November 2019 - tbb-commits - lists.torproject.org

[tor-browser-build/master] Bug 32365: Package multi-locale apk in a new way
by gk＠torproject.org 27 Nov '19

27 Nov '19

commit 4f97d497ea11a8325cafeaec6ac51fb10ef56de1 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Fri Nov 8 01:47:32 2019 +0000 Bug 32365: Package multi-locale apk in a new way --- projects/firefox/build | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/projects/firefox/build b/projects/firefox/build index 53d425b..5179634 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -115,7 +115,11 @@ rm -f js/src/configure cp /var/tmp/dist/tba-translation/[% … [View More]

1 0

[tor-browser-build/maint-9.0] Changelog update and 9.0.2 version bump
by gk＠torproject.org 27 Nov '19

27 Nov '19

commit 0e5a9486bd726eaf442fa8e5d21a8e38e22f32f0 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Nov 27 08:15:18 2019 +0000 Changelog update and 9.0.2 version bump --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 1 + rbm.conf | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index dd67e02..… [View More]

1 0

[tor-browser/tor-browser-68.3.0esr-9.0-1] squash! Bug 4234: Use the Firefox Update Process for Tor Browser.
by gk＠torproject.org 27 Nov '19

27 Nov '19

commit acaf32506a39f94751853ff55869855ac3563a54 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue Nov 26 15:12:59 2019 -0500 squash! Bug 4234: Use the Firefox Update Process for Tor Browser. Also fix 32616: Disable GetSecureOutputDirectoryPath() functionality. --- toolkit/mozapps/update/common/updatehelper.cpp | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/toolkit/mozapps/update/common/updatehelper.cpp b/toolkit/mozapps/update/common/updatehelper.cpp … [View More]

1 0

[tor-browser-build/master] Bug 25101: Add support for generating nightly incremental mars
by gk＠torproject.org 26 Nov '19

26 Nov '19

commit d4460a92659808f8d29547197e23cb6defcf2f35 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Nov 18 19:19:12 2019 +0100 Bug 25101: Add support for generating nightly incremental mars --- Makefile | 5 +++++ README.MAKEFILE | 14 +++++++++++++- projects/release/hash_incrementals | 6 +++++- projects/release/update_responses_config | 11 ++++++----- projects/release/update_responses_config.… [View More]yml | 5 +++-- rbm.conf | 19 +++++++++++++++++++ tools/update-responses/update_responses | 3 ++- 7 files changed, 53 insertions(+), 10 deletions(-) diff --git a/Makefile b/Makefile index 6edb7e3..6d82f93 100644 --- a/Makefile +++ b/Makefile @@ -164,6 +164,11 @@ incrementals-alpha: submodule-update tools/update-responses/gen_incrementals alpha $(rbm) build release --step hash_incrementals --target alpha +incrementals-nightly: submodule-update + $(rbm) build release --step update_responses_config --target nightly + NO_CODESIGNATURE=1 tools/update-responses/gen_incrementals nightly + $(rbm) build release --step hash_incrementals --target nightly + update_responses-release: submodule-update $(rbm) build release --step update_responses_config --target release --target signed $(rbm) build release --step create_update_responses_tar --target release --target signed diff --git a/README.MAKEFILE b/README.MAKEFILE index e07224e..62b54df 100644 --- a/README.MAKEFILE +++ b/README.MAKEFILE @@ -82,7 +82,19 @@ build number defined as var/torbrowser_version and var/torbrowser_build. incrementals-{release,alpha} ---------------------------- Create incremental mar files for an unsigned build in the release or -alpha channel. +alpha channel. The list of versions we create incrementals from is +defined as var/torbrowser_incremental_from in rbm.conf. + +incrementals-nightly +-------------------- +Create incremental mar files for the current nightly build. The number +of previous versions we should generate incremental mars from is defined +as var/max_torbrowser_incremental_from in rbm.conf. + +If you want to create incremental mars for a version that is not the +current one, you can define the environment variable +TORBROWSER_NIGHTLY_VERSION to the version you want to generate +incremental mars for. dmg2mar-{release,alpha) ----------------------- diff --git a/projects/release/hash_incrementals b/projects/release/hash_incrementals index 9cf1b27..ba95ac7 100644 --- a/projects/release/hash_incrementals +++ b/projects/release/hash_incrementals @@ -1,4 +1,8 @@ #!/bin/bash [% c("var/set_default_env") -%] -cd [% shell_quote(path(dest_dir)) %]/[% c("var/signed_status") %]/[% c("version") %]-[% c("var/torbrowser_build") %] +[% IF c("var/nightly") -%] + cd [% shell_quote(path(dest_dir)) %]/[% c("version") %] +[% ELSE -%] + cd [% shell_quote(path(dest_dir)) %]/[% c("var/signed_status") %]/[% c("version") %]-[% c("var/torbrowser_build") %] +[% END -%] sha256sum `ls -1 | grep '\.incremental\.mar$' | sort` > sha256sums-[% c("var/signed_status") %]-build.incrementals.txt diff --git a/projects/release/update_responses_config b/projects/release/update_responses_config index 4ff470d..ce1d846 100644 --- a/projects/release/update_responses_config +++ b/projects/release/update_responses_config @@ -4,8 +4,9 @@ cat > [% shell_quote(c("basedir")) %]/tools/update-responses/config.yml << 'EOF' [% INCLUDE update_responses_config.yml -%] EOF -# Update / create symlink $torbrowser_version -> $torbrowser_version-buildN -versiondir=[% shell_quote(path(dest_dir)) _ '/' _ c("var/signed_status") _ '/' _ c("version") %] -test -L "$versiondir" && rm -f "$versiondir" -test -d "$versiondir" || ln -s [% shell_quote(c("version")) %]-[% shell_quote(c("var/torbrowser_build")) %] "$versiondir" - +[% IF ! c("var/nightly") -%] + # Update / create symlink $torbrowser_version -> $torbrowser_version-buildN + versiondir=[% shell_quote(path(dest_dir)) _ '/' _ c("var/signed_status") _ '/' _ c("version") %] + test -L "$versiondir" && rm -f "$versiondir" + test -d "$versiondir" || ln -s [% shell_quote(c("version")) %]-[% shell_quote(c("var/torbrowser_build")) %] "$versiondir" +[% END -%] diff --git a/projects/release/update_responses_config.yml b/projects/release/update_responses_config.yml index f2542d6..85a1d43 100644 --- a/projects/release/update_responses_config.yml +++ b/projects/release/update_responses_config.yml @@ -5,7 +5,7 @@ appname_bundle_osx: TorBrowser appname_bundle_linux: tor-browser appname_bundle_win32: torbrowser-install appname_bundle_win64: torbrowser-install-win64 -releases_dir: [% path(c('output_dir')) %]/signed +releases_dir: [% path(c('output_dir')) %][% IF ! c("var/nightly") %]/signed[% END %] download: archive_url: https://archive.torproject.org/tor-package-archive/torbrowser gpg_keyring: ../../keyring/torbrowser.gpg @@ -31,7 +31,8 @@ versions: platformVersion: [% pc('firefox', 'var/firefox_platform_version') %] detailsURL: https://blog.torproject.org/new-release-tor-browser-[% c("var/torbrowser_version") FILTER remove('\.') %] incremental_from: -[% FOREACH v IN c("var/torbrowser_incremental_from") -%] +[% SET incr_from = c("var/nightly") ? c("var_p/nightly_torbrowser_incremental_from") : c("var/torbrowser_incremental_from"); + FOREACH v IN incr_from -%] - [% v %] [% END -%] migrate_archs: diff --git a/rbm.conf b/rbm.conf index 15d8ef1..cb5e972 100644 --- a/rbm.conf +++ b/rbm.conf @@ -154,6 +154,7 @@ targets: - es-ES - fr - ru + max_torbrowser_incremental_from: 2 torbrowser-testbuild: - testbuild @@ -521,5 +522,23 @@ ENV: $version = sprintf("tbb-nightly.%u.%02u.%02u", $year + 1900, $mon + 1, $day); return $version; }, + nightly_torbrowser_incremental_from => sub { + my ($project, $options) = @_; + my $nightly_dir = project_config($project, 'basedir', $options) . '/nightly'; + my $current_version = project_config($project, 'var/torbrowser_version', $options); + use Path::Tiny; + return [] unless -d $nightly_dir; + my @dirs = sort map { $_->basename } path($nightly_dir)->children(qr/^tbb-nightly\./); + my $nb_incr = project_config($project, ['var', 'max_torbrowser_incremental_from'], $options); + my @res; + while ($nb_incr > 0) { + my $dir = pop @dirs; + last unless $dir; + next if $dir eq $current_version; + $nb_incr--; + push @res, $dir; + } + return [@res]; + }, }, ) diff --git a/tools/update-responses/update_responses b/tools/update-responses/update_responses index 59cd2ef..3dfd05d 100755 --- a/tools/update-responses/update_responses +++ b/tools/update-responses/update_responses @@ -220,7 +220,8 @@ sub create_incremental_mar { extract_mar(mar_filename($config, $appname, $new_version, $os, $lang), "$tmpdir/B", $mar_c_new); # bug 26054: make sure previous macOS version is code signed - if (($os eq 'osx64') && ! -f "$tmpdir/A/Contents/_CodeSignature/CodeResources") { + if (!$ENV{NO_CODESIGNATURE} && ($os eq 'osx64') + && ! -f "$tmpdir/A/Contents/_CodeSignature/CodeResources") { exit_error "Missing code signature in $from_version while creating $mar_file"; } if ($ENV{CHECK_CODESIGNATURE_EXISTS}) { [View Less]

1 0

[tor-browser-build/master] Bug 32556: Keep track of entitlement files and add signing script templates
by gk＠torproject.org 26 Nov '19

26 Nov '19

commit f1cc6bc762c337d9cbc7187d2958dcb54007f9ff Author: Georg Koppen <gk(a)torproject.org> Date: Tue Nov 26 18:16:10 2019 +0000 Bug 32556: Keep track of entitlement files and add signing script templates --- tools/signing/README | 7 ++++ tools/signing/alpha.entitlements.xml | 53 ++++++++++++++++++++++++++++++ tools/signing/authenticode-signing.sh | 48 +++++++++++++++++++++++++++ tools/signing/authenticode-timestamping.sh | 46 +++++++++++++++++++… [View More]+++++++ tools/signing/gatekeeper-bundling.sh | 49 +++++++++++++++++++++++++++ tools/signing/gatekeeper-signing.sh | 51 ++++++++++++++++++++++++++++ tools/signing/notarization.sh | 50 ++++++++++++++++++++++++++++ tools/signing/stable.entitlements.xml | 53 ++++++++++++++++++++++++++++++ tools/signing/stapler.sh | 47 ++++++++++++++++++++++++++ tools/signing/tbb-signing.sh | 38 +++++++++++++++++++++ 10 files changed, 442 insertions(+) diff --git a/tools/signing/README b/tools/signing/README new file mode 100644 index 0000000..e18a761 --- /dev/null +++ b/tools/signing/README @@ -0,0 +1,7 @@ +The files in this directory are a large part of what we use when signing +releases. The scripts are meant to be templates, though, at the moment +omitting specific paths and credential information. + +Additionally, when starting to used them for an own signing setup don't forget +to adapt the locale list if needed. The entitlement files, however, are kept +up-to-date. diff --git a/tools/signing/alpha.entitlements.xml b/tools/signing/alpha.entitlements.xml new file mode 100644 index 0000000..3097c05 --- /dev/null +++ b/tools/signing/alpha.entitlements.xml @@ -0,0 +1,53 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> + +<plist version="1.0"> + <dict> +  + <key>com.apple.security.cs.allow-jit</key><false/> + +  + <key>com.apple.security.cs.allow-unsigned-executable-memory</key><true/> + +  + <key>com.apple.security.cs.disable-executable-page-protection</key><false/> + +  + <key>com.apple.security.cs.disable-library-validation</key><true/> + +  + <key>com.apple.security.cs.allow-dyld-environment-variables</key><true/> + +  + <key>com.apple.security.get-task-allow</key><false/> + +  + <key>com.apple.security.device.audio-input</key><true/> + +  + <key>com.apple.security.device.camera</key><true/> + +  + <key>com.apple.security.personal-information.location</key><true/> + +  + <key>com.apple.security.automation.apple-events</key><true/> + +  + <key>com.apple.security.smartcard</key><true/> + </dict> +</plist> diff --git a/tools/signing/authenticode-signing.sh b/tools/signing/authenticode-signing.sh new file mode 100755 index 0000000..7e2e6f0 --- /dev/null +++ b/tools/signing/authenticode-signing.sh @@ -0,0 +1,48 @@ +#!/bin/bash + +# Copyright (c) 2019, The Tor Project, Inc. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are +# met: + +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following disclaimer +# in the documentation and/or other materials provided with the +# distribution. +# +# * Neither the names of the copyright owners nor the names of its +# contributors may be used to endorse or promote products derived from +# this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +set -e + +read -sp "Enter passphrase: " pass +echo +for i in `find . -name "*.exe" -print` +do + /path/to/patched/osslsigncode/build/osslsigncode \ + -pkcs11engine /usr/lib/engines/engine_pkcs11.so \ + -pkcs11module /usr/lib/libeTPkcs11.so \ + -pass $pass \ + -h sha256 \ + -certs $path/to/cert \ + -key $key \ + $i $i-signed +done +rename -f 's/-signed//' *-signed diff --git a/tools/signing/authenticode-timestamping.sh b/tools/signing/authenticode-timestamping.sh new file mode 100755 index 0000000..77973b7 --- /dev/null +++ b/tools/signing/authenticode-timestamping.sh @@ -0,0 +1,46 @@ +#!/bin/bash + +# Copyright (c) 2019, The Tor Project, Inc. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are +# met: + +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following disclaimer +# in the documentation and/or other materials provided with the +# distribution. +# +# * Neither the names of the copyright owners nor the names of its +# contributors may be used to endorse or promote products derived from +# this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +set -e + +COUNT=0 +for i in `find . -name "*.exe" -print` +do + /path/to/patched/osslsigncode add \ + -t http://timestamp.digicert.com \ + -p socks://127.0.0.1:9050 \ + $i $i-timestamped + COUNT=$((COUNT + 1)) + +done +echo "Timestamped $COUNT .exe files, now renaming" +rename -f 's/-timestamped//' *-timestamped diff --git a/tools/signing/gatekeeper-bundling.sh b/tools/signing/gatekeeper-bundling.sh new file mode 100755 index 0000000..742bc61 --- /dev/null +++ b/tools/signing/gatekeeper-bundling.sh @@ -0,0 +1,49 @@ +#!/bin/bash + +# Copyright (c) 2019, The Tor Project, Inc. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are +# met: + +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following disclaimer +# in the documentation and/or other materials provided with the +# distribution. +# +# * Neither the names of the copyright owners nor the names of its +# contributors may be used to endorse or promote products derived from +# this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +TORBROWSER_VERSION=$1 +if [ -z $TORBROWSER_VERSION ]; +then + echo "Please call this script with a Tor Browser version!" + exit 1 +fi +BUNDLE_LOCALES="ar ca cs da de el en-US es-AR es-ES fa fr ga-IE he hu id is it ja ka ko mk nb-NO nl pl pt-BR ro ru sv-SE tr vi zh-CN zh-TW" +builddir=/path/to/the/build/dir +mkdir $builddir/$TORBROWSER_VERSION-signed +for LANG in $BUNDLE_LOCALES +do + cd $builddir/dmg + unzip -q $builddir/$TORBROWSER_VERSION/tb-${TORBROWSER_VERSION}_$LANG-stapled.zip + cd .. + $builddir/ddmg.sh $builddir/$TORBROWSER_VERSION-signed/TorBrowser-${TORBROWSER_VERSION}-osx64_$LANG.dmg $builddir/dmg/ + rm -rf 'dmg/Tor Browser.app' +done diff --git a/tools/signing/gatekeeper-signing.sh b/tools/signing/gatekeeper-signing.sh new file mode 100755 index 0000000..3f31f82 --- /dev/null +++ b/tools/signing/gatekeeper-signing.sh @@ -0,0 +1,51 @@ +#!/bin/bash + +# Copyright (c) 2019, The Tor Project, Inc. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are +# met: + +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following disclaimer +# in the documentation and/or other materials provided with the +# distribution. +# +# * Neither the names of the copyright owners nor the names of its +# contributors may be used to endorse or promote products derived from +# this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +TORBROWSER_VERSION=$1 +if [ -z "$TORBROWSER_VERSION" ]; +then + echo "Please call this script with a Tor Browser version!" + exit 1 +fi +ENTITLEMENTS=/path/to/stable.entitlements.xml +BUNDLE_LOCALES="ar ca cs da de el en-US es-AR es-ES fa fr ga-IE he hu id is it ja ka ko mk nb-NO nl pl pt-BR ro ru sv-SE tr vi zh-CN zh-TW" +for LANG in $BUNDLE_LOCALES +do + hdiutil attach TorBrowser-${TORBROWSER_VERSION}-osx64_$LANG.dmg + cp -rf "/Volumes/Tor Browser/Tor Browser.app" "Tor Browser.app" + echo "Signing Tor Browser_$LANG.app" + codesign -vvv --deep -o runtime --entitlements="$ENTITLEMENTS" --timestamp -f -s "$ID" "Tor Browser.app/" + echo "Zipping up" + zip -qr tb-${TORBROWSER_VERSION}_${LANG}.zip "Tor Browser.app" + rm -rf "Tor Browser.app" + hdiutil detach "/Volumes/Tor Browser" +done diff --git a/tools/signing/notarization.sh b/tools/signing/notarization.sh new file mode 100755 index 0000000..eb29e74 --- /dev/null +++ b/tools/signing/notarization.sh @@ -0,0 +1,50 @@ +#!/bin/bash + +# Copyright (c) 2019, The Tor Project, Inc. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are +# met: + +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following disclaimer +# in the documentation and/or other materials provided with the +# distribution. +# +# * Neither the names of the copyright owners nor the names of its +# contributors may be used to endorse or promote products derived from +# this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +TORBROWSER_VERSION=$1 +if [ -z "$TORBROWSER_VERSION" ]; +then + echo "Please call this script with a Tor Browser version!" + exit 1 +fi +BUNDLE_LOCALES="ar ca cs da de el en-US es-AR es-ES fa fr ga-IE he hu id is it ja ka ko mk nb-NO nl pl pt-BR ro ru sv-SE tr vi zh-CN zh-TW" +for LANG in $BUNDLE_LOCALES +do + mkdir $LANG + cd $LANG + mv ../tb-${TORBROWSER_VERSION}_$LANG.zip . + unzip -q tb-${TORBROWSER_VERSION}_$LANG.zip + echo "Notarizing $LANG..." + xcrun altool --notarize-app -t osx -f tb-${TORBROWSER_VERSION}_$LANG.zip + --primary-bundle-id org.torproject.torbrowser -u USERNAME -p @env:PW --output-format xml + cd .. +done diff --git a/tools/signing/stable.entitlements.xml b/tools/signing/stable.entitlements.xml new file mode 100644 index 0000000..3097c05 --- /dev/null +++ b/tools/signing/stable.entitlements.xml @@ -0,0 +1,53 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> + +<plist version="1.0"> + <dict> +  + <key>com.apple.security.cs.allow-jit</key><false/> + +  + <key>com.apple.security.cs.allow-unsigned-executable-memory</key><true/> + +  + <key>com.apple.security.cs.disable-executable-page-protection</key><false/> + +  + <key>com.apple.security.cs.disable-library-validation</key><true/> + +  + <key>com.apple.security.cs.allow-dyld-environment-variables</key><true/> + +  + <key>com.apple.security.get-task-allow</key><false/> + +  + <key>com.apple.security.device.audio-input</key><true/> + +  + <key>com.apple.security.device.camera</key><true/> + +  + <key>com.apple.security.personal-information.location</key><true/> + +  + <key>com.apple.security.automation.apple-events</key><true/> + +  + <key>com.apple.security.smartcard</key><true/> + </dict> +</plist> diff --git a/tools/signing/stapler.sh b/tools/signing/stapler.sh new file mode 100755 index 0000000..cdbb466 --- /dev/null +++ b/tools/signing/stapler.sh @@ -0,0 +1,47 @@ +#!/bin/bash + +# Copyright (c) 2019, The Tor Project, Inc. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are +# met: + +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following disclaimer +# in the documentation and/or other materials provided with the +# distribution. +# +# * Neither the names of the copyright owners nor the names of its +# contributors may be used to endorse or promote products derived from +# this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +TORBROWSER_VERSION=$1 +if [ -z "$TORBROWSER_VERSION" ]; +then + echo "Please call this script with a Tor Browser version!" + exit 1 +fi +BUNDLE_LOCALES="ar ca cs da de el en-US es-AR es-ES fa fr ga-IE he hu id is it ja ka ko mk nb-NO nl pl pt-BR ro ru sv-SE tr vi zh-CN zh-TW" +for LANG in $BUNDLE_LOCALES +do + echo "Stapling $LANG..." + cd $LANG + xcrun stapler staple Tor\ Browser.app + zip -qr ../tb-${TORBROWSER_VERSION}_$LANG-stapled.zip Tor\ Browser.app + cd .. +done diff --git a/tools/signing/tbb-signing.sh b/tools/signing/tbb-signing.sh new file mode 100755 index 0000000..42ea235 --- /dev/null +++ b/tools/signing/tbb-signing.sh @@ -0,0 +1,38 @@ +#!/bin/bash + +# Copyright (c) 2019, The Tor Project, Inc. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are +# met: + +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following disclaimer +# in the documentation and/or other materials provided with the +# distribution. +# +# * Neither the names of the copyright owners nor the names of its +# contributors may be used to endorse or promote products derived from +# this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +export GNUPGHOME=/path/to/gpg-key +read -sp "Enter passphrase: " pass +for i in `find . -name "*.dmg" -o -name "*.exe" -o -name "*.tar.xz" -o -name "*.txt" -o -name "*.zip" -o -name "*.tar.gz" -o -name "*.apk"` +do + echo "$pass" | gpg -absu $key! --passphrase-fd 0 $i +done [View Less]

1 0

[tor-browser-build/master] Bug 32475: Limit the number of mar file locales in nightly builds
by gk＠torproject.org 26 Nov '19

26 Nov '19

commit 8d5805ae26b873762ec823ae7ec1180d8d89b585 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Nov 20 19:14:37 2019 +0100 Bug 32475: Limit the number of mar file locales in nightly builds We will start supporting updates in the nightly channel only for a limited set of locales. --- projects/tor-browser/build | 18 ++++++++++++++++-- rbm.conf | 6 ++++++ 2 files changed, 22 insertions(+), 2 deletions(-) diff --git a/projects/tor-browser/… [View More]

1 0

[tor-browser/tor-browser-68.2.0esr-9.5-1] fixup! Bug 4234: Use the Firefox Update Process for Tor Browser.
by gk＠torproject.org 26 Nov '19

26 Nov '19

commit 9579237949269ef391e474f222011fa218608fae Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Nov 25 17:25:29 2019 +0100 fixup! Bug 4234: Use the Firefox Update Process for Tor Browser. Bug 32498: Update MAR_CHANNEL_ID for nightly We also add the -alpha channel ID to the list of ACCEPTED_MAR_CHANNEL_IDS for the alpha, so that we can change the alpha channel name at some point. --- browser/confvars.sh | 9 +++++++++ 1 file changed, 9 insertions(+) … [View More]

1 0

[tor-browser/tor-browser-68.2.0esr-9.5-1] Bug 1598647 - Set Origin to null with network.http.referer.hideOnionSource r=JuniorHsu
by gk＠torproject.org 26 Nov '19

26 Nov '19

commit 1b5b65b5c8f11e3f2fd30ca0604fde741bc2c749 Author: Alex Catarineu <acat(a)torproject.org> Date: Mon Nov 25 13:29:47 2019 +0000 Bug 1598647 - Set Origin to null with network.http.referer.hideOnionSource r=JuniorHsu Differential Revision: https://phabricator.services.mozilla.com/D54303 --HG-- extra : moz-landing-system : lando --- dom/security/ReferrerInfo.cpp | 3 ++- dom/security/ReferrerInfo.h | 2 +- netwerk/protocol/… [View More]http/nsCORSListenerProxy.cpp | 2 +- netwerk/protocol/http/nsHttpChannel.cpp | 17 +++++++---------- 4 files changed, 11 insertions(+), 13 deletions(-) diff --git a/dom/security/ReferrerInfo.cpp b/dom/security/ReferrerInfo.cpp index 2d06d9b3d3d3..25d9cd3290c0 100644 --- a/dom/security/ReferrerInfo.cpp +++ b/dom/security/ReferrerInfo.cpp @@ -322,7 +322,8 @@ nsresult ReferrerInfo::HandleUserReferrerSendingPolicy(nsIHttpChannel* aChannel, return NS_OK; } -bool ReferrerInfo::IsCrossOriginRequest(nsIHttpChannel* aChannel) const { +/* static */ +bool ReferrerInfo::IsCrossOriginRequest(nsIHttpChannel* aChannel) { nsCOMPtr<nsILoadInfo> loadInfo = aChannel->LoadInfo(); nsCOMPtr<nsIURI> triggeringURI; diff --git a/dom/security/ReferrerInfo.h b/dom/security/ReferrerInfo.h index bf21233a0510..5fa052f3f32d 100644 --- a/dom/security/ReferrerInfo.h +++ b/dom/security/ReferrerInfo.h @@ -155,7 +155,7 @@ class ReferrerInfo : public nsIReferrerInfo { * Computing whether the request is cross-origin may be expensive, so please * do that in cases where we're going to use this information later on. */ - bool IsCrossOriginRequest(nsIHttpChannel* aChannel) const; + static bool IsCrossOriginRequest(nsIHttpChannel* aChannel); /* * Check whether referrer is allowed to send in secure to insecure scenario. diff --git a/netwerk/protocol/http/nsCORSListenerProxy.cpp b/netwerk/protocol/http/nsCORSListenerProxy.cpp index 36b263ddf003..36027a5d2809 100644 --- a/netwerk/protocol/http/nsCORSListenerProxy.cpp +++ b/netwerk/protocol/http/nsCORSListenerProxy.cpp @@ -985,7 +985,7 @@ nsresult nsCORSListenerProxy::UpdateChannel(nsIChannel* aChannel, if (!currentOrgin.EqualsIgnoreCase(origin.get()) && StringEndsWith(potentialOnionHost, NS_LITERAL_CSTRING(".onion"))) { - origin.Truncate(); + origin.AssignLiteral("null"); } } diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp index b2d58379affe..7e1730c13b6a 100644 --- a/netwerk/protocol/http/nsHttpChannel.cpp +++ b/netwerk/protocol/http/nsHttpChannel.cpp @@ -9631,8 +9631,7 @@ void nsHttpChannel::SetOriginHeader() { nsContentUtils::GetASCIIOrigin(referrer, origin); } - // Restrict Origin to same-origin loads if requested by user or leaving from - // .onion + // Restrict Origin to same-origin loads if requested by user if (sSendOriginHeader == 1) { nsAutoCString currentOrigin; nsContentUtils::GetASCIIOrigin(mURI, currentOrigin); @@ -9640,16 +9639,14 @@ void nsHttpChannel::SetOriginHeader() { // Origin header suppressed by user setting return; } - } else if (dom::ReferrerInfo::HideOnionReferrerSource()) { + } + + if (dom::ReferrerInfo::HideOnionReferrerSource()) { nsAutoCString host; if (referrer && NS_SUCCEEDED(referrer->GetAsciiHost(host)) && - StringEndsWith(host, NS_LITERAL_CSTRING(".onion"))) { - nsAutoCString currentOrigin; - nsContentUtils::GetASCIIOrigin(mURI, currentOrigin); - if (!origin.EqualsIgnoreCase(currentOrigin.get())) { - // Origin header is suppressed by .onion - return; - } + StringEndsWith(host, NS_LITERAL_CSTRING(".onion")) && + dom::ReferrerInfo::IsCrossOriginRequest(this)) { + origin.AssignLiteral("null"); } } [View Less]

1 0

[tor-browser/tor-browser-68.2.0esr-9.5-1] Revert "Bug 32255: Set Origin to null for CORS requests"
by gk＠torproject.org 26 Nov '19

26 Nov '19

commit 9de14da5e2a82b6e1ea4a4c68328996cbcc847ce Author: Alex Catarineu <acat(a)torproject.org> Date: Tue Nov 26 13:31:20 2019 +0100 Revert "Bug 32255: Set Origin to null for CORS requests" This reverts commit f26fb9c17d71f3373c8ccb91ae74c438d9e13f80. --- netwerk/protocol/http/nsCORSListenerProxy.cpp | 2 +- netwerk/protocol/http/nsHttpChannel.cpp | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/netwerk/protocol/http/nsCORSListenerProxy.cpp b/… [View More]

1 0

[tor-browser-build/maint-9.0] Bug 30548: Clean up keyring file
by gk＠torproject.org 26 Nov '19

26 Nov '19

commit 6b722f712e666bdc4b80694a89b0950e42f3574a Author: Georg Koppen <gk(a)torproject.org> Date: Thu Nov 21 11:56:54 2019 +0000 Bug 30548: Clean up keyring file --- keyring/cmake.gpg | Bin 16939 -> 22706 bytes keyring/llvm.gpg | Bin 3335 -> 4309 bytes keyring/tor.gpg | Bin 159585 -> 9148 bytes keyring/torbrowser.gpg | Bin 125669 -> 2839 bytes keyring/torbutton.gpg | Bin 290913 -> 5120 bytes keyring/yawning.gpg | Bin 58959 -> 36705 bytes … [View More]

1 0