July 2017 - tbb-commits - lists.torproject.org

[tor-browser-bundle/master] Updating Noscript
by gk＠torproject.org 28 Jul '17

28 Jul '17

commit 0437834017c1c7ff168da868d9dcb2f2519fd122 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Jul 28 16:19:01 2017 +0000 Updating Noscript This fixes bug 22067. --- gitian/versions.alpha | 4 ++-- gitian/versions.nightly | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/gitian/versions.alpha b/gitian/versions.alpha index ee7384c..a29572a 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -77,7 +77,7 @@ ELFUTILS_VER=0.166 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 -NOSCRIPT_PACKAGE=noscript_security_suite-5.0.5-fx+sm.xpi +NOSCRIPT_PACKAGE=noscript_security_suite-5.0.7.1-fx+sm.xpi CCTOOLS_PACKAGE=cctools.tar.gz OSXSDK_PACKAGE=MacOSX10.7.sdk.tar.gz MSVCR100_PACKAGE=msvcr100.dll @@ -113,7 +113,7 @@ ELFUTILS_PACKAGE=elfutils-${ELFUTILS_VER}.tar.bz2 OPENSSL_HASH=6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf -NOSCRIPT_HASH=bf1dee39f6e5936df2b03b794c1efc9236b440536a05fafcff667e33903e6aed +NOSCRIPT_HASH=fe85a4c72b5a763462f3b264f54a0ef1c6f6879eb95d903f2dfee337f768a50b CCTOOLS_HASH=e908fdebc2886ee5491ebfc7e7950af451b3c4e2439c2d7a923ed06ad05113e4 MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 5fe2881..e050347 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -80,7 +80,7 @@ ELFUTILS_VER=0.166 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 -NOSCRIPT_PACKAGE=noscript_security_suite-5.0.5-fx+sm.xpi +NOSCRIPT_PACKAGE=noscript_security_suite-5.0.7.1-fx+sm.xpi CCTOOLS_PACKAGE=cctools.tar.gz OSXSDK_PACKAGE=MacOSX10.7.sdk.tar.gz MSVCR100_PACKAGE=msvcr100.dll @@ -116,7 +116,7 @@ ELFUTILS_PACKAGE=elfutils-${ELFUTILS_VER}.tar.bz2 OPENSSL_HASH=ce07195b659e75f4e1db43552860070061f156a98bb37b672b101ba6e3ddf30c GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf -NOSCRIPT_HASH=bf1dee39f6e5936df2b03b794c1efc9236b440536a05fafcff667e33903e6aed +NOSCRIPT_HASH=fe85a4c72b5a763462f3b264f54a0ef1c6f6879eb95d903f2dfee337f768a50b CCTOOLS_HASH=e908fdebc2886ee5491ebfc7e7950af451b3c4e2439c2d7a923ed06ad05113e4 MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c

1 0

[tor-browser-bundle/maint-7.0] Apply patch for bug 23044
by gk＠torproject.org 27 Jul '17

27 Jul '17

commit a11a8b301950e1c25adcfd5bea07c773f5082533 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Jul 27 08:10:20 2017 +0000 Apply patch for bug 23044 --- gitian/descriptors/linux/gitian-firefox.yml | 2 ++ gitian/patches/gio.patch | 48 +++++++++++++++++++++++++++++ 2 files changed, 50 insertions(+) diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index 1ff66a2..49c457c 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -33,6 +33,7 @@ files: - "gcc-linux32-utils.zip" - "gcc-linux64-utils.zip" - "get-moz-build-date" +- "gio.patch" - "re-dzip.sh" - "dzip.sh" - "versions" @@ -88,6 +89,7 @@ script: | mkdir -p $INSTDIR/Debug/Browser/ cd tor-browser + patch -p1 < ../gio.patch # run get-moz-build-date before removing .git, which is used to get the year chmod +x ~/build/get-moz-build-date eval $(~/build/get-moz-build-date $(cat browser/config/version.txt)) diff --git a/gitian/patches/gio.patch b/gitian/patches/gio.patch new file mode 100644 index 0000000..1edae4d --- /dev/null +++ b/gitian/patches/gio.patch @@ -0,0 +1,48 @@ +From a96f898e0da42de751a5e1367a9899cc96fadb1f Mon Sep 17 00:00:00 2001 +From: Georg Koppen <gk(a)torproject.org> +Date: Thu, 27 Jul 2017 07:31:38 +0000 +Subject: [PATCH] Bug 23044: Don't allow GIO supported protocols by default + + +diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js +index aaeba630422d..3edaad88f59e 100644 +--- a/browser/app/profile/000-tor-browser.js ++++ b/browser/app/profile/000-tor-browser.js +@@ -210,6 +210,9 @@ pref("network.protocol-handler.warn-external.mailto", true); + pref("network.protocol-handler.warn-external.news", true); + pref("network.protocol-handler.warn-external.nntp", true); + pref("network.protocol-handler.warn-external.snews", true); ++// Make sure we don't have any GIO supported protocols (defense in depth ++// measure) ++pref("network.gio.supported-protocols", ""); + pref("plugin.disable", true); // Disable to search plugins on first start + pref("plugins.click_to_play", true); + pref("plugin.state.flash", 1); +diff --git a/extensions/gio/nsGIOProtocolHandler.cpp b/extensions/gio/nsGIOProtocolHandler.cpp +index a378e8700821..5f6b2a0a2a57 100644 +--- a/extensions/gio/nsGIOProtocolHandler.cpp ++++ b/extensions/gio/nsGIOProtocolHandler.cpp +@@ -922,16 +922,16 @@ nsGIOProtocolHandler::InitSupportedProtocolsPref(nsIPrefBranch *prefs) + // Get user preferences to determine which protocol is supported. + // Gvfs/GIO has a set of supported protocols like obex, network, archive, + // computer, dav, cdda, gphoto2, trash, etc. Some of these seems to be +- // irrelevant to process by browser. By default accept only smb and sftp +- // protocols so far. ++ // irrelevant to process by browser. By default accept none. + nsresult rv = prefs->GetCharPref(MOZ_GIO_SUPPORTED_PROTOCOLS, + getter_Copies(mSupportedProtocols)); + if (NS_SUCCEEDED(rv)) { + mSupportedProtocols.StripWhitespace(); + ToLowerCase(mSupportedProtocols); + } +- else +- mSupportedProtocols.AssignLiteral("smb:,sftp:"); // use defaults ++ else { ++ mSupportedProtocols.AssignLiteral(""); // use none by default ++ } + + LOG(("gio: supported protocols \"%s\"\n", mSupportedProtocols.get())); + } +-- +2.13.2 +

1 0

[tor-browser-bundle/maint-7.0] Changelog update, and config.yml changes
by gk＠torproject.org 27 Jul '17

27 Jul '17

commit fb678ac1a95ed724f0edb8bc1f7c748d0ef8b8d1 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Jul 27 08:06:44 2017 +0000 Changelog update, and config.yml changes --- Bundle-Data/Docs/ChangeLog.txt | 4 ++++ tools/update-responses/config.yml | 8 ++++---- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index c7cb8c2..d509505 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,7 @@ +Tor Browser 7.0.3 -- July 27 2017 + * Linux + * Bug 23044: Don't allow GIO supported protocols by default + Tor Browser 7.0.2 -- July 3 2017 * All Platforms * Update Tor to 0.3.0.9, fixing bug #22753 diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index 9ff92ce..1547dfd 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -20,13 +20,13 @@ build_targets: osx64: Darwin_x86_64-gcc3 channels: alpha: 7.0a4 - release: 7.0.2 + release: 7.0.3 versions: - 7.0.2: + 7.0.3: platformVersion: 52.2.0 - detailsURL: https://blog.torproject.org/blog/tor-browser-702-released + detailsURL: https://blog.torproject.org/blog/tor-browser-703-released incremental_from: - - 7.0.1 + - 7.0.2 migrate_archs: osx32: osx64 migrate_langs:

1 0

[tor-browser/tor-browser-52.2.0esr-7.5-1] Bug 23044: Don't allow GIO supported protocols by default
by gk＠torproject.org 27 Jul '17

27 Jul '17

commit a96f898e0da42de751a5e1367a9899cc96fadb1f Author: Georg Koppen <gk(a)torproject.org> Date: Thu Jul 27 07:31:38 2017 +0000 Bug 23044: Don't allow GIO supported protocols by default --- browser/app/profile/000-tor-browser.js | 3 +++ extensions/gio/nsGIOProtocolHandler.cpp | 8 ++++---- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index aaeba630422d..3edaad88f59e 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -210,6 +210,9 @@ pref("network.protocol-handler.warn-external.mailto", true); pref("network.protocol-handler.warn-external.news", true); pref("network.protocol-handler.warn-external.nntp", true); pref("network.protocol-handler.warn-external.snews", true); +// Make sure we don't have any GIO supported protocols (defense in depth +// measure) +pref("network.gio.supported-protocols", ""); pref("plugin.disable", true); // Disable to search plugins on first start pref("plugins.click_to_play", true); pref("plugin.state.flash", 1); diff --git a/extensions/gio/nsGIOProtocolHandler.cpp b/extensions/gio/nsGIOProtocolHandler.cpp index a378e8700821..5f6b2a0a2a57 100644 --- a/extensions/gio/nsGIOProtocolHandler.cpp +++ b/extensions/gio/nsGIOProtocolHandler.cpp @@ -922,16 +922,16 @@ nsGIOProtocolHandler::InitSupportedProtocolsPref(nsIPrefBranch *prefs) // Get user preferences to determine which protocol is supported. // Gvfs/GIO has a set of supported protocols like obex, network, archive, // computer, dav, cdda, gphoto2, trash, etc. Some of these seems to be - // irrelevant to process by browser. By default accept only smb and sftp - // protocols so far. + // irrelevant to process by browser. By default accept none. nsresult rv = prefs->GetCharPref(MOZ_GIO_SUPPORTED_PROTOCOLS, getter_Copies(mSupportedProtocols)); if (NS_SUCCEEDED(rv)) { mSupportedProtocols.StripWhitespace(); ToLowerCase(mSupportedProtocols); } - else - mSupportedProtocols.AssignLiteral("smb:,sftp:"); // use defaults + else { + mSupportedProtocols.AssignLiteral(""); // use none by default + } LOG(("gio: supported protocols \"%s\"\n", mSupportedProtocols.get())); }

1 0

[tor-browser/tor-browser-52.2.0esr-7.0-1] Bug 23044: Don't allow GIO supported protocols by default
by gk＠torproject.org 27 Jul '17

27 Jul '17

commit 720f9061496321aa978d2f022113c40e9aeb4847 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Jul 27 07:31:38 2017 +0000 Bug 23044: Don't allow GIO supported protocols by default --- browser/app/profile/000-tor-browser.js | 3 +++ extensions/gio/nsGIOProtocolHandler.cpp | 8 ++++---- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index d2fb5e57378a..dc7e99701293 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -210,6 +210,9 @@ pref("network.protocol-handler.warn-external.mailto", true); pref("network.protocol-handler.warn-external.news", true); pref("network.protocol-handler.warn-external.nntp", true); pref("network.protocol-handler.warn-external.snews", true); +// Make sure we don't have any GIO supported protocols (defense in depth +// measure) +pref("network.gio.supported-protocols", ""); pref("plugin.disable", true); // Disable to search plugins on first start pref("plugins.click_to_play", true); pref("plugin.state.flash", 1); diff --git a/extensions/gio/nsGIOProtocolHandler.cpp b/extensions/gio/nsGIOProtocolHandler.cpp index a378e8700821..5f6b2a0a2a57 100644 --- a/extensions/gio/nsGIOProtocolHandler.cpp +++ b/extensions/gio/nsGIOProtocolHandler.cpp @@ -922,16 +922,16 @@ nsGIOProtocolHandler::InitSupportedProtocolsPref(nsIPrefBranch *prefs) // Get user preferences to determine which protocol is supported. // Gvfs/GIO has a set of supported protocols like obex, network, archive, // computer, dav, cdda, gphoto2, trash, etc. Some of these seems to be - // irrelevant to process by browser. By default accept only smb and sftp - // protocols so far. + // irrelevant to process by browser. By default accept none. nsresult rv = prefs->GetCharPref(MOZ_GIO_SUPPORTED_PROTOCOLS, getter_Copies(mSupportedProtocols)); if (NS_SUCCEEDED(rv)) { mSupportedProtocols.StripWhitespace(); ToLowerCase(mSupportedProtocols); } - else - mSupportedProtocols.AssignLiteral("smb:,sftp:"); // use defaults + else { + mSupportedProtocols.AssignLiteral(""); // use none by default + } LOG(("gio: supported protocols \"%s\"\n", mSupportedProtocols.get())); }

1 0

[tor-browser-build/master] Remove some unused options
by boklm＠torproject.org 26 Jul '17

26 Jul '17

commit 0a9f7ef3459d4e19d22bc312cdaa5961eaa650da Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Jul 26 11:40:54 2017 +0200 Remove some unused options --- projects/debootstrap-image/config | 3 --- 1 file changed, 3 deletions(-) diff --git a/projects/debootstrap-image/config b/projects/debootstrap-image/config index 15eec3b..ecb7f2d 100644 --- a/projects/debootstrap-image/config +++ b/projects/debootstrap-image/config @@ -5,9 +5,6 @@ pkg_type: build var: ubuntu_version: 17.04 - container_dir: '[% c("tmp_dir") %]/rbm-containers/[% sha256(c("build_id")) %]' - container_user: rbm - container: use_container: 1 # We need CAP_SYS_ADMIN for debootstrap to work

1 0

[tor-browser-build/master] Include uid in tmp containers directory
by boklm＠torproject.org 26 Jul '17

26 Jul '17

commit 9084d642cfc291df76b9fd4acecdce5aeb7f71b9 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Jul 26 12:09:07 2017 +0200 Include uid in tmp containers directory This should allow multiple users to do builds on the same machine. --- rbm.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rbm.conf b/rbm.conf index ce444d4..4ef6b90 100644 --- a/rbm.conf +++ b/rbm.conf @@ -28,7 +28,7 @@ var: build: [% c("build", { filename => 'f', output_dir => '/out' }) %] container: - dir: '[% c("tmp_dir") %]/rbm-containers/[% sha256(c("build_id")) %]' + dir: '[% c("tmp_dir") %]/[% c("uid") %]/rbm-containers/[% sha256(c("build_id")) %]' user: rbm input_files_list: | [% FOREACH file IN c("input_files_by_name").keys.sort -%]

1 0

[tor-browser-build/master] README: mention which version of runc is needed
by boklm＠torproject.org 26 Jul '17

26 Jul '17

commit b386c5f8af06e605bdb84c5bae8bde3c8afbd485 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Jul 26 12:10:54 2017 +0200 README: mention which version of runc is needed --- README | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/README b/README index fa968ff..2fcfadf 100644 --- a/README +++ b/README @@ -5,8 +5,12 @@ Installing build dependencies ----------------------------- To build Tor Browser, you need a Linux distribution that has support -for runC (such as Debian jessie, Ubuntu 14.04, Fedora 20, etc ...). -On Debian jessie, the runc package is available in backports. +for runc (such as Debian jessie, Ubuntu 14.04, Fedora 20, etc ...). +On Debian jessie, the runc package is available in backports. On Debian +stretch, the runc package is available in the main repository. +Version 0.1.1 of runc is required (which is the version available in +Debian stretch and jessie-backports). It is not yet working with runc +version 1.0.0: https://trac.torproject.org/projects/tor/ticket/23039 Your user account should have access sudo access, which is required to be able to extract container file systems, start containers and copy

1 0

[tor-browser-bundle/maint-7.0] Bug 23028: update argparse URL
by gk＠torproject.org 25 Jul '17

25 Jul '17

1 0

[tor-browser-bundle/master] Bug 23028: update argparse URL
by gk＠torproject.org 25 Jul '17

25 Jul '17

1 0