August 2016 - tbb-commits - lists.torproject.org

[tor-browser-bundle/hardened-builds] correcting mirror
by gk＠torproject.org 01 Aug '16

01 Aug '16

commit f7fda5e4d6c0cb5147cf4b8629aac1a877ae5bff Author: Georg Koppen <gk(a)torproject.org> Date: Mon Aug 1 13:23:20 2016 +0000 correcting mirror --- gitian/fetch-inputs.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gitian/fetch-inputs.sh b/gitian/fetch-inputs.sh index 4d48089..c663051 100755 --- a/gitian/fetch-inputs.sh +++ b/gitian/fetch-inputs.sh @@ -6,7 +6,7 @@ MIRROR_URL=https://people.torproject.org/~mikeperry/mirrors/sources/ MIRROR_URL_DCF=https://people.torproject.org/~dcf/mirrors/sources/ MIRROR_URL_ASN=https://people.torproject.org/~asn/mirrors/sources/ -MIRROR_URL_GK=https://people.torproject.org/~asn/mirrors/sources/ +MIRROR_URL_GK=https://people.torproject.org/~gk/mirrors/sources/ set -e set -u umask 0022

1 0

[tor-browser-bundle/hardened-builds] Updating CCTOOLS source url
by gk＠torproject.org 01 Aug '16

01 Aug '16

commit efbddbb105bfc7c3197c8ea79e7039a95a55cfbc Author: Georg Koppen <gk(a)torproject.org> Date: Mon Aug 1 13:16:01 2016 +0000 Updating CCTOOLS source url --- gitian/fetch-inputs.sh | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/gitian/fetch-inputs.sh b/gitian/fetch-inputs.sh index 1bf69a2..4d48089 100755 --- a/gitian/fetch-inputs.sh +++ b/gitian/fetch-inputs.sh @@ -6,6 +6,7 @@ MIRROR_URL=https://people.torproject.org/~mikeperry/mirrors/sources/ MIRROR_URL_DCF=https://people.torproject.org/~dcf/mirrors/sources/ MIRROR_URL_ASN=https://people.torproject.org/~asn/mirrors/sources/ +MIRROR_URL_GK=https://people.torproject.org/~asn/mirrors/sources/ set -e set -u umask 0022 @@ -138,6 +139,13 @@ do get "${!PACKAGE}" "${MIRROR_URL}${!PACKAGE}" done +for i in CCTOOLS +do + PACKAGE="${i}_PACKAGE" + URL="${MIRROR_URL_GK}${!PACKAGE}" + get "${!PACKAGE}" "${MIRROR_URL_GK}${!PACKAGE}" +done + # XXX: Omit googlecode.com packages because Google won't allow wget -N # and because the download seems to 404 about 50% of the time. for i in ARGPARSE

1 0

[tor-browser-bundle/hardened-builds] Add Selfrando sources for to versions.alpha
by gk＠torproject.org 01 Aug '16

01 Aug '16

commit d4e78124c4aef4220d59acd03df49c94c67801d1 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Aug 1 12:42:22 2016 +0000 Add Selfrando sources for to versions.alpha --- gitian/versions.alpha | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/gitian/versions.alpha b/gitian/versions.alpha index dba74e7..fae60f8 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -45,6 +45,7 @@ GO_X_CRYPTO_TAG=4ed45ec682102c643324fae5dff8dab085b6c300 GO_X_NET_TAG=7dbad50ab5b31073856416cdcfeb2796d682f844 OBFS4_TAG=obfs4proxy-0.0.5 NOTOFONTS_TAG=720e34851382ee3c1ef024d8dffb68ffbfb234c2 +SELFRANDO_TAG=8e49e7aa664625d8e4793579864231b151589d0f GITIAN_TAG=tor-browser-builder-4-1 @@ -68,6 +69,7 @@ PARSLEY_VER=1.2 GO14_VER=1.4.3 GO_VER=1.6.3 NSIS_VER=2.51 +ELFUTILS_VER=0.160 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz @@ -99,6 +101,7 @@ NOTOJPFONT_PACKAGE=NotoSansJP-Regular.otf NOTOKRFONT_PACKAGE=NotoSansKR-Regular.otf NOTOSCFONT_PACKAGE=NotoSansSC-Regular.otf NOTOTCFONT_PACKAGE=NotoSansTC-Regular.otf +ELFUTILS_PACKAGE=elfutils-${ELFUTILS_VER}.tar.bz2 # Hashes for packages with weak sigs or no sigs OPENSSL_HASH=4a6ee491a2fdb22e519c76fdc2a628bb3cec12762cd456861d207996c8a07088 @@ -159,3 +162,4 @@ NOTOJPFONT_URL=${NOTOCJKBASE_URL}/${NOTOJPFONT_PACKAGE} NOTOKRFONT_URL=${NOTOCJKBASE_URL}/${NOTOKRFONT_PACKAGE} NOTOSCFONT_URL=${NOTOCJKBASE_URL}/${NOTOSCFONT_PACKAGE} NOTOTCFONT_URL=${NOTOCJKBASE_URL}/${NOTOTCFONT_PACKAGE} +ELFUTILS_URL=https://fedorahosted.org/releases/e/l/elfutils/${ELFUTILS_VER}/${ELFUTILS_PACKAGE}

1 0

[tor-browser-bundle/hardened-builds] updating gk's key
by gk＠torproject.org 01 Aug '16

01 Aug '16

commit 1911d4e4ae2ed9de4bc466e63ae1cbdaff409d77 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Aug 1 11:50:36 2016 +0000 updating gk's key --- gitian/gpg/gk.gpg | Bin 72418 -> 113673 bytes gitian/gpg/torbutton.gpg | Bin 94114 -> 135369 bytes 2 files changed, 0 insertions(+), 0 deletions(-) diff --git a/gitian/gpg/gk.gpg b/gitian/gpg/gk.gpg index 2f78b14..359ea69 100644 Binary files a/gitian/gpg/gk.gpg and b/gitian/gpg/gk.gpg differ diff --git a/gitian/gpg/torbutton.gpg b/gitian/gpg/torbutton.gpg index da40f76..17b6c70 100644 Binary files a/gitian/gpg/torbutton.gpg and b/gitian/gpg/torbutton.gpg differ

1 0

[tor-browser-bundle/hardened-builds] Bug 19737: Allow git tag signatures made using an expired key
by gk＠torproject.org 01 Aug '16

01 Aug '16

commit c6458e49f9dd51708e22c84f26195c50d0ff2d0b Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Jul 27 22:53:19 2016 +0200 Bug 19737: Allow git tag signatures made using an expired key We are adding a gitian/git-gpg-wrapper script which validates signatures made using an expired key. To do that, we use gpgv rather than gpg, and any EXPKEYSIG line from the gpg `--status-fd` output is replaced by a GOODSIG line. --- gitian/git-gpg-wrapper | 13 +++++++++++++ gitian/verify-tags.sh | 3 ++- 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/gitian/git-gpg-wrapper b/gitian/git-gpg-wrapper new file mode 100644 index 0000000..f137d6d --- /dev/null +++ b/gitian/git-gpg-wrapper @@ -0,0 +1,13 @@ +#!/bin/bash +# This wrapper script is used by git to verify signatures made using +# an expired key. +# https://bugs.torproject.org/19737 +set -e +if [ $# -eq 4 ] && [ "$1" = '--status-fd=1' ] \ + && [ "$2" = '--verify' ] +then + gpgv "$1" "$3" "$4" | sed 's/^\[GNUPG:\] EXPKEYSIG /\[GNUPG:\] GOODSIG /' + exit ${PIPESTATUS[0]} +else + exec gpg "$@" +fi diff --git a/gitian/verify-tags.sh b/gitian/verify-tags.sh index 5908801..8277fca 100755 --- a/gitian/verify-tags.sh +++ b/gitian/verify-tags.sh @@ -37,10 +37,11 @@ verify_git() { local gpghome=$(mktemp -d) echo "rm -rf '$gpghome'" >> "$CLEANUP" - GNUPGHOME="$gpghome" gpg --import "$keyring" + GNUPGHOME="$gpghome" gpg --no-default-keyring --keyring trustedkeys.gpg --import "$keyring" pushd . cd "$dir" + git config --local gpg.program "$WRAPPER_DIR/git-gpg-wrapper" if ! GNUPGHOME="$gpghome" git tag -v "$tag"; then echo >&2 "$dir: verification of tag $tag against $keyring failed!" exit 1

1 0

[tor-browser-bundle/hardened-builds] Release preparations for 6.5a2-hardened
by gk＠torproject.org 01 Aug '16

01 Aug '16

commit 4daeed06ac415ba19617cebfb41b5fe7d26c1fcd Author: Georg Koppen <gk(a)torproject.org> Date: Mon Aug 1 09:44:41 2016 +0000 Release preparations for 6.5a2-hardened Changelog update, versions bumps, config.yml update --- Bundle-Data/Docs/ChangeLog.txt | 33 +++++++++++++++++++++++++++++++++ gitian/versions.alpha | 14 +++++++------- tools/update-responses/config.yml | 12 ++++++------ 3 files changed, 46 insertions(+), 13 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 40a36c9..2cdc4b7 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,36 @@ +Tor Browser 6.5a2-hardened -- August 3 + * All Platforms + * Update Firefox to 45.3.0esr + * Update Tor to tor-0.2.8.5-rc + * Update Torbutton to 1.9.6.1 + * Bug 19689: Use proper parent window for plugin prompt + * Bug 19206: Avoid SOCKS auth and NEWNYM collisions when sharing a tor client + * Bug 19417: Disable asm.js (but add code to clear on New Identity if enabled) + * Bug 19273: Improve external app launch handling and associated warnings + * Bug 8725: Block addon resource and url fingerprinting with nsIContentPolicy + * Update HTTPS-Everywhere to 5.2.1 + * Update NoScript to 2.9.0.12 + * Bug 17406: Include Selfrando into our hardened builds + * Bug 19417: Disable asmjs for now + * Bug 19715: Disable the meek-google pluggable transport option + * Bug 19714: Remove mercurius4 obfs4 bridge + * Bug 19585: Fix regression test for keyboard layout fingerprinting + * Bug 19515: Tor Browser is crashing in graphics code + * Bug 18513: Favicon requests can bypass New Identity + * Bug 19273: Write C++ patch for external app launch handling + * Bug 16998: Isolate preconnect requests to URL bar domain + * Bug 18923: Add script to run all Tor Browser regression tests + * Bug 19478: Prevent millisecond resolution leaks in File API + * Bug 19401: Fix broken PDF download button + * Bug 19411: Don't show update icon if a partial update failed + * Bug 19400: Back out GCC bug workaround to avoid asmjs crash + * Bug 19735: Switch default search engine to DuckDuckGo + * Bug 19276: Disable Xrender due to possible performance regressions + * Bug 19725: Remove old updater files left on disk after upgrade to 6.x + * Build System + * All Platforms + * Bug 19703: Upgrade Go to 1.6.3 + Tor Browser 6.5a1-hardened -- June 8 * All Platforms * Update Firefox to 45.2.0esr diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 29595cc..dba74e7 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -14,15 +14,15 @@ DATA_OUTSIDE_APP_DIR=1 VERIFY_TAGS=1 -FIREFOX_VERSION=45.2.0esr +FIREFOX_VERSION=45.3.0esr TORBROWSER_UPDATE_CHANNEL=hardened TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-6.5-1-build1 -TOR_TAG=tor-0.2.8.3-alpha +TOR_TAG=tor-0.2.8.5-rc TORLAUNCHER_TAG=0.2.8.5 -TORBUTTON_TAG=1.9.6 -HTTPSE_TAG=5.1.9 +TORBUTTON_TAG=1.9.6.1 +HTTPSE_TAG=5.2.1 NSIS_TAG=v0.3.1 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.22-stable @@ -51,7 +51,7 @@ GITIAN_TAG=tor-browser-builder-4-1 OPENSSL_VER=1.0.1t GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION -FIREFOX_LANG_BUILD=build2 +FIREFOX_LANG_BUILD=build1 BINUTILS_VER=2.24 GCC_VER=5.2.0 CLANG_VER=r247539 @@ -72,7 +72,7 @@ NSIS_VER=2.51 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 -NOSCRIPT_PACKAGE=noscript_security_suite-2.9.0.11-fn+sm+fx.xpi +NOSCRIPT_PACKAGE=noscript_security_suite-2.9.0.12-fx+fn+sm.xpi TOOLCHAIN4_OLD_PACKAGE=multiarch-darwin11-cctools127.2-gcc42-5666.3-llvmgcc42-2336.1-Linux-120724.tar.xz CCTOOLS_PACKAGE=cctools.tar.gz OSXSDK_PACKAGE=MacOSX10.7.sdk.tar.gz @@ -106,7 +106,7 @@ GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf OSXSDK_OLD_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc TOOLCHAIN4_OLD_HASH=65c1b2d302358a6b95a26c6828a66908a199276193bb0b268f2dcc1a997731e9 -NOSCRIPT_HASH=fdd965a69188ac651b08a7d3ada54821a89db10a4685aa73ba59edc0b8243390 +NOSCRIPT_HASH=3fa641dcb60455c950cef0c15effa8ca060b3b05405f46f55cbdb922929027e7 CCTOOLS_HASH=e908fdebc2886ee5491ebfc7e7950af451b3c4e2439c2d7a923ed06ad05113e4 MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index 179f882..8eaeae6 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -12,7 +12,7 @@ build_targets: osx32: Darwin_x86-gcc3 osx64: Darwin_x86_64-gcc3 channels: - hardened: 6.5a1-hardened + hardened: 6.5a2-hardened release: 6.0.1 versions: 6.0.1: @@ -26,12 +26,12 @@ versions: osx32: minSupportedOSVersion: 10.8 detailsURL: https://blog.torproject.org/blog/end-life-plan-tor-browser-32-bit-macs#upda… - 6.5a1-hardened: - platformVersion: 45.2.0 - detailsURL: https://blog.torproject.org/blog/tor-browser-65a1-hardened-released - download_url: https://cdn.torproject.org/aus1/torbrowser/6.5a1-hardened + 6.5a2-hardened: + platformVersion: 45.3.0 + detailsURL: https://blog.torproject.org/blog/tor-browser-65a2-hardened-released + download_url: https://cdn.torproject.org/aus1/torbrowser/6.5a2-hardened incremental_from: - - 6.0a5-hardened + - 6.5a1-hardened migrate_archs: osx32: osx64 osx32:

1 0

[tor-browser-bundle/hardened-builds] Making the git-gpg-wrapper executable
by gk＠torproject.org 01 Aug '16

01 Aug '16

commit 166f1c2a301c5f8ca8d949e32ad2728c6bdb42af Author: Georg Koppen <gk(a)torproject.org> Date: Sat Jul 30 10:00:11 2016 +0000 Making the git-gpg-wrapper executable --- gitian/git-gpg-wrapper | 0 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/gitian/git-gpg-wrapper b/gitian/git-gpg-wrapper old mode 100644 new mode 100755

1 0

[tor-browser-bundle/hardened-builds] Update gk's key
by gk＠torproject.org 01 Aug '16

01 Aug '16

commit 61f56b3022059f79246306d8aff6e71fd04c6802 Author: Georg Koppen <gk(a)torproject.org> Date: Sat Jul 30 09:29:24 2016 +0000 Update gk's key --- gitian/gpg/gk.gpg | Bin 33866 -> 72418 bytes gitian/gpg/torbutton.gpg | Bin 55562 -> 94114 bytes 2 files changed, 0 insertions(+), 0 deletions(-) diff --git a/gitian/gpg/gk.gpg b/gitian/gpg/gk.gpg index ad731ca..2f78b14 100644 Binary files a/gitian/gpg/gk.gpg and b/gitian/gpg/gk.gpg differ diff --git a/gitian/gpg/torbutton.gpg b/gitian/gpg/torbutton.gpg index e4a03dd..da40f76 100644 Binary files a/gitian/gpg/torbutton.gpg and b/gitian/gpg/torbutton.gpg differ

1 0