May 2019 - tbb-commits - lists.torproject.org

[tor-browser-build/master] Bug 30492: Switch to the OpenSSL 1.1.1 series
by boklm＠torproject.org 29 May '19

29 May '19

commit 2fba118f50c4bb3418787cdca5a021d5941841b6 Author: Georg Koppen <gk(a)torproject.org> Date: Wed May 29 11:31:11 2019 +0000 Bug 30492: Switch to the OpenSSL 1.1.1 series --- projects/openssl/config | 4 ++-- projects/tor/build | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/projects/openssl/config b/projects/openssl/config index ecb6966..318529a 100644 --- a/projects/openssl/config +++ b/projects/openssl/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 1.0.2r +version: 1.1.1b filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' var: @@ -26,4 +26,4 @@ input_files: - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]' - URL: 'https://www.openssl.org/source/openssl-[% c("version") %].tar.gz' - sha256sum: ae51d08bba8a83958e894946f15303ff894d75c2b8bbd44a852b64e3fe11d0d6 + sha256sum: 5c557b023230413dfb0756f3137a13e6d726838ccd1430888ad15bfb2b43ea4b diff --git a/projects/tor/build b/projects/tor/build index a9305d6..8c8ed45 100644 --- a/projects/tor/build +++ b/projects/tor/build @@ -49,8 +49,8 @@ openssldir=/var/tmp/dist/openssl [% END -%] [% IF c("var/linux") %] mkdir -p "$distdir/Debug/Tor" - cp $openssldir/lib/libssl.so.1.0.0 "$distdir/Tor/" - cp $openssldir/lib/libcrypto.so.1.0.0 "$distdir/Tor/" + cp $openssldir/lib/libssl.so.1.1 "$distdir/Tor/" + cp $openssldir/lib/libcrypto.so.1.1 "$distdir/Tor/" cp $libeventdir/lib/libevent-2.1.so.6 "$distdir/Tor/" # We need to copy the libstdc++.so.6 for Tor Browser on older Linux distros. # Copying it into /Browser, which feels more natural, and amending

1 0

[tor-browser/tor-browser-60.7.0esr-8.5-1] Bug 30541: Disable WebGL readPixel() for web content
by gk＠torproject.org 29 May '19

29 May '19

commit a7422f83dff4a4c58b2a763543d4960ac1b42771 Author: Georg Koppen <gk(a)torproject.org> Date: Wed May 29 12:29:19 2019 +0000 Bug 30541: Disable WebGL readPixel() for web content --- dom/canvas/WebGLContextGL.cpp | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/dom/canvas/WebGLContextGL.cpp b/dom/canvas/WebGLContextGL.cpp index cab33ba626f2..2d4d9d8d16a4 100644 --- a/dom/canvas/WebGLContextGL.cpp +++ b/dom/canvas/WebGLContextGL.cpp @@ -1137,6 +1137,14 @@ bool WebGLContext::ReadPixels_SharedPrecheck(CallerType aCallerType, return false; } + // Security check passed, but don't let content readPixel calls through for + // now, if Resist Fingerprinting Mode is enabled. + if (nsContentUtils::ResistFingerprinting(aCallerType)) { + GenerateWarning("readPixels: Not allowed in Resist Fingerprinting Mode"); + out_error.Throw(NS_ERROR_DOM_NOT_SUPPORTED_ERR); + return false; + } + return true; }

1 0

[tor-browser/tor-browser-60.7.0esr-9.0-1] Bug 30541: Disable WebGL readPixel() for web content
by gk＠torproject.org 29 May '19

29 May '19

commit e462f9d9eb505b5e724ec64a52280c70210cf5eb Author: Georg Koppen <gk(a)torproject.org> Date: Wed May 29 12:29:19 2019 +0000 Bug 30541: Disable WebGL readPixel() for web content --- dom/canvas/WebGLContextGL.cpp | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/dom/canvas/WebGLContextGL.cpp b/dom/canvas/WebGLContextGL.cpp index cab33ba626f2..2d4d9d8d16a4 100644 --- a/dom/canvas/WebGLContextGL.cpp +++ b/dom/canvas/WebGLContextGL.cpp @@ -1137,6 +1137,14 @@ bool WebGLContext::ReadPixels_SharedPrecheck(CallerType aCallerType, return false; } + // Security check passed, but don't let content readPixel calls through for + // now, if Resist Fingerprinting Mode is enabled. + if (nsContentUtils::ResistFingerprinting(aCallerType)) { + GenerateWarning("readPixels: Not allowed in Resist Fingerprinting Mode"); + out_error.Throw(NS_ERROR_DOM_NOT_SUPPORTED_ERR); + return false; + } + return true; }

1 0

[tor-browser-build/maint-8.5] Pick up fix for #30635
by gk＠torproject.org 29 May '19

29 May '19

commit 8fe019d3f4cb27d549727b6754e4ffb38fafbe1f Author: Georg Koppen <gk(a)torproject.org> Date: Wed May 29 09:00:16 2019 +0000 Pick up fix for #30635 --- projects/tor-android-service/config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/tor-android-service/config b/projects/tor-android-service/config index a87422c..2290c6e 100644 --- a/projects/tor-android-service/config +++ b/projects/tor-android-service/config @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' -git_hash: 28cc173eed552521a02b8edd94f4b7be8df7897f +git_hash: d9b049c8cee225b4e7bb6f0191093f543d0f9f65 git_url: https://git.torproject.org/tor-android-service.git git_submodule: 1

1 0

[tor-browser-build/master] Pick up fix for #30635
by gk＠torproject.org 29 May '19

29 May '19

commit 68bfb37ac2643945268e124942540d40bb014869 Author: Georg Koppen <gk(a)torproject.org> Date: Wed May 29 09:00:16 2019 +0000 Pick up fix for #30635 --- projects/tor-android-service/config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/tor-android-service/config b/projects/tor-android-service/config index a87422c..2290c6e 100644 --- a/projects/tor-android-service/config +++ b/projects/tor-android-service/config @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' -git_hash: 28cc173eed552521a02b8edd94f4b7be8df7897f +git_hash: d9b049c8cee225b4e7bb6f0191093f543d0f9f65 git_url: https://git.torproject.org/tor-android-service.git git_submodule: 1

1 0

[tor-android-service/master] Bug 30635 - Synchronize bridges with Tor Browser on desktop
by gk＠torproject.org 29 May '19

29 May '19

commit d9b049c8cee225b4e7bb6f0191093f543d0f9f65 Author: Matthew Finkel <Matthew.Finkel(a)gmail.com> Date: Mon May 27 14:26:12 2019 +0000 Bug 30635 - Synchronize bridges with Tor Browser on desktop --- service/src/main/assets/common/bridges.txt | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/service/src/main/assets/common/bridges.txt b/service/src/main/assets/common/bridges.txt index 6101973..2e52b09 100644 --- a/service/src/main/assets/common/bridges.txt +++ b/service/src/main/assets/common/bridges.txt @@ -1,7 +1,11 @@ -obfs3 169.229.59.74:31493 AF9F66B7B04F8FF6F32D455F05135250A16543C9 -obfs3 169.229.59.75:46328 AF9F66B7B04F8FF6F32D455F05135250A16543C9 obfs3 109.105.109.163:38980 1E05F577A0EC0213F971D81BF4D86A9E4E8229ED obfs3 109.105.109.163:47779 4C331FA9B3D1D6D8FB0D8FBBF0C259C360D97E6A +obfs4 109.105.109.165:10527 8DFCD8FB3285E855F5A55EDDA35696C743ABFC4E cert=Bvg/itxeL4TWKLP6N1MaQzSOC6tcRIBv6q57DYAZc3b2AzuM+/TfB7mqTFEfXILCjEwzVA iat-mode=1 +obfs4 109.105.109.147:13764 BBB28DF0F201E706BE564EFE690FE9577DD8386D cert=KfMQN/tNMFdda61hMgpiMI7pbwU1T+wxjTulYnfw+4sgvG0zSH7N7fwT10BI8MUdAD7iJA iat-mode=2 +obfs4 192.95.36.142:443 CDF2E852BF539B82BD10E27E9115A31734E378C2 cert=qUVQ0srL1JI/vO6V6m/24anYXiJD3QP2HgzUKQtQ7GRqqUvs7P+tG43RtAqdhLOALP7DJQ iat-mode=1 +obfs4 85.17.30.79:443 FC259A04A328A07FED1413E9FC6526530D9FD87A cert=RutxZlu8BtyP+y0NX7bAVD41+J/qXNhHUrKjFkRSdiBAhIHIQLhKQ2HxESAKZprn/lR3KA iat-mode=0 +obfs4 38.229.1.78:80 C8CBDB2464FC9804A69531437BCF2BE31FDD2EE4 cert=Hmyfd2ev46gGY7NoVxA9ngrPF2zCZtzskRTzoWXbxNkzeVnGFPWmrTtILRyqCTjHR+s9dg iat-mode=1 +obfs4 [2001:470:b381:bfff:216:3eff:fe23:d6c3]:443 CDF2E852BF539B82BD10E27E9115A31734E378C2 cert=qUVQ0srL1JI/vO6V6m/24anYXiJD3QP2HgzUKQtQ7GRqqUvs7P+tG43RtAqdhLOALP7DJQ iat-mode=1 obfs4 37.218.240.34:40035 88CD36D45A35271963EF82E511C8827A24730913 cert=eGXYfWODcgqIdPJ+rRupg4GGvVGfh25FWaIXZkit206OSngsp7GAIiGIXOJJROMxEqFKJg iat-mode=1 obfs4 37.218.245.14:38224 D9A82D2F9C2F65A18407B1D2B764F130847F8B5D cert=bjRaMrr1BRiAW8IE9U5z27fQaYgOhX1UCmOpg2pFpoMvo6ZgQMzLsaTzzQNTlm7hNcb+Sg iat-mode=0 obfs4 85.31.186.98:443 011F2599C0E9B27EE74B353155E244813763C3E5 cert=ayq0XzCwhpdysn5o0EyDUbmSOx3X/oTEbzDMvczHOdBJKlvIdHHLJGkZARtT4dcBFArPPg iat-mode=0

1 0

[tor-browser-build/maint-8.5] Pick up rbm changes for #30480
by gk＠torproject.org 27 May '19

27 May '19

commit 018ff64dc7fc5542dd8bca6621e2d86bd8ea06fd Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 27 13:09:10 2019 +0000 Pick up rbm changes for #30480 --- rbm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rbm b/rbm index 87adfb7..e04f03f 160000 --- a/rbm +++ b/rbm @@ -1 +1 @@ -Subproject commit 87adfb7b7be7e7e0f437020dbf8a119673133412 +Subproject commit e04f03f9626e993bb66d7784d258f95ca07bc769

1 0

[tor-browser-build/master] Pick up rbm changes for #30480
by gk＠torproject.org 27 May '19

27 May '19

commit 7526dc507738c0816d84e0746b041867e2b35f90 Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 27 13:07:52 2019 +0000 Pick up rbm changes for #30480 --- rbm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rbm b/rbm index 87adfb7..e04f03f 160000 --- a/rbm +++ b/rbm @@ -1 +1 @@ -Subproject commit 87adfb7b7be7e7e0f437020dbf8a119673133412 +Subproject commit e04f03f9626e993bb66d7784d258f95ca07bc769

1 0

[rbm/master] Bug 30480: Check that a signed tag object contains the expected tag name
by gk＠torproject.org 27 May '19

27 May '19

commit e04f03f9626e993bb66d7784d258f95ca07bc769 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu May 16 12:38:08 2019 +0200 Bug 30480: Check that a signed tag object contains the expected tag name When checking the signature on a tag, we also need to check that the tag is really the expected tag in order to avoid rollback attacks. Thanks to Santiago Torres-Arias and Keving Gallagher from NYU for reporting and helping to fix this issue. --- lib/RBM.pm | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/lib/RBM.pm b/lib/RBM.pm index 4416a0c..75912af 100644 --- a/lib/RBM.pm +++ b/lib/RBM.pm @@ -308,6 +308,16 @@ sub git_commit_sign_id { return gpg_get_fingerprint(@l); } +sub git_get_signed_tagname { + foreach my $l (split(/\n/, $_[0])) { + # the tag message is separated from headers by an empty line, so we + # ignore anything after the first empty line + return '' unless $l; + return $1 if $l =~ m/^tag (.*)$/; + } + return ''; +} + sub git_tag_sign_id { my ($project, $tag) = @_; my $w = set_git_gpg_wrapper($project); @@ -315,6 +325,7 @@ sub git_tag_sign_id { = capture_exec('git', 'tag', '-v', $tag); unset_git_gpg_wrapper($w); return undef unless $success; + return undef unless git_get_signed_tagname($stdout) eq $tag; return gpg_get_fingerprint(split /\n/, $stderr); }

1 0

[tor-browser-build/master] Bug 30491: Move our macOS builds to Debian Stretch
by gk＠torproject.org 27 May '19

27 May '19

commit cfa06e43015e845c4350b8019c465860f655e1b9 Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 20 12:16:27 2019 +0000 Bug 30491: Move our macOS builds to Debian Stretch --- projects/debootstrap-image/config | 18 ------------------ projects/rust/config | 1 + rbm.conf | 2 +- 3 files changed, 2 insertions(+), 19 deletions(-) diff --git a/projects/debootstrap-image/config b/projects/debootstrap-image/config index 99326dd..cad9c77 100644 --- a/projects/debootstrap-image/config +++ b/projects/debootstrap-image/config @@ -58,24 +58,6 @@ targets: arch: amd64 debootstrap_mirror: "http://archive.debian.org/debian/" - jessie-amd64: - var: - minimal_apt_version: 1.0.9.8.5 - # https://lists.debian.org/debian-lts-announce/2019/01/msg00014.html - apt_packages_baseurl: http://security.debian.org/debian-security/pool/updates/main/a/apt - apt_package_filename: apt_1.0.9.8.5_amd64.deb - apt_package_sha256sum: 4078748632abc19836d045f80f9d6933326065ca1d47367909a0cf7f29e7dfe8 - apt_utils_package_filename: apt-utils_1.0.9.8.5_amd64.deb - apt_utils_package_sha256sum: 87c55d9ccadcabd59674873c221357c774020c116afd978fb9df6d2d0303abf2 - libapt_inst_package_filename: libapt-inst1.5_1.0.9.8.5_amd64.deb - libapt_inst_package_sha256sum: f9615532b1577b3d1455fa51839ce91765f2860eb3a6810fb5e0de0c87253030 - libapt_pkg_package_filename: libapt-pkg4.12_1.0.9.8.5_amd64.deb - libapt_pkg_package_sha256sum: 295d9c69854a4cfbcb46001b09b853f5a098a04c986fc5ae01a0124c1c27e6bd - - container: - suite: jessie - arch: amd64 - stretch-amd64: var: minimal_apt_version: 1.4.9 diff --git a/projects/rust/config b/projects/rust/config index 8d65fc6..2ed48c0 100644 --- a/projects/rust/config +++ b/projects/rust/config @@ -75,6 +75,7 @@ targets: arch_deps: - libssl-dev - pkg-config + - zlib1g-dev configure_opt: --enable-local-rust --enable-vendor --enable-extended --release-channel=stable --sysconfdir=etc --target=x86_64-apple-darwin --set=target.x86_64-apple-darwin.cc=x86_64-apple-darwin-clang windows: diff --git a/rbm.conf b/rbm.conf index ee805fc..2e9abf1 100644 --- a/rbm.conf +++ b/rbm.conf @@ -312,7 +312,7 @@ targets: osx: 1 osname: osx-x86_64 container: - suite: jessie + suite: stretch arch: amd64 compiler: 'macosx-toolchain' configure_opt: '--host=x86_64-apple-darwin11 CC="x86_64-apple-darwin11-clang [% c("var/FLAGS") %]" CXX="x86_64-apple-darwin11-clang++ [% c("var/FLAGS") %]"'

1 0