January 2022 - tbb-commits - lists.torproject.org

[tor-browser-build/master] Revert "Bug 40420: Temporarily stop building ofs4 master on nightly"
by boklm＠torproject.org 31 Jan '22

31 Jan '22

commit 9f0ce975cab384e83905706414f14ac83ccbd1af Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Jan 31 20:08:51 2022 +0100 Revert "Bug 40420: Temporarily stop building ofs4 master on nightly" This reverts commit 247d79f92476f65998962ba3ed4eb187b0d59e9d. --- projects/obfs4/config | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/projects/obfs4/config b/projects/obfs4/config index 80b39c1..eec61bb 100644 --- a/projects/obfs4/config +++ b/projects/obfs4/config @@ -10,6 +10,12 @@ var: container: use_container: 1 +targets: + nightly: + git_hash: master + version: '[% c("abbrev") %]' + tag_gpg_id: 0 + input_files: - project: container-image - name: go

1 0

[tor-browser-build/master] Bug 40416: updated obfsproxy to 0.0.12
by boklm＠torproject.org 31 Jan '22

31 Jan '22

commit d3e8a8ac42ae311a1f76d1b453c34a492d65deca Author: Pier Angelo Vendrame <pierov(a)torproject.org> Date: Mon Jan 24 09:29:46 2022 +0100 Bug 40416: updated obfsproxy to 0.0.12 --- projects/edwards25519-extra/config | 31 +++++++++++++++++++++++++++++++ projects/edwards25519/config | 17 +++++++++++++++++ projects/gobsaes/config | 8 ++++++-- projects/goutls/config | 3 +-- projects/goutls/sessionid.patch | 25 ------------------------- projects/obfs4/build | 3 ++- projects/obfs4/config | 14 ++++++++------ 7 files changed, 65 insertions(+), 36 deletions(-) diff --git a/projects/edwards25519-extra/config b/projects/edwards25519-extra/config new file mode 100644 index 0000000..2aa7390 --- /dev/null +++ b/projects/edwards25519-extra/config @@ -0,0 +1,31 @@ +# vim: filetype=yaml sw=2 +version: '[% c("abbrev") %]' +git_url: https://gitlab.com/yawning/edwards25519-extra.git +git_hash: 2f91fcc9fbdb888f3c795849b6777940135559b7 +filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' + +build: '[% c("projects/go/var/build_go_lib") %]' + +var: + container: + use_container: 1 + go_lib: gitlab.com/yawning/edwards25519-extra.git + go_lib_deps: + - goxcrypto + - edwards25519 + go_lib_install: + - gitlab.com/yawning/edwards25519-extra.git/elligator2 + - gitlab.com/yawning/edwards25519-extra.git/h2c + - gitlab.com/yawning/edwards25519-extra.git/vrf + +input_files: + - project: container-image + - name: go + project: go + - name: goxcrypto + project: goxcrypto + - name: edwards25519 + project: edwards25519 + - name: '[% c("var/compiler") %]' + project: '[% c("var/compiler") %]' + enable: '[% c("var/android") %]' diff --git a/projects/edwards25519/config b/projects/edwards25519/config new file mode 100644 index 0000000..0f3377d --- /dev/null +++ b/projects/edwards25519/config @@ -0,0 +1,17 @@ +# vim: filetype=yaml sw=2 +version: '[% c("abbrev") %]' +git_url: https://github.com/FiloSottile/edwards25519.git +git_hash: 390f27c3be2014e4912ce88c6a1fff52ec60428b +filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' + +build: '[% c("projects/go/var/build_go_lib") %]' + +var: + container: + use_container: 1 + go_lib: filippo.io/edwards25519 + +input_files: + - project: container-image + - name: go + project: go diff --git a/projects/gobsaes/config b/projects/gobsaes/config index 3674488..cd8af1a 100644 --- a/projects/gobsaes/config +++ b/projects/gobsaes/config @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 git_url: https://gitlab.com/yawning/bsaes.git version: '[% c("abbrev") %]' -git_hash: 26d1add596b6d800bdeeb3bc3b2c7b316c056b6d +git_hash: 0a714cd429ec754482b4001e918db30cd2094405 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' build: '[% c("projects/go/var/build_go_lib") %]' @@ -9,7 +9,9 @@ build: '[% c("projects/go/var/build_go_lib") %]' var: container: use_container: 1 - go_lib: git.schwanenlied.me/yawning/bsaes.git + go_lib: gitlab.com/yawning/bsaes.git + go_lib_deps: + - goxsys targets: android: @@ -21,6 +23,8 @@ input_files: - project: container-image - name: go project: go + - name: goxsys + project: goxsys - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]' enable: '[% c("var/android") %]' diff --git a/projects/goutls/config b/projects/goutls/config index 7a46517..8052176 100644 --- a/projects/goutls/config +++ b/projects/goutls/config @@ -1,6 +1,6 @@ # vim: filetype=yaml sw=2 git_url: https://gitlab.com/yawning/utls.git -version: 0.0.10-1 +version: 0.0.12-1 git_hash: 'v[% c("version") %]' tag_gpg_id: 1 gpg_keyring: yawning.gpg @@ -33,7 +33,6 @@ input_files: project: gocompress - name: gobsaes project: gobsaes - - filename: sessionid.patch - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]' enable: '[% c("var/android") %]' diff --git a/projects/goutls/sessionid.patch b/projects/goutls/sessionid.patch deleted file mode 100644 index fd3636d..0000000 --- a/projects/goutls/sessionid.patch +++ /dev/null @@ -1,25 +0,0 @@ -From 4da67951864128358459681399dd208c49d5d001 Mon Sep 17 00:00:00 2001 -From: Rod Hynes <rod-hynes(a)users.noreply.github.com> -Date: Mon, 12 Aug 2019 17:06:06 -0400 -Subject: [PATCH] Fix all-zeroes SessionID (#31) - ---- - u_conn.go | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/u_conn.go b/u_conn.go -index 9079460..2706373 100644 ---- a/u_conn.go -+++ b/u_conn.go -@@ -121,7 +121,7 @@ func (uconn *UConn) SetSessionState(session *ClientSessionState) error { - } - } - var sessionID [32]byte -- _, err := io.ReadFull(uconn.config.rand(), uconn.HandshakeState.Hello.SessionId) -+ _, err := io.ReadFull(uconn.config.rand(), sessionID[:]) - if err != nil { - return err - } --- -2.22.0 - diff --git a/projects/obfs4/build b/projects/obfs4/build index b57b0c5..3aa2167 100644 --- a/projects/obfs4/build +++ b/projects/obfs4/build @@ -13,7 +13,8 @@ mkdir -p $PTDIR [% END -%] tar -C /var/tmp/dist -xf [% c('input_files_by_name/goptlib') %] -tar -C /var/tmp/dist -xf [% c('input_files_by_name/ed25519') %] +tar -C /var/tmp/dist -xf [% c('input_files_by_name/edwards25519') %] +tar -C /var/tmp/dist -xf [% c('input_files_by_name/edwards25519-extra') %] tar -C /var/tmp/dist -xf [% c('input_files_by_name/siphash') %] tar -C /var/tmp/dist -xf [% c('input_files_by_name/goxcrypto') %] tar -C /var/tmp/dist -xf [% c('input_files_by_name/goxnet') %] diff --git a/projects/obfs4/config b/projects/obfs4/config index eec61bb..a05d2d4 100644 --- a/projects/obfs4/config +++ b/projects/obfs4/config @@ -1,8 +1,8 @@ # vim: filetype=yaml sw=2 -version: 0.0.11 -git_url: https://git.torproject.org/pluggable-transports/obfs4.git -git_hash: 40245c4a1cf221395c59d1f4bf274127045352f9 -tag_gpg_id: 0 +version: 0.0.12 +git_url: https://gitlab.com/yawning/obfs4.git +git_hash: 'obfs4proxy-[% c("version") %]' +tag_gpg_id: 1 gpg_keyring: yawning.gpg filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' @@ -22,8 +22,10 @@ input_files: project: go - name: goptlib project: goptlib - - name: ed25519 - project: ed25519 + - name: edwards25519 + project: edwards25519 + - name: edwards25519-extra + project: edwards25519-extra - name: siphash project: siphash - name: goxcrypto

1 0

[tor-browser-build/master] Bug 40400: Add tools/changelog-format-blog-post
by gk＠torproject.org 28 Jan '22

28 Jan '22

commit ffc2c49558b9f7c330152987176af4d71f32fc0e Author: Nicolas Vigier <boklm(a)torproject.org> Date: Tue Dec 14 13:20:23 2021 +0100 Bug 40400: Add tools/changelog-format-blog-post --- tools/changelog-format-blog-post | 53 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) diff --git a/tools/changelog-format-blog-post b/tools/changelog-format-blog-post new file mode 100755 index 0000000..a50ae8f --- /dev/null +++ b/tools/changelog-format-blog-post @@ -0,0 +1,53 @@ +#!/usr/bin/perl -w + +# This script reads the ChangeLog.txt file and outputs it to stdout +# in the format for the blog post. + +use strict; +use FindBin; + +sub version_type { + return $_[0] =~ 'a' ? 'alpha' : 'release'; +} + +my ($changelog, $current_tbversion, $last_tbversion); + +if (!open(CHANGELOG, '<', "$FindBin::Bin/../ChangeLog.txt")) { + print STDERR "Error opening changelog file\n"; + exit 1; +} + +foreach (<CHANGELOG>) { + if (m/^Tor Browser ([^\s]+) -/) { + if ($current_tbversion) { + $last_tbversion = $1; + last if version_type($current_tbversion) eq version_type($last_tbversion); + next; + } + $current_tbversion = $1; + next; + } + + next if $last_tbversion; + + # Remove one space at the begining of all lines + s/^\s//; + + # Replace '*' by '-' + s/^(\s*)\*/$1-/; + + s/&/&/; s/</</; s/>/>/; + + # Change bug numbers to links + s|Bug (\d+): ([^\[]+) \[([^\]]+)\]|[Bug $3#$1](https://gitlab.torproject.org/tpo/applications/$3/-/issues/$1): $2|; + + $changelog .= $_; +} + +my $changelog_branch = 'master'; +if (! ( $current_tbversion =~ m/a/ ) ) { + my @v = split(/\./, $current_tbversion); + $changelog_branch = "maint-$v[0].$v[1]"; +} +print "The full changelog since [Tor Browser $last_tbversion](https://gitweb.torproject.org/builders/tor-browser-build.git/plain/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt?h=$changelog_branch) is:\n\n"; +print $changelog;

1 0

[tor-browser-build/master] Bug 40420: Temporarily stop building ofs4 master on nightly
by boklm＠torproject.org 28 Jan '22

28 Jan '22

commit 247d79f92476f65998962ba3ed4eb187b0d59e9d Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri Jan 28 12:39:44 2022 +0100 Bug 40420: Temporarily stop building ofs4 master on nightly To avoid a build failure on nightly, don't build the master branch of obfs4 in nightly builds. We should revert this after #40416 is merged. --- projects/obfs4/config | 6 ------ 1 file changed, 6 deletions(-) diff --git a/projects/obfs4/config b/projects/obfs4/config index eec61bb..80b39c1 100644 --- a/projects/obfs4/config +++ b/projects/obfs4/config @@ -10,12 +10,6 @@ var: container: use_container: 1 -targets: - nightly: - git_hash: master - version: '[% c("abbrev") %]' - tag_gpg_id: 0 - input_files: - project: container-image - name: go

1 0

[tor-browser-spec/master] Bug 40015: Add FF81 audit
by richard＠torproject.org 27 Jan '22

27 Jan '22

commit d88fc79d206438700b724e2b4b2cf9fce005ed37 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Jan 20 16:40:00 2022 +0000 Bug 40015: Add FF81 audit --- audits/FF81_NETWORK_AUDIT | 55 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) diff --git a/audits/FF81_NETWORK_AUDIT b/audits/FF81_NETWORK_AUDIT new file mode 100644 index 0000000..ef138b7 --- /dev/null +++ b/audits/FF81_NETWORK_AUDIT @@ -0,0 +1,55 @@ +============ General ============= + +The audit begins at the commit hash where the previous audit ended. Use +code_audit.sh for creating the diff and highlighting potentially problematic +code. The audit is scoped to a specific language (currently C/C++, Rust, +Java/Kotlin, and Javascript). + +The output includes the entire patch where the new problematic code was +introduced. Search for "XXX MATCH XXX" to find the next potential violation. + +code_audit.sh contains the list of known problematic APIs. New usage of these +functions are documented and analyzed in this audit. + +============ Firefox General Portion ============= + +(Note: While we later on use FIREFOX_XXX_BUILDN targets we use the _BASE ones + here as we do the audit retrospectively, long after those releases went out.) + +Start: 84cb11f03ecea33982cb53086c25d6b6df8b28cf # FIREFOX_RELEASE_80_BASE +End: f127e1315fb82a7cc784b0c9928a062ae1e9ca7e # FIREFOX_RELEASE_81_BASE + +# https://bugzilla.mozilla.org/show_bug.cgi?id=1657582 (DNS code related + refactoring), looks okay. + +# Nothing else of interest (using `code_audit.sh`) + +============ Application Services Portion ============= + +Start: dd09c25f14dbf45f1637ed8dca2d1e5ff668479f # v61.0.10 +End: 89ea9cfa6eaa0763d17ec9aa04098839d028004c # v61.0.13 + +Nothing new. + +============ Android Components Portion ============= + +Start: cfc360e0587ccb7eb49689d08212f05ff0966fbb # v54.0.6 +End: eb4aebb91eb39a47c05fdf0b2cb1100c80cd344f # v57.0.4 (which is used by + Fenix v81.1.1-beta.3) + +Nothing new. + +============ Fenix Portion ============= + +Start: bad13cc48c526fcc8ed2de5c58da1ae4a3b392dd # v80.1.3 +End: b54949e58f9fda3698ada3e64b9f4337177d84f0 # (HEAD~1 v81.1.1-beta.3) + +# Issue #1216 voice input for search +# - I opened fenix#40204 for further investigation. + +============ Regression/Prior Vuln Review ========= + +Review proxy bypass bugs; check for new vectors to look for: + - https://gitlab.torproject.org/groups/tpo/applications/-/issues?scope=all&ut… + - Look for new features like these. Especially external app launch vectors +

1 0

[tor-browser-spec/master] Bug 40015: Add FF80 audit
by richard＠torproject.org 27 Jan '22

27 Jan '22

commit 46f05a52f521767113d6e115def4e9ef1d1a671d Author: Georg Koppen <gk(a)torproject.org> Date: Wed Jan 26 12:26:49 2022 +0000 Bug 40015: Add FF80 audit --- audits/FF80_NETWORK_AUDIT | 57 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 57 insertions(+) diff --git a/audits/FF80_NETWORK_AUDIT b/audits/FF80_NETWORK_AUDIT new file mode 100644 index 0000000..11bda7c --- /dev/null +++ b/audits/FF80_NETWORK_AUDIT @@ -0,0 +1,57 @@ +============ General ============= + +The audit begins at the commit hash where the previous audit ended. Use +code_audit.sh for creating the diff and highlighting potentially problematic +code. The audit is scoped to a specific language (currently C/C++, Rust, +Java/Kotlin, and Javascript). + +The output includes the entire patch where the new problematic code was +introduced. Search for "XXX MATCH XXX" to find the next potential violation. + +code_audit.sh contains the list of known problematic APIs. New usage of these +functions are documented and analyzed in this audit. + +============ Firefox General Portion ============= + +(Note: While we later on use FIREFOX_XXX_BUILDN targets we use the _BASE ones + here as we do the audit retrospectively, long after those releases went out.) + +Start: 2742c5c7b6a244c28f81391c9e1641cc79281ef6 # FIREFOX_RELEASE_79_BASE +End: 84cb11f03ecea33982cb53086c25d6b6df8b28cf # FIREFOX_RELEASE_80_BASE + +# https://bugzilla.mozilla.org/show_bug.cgi?id=1618271 got fixed, yay! + +# Nothing else of interest (using `code_audit.sh`) + +============ Application Services Portion ============= + +Start: dd09c25f14dbf45f1637ed8dca2d1e5ff668479f # v61.0.10 +End: dd09c25f14dbf45f1637ed8dca2d1e5ff668479f # v61.0.10 + +Nothing new, same commit. + +============ Android Components Portion ============= + +Start: 8755ac0cdd88f2d549f65039413c41b6ccc02c5f # v48.0.15 +End: cfc360e0587ccb7eb49689d08212f05ff0966fbb # v54.0.6 + +# Issue #4772 Improve our download manger to be able to forward downloads to + external download manager +# - should be okay +# +# Issue #7366 Provide request interceptor to automatically navigate into PWAs +# - should be covered by android-components#34333 + +============ Fenix Portion ============= + +Start: 6cb548575ff3af5c122c6a80d68a3dd483c596e7 # v79.0.5 +End: bad13cc48c526fcc8ed2de5c58da1ae4a3b392dd # v80.1.3 + +Nothing new. + +============ Regression/Prior Vuln Review ========= + +Review proxy bypass bugs; check for new vectors to look for: + - https://gitlab.torproject.org/groups/tpo/applications/-/issues?scope=all&ut… + - Look for new features like these. Especially external app launch vectors +

1 0

[tor-browser-spec/master] Bug 40015: Add FF79 Audit
by richard＠torproject.org 27 Jan '22

27 Jan '22

commit 10a554de09ed718fd04f45026307dc815037dd97 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Jan 27 09:26:42 2022 +0000 Bug 40015: Add FF79 Audit --- audits/FF79_NETWORK_AUDIT | 60 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 60 insertions(+) diff --git a/audits/FF79_NETWORK_AUDIT b/audits/FF79_NETWORK_AUDIT new file mode 100644 index 0000000..eedde34 --- /dev/null +++ b/audits/FF79_NETWORK_AUDIT @@ -0,0 +1,60 @@ +============ General ============= + +The audit begins at the commit hash where the previous audit ended. Use +code_audit.sh for creating the diff and highlighting potentially problematic +code. The audit is scoped to a specific language (currently C/C++, Rust, +Java/Kotlin, and Javascript). + +The output includes the entire patch where the new problematic code was +introduced. Search for "XXX MATCH XXX" to find the next potential violation. + +code_audit.sh contains the list of known problematic APIs. New usage of these +functions are documented and analyzed in this audit. + +============ Firefox General Portion ============= + +(Note: While we later on use FIREFOX_XXX_BUILDN targets we use the _BASE ones + here as we do the audit retrospectively, long after those releases went out.) + +Start: 53e19ba9c60bf6beb91d1968641e6e56c5fe702b # FIREFOX_RELEASE_78_BASE +End: 2742c5c7b6a244c28f81391c9e1641cc79281ef6 # FIREFOX_RELEASE_79_BASE + +# https://bugzilla.mozilla.org/show_bug.cgi?id=1628792 updated the exoplayer +# library. Our proxy safeguard +# (https://bugzilla.mozilla.org/show_bug.cgi?id=1459420) is kept. + +# Nothing else of interest (using `code_audit.sh`) + +============ Application Services Portion ============= + +Start: 762791bd1ae8a7bf750208b6aab6ddb1cc4ea04c # v61.0.2 +End: dd09c25f14dbf45f1637ed8dca2d1e5ff668479f # v61.0.10 + +Nothing of interest. + +============ Android Components Portion ============= + +Start: 88694edfb7f97e2d5db9c22db5edd5a4eb621621 # (48.0.20200626213814 is the + version that gets used by + Fenix v78.0.1-beta.1 but it's + not exactly clear which + commit that corresponds to. + Thus, we play safe and use + v47.0.0) +End: 8755ac0cdd88f2d549f65039413c41b6ccc02c5f # v48.0.15 + +Nothing of interest. + +============ Fenix Portion ============= + +Start: e0fa1c0db4ff806c991b13906ef6a30ba4d6054d # v78.0.1-beta.1 +End: 6cb548575ff3af5c122c6a80d68a3dd483c596e7 # v79.0.5 + +Nothing new. + +============ Regression/Prior Vuln Review ========= + +Review proxy bypass bugs; check for new vectors to look for: + - https://gitlab.torproject.org/groups/tpo/applications/-/issues?scope=all&ut… + - Look for new features like these. Especially external app launch vectors +

1 0

[tor-browser-spec/master] Fix typos
by richard＠torproject.org 27 Jan '22

27 Jan '22

commit 144aff729eeb102d4741f44263f314b593777e30 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Jan 26 10:48:46 2022 +0000 Fix typos --- audits/FF91_NETWORK_AUDIT | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/audits/FF91_NETWORK_AUDIT b/audits/FF91_NETWORK_AUDIT index 21d9b62..99de476 100644 --- a/audits/FF91_NETWORK_AUDIT +++ b/audits/FF91_NETWORK_AUDIT @@ -18,13 +18,12 @@ End: e0fdc6e4749b33693b75b92309ba2a982a9bdfa9 # FIREFOX_91_0_BUILD2 # Nothing of interest (using `code_audit.sh`) - ============ Application Services Portion ============= Start: dd09c25f14dbf45f1637ed8dca2d1e5ff668479f # v77.0.2 End: 89ea9cfa6eaa0763d17ec9aa04098839d028004c # v79.0.0 -Nothin new. +Nothing new. ============ Android Components Portion =============

1 0

[tor-browser/tor-browser-91.5.0esr-11.5-1] fixup! Add TorStrings module for localization
by richard＠torproject.org 27 Jan '22

27 Jan '22

commit 8ef60e4178db89eaa8c70fb5da0f4b0d682097c0 Author: Pier Angelo Vendrame <pierov(a)torproject.org> Date: Fri Jan 14 09:35:36 2022 +0100 fixup! Add TorStrings module for localization Fixes #40777. --- browser/modules/TorStrings.jsm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/browser/modules/TorStrings.jsm b/browser/modules/TorStrings.jsm index 73671c08693d..0ccbbb41a782 100644 --- a/browser/modules/TorStrings.jsm +++ b/browser/modules/TorStrings.jsm @@ -443,7 +443,7 @@ var TorStrings = { offline: getStringNet("torConnect.offline", "Offline"), // tor connect strings for message box in about:preferences#tor - connectMessage: getStringNet("torConnect.connectMessage", "Changes to Tor Settings will not take effect until you connect to the Tor Network"), + connectMessage: getStringNet("torConnect.connectMessage", "Changes to Tor Settings will not take effect until you connect"), tryAgainMessage: getStringNet("torConnect.tryAgainMessage", "Tor Browser has failed to establish a connection to the Tor Network"), }; })(),

1 0

[Git][tpo/applications/fenix] Pushed new branch tor-browser-96.2.0-11.5-1
by boklm (＠boklm) 25 Jan '22

25 Jan '22

boklm pushed new branch tor-browser-96.2.0-11.5-1 at The Tor Project / Applications / fenix -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/fenix/-/tree/tor-browser-96.… You're receiving this email because of your account on gitlab.torproject.org.

1 0