March 2018 - tbb-commits - lists.torproject.org

[tor-browser/tor-browser-52.7.3esr-8.0-1] fixup! Bug 16940: After update, load local change notes.
by gk＠torproject.org 27 Mar '18

27 Mar '18

commit 7719a132533d0e245602b9aee496875a8cb03cd5 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Wed Jan 17 14:01:51 2018 -0500 fixup! Bug 16940: After update, load local change notes. Always load about:tbupdate in a content process. To improve compatiblity with future sandboxing efforts, relocate the code that accesses the file system (changelog) to the chrome process. Avoid using a query string to pass the "more info" link to the about:tbupdate page. Remove obsolete flag nsIAboutModule::MAKE_UNLINKABLE (about: pages are unlinkable by default). --- browser/base/content/browser.js | 22 +++-- browser/base/content/tab-content.js | 104 ++++++++---------------- browser/base/jar.mn | 2 +- browser/base/moz.build | 3 + browser/components/about/AboutRedirector.cpp | 2 +- browser/components/nsBrowserContentHandler.js | 5 +- browser/components/nsBrowserGlue.js | 9 +++ browser/modules/AboutTBUpdate.jsm | 111 ++++++++++++++++++++++++++ browser/modules/moz.build | 5 ++ toolkit/modules/AppConstants.jsm | 7 ++ toolkit/modules/moz.build | 3 + 11 files changed, 186 insertions(+), 87 deletions(-) diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js index 5c0d9a4d7161..5eabd3373b71 100755 --- a/browser/base/content/browser.js +++ b/browser/base/content/browser.js @@ -215,9 +215,6 @@ this.__defineSetter__("AddonManager", function (val) { var gInitialPages = [ "about:tor", -#ifdef TOR_BROWSER_UPDATE - "about:tbupdate", -#endif "about:blank", "about:newtab", "about:home", @@ -225,6 +222,9 @@ var gInitialPages = [ "about:welcomeback", "about:sessionrestore" ]; +if (AppConstants.TOR_BROWSER_UPDATE) { + gInitialPages.push("about:tbupdate"); +} function* browserWindows() { let windows = Services.wm.getEnumerator("navigator:browser"); @@ -2420,13 +2420,8 @@ function URLBarSetURI(aURI) { // 2. if remote newtab is enabled and it's the default remote newtab page let defaultRemoteURL = gAboutNewTabService.remoteEnabled && uri.spec === gAboutNewTabService.newTabURL; -#ifdef TOR_BROWSER_UPDATE - if ((gInitialPages.includes(uri.spec.split('?')[0]) || defaultRemoteURL) && - checkEmptyPageOrigin(gBrowser.selectedBrowser, uri)) -#else if ((gInitialPages.includes(uri.spec) || defaultRemoteURL) && checkEmptyPageOrigin(gBrowser.selectedBrowser, uri)) -#endif { value = ""; } else { @@ -7453,11 +7448,12 @@ var gIdentityHandler = { this._uriHasHost = false; } -#ifdef TOR_BROWSER_UPDATE - let whitelist = /^(?:accounts|addons|cache|config|crashes|customizing|downloads|healthreport|home|license|newaddon|permissions|preferences|privatebrowsing|rights|searchreset|sessionrestore|support|welcomeback|tor|tbupdate)(?:[?#]|$)/i; -#else - let whitelist = /^(?:accounts|addons|cache|config|crashes|customizing|downloads|healthreport|home|license|newaddon|permissions|preferences|privatebrowsing|rights|searchreset|sessionrestore|support|welcomeback|tor)(?:[?#]|$)/i; -#endif + let whitelist; + if (AppConstants.TOR_BROWSER_UPDATE) { + whitelist = /^(?:accounts|addons|cache|config|crashes|customizing|downloads|healthreport|home|license|newaddon|permissions|preferences|privatebrowsing|rights|searchreset|sessionrestore|support|welcomeback|tor|tbupdate)(?:[?#]|$)/i; + } else { + whitelist = /^(?:accounts|addons|cache|config|crashes|customizing|downloads|healthreport|home|license|newaddon|permissions|preferences|privatebrowsing|rights|searchreset|sessionrestore|support|welcomeback|tor)(?:[?#]|$)/i; + } this._isSecureInternalUI = uri.schemeIs("about") && whitelist.test(uri.path); // Create a channel for the sole purpose of getting the resolved URI diff --git a/browser/base/content/tab-content.js b/browser/base/content/tab-content.js index d7d565ec50de..9aefa567fbae 100644 --- a/browser/base/content/tab-content.js +++ b/browser/base/content/tab-content.js @@ -5,19 +5,11 @@ /* This content script contains code that requires a tab browser. */ -#ifdef TOR_BROWSER_VERSION -# Add double-quotes back on (stripped by JarMaker.py). -#expand const TOR_BROWSER_VERSION = "__TOR_BROWSER_VERSION__"; -#endif - var {classes: Cc, interfaces: Ci, utils: Cu, results: Cr} = Components; Cu.import("resource://gre/modules/XPCOMUtils.jsm"); Cu.import("resource://gre/modules/Services.jsm"); Cu.import("resource://gre/modules/ExtensionContent.jsm"); -#ifdef TOR_BROWSER_UPDATE -Cu.import("resource://gre/modules/NetUtil.jsm"); -#endif XPCOMUtils.defineLazyModuleGetter(this, "E10SUtils", "resource:///modules/E10SUtils.jsm"); @@ -408,80 +400,50 @@ let AboutTBUpdateListener = { }, get isAboutTBUpdate() { - return content.document.documentURI.split('?')[0].toLowerCase() - == "about:tbupdate"; + return content.document.documentURI.toLowerCase() == "about:tbupdate"; }, handleEvent: function(aEvent) { - if (this.isAboutTBUpdate && (aEvent.type == "AboutTBUpdateLoad")) - this.onPageLoad(); - }, + if (!this.isAboutTBUpdate) + return; - onPageLoad: function() { - let doc = content.document; - doc.getElementById("infolink").setAttribute("href", this.getPostUpdateURL()); - doc.getElementById("changelog").textContent = this.getChangeLogText(); - - const kBrandBundle = "chrome://branding/locale/brand.properties"; - let brandBundle = Cc["@mozilla.org/intl/stringbundle;1"] - .getService(Ci.nsIStringBundleService) - .createBundle(kBrandBundle); - let productName = brandBundle.GetStringFromName("brandFullName"); - doc.getElementById("torbrowser-version").textContent = productName + "\n" - + TOR_BROWSER_VERSION; + switch (aEvent.type) { + case "AboutTBUpdateLoad": + this.onPageLoad(); + break; + case "pagehide": + this.onPageHide(aEvent); + break; + } }, - // Extract the post update URL from this page's query string. - getPostUpdateURL: function() { - let idx = content.document.documentURI.indexOf('?'); - if (idx > 0) - return decodeURIComponent(content.document.documentURI.substring(idx+1)); - - // No query string: use the default URL. - return Services.urlFormatter.formatURLPref("startup.homepage_override_url"); + receiveMessage: function(aMessage) { + if (this.isAboutTBUpdate && (aMessage.name == "AboutTBUpdate:Update")) + this.onUpdate(aMessage.data); }, - // Read and return the text from the beginning of the changelog file that is - // located at TorBrowser/Docs/ChangeLog.txt. - // On Mac OS, when building with --enable-tor-browser-data-outside-app-dir - // to support Gatekeeper signing, the file is located in - // TorBrowser.app/Contents/Resources/TorBrowser/Docs/. - // - // When electrolysis is enabled we will need to adopt an architecture that is - // more similar to the one that is used for about:home (see AboutHomeListener - // in this file and browser/modules/AboutHome.jsm). - getChangeLogText: function() { - try { -#ifdef TOR_BROWSER_DATA_OUTSIDE_APP_DIR - // "XREExeF".parent is the directory that contains firefox, i.e., - // Browser/ or, on Mac OS, TorBrowser.app/Contents/MacOS/. - let f = Services.dirsvc.get("XREExeF", Ci.nsIFile).parent; -#ifdef XP_MACOSX - f = f.parent; - f.append("Resources"); -#endif - f.append("TorBrowser"); -#else - // "DefProfRt" is .../TorBrowser/Data/Browser - let f = Cc["@mozilla.org/file/directory_service;1"] - .getService(Ci.nsIProperties).get("DefProfRt", Ci.nsIFile); - f = f.parent.parent; // Remove "Data/Browser" -#endif - f.append("Docs"); - f.append("ChangeLog.txt"); - - let fs = Cc["@mozilla.org/network/file-input-stream;1"] - .createInstance(Ci.nsIFileInputStream); - fs.init(f, -1, 0, 0); - let s = NetUtil.readInputStreamToString(fs, fs.available()); - fs.close(); + onUpdate: function(aData) { + let doc = content.document; + doc.getElementById("torbrowser-version").textContent = aData.productInfo; + if (aData.moreInfoURL) + doc.getElementById("infolink").setAttribute("href", aData.moreInfoURL); + doc.getElementById("changelog").textContent = aData.changeLog; + }, - // Truncate at the first empty line. - return s.replace(/[\r\n][\r\n][\s\S]*$/m, ""); - } catch (e) {} + onPageLoad: function() { + addMessageListener("AboutTBUpdate:Update", this); + addEventListener("pagehide", this, true); + sendAsyncMessage("AboutTBUpdate:RequestUpdate"); + }, - return ""; + onPageHide: function(aEvent) { + if (aEvent.target.defaultView.frameElement) { + return; + } + removeMessageListener("AboutTBUpdate:Update", this); + removeEventListener("pagehide", this, true); }, + }; AboutTBUpdateListener.init(this); #endif diff --git a/browser/base/jar.mn b/browser/base/jar.mn index 2b0f744b42cb..9d2f100a9717 100644 --- a/browser/base/jar.mn +++ b/browser/base/jar.mn @@ -75,7 +75,7 @@ browser.jar: content/browser/abouttbupdate/aboutTBUpdateLogo.png (content/abouttbupdate/aboutTBUpdateLogo.png) #endif * content/browser/browser.css (content/browser.css) -* content/browser/browser.js (content/browser.js) + content/browser/browser.js (content/browser.js) * content/browser/browser.xul (content/browser.xul) content/browser/browser-addons.js (content/browser-addons.js) content/browser/browser-captivePortal.js (content/browser-captivePortal.js) diff --git a/browser/base/moz.build b/browser/base/moz.build index 46634999261c..dc15e2902bb8 100644 --- a/browser/base/moz.build +++ b/browser/base/moz.build @@ -47,4 +47,7 @@ if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('windows', 'cocoa'): if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('windows', 'gtk2', 'gtk3'): DEFINES['MENUBAR_CAN_AUTOHIDE'] = 1 +if CONFIG['TOR_BROWSER_UPDATE']: + DEFINES['TOR_BROWSER_UPDATE'] = 1 + JAR_MANIFESTS += ['jar.mn'] diff --git a/browser/components/about/AboutRedirector.cpp b/browser/components/about/AboutRedirector.cpp index 016d75cb68c7..364f78d46957 100644 --- a/browser/components/about/AboutRedirector.cpp +++ b/browser/components/about/AboutRedirector.cpp @@ -107,8 +107,8 @@ static RedirEntry kRedirMap[] = { #ifdef TOR_BROWSER_UPDATE { "tbupdate", "chrome://browser/content/abouttbupdate/aboutTBUpdate.xhtml", nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT | + nsIAboutModule::URI_MUST_LOAD_IN_CHILD | nsIAboutModule::ALLOW_SCRIPT | - nsIAboutModule::MAKE_UNLINKABLE | nsIAboutModule::HIDE_FROM_ABOUTABOUT }, #endif }; diff --git a/browser/components/nsBrowserContentHandler.js b/browser/components/nsBrowserContentHandler.js index ee0c6a5a4a7a..583010e937ed 100644 --- a/browser/components/nsBrowserContentHandler.js +++ b/browser/components/nsBrowserContentHandler.js @@ -576,7 +576,10 @@ nsBrowserContentHandler.prototype = { #ifdef TOR_BROWSER_UPDATE if (overridePage) - overridePage = "about:tbupdate?" + encodeURIComponent(overridePage); + { + prefb.setCharPref("torbrowser.post_update.url", overridePage); + overridePage = "about:tbupdate" + } #endif break; } diff --git a/browser/components/nsBrowserGlue.js b/browser/components/nsBrowserGlue.js index bb2351d41014..562ca20e19a4 100644 --- a/browser/components/nsBrowserGlue.js +++ b/browser/components/nsBrowserGlue.js @@ -78,6 +78,11 @@ if (AppConstants.MOZ_CRASHREPORTER) { "resource://gre/modules/CrashSubmit.jsm"); } +if (AppConstants.TOR_BROWSER_UPDATE) { + XPCOMUtils.defineLazyModuleGetter(this, "AboutTBUpdate", + "resource:///modules/AboutTBUpdate.jsm"); +} + XPCOMUtils.defineLazyGetter(this, "gBrandBundle", function() { return Services.strings.createBundle('chrome://branding/locale/brand.properties'); }); @@ -714,6 +719,10 @@ BrowserGlue.prototype = { UnsubmittedCrashHandler.init(); } + if (AppConstants.TOR_BROWSER_UPDATE) { + AboutTBUpdate.init(); + } + Services.obs.notifyObservers(null, "browser-ui-startup-complete", ""); }, diff --git a/browser/modules/AboutTBUpdate.jsm b/browser/modules/AboutTBUpdate.jsm new file mode 100644 index 000000000000..49d9d9b0e18d --- /dev/null +++ b/browser/modules/AboutTBUpdate.jsm @@ -0,0 +1,111 @@ +// Copyright (c) 2018, The Tor Project, Inc. +// See LICENSE for licensing information. +// +// vim: set sw=2 sts=2 ts=8 et syntax=javascript: + +"use strict"; + +var Cc = Components.classes; +var Ci = Components.interfaces; +var Cu = Components.utils; + +this.EXPORTED_SYMBOLS = [ "AboutTBUpdate" ]; + +Cu.import("resource://gre/modules/Services.jsm"); +Cu.import("resource://gre/modules/NetUtil.jsm"); + +const kRequestUpdateMessageName = "AboutTBUpdate:RequestUpdate"; +const kSendUpdateMessageName = "AboutTBUpdate:Update"; + +#ifdef TOR_BROWSER_VERSION +#expand const TOR_BROWSER_VERSION = __TOR_BROWSER_VERSION__; +#endif + +/** + * This code provides services to the about:tbupdate page. Whenever + * about:tbupdate needs to do something chrome-privileged, it sends a + * message that's handled here. It is modeled after Mozilla's about:home + * implementation. + */ +var AboutTBUpdate = { + init: function() { + let mm = Cc["@mozilla.org/globalmessagemanager;1"] + .getService(Ci.nsIMessageListenerManager); + mm.addMessageListener(kRequestUpdateMessageName, this); + }, + + receiveMessage: function(aMessage) { + if (aMessage.name == kRequestUpdateMessageName) + this.sendAboutTBUpdateData(aMessage.target); + }, + + sendAboutTBUpdateData: function(aTarget) { + let data = { productInfo: this.productInfo, + moreInfoURL: this.moreInfoURL, + changeLog: this.changeLog }; + + if (aTarget && aTarget.messageManager) { + aTarget.messageManager.sendAsyncMessage(kSendUpdateMessageName, data); + } else { + let mm = Cc["@mozilla.org/globalmessagemanager;1"] + .getService(Ci.nsIMessageListenerManager); + mm.broadcastAsyncMessage(kSendUpdateMessageName, data); + } + }, + + get productInfo() { + const kBrandBundle = "chrome://branding/locale/brand.properties"; + let brandBundle = Cc["@mozilla.org/intl/stringbundle;1"] + .getService(Ci.nsIStringBundleService) + .createBundle(kBrandBundle); + return brandBundle.GetStringFromName("brandFullName") + + "\n" + TOR_BROWSER_VERSION; + }, + + get moreInfoURL() { + try { + return Services.prefs.getCharPref("torbrowser.post_update.url"); + } catch (e) {} + + // Use the default URL as a fallback. + return Services.urlFormatter.formatURLPref("startup.homepage_override_url"); + }, + + // Read and return the text from the beginning of the changelog file that is + // located at TorBrowser/Docs/ChangeLog.txt. + // On Mac OS, when building with --enable-tor-browser-data-outside-app-dir + // to support Gatekeeper signing, the file is located in + // TorBrowser.app/Contents/Resources/TorBrowser/Docs/. + get changeLog() { + try { +#ifdef TOR_BROWSER_DATA_OUTSIDE_APP_DIR + // "XREExeF".parent is the directory that contains firefox, i.e., + // Browser/ or, on Mac OS, TorBrowser.app/Contents/MacOS/. + let f = Services.dirsvc.get("XREExeF", Ci.nsIFile).parent; +#ifdef XP_MACOSX + f = f.parent; + f.append("Resources"); +#endif + f.append("TorBrowser"); +#else + // "DefProfRt" is .../TorBrowser/Data/Browser + let f = Cc["@mozilla.org/file/directory_service;1"] + .getService(Ci.nsIProperties).get("DefProfRt", Ci.nsIFile); + f = f.parent.parent; // Remove "Data/Browser" +#endif + f.append("Docs"); + f.append("ChangeLog.txt"); + + let fs = Cc["@mozilla.org/network/file-input-stream;1"] + .createInstance(Ci.nsIFileInputStream); + fs.init(f, -1, 0, 0); + let s = NetUtil.readInputStreamToString(fs, fs.available()); + fs.close(); + + // Truncate at the first empty line. + return s.replace(/[\r\n][\r\n][\s\S]*$/m, ""); + } catch (e) {} + + return ""; + }, +}; diff --git a/browser/modules/moz.build b/browser/modules/moz.build index 2526272249e8..4fe8adeb6c49 100644 --- a/browser/modules/moz.build +++ b/browser/modules/moz.build @@ -52,6 +52,11 @@ if not CONFIG['TOR_BROWSER_VERSION']: 'CastingApps.jsm', ] +if CONFIG['TOR_BROWSER_UPDATE']: + EXTRA_PP_JS_MODULES += [ + 'AboutTBUpdate.jsm', + ] + if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'windows': EXTRA_JS_MODULES += [ 'Windows8WindowFrameColor.jsm', diff --git a/toolkit/modules/AppConstants.jsm b/toolkit/modules/AppConstants.jsm index 7ce8e1f09af4..82e5753be12a 100644 --- a/toolkit/modules/AppConstants.jsm +++ b/toolkit/modules/AppConstants.jsm @@ -340,4 +340,11 @@ this.AppConstants = Object.freeze({ #else false, #endif + + TOR_BROWSER_UPDATE: +#ifdef TOR_BROWSER_UPDATE + true, +#else + false, +#endif }); diff --git a/toolkit/modules/moz.build b/toolkit/modules/moz.build index 7d4b0f3fa713..6c3d273804fc 100644 --- a/toolkit/modules/moz.build +++ b/toolkit/modules/moz.build @@ -159,4 +159,7 @@ for var in ('MOZ_TOOLKIT_SEARCH', if CONFIG[var]: DEFINES[var] = True +if CONFIG['TOR_BROWSER_UPDATE']: + DEFINES['TOR_BROWSER_UPDATE'] = 1 + DEFINES['TOPOBJDIR'] = TOPOBJDIR

1 0

[tor-browser/tor-browser-52.7.3esr-8.0-1] Revert "Orfox: Fix #1 - Improve build instructions"
by gk＠torproject.org 27 Mar '18

27 Mar '18

commit cc4c7e19e9474e423aebbc00be898824f27d496a Author: Georg Koppen <gk(a)torproject.org> Date: Tue Mar 27 06:25:17 2018 +0000 Revert "Orfox: Fix #1 - Improve build instructions" This reverts commit c981d290167b8547789849194ed12dd763f1f892. --- README.md | 20 -------------------- README.txt | 27 +++++++++++++++++++++++++++ 2 files changed, 27 insertions(+), 20 deletions(-) diff --git a/README.md b/README.md deleted file mode 100644 index 8cf5ca26625a..000000000000 --- a/README.md +++ /dev/null @@ -1,20 +0,0 @@ -## ORFOX BUILD STEPS: - -1) Move .mozconfig-android to .mozconfig OR run: -``` -export MOZCONFIG="tor-browser/.mozconfig-android" -``` -2) Checks if the all requirements for the build are fine with: -``` -./mach configure -``` -3) Builds the repo with: -``` -./mach build -``` -4) Creates the apk in tor-browser/MOZ_OBJDIR/dist/fennec-38.0.en-US.android-arm.apk -``` -./mach package -``` -### Note: this does not ship the addons, that is managed in a different repo: https://github.com/amoghbl1/orfox-addons. -### Steps to include these addons can be figured out looking at the jenkins script at https://github.com/amoghbl1/Orfox/blob/master/jenkins-build diff --git a/README.txt b/README.txt new file mode 100644 index 000000000000..658c0dce3174 --- /dev/null +++ b/README.txt @@ -0,0 +1,27 @@ +An explanation of the Mozilla Source Code Directory Structure and links to +project pages with documentation can be found at: + + https://developer.mozilla.org/en/Mozilla_Source_Code_Directory_Structure + +For information on how to build Mozilla from the source code, see: + + http://developer.mozilla.org/en/docs/Build_Documentation + +To have your bug fix / feature added to Mozilla, you should create a patch and +submit it to Bugzilla (https://bugzilla.mozilla.org) Instructions are at: + + http://developer.mozilla.org/en/docs/Creating_a_patch + http://developer.mozilla.org/en/docs/Getting_your_patch_in_the_tree + +If you have a question about developing Mozilla, and can't find the solution +on http://developer.mozilla.org, you can try asking your question in a +mozilla.* Usenet group, or on IRC at irc.mozilla.org. [The Mozilla news groups +are accessible on Google Groups, or news.mozilla.org with a NNTP reader.] + +You can download nightly development builds from the Mozilla FTP server. +Keep in mind that nightly builds, which are used by Mozilla developers for +testing, may be buggy. Firefox nightlies, for example, can be found at: + + https://archive.mozilla.org/pub/firefox/nightly/latest-mozilla-central/ + - or - + http://nightly.mozilla.org/

1 0

[tor-browser-build/master] Revert "Merge remote-tracking branch 'boklm/bug_16472_v8'"
by gk＠torproject.org 25 Mar '18

25 Mar '18

commit 1087afecd27f1cb535c3c1187b3d468ee454a15d Author: Georg Koppen <gk(a)torproject.org> Date: Sun Mar 25 09:55:21 2018 +0000 Revert "Merge remote-tracking branch 'boklm/bug_16472_v8'" This reverts commit b8bae5882eac6159c8a6ad466b9dc4a7b18ba27b, reversing changes made to 42720c512520ecef5437d23e405d8ce011764661. It turns out this binutils update is causing non-reproducible outomces. We need to investigate those further in #16472. --- keyring/binutils.gpg | Bin 2242 -> 25772 bytes projects/binutils/64bit-fixups.patch | 31 ++-- projects/binutils/binutils-224-gold.patch | 98 +++++++++++++ projects/binutils/build | 9 ++ projects/binutils/config | 8 +- projects/binutils/enable-reloc-section-ld.patch | 83 +++++------ projects/binutils/fix-warning-bfd.patch | 186 ++++++++++++++++++++++++ projects/binutils/peXXigen.patch | 14 ++ projects/mingw-w64/build | 8 +- projects/nsis/build | 31 +--- projects/openssl/config | 2 +- projects/selfrando/config | 2 +- projects/zlib/build | 4 +- rbm.conf | 2 +- 14 files changed, 378 insertions(+), 100 deletions(-) diff --git a/keyring/binutils.gpg b/keyring/binutils.gpg index eab4406..f24bb01 100644 Binary files a/keyring/binutils.gpg and b/keyring/binutils.gpg differ diff --git a/projects/binutils/64bit-fixups.patch b/projects/binutils/64bit-fixups.patch index 7dc1294..33c0297 100644 --- a/projects/binutils/64bit-fixups.patch +++ b/projects/binutils/64bit-fixups.patch @@ -1,19 +1,14 @@ -From 05164a1162d5f6f696d7f7c4b1bc61ef06d1c288 Mon Sep 17 00:00:00 2001 +From f3ba95e14437f10de8b8f296930ff2a8495d18c6 Mon Sep 17 00:00:00 2001 From: Georg Koppen <gk(a)torproject.org> Date: Tue, 12 Sep 2017 07:21:16 +0000 Subject: [PATCH] 64bit fixups ---- - ld/emultempl/pep.em | 4 ++-- - ld/pep-dll.c | 1 + - ld/pep-dll.h | 1 + - 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/ld/emultempl/pep.em b/ld/emultempl/pep.em -index fccbd63..f7c0a57 100644 +index b566903b14..27006bdf79 100644 --- a/ld/emultempl/pep.em +++ b/ld/emultempl/pep.em -@@ -742,7 +742,7 @@ gld${EMULATION_NAME}_handle_option (int optc) +@@ -730,7 +730,7 @@ gld${EMULATION_NAME}_handle_option (int optc) pep_dll_exclude_all_symbols = 1; break; case OPTION_ENABLE_RELOC_SECTION: @@ -22,17 +17,17 @@ index fccbd63..f7c0a57 100644 break; case OPTION_EXCLUDE_LIBS: pep_dll_add_excludes (optarg, EXCLUDELIBS); -@@ -1862,7 +1862,7 @@ gld_${EMULATION_NAME}_finish (void) +@@ -1623,7 +1623,7 @@ gld_${EMULATION_NAME}_finish (void) + #ifdef DLL_SUPPORT - if (bfd_link_pic (&link_info) - || (!bfd_link_relocatable (&link_info) -- && pe_dll_enable_reloc_section) -+ && pep_dll_enable_reloc_section) - || (!bfd_link_relocatable (&link_info) - && pep_def_file->num_exports != 0)) + if (link_info.shared +- || (!link_info.relocatable && pe_dll_enable_reloc_section) ++ || (!link_info.relocatable && pep_dll_enable_reloc_section) + || (!link_info.relocatable && pep_def_file->num_exports != 0)) { + pep_dll_fill_sections (link_info.output_bfd, &link_info); diff --git a/ld/pep-dll.c b/ld/pep-dll.c -index b8c017f..5ad5733 100644 +index 0e5e8b1523..b5f99b90e0 100644 --- a/ld/pep-dll.c +++ b/ld/pep-dll.c @@ -31,6 +31,7 @@ @@ -44,7 +39,7 @@ index b8c017f..5ad5733 100644 #define pe_dll_stdcall_aliases pep_dll_stdcall_aliases #define pe_dll_warn_dup_exports pep_dll_warn_dup_exports diff --git a/ld/pep-dll.h b/ld/pep-dll.h -index 0a27c1f..95d9c15 100644 +index 1e7e3d65d4..c31e69cc8e 100644 --- a/ld/pep-dll.h +++ b/ld/pep-dll.h @@ -31,6 +31,7 @@ extern def_file * pep_def_file; @@ -56,5 +51,5 @@ index 0a27c1f..95d9c15 100644 extern int pep_dll_stdcall_aliases; extern int pep_dll_warn_dup_exports; -- -2.1.4 +2.14.1 diff --git a/projects/binutils/binutils-224-gold.patch b/projects/binutils/binutils-224-gold.patch new file mode 100644 index 0000000..a45e49c --- /dev/null +++ b/projects/binutils/binutils-224-gold.patch @@ -0,0 +1,98 @@ +From f984741df04cd68bb116073fdfa9405808810ab4 Mon Sep 17 00:00:00 2001 +From: Cary Coutant <ccoutant(a)google.com> +Date: Wed, 5 Feb 2014 22:59:02 -0800 +Subject: [PATCH] Fix issues with gold undefined symbol diagnostics. + +PR binutils/15435 complains that gold issues a visibility error for an +weak undefined symbol with hidden visibility. The message should be +suppressed if the symbol is a weak undef. + +An earlier patch to add an extra note about key functions when a class's +vtable symbol is undefined missed a case where the reference to the +vtable came from a shared library. This patch moves the check to a +lower-level routine that catches both cases. + +gold/ + +2014-02-05 Cary Coutant <ccoutant(a)google.com> + + * errors.cc (Errors::undefined_symbol): Move undef vtable symbol + check to here. + * target-reloc.h (is_strong_undefined): New function. + (relocate_section): Move undef vtable symbol check from here. + Check for is_strong_undefined. + +diff --git a/gold/ChangeLog b/gold/ChangeLog +index dcf7ed41f8..dd7ef72980 100644 +--- a/gold/ChangeLog ++++ b/gold/ChangeLog +@@ -1,3 +1,14 @@ ++2014-02-05 Cary Coutant <ccoutant(a)google.com> ++ ++ Fix issues with gold undefined symbol diagnostics. ++ ++ PR binutils/15435 ++ * errors.cc (Errors::undefined_symbol): Move undef vtable symbol ++ check to here. ++ * target-reloc.h (is_strong_undefined): New function. ++ (relocate_section): Move undef vtable symbol check from here. ++ Check for is_strong_undefined. ++ + 2013-11-22 Cary Coutant <ccoutant(a)google.com> + + * testsuite/Makefile.am (exception_x86_64_bnd_test): Use in-tree +diff --git a/gold/errors.cc b/gold/errors.cc +index b79764bd1d..98db0fdd86 100644 +--- a/gold/errors.cc ++++ b/gold/errors.cc +@@ -193,6 +193,11 @@ Errors::undefined_symbol(const Symbol* sym, const std::string& location) + fprintf(stderr, + _("%s: %s: undefined reference to '%s', version '%s'\n"), + location.c_str(), zmsg, sym->demangled_name().c_str(), version); ++ ++ if (sym->is_cxx_vtable()) ++ gold_info(_("%s: the vtable symbol may be undefined because " ++ "the class is missing its key function"), ++ program_name); + } + + // Issue a debugging message. +diff --git a/gold/target-reloc.h b/gold/target-reloc.h +index b544c78f37..d609bcbaa8 100644 +--- a/gold/target-reloc.h ++++ b/gold/target-reloc.h +@@ -144,6 +144,12 @@ class Default_comdat_behavior + } + }; + ++inline bool ++is_strong_undefined(const Symbol* sym) ++{ ++ return sym->is_undefined() && sym->binding() != elfcpp::STB_WEAK; ++} ++ + // Give an error for a symbol with non-default visibility which is not + // defined locally. + +@@ -411,16 +417,10 @@ relocate_section( + } + + if (issue_undefined_symbol_error(sym)) +- { +- gold_undefined_symbol_at_location(sym, relinfo, i, offset); +- if (sym->is_cxx_vtable()) +- gold_info(_("%s: the vtable symbol may be undefined because " +- "the class is missing its key function"), +- program_name); +- } ++ gold_undefined_symbol_at_location(sym, relinfo, i, offset); + else if (sym != NULL + && sym->visibility() != elfcpp::STV_DEFAULT +- && (sym->is_undefined() || sym->is_from_dynobj())) ++ && (is_strong_undefined(sym) || sym->is_from_dynobj())) + visibility_error(sym); + + if (sym != NULL && sym->has_warning()) +-- +2.11.0 + diff --git a/projects/binutils/build b/projects/binutils/build index 8a4ae3f..ee6db1a 100644 --- a/projects/binutils/build +++ b/projects/binutils/build @@ -21,12 +21,21 @@ cd [% project %]-[% c("version") %] [% IF c('var/windows') -%] # XXX: This is needed due to bug 10102. sed 's/= extern_rt_rel_d;/= extern_rt_rel_d;\n memset (extern_rt_rel_d, 0, PE_IDATA5_SIZE);/' -i ld/pe-dll.c + # Zeroing timestamps in PE headers reliably, see bug 12753. + patch -p1 < ../peXXigen.patch # Needed for the hardening... patch -p1 < ../enable-reloc-section-ld.patch + # fix "right-hand operand of comma expression has no effect" warning + patch -p1 < ../fix-warning-bfd.patch [% END -%] [% IF c('var/windows-x86_64') -%] patch -p1 < ../64bit-fixups.patch [% END -%] +[% IF c("var/linux") && ! c("var/release") -%] + # We need to work around a gold linker bug in 2.24 to get selfrando working, + # see bug 20683. + patch -p1 < $rootdir/binutils-224-gold.patch +[% END -%] ./configure --prefix=$distdir [% c('var/configure_opt') %] make -j[% c("buildconf/num_procs") %] make install diff --git a/projects/binutils/config b/projects/binutils/config index 7ac3799..5c35588 100644 --- a/projects/binutils/config +++ b/projects/binutils/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 2.29.1 +version: 2.24 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' var: configure_opt: '--disable-multilib --enable-gold --enable-deterministic-archives --enable-plugins' @@ -19,5 +19,11 @@ input_files: - project: container-image - filename: enable-reloc-section-ld.patch enable: '[% c("var/windows") %]' + - filename: fix-warning-bfd.patch + enable: '[% c("var/windows") %]' - filename: 64bit-fixups.patch enable: '[% c("var/windows-x86_64") %]' + - filename: peXXigen.patch + enable: '[% c("var/windows") %]' + - filename: binutils-224-gold.patch + enable: '[% c("var/linux") %]' diff --git a/projects/binutils/enable-reloc-section-ld.patch b/projects/binutils/enable-reloc-section-ld.patch index a6600c3..f393f51 100644 --- a/projects/binutils/enable-reloc-section-ld.patch +++ b/projects/binutils/enable-reloc-section-ld.patch @@ -1,29 +1,30 @@ -From fba503a78c50d6134943245d55e820f53e8f19cd Mon Sep 17 00:00:00 2001 +From 093b08a9e7af23a258306b710ebc4556d12f94f7 Mon Sep 17 00:00:00 2001 From: Erinn Clark <erinn(a)torproject.org> Date: Fri, 8 Aug 2014 14:23:44 -0400 Subject: [PATCH] add relocation section so Windows bundles can have ASLR Patch by skruffy. + --- - ld/emultempl/pe.em | 7 ++++++ - ld/emultempl/pep.em | 11 ++++++++-- + ld/emultempl/pe.em | 6 +++++ + ld/emultempl/pep.em | 8 ++++++- ld/pe-dll.c | 63 ++++++++++++++++++++++++++++++----------------------- ld/pe-dll.h | 1 + - 4 files changed, 53 insertions(+), 29 deletions(-) + 4 files changed, 50 insertions(+), 28 deletions(-) diff --git a/ld/emultempl/pe.em b/ld/emultempl/pe.em -index 339b7c5..3958b81 100644 +index 5d6da9e..14c07f7 100644 --- a/ld/emultempl/pe.em +++ b/ld/emultempl/pe.em -@@ -272,6 +272,7 @@ fragment <<EOF +@@ -268,6 +268,7 @@ fragment <<EOF + #define OPTION_TERMINAL_SERVER_AWARE (OPTION_WDM_DRIVER + 1) + /* Determinism. */ #define OPTION_INSERT_TIMESTAMP (OPTION_TERMINAL_SERVER_AWARE + 1) - #define OPTION_NO_INSERT_TIMESTAMP (OPTION_INSERT_TIMESTAMP + 1) - #define OPTION_BUILD_ID (OPTION_NO_INSERT_TIMESTAMP + 1) -+#define OPTION_ENABLE_RELOC_SECTION (OPTION_BUILD_ID + 1) ++#define OPTION_ENABLE_RELOC_SECTION (OPTION_INSERT_TIMESTAMP + 1) static void gld${EMULATION_NAME}_add_options -@@ -315,6 +316,7 @@ gld${EMULATION_NAME}_add_options +@@ -310,6 +311,7 @@ gld${EMULATION_NAME}_add_options {"export-all-symbols", no_argument, NULL, OPTION_EXPORT_ALL}, {"exclude-symbols", required_argument, NULL, OPTION_EXCLUDE_SYMBOLS}, {"exclude-all-symbols", no_argument, NULL, OPTION_EXCLUDE_ALL_SYMBOLS}, @@ -31,7 +32,7 @@ index 339b7c5..3958b81 100644 {"exclude-libs", required_argument, NULL, OPTION_EXCLUDE_LIBS}, {"exclude-modules-for-implib", required_argument, NULL, OPTION_EXCLUDE_MODULES_FOR_IMPLIB}, {"kill-at", no_argument, NULL, OPTION_KILL_ATS}, -@@ -782,6 +784,9 @@ gld${EMULATION_NAME}_handle_option (int optc) +@@ -773,6 +775,9 @@ gld${EMULATION_NAME}_handle_option (int optc) case OPTION_EXCLUDE_ALL_SYMBOLS: pe_dll_exclude_all_symbols = 1; break; @@ -41,30 +42,29 @@ index 339b7c5..3958b81 100644 case OPTION_EXCLUDE_LIBS: pe_dll_add_excludes (optarg, EXCLUDELIBS); break; -@@ -2076,6 +2081,8 @@ gld_${EMULATION_NAME}_finish (void) +@@ -1839,6 +1844,7 @@ gld_${EMULATION_NAME}_finish (void) + if (link_info.shared #if !defined(TARGET_IS_shpe) - || (!bfd_link_relocatable (&link_info) - && pe_def_file->num_exports != 0) -+ || (!bfd_link_relocatable (&link_info) -+ && pe_dll_enable_reloc_section) + || (!link_info.relocatable && pe_def_file->num_exports != 0) ++ || (!link_info.relocatable && pe_dll_enable_reloc_section) #endif ) { diff --git a/ld/emultempl/pep.em b/ld/emultempl/pep.em -index c253d2f..fccbd63 100644 +index b738800..b566903 100644 --- a/ld/emultempl/pep.em +++ b/ld/emultempl/pep.em -@@ -246,7 +246,8 @@ enum options +@@ -242,7 +242,8 @@ enum options + OPTION_NO_BIND, + OPTION_WDM_DRIVER, OPTION_INSERT_TIMESTAMP, - OPTION_NO_INSERT_TIMESTAMP, - OPTION_TERMINAL_SERVER_AWARE, -- OPTION_BUILD_ID -+ OPTION_BUILD_ID, +- OPTION_TERMINAL_SERVER_AWARE ++ OPTION_TERMINAL_SERVER_AWARE, + OPTION_ENABLE_RELOC_SECTION }; static void -@@ -288,6 +289,7 @@ gld${EMULATION_NAME}_add_options +@@ -284,6 +285,7 @@ gld${EMULATION_NAME}_add_options {"export-all-symbols", no_argument, NULL, OPTION_EXPORT_ALL}, {"exclude-symbols", required_argument, NULL, OPTION_EXCLUDE_SYMBOLS}, {"exclude-all-symbols", no_argument, NULL, OPTION_EXCLUDE_ALL_SYMBOLS}, @@ -72,7 +72,7 @@ index c253d2f..fccbd63 100644 {"exclude-libs", required_argument, NULL, OPTION_EXCLUDE_LIBS}, {"exclude-modules-for-implib", required_argument, NULL, OPTION_EXCLUDE_MODULES_FOR_IMPLIB}, {"kill-at", no_argument, NULL, OPTION_KILL_ATS}, -@@ -739,6 +741,9 @@ gld${EMULATION_NAME}_handle_option (int optc) +@@ -727,6 +729,9 @@ gld${EMULATION_NAME}_handle_option (int optc) case OPTION_EXCLUDE_ALL_SYMBOLS: pep_dll_exclude_all_symbols = 1; break; @@ -82,22 +82,19 @@ index c253d2f..fccbd63 100644 case OPTION_EXCLUDE_LIBS: pep_dll_add_excludes (optarg, EXCLUDELIBS); break; -@@ -1857,7 +1862,9 @@ gld_${EMULATION_NAME}_finish (void) +@@ -1618,6 +1623,7 @@ gld_${EMULATION_NAME}_finish (void) + #ifdef DLL_SUPPORT - if (bfd_link_pic (&link_info) - || (!bfd_link_relocatable (&link_info) -- && pep_def_file->num_exports != 0)) -+ && pe_dll_enable_reloc_section) -+ || (!bfd_link_relocatable (&link_info) -+ && pep_def_file->num_exports != 0)) + if (link_info.shared ++ || (!link_info.relocatable && pe_dll_enable_reloc_section) + || (!link_info.relocatable && pep_def_file->num_exports != 0)) { pep_dll_fill_sections (link_info.output_bfd, &link_info); - if (command_line.out_implib_filename) diff --git a/ld/pe-dll.c b/ld/pe-dll.c -index c398f23..3797f1a 100644 +index e9e133b..4230dc3 100644 --- a/ld/pe-dll.c +++ b/ld/pe-dll.c -@@ -151,6 +151,7 @@ def_file * pe_def_file = 0; +@@ -152,6 +152,7 @@ def_file * pe_def_file = 0; int pe_dll_export_everything = 0; int pe_dll_exclude_all_symbols = 0; int pe_dll_do_default_excludes = 1; @@ -105,10 +102,10 @@ index c398f23..3797f1a 100644 int pe_dll_kill_ats = 0; int pe_dll_stdcall_aliases = 0; int pe_dll_warn_dup_exports = 0; -@@ -3430,8 +3431,15 @@ pe_dll_build_sections (bfd *abfd, struct bfd_link_info *info) +@@ -3370,8 +3371,15 @@ pe_dll_build_sections (bfd *abfd, struct bfd_link_info *info) process_def_file_and_drectve (abfd, info); - if (pe_def_file->num_exports == 0 && !bfd_link_pic (info)) + if (pe_def_file->num_exports == 0 && !info->shared) - return; - + { @@ -123,7 +120,7 @@ index c398f23..3797f1a 100644 generate_edata (abfd, info); build_filler_bfd (1); pe_output_file_set_long_section_names (filler_bfd); -@@ -3446,13 +3454,9 @@ pe_exe_build_sections (bfd *abfd, struct bfd_link_info *info ATTRIBUTE_UNUSED) +@@ -3386,13 +3394,9 @@ pe_exe_build_sections (bfd *abfd, struct bfd_link_info *info ATTRIBUTE_UNUSED) pe_output_file_set_long_section_names (filler_bfd); } @@ -139,13 +136,13 @@ index c398f23..3797f1a 100644 generate_reloc (abfd, info); if (reloc_sz > 0) { -@@ -3469,38 +3473,43 @@ pe_dll_fill_sections (bfd *abfd, struct bfd_link_info *info) +@@ -3409,38 +3413,43 @@ pe_dll_fill_sections (bfd *abfd, struct bfd_link_info *info) lang_do_assignments (lang_final_phase_enum); } - fill_edata (abfd, info); - -- if (bfd_link_dll (info)) +- if (info->shared && !info->pie) - pe_data (abfd)->dll = 1; - - edata_s->contents = edata_d; @@ -177,7 +174,7 @@ index c398f23..3797f1a 100644 - /* Resize the sections. */ - lang_reset_memory_regions (); - lang_size_sections (NULL, TRUE); -+ if (bfd_link_pic (info) && !bfd_link_pie (info)) ++ if (info->shared && !info->pie) + pe_data (abfd)->dll = 1; - /* Redo special stuff. */ @@ -203,10 +200,10 @@ index c398f23..3797f1a 100644 bfd_boolean diff --git a/ld/pe-dll.h b/ld/pe-dll.h -index 48d169b..05ff72b 100644 +index 4697390..2bf71d9 100644 --- a/ld/pe-dll.h +++ b/ld/pe-dll.h -@@ -30,6 +30,7 @@ extern def_file *pe_def_file; +@@ -31,6 +31,7 @@ extern def_file *pe_def_file; extern int pe_dll_export_everything; extern int pe_dll_exclude_all_symbols; extern int pe_dll_do_default_excludes; @@ -215,5 +212,5 @@ index 48d169b..05ff72b 100644 extern int pe_dll_stdcall_aliases; extern int pe_dll_warn_dup_exports; -- -2.1.4 +2.0.1 diff --git a/projects/binutils/fix-warning-bfd.patch b/projects/binutils/fix-warning-bfd.patch new file mode 100644 index 0000000..fa04405 --- /dev/null +++ b/projects/binutils/fix-warning-bfd.patch @@ -0,0 +1,186 @@ +From 27b829ee701e29804216b3803fbaeb629be27491 Mon Sep 17 00:00:00 2001 +From: Nick Clifton <nickc(a)redhat.com> +Date: Wed, 29 Jan 2014 13:46:39 +0000 +Subject: [PATCH] Following up on Tom's suggestion I am checking in a patch to + replace the various bfd_xxx_set macros with static inline functions, so that + we can avoid compile time warnings about comma expressions with unused + values. + + * bfd-in.h (bfd_set_section_vma): Delete. + (bfd_set_section_alignment): Delete. + (bfd_set_section_userdata): Delete. + (bfd_set_cacheable): Delete. + * bfd.c (bfd_set_cacheable): New static inline function. + * section.c (bfd_set_section_userdata): Likewise. + (bfd_set_section_vma): Likewise. + (bfd_set_section_alignment): Likewise. + * bfd-in2.h: Regenerate. +--- + bfd/bfd-in.h | 5 ----- + bfd/bfd-in2.h | 41 +++++++++++++++++++++++++++++++++++------ + bfd/bfd.c | 8 ++++++++ + bfd/section.c | 26 ++++++++++++++++++++++++++ + 5 files changed, 81 insertions(+), 11 deletions(-) + +diff --git a/bfd/bfd-in.h b/bfd/bfd-in.h +index 3afd71b..c7c5a7d 100644 +--- a/bfd/bfd-in.h ++++ b/bfd/bfd-in.h +@@ -292,9 +292,6 @@ typedef struct bfd_section *sec_ptr; + + #define bfd_is_com_section(ptr) (((ptr)->flags & SEC_IS_COMMON) != 0) + +-#define bfd_set_section_vma(bfd, ptr, val) (((ptr)->vma = (ptr)->lma = (val)), ((ptr)->user_set_vma = TRUE), TRUE) +-#define bfd_set_section_alignment(bfd, ptr, val) (((ptr)->alignment_power = (val)),TRUE) +-#define bfd_set_section_userdata(bfd, ptr, val) (((ptr)->userdata = (val)),TRUE) + /* Find the address one past the end of SEC. */ + #define bfd_get_section_limit(bfd, sec) \ + (((bfd)->direction != write_direction && (sec)->rawsize != 0 \ +@@ -517,8 +514,6 @@ extern void warn_deprecated (const char *, const char *, int, const char *); + + #define bfd_get_symbol_leading_char(abfd) ((abfd)->xvec->symbol_leading_char) + +-#define bfd_set_cacheable(abfd,bool) (((abfd)->cacheable = bool), TRUE) +- + extern bfd_boolean bfd_cache_close + (bfd *abfd); + /* NB: This declaration should match the autogenerated one in libbfd.h. */ +diff --git a/bfd/bfd-in2.h b/bfd/bfd-in2.h +index 71996db..b5aeb40 100644 +--- a/bfd/bfd-in2.h ++++ b/bfd/bfd-in2.h +@@ -299,9 +299,6 @@ typedef struct bfd_section *sec_ptr; + + #define bfd_is_com_section(ptr) (((ptr)->flags & SEC_IS_COMMON) != 0) + +-#define bfd_set_section_vma(bfd, ptr, val) (((ptr)->vma = (ptr)->lma = (val)), ((ptr)->user_set_vma = TRUE), TRUE) +-#define bfd_set_section_alignment(bfd, ptr, val) (((ptr)->alignment_power = (val)),TRUE) +-#define bfd_set_section_userdata(bfd, ptr, val) (((ptr)->userdata = (val)),TRUE) + /* Find the address one past the end of SEC. */ + #define bfd_get_section_limit(bfd, sec) \ + (((bfd)->direction != write_direction && (sec)->rawsize != 0 \ +@@ -524,8 +521,6 @@ extern void warn_deprecated (const char *, const char *, int, const char *); + + #define bfd_get_symbol_leading_char(abfd) ((abfd)->xvec->symbol_leading_char) + +-#define bfd_set_cacheable(abfd,bool) (((abfd)->cacheable = bool), TRUE) +- + extern bfd_boolean bfd_cache_close + (bfd *abfd); + /* NB: This declaration should match the autogenerated one in libbfd.h. */ +@@ -1029,7 +1024,7 @@ bfd *bfd_openr (const char *filename, const char *target); + + bfd *bfd_fdopenr (const char *filename, const char *target, int fd); + +-bfd *bfd_openstreamr (const char *, const char *, void *); ++bfd *bfd_openstreamr (const char * filename, const char * target, void * stream); + + bfd *bfd_openr_iovec (const char *filename, const char *target, + void *(*open_func) (struct bfd *nbfd, +@@ -1596,6 +1591,32 @@ struct relax_table { + int size; + }; + ++/* Note: the following are provided as inline functions rather than macros ++ because not all callers use the return value. A macro implementation ++ would use a comma expression, eg: "((ptr)->foo = val, TRUE)" and some ++ compilers will complain about comma expressions that have no effect. */ ++static inline bfd_boolean ++bfd_set_section_userdata (bfd * abfd ATTRIBUTE_UNUSED, asection * ptr, void * val) ++{ ++ ptr->userdata = val; ++ return TRUE; ++} ++ ++static inline bfd_boolean ++bfd_set_section_vma (bfd * abfd ATTRIBUTE_UNUSED, asection * ptr, bfd_vma val) ++{ ++ ptr->vma = ptr->lma = val; ++ ptr->user_set_vma = TRUE; ++ return TRUE; ++} ++ ++static inline bfd_boolean ++bfd_set_section_alignment (bfd * abfd ATTRIBUTE_UNUSED, asection * ptr, unsigned int val) ++{ ++ ptr->alignment_power = val; ++ return TRUE; ++} ++ + /* These sections are global, and are managed by BFD. The application + and target back end are not permitted to change the values in + these sections. */ +@@ -6415,6 +6436,14 @@ struct bfd + unsigned int selective_search : 1; + }; + ++/* See note beside bfd_set_section_userdata. */ ++static inline bfd_boolean ++bfd_set_cacheable (bfd * abfd, bfd_boolean val) ++{ ++ abfd->cacheable = val; ++ return TRUE; ++} ++ + typedef enum bfd_error + { + bfd_error_no_error = 0, +diff --git a/bfd/bfd.c b/bfd/bfd.c +index 8d0580c..2d174f3 100644 +--- a/bfd/bfd.c ++++ b/bfd/bfd.c +@@ -311,6 +311,14 @@ CODE_FRAGMENT + . unsigned int selective_search : 1; + .}; + . ++.{* See note beside bfd_set_section_userdata. *} ++.static inline bfd_boolean ++.bfd_set_cacheable (bfd * abfd, bfd_boolean val) ++.{ ++. abfd->cacheable = val; ++. return TRUE; ++.} ++. + */ + + #include "sysdep.h" +diff --git a/bfd/section.c b/bfd/section.c +index fb19d8c..a661228 100644 +--- a/bfd/section.c ++++ b/bfd/section.c +@@ -542,6 +542,32 @@ CODE_FRAGMENT + . int size; + .}; + . ++.{* Note: the following are provided as inline functions rather than macros ++. because not all callers use the return value. A macro implementation ++. would use a comma expression, eg: "((ptr)->foo = val, TRUE)" and some ++. compilers will complain about comma expressions that have no effect. *} ++.static inline bfd_boolean ++.bfd_set_section_userdata (bfd * abfd ATTRIBUTE_UNUSED, asection * ptr, void * val) ++.{ ++. ptr->userdata = val; ++. return TRUE; ++.} ++. ++.static inline bfd_boolean ++.bfd_set_section_vma (bfd * abfd ATTRIBUTE_UNUSED, asection * ptr, bfd_vma val) ++.{ ++. ptr->vma = ptr->lma = val; ++. ptr->user_set_vma = TRUE; ++. return TRUE; ++.} ++. ++.static inline bfd_boolean ++.bfd_set_section_alignment (bfd * abfd ATTRIBUTE_UNUSED, asection * ptr, unsigned int val) ++.{ ++. ptr->alignment_power = val; ++. return TRUE; ++.} ++. + .{* These sections are global, and are managed by BFD. The application + . and target back end are not permitted to change the values in + . these sections. *} +-- +2.1.4 + diff --git a/projects/binutils/peXXigen.patch b/projects/binutils/peXXigen.patch new file mode 100644 index 0000000..785aa02 --- /dev/null +++ b/projects/binutils/peXXigen.patch @@ -0,0 +1,14 @@ +diff -crB binutils-2.24/bfd/peXXigen.c binutils-2.24/bfd/peXXigen.c +*** binutils-2.24/bfd/peXXigen.c Tue Nov 26 11:37:33 2013 +--- binutils-2.24/bfd/peXXigen.c Mon Aug 4 07:10:15 2014 +*************** +*** 795,800 **** +--- 795,802 ---- + /* Only use a real timestamp if the option was chosen. */ + if ((pe_data (abfd)->insert_timestamp)) + H_PUT_32 (abfd, time(0), filehdr_out->f_timdat); ++ else ++ H_PUT_32 (abfd, 0, filehdr_out->f_timdat); + + PUT_FILEHDR_SYMPTR (abfd, filehdr_in->f_symptr, + filehdr_out->f_symptr); diff --git a/projects/mingw-w64/build b/projects/mingw-w64/build index 8acd41d..8d3e567 100644 --- a/projects/mingw-w64/build +++ b/projects/mingw-w64/build @@ -29,7 +29,7 @@ sed 's/msvcrt/msvcr100/' -i $distdir/msvcr100.spec sed 's/msvcrt/msvcr100/' -i gcc-[% c("var/gcc_version") %]/gcc/config/i386/t-mingw-w32 # LDFLAGS_FOR_TARGET does not work for some reason. Thus, we take # CFLAGS_FOR_TARGET. -export CFLAGS_FOR_TARGET="-specs=$distdir/msvcr100.spec -Wl,--nxcompat -Wl,--dynamicbase -Wl,--no-insert-timestamp" +export CFLAGS_FOR_TARGET="-specs=$distdir/msvcr100.spec -Wl,--nxcompat -Wl,--dynamicbase" gcc-[% c("var/gcc_version") %]/configure --prefix=$distdir --target=[% c("arch") %]-w64-mingw32 --disable-multilib --enable-languages=c,c++ make -j[% c("buildconf/num_procs") %] all-gcc make install-gcc @@ -59,17 +59,17 @@ mkdir -p $distdir/helpers cat > $distdir/helpers/[% c("arch") %]-w64-mingw32-g++ << 'EOF' #!/bin/sh -/var/tmp/dist/mingw-w64/bin/[% c("arch") %]-w64-mingw32-g++ -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -Wl,--no-insert-timestamp -fstack-protector --param ssp-buffer-size=4 -fno-strict-overflow "$@" +/var/tmp/dist/mingw-w64/bin/[% c("arch") %]-w64-mingw32-g++ -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -fstack-protector --param ssp-buffer-size=4 -fno-strict-overflow "$@" EOF cat > $distdir/helpers/[% c("arch") %]-w64-mingw32-gcc << 'EOF' #!/bin/sh -/var/tmp/dist/mingw-w64/bin/[% c("arch") %]-w64-mingw32-gcc -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -Wl,--no-insert-timestamp -fstack-protector --param ssp-buffer-size=4 -fno-strict-overflow "$@" +/var/tmp/dist/mingw-w64/bin/[% c("arch") %]-w64-mingw32-gcc -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -fstack-protector --param ssp-buffer-size=4 -fno-strict-overflow "$@" EOF cat > $distdir/helpers/[% c("arch") %]-w64-mingw32-ld << 'EOF' #!/bin/sh -/var/tmp/dist/mingw-w64/bin/[% c("arch") %]-w64-mingw32-ld --dynamicbase --nxcompat --enable-reloc-section --no-insert-timestamp -lssp -L$gcclibs "$@" +/var/tmp/dist/mingw-w64/bin/[% c("arch") %]-w64-mingw32-ld --dynamicbase --nxcompat --enable-reloc-section -lssp -L$gcclibs "$@" EOF chmod +x $distdir/helpers/* diff --git a/projects/nsis/build b/projects/nsis/build index 7a66884..af19dd7 100755 --- a/projects/nsis/build +++ b/projects/nsis/build @@ -1,35 +1,8 @@ #!/bin/bash [% c("var/set_default_env") -%] [% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] -# Some of the hardening flags are causing the build to fail, so we -# overwrite the helpers with only the flags required to make the build -# reproducible. -helpersdir=/var/tmp/dist/mingw-w64/helpers -cat > $helpersdir/[% c("arch") %]-w64-mingw32-g++ << 'EOF' -#!/bin/sh -/var/tmp/dist/mingw-w64/bin/[% c("arch") %]-w64-mingw32-g++ -Wl,--no-insert-timestamp "$@" -EOF - -cat > $helpersdir/[% c("arch") %]-w64-mingw32-gcc << 'EOF' -#!/bin/sh -/var/tmp/dist/mingw-w64/bin/[% c("arch") %]-w64-mingw32-gcc -Wl,--no-insert-timestamp "$@" -EOF - -cat > $helpersdir/[% c("arch") %]-w64-mingw32-ld << 'EOF' -#!/bin/sh -/var/tmp/dist/mingw-w64/bin/[% c("arch") %]-w64-mingw32-ld --no-insert-timestamp "$@" -EOF -# the nsis build system expects all toolchain binaries to be in the same -# directory, so we create wrappers for the other commands in the same -# directory. -for util in ar ranlib windres -do - cat > $helpersdir/[% c("arch") %]-w64-mingw32-$util <<EOF -#!/bin/sh -/var/tmp/dist/mingw-w64/bin/[% c("arch") %]-w64-mingw32-$util "\$@" -EOF - chmod +x $helpersdir/[% c("arch") %]-w64-mingw32-$util -done +# remove hardening wrappers +rm -Rf /var/tmp/dist/mingw-w64/helpers mkdir -p /var/tmp/dist mkdir -p /var/tmp/build tar -C /var/tmp/build -xf nsis-[% c('version') %].tar.bz2 diff --git a/projects/openssl/config b/projects/openssl/config index fc8e1ff..378ee53 100644 --- a/projects/openssl/config +++ b/projects/openssl/config @@ -15,7 +15,7 @@ targets: configure_opts: -shared linux-generic32 windows: var: - configure_opts: '-shared --cross-compile-prefix=[% c("arch") %]-w64-mingw32- mingw[% IF c("var/windows-x86_64") %]64[% END %] "-fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -Wl,--no-insert-timestamp -lssp -L$gcclibs"' + configure_opts: '-shared --cross-compile-prefix=[% c("arch") %]-w64-mingw32- mingw[% IF c("var/windows-x86_64") %]64[% END %] "-fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$gcclibs"' osx-x86_64: var: configure_opts: --cross-compile-prefix=x86_64-apple-darwin10- darwin64-x86_64-cc enable-ec_nistp_64_gcc_128 diff --git a/projects/selfrando/config b/projects/selfrando/config index 07195f7..f8afa5d 100644 --- a/projects/selfrando/config +++ b/projects/selfrando/config @@ -1,6 +1,6 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -version: 0.4.1 +version: 0.3.3 git_hash: 'tb-v[% c("version") %]' git_url: https://github.com/immunant/selfrando.git gpg_keyring: selfrando.gpg diff --git a/projects/zlib/build b/projects/zlib/build index ef26882..4cb384b 100644 --- a/projects/zlib/build +++ b/projects/zlib/build @@ -7,8 +7,8 @@ tar -C /var/tmp/build -xf [% project %]-[% c('version') %].tar.gz cd /var/tmp/build/[% project %]-[% c('version') %] export CFLAGS="[% c("var/CFLAGS") %]" export LDFLAGS="[% c("var/LDFLAGS") %]" -make BINARY_PATH=$distdir/lib INCLUDE_PATH=$distdir/include LIBRARY_PATH=$distdir/lib -f win32/Makefile.gcc PREFIX=[% c("arch") %]-w64-mingw32- -j4 SHARED_MODE=1 LOC="-fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -Wl,--no-insert-timestamp -lssp -L$gcclibs" -make BINARY_PATH=$distdir/lib INCLUDE_PATH=$distdir/include LIBRARY_PATH=$distdir/lib -f win32/Makefile.gcc PREFIX=[% c("arch") %]-w64-mingw32- -j4 SHARED_MODE=1 LOC="-fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -Wl,--no-insert-timestamp -lssp -L$gcclibs" install +make BINARY_PATH=$distdir/lib INCLUDE_PATH=$distdir/include LIBRARY_PATH=$distdir/lib -f win32/Makefile.gcc PREFIX=[% c("arch") %]-w64-mingw32- -j4 SHARED_MODE=1 LOC="-fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$gcclibs" +make BINARY_PATH=$distdir/lib INCLUDE_PATH=$distdir/include LIBRARY_PATH=$distdir/lib -f win32/Makefile.gcc PREFIX=[% c("arch") %]-w64-mingw32- -j4 SHARED_MODE=1 LOC="-fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$gcclibs" install cd /var/tmp/dist [% c('tar', { diff --git a/rbm.conf b/rbm.conf index b2ba2ab..13005b7 100644 --- a/rbm.conf +++ b/rbm.conf @@ -218,7 +218,7 @@ targets: suite: jessie configure_opt: '--host=[% c("arch") %]-w64-mingw32 CFLAGS="[% c("var/CFLAGS") %]" LDFLAGS="[% c("var/LDFLAGS") %]"' CFLAGS: '[% c("var/flag_mwindows") %] -fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security' - LDFLAGS: '[% c("var/flag_mwindows") %] -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -Wl,--no-insert-timestamp -lssp -L$gcclibs' + LDFLAGS: '[% c("var/flag_mwindows") %] -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$gcclibs' flag_mwindows: '-mwindows' compiler: mingw-w64 deps:

1 0

[tor-browser-build/master] build2 for 8.0a5
by gk＠torproject.org 25 Mar '18

25 Mar '18

commit 4b7e4683e8f99fe7e023d682da92b0575ec0187f Author: Georg Koppen <gk(a)torproject.org> Date: Sun Mar 25 09:57:01 2018 +0000 build2 for 8.0a5 --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 5 ----- rbm.conf | 2 +- 2 files changed, 1 insertion(+), 6 deletions(-) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 2d1c9ca..34b78e4 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -9,11 +9,6 @@ Tor Browser 8.0a5 -- March 27 2018 * Linux * Update Snowflake * Bug 21312+25579+25449: Fix crashes and memory/file descriptor leaks in go-webrtc - * Build System - * Windows - * Bug 16472: Update Binutils to 2.29.1 - * Linux - * Bug 16472: Update Binutils to 2.29.1 Tor Browser 8.0a4 -- March 17 2018 * All platforms diff --git a/rbm.conf b/rbm.conf index 13005b7..2654371 100644 --- a/rbm.conf +++ b/rbm.conf @@ -16,7 +16,7 @@ buildconf: var: torbrowser_version: '8.0a5' - torbrowser_build: 'build1' + torbrowser_build: 'build2' torbrowser_incremental_from: - 8.0a3 - 8.0a4

1 0

[tor-browser-build/master] Release preparations for Tor Browser 8.0a5
by gk＠torproject.org 24 Mar '18

24 Mar '18

commit 1b6afb64e5d4409f3cec6bf538dd1e6bec164c86 Author: Georg Koppen <gk(a)torproject.org> Date: Sat Mar 24 12:58:05 2018 +0000 Release preparations for Tor Browser 8.0a5 --- projects/firefox-langpacks/config | 2 +- projects/firefox/config | 2 +- projects/https-everywhere/config | 2 +- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 21 +++++++++++++++++++++ rbm.conf | 3 ++- 5 files changed, 26 insertions(+), 4 deletions(-) diff --git a/projects/firefox-langpacks/config b/projects/firefox-langpacks/config index 4e42939..04cd7dd 100644 --- a/projects/firefox-langpacks/config +++ b/projects/firefox-langpacks/config @@ -4,7 +4,7 @@ filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/buil var: ff_version: '[% pc("firefox", "var/firefox_version") %]' - ff_build: build1 + ff_build: build2 ff_arch: linux-i686 input_filename: 'dl-langpack-[% c("var/ff_arch") %]-[% c("version") %]' diff --git a/projects/firefox/config b/projects/firefox/config index fff92d4..8412c2c 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -7,7 +7,7 @@ git_url: https://git.torproject.org/tor-browser.git gpg_keyring: torbutton.gpg var: - firefox_platform_version: 52.7.2 + firefox_platform_version: 52.7.3 firefox_version: '[% c("var/firefox_platform_version") %]esr' torbrowser_branch: 8.0 torbrowser_update_channel: alpha diff --git a/projects/https-everywhere/config b/projects/https-everywhere/config index 43be728..38eb2be 100644 --- a/projects/https-everywhere/config +++ b/projects/https-everywhere/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 2018.2.26 +version: 2018.3.13 git_url: https://git.torproject.org/https-everywhere.git git_hash: '[% c("version") %]' git_submodule: 1 diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 8f0f653..2d1c9ca 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,7 +1,28 @@ +Tor Browser 8.0a5 -- March 27 2018 + * All platforms + * Update Firefox to 52.7.3esr + * Update HTTPS Everywhere to 2018.3.13 + * Bug 23439: Exempt .onion domains from mixed content warnings + * OS X + * Update Snowflake + * Bug 21312+25579+25449: Fix crashes and memory/file descriptor leaks in go-webrtc + * Linux + * Update Snowflake + * Bug 21312+25579+25449: Fix crashes and memory/file descriptor leaks in go-webrtc + * Build System + * Windows + * Bug 16472: Update Binutils to 2.29.1 + * Linux + * Bug 16472: Update Binutils to 2.29.1 + Tor Browser 8.0a4 -- March 17 2018 * All platforms * Update Firefox to 52.7.2esr +Tor Browser 7.5.2 -- March 17 2018 + * All platforms + * Update Firefox to 52.7.2esr + Tor Browser 8.0a3 -- March 13 2018 * All platforms * Update Firefox to 52.7.0esr diff --git a/rbm.conf b/rbm.conf index 4d633eb..b2ba2ab 100644 --- a/rbm.conf +++ b/rbm.conf @@ -15,10 +15,11 @@ buildconf: git_signtag_opt: '-s' var: - torbrowser_version: '8.0a4' + torbrowser_version: '8.0a5' torbrowser_build: 'build1' torbrowser_incremental_from: - 8.0a3 + - 8.0a4 project_name: tor-browser multi_lingual: 0 build_mar: 1

1 0

[tor-browser-build/maint-7.5] Bug 25339: update https-everywhere to 2018.2.26
by gk＠torproject.org 24 Mar '18

24 Mar '18

commit a2510d82d0da7e2f4465c9954beef320e33c737c Author: Nicolas Vigier <boklm(a)torproject.org> Date: Tue Feb 27 13:03:25 2018 +0100 Bug 25339: update https-everywhere to 2018.2.26 This new https-everywhere version requires python 3.6, so we are now building it in a buster container instead of wheezy. --- projects/debootstrap-image/config | 5 +++++ projects/https-everywhere/config | 8 ++++---- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/projects/debootstrap-image/config b/projects/debootstrap-image/config index 2c470be..fedf6d8 100644 --- a/projects/debootstrap-image/config +++ b/projects/debootstrap-image/config @@ -39,6 +39,11 @@ targets: container: suite: jessie arch: i386 + buster-amd64: + var: + container: + suite: buster + arch: amd64 precise-amd64: var: container: diff --git a/projects/https-everywhere/config b/projects/https-everywhere/config index ba3f3ca..43be728 100644 --- a/projects/https-everywhere/config +++ b/projects/https-everywhere/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 2018.1.11 +version: 2018.2.26 git_url: https://git.torproject.org/https-everywhere.git git_hash: '[% c("version") %]' git_submodule: 1 @@ -17,12 +17,12 @@ var: # inputs. This allows us to save a little time and disk space. container: use_container: 1 - suite: wheezy + suite: buster arch: amd64 deps: - git - - python - - python-lxml + - python3 + - python3-lxml - libxslt1.1 - libxml2-utils - sqlite3

1 0

[tor-browser-build/maint-7.5] Release preparations for 7.5.3
by gk＠torproject.org 24 Mar '18

24 Mar '18

commit c90d731e4738d5a257b4512ffee4086e98dd6298 Author: Georg Koppen <gk(a)torproject.org> Date: Sat Mar 24 08:59:35 2018 +0000 Release preparations for 7.5.3 Versions bump and Changelog update --- projects/firefox-langpacks/config | 2 +- projects/firefox/config | 2 +- projects/https-everywhere/config | 2 +- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 6 ++++++ rbm.conf | 3 ++- 5 files changed, 11 insertions(+), 4 deletions(-) diff --git a/projects/firefox-langpacks/config b/projects/firefox-langpacks/config index 4e42939..04cd7dd 100644 --- a/projects/firefox-langpacks/config +++ b/projects/firefox-langpacks/config @@ -4,7 +4,7 @@ filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/buil var: ff_version: '[% pc("firefox", "var/firefox_version") %]' - ff_build: build1 + ff_build: build2 ff_arch: linux-i686 input_filename: 'dl-langpack-[% c("var/ff_arch") %]-[% c("version") %]' diff --git a/projects/firefox/config b/projects/firefox/config index 5cd242b..22c7a0b 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -7,7 +7,7 @@ git_url: https://git.torproject.org/tor-browser.git gpg_keyring: torbutton.gpg var: - firefox_platform_version: 52.7.2 + firefox_platform_version: 52.7.3 firefox_version: '[% c("var/firefox_platform_version") %]esr' torbrowser_branch: 7.5 torbrowser_update_channel: alpha diff --git a/projects/https-everywhere/config b/projects/https-everywhere/config index 43be728..38eb2be 100644 --- a/projects/https-everywhere/config +++ b/projects/https-everywhere/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 2018.2.26 +version: 2018.3.13 git_url: https://git.torproject.org/https-everywhere.git git_hash: '[% c("version") %]' git_submodule: 1 diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 8a72c21..f9a328a 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,9 @@ +Tor Browser 7.5.3 -- March 26 2018 + * All platforms + * Update Firefox to 52.7.3esr + * Update HTTPS Everywhere to 2018.3.13 + * Bug 25339: Adapt build system for Python 3.6 based build procedure + Tor Browser 7.5.2 -- March 17 2018 * All platforms * Update Firefox to 52.7.2esr diff --git a/rbm.conf b/rbm.conf index 3bdc04a..1f7d0d4 100644 --- a/rbm.conf +++ b/rbm.conf @@ -15,10 +15,11 @@ buildconf: git_signtag_opt: '-s' var: - torbrowser_version: '7.5.2' + torbrowser_version: '7.5.3' torbrowser_build: 'build1' torbrowser_incremental_from: - 7.5.1 + - 7.5.2 project_name: tor-browser multi_lingual: 0 build_mar: 1

1 0

[tor-browser-build/master] Bug 25585: fetch dependencies using https instead of http when possible
by gk＠torproject.org 23 Mar '18

23 Mar '18

commit cd059a825f61d6ae514cfe823b3075819485f704 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Mar 22 11:54:44 2018 +0100 Bug 25585: fetch dependencies using https instead of http when possible --- projects/fonts/config | 2 +- projects/llvm/config | 12 ++++-------- projects/mingw-w64/config | 2 +- projects/nsis/config | 2 +- projects/winpython/config | 2 +- 5 files changed, 8 insertions(+), 12 deletions(-) diff --git a/projects/fonts/config b/projects/fonts/config index e939ad1..1547403 100644 --- a/projects/fonts/config +++ b/projects/fonts/config @@ -102,6 +102,6 @@ input_files: - URL: https://github.com/googlei18n/noto-cjk/raw/f36eda03dfa5582a6d49abbfb5c83d02… sha256sum: e6b82f7d3dab605c428161124ceb5e169cde93de632d800297b167cdd88e7baa enable: '[% c("var/linux") %]' - - URL: http://downloads.sourceforge.net/stixfonts/STIXv1.1.1-latex.zip + - URL: https://downloads.sourceforge.net/stixfonts/STIXv1.1.1-latex.zip sha256sum: e3b0f712e2644438eee2d0dcd2b10b2d54f1b972039de95b2f8e800bae1adbd8 enable: '[% c("var/linux") || c("var/osx") %]' diff --git a/projects/llvm/config b/projects/llvm/config index f0a803b..daa779d 100644 --- a/projects/llvm/config +++ b/projects/llvm/config @@ -10,26 +10,22 @@ input_files: - project: container-image - project: cmake name: cmake - - URL: 'http://releases.llvm.org/[% c("version") %]/llvm-[% c("version") %].src.tar.xz' - # no proper HTTPS + - URL: 'https://releases.llvm.org/[% c("version") %]/llvm-[% c("version") %].src.tar.xz' name: llvm sig_ext: sig file_gpg_id: 1 gpg_keyring: llvm.gpg - - URL: 'http://releases.llvm.org/[% c("version") %]/cfe-[% c("version") %].src.tar.xz' - # no proper HTTPS + - URL: 'https://releases.llvm.org/[% c("version") %]/cfe-[% c("version") %].src.tar.xz' name: cfe sig_ext: sig file_gpg_id: 1 gpg_keyring: llvm.gpg - - URL: 'http://releases.llvm.org/[% c("version") %]/libcxx-[% c("version") %].src.tar.xz' - # no proper HTTPS + - URL: 'https://releases.llvm.org/[% c("version") %]/libcxx-[% c("version") %].src.tar.xz' name: libcxx sig_ext: sig file_gpg_id: 1 gpg_keyring: llvm.gpg - - URL: 'http://releases.llvm.org/[% c("version") %]/libcxxabi-[% c("version") %].src.tar.xz' - # no proper HTTPS + - URL: 'https://releases.llvm.org/[% c("version") %]/libcxxabi-[% c("version") %].src.tar.xz' name: libcxxabi sig_ext: sig file_gpg_id: 1 diff --git a/projects/mingw-w64/config b/projects/mingw-w64/config index bb66167..73961e4 100644 --- a/projects/mingw-w64/config +++ b/projects/mingw-w64/config @@ -1,6 +1,6 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' -git_url: http://git.code.sf.net/p/mingw-w64/mingw-w64 +git_url: https://git.code.sf.net/p/mingw-w64/mingw-w64 git_hash: 1259532ff8f5a7ac625b2f28d499ee93a0c0841e version: '[% c("abbrev") %]' var: diff --git a/projects/nsis/config b/projects/nsis/config index 2812a22..7db7b60 100644 --- a/projects/nsis/config +++ b/projects/nsis/config @@ -15,7 +15,7 @@ var: input_files: - project: container-image - filename: 'nsis-[% c("version") %].tar.bz2' - URL: 'http://downloads.sourceforge.net/nsis/nsis-[% c("version") %]-src.tar.bz2' + URL: 'https://downloads.sourceforge.net/nsis/nsis-[% c("version") %]-src.tar.bz2' sha256sum: 43d4c9209847e35eb6e2c7cd5a7586e1445374c056c2c7899e40a080e17a1be7 - name: debian URL: 'http://http.debian.net/debian/pool/main/n/nsis/nsis_2.51-1.debian.tar.xz' diff --git a/projects/winpython/config b/projects/winpython/config index 9f884c0..124b3b6 100644 --- a/projects/winpython/config +++ b/projects/winpython/config @@ -47,7 +47,7 @@ input_files: gpg_keyring: winpython.gpg - URL: https://pypi.python.org/packages/source/s/setuptools/setuptools-1.4.tar.gz sha256sum: 75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 - - URL: http://downloads.sourceforge.net/py2exe/0.6.9/py2exe-0.6.9.win32-py2.7.exe + - URL: https://downloads.sourceforge.net/py2exe/0.6.9/py2exe-0.6.9.win32-py2.7.exe sha256sum: 610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]'

1 0

[tor-browser-build/master] Bug 25579: Bump snowflake/go-webrtc again for trac 21312.
by gk＠torproject.org 22 Mar '18

22 Mar '18

commit 0679737202b5a7343314e0ef7f3aa1fefa5cbd6d Author: David Fifield <david(a)bamsoftware.com> Date: Tue Mar 20 19:33:25 2018 -0700 Bug 25579: Bump snowflake/go-webrtc again for trac 21312. Commit 42720c512520ecef5437d23e405d8ce011764661 fixed a memory/file descriptor leak in snowflake-client. Further work on ticket #21312 uncovered crashes in the snowflake WebRTC server and proxy (comments 29 and following). While we didn't observe the same kind of crashes in snowflake-client, this revision applies the same synchronization around WebRTC channel destruction as in the server and proxy. --- projects/go-webrtc/config | 2 +- projects/snowflake/config | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/projects/go-webrtc/config b/projects/go-webrtc/config index bcfaffa..65be36f 100644 --- a/projects/go-webrtc/config +++ b/projects/go-webrtc/config @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' git_url: https://github.com/keroserene/go-webrtc.git -git_hash: 62dbae8e3b7e7db076e079a7437166966c747033 +git_hash: 90ac15ae07cc6e820cd922a239dd892598986622 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' build: '[% c("projects/go/var/build_go_lib") %]' diff --git a/projects/snowflake/config b/projects/snowflake/config index d28f8b2..8e3296c 100644 --- a/projects/snowflake/config +++ b/projects/snowflake/config @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' git_url: https://git.torproject.org/pluggable-transports/snowflake.git -git_hash: d0686b1c8df037413f32bef891ef90638b75a080 +git_hash: 1114acbcb4acb82174b293983ced8afcaf9e2a93 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' var:

1 0

[tor-browser/tor-browser-52.7.2esr-8.0-1] Bug 23439: Exempt .onion domains from mixed content warnings
by gk＠torproject.org 21 Mar '18

21 Mar '18

commit 680dece41e71d30afd4616aa19001c60e55dc852 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue Mar 20 15:02:32 2018 -0400 Bug 23439: Exempt .onion domains from mixed content warnings --- dom/html/HTMLFormElement.cpp | 5 +++++ dom/security/nsContentSecurityManager.cpp | 7 +++--- dom/security/nsMixedContentBlocker.cpp | 37 ++++++++++++++++++++++++++++--- dom/security/nsMixedContentBlocker.h | 2 ++ 4 files changed, 44 insertions(+), 7 deletions(-) diff --git a/dom/html/HTMLFormElement.cpp b/dom/html/HTMLFormElement.cpp index 5164391f8d2b..71b6248d5b06 100644 --- a/dom/html/HTMLFormElement.cpp +++ b/dom/html/HTMLFormElement.cpp @@ -14,6 +14,7 @@ #include "mozilla/dom/AutocompleteErrorEvent.h" #include "mozilla/dom/nsCSPUtils.h" #include "mozilla/dom/nsCSPContext.h" +#include "mozilla/dom/nsMixedContentBlocker.h" #include "mozilla/dom/HTMLFormControlsCollection.h" #include "mozilla/dom/HTMLFormElementBinding.h" #include "mozilla/Move.h" @@ -907,6 +908,10 @@ HTMLFormElement::DoSecureToInsecureSubmitCheck(nsIURI* aActionURL, return NS_OK; } + if (nsMixedContentBlocker::IsPotentiallyTrustworthyOnion(aActionURL)) { + return NS_OK; + } + nsCOMPtr<nsPIDOMWindowOuter> window = OwnerDoc()->GetWindow(); if (!window) { return NS_ERROR_FAILURE; diff --git a/dom/security/nsContentSecurityManager.cpp b/dom/security/nsContentSecurityManager.cpp index c95226b56e91..aa4f735a5c4f 100644 --- a/dom/security/nsContentSecurityManager.cpp +++ b/dom/security/nsContentSecurityManager.cpp @@ -10,6 +10,7 @@ #include "nsMixedContentBlocker.h" #include "mozilla/dom/Element.h" +#include "mozilla/dom/nsMixedContentBlocker.h" NS_IMPL_ISUPPORTS(nsContentSecurityManager, nsIContentSecurityManager, @@ -689,11 +690,9 @@ nsContentSecurityManager::IsOriginPotentiallyTrustworthy(nsIPrincipal* aPrincipa } } } - // Maybe we have a .onion URL. Treat it as whitelisted as well when + // Maybe we have a .onion URL. Treat it as whitelisted as well if // `dom.securecontext.whitelist_onions` is `true`. - bool whitelistOnions = - Preferences::GetBool("dom.securecontext.whitelist_onions", false); - if (whitelistOnions && StringEndsWith(host, NS_LITERAL_CSTRING(".onion"))) { + if (nsMixedContentBlocker::IsPotentiallyTrustworthyOnion(uri)) { *aIsTrustWorthy = true; return NS_OK; } diff --git a/dom/security/nsMixedContentBlocker.cpp b/dom/security/nsMixedContentBlocker.cpp index a9aca5333491..98e262f0bcf4 100644 --- a/dom/security/nsMixedContentBlocker.cpp +++ b/dom/security/nsMixedContentBlocker.cpp @@ -394,6 +394,29 @@ nsMixedContentBlocker::ShouldLoad(uint32_t aContentType, return rv; } +/* Maybe we have a .onion URL. Treat it as whitelisted as well if + * `dom.securecontext.whitelist_onions` is `true`. + */ +bool +nsMixedContentBlocker::IsPotentiallyTrustworthyOnion(nsIURI* aURL) { + static bool sInited = false; + static bool sWhiteListOnions = false; + if (!sInited) { + Preferences::AddBoolVarCache(&sWhiteListOnions, + "dom.securecontext.whitelist_onions"); + sInited = true; + } + if (!sWhiteListOnions) { + return false; + } + + nsAutoCString host; + nsresult rv = aURL->GetHost(host); + NS_ENSURE_SUCCESS(rv, false); + return StringEndsWith(host, NS_LITERAL_CSTRING(".onion")); +} + + /* Static version of ShouldLoad() that contains all the Mixed Content Blocker * logic. Called from non-static ShouldLoad(). */ @@ -696,6 +719,17 @@ nsMixedContentBlocker::ShouldLoad(bool aHadInsecureImageRedirect, return NS_OK; } + bool isHttpScheme = false; + rv = innerContentLocation->SchemeIs("http", &isHttpScheme); + NS_ENSURE_SUCCESS(rv, rv); + + // .onion URLs are encrypted and authenticated. Don't treat them as mixed + // content if potentially trustworthy (i.e. whitelisted). + if (isHttpScheme && IsPotentiallyTrustworthyOnion(innerContentLocation)) { + *aDecision = ACCEPT; + return NS_OK; + } + // The page might have set the CSP directive 'upgrade-insecure-requests'. In such // a case allow the http: load to succeed with the promise that the channel will // get upgraded to https before fetching any data from the netwerk. @@ -707,9 +741,6 @@ nsMixedContentBlocker::ShouldLoad(bool aHadInsecureImageRedirect, // we only have to check against http: here. Skip mixed content blocking if the // subresource load uses http: and the CSP directive 'upgrade-insecure-requests' // is present on the page. - bool isHttpScheme = false; - rv = innerContentLocation->SchemeIs("http", &isHttpScheme); - NS_ENSURE_SUCCESS(rv, rv); nsIDocument* document = docShell->GetDocument(); MOZ_ASSERT(document, "Expected a document"); if (isHttpScheme && document->GetUpgradeInsecureRequests(isPreload)) { diff --git a/dom/security/nsMixedContentBlocker.h b/dom/security/nsMixedContentBlocker.h index 539c3ebbb7f0..24fbac171dac 100644 --- a/dom/security/nsMixedContentBlocker.h +++ b/dom/security/nsMixedContentBlocker.h @@ -43,6 +43,8 @@ public: nsMixedContentBlocker(); + static bool IsPotentiallyTrustworthyOnion(nsIURI* aURL); + /* Static version of ShouldLoad() that contains all the Mixed Content Blocker * logic. Called from non-static ShouldLoad(). * Called directly from imageLib when an insecure redirect exists in a cached

1 0