March 2020 - tbb-commits - lists.torproject.org

[tor-browser-build/master] Bug 33403: Add nightly mar key
by boklm＠torproject.org 09 Mar '20

09 Mar '20

commit e6d2903efa95a88e24e846dd30f2f076fec45ca5 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Feb 20 18:42:37 2020 +0100 Bug 33403: Add nightly mar key --- projects/firefox/build | 6 ++++++ projects/firefox/config | 2 ++ projects/firefox/nightly-marsigner.der | Bin 0 -> 1245 bytes 3 files changed, 8 insertions(+) diff --git a/projects/firefox/build b/projects/firefox/build index 800a0c4..8837cfc 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -108,6 +108,12 @@ fi popd [% END %] +[% IF c("var/nightly") -%] + # Add nightly mar signing key (#33403) + cp $rootdir/nightly-marsigner.der toolkit/mozapps/update/updater/nightly_aurora_level3_primary.der + cp $rootdir/nightly-marsigner.der toolkit/mozapps/update/updater/nightly_aurora_level3_secondary.der +[% END -%] + rm -f configure rm -f js/src/configure diff --git a/projects/firefox/config b/projects/firefox/config index 5d6c05d..13c9307 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -177,6 +177,8 @@ input_files: - project: tba-translation name: tba-translation enable: '[% c("var/android") %]' + - filename: nightly-marsigner.der + enable: '[% c("var/nightly") %]' - filename: namecoin-torbutton.patch enable: '[% c("var/namecoin") %]' # TorButton patch authored by Arthur Edelstein, from https://github.com/arthuredelstein/torbutton/ branch 2.1.10-namecoin diff --git a/projects/firefox/nightly-marsigner.der b/projects/firefox/nightly-marsigner.der new file mode 100644 index 0000000..a3a3077 Binary files /dev/null and b/projects/firefox/nightly-marsigner.der differ

1 0

[tor-browser-build/master] Bug 28764: OpenSSL Build for Android
by boklm＠torproject.org 09 Mar '20

09 Mar '20

commit b380d694e605e46500e411c792602e08cdbb6fb2 Author: sisbell <shane.isbell(a)gmail.com> Date: Tue Dec 10 18:36:08 2019 -0800 Bug 28764: OpenSSL Build for Android --- projects/openssl/build | 4 ++++ projects/openssl/config | 3 +++ 2 files changed, 7 insertions(+) diff --git a/projects/openssl/build b/projects/openssl/build index 5851ff8..984d14a 100644 --- a/projects/openssl/build +++ b/projects/openssl/build @@ -17,6 +17,10 @@ export CC='gcc -m32' patch -p1 < $rootdir/escape-openssldir.patch patch -p1 < $rootdir/use-SOURCE_DATE_EPOCH.patch [% END -%] +# OpenSSL expects the NDK home to include the pre-assembled architecture directory +[% IF c("var/android") -%] + export ANDROID_NDK_HOME=$ANDROID_NDK_HOME/[% c("var/toolchain_arch") %] +[% END -%] export SOURCE_DATE_EPOCH='[% c("timestamp") %]' ./Configure [% c('var/configure_opts') %] make diff --git a/projects/openssl/config b/projects/openssl/config index 450c4c9..c0861b6 100644 --- a/projects/openssl/config +++ b/projects/openssl/config @@ -22,6 +22,9 @@ targets: osx-x86_64: var: configure_opts: --cross-compile-prefix=x86_64-apple-darwin11- darwin64-x86_64-cc enable-ec_nistp_64_gcc_128 + android: + var: + configure_opts: CC=clang android-[% c("var/toolchain_arch") %] -no-shared input_files: - project: container-image

1 0

[tor-browser-build/maint-9.0] Bump build2 for ChangeLog change
by sysrqb＠torproject.org 09 Mar '20

09 Mar '20

commit e0c84715fb706a7feaf2da84aac80364ce2309c8 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Mon Mar 9 17:33:33 2020 +0000 Bump build2 for ChangeLog change --- rbm.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rbm.conf b/rbm.conf index 99c0de3..4fbcc85 100644 --- a/rbm.conf +++ b/rbm.conf @@ -25,7 +25,7 @@ buildconf: var: torbrowser_version: '9.0.6' - torbrowser_build: 'build1' + torbrowser_build: 'build2' torbrowser_incremental_from: - 9.0.5 project_name: tor-browser

1 0

[tor-browser-build/maint-9.0] Patch for bug 33535 is only applied on Windows
by sysrqb＠torproject.org 09 Mar '20

09 Mar '20

commit 36d11459e435ca2091cd8c07b501507c8dfcf108 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Mon Mar 9 17:32:06 2020 +0000 Patch for bug 33535 is only applied on Windows --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index be2559b..38a4fad 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -4,7 +4,7 @@ Tor Browser 9.0.6 -- March 11 2020 * Bump NoScript to 11.0.15 * Bug 33430: Disable downloadable fonts on Safest security level * Build System - * All Platforms + * Windows * Bug 33535: Patch openssl to use SOURCE_DATE_EPOCH for copyright year Tor Browser 9.0.5 -- February 11 2020

1 0

[tor-browser-build/maint-9.0] Add #33430 in ChangeLog
by sysrqb＠torproject.org 09 Mar '20

09 Mar '20

commit 7f44d23d5fe6327aa813f1789ae3164dc60de609 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Mon Mar 9 17:21:14 2020 +0000 Add #33430 in ChangeLog --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 6b7748d..be2559b 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -2,6 +2,7 @@ Tor Browser 9.0.6 -- March 11 2020 * All Platforms * Update Firefox to 68.6.0esr * Bump NoScript to 11.0.15 + * Bug 33430: Disable downloadable fonts on Safest security level * Build System * All Platforms * Bug 33535: Patch openssl to use SOURCE_DATE_EPOCH for copyright year

1 0

[tor-browser-build/maint-9.0] Release preparations for 9.0.6
by sysrqb＠torproject.org 09 Mar '20

09 Mar '20

commit 1f1087cd9cc350585bc1f1737cf0030d4bf3b810 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Sat Mar 7 19:14:32 2020 +0000 Release preparations for 9.0.6 Versions bump and Changelog update --- projects/firefox-langpacks/config | 2 +- projects/firefox-locale-bundle/config | 2 +- projects/firefox/config | 4 ++-- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 8 ++++++++ projects/tor-browser/config | 4 ++-- rbm.conf | 6 +++--- 6 files changed, 17 insertions(+), 9 deletions(-) diff --git a/projects/firefox-langpacks/config b/projects/firefox-langpacks/config index 34d6fad..17a707a 100644 --- a/projects/firefox-langpacks/config +++ b/projects/firefox-langpacks/config @@ -4,7 +4,7 @@ filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/buil var: ff_version: '[% pc("firefox", "var/firefox_version") %]' - ff_build: build1 + ff_build: build2 input_filename: 'dl-langpack-[% c("var/ff_arch") %]-[% c("version") %]' targets: diff --git a/projects/firefox-locale-bundle/config b/projects/firefox-locale-bundle/config index 2f4997f..2ea6db6 100644 --- a/projects/firefox-locale-bundle/config +++ b/projects/firefox-locale-bundle/config @@ -5,4 +5,4 @@ filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' var: use_container: 0 ff_version: '[% pc("firefox", "var/firefox_version") %]' - ff_build: build1 + ff_build: build2 diff --git a/projects/firefox/config b/projects/firefox/config index 87010ee..36ec737 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -1,14 +1,14 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' filename: 'firefox-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build2' +git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build1' tag_gpg_id: 1 git_url: https://git.torproject.org/tor-browser.git git_submodule: 1 gpg_keyring: torbutton.gpg var: - firefox_platform_version: 68.5.0 + firefox_platform_version: 68.6.0 firefox_version: '[% c("var/firefox_platform_version") %]esr' torbrowser_branch: 9.0 torbrowser_update_channel: alpha diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index c542ef0..6b7748d 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,11 @@ +Tor Browser 9.0.6 -- March 11 2020 + * All Platforms + * Update Firefox to 68.6.0esr + * Bump NoScript to 11.0.15 + * Build System + * All Platforms + * Bug 33535: Patch openssl to use SOURCE_DATE_EPOCH for copyright year + Tor Browser 9.0.5 -- February 11 2020 * All Platforms * Update Firefox to 68.5.0esr diff --git a/projects/tor-browser/config b/projects/tor-browser/config index 4e8ee14..c526d59 100644 --- a/projects/tor-browser/config +++ b/projects/tor-browser/config @@ -73,9 +73,9 @@ input_files: enable: '[% c("var/snowflake") %]' - filename: Bundle-Data enable: '[% ! c("var/android") %]' - - URL: https://addons.cdn.mozilla.net/user-media/addons/722/noscript_security_suit… + - URL: https://addons.cdn.mozilla.net/user-media/addons/722/noscript_security_suit… name: noscript - sha256sum: ced718d9d9e719547db392ad85d24a7ad5c6b54cc0f93f9c57f2fcb44bb4de56 + sha256sum: 5e795f711275f9162957321e5245cb0176ce36ce8a2410de95496670af51603d - filename: 'RelativeLink/start-tor-browser.desktop' enable: '[% c("var/linux") %]' - filename: 'RelativeLink/execdesktop' diff --git a/rbm.conf b/rbm.conf index 123d1a8..99c0de3 100644 --- a/rbm.conf +++ b/rbm.conf @@ -24,10 +24,10 @@ buildconf: git_signtag_opt: '-s' var: - torbrowser_version: '9.0.5' - torbrowser_build: 'build3' + torbrowser_version: '9.0.6' + torbrowser_build: 'build1' torbrowser_incremental_from: - - 9.0.4 + - 9.0.5 project_name: tor-browser multi_lingual: 0 build_mar: 1

1 0

[tor-browser-build/master] Bug 33535: Patch openssl to use SOURCE_DATE_EPOCH for copyright year
by sysrqb＠torproject.org 07 Mar '20

07 Mar '20

commit b5e9b4ad94be85ec581b8e7a8aaec42696519dc1 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Mar 5 20:19:48 2020 +0100 Bug 33535: Patch openssl to use SOURCE_DATE_EPOCH for copyright year --- projects/openssl/build | 1 + projects/openssl/config | 2 ++ projects/openssl/use-SOURCE_DATE_EPOCH.patch | 25 +++++++++++++++++++++++++ 3 files changed, 28 insertions(+) diff --git a/projects/openssl/build b/projects/openssl/build index 3ee3571..5851ff8 100644 --- a/projects/openssl/build +++ b/projects/openssl/build @@ -15,6 +15,7 @@ export CC='gcc -m32' [% END -%] [% IF c("var/windows") -%] patch -p1 < $rootdir/escape-openssldir.patch + patch -p1 < $rootdir/use-SOURCE_DATE_EPOCH.patch [% END -%] export SOURCE_DATE_EPOCH='[% c("timestamp") %]' ./Configure [% c('var/configure_opts') %] diff --git a/projects/openssl/config b/projects/openssl/config index 0a60c24..450c4c9 100644 --- a/projects/openssl/config +++ b/projects/openssl/config @@ -31,3 +31,5 @@ input_files: sha256sum: 1e3a91bc1f9dfce01af26026f856e064eab4c8ee0a8f457b5ae30b40b8b711f2 - filename: escape-openssldir.patch enable: '[% c("var/windows") %]' + - filename: use-SOURCE_DATE_EPOCH.patch + enable: '[% c("var/windows") %]' diff --git a/projects/openssl/use-SOURCE_DATE_EPOCH.patch b/projects/openssl/use-SOURCE_DATE_EPOCH.patch new file mode 100644 index 0000000..65533bb --- /dev/null +++ b/projects/openssl/use-SOURCE_DATE_EPOCH.patch @@ -0,0 +1,25 @@ +From a1625535fc5127ab8e94043280ef7a983bcfc161 Mon Sep 17 00:00:00 2001 +From: Nicolas Vigier <boklm(a)torproject.org> +Date: Thu, 5 Mar 2020 20:39:05 +0100 +Subject: [PATCH] If SOURCE_DATE_EPOCH is defined, use it for copyright year + +Using the date from SOURCE_DATE_EPOCH instead of the current date makes +it possible to reproduce a build that was built on a different year: +https://reproducible-builds.org/specs/source-date-epoch/ +--- + util/mkrc.pl | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/util/mkrc.pl b/util/mkrc.pl +index 6762bc4a56..e15c071af7 100755 +--- a/util/mkrc.pl ++++ b/util/mkrc.pl +@@ -46,7 +46,7 @@ if ( $filename =~ /openssl/i ) { + $vft = "VFT_APP"; + } + +-my $YEAR = [localtime()]->[5] + 1900; ++my $YEAR = [localtime($ENV{SOURCE_DATE_EPOCH} || time())]->[5] + 1900; + print <<___; + #include <winver.h> +

1 0

[tor-browser-build/maint-9.0] Bug 33535: Patch openssl to use SOURCE_DATE_EPOCH for copyright year
by sysrqb＠torproject.org 07 Mar '20

07 Mar '20

commit 4a2ad0146f9ad09eca816f07335df2a627ede6a1 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Mar 5 20:19:48 2020 +0100 Bug 33535: Patch openssl to use SOURCE_DATE_EPOCH for copyright year --- projects/openssl/build | 1 + projects/openssl/config | 2 ++ projects/openssl/use-SOURCE_DATE_EPOCH.patch | 25 +++++++++++++++++++++++++ 3 files changed, 28 insertions(+) diff --git a/projects/openssl/build b/projects/openssl/build index 3ee3571..5851ff8 100644 --- a/projects/openssl/build +++ b/projects/openssl/build @@ -15,6 +15,7 @@ export CC='gcc -m32' [% END -%] [% IF c("var/windows") -%] patch -p1 < $rootdir/escape-openssldir.patch + patch -p1 < $rootdir/use-SOURCE_DATE_EPOCH.patch [% END -%] export SOURCE_DATE_EPOCH='[% c("timestamp") %]' ./Configure [% c('var/configure_opts') %] diff --git a/projects/openssl/config b/projects/openssl/config index 0a60c24..450c4c9 100644 --- a/projects/openssl/config +++ b/projects/openssl/config @@ -31,3 +31,5 @@ input_files: sha256sum: 1e3a91bc1f9dfce01af26026f856e064eab4c8ee0a8f457b5ae30b40b8b711f2 - filename: escape-openssldir.patch enable: '[% c("var/windows") %]' + - filename: use-SOURCE_DATE_EPOCH.patch + enable: '[% c("var/windows") %]' diff --git a/projects/openssl/use-SOURCE_DATE_EPOCH.patch b/projects/openssl/use-SOURCE_DATE_EPOCH.patch new file mode 100644 index 0000000..65533bb --- /dev/null +++ b/projects/openssl/use-SOURCE_DATE_EPOCH.patch @@ -0,0 +1,25 @@ +From a1625535fc5127ab8e94043280ef7a983bcfc161 Mon Sep 17 00:00:00 2001 +From: Nicolas Vigier <boklm(a)torproject.org> +Date: Thu, 5 Mar 2020 20:39:05 +0100 +Subject: [PATCH] If SOURCE_DATE_EPOCH is defined, use it for copyright year + +Using the date from SOURCE_DATE_EPOCH instead of the current date makes +it possible to reproduce a build that was built on a different year: +https://reproducible-builds.org/specs/source-date-epoch/ +--- + util/mkrc.pl | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/util/mkrc.pl b/util/mkrc.pl +index 6762bc4a56..e15c071af7 100755 +--- a/util/mkrc.pl ++++ b/util/mkrc.pl +@@ -46,7 +46,7 @@ if ( $filename =~ /openssl/i ) { + $vft = "VFT_APP"; + } + +-my $YEAR = [localtime()]->[5] + 1900; ++my $YEAR = [localtime($ENV{SOURCE_DATE_EPOCH} || time())]->[5] + 1900; + print <<___; + #include <winver.h> +

1 0

[tor-browser-spec/master] Bug 33523: Rename the previous update responses directory to .old
by gk＠torproject.org 06 Mar '20

06 Mar '20

commit 02500b653b55a6e6241aee58cbff245fac2fb758 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Mar 4 12:18:43 2020 +0100 Bug 33523: Rename the previous update responses directory to .old In order to make it easier to quickly disable an update in case of issue. --- processes/ReleaseProcess | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/processes/ReleaseProcess b/processes/ReleaseProcess index f6256db..7d731d9 100644 --- a/processes/ReleaseProcess +++ b/processes/ReleaseProcess @@ -200,7 +200,10 @@ chmod 664 ${TORBROWSER_UPDATE_CHANNEL}/* chmod 664 ${TORBROWSER_UPDATE_CHANNEL}/.htaccess chmod 775 ${TORBROWSER_UPDATE_CHANNEL}/ - torsocks ssh staticiforme.torproject.org "rm -rf /srv/aus1-master.torproject.org/htdocs/torbrowser/update_3/${TORBROWSER_UPDATE_CHANNEL}/*" + # Rename the update responses directory to .old to make it easier to + # revert in case of problem + torsocks ssh staticiforme.torproject.org "rm -rf /srv/aus1-master.torproject.org/htdocs/torbrowser/update_3/${TORBROWSER_UPDATE_CHANNEL}.old" + torsocks ssh staticiforme.torproject.org "mv -v /srv/aus1-master.torproject.org/htdocs/torbrowser/update_3/${TORBROWSER_UPDATE_CHANNEL} /srv/aus1-master.torproject.org/htdocs/torbrowser/update_3/${TORBROWSER_UPDATE_CHANNEL}.old" torsocks rsync -avP $TORBROWSER_UPDATE_CHANNEL staticiforme.torproject.org:/srv/aus1-master.torproject.org/htdocs/torbrows… torsocks ssh staticiforme.torproject.org "chown -R :torwww /srv/aus1-master.torproject.org/htdocs/torbrowser/update_3/${TORBROWSER_UPDATE_CHANNEL}/*" torsocks ssh staticiforme.torproject.org "static-update-component aus1.torproject.org"

1 0

[tor-browser-build/master] Bug 23384: Add user cohosh on build-sunet-a.torproject.net
by boklm＠torproject.org 04 Mar '20

04 Mar '20

commit 5954b38459a3831b92df64c70960fd737331335e Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Mar 4 18:08:22 2020 +0100 Bug 23384: Add user cohosh on build-sunet-a.torproject.net --- tools/ansible/roles/tbb-team/defaults/main.yml | 1 + tools/ansible/roles/tbb-team/files/cohosh.pub | 1 + 2 files changed, 2 insertions(+) diff --git a/tools/ansible/roles/tbb-team/defaults/main.yml b/tools/ansible/roles/tbb-team/defaults/main.yml index a1c091d..4ce9c03 100644 --- a/tools/ansible/roles/tbb-team/defaults/main.yml +++ b/tools/ansible/roles/tbb-team/defaults/main.yml @@ -2,6 +2,7 @@ tbb_team_members: - boklm - brade + - cohosh - gk - mcs - mikeperry diff --git a/tools/ansible/roles/tbb-team/files/cohosh.pub b/tools/ansible/roles/tbb-team/files/cohosh.pub new file mode 100644 index 0000000..907a763 --- /dev/null +++ b/tools/ansible/roles/tbb-team/files/cohosh.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILDttnqVcCBFEtAfbYM0POVjAt5fBVwNPU3IUPhxLJnw

1 0