March 2017 - tbb-commits - lists.torproject.org

[tor-browser-build/master] Add snowflake
by boklm＠torproject.org 13 Mar '17

13 Mar '17

commit 832c2ce17672d5cd1f554354902df670e6ee928a Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Mar 13 19:39:02 2017 +0100 Add snowflake Only for linux-x86_64 for now, as it fails to build on linux-i686. --- .gitignore | 1 + projects/depot_tools/build | 8 +++ projects/depot_tools/config | 5 ++ projects/gcc/config | 2 +- projects/go-webrtc/config | 53 ++++++++++++++++++++ projects/go/config | 1 + projects/snowflake/build | 38 +++++++++++++++ projects/snowflake/config | 35 ++++++++++++++ projects/tor-browser/build | 3 ++ projects/tor-browser/config | 3 ++ projects/webrtc/build | 80 ++++++++++++++++++++++++++++++ projects/webrtc/config | 115 ++++++++++++++++++++++++++++++++++++++++++++ rbm.conf | 4 ++ 13 files changed, 347 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 9b6754f..0fe0aec 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,6 @@ git_clones hg_clones +gclient out release alpha diff --git a/projects/depot_tools/build b/projects/depot_tools/build new file mode 100644 index 0000000..ac0f21b --- /dev/null +++ b/projects/depot_tools/build @@ -0,0 +1,8 @@ +#!/bin/bash +[% c("var/set_default_env") -%] +tar xf [% project %]-[% c("version") %].tar.gz +mv [% project %]-[% c("version") %] [% project %] +[% c('tar', { + tar_src => [ project ], + tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'), + }) %] diff --git a/projects/depot_tools/config b/projects/depot_tools/config new file mode 100644 index 0000000..40a6d85 --- /dev/null +++ b/projects/depot_tools/config @@ -0,0 +1,5 @@ +# vim: filetype=yaml sw=2 +version: '[% c("abbrev") %]' +git_hash: 28216cd14b44716db5c83634afbdc6e90492652b +git_url: https://chromium.googlesource.com/chromium/tools/depot_tools.git +filename: '[% project %]-[% c("version") %].tar.gz' diff --git a/projects/gcc/config b/projects/gcc/config index bf73b7d..391e453 100644 --- a/projects/gcc/config +++ b/projects/gcc/config @@ -10,7 +10,7 @@ var: - libc6-dev-i386 setup: | mkdir -p /var/tmp/dist - tar -C /var/tmp/dist -xf [% c("compiler_tarfile") %] + tar -C /var/tmp/dist -xf $rootdir/[% c("compiler_tarfile") %] export PATH="/var/tmp/dist/gcc/bin:$PATH" [% IF c("var/osname") == "linux-i686" -%] export LD_LIBRARY_PATH=/var/tmp/dist/gcc/lib32 diff --git a/projects/go-webrtc/config b/projects/go-webrtc/config new file mode 100644 index 0000000..778d3db --- /dev/null +++ b/projects/go-webrtc/config @@ -0,0 +1,53 @@ +# vim: filetype=yaml sw=2 +version: '[% c("abbrev") %]' +git_url: https://github.com/keroserene/go-webrtc.git +git_hash: 69c5ca70533142494d145b43ef2f46ca94715557 +filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' +remote_docker: 1 + +build: '[% c("projects/go/var/build_go_lib") %]' + +var: + go_lib: github.com/keroserene/go-webrtc + build_go_lib_pre: | + [% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] + [% IF c("var/linux") %] + tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/binutils') %] + export PATH="/var/tmp/dist/binutils/bin:$PATH" + [% END -%] + tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/webrtc') %] + # Replace the prebuilt webrtc library with our own one. + rm -rf include/ lib/ + cp -a /var/tmp/dist/webrtc/{include,lib} . + # The go-webrtc package sets _GLIBCXX_USE_CXX11_ABI=0 for compatibility with + # the prebuilt libwebrtc-magic.a libraries. Since we build our own + # libwebrtc-magic.a with the C++11 ABI, we have to undo that setting here, + # using CGO_CXXFLAGS. + export CGO_CXXFLAGS=-D_GLIBCXX_USE_CXX11_ABI=1 + +targets: + master: + git_hash: master + linux-x86_64: + var: + arch_deps: + - pkg-config + - libx11-dev + linux-i686: + var: + arch_deps: + - pkg-config:i386 + - libx11-dev:i386 + - lib32stdc++6 + +input_files: + - project: docker-image + - name: go + project: go + - name: webrtc + project: webrtc + - name: '[% c("var/compiler") %]' + project: '[% c("var/compiler") %]' + - name: binutils + project: binutils + enable: '[% c("var/linux") %]' diff --git a/projects/go/config b/projects/go/config index 5e55a09..870dc50 100644 --- a/projects/go/config +++ b/projects/go/config @@ -35,6 +35,7 @@ var: do patch -p1 < $p done + [% IF c("var/build_go_lib_pre"); GET c("var/build_go_lib_pre"); END; -%] [% IF c("var/go_lib_install") -%] [% FOREACH inst IN c("var/go_lib_install") %] go install [% inst %] diff --git a/projects/snowflake/build b/projects/snowflake/build new file mode 100644 index 0000000..6e08b4e --- /dev/null +++ b/projects/snowflake/build @@ -0,0 +1,38 @@ +#!/bin/bash +[% c("var/set_default_env") -%] +[% pc('go', 'var/setup', { go_tarfile => c('input_files_by_name/go') }) %] +[% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] +[% IF c("var/linux") %] + tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/binutils') %] + export PATH="/var/tmp/dist/binutils/bin:$PATH" +[% END -%] +distdir=/var/tmp/dist/[% project %] +[% IF c("var/osx") %] + PTDIR="$distdir/Contents/MacOS/Tor/PluggableTransports" + DOCSDIR="$distdir/Contents/Resources/TorBrowser/Docs/snowflake" +[% ELSE %] + PTDIR="$distdir/TorBrowser/Tor/PluggableTransports" + DOCSDIR="$distdir/TorBrowser/Docs/snowflake" +[% END %] +mkdir -p $PTDIR $DOCSDIR + +tar -C /var/tmp/dist -xf [% c('input_files_by_name/go-webrtc') %] +tar -C /var/tmp/dist -xf [% c('input_files_by_name/uniuri') %] +tar -C /var/tmp/dist -xf [% c('input_files_by_name/goptlib') %] + +mkdir -p /var/tmp/build +tar -C /var/tmp/build -xf [% project %]-[% c('version') %].tar.gz +cd /var/tmp/build/[% project %]-[% c('version') %] + +cd client +go build -ldflags '-s' +cp -a client[% IF c("var/windows") %].exe[% END %] $PTDIR/snowflake-client[% IF c("var/windows") %].exe[% END %] + +cd .. +cp -a README.md LICENSE $DOCSDIR + +cd $distdir +[% c('tar', { + tar_src => [ '.' ], + tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'), + }) %] diff --git a/projects/snowflake/config b/projects/snowflake/config new file mode 100644 index 0000000..5ba006b --- /dev/null +++ b/projects/snowflake/config @@ -0,0 +1,35 @@ +# vim: filetype=yaml sw=2 +version: '[% c("abbrev") %]' +git_url: https://git.torproject.org/pluggable-transports/snowflake.git +git_hash: 6cecd31fd896eb26e64ad8bab8a9ea510ec3b21d +filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' +remote_docker: 1 + +targets: + linux-i686: + var: + arch_deps: + - pkg-config + - libx11-dev:i386 + - lib32stdc++6 + linux-x86_64: + var: + arch_deps: + - pkg-config + - libx11-dev + +input_files: + - project: docker-image + - name: go + project: go + - name: '[% c("var/compiler") %]' + project: '[% c("var/compiler") %]' + - name: binutils + project: binutils + enable: '[% c("var/linux") %]' + - name: go-webrtc + project: go-webrtc + - name: uniuri + project: uniuri + - name: goptlib + project: goptlib diff --git a/projects/tor-browser/build b/projects/tor-browser/build index 904f1b6..814f7af 100644 --- a/projects/tor-browser/build +++ b/projects/tor-browser/build @@ -52,6 +52,9 @@ mv [% c('input_files_by_name/noscript') %] $TBDIR/$EXTSPATH/{73a6fe31-595d-460b- tar -C $TBDIR -xf [% c('input_files_by_name/obfs4') %] tar -C $TBDIR -xf [% c('input_files_by_name/meek') %] mv $TBDIR/meek-http-helper(a)bamsoftware.com.xpi $TBDIR/$MEEKPROFILEPATH/extensions/ +[% IF c("var/snowflake") %] + tar -C $TBDIR -xf [% c('input_files_by_name/snowflake') -%] +[% END -%] tar -C $TBDIR[% IF c("var/osx") %]/Contents/Resources[% END %] -xf [% c('input_files_by_name/fonts') %] diff --git a/projects/tor-browser/config b/projects/tor-browser/config index 95f444d..f2c1d72 100644 --- a/projects/tor-browser/config +++ b/projects/tor-browser/config @@ -48,6 +48,9 @@ input_files: name: meek - project: obfs4 name: obfs4 + - project: snowflake + name: snowflake + enable: '[% c("var/snowflake") %]' - filename: Bundle-Data - URL: https://addons.cdn.mozilla.net/user-media/addons/722/noscript_security_suit… name: noscript diff --git a/projects/webrtc/build b/projects/webrtc/build new file mode 100644 index 0000000..5a70fbe --- /dev/null +++ b/projects/webrtc/build @@ -0,0 +1,80 @@ +#!/bin/bash +[% c("var/set_default_env") -%] +distdir=/var/tmp/dist/[% project %] +[% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] + +mkdir -p /var/tmp/dist + +[% IF c("var/linux") %] + tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/binutils') %] + export PATH="/var/tmp/dist/binutils/bin:$PATH" +[% END -%] + +# Setting up depot_tools +# https://dev.chromium.org/developers/how-tos/install-depot-tools +tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/depot_tools') %] +export PATH="$PATH:/var/tmp/dist/depot_tools" +# Disable automatic updating. +export DEPOT_TOOLS_UPDATE=0 + +mkdir -p /var/tmp/build +tar -C /var/tmp/build -xf webrtc-sources-[% c('version') %].tar.gz + +builddir=/var/tmp/build/[% project %]/src +cd $builddir +export GYP_CROSSCOMPILE=1 +export GYP_DEFINES="OS=[% c("var/webrtc/os") %] target_arch=[% c("var/webrtc/arch") %]" +# Do not use bundled utilities. +GYP_DEFINES+=" clang=0 host_clang=0 use_sysroot=0" +GYP_DEFINES+=" linux_use_bundled_gold=0 linux_use_gold_flags=0 linux_use_bundled_binutils=0" +# Avoid some dependencies. Some of these don't seem to work fully; for +# example even with use_alsa=0 we need libasound2-dev. +GYP_DEFINES+=" use_x11=0 use_gtk=0 use_gconf=0 use_alsa=0 use_pulseaudio=0 use_libpci=0 include_internal_audio_device=0 enabled_libjingle_device_manager=0" +# examples and tests also bring in dependencies. +GYP_DEFINES+=" include_examples=0 include_tests=0" +# embedded=1 is supposed to turn of various features; see +# https://bugs.chromium.org/p/chromium/issues/detail?id=318413. +GYP_DEFINES+=" embedded=1" +GYP_DEFINES+=" werror=" +[% IF c("var/linux") -%] + export CC=gcc + export CXX=g++ +[% END -%] +[% IF c("var/linux-i686") -%] + GYP_DEFINES+=" target_arch=ia32" + export CC='gcc -m32' + export CXX='g++ -m32' + export CFLAGS=-m32 + export CXXFLAGS=-m32 + export LDFLAGS=-m32 +[% END -%] +JAVA_HOME=/usr/lib/jvm/default-java webrtc/build/gyp_webrtc.py +ninja -C out/Release +# Run ninja once more, without include_tests=0, in order to build just the +# FakeAudioCaptureModule that go-webrtc uses. +GYP_DEFINES="$(echo "$GYP_DEFINES" | sed -e 's/include_tests=0//g')" +JAVA_HOME=/usr/lib/jvm/default-java webrtc/build/gyp_webrtc.py +ninja -C out/Release obj/webrtc/api/test/peerconnection_unittests.fakeaudiocapturemodule.o +# https://github.com/keroserene/go-webrtc/issues/23#issuecomment-175312648 +# dump_syms_regtest.o is actually an executable, not an object file. If not +# excluded, it results in the error: +# libwebrtc-linux-386-magic.a(dump_syms_regtest.o): unsupported ELF file type 2 +ar crs libwebrtc-magic.a $(find . -name '*.o' -not -name '*.main.o' -not -name 'dump_syms_regtest.o' | sort) + +mkdir -p $distdir +cd $distdir +mkdir -p include lib +cp -f $builddir/libwebrtc-magic.a [% c("var/webrtc/lib_path") %] +INCLUDE_DIR="$PWD/include" +cd $builddir +for h in $(find talk/ webrtc/ -type f -name '*.h'); +do + mkdir -p "$INCLUDE_DIR/$(dirname $h)" + cp -f "$h" "$INCLUDE_DIR/$h" +done + +cd /var/tmp/dist +[% c('tar', { + tar_src => [ project ], + tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'), + }) %] diff --git a/projects/webrtc/config b/projects/webrtc/config new file mode 100644 index 0000000..52618c2 --- /dev/null +++ b/projects/webrtc/config @@ -0,0 +1,115 @@ +# vim: filetype=yaml sw=2 +version: '[% c("var/webrtc_tag") %]' +remote_docker: 1 +filename: 'webrtc-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' + +var: + webrtc_tag: f33698296719f956497d2dbff81b5080864a8804 + +input_files: + - project: docker-image + - project: webrtc + pkg_type: fetch_sources + - project: depot_tools + name: depot_tools + - name: '[% c("var/compiler") %]' + project: '[% c("var/compiler") %]' + - project: binutils + name: binutils + enable: '[% c("var/linux") %]' + +targets: + linux: + var: + webrtc: + os: linux + linux-i686: + var: + dockerbuild: "[% pc('docker-image', 'pre') %]" + sort_deps: 0 + arch_deps: + - default-jre-headless + - default-jdk + - lib32asound2-dev + - lib64expat1 + - libexpat1-dev:i386 + - libudev-dev:i386 + - libx11-dev:i386 + - libxext-dev:i386 + - libxrandr-dev:i386 + - lib32stdc++6 + - hardening-wrapper + webrtc: + arch: ia32 + lib_arch: 386 + lib_path: lib/libwebrtc-linux-386-magic.a + linux-x86_64: + var: + arch_deps: + - default-jre-headless + - default-jdk + - libasound2-dev + - libexpat1-dev + - libudev-dev + - libx11-dev + - libxext-dev + - libxrandr-dev + webrtc: + arch: x64 + lib_arch: amd64 + lib_path: lib/libwebrtc-linux-amd64-magic.a + +steps: + fetch_sources: + remote_docker: 0 + filename: 'webrtc-sources-[% c("var/webrtc_tag") %].tar.gz' + fetch_sources: | + #!/bin/bash + [% c("var/set_default_env") -%] + # WebRTC is special, having its own build system that brings in lots of Chromium dependencies. + # https://webrtc.org/native-code/development/ + tar xf [% c('input_files_by_name/depot_tools') %] + export PATH="$rootdir/depot_tools:$PATH" + # GYP_CROSSCOMPILE=1 and GYP_DEFINES="use_x11=0" prevent probing for certain dependencies. + # Use --no-history because the whole checkout with history is about 12 GB. + export GYP_CROSSCOMPILE=1 + export GYP_DEFINES="use_x11=0" + # JAVA_HOME is needed in a hook for libjingle. The readlink line tries to find the current JRE. + # default-java comes from the package default-jdk-headless. + export JAVA_HOME=/usr/lib/jvm/default-java + clone_dir='[% c("basedir") %]/gclient/webrtc' + mkdir -p "$clone_dir" + cd "$clone_dir" + if [ ! -d "src" ]; + then + # "fetch" is part of depot_tools. + #fetch --nohooks --no-history webrtc + # FIXME: To avoid the unconditional `gclient sync` in the call to fetch, + # we inline the result of a `fetch --dry-run` + gclient root + gclient config --spec 'solutions = [ + { + "managed": False, + "name": "src", + "url": "https://chromium.googlesource.com/external/webrtc.git", + "custom_deps": {}, + "deps_file": "DEPS", + "safesync_url": "", + }, + ] + ' + gclient sync --nohooks --no-history --with_branch_heads -r [% c("var/webrtc_tag") %] + cd src + git submodule foreach 'git config -f $toplevel/.git/config submodule.$name.ignore all' + git config --add remote.origin.fetch '+refs/tags/*:refs/tags/*' + git config diff.ignoreSubmodules all + cd .. + fi + # "gclient" is part of depot_tools. This download takes a long time the first time. + gclient sync --no-history --with_branch_heads -r [% c("var/webrtc_tag") %] + cd .. + tar --exclude .git -czf [% dest_dir _ '/' _ c('filename') %] webrtc + input_files: + - project: depot_tools + name: depot_tools + pkg_type: build diff --git a/rbm.conf b/rbm.conf index e5c69b0..e206193 100644 --- a/rbm.conf +++ b/rbm.conf @@ -105,6 +105,7 @@ targets: linux-x86_64: arch: x86_64 var: + linux-x86_64: 1 osname: linux-x86_64 deps: - build-essential @@ -115,9 +116,12 @@ targets: - libtool - zip - unzip + # We only build snowflake on linux-x86_64 for now + snowflake: 1 linux-i686: arch: i686 var: + linux-i686: 1 osname: linux-i686 configure_opt: '--host=i686-linux-gnu CFLAGS=-m32 CXXFLAGS=-m32 LDFLAGS=-m32' pre_pkginst: dpkg --add-architecture i386

1 0

[tor-browser-build/master] Update firefox, http-e, openssl, tor, torbutton versions
by boklm＠torproject.org 10 Mar '17

10 Mar '17

commit e040f4434ea48ad7be41d2a22f19dc58a3ac8f5b Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri Mar 10 11:44:33 2017 +0100 Update firefox, http-e, openssl, tor, torbutton versions --- projects/firefox-langpacks/config | 2 +- projects/firefox/config | 2 +- projects/https-everywhere/config | 2 +- projects/openssl/config | 10 ++-------- projects/tor/config | 2 +- projects/torbutton/config | 2 +- 6 files changed, 7 insertions(+), 13 deletions(-) diff --git a/projects/firefox-langpacks/config b/projects/firefox-langpacks/config index a645b92..dd96dcd 100644 --- a/projects/firefox-langpacks/config +++ b/projects/firefox-langpacks/config @@ -4,7 +4,7 @@ filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/buil var: ff_version: '[% pc("firefox", "var/firefox_version") %]' - ff_build: build1 + ff_build: build2 ff_arch: linux-i686 input_filename: 'dl-langpack-[% c("var/ff_arch") %]-[% c("version") %]' diff --git a/projects/firefox/config b/projects/firefox/config index 96be619..f7e89e5 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -8,7 +8,7 @@ gpg_keyring: torbutton.gpg remote_docker: 1 var: - firefox_version: 45.7.0esr + firefox_version: 45.8.0esr torbrowser_branch: 7.0 torbrowser_update_channel: alpha copyright_year: '[% exec("git show -s --format=%ci").remove("-.*") %]' diff --git a/projects/https-everywhere/config b/projects/https-everywhere/config index 557473d..17f9f82 100644 --- a/projects/https-everywhere/config +++ b/projects/https-everywhere/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 5.2.9 +version: 5.2.11 git_url: https://git.torproject.org/https-everywhere.git git_hash: '[% c("version") %]' git_submodule: 1 diff --git a/projects/openssl/config b/projects/openssl/config index 637f3d1..8490b0b 100644 --- a/projects/openssl/config +++ b/projects/openssl/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 1.0.2j +version: 1.0.2k filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' remote_docker: 1 @@ -24,15 +24,9 @@ targets: pre_pkginst: dpkg --add-architecture i386 compiler: macosx-toolchain-gcc - nightly: - version: 1.0.2k - input_files: - project: docker-image - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]' - URL: 'https://www.openssl.org/source/openssl-[% c("version") %].tar.gz' - sha256sum: e7aff292be21c259c6af26469c7a9b3ba26e9abaaffd325e3dccc9785256c431 - targets: - nightly: - sha256sum: 6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 + sha256sum: 6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 diff --git a/projects/tor/config b/projects/tor/config index 2fbbf24..55637dc 100644 --- a/projects/tor/config +++ b/projects/tor/config @@ -1,6 +1,6 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -version: 0.3.0.2-alpha +version: 0.3.0.4-rc git_hash: 'tor-[% c("version") %]' git_url: https://git.torproject.org/tor.git gpg_keyring: tor.gpg diff --git a/projects/torbutton/config b/projects/torbutton/config index 5ff51f8..fdc9208 100644 --- a/projects/torbutton/config +++ b/projects/torbutton/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 1.9.7 +version: 1.9.7.1 git_url: https://git.torproject.org/torbutton.git git_hash: '[% c("version") %]' gpg_keyring: torbutton.gpg

1 0

[tor-browser/tor-browser-45.8.0esr-6.5-2] fixup! Bug 13900: Remove 3rd party HTTP auth tokens.
by gk＠torproject.org 08 Mar '17

08 Mar '17

commit eb8f7fd0910e831d96dfdef4782e23c6c389e844 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Fri Mar 3 21:47:20 2017 -0800 fixup! Bug 13900: Remove 3rd party HTTP auth tokens. The HostPartIsTheSame() is too strict about deciding what is first party. Instead we use IsThirdPartyURI() to check if the request is from the first party. Specifically, it considers an XHR to api.twitter.com from a twitter.com top-level page to be first-party. This fixes bug 21555 and 16450. --- netwerk/protocol/http/nsHttpChannel.cpp | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp index 3a9a126..e571394 100644 --- a/netwerk/protocol/http/nsHttpChannel.cpp +++ b/netwerk/protocol/http/nsHttpChannel.cpp @@ -6558,8 +6558,12 @@ nsHttpChannel::RemoveAuthorizationHeaderIfAppropriate() nsresult rv = thirdPartySvc->GetFirstPartyURIFromChannel(this, false, getter_AddRefs(firstPartyURI)); if (NS_SUCCEEDED(rv) && firstPartyURI) { - isAuthAllowed = (mURI == firstPartyURI) - || HostPartIsTheSame(firstPartyURI); + bool isThirdParty; + rv = thirdPartySvc->IsThirdPartyURI(firstPartyURI, mURI, &isThirdParty); + if (NS_SUCCEEDED(rv)) { + // Prevent third-party requests from sending auth tokens. + isAuthAllowed = !isThirdParty; + } } else { // We failed to get the first party URI. Check the document URI so // that we can allow authentication if the request originates from the

1 0

[tor-browser/tor-browser-45.8.0esr-7.0-1] fixup! Bug 13900: Remove 3rd party HTTP auth tokens.
by gk＠torproject.org 08 Mar '17

08 Mar '17

commit 340377b882408b5de24ff69bcd76e774d9844e4c Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Fri Mar 3 21:47:20 2017 -0800 fixup! Bug 13900: Remove 3rd party HTTP auth tokens. The HostPartIsTheSame() is too strict about deciding what is first party. Instead we use IsThirdPartyURI() to check if the request is from the first party. Specifically, it considers an XHR to api.twitter.com from a twitter.com top-level page to be first-party. This fixes bug 21555 and 16450. --- netwerk/protocol/http/nsHttpChannel.cpp | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp index 3a9a126..e571394 100644 --- a/netwerk/protocol/http/nsHttpChannel.cpp +++ b/netwerk/protocol/http/nsHttpChannel.cpp @@ -6558,8 +6558,12 @@ nsHttpChannel::RemoveAuthorizationHeaderIfAppropriate() nsresult rv = thirdPartySvc->GetFirstPartyURIFromChannel(this, false, getter_AddRefs(firstPartyURI)); if (NS_SUCCEEDED(rv) && firstPartyURI) { - isAuthAllowed = (mURI == firstPartyURI) - || HostPartIsTheSame(firstPartyURI); + bool isThirdParty; + rv = thirdPartySvc->IsThirdPartyURI(firstPartyURI, mURI, &isThirdParty); + if (NS_SUCCEEDED(rv)) { + // Prevent third-party requests from sending auth tokens. + isAuthAllowed = !isThirdParty; + } } else { // We failed to get the first party URI. Check the document URI so // that we can allow authentication if the request originates from the

1 0

[tor-browser-bundle/hardened-builds] Switch nightlies to 45.8.0esr
by gk＠torproject.org 07 Mar '17

07 Mar '17

commit 3c1ae6423d866c462c27fbd85365a30dd64f2d86 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Mar 7 09:44:16 2017 +0000 Switch nightlies to 45.8.0esr --- gitian/versions.nightly | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 7f10c69..042095a 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -17,7 +17,7 @@ MULTI_LINGUAL=1 VERIFY_TAGS=0 -FIREFOX_VERSION=45.7.0esr +FIREFOX_VERSION=45.8.0esr TORBROWSER_UPDATE_CHANNEL=default @@ -61,7 +61,7 @@ GITIAN_TAG=tor-browser-builder-4 OPENSSL_VER=1.0.2k GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION -FIREFOX_LANG_BUILD=build1 +FIREFOX_LANG_BUILD=build2 BINUTILS_VER=2.24 GCC_VER=5.4.0 CLANG_VER=r247539

1 0

[tor-browser-bundle/master] Switch nightlies to 45.8.0esr
by gk＠torproject.org 07 Mar '17

07 Mar '17

commit 24fdda2e33fc1f6e82f6a09f9bd32118fa3f2fa7 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Mar 7 09:43:07 2017 +0000 Switch nightlies to 45.8.0esr --- gitian/versions.nightly | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 94b3003..b9779e2 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -17,7 +17,7 @@ MULTI_LINGUAL=1 VERIFY_TAGS=0 -FIREFOX_VERSION=45.7.0esr +FIREFOX_VERSION=45.8.0esr TORBROWSER_UPDATE_CHANNEL=default @@ -62,7 +62,7 @@ GITIAN_TAG=tor-browser-builder-4 OPENSSL_VER=1.0.2k GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION -FIREFOX_LANG_BUILD=build1 +FIREFOX_LANG_BUILD=build2 BINUTILS_VER=2.24 GCC_VER=5.1.0 CLANG_VER=r247539

1 0

[tor-browser-build/master] Update rbm to fix installation of some packages
by boklm＠torproject.org 06 Mar '17

06 Mar '17

commit dc243808466f77c44e594b02962317c16bb379e4 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Mar 6 13:41:42 2017 +0100 Update rbm to fix installation of some packages This change will cause all containers to be rebuilt. --- rbm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rbm b/rbm index 1945b67..845bb90 160000 --- a/rbm +++ b/rbm @@ -1 +1 @@ -Subproject commit 1945b67fefbcf7b834b71275e301da06232f0241 +Subproject commit 845bb904fb87b6c56ab789f35cd02bce32453f52

1 0

[rbm/master] Fix install_package on Debian
by boklm＠torproject.org 06 Mar '17

06 Mar '17

commit 845bb904fb87b6c56ab789f35cd02bce32453f52 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Mar 6 13:34:11 2017 +0100 Fix install_package on Debian dpkg -s not returning an error means that the package has a status, but its status is not always installed, so checking the exit value is not enough. We are now checking that the status is "install ok installed". --- lib/RBM/DefaultConfig.pm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/RBM/DefaultConfig.pm b/lib/RBM/DefaultConfig.pm index 2f6264e..c0764bd 100644 --- a/lib/RBM/DefaultConfig.pm +++ b/lib/RBM/DefaultConfig.pm @@ -525,7 +525,7 @@ OPT_END my $dnf = 'rpm -q [% c("pkg_name") %] > /dev/null || dnf install -y [% c("pkg_name") %]'; my $zypper = 'rpm -q [% c("pkg_name") %] > /dev/null || zypper install [% c("pkg_name") %]'; my $urpmi = 'rpm -q [% c("pkg_name") %] > /dev/null || urpmi [% c("pkg_name") %]'; - my $apt = 'dpkg -s [% c("pkg_name") %] > /dev/null 2>&1 || apt-get install -y [% c("pkg_name") %]'; + my $apt = 'dpkg -s [% c("pkg_name") %] 2> /dev/null | grep -q "^Status: install ok installed\$" || apt-get install -y [% c("pkg_name") %]'; my %install = ( Fedora => $dnf, 'Fedora-20' => $yum,

1 0

[tor-browser-bundle/maint-6.5] Fix release date bug in Changelog
by gk＠torproject.org 06 Mar '17

06 Mar '17

commit 21ddc8a6be0f6ffe4723b1eba615e99460889e64 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Mar 6 11:04:23 2017 +0000 Fix release date bug in Changelog --- Bundle-Data/Docs/ChangeLog.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 311a894..5438022 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,4 +1,4 @@ -Tor Browser 6.5.1 -- March 6 2017 +Tor Browser 6.5.1 -- March 7 2017 * All Platforms * Update Firefox to 45.8.0esr * Tor to 0.2.9.10

1 0

[tor-browser-bundle/hardened-builds] Release preparations for 7.0a2-hardened
by gk＠torproject.org 06 Mar '17

06 Mar '17

commit dcfd2efd5b155830e4d9443b9f6b69f60313e6fb Author: Georg Koppen <gk(a)torproject.org> Date: Mon Mar 6 08:12:25 2017 +0000 Release preparations for 7.0a2-hardened Version bumps, Changelog update, and update of config.yml --- Bundle-Data/Docs/ChangeLog.txt | 20 ++++++++++++++++++++ gitian/versions.alpha | 14 +++++++------- tools/update-responses/config.yml | 10 +++++----- 3 files changed, 32 insertions(+), 12 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index f349311..c192940 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,23 @@ +Tor Browser 7.0a2-hardened -- March 7 2017 + * All Platforms + * Update Firefox to 45.8.0esr + * Tor to 0.3.0.4-rc + * OpenSSL to 1.0.2k + * Update Torbutton to 1.9.7.1 + * Bug 21396: Allow leaking of resource/chrome URIs (off by default) + * Bug 21574: Add link for zh manual and create manual links dynamically + * Bug 21330: Non-usable scrollbar appears in tor browser security settings + * Bug 21324: Don't update NoScript button with timer update + * Translation updates + * Update HTTPS-Everywhere to 5.2.11 + * Bug 21514: Restore W^X JIT implementation removed from ESR45 + * Bug 21536: Remove scramblesuit bridge + * Bug 21342: Move meek-azure to the meek.azureedge.net backend and cymrubridge02 bridge + * Bug 21326: Update the "Using a system-installed Tor" section in start script + * Build system + * Bug 17034: Use our built binutils and GCC for building tor + * Code clean-up + Tor Browser 7.0a1-hardened -- January 25 2017 * All Platforms * Update Firefox to 45.7.0esr diff --git a/gitian/versions.alpha b/gitian/versions.alpha index aaacef9..e3352c4 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -14,15 +14,15 @@ DATA_OUTSIDE_APP_DIR=1 VERIFY_TAGS=1 -FIREFOX_VERSION=45.7.0esr +FIREFOX_VERSION=45.8.0esr TORBROWSER_UPDATE_CHANNEL=hardened TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.0-1-build1 -TOR_TAG=tor-0.3.0.2-alpha +TOR_TAG=tor-0.3.0.4-rc TORLAUNCHER_TAG=0.2.11.1 -TORBUTTON_TAG=1.9.7 -HTTPSE_TAG=5.2.9 +TORBUTTON_TAG=1.9.7.1 +HTTPSE_TAG=5.2.11 NSIS_TAG=v0.3.1 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.22-stable @@ -55,10 +55,10 @@ UNIURI_TAG=8902c56451e9b58ff940bbe5fec35d5f9c04584a GITIAN_TAG=tor-browser-builder-4-1 -OPENSSL_VER=1.0.2j +OPENSSL_VER=1.0.2k GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION -FIREFOX_LANG_BUILD=build1 +FIREFOX_LANG_BUILD=build2 BINUTILS_VER=2.24 GCC_VER=5.4.0 CLANG_VER=r247539 @@ -110,7 +110,7 @@ NOTOTCFONT_PACKAGE=NotoSansTC-Regular.otf ELFUTILS_PACKAGE=elfutils-${ELFUTILS_VER}.tar.bz2 # Hashes for packages with weak sigs or no sigs -OPENSSL_HASH=e7aff292be21c259c6af26469c7a9b3ba26e9abaaffd325e3dccc9785256c431 +OPENSSL_HASH=6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf OSXSDK_OLD_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index 21c039b..0f112a3 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -20,7 +20,7 @@ build_targets: osx32: Darwin_x86-gcc3 osx64: Darwin_x86_64-gcc3 channels: - hardened: 7.0a1-hardened + hardened: 7.0a2-hardened release: 6.0.1 versions: 6.0.1: @@ -33,11 +33,11 @@ versions: osx32: minSupportedOSVersion: 10.8 detailsURL: https://blog.torproject.org/blog/end-life-plan-tor-browser-32-bit-macs#upda… - 7.0a1-hardened: - platformVersion: 45.7.0 - detailsURL: https://blog.torproject.org/blog/tor-browser-70a1-hardened-released + 7.0a2-hardened: + platformVersion: 45.8.0 + detailsURL: https://blog.torproject.org/blog/tor-browser-70a2-hardened-released incremental_from: - - 6.5a6-hardened + - 7.0a1-hardened migrate_archs: osx32: osx64 osx32:

1 0