Merge pull request 'release: package Windows builds with managed Tor' (#34) from windows-managed-tor-package into main

1 files changed, 19 insertions, 0 deletions

diff --git a/docs/tor.md b/docs/tor.md
index 1c0f589..a408704 100644
--- a/docs/tor.md
+++ b/docs/tor.md
@@ -53,6 +53,25 @@ Without a value, Bitflash looks for Tor in this order:
 2. `tor.exe` or `tor` beside the Bitflash binary;
 3. `tor.exe` or `tor` on `PATH`.
 
+Windows releases can also be built as `Bitflash-*-windows-with-tor.zip`. That
+package includes the official Tor Expert Bundle under `tor/`, so the first path
+above exists immediately after extraction and `bitflash -managedtor` needs no
+separate Tor install.
+
+The bundled-Tor package is created by:
+
+```bash
+make windows-tor
+```
+
+The packaging script verifies a pinned SHA256 for the downloaded Tor Expert
+Bundle before copying it into the release directory. When `gpg` is available it
+also verifies the matching `.asc` signature against the pinned Tor Browser
+Developers signing-key fingerprint. Release builds should use
+`TOR_VERIFY_GPG=required make windows-tor` to make that second check mandatory.
+The Tor binary is bundled; the runtime data directory, hidden-service key, and
+control cookie are still created under the user's Bitflash data directory.
+
 To point at a specific Tor executable:
 
 ```bash