October 2017 - tbb-commits - lists.torproject.org

[tor-browser/tor-browser-52.4.0esr-7.5-1] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 04 Oct '17

04 Oct '17

commit b1c4718f8907e2ecae4d47e3ca83ba5077974e5b Author: Georg Koppen <gk(a)torproject.org> Date: Thu Sep 28 13:59:13 2017 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. --- browser/app/profile/000-tor-browser.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 16c23be0d65a..444c9f39b02a 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -180,13 +180,13 @@ pref("dom.maxHardwareConcurrency", 1); // Bug 21675: Spoof single-core cpu pref("dom.w3c_touch_events.enabled", 0); // Bug 10286: Always disable Touch API // Third party stuff +pref("privacy.firstparty.isolate", true); // Always enforce first party isolation pref("network.cookie.cookieBehavior", 1); pref("security.enable_tls_session_tickets", false); pref("network.http.spdy.enabled", false); // Stores state and may have keepalive issues (both fixable) pref("network.http.spdy.enabled.v2", false); // Seems redundant, but just in case pref("network.http.spdy.enabled.v3", false); // Seems redundant, but just in case pref("network.http.spdy.enabled.v3-1", false); // Seems redundant, but just in case -pref("privacy.firstparty.isolate", true); // Always enforce first party isolation pref("network.http.spdy.enabled.http2", false); // Temporarily disabled pending implementation review pref("network.http.spdy.enabled.http2draft", false); // Temporarily disabled pending implementation review pref("network.predictor.enabled", false); // Temporarily disabled. See https://bugs.torproject.org/16633

1 0

[tor-browser/tor-browser-52.4.0esr-7.5-1] Bug 13398: at startup, browser gleans user FULL NAME (real name, given name) from O/S
by gk＠torproject.org 04 Oct '17

04 Oct '17

commit e3b99866dbdc29a2949d0a53806b99a94f34cc73 Author: Richard Pospesel <richard(a)torproject.org> Date: Fri Sep 29 15:35:31 2017 -0700 Bug 13398: at startup, browser gleans user FULL NAME (real name, given name) from O/S ifdef'd out offending code in each platform based on existance of TOR_BROWSER_VERSION and return empty string instead. --- toolkit/components/startup/nsUserInfoMac.mm | 24 ++++++++++++++++++++---- toolkit/components/startup/nsUserInfoUnix.cpp | 20 ++++++++++++++++++++ toolkit/components/startup/nsUserInfoWin.cpp | 22 ++++++++++++++++++++-- 3 files changed, 60 insertions(+), 6 deletions(-) diff --git a/toolkit/components/startup/nsUserInfoMac.mm b/toolkit/components/startup/nsUserInfoMac.mm index 1895cf177353..175e9637c422 100644 --- a/toolkit/components/startup/nsUserInfoMac.mm +++ b/toolkit/components/startup/nsUserInfoMac.mm @@ -19,11 +19,14 @@ NS_IMETHODIMP nsUserInfo::GetFullname(char16_t **aFullname) { NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NSRESULT - +#ifndef TOR_BROWSER_VERSION NS_ConvertUTF8toUTF16 fullName([NSFullUserName() UTF8String]); *aFullname = ToNewUnicode(fullName); return NS_OK; - +#else + *aFullname = ToNewUnicode(NS_LITERAL_STRING("")); + return *aFullname ? NS_OK : NS_ERROR_FAILURE; +#endif NS_OBJC_END_TRY_ABORT_BLOCK_NSRESULT } @@ -31,11 +34,14 @@ NS_IMETHODIMP nsUserInfo::GetUsername(char **aUsername) { NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NSRESULT - +#ifndef TOR_BROWSER_VERSION nsAutoCString username([NSUserName() UTF8String]); *aUsername = ToNewCString(username); return NS_OK; - +#else + *aUsername = ToNewUTF8String(NS_LITERAL_STRING("")); + return *aUsername ? NS_OK : NS_ERROR_FAILURE; +#endif NS_OBJC_END_TRY_ABORT_BLOCK_NSRESULT } @@ -63,15 +69,21 @@ nsUserInfo::GetPrimaryEmailAddress(nsCString &aEmailAddress) NS_IMETHODIMP nsUserInfo::GetEmailAddress(char **aEmailAddress) { +#ifndef TOR_BROWSER_VERSION nsAutoCString email; if (NS_SUCCEEDED(GetPrimaryEmailAddress(email))) *aEmailAddress = ToNewCString(email); return NS_OK; +#else + *aEmailAddress = ToNewUTF8String(NS_LITERAL_STRING("")); + return *aEmailAddress ? NS_OK : NS_ERROR_FAILURE; +#endif } NS_IMETHODIMP nsUserInfo::GetDomain(char **aDomain) { +#ifndef TOR_BROWSER_VERSION nsAutoCString email; if (NS_SUCCEEDED(GetPrimaryEmailAddress(email))) { int32_t index = email.FindChar('@'); @@ -81,4 +93,8 @@ nsUserInfo::GetDomain(char **aDomain) } } return NS_OK; +#else + *aDomain = ToNewUTF8String(NS_LITERAL_STRING("")); + return *aDomain ? NS_OK : NS_ERROR_FAILURE; +#endif } diff --git a/toolkit/components/startup/nsUserInfoUnix.cpp b/toolkit/components/startup/nsUserInfoUnix.cpp index 71bc46da2573..6c8b35443139 100644 --- a/toolkit/components/startup/nsUserInfoUnix.cpp +++ b/toolkit/components/startup/nsUserInfoUnix.cpp @@ -36,6 +36,7 @@ NS_IMPL_ISUPPORTS(nsUserInfo,nsIUserInfo) NS_IMETHODIMP nsUserInfo::GetFullname(char16_t **aFullname) { +#ifndef TOR_BROWSER_VERSION struct passwd *pw = nullptr; pw = getpwuid (geteuid()); @@ -76,11 +77,16 @@ nsUserInfo::GetFullname(char16_t **aFullname) return NS_OK; return NS_ERROR_FAILURE; +#else + *aFullname = ToNewUnicode(NS_LITERAL_STRING("")); + return *aFullname ? NS_OK : NS_ERROR_FAILURE; +#endif } NS_IMETHODIMP nsUserInfo::GetUsername(char * *aUsername) { +#ifndef TOR_BROWSER_VERSION struct passwd *pw = nullptr; // is this portable? those are POSIX compliant calls, but I need to check @@ -95,11 +101,16 @@ nsUserInfo::GetUsername(char * *aUsername) *aUsername = strdup(pw->pw_name); return NS_OK; +#else + *aUsername = ToNewUTF8String(NS_LITERAL_STRING("")); + return *aUsername ? NS_OK : NS_ERROR_FAILURE; +#endif } NS_IMETHODIMP nsUserInfo::GetDomain(char * *aDomain) { +#ifndef TOR_BROWSER_VERSION nsresult rv = NS_ERROR_FAILURE; struct utsname buf; @@ -132,11 +143,16 @@ nsUserInfo::GetDomain(char * *aDomain) } return rv; +#else + *aDomain = ToNewUTF8String(NS_LITERAL_STRING("")); + return *aDomain ? NS_OK : NS_ERROR_FAILURE; +#endif } NS_IMETHODIMP nsUserInfo::GetEmailAddress(char * *aEmailAddress) { +#ifndef TOR_BROWSER_VERSION // use username + "@" + domain for the email address nsresult rv; @@ -163,5 +179,9 @@ nsUserInfo::GetEmailAddress(char * *aEmailAddress) *aEmailAddress = ToNewCString(emailAddress); return NS_OK; +#else + *aEmailAddress = ToNewUTF8String(NS_LITERAL_STRING("")); + return *aEmailAddress ? NS_OK : NS_ERROR_FAILURE; +#endif } diff --git a/toolkit/components/startup/nsUserInfoWin.cpp b/toolkit/components/startup/nsUserInfoWin.cpp index b27a2c483b1c..04552d7310f9 100644 --- a/toolkit/components/startup/nsUserInfoWin.cpp +++ b/toolkit/components/startup/nsUserInfoWin.cpp @@ -30,6 +30,7 @@ nsUserInfo::GetUsername(char **aUsername) { NS_ENSURE_ARG_POINTER(aUsername); *aUsername = nullptr; +#ifndef TOR_BROWSER_VERSION // ULEN is the max username length as defined in lmcons.h wchar_t username[UNLEN +1]; @@ -39,6 +40,10 @@ nsUserInfo::GetUsername(char **aUsername) *aUsername = ToNewUTF8String(nsDependentString(username)); return (*aUsername) ? NS_OK : NS_ERROR_FAILURE; +#else + *aUsername = ToNewUTF8String(NS_LITERAL_STRING("")); + return *aUsername ? NS_OK : NS_ERROR_FAILURE; +#endif } NS_IMETHODIMP @@ -46,6 +51,7 @@ nsUserInfo::GetFullname(char16_t **aFullname) { NS_ENSURE_ARG_POINTER(aFullname); *aFullname = nullptr; +#ifndef TOR_BROWSER_VERSION wchar_t fullName[512]; DWORD size = mozilla::ArrayLength(fullName); @@ -91,6 +97,10 @@ nsUserInfo::GetFullname(char16_t **aFullname) } return (*aFullname) ? NS_OK : NS_ERROR_FAILURE; +#else + *aFullname = ToNewUnicode(NS_LITERAL_STRING("")); + return *aFullname ? NS_OK : NS_ERROR_FAILURE; +#endif } NS_IMETHODIMP @@ -98,7 +108,7 @@ nsUserInfo::GetDomain(char **aDomain) { NS_ENSURE_ARG_POINTER(aDomain); *aDomain = nullptr; - +#ifndef TOR_BROWSER_VERSION const DWORD level = 100; LPBYTE info; NET_API_STATUS status = NetWkstaGetInfo(nullptr, level, &info); @@ -110,6 +120,10 @@ nsUserInfo::GetDomain(char **aDomain) } return (*aDomain) ? NS_OK : NS_ERROR_FAILURE; +#else + *aDomain = ToNewUTF8String(NS_LITERAL_STRING("")); + return *aDomain ? NS_OK : NS_ERROR_FAILURE; +#endif } NS_IMETHODIMP @@ -117,7 +131,7 @@ nsUserInfo::GetEmailAddress(char **aEmailAddress) { NS_ENSURE_ARG_POINTER(aEmailAddress); *aEmailAddress = nullptr; - +#ifndef TOR_BROWSER_VERSION // RFC3696 says max length of an email address is 254 wchar_t emailAddress[255]; DWORD size = mozilla::ArrayLength(emailAddress); @@ -130,4 +144,8 @@ nsUserInfo::GetEmailAddress(char **aEmailAddress) *aEmailAddress = ToNewUTF8String(nsDependentString(emailAddress)); return (*aEmailAddress) ? NS_OK : NS_ERROR_FAILURE; +#else + *aEmailAddress = ToNewUTF8String(NS_LITERAL_STRING("")); + return *aEmailAddress ? NS_OK : NS_ERROR_FAILURE; +#endif }

1 0

[tor-browser-build/master] Fold in 7.0.6 changelog and update release date
by gk＠torproject.org 03 Oct '17

03 Oct '17

commit 36600281908287e26153315dc2a3e7aa2e6d06e3 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Oct 3 06:25:42 2017 +0000 Fold in 7.0.6 changelog and update release date --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 430aa8c..56fcb64 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,4 +1,4 @@ -Tor Browser 7.5a5 -- September 27 2017 +Tor Browser 7.5a5 -- September 28 2017 * All Platforms * Update Firefox to 52.4.0esr * Update Tor to 0.3.2.1-alpha @@ -35,6 +35,20 @@ Tor Browser 7.5a5 -- September 27 2017 * All Platforms * Switch from gitian/tor-browser-bundle to rbm/tor-browser-build +Tor Browser 7.0.6 -- September 28 2017 + * All Platforms + * Update Firefox to 52.4.0esr + * Update Tor to 0.3.1.7 + * Update Torbutton to 1.9.7.7 + * Bug 22542: Security Settings window too small on macOS 10.12 (fixup) + * Bug 20375: Warn users after entering fullscreen mode + * Update HTTPS-Everywhere to 2017.9.12 + * Update NoScript to 5.0.10 + * Bug 21830: Copying large text from web console leaks to /tmp + * Bug 23393: Don't crash all tabs when closing one tab + * OS X + * Bug 23404: Add missing Noto Sans Buginese font to the macOS whitelist + Tor Browser 7.0.5 -- September 4 2017 * All Platforms * Update Torbutton to 1.9.7.6

1 0

[tor-browser-build/master] Bug 23384: install dma (lightweight mail transport agent) on build-sunet-a.torproject.net
by boklm＠torproject.org 02 Oct '17

02 Oct '17

commit 39722d6b59c200710025b899e5f544a69bbeb943 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Oct 2 17:27:54 2017 +0200 Bug 23384: install dma (lightweight mail transport agent) on build-sunet-a.torproject.net --- tools/ansible/roles/mta/tasks/main.yml | 6 ++++++ tools/ansible/tbb-build.yml | 1 + 2 files changed, 7 insertions(+) diff --git a/tools/ansible/roles/mta/tasks/main.yml b/tools/ansible/roles/mta/tasks/main.yml new file mode 100644 index 0000000..de469d8 --- /dev/null +++ b/tools/ansible/roles/mta/tasks/main.yml @@ -0,0 +1,6 @@ +--- + +- name: Install dma (DragonFly Mail Agent) + apt: + name: dma + state: present diff --git a/tools/ansible/tbb-build.yml b/tools/ansible/tbb-build.yml index e74e665..9f76b67 100644 --- a/tools/ansible/tbb-build.yml +++ b/tools/ansible/tbb-build.yml @@ -5,3 +5,4 @@ - role: tbb-builder - role: useful-packages - role: tbb-team + - role: mta

1 0

[tor-browser-build/master] Bug 23384: install and configure unattended-upgrades on build-sunet-a.torproject.net
by boklm＠torproject.org 02 Oct '17

02 Oct '17

commit fd97762cb0924eea137896425eab788daef6ca8d Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Oct 2 18:05:14 2017 +0200 Bug 23384: install and configure unattended-upgrades on build-sunet-a.torproject.net --- .../roles/unattended-upgrades/defaults/main.yml | 2 + .../roles/unattended-upgrades/tasks/main.yml | 18 +++++ .../unattended-upgrades/templates/20auto-upgrades | 2 + .../templates/50unattended-upgrades | 92 ++++++++++++++++++++++ tools/ansible/tbb-build.yml | 1 + 5 files changed, 115 insertions(+) diff --git a/tools/ansible/roles/unattended-upgrades/defaults/main.yml b/tools/ansible/roles/unattended-upgrades/defaults/main.yml new file mode 100644 index 0000000..f6351a7 --- /dev/null +++ b/tools/ansible/roles/unattended-upgrades/defaults/main.yml @@ -0,0 +1,2 @@ +--- +unattended_upgrade_mail: 'boklm(a)mars-attacks.org' diff --git a/tools/ansible/roles/unattended-upgrades/tasks/main.yml b/tools/ansible/roles/unattended-upgrades/tasks/main.yml new file mode 100644 index 0000000..de0892b --- /dev/null +++ b/tools/ansible/roles/unattended-upgrades/tasks/main.yml @@ -0,0 +1,18 @@ +--- + +- name: Install unattended-updates + apt: + name: unattended-upgrades + state: present + +- name: Install apt-listchanges + apt: + name: apt-listchanges + state: present + +- name: create /etc/apt/apt.conf.d/50unattended-upgrades + template: src=50unattended-upgrades dest=/etc/apt/apt.conf.d/50unattended-upgrades mode=0644 + +- name: create /etc/apt/apt.conf.d/20auto-upgrades + template: src=20auto-upgrades dest=/etc/apt/apt.conf.d/20auto-upgrades mode=0644 + diff --git a/tools/ansible/roles/unattended-upgrades/templates/20auto-upgrades b/tools/ansible/roles/unattended-upgrades/templates/20auto-upgrades new file mode 100644 index 0000000..8d6d7c8 --- /dev/null +++ b/tools/ansible/roles/unattended-upgrades/templates/20auto-upgrades @@ -0,0 +1,2 @@ +APT::Periodic::Update-Package-Lists "1"; +APT::Periodic::Unattended-Upgrade "1"; diff --git a/tools/ansible/roles/unattended-upgrades/templates/50unattended-upgrades b/tools/ansible/roles/unattended-upgrades/templates/50unattended-upgrades new file mode 100644 index 0000000..d4904ab --- /dev/null +++ b/tools/ansible/roles/unattended-upgrades/templates/50unattended-upgrades @@ -0,0 +1,92 @@ +// Unattended-Upgrade::Origins-Pattern controls which packages are +// upgraded. +// +// Lines below have the format format is "keyword=value,...". A +// package will be upgraded only if the values in its metadata match +// all the supplied keywords in a line. (In other words, omitted +// keywords are wild cards.) The keywords originate from the Release +// file, but several aliases are accepted. The accepted keywords are: +// a,archive,suite (eg, "stable") +// c,component (eg, "main", "crontrib", "non-free") +// l,label (eg, "Debian", "Debian-Security") +// o,origin (eg, "Debian", "Unofficial Multimedia Packages") +// n,codename (eg, "jessie", "jessie-updates") +// site (eg, "http.debian.net") +// The available values on the system are printed by the command +// "apt-cache policy", and can be debugged by running +// "unattended-upgrades -d" and looking at the log file. +// +// Within lines unattended-upgrades allows 2 macros whose values are +// derived from /etc/debian_version: +// ${distro_id} Installed origin. +// ${distro_codename} Installed codename (eg, "jessie") +Unattended-Upgrade::Origins-Pattern { + // Codename based matching: + // This will follow the migration of a release through different + // archives (e.g. from testing to stable and later oldstable). +// "o=Debian,n=jessie"; +// "o=Debian,n=jessie-updates"; +// "o=Debian,n=jessie-proposed-updates"; +// "o=Debian,n=jessie,l=Debian-Security"; + + // Archive or Suite based matching: + // Note that this will silently match a different release after + // migration to the specified archive (e.g. testing becomes the + // new stable). +// "o=Debian,a=stable"; +// "o=Debian,a=stable-updates"; +// "o=Debian,a=proposed-updates"; + "origin=Debian,codename=${distro_codename},label=Debian-Security"; +}; + +// List of packages to not update (regexp are supported) +Unattended-Upgrade::Package-Blacklist { +// "vim"; +// "libc6"; +// "libc6-dev"; +// "libc6-i686"; +}; + +// This option allows you to control if on a unclean dpkg exit +// unattended-upgrades will automatically run +// dpkg --force-confold --configure -a +// The default is true, to ensure updates keep getting installed +//Unattended-Upgrade::AutoFixInterruptedDpkg "false"; + +// Split the upgrade into the smallest possible chunks so that +// they can be interrupted with SIGUSR1. This makes the upgrade +// a bit slower but it has the benefit that shutdown while a upgrade +// is running is possible (with a small delay) +//Unattended-Upgrade::MinimalSteps "true"; + +// Install all unattended-upgrades when the machine is shuting down +// instead of doing it in the background while the machine is running +// This will (obviously) make shutdown slower +//Unattended-Upgrade::InstallOnShutdown "true"; + +// Send email to this address for problems or packages upgrades +// If empty or unset then no email is sent, make sure that you +// have a working mail setup on your system. A package that provides +// 'mailx' must be installed. E.g. "user(a)example.com" +Unattended-Upgrade::Mail "{{ unattended_upgrade_mail }}"; + +// Set this value to "true" to get emails only on errors. Default +// is to always send a mail if Unattended-Upgrade::Mail is set +//Unattended-Upgrade::MailOnlyOnError "true"; + +// Do automatic removal of new unused dependencies after the upgrade +// (equivalent to apt-get autoremove) +//Unattended-Upgrade::Remove-Unused-Dependencies "false"; + +// Automatically reboot *WITHOUT CONFIRMATION* if +// the file /var/run/reboot-required is found after the upgrade +//Unattended-Upgrade::Automatic-Reboot "false"; + +// If automatic reboot is enabled and needed, reboot at the specific +// time instead of immediately +// Default: "now" +//Unattended-Upgrade::Automatic-Reboot-Time "02:00"; + +// Use apt bandwidth limit feature, this example limits the download +// speed to 70kb/sec +//Acquire::http::Dl-Limit "70"; diff --git a/tools/ansible/tbb-build.yml b/tools/ansible/tbb-build.yml index 9f76b67..3d9f543 100644 --- a/tools/ansible/tbb-build.yml +++ b/tools/ansible/tbb-build.yml @@ -6,3 +6,4 @@ - role: useful-packages - role: tbb-team - role: mta + - role: unattended-upgrades

1 0