win-$name.zip -DestinationPath windsign-temp\windows-x64-signed-$name\zen.win-$name
-    rm windsign-temp\windows-x64-signed-$name\zen.win-$name.zip
-    $files = Get-ChildItem windsign-temp\windows-x64-signed-$name\zen.win-$name -Recurse -Include *.exe
-    $files += Get-ChildItem windsign-temp\windows-x64-signed-$name\zen.win-$name -Recurse -Include *.dll
-    signtool.exe sign /n "$SignIdentity" /t http://time.certum.pl/ /fd sha256 /v $files
-    Compress-Archive -Path windsign-temp\windows-x64-signed-$name\zen.win-$name -DestinationPath windsign-temp\windows-x64-signed-$name\zen.win-$name.zip
-    rmdir windsign-temp\windows-x64-signed-$name\zen.win-$name -Recurse -ErrorAction SilentlyContinue
-
-    # Move the manifest
-    mv .\dist\update\. windsign-temp\windows-x64-signed-$name\update_manifest
-
-    echo "Invoking tar for $name"
-    # note: We need to sign it into a parent folder, called windows-x64-signed-$name
-    rmdir .\windsign-temp\windows-binaries\windows-x64-signed-$name -Recurse -ErrorAction SilentlyContinue
-    mv windsign-temp\windows-x64-signed-$name .\windsign-temp\windows-binaries -Force
-
-    echo "Finished $name"
-}
-
-SignAndPackage arm64
-SignAndPackage x86_64
-
-echo "All artifacts signed and packaged, ready for release!"
-echo "Commiting the changes to the repository"
-cd windsign-temp\windows-binaries
-git add .
-git commit -m "Sign and package windows artifacts"
-git push
-cd ..\..
-
-# Cleaning up
-
-echo "All done!"
-echo "All the artifacts (x86_64 and arm46) are signed and packaged, get a rest now!"
-Read-Host "Press Enter to continue"
-
-echo "Cleaning up"
-rmdir windsign-temp\windows-x64-obj-x86_64 -Recurse -ErrorAction SilentlyContinue
-rmdir windsign-temp\windows-x64-obj-arm64 -Recurse -ErrorAction SilentlyContinue
-
-echo "Opening visual studio code"
-code .

configs/common/mozconfig

@@ -1,18 +1,19 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
 # Browser branding
 ac_add_options --with-app-name=${binName}
 ac_add_options --with-app-basename=Zen
-ac_add_options --enable-official-branding
 
-# Localization
-ac_add_options --with-l10n-base="$PWD/browser/locales"
+# Localization (Must be an absolute path)
+ac_add_options --with-l10n-base="${topsrcdir}/browser/locales"
 
-export MOZ_USER_DIR="${name}"
 export MOZ_APP_BASENAME=Zen
-export MOZ_APP_PROFILE=${binName}
-export MOZ_APP_DISPLAYNAME="${name}"
 export MOZ_BRANDING_DIRECTORY=${brandingDir}
 export MOZ_OFFICIAL_BRANDING_DIRECTORY=${brandingDir}
-export MOZ_DISTRIBUTION_ID=${appId}
+
+ac_add_options --with-distribution-id=app.zen-browser
 
 # Uncomment if builds are too resource hungry
 # mk_add_options MOZ_MAKE_FLAGS="-j4"
@@ -25,9 +26,36 @@ export MOZ_INCLUDE_SOURCE_INFO=1
 
 ac_add_options --enable-application=browser
 
+if test "$SCCACHE_GHA_ENABLED" = "true"; then
+  if test -x "$(command -v sccache)"; then
+    ac_add_options --with-ccache=sccache
+  elif test -f "$HOME/.mozbuild/sccache/sccache"; then
+    ac_add_options --with-ccache="$HOME"/.mozbuild/sccache/sccache
+  fi
+
+  mk_add_options 'export RUSTC_WRAPPER=sccache'
+  mk_add_options 'export CCACHE_CPP2=yes'
+fi
+
+# add API keys if it exists on a file
+if test -f "$HOME/.zen-keys/safebrowsing.dat"; then
+  ac_add_options --with-google-safebrowsing-api-keyfile="$HOME/.zen-keys/safebrowsing.dat"
+fi
+
+if test -f "$HOME/.zen-keys/mozilla.dat"; then
+  ac_add_options --with-mozilla-api-keyfile="$HOME/.zen-keys/mozilla.dat"
+fi
+
+if test -f "$HOME/.zen-keys/google_location_service.dat"; then
+  ac_add_options --with-google-location-service-api-keyfile="$HOME/.zen-keys/google_location_service.dat"
+fi
+
 if test "$ZEN_RELEASE"; then
+
   ac_add_options --enable-clang-plugin
-  ac_add_options --enable-bootstrap
+  ac_add_options --enable-bootstrap=-sccache
+
+  ac_add_options --enable-optimize
 
   ac_add_options --enable-release
   ac_add_options --disable-debug
@@ -35,59 +63,42 @@ if test "$ZEN_RELEASE"; then
   ac_add_options --disable-debug-js-modules
   ac_add_options --disable-tests
 
-  ac_add_options --disable-vtune
-
   ac_add_options --enable-rust-simd
   ac_add_options --enable-wasm-simd
 
-  mk_add_options MOZ_PARALLEL_COMPILE=1
-
-  ac_add_options --enable-proxy-bypass-protection
-  ac_add_options --enable-hardening
-  ac_add_options --disable-profiling
-
-  ac_add_options --disable-crashreporter
   ac_add_options --disable-geckodriver
   ac_add_options --disable-rust-tests
 
-  # Done by vlad, if something fails, it's his fault
-  ac_add_options --disable-default-browser-agent
-
   if ! test "$ZEN_DISABLE_LTO"; then
-    export MOZ_LTO=cross,thin
-    ac_add_options --enable-lto=cross,thin
+    # only enable full LTO when ZEN_RELEASE_BRANCH is 'release'
+    if test "$ZEN_RELEASE_BRANCH" = "release"; then
+      # TODO: make it "full" once we have the resources to build it
+      export MOZ_LTO=cross,full
+      ac_add_options --enable-lto=cross,full
+    else
+      export MOZ_LTO=cross,thin
+      ac_add_options --enable-lto=cross,thin
+    fi
   fi
 
-  ac_add_options --enable-jemalloc
-
   mk_add_options MOZILLA_OFFICIAL=1
   MOZILLA_OFFICIAL=1
   export MOZILLA_OFFICIAL=1
 
-  mk_add_options MOZ_OPTIMIZE=2
-  MOZ_OPTIMIZE=2
-  export MOZ_OPTIMIZE=2
-
-  export OPT_LEVEL="3"
-  ac_add_options OPT_LEVEL="3"
-
-  export RUSTC_OPT_LEVEL="3"
-  ac_add_options RUSTC_OPT_LEVEL="3"
-
   mk_add_options AUTOCLOBBER=1
   export AUTOCLOBBER=1
 
-  ac_add_options --enable-updater
-
   export MOZ_PACKAGE_JSSHELL=1
+
+  ac_add_options --disable-crashreporter
+
+  # Experimental flag, enabled only on nightly for Firefox.
+  # Should bring in some nice performance improvements, 
+  # but may cause stability issues.
+  ac_add_options --enable-replace-malloc
 fi
 
-ac_add_options --enable-unverified-updates
-
-ac_add_options --enable-raw
-ac_add_options --enable-webrtc
 ac_add_options --enable-jxl
-ac_add_options --enable-av1
 
 ac_add_options --with-unsigned-addon-scopes=app,system
 
@@ -95,10 +106,9 @@ mk_add_options MOZ_DATA_REPORTING=
 mk_add_options MOZ_SERVICES_HEALTHREPORT=
 mk_add_options MOZ_TELEMETRY_REPORTING=
 
+ac_add_options MOZ_DATA_REPORTING=
+ac_add_options MOZ_TELEMETRY_REPORTING=
+
 # Allow loading unsigned extensions
 export MOZ_REQUIRE_SIGNING=
 mk_add_options MOZ_REQUIRE_SIGNING=
-
-# Sorry ptr, I didnt mean to!
-# Edit: ok, ill remove it, goodbye top #1 on fastest browsers benchmark :[
-# ac_add_options --without-wasm-sandboxed-libraries

configs/dumps/search-config-v2.json

@@ -0,0 +1,19 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this file,
+// You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  "remove": {
+    "identifiers": [
+      // Firefox adds Perplexity by default, we don't want it as
+      // its not very privacy focused.
+      "perplexity",
+
+      // These are not search engines, Firefox adds them by default
+      // but we don't want them.
+      "wikipedia",
+      "wikipedia-*",
+      "ebay",
+      "ebay-*"
+    ]
+  }
+}

configs/linux/mozconfig

@@ -1,3 +1,7 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
 # Setting the compiler based on the existence of clang bin directory
 if test -d "$HOME/.mozbuild/clang/bin"; then
     export CC="$HOME/.mozbuild/clang/bin/clang"
@@ -7,59 +11,36 @@ else
     export CXX=clang++
 fi
 
-if test "$SURFER_COMPAT" = "x86_64"; then
-    ac_add_options --target=x86_64-pc-linux
-    ac_add_options --enable-eme=widevine
-
-    # Enable Profile Guided Optimization
-    export MOZ_PGO=1
-    ac_add_options MOZ_PGO=1
-
-    # Optimization flags for SURFER_COMPAT
-    ac_add_options --enable-optimize="-O3 -march=x86-64"
-
-    export CFLAGS="$CFLAGS -O3 -ffp-contract=fast -march=x86-64"
-    export CPPFLAGS="$CPPFLAGS -O3 -ffp-contract=fast -march=x86-64"
-    export CXXFLAGS="$CXXFLAGS -O3 -flto=thin -ffp-contract=fast -march=x86-64"
-    export LDFLAGS="$LDFLAGS -Wl,-O3 -Wl,-mllvm,-fp-contract=fast -march=x86-64"
-    export RUSTFLAGS="$RUSTFLAGS -C target-cpu=x86-64 -C codegen-units=1 -Clink-args=--icf=safe"
-elif test "$SURFER_COMPAT" = "aarch64"; then
-    ac_add_options --target=aarch64-linux-gnu
-
-    ac_add_options --enable-optimize="-O3"
-
-    export CFLAGS="$CFLAGS -O3"
-    export CPPFLAGS="$CPPFLAGS -O3"
-    export CXXFLAGS="$CXXFLAGS -O3"
-    export LDFLAGS="$LDFLAGS -Wl,-O3"
-    export RUSTFLAGS="$RUSTFLAGS -C codegen-units=1 -Clink-args=--icf=safe"
-fi
-
-    export VERBOSE=1
-    # Uncomment if you want to enable Polly optimizations
-    #export POLLY="-mllvm -polly -mllvm -polly-2nd-level-tiling -mllvm -polly-loopfusion-greedy -mllvm -polly-pattern-matching-based-opts -mllvm -polly-position=before-vectorizer -mllvm -polly-vectorizer=stripmine"
-
-# Common options
-ac_add_options --enable-alsa
-ac_add_options --enable-pulseaudio
-
 if test "$ZEN_RELEASE"; then
+    if test "$SURFER_COMPAT" = "x86_64"; then
+        ac_add_options --target=x86_64-pc-linux
+        ac_add_options --enable-eme=widevine
+
+        # Enable Profile Guided Optimization
+        if ! test "$ZEN_GA_DISABLE_PGO"; then
+            if test "$ZEN_GA_GENERATE_PROFILE"; then
+                mk_add_options "export MOZ_AUTOMATION_PACKAGE_GENERATED_SOURCES=0"
+                ac_add_options --enable-profile-generate=cross
+            else
+                ac_add_options --enable-profile-use=cross
+                ac_add_options --with-pgo-profile-path="$(echo ~)/artifact/merged.profdata"
+                ac_add_options --with-pgo-jarlog="$(echo ~)/artifact/en-US.log"
+            fi
+        fi
+    elif test "$SURFER_COMPAT" = "aarch64"; then
+        ac_add_options --target=aarch64-linux-gnu
+
+        # override LTO settings
+        export MOZ_LTO=cross,thin
+        ac_add_options --enable-lto=cross,thin
+    fi
+
     # Disable DMD and ELF hacks, enable linker lld
-    ac_add_options --disable-dmd
     ac_add_options --enable-linker=lld
     ac_add_options --disable-elf-hack
-    ac_add_options --disable-necko-wifi
 
     # Stripping options for release builds
     ac_add_options --enable-install-strip
     ac_add_options --enable-strip
     export STRIP_FLAGS="--strip-debug --strip-unneeded"
-
-    # Using sccache if available
-    if [ -f /home/runner/.mozbuild/sccache/sccache ]; then
-        mk_add_options 'export RUSTC_WRAPPER=/home/runner/.mozbuild/sccache/sccache'
-        mk_add_options 'export CCACHE_CPP2=yes'
-        ac_add_options --with-ccache=/home/runner/.mozbuild/sccache/sccache
-        mk_add_options 'export SCCACHE_GHA_ENABLED=on'
-    fi
 fi

configs/macos/mozconfig

@@ -1,42 +1,58 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
 unset MOZ_STDCXX_COMPAT
 
 ac_add_options --disable-dmd
 ac_add_options --enable-eme=widevine
 
-export MOZ_MACBUNDLE_ID=${appId}
-export MOZ_MACBUNDLE_NAME="Zen Browser.app"
+if test "$ZEN_RELEASE"; then
+  ac_add_options --with-macos-sdk=/Library/Developer/CommandLineTools/SDKs/MacOSX26.4.sdk
+fi
 
-export MOZ_PGO=1
-ac_add_options MOZ_PGO=1
+if test "$ZEN_RELEASE"; then
+  if ! test "$ZEN_GA_DISABLE_PGO"; then
+    if test "$ZEN_GA_GENERATE_PROFILE"; then
+      mk_add_options "export MOZ_AUTOMATION_PACKAGE_GENERATED_SOURCES=0"
+      ac_add_options --enable-profile-generate=cross
+    else
+      ac_add_options --enable-profile-use=cross
+      ac_add_options --with-pgo-profile-path="$(echo ~)/artifact/merged.profdata"
+      ac_add_options --with-pgo-jarlog="$(echo ~)/artifact/en-US.log"
+    fi
+  fi
+fi
 
 if test "$SURFER_COMPAT" = "x86_64"; then
-    ac_add_options --target=x86_64-apple-darwin
+  ac_add_options --target=x86_64-apple-darwin
 
+  if test "$ZEN_RELEASE"; then
     ac_add_options --enable-wasm-avx
-    ac_add_options --enable-optimize="-march=nehalem -mtune=haswell -O3 -w"
 
-    export CFLAGS="-O3 -march=nehalem"
-    export CPPFLAGS="-O3 -march=nehalem"
-    export CXXFLAGS="-O3 -march=nehalem"
-    export LDFLAGS="-Wl,-O3 -march=nehalem"
-    export RUSTFLAGS="-Ctarget-cpu=nehalem -C codegen-units=1"
+    # override LTO settings
+    export MOZ_LTO=cross,thin
+    ac_add_options --enable-lto=cross,thin
+  fi
 else
-    ac_add_options --target=aarch64-apple-darwin
-
-    ac_add_options --enable-optimize="-O3 -mcpu=apple-m1 -march=armv8.3-a+simd"
+  ac_add_options --target=aarch64-apple-darwin
 
+  if test "$ZEN_RELEASE"; then
     # As of Clang 13, the default is -mcpu=apple-m1 when using a aarch64-apple-macos target,
     # but we're using apple64-apple-darwin, which defaults to -mcpu=apple-a7, which disables
     # a bunch of # performance-enabling CPU features.
-    export CFLAGS="-O3 -march=armv8.3-a+simd -mcpu=apple-m1"
-    export CPPFLAGS="-O3 -march=armv8.3-a+simd -mcpu=apple-m1"
-    export CXXFLAGS="-O3 -march=armv8.3-a+simd -mcpu=apple-m1"
-    export LDFLAGS="-Wl,-O3 -march=armv8.3-a+simd -mcpu=apple-m1"
-    export RUSTFLAGS="-C target-feature=+v8.3a -C codegen-units=1 -Ctarget-cpu=apple-m1"
+    # TODO: We'll want to switch to aarch64-apple-macos eventually.
+    export CFLAGS="$CFLAGS -mcpu=apple-m1"
+    export CXXFLAGS="$CXXFLAGS -mcpu=apple-m1"
+  fi
 fi
 
-export VERBOSE=1
-
-# Enable polly for macos, since they have a more stable set of GPU drivers,
-# unlike Linux, which has a lot of different drivers.
-export POLLY="-mllvm -polly -mllvm -polly-2nd-level-tiling -mllvm -polly-loopfusion-greedy -mllvm -polly-pattern-matching-based-opts -mllvm -polly-position=before-vectorizer -mllvm -polly-vectorizer=stripmine"
+# Keep using ld64 on PGO/LTO builds because of performance regressions when using lld.
+# Mozilla sets "MOZ_LD64_KNOWN_GOOD" to true when they do automated builds with PGO/LTO on macOS.
+# See https://searchfox.org/firefox-main/rev/e61d59b5c9a651fd7bf28043f87c0dc669833496/build/moz.configure/lto-pgo.configure#261
+# export MOZ_LD64_KNOWN_GOOD=1
+# ac_add_options --enable-linker=ld64
+# 
+# if test "$ZEN_RELEASE"; then
+#   mk_add_options MOZ_MAKE_FLAGS="-j4"
+# fi

configs/windows/mozconfig

@@ -1,9 +1,12 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 if test "$ZEN_CROSS_COMPILING"; then
 
-  export WINSYSROOT="$(echo ~)/win-cross/vs2022"
+  export WINSYSROOT="$(echo ~)/win-cross/vs2026"
 
-  export WINE="$(echo ~)/win-cross/wine/bin/wine64"
+  export WINE="$(echo ~)/win-cross/wine/bin/wine"
   export WINEDEBUG=-all
 
   export MOZ_STUB_INSTALLER=1
@@ -13,59 +16,36 @@ if test "$ZEN_CROSS_COMPILING"; then
   CROSS_COMPILE=1
 
   if test "$SURFER_COMPAT" = "aarch64"; then
-    export WIN32_REDIST_DIR="$(echo ~)/win-cross/vs2022/VC/Redist/MSVC/14.38.33135/arm64/Microsoft.VC143.CRT"
+    export WIN32_REDIST_DIR="$(echo ~)/win-cross/vs2026/VC/Redist/MSVC/14.50.35710/arm64/Microsoft.VC145.CRT"
   else
-    export WIN32_REDIST_DIR="$(echo ~)/win-cross/vs2022/VC/Redist/MSVC/14.38.33135/x64/Microsoft.VC143.CRT"
+    export WIN32_REDIST_DIR="$(echo ~)/win-cross/vs2026/VC/Redist/MSVC/14.50.35710/x64/Microsoft.VC145.CRT"
   fi
-
 fi
 
-#? https://bugzilla.mozilla.org/show_bug.cgi?id=1617793
-#? https://phabricator.services.mozilla.com/D170170
-ac_add_options --disable-maintenance-service
-ac_add_options --disable-bits-download
-
-ac_add_options --disable-clang-plugin
-
 if test "$SURFER_COMPAT" = "x86_64"; then
-  # FIXME: For some reason, the clang plugin is not working on generic x86_64 builds
-  ac_add_options --disable-clang-plugin
-
   ac_add_options --target=x86_64-pc-windows-msvc
-  ac_add_options --enable-eme=widevine
-
-  ac_add_options --enable-optimize="-O3 -w -ftree-vectorize"
-
-  export CFLAGS="-mtune=haswell -march=x86-64 -O2 -Qvec -w"
-  export CPPFLAGS="-mtune=haswell -march=x86-64 -O2 -Qvec -w"
-  export CXXFLAGS="-flto=thin -mtune=haswell -march=x86-64 -O2 -Qvec -w"
-  export LDFLAGS="-Wl,-O2"
-  export RUSTFLAGS="-Clink-args=--icf=safe -C codegen-units=1 -Ctarget-cpu=x86-64"
+  ac_add_options --enable-eme=widevine,wmfcdm
 elif test "$SURFER_COMPAT" = "aarch64"; then
   ac_add_options --target=aarch64-pc-windows-msvc
   ac_add_options --enable-eme=widevine
 
-  ac_add_options --enable-optimize="-O2 -mtune=cortex-a55 -march=armv8.2-a+simd"
-
-  export CFLAGS="-O2 -march=armv8.2-a+simd -mtune=cortex-a55"
-  export CPPFLAGS="-O2 -march=armv8.2-a+simd -mtune=cortex-a55"
-  export CXXFLAGS="-O2 -march=armv8.2-a+simd -mtune=cortex-a55"
-  export LDFLAGS="-Wl,-O2 -march=armv8.2-a+simd -mtune=cortex-a55"
-  export RUSTFLAGS="-C target-feature=+v8.2a -C codegen-units=1 -Ctarget-cpu=cortex-a55"
+  # override LTO settings
+  export MOZ_LTO=cross,thin
+  ac_add_options --enable-lto=cross,thin
 fi
 
-#export POLLY="-mllvm -polly -mllvm -polly-2nd-level-tiling -mllvm -polly-loopfusion-greedy -mllvm -polly-pattern-matching-based-opts -mllvm -polly-position=before-vectorizer -mllvm -polly-vectorizer=stripmine"
-export VERBOSE=1
-
 if test "$ZEN_CROSS_COMPILING"; then
   if test "$ZEN_GA_GENERATE_PROFILE"; then
-    export CXXFLAGS="$CXXFLAGS -fprofile-generate -mllvm -enable-name-compression=false -mllvm -pgo-temporal-instrumentation -fprofile-update=atomic"
     mk_add_options "export MOZ_AUTOMATION_PACKAGE_GENERATED_SOURCES=0"
     ac_add_options --enable-profile-generate=cross
   elif test "$SURFER_COMPAT" = "x86_64"; then
-    # Dont use PGO on aarch64 builds
-    ac_add_options --enable-profile-use=cross
-    ac_add_options --with-pgo-profile-path=$(echo ~)/artifact/merged.profdata
-    ac_add_options --with-pgo-jarlog=$(echo ~)/artifact/en-US.log
+    # Dont use PGO on aarch64 builds and the ZEN_GA_DISABLE_PGO flag is not set
+    if test "$ZEN_GA_DISABLE_PGO"; then
+      export ZEN_DUMMY=1
+    else
+      ac_add_options --enable-profile-use=cross
+      ac_add_options --with-pgo-profile-path=$(echo ~)/artifact/merged.profdata
+      ac_add_options --with-pgo-jarlog=$(echo ~)/artifact/en-US.log
+    fi
   fi
 fi

crowdin.yml

@@ -0,0 +1,24 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+base_path: locales
+files:
+  - source: en-US/browser/browser/zen-general.ftl
+    translation: browser/browser/zen-general.ftl
+  - source: en-US/browser/browser/zen-split-view.ftl
+    translation: browser/browser/zen-split-view.ftl
+  - source: en-US/browser/browser/zen-menubar.ftl
+    translation: browser/browser/zen-menubar.ftl
+  - source: en-US/browser/browser/zen-vertical-tabs.ftl
+    translation: browser/browser/zen-vertical-tabs.ftl
+  - source: en-US/browser/browser/zen-welcome.ftl
+    translation: browser/browser/zen-welcome.ftl
+  - source: en-US/browser/browser/zen-workspaces.ftl
+    translation: browser/browser/zen-workspaces.ftl
+  - source: en-US/browser/browser/preferences/zen-preferences.ftl
+    translation: browser/browser/preferences/zen-preferences.ftl
+  - source: en-US/browser/browser/zen-folders.ftl
+    translation: browser/browser/zen-folders.ftl
+  - source: en-US/browser/browser/zen-boosts.ftl
+    translation: browser/browser/zen-boosts.ftl

docs/assets/zen-browser.svg

@@ -0,0 +1,19 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 156 64" height="64" width="156">
+  <defs>
+    <style>
+      .label {
+        font-size: 1.5rem;
+        font-family: sans-serif;
+        font-weight: 700;
+        text-align: center;
+        fill: #1f1f1f;
+      }
+      @media (prefers-color-scheme: dark) {
+        .label {
+          fill: #d1cfc0;
+        }
+      }
+    </style>
+  </defs>
+  <text class="label" y="38" x="5">Zen Browser</text>
+</svg>

docs/changes.md

@@ -1,14 +0,0 @@
-## Changed things that should be tested each release
-
-- Workspaces
-- Sidebar
-- Split views
-- Vertical tabs (expanded and not expanded)
-- Tab groups
-- Welcome Page
-- Overall performance
-- Overall stability
-- Pinning tabs (Grid layout)
-- Overall UX
-- Themes Page
-- Settings Page

docs/contribute.md

@@ -1,3 +1,8 @@
+<!--
+   - This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/.
+   -->
 
 # Branch Structure
 
@@ -7,31 +12,21 @@ The repository is structured as follows:
 dev (main branch)
  | |
  | \--->-- stable (release branch)
- |   ^ 
+ |   ^
  ^   |
  |   \-<- Hotfix (hotfixes directly from stable)
  |
  \-<- (features branches)
 ```
 
-The `central` branch is the main branch of the repository, and it is the default branch for the repository. The `twilight` branch is the feature branch, and it is branched off from the `central` branch. The `stable` branch is the release branch, and it is branched off from the `central` branch. 
+The `dev` branch is the main branch of the repository, and it is the default branch for the repository. The `twilight` branch is the feature branch, and it is branched off from the `dev` branch. The `stable` branch is the release branch, and it is branched off from the `dev` branch.
 
 The `stable` branch may have hotfixes directly from the `stable` branch, and the `twilight` branch may have feature branches branched off from the `twilight` branch. This is done so that we can apply hotfixes like security patches directly to the `stable` branch without having to merge the changes from the `twilight` branch.
 
+# Local Development Setup
+
+Before you set up your local development environment, **read our [Building Guidelines](https://docs.zen-browser.app/guides/building)**. Skipping them can lead to avoidable build errors.
+
 # Code Of Conduct
 
 Please read our [Code of Conduct](../CODE_OF_CONDUCT.md) before contributing.
-
-# Releasing/Merging branches
-
-To merge zen twilight branch from the central branch, you can use the following command:
-
-```bash
-sh ./scripts/merge-to-branch.sh twilight
-```
-
-To merge zen stable branch from the twilight branch, you can use the following command:
-
-```bash
-sh ./scripts/merge-to-branch.sh stable
-```