July 2019 - tbb-commits - lists.torproject.org

[tor-browser-build/master] Bug 28119: Tor Browser for aarch64
by boklm＠torproject.org 01 Jul '19

01 Jul '19

commit d226510faec5480997adcdc3c1c6aee1952d92e5 Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 31 13:01:30 2019 +0000 Bug 28119: Tor Browser for aarch64 Thanks to boklm for help with this patch. --- Makefile | 15 +++++++++ projects/android-toolchain/build | 8 ++--- projects/firefox/mozconfig-android-aarch64 | 50 ++++++++++++++++++++++++++++++ projects/release/build | 3 ++ projects/release/config | 10 ++++++ projects/rust/config | 4 +++ projects/tor-browser/build.android | 9 ++++-- rbm.conf | 14 ++++++++- 8 files changed, 104 insertions(+), 9 deletions(-) diff --git a/Makefile b/Makefile index 285b49d..94a26f6 100644 --- a/Makefile +++ b/Makefile @@ -11,6 +11,9 @@ release-android-armv7: submodule-update release-android-x86: submodule-update $(rbm) build release --target release --target torbrowser-android-x86 +release-android-aarch64: submodule-update + $(rbm) build release --target release --target torbrowser-android-aarch64 + release-linux-x86_64: submodule-update $(rbm) build release --target release --target torbrowser-linux-x86_64 @@ -41,6 +44,9 @@ alpha-android-armv7: submodule-update alpha-android-x86: submodule-update $(rbm) build release --target alpha --target torbrowser-android-x86 +alpha-android-aarch64: submodule-update + $(rbm) build release --target alpha --target torbrowser-android-aarch64 + alpha-linux-x86_64: submodule-update $(rbm) build release --target alpha --target torbrowser-linux-x86_64 @@ -71,6 +77,9 @@ nightly-android-armv7: submodule-update nightly-android-x86: submodule-update $(rbm) build release --target nightly --target torbrowser-android-x86 +nightly-android-aarch64: submodule-update + $(rbm) build release --target nightly --target torbrowser-android-aarch64 + nightly-linux-x86_64: submodule-update $(rbm) build release --target nightly --target torbrowser-linux-x86_64 @@ -101,6 +110,9 @@ alpha_nightly-android-armv7: submodule-update alpha_nightly-android-x86: submodule-update $(rbm) build release --target alpha_nightly --target torbrowser-android-x86 +alpha_nightly-android-aarch64: submodule-update + $(rbm) build release --target alpha_nightly --target torbrowser-android-aarch64 + alpha_nightly-linux-x86_64: submodule-update $(rbm) build release --target alpha_nightly --target torbrowser-linux-x86_64 @@ -128,6 +140,9 @@ testbuild-android-armv7: submodule-update testbuild-android-x86: submodule-update $(rbm) build release --target testbuild --target torbrowser-android-x86 +testbuild-android-aarch64: submodule-update + $(rbm) build release --target testbuild --target torbrowser-android-aarch64 + testbuild-linux-x86_64: submodule-update $(rbm) build release --target testbuild --target torbrowser-linux-x86_64 diff --git a/projects/android-toolchain/build b/projects/android-toolchain/build index 9fe40f7..e0f59a9 100644 --- a/projects/android-toolchain/build +++ b/projects/android-toolchain/build @@ -18,11 +18,9 @@ cd $NDK_HOME mv android-ndk-r15c/* . rm -fR android-ndk-r15c -# The architectures we support -archs="arm x86" -for arch in $archs; do - ./build/tools/make_standalone_toolchain.py --api [% c("var/android_min_api") %] --arch $arch --install-dir=./$arch -done +./build/tools/make_standalone_toolchain.py --api [% c("var/android_min_api_armv7") %] --arch arm --install-dir=./arm +./build/tools/make_standalone_toolchain.py --api [% c("var/android_min_api_x86") %] --arch x86 --install-dir=./x86 +./build/tools/make_standalone_toolchain.py --api [% c("var/android_min_api_aarch64") %] --arch arm64 --install-dir=./arm64 # Tool Archives cd $SDK_HOME diff --git a/projects/firefox/mozconfig-android-aarch64 b/projects/firefox/mozconfig-android-aarch64 new file mode 100644 index 0000000..2a9eb67 --- /dev/null +++ b/projects/firefox/mozconfig-android-aarch64 @@ -0,0 +1,50 @@ +mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/obj-aarch64-linux-android +mk_add_options MOZ_APP_DISPLAYNAME="Tor Browser" +export MOZILLA_OFFICIAL=1 + +ac_add_options --enable-optimize +ac_add_options --enable-official-branding + +ac_add_options --enable-application=mobile/android +ac_add_options --target=aarch64-linux-android +ac_add_options --with-android-ndk=/var/tmp/dist/android-toolchain/android-ndk +ac_add_options --with-android-sdk=/var/tmp/dist/android-toolchain/android-sdk-linux +ac_add_options --with-gradle=/var/tmp/dist/android-toolchain/gradle/gradle-4.1/bin/gradle +ac_add_options --with-android-version=21 + +# Android NDK does not contain llvm-config so set clang path in options +ac_add_options --with-libclang-path=/var/tmp/dist/android-toolchain/android-ndk/arm64/lib64 +ac_add_options --with-clang-path=/var/tmp/dist/android-toolchain/android-ndk/arm64/bin/clang + +ac_add_options --with-android-distribution-directory=@TOPSRCDIR@/mobile/android/torbrowser +ac_add_options --with-l10n-base=/var/tmp/dist/locales + +# We do not use Tor Launcher on Android: +ac_add_options --disable-tor-launcher + +if [ -z "${TB_BUILD_WITH_UPDATER}" ]; then +# Because Google Play will likely be the primary distribution medium, +# we disable updating and rely on Google Play by default. The +# Developer Policy explicitly prohibits in-app updating: +# An app distributed via Google Play may not modify, replace, or +# update itself using any method other than Google Plays update +# mechanism. +# https://play.google.com/about/privacy-security-deception/malicious-behavior/ + + ac_add_options --disable-tor-browser-update + ac_add_options --disable-signmar + ac_add_options --disable-verify-mar +fi + +ac_add_options --enable-strip +ac_add_options --disable-tests +ac_add_options --disable-debug +ac_add_options --disable-rust-debug +ac_add_options --disable-maintenance-service +ac_add_options --disable-crashreporter +ac_add_options --disable-webrtc + +ac_add_options --without-google-play-services + +# Let's make sure no preference is enabling either Adobe's or Google's CDM. +ac_add_options --disable-eme diff --git a/projects/release/build b/projects/release/build index af9d673..3e930e0 100644 --- a/projects/release/build +++ b/projects/release/build @@ -10,6 +10,9 @@ mkdir -p "$destdir" [% IF c("var/torbrowser-android-x86") -%] mv [% c('input_files_by_name/android-x86') %]/* "$destdir"/ [% END -%] +[% IF c("var/torbrowser-android-aarch64") -%] + mv [% c('input_files_by_name/android-aarch64') %]/* "$destdir"/ +[% END -%] [% IF c("var/torbrowser-windows-i686") -%] mv [% c('input_files_by_name/windows-i686') %]/* "$destdir"/ mv [% c('input_files_by_name/windows-expert-bundle') %]/* "$destdir"/ diff --git a/projects/release/config b/projects/release/config index ddb17d1..1623083 100644 --- a/projects/release/config +++ b/projects/release/config @@ -24,6 +24,9 @@ targets: torbrowser-android-x86: var: torbrowser-android-x86: 1 + torbrowser-android-aarch64: + var: + torbrowser-android-aarch64: 1 torbrowser-linux-x86_64: var: torbrowser-linux-x86_64: 1 @@ -117,6 +120,13 @@ input_files: - '[% c("var/build_target") %]' - torbrowser-android-x86 + - name: android-aarch64 + project: tor-browser + enable: '[% c("var/torbrowser-android-aarch64") %]' + target: + - '[% c("var/build_target") %]' + - torbrowser-android-aarch64 + - name: linux-x86_64 project: tor-browser enable: '[% c("var/torbrowser-linux-x86_64") %]' diff --git a/projects/rust/config b/projects/rust/config index 2ed48c0..d784d39 100644 --- a/projects/rust/config +++ b/projects/rust/config @@ -30,6 +30,10 @@ targets: var: configure_opt: --enable-local-rust --enable-vendor --enable-extended --release-channel=stable --sysconfdir=etc --target=i686-linux-android --set=target.i686-linux-android.cc=$ANDROID_NDK_HOME/x86/bin/i686-linux-android-gcc + android-aarch64: + var: + configure_opt: --enable-local-rust --enable-vendor --enable-extended --release-channel=stable --sysconfdir=etc --target=aarch64-linux-android --set=target.aarch64-linux-android.cc=$ANDROID_NDK_HOME/arm64/bin/aarch64-linux-android-gcc + linux: var: rust_arch: x86_64 diff --git a/projects/tor-browser/build.android b/projects/tor-browser/build.android index be36abc..b90c8b9 100644 --- a/projects/tor-browser/build.android +++ b/projects/tor-browser/build.android @@ -24,13 +24,16 @@ zip -d $apk lib/\* zip_src => [ 'lib/x86/*' ], zip_args => '$apk', }) %] -[% END %] - -[% IF c("var/android-armv7") %] +[% ELSIF c("var/android-armv7") %] [% c('zip', { zip_src => [ 'lib/armeabi-v7a/*' ], zip_args => '$apk', }) %] +[% ELSIF c("var/android-aarch64") %] + [% c('zip', { + zip_src => [ 'lib/arm64-v8a/*' ], + zip_args => '$apk', + }) %] [% END %] rm -fR lib diff --git a/rbm.conf b/rbm.conf index 657ce31..62a19a6 100644 --- a/rbm.conf +++ b/rbm.conf @@ -190,12 +190,24 @@ targets: var: android-x86: 1 osname: android-x86 + torbrowser-android-aarch64: + - android-aarch64 + - android + android-aarch64: + arch: aarch64 + var: + android-aarch64: 1 + osname: android-aarch64 android: var: android: 1 compiler: android-toolchain # API 16 is the minimum we currently support for Tor Browser on Android - android_min_api: 16 + android_min_api: '[% GET c("var/android_min_api_" _ c("arch")) %]' + # API 21 is the minimum we currently support for arm64 on Android + android_min_api_aarch64: 21 + android_min_api_armv7: 16 + android_min_api_x86: 16 snowflake: 0 container: suite: stretch

1 0

[tor-browser-build/master] Merge remote-tracking branch 'gk/bug_28119_v6'
by boklm＠torproject.org 01 Jul '19

01 Jul '19

commit 99f739a2b2bde7e81d9f6a974efbdd2eca1b7947 Merge: 419b0be d226510 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Jul 1 19:21:55 2019 +0200 Merge remote-tracking branch 'gk/bug_28119_v6' Makefile | 15 +++++++++ projects/android-toolchain/build | 8 ++--- projects/firefox/mozconfig-android-aarch64 | 50 ++++++++++++++++++++++++++++++ projects/release/build | 3 ++ projects/release/config | 10 ++++++ projects/rust/config | 4 +++ projects/tor-browser/build.android | 9 ++++-- rbm.conf | 14 ++++++++- 8 files changed, 104 insertions(+), 9 deletions(-)

1 0

[tor-browser-build/master] Bug 30549: Add script to remove expired and revoked sub-keys from a keyring file
by gk＠torproject.org 01 Jul '19

01 Jul '19

commit 419b0bef89047450a88292ea34bb8ef1e746bbea Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Jul 1 16:02:54 2019 +0200 Bug 30549: Add script to remove expired and revoked sub-keys from a keyring file The tools/keyring/drop-expired-sub-keys script can be used to drop all expired and revoked sub-keys from a keyring. We also add the script tools/keyring/list-all-keyrings which can be used to list all the keys included in all the keyring files, to make it easier to review if any key needs to be removed. --- tools/keyring/README | 29 +++++++++++++++++++++++++++++ tools/keyring/drop-expired-sub-keys | 22 ++++++++++++++++++++++ tools/keyring/list-all-keyrings | 10 ++++++++++ 3 files changed, 61 insertions(+) diff --git a/tools/keyring/README b/tools/keyring/README new file mode 100644 index 0000000..ffbb2a8 --- /dev/null +++ b/tools/keyring/README @@ -0,0 +1,29 @@ +The keyring/ directory contains some gpg keyring files that we use +during the build to verify gpg signatures on downloaded files, or git +tags. In order to be able to continue to use a git tag even after the +key or sub-key that signed it expired (which is common when one is +rotating sub-keys frequently), we configured gpg to ignore key expirations +when verifying git tag signatures. However this also means that we should +make sure that our keyring files do not contain expired keys or subkeys +that are not supposed to be used anymore. + +This directory contains some scripts that can help clean the keyring +files. + +The complete process for cleaning keyring files starts with: + + - Run `list-all-keyrings` to see if we include any expired key or sub-key. + +Then for each expired key or sub-key: + + - Check if the expiration is expected, and do nothing in that case. + + - Check if the owner of that key or sub-key extended it, and in that + case add the updated key or sub-key. + + - If a key is not needed anymore (but other keys in the keyring are + still needed), remove it with `gpg --delete-keys <key>`. + + - If a sub-key is not needed anymore, but the main key still contains + at least one other valid sub-key, use `drop-expired-sub-keys` to + remove the expired sub-key. diff --git a/tools/keyring/drop-expired-sub-keys b/tools/keyring/drop-expired-sub-keys new file mode 100755 index 0000000..e7bbe50 --- /dev/null +++ b/tools/keyring/drop-expired-sub-keys @@ -0,0 +1,22 @@ +#!/bin/bash + +# Drop expired and revoked sub-keys from a keyring file +# +# usage: drop-expired-sub-keys <keyring-file> +# +# Note: this script only handles the case where all expired and revoked +# sub-keys should be removed, so it cannot be used in the cases where +# some of the expired sub-keys need to be kept. It is also only handling +# one small part of the process to clean the keyring files and is not +# supposed to be run on all keyring files. +# +# See the README file for the complete process for cleaning keyring files. + +set -e +keyring="$1" +test -f "$keyring" +tmpfile=$(mktemp) +gpg --no-auto-check-trustdb --no-default-keyring --keyring "$keyring" --armor --export-options export-clean --export-filter 'drop-subkey=expired -t || revoked -t' --export > "$tmpfile" +rm -f "$keyring" +gpg --no-auto-check-trustdb --trust-model always --no-default-keyring --keyring "$keyring" --import "$tmpfile" +rm -f "$tmpfile" diff --git a/tools/keyring/list-all-keyrings b/tools/keyring/list-all-keyrings new file mode 100755 index 0000000..2d053c4 --- /dev/null +++ b/tools/keyring/list-all-keyrings @@ -0,0 +1,10 @@ +#!/bin/sh + +# List all keys included in our keyring files, including expired sub-keys. + +set -e +cd $(dirname "$0")/../.. +for keyring in ./keyring/*.gpg +do + gpg --no-auto-check-trustdb --list-options show-unusable-subkeys,show-keyring --no-default-keyring --list-keys --keyring "$keyring" +done

1 0

[torbutton/maint-2.1] Bug 31041: stop syncing network.cookie.lifetimePolicy
by gk＠torproject.org 01 Jul '19

01 Jul '19

commit 4cec079c058d5756a47f9d661b7aea7a95d31076 Author: Alex Catarineu <acat(a)torproject.org> Date: Mon Jul 1 14:51:15 2019 +0200 Bug 31041: stop syncing network.cookie.lifetimePolicy Also browser.download.manager.retention, since it's not used anymore in the browser. --- src/chrome/content/torbutton.js | 8 -------- 1 file changed, 8 deletions(-) diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index 53fe4fc9..971d3023 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -1527,14 +1527,6 @@ function torbutton_update_disk_prefs() { // Third party abuse. Leave it off for now. //m_tb_prefs.setBoolPref("browser.cache.offline.enable", !mode); - if (mode) { - m_tb_prefs.setIntPref("network.cookie.lifetimePolicy", 2); - m_tb_prefs.setIntPref("browser.download.manager.retention", 1); - } else { - m_tb_prefs.setIntPref("network.cookie.lifetimePolicy", 0); - m_tb_prefs.setIntPref("browser.download.manager.retention", 2); - } - // Force prefs to be synced to disk Services.prefs.savePrefFile(null); }

1 0

[torbutton/master] Bug 31041: stop syncing network.cookie.lifetimePolicy
by gk＠torproject.org 01 Jul '19

01 Jul '19

commit a13b6c870afa18ac1c7747aa928f89b5706a9f44 Author: Alex Catarineu <acat(a)torproject.org> Date: Mon Jul 1 14:51:15 2019 +0200 Bug 31041: stop syncing network.cookie.lifetimePolicy Also browser.download.manager.retention, since it's not used anymore in the browser. --- src/chrome/content/torbutton.js | 8 -------- 1 file changed, 8 deletions(-) diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index 53fe4fc9..971d3023 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -1527,14 +1527,6 @@ function torbutton_update_disk_prefs() { // Third party abuse. Leave it off for now. //m_tb_prefs.setBoolPref("browser.cache.offline.enable", !mode); - if (mode) { - m_tb_prefs.setIntPref("network.cookie.lifetimePolicy", 2); - m_tb_prefs.setIntPref("browser.download.manager.retention", 1); - } else { - m_tb_prefs.setIntPref("network.cookie.lifetimePolicy", 0); - m_tb_prefs.setIntPref("browser.download.manager.retention", 2); - } - // Force prefs to be synced to disk Services.prefs.savePrefFile(null); }

1 0

[tor-browser-build/master] Fold in stable Changelog
by gk＠torproject.org 01 Jul '19

01 Jul '19

commit 80c4d17b1976ee06e2c4c553f9a4f42d7122f314 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Jul 1 11:36:27 2019 +0000 Fold in stable Changelog --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index b03054b..37e89a2 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -5,6 +5,17 @@ Tor Browser 9.0a3 -- June 24 2019 * Bug 29904: NoScript blocks MP4 on higher security levels * Bug 30624+29043+29647: Prevent XSS protection from freezing the browser +Tor Browser 8.5.3 -- June 21 2019 + * All platforms + * Pick up fix for Mozilla's bug 1560192 + +Tor Browser 8.5.2 -- June 19 2019 + * All platforms + * Pick up fix for Mozilla's bug 1544386 + * Update NoScript to 10.6.3 + * Bug 29904: NoScript blocks MP4 on higher security levels + * Bug 30624+29043+29647: Prevent XSS protection from freezing the browser + Tor Browser 9.0a2 -- June 11 2019 * All platforms * Update Torbutton to 2.2

1 0