November 2022 - tbb-commits - lists.torproject.org

[builders/tor-browser-build] branch main updated (7d6a2d1b -> 98b4184d)
by gitolite role 07 Nov '22

07 Nov '22

This is an automated email from the git hooks/post-receive script. pierov pushed a change to branch main in repository builders/tor-browser-build. from 7d6a2d1b Bug 40676: Remove HTTPS-Everywhere from the repackage script new 87987543 Bug 40641: Add projects/firefox-l10n new 1e12d726 Bug 40641: Use packaged locales on Firefox new 98b4184d Bug 40641: Remove langpacks and single-locale support The 3 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: README | 4 +- projects/browser/build | 154 ++------------------------------------ projects/browser/config | 3 - projects/firefox-l10n/build | 6 ++ projects/firefox-l10n/config | 45 +++++++++++ projects/firefox-langpacks/build | 16 ---- projects/firefox-langpacks/config | 50 ------------- projects/firefox/build | 16 +++- projects/firefox/config | 5 ++ rbm | 2 +- rbm.conf | 1 - tools/signing/check_file_counts | 7 -- 12 files changed, 80 insertions(+), 229 deletions(-) create mode 100644 projects/firefox-l10n/build create mode 100644 projects/firefox-l10n/config delete mode 100644 projects/firefox-langpacks/build delete mode 100644 projects/firefox-langpacks/config -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 3

[builders/tor-browser-build] branch maint-11.5 updated: fixup! Bug 41413: make injected intl.locale.requested sticky
by gitolite role 07 Nov '22

07 Nov '22

This is an automated email from the git hooks/post-receive script. pierov pushed a commit to branch maint-11.5 in repository builders/tor-browser-build. The following commit(s) were added to refs/heads/maint-11.5 by this push: new 89a99e58 fixup! Bug 41413: make injected intl.locale.requested sticky 89a99e58 is described below commit 89a99e58fc5002cc43651fb7ecb6338683ca52eb Author: Dan Ballard <dan(a)mindstab.net> AuthorDate: Mon Nov 7 09:13:46 2022 -0800 fixup! Bug 41413: make injected intl.locale.requested sticky Bug 41413: add sticky to intl.locale.requested --- projects/tor-browser/build | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/tor-browser/build b/projects/tor-browser/build index 691bac90..e639ae30 100644 --- a/projects/tor-browser/build +++ b/projects/tor-browser/build @@ -184,7 +184,7 @@ cp defaults/preferences/000-tor-browser.js $rootdir rm -rf chrome [% END %] # Set the locale of the bundle. -echo "pref(\"intl.locale.requested\", \"en-US\");" >> defaults/preferences/000-tor-browser.js +echo "pref(\"intl.locale.requested\", \"en-US\", sticky);" >> defaults/preferences/000-tor-browser.js [% c("touch") %] defaults/preferences/000-tor-browser.js zip -Xm omni.ja defaults/preferences/000-tor-browser.js rm -rf defaults -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[torbutton] branch maint-11.5 updated: Bug 41105: Match tb-102 use of ClearDataService flags, including proper call to PreflightCacheCleaner included in CLEAR_ALL
by gitolite role 07 Nov '22

07 Nov '22

This is an automated email from the git hooks/post-receive script. pierov pushed a commit to branch maint-11.5 in repository torbutton. The following commit(s) were added to refs/heads/maint-11.5 by this push: new 7d789f2c Bug 41105: Match tb-102 use of ClearDataService flags, including proper call to PreflightCacheCleaner included in CLEAR_ALL 7d789f2c is described below commit 7d789f2ce6595232486456fb8570a4a8d5f01471 Author: Dan Ballard <dan(a)mindstab.net> AuthorDate: Fri Nov 4 14:38:11 2022 -0700 Bug 41105: Match tb-102 use of ClearDataService flags, including proper call to PreflightCacheCleaner included in CLEAR_ALL --- chrome/content/torbutton.js | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/chrome/content/torbutton.js b/chrome/content/torbutton.js index 3bfaa1f8..2f6ff1ee 100644 --- a/chrome/content/torbutton.js +++ b/chrome/content/torbutton.js @@ -571,9 +571,7 @@ async function torbutton_do_new_identity() { try { await clearData( - Services.clearData.CLEAR_DOM_STORAGES | - Services.clearData.CLEAR_MEDIA_DEVICES | - Services.clearData.CLEAR_PREDICTOR_NETWORK_DATA + Services.clearData.CLEAR_ALL ^ Services.clearData.CLEAR_PASSWORDS ); } catch (e) { torbutton_log(5, "Exception on storage clearing: " + e); -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[tor-browser] branch tor-browser-102.4.0esr-12.0-2 updated: Bug 41417: Always prompt users to restart after changing language
by gitolite role 07 Nov '22

07 Nov '22

This is an automated email from the git hooks/post-receive script. pierov pushed a commit to branch tor-browser-102.4.0esr-12.0-2 in repository tor-browser. The following commit(s) were added to refs/heads/tor-browser-102.4.0esr-12.0-2 by this push: new de019e3edec0 Bug 41417: Always prompt users to restart after changing language de019e3edec0 is described below commit de019e3edec0f4ead853b5ddb25fd0423d03e916 Author: Pier Angelo Vendrame <pierov(a)torproject.org> AuthorDate: Fri Nov 4 14:10:49 2022 +0100 Bug 41417: Always prompt users to restart after changing language This is a temporary patch that we need until we switch our strings to Fluent. The reason is that we currently set strings when we populate our XUL content. We could rework the whole mechanism, but it is not worth it because we want to switch to Fluent, which will handle everything automatically. --- browser/components/preferences/main.js | 23 ++++++++--------------- 1 file changed, 8 insertions(+), 15 deletions(-) diff --git a/browser/components/preferences/main.js b/browser/components/preferences/main.js index eab384264c4e..af53fa0403f7 100644 --- a/browser/components/preferences/main.js +++ b/browser/components/preferences/main.js @@ -1202,18 +1202,17 @@ var gMainPane = { gMainPane.recordBrowserLanguagesTelemetry("reorder"); switch (gMainPane.getLanguageSwitchTransitionType(newLocales)) { + // tor-browser#41417: Always prompt for the restart, until we switch to + // Fluent, since the current way we use to update languages does not allow + // live-reload. We could also call showConfirmLanguageChangeMessageBar in + // the official live-reload case, but the result is inconsistent and makes + // handling the locales-match case harder. case "requires-restart": + case "live-reload": // Prepare to change the locales, as they were different. gMainPane.showConfirmLanguageChangeMessageBar(newLocales); gMainPane.updatePrimaryBrowserLanguageUI(newLocales[0]); break; - case "live-reload": - Services.locale.requestedLocales = newLocales; - gMainPane.updatePrimaryBrowserLanguageUI( - Services.locale.appLocaleAsBCP47 - ); - gMainPane.hideConfirmLanguageChangeMessageBar(); - break; case "locales-match": // They matched, so we can reset the UI. gMainPane.updatePrimaryBrowserLanguageUI( @@ -1466,18 +1465,12 @@ var gMainPane = { } switch (gMainPane.getLanguageSwitchTransitionType(selected)) { + // tor-browser#41417: see onPrimaryBrowserLanguageMenuChange case "requires-restart": + case "live-reload": gMainPane.showConfirmLanguageChangeMessageBar(selected); gMainPane.updatePrimaryBrowserLanguageUI(selected[0]); break; - case "live-reload": - Services.locale.requestedLocales = selected; - - gMainPane.updatePrimaryBrowserLanguageUI( - Services.locale.appLocaleAsBCP47 - ); - gMainPane.hideConfirmLanguageChangeMessageBar(); - break; case "locales-match": // They matched, so we can reset the UI. gMainPane.updatePrimaryBrowserLanguageUI( -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[builders/tor-browser-build] branch main updated: Bug 40676: Remove HTTPS-Everywhere from the repackage script
by gitolite role 07 Nov '22

07 Nov '22

This is an automated email from the git hooks/post-receive script. boklm pushed a commit to branch main in repository builders/tor-browser-build. The following commit(s) were added to refs/heads/main by this push: new 7d6a2d1b Bug 40676: Remove HTTPS-Everywhere from the repackage script 7d6a2d1b is described below commit 7d6a2d1becb5b78d30eb1cbd2e710280539a50df Author: Pier Angelo Vendrame <pierov(a)torproject.org> AuthorDate: Fri Nov 4 09:46:06 2022 +0100 Bug 40676: Remove HTTPS-Everywhere from the repackage script We do not bundle HTTPS Everywhere anymore, so we do not need to add it to local builds anymore. --- tools/repackage_browser.sh | 8 -------- 1 file changed, 8 deletions(-) diff --git a/tools/repackage_browser.sh b/tools/repackage_browser.sh index 47876735..5498bd24 100755 --- a/tools/repackage_browser.sh +++ b/tools/repackage_browser.sh @@ -48,14 +48,6 @@ do strip "$LIB" done -# Repackage https-everywhere extension -mkdir _omni/ -unzip tor-browser_en-US/Browser/omni.ja -d _omni/ -cd _omni/ -zip -Xmr ../firefox/omni.ja chrome/torbutton/content/extensions/https-everywhere/ -cd .. -rm -rf _omni/ - # Overwrite extracted tor-browser with locally built files and move to _repackaged folder cp -r firefox/* tor-browser_en-US/Browser rm -rf firefox "${TOR_FILENAME}" -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[torbutton] branch main updated: Bug 41293: Use the new Fluent API to register Torbutton as a l10n source
by gitolite role 04 Nov '22

04 Nov '22

This is an automated email from the git hooks/post-receive script. pierov pushed a commit to branch main in repository torbutton. The following commit(s) were added to refs/heads/main by this push: new 004b629b Bug 41293: Use the new Fluent API to register Torbutton as a l10n source 004b629b is described below commit 004b629b21c83133d7c90e0a3656f90d44562746 Author: Pier Angelo Vendrame <pierov(a)torproject.org> AuthorDate: Thu Nov 3 17:13:34 2022 +0100 Bug 41293: Use the new Fluent API to register Torbutton as a l10n source With Firefox 102, we have switched from a JS implementation of Fluent to a Rust one, and the related API has slightly changed. Anyway. since we are switching to packaged locales, we can register them with the jar.mn, rather than using the API. --- components/startup-observer.js | 38 -------------------------------------- jar.mn | 1 + 2 files changed, 1 insertion(+), 38 deletions(-) diff --git a/components/startup-observer.js b/components/startup-observer.js index 090eb7b8..8f9b8cc2 100644 --- a/components/startup-observer.js +++ b/components/startup-observer.js @@ -28,42 +28,6 @@ XPCOMUtils.defineLazyModuleGetters(this, { ComponentUtils: "resource://gre/modules/ComponentUtils.jsm", }); -let registerTranslations = () => {}; -if (parseInt(AppConstants.TOR_BROWSER_VERSION) < 102) { - XPCOMUtils.defineLazyModuleGetters(this, { - FileUtils: "resource://gre/modules/FileUtils.jsm", - FileSource: "resource://gre/modules/L10nRegistry.jsm", - L10nRegistry: "resource://gre/modules/L10nRegistry.jsm", - }); - registerTranslations = () => { - // Using all possible locales so that we do not have to change this list every time we support - // a new one. - /* eslint-disable */ - const allLocales = [ - "en-US", "ach", "af", "an", "ar", "ast", "az", "be", "bg", "bn", "br", "bs", "ca", "cak", - "crh", "cs", "cy", "da", "de", "dsb", "el", "en-CA", "en-GB", "eo", "es-AR", "es-CL", - "es-ES", "es-MX", "et", "eu", "fa", "ff", "fi", "fr", "fy-NL", "ga-IE", "gd", "gl", "gn", - "gu-IN", "he", "hi-IN", "hr", "hsb", "hu", "hy-AM", "ia", "id", "is", "it", "ja", - "ja-JP-mac", "ka", "kab", "kk", "km", "kn", "ko", "lij", "lo", "lt", "ltg", "lv", "mk", "mr", - "ms", "my", "nb-NO", "ne-NP", "nl", "nn-NO", "oc", "pa-IN", "pl", "pt-BR", "pt-PT", "rm", - "ro", "ru", "si", "sk", "sl", "son", "sq", "sr", "sv-SE", "ta", "te", "th", "tl", "tr", - "trs", "uk", "ur", "uz", "vi", "wo", "xh", "zh-CN", "zh-TW" - ]; - /* eslint-enable */ - let torSource = new FileSource( - "torbutton", - allLocales, - "resource://torbutton/locale/{locale}/", - true // skip this FileSource locales when computing Services.locale.availableLocales - ); - if (L10nRegistry.registerSources) { - L10nRegistry.registerSources([torSource]); - } else { - L10nRegistry.registerSource(torSource); - } - }; -} - // Module specific constants const kMODULE_NAME = "Startup"; const kMODULE_CONTRACTID = "@torproject.org/startup-observer;1"; @@ -118,8 +82,6 @@ function StartupObserver() { } cleanupCookies(); - - registerTranslations(); } StartupObserver.prototype = { diff --git a/jar.mn b/jar.mn index 8441f006..06caec8f 100644 --- a/jar.mn +++ b/jar.mn @@ -23,6 +23,7 @@ torbutton.jar: # browser branding % override chrome://branding/locale/brand.dtd chrome://torbutton/locale/brand.dtd % override chrome://branding/locale/brand.properties chrome://torbutton/locale/brand.properties +% category l10n-registry torbutton resource://torbutton/locale/{locale}/ # Strings for the about:tbupdate page % override chrome://browser/locale/aboutTBUpdate.dtd chrome://torbutton/locale/aboutTBUpdate.dtd -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[builders/tor-browser-build] branch main updated: Bug 40675: Update tb_builders list in set-config
by gitolite role 03 Nov '22

03 Nov '22

This is an automated email from the git hooks/post-receive script. richard pushed a commit to branch main in repository builders/tor-browser-build. The following commit(s) were added to refs/heads/main by this push: new fddffa89 Bug 40675: Update tb_builders list in set-config fddffa89 is described below commit fddffa89aeaf44498bcc1ece321313c9b6aaab79 Author: Richard Pospesel <richard(a)torproject.org> AuthorDate: Wed Nov 2 20:09:32 2022 +0000 Bug 40675: Update tb_builders list in set-config --- tools/signing/set-config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/signing/set-config b/tools/signing/set-config index 88a5e655..a6658452 100644 --- a/tools/signing/set-config +++ b/tools/signing/set-config @@ -14,4 +14,4 @@ echo "${BASH_ARGV0:-}" | grep -q '\.dry-run$' && DRY_RUN='--dry-run' test -z "${NON_INTERACTIVE:-}" || rsync_progress="--progress" rsync_options="-avH ${rsync_progress:-} ${DRY_RUN:-}" -tb_builders='boklm gk pierov richard sysrqb' +tb_builders='boklm dan henry ma1 pierov richard' -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[tor-browser] branch tor-browser-102.4.0esr-12.0-2 updated: squash! Firefox preference overrides.
by gitolite role 02 Nov '22

02 Nov '22

This is an automated email from the git hooks/post-receive script. richard pushed a commit to branch tor-browser-102.4.0esr-12.0-2 in repository tor-browser. The following commit(s) were added to refs/heads/tor-browser-102.4.0esr-12.0-2 by this push: new 46dcad9a70ad squash! Firefox preference overrides. 46dcad9a70ad is described below commit 46dcad9a70ad2ed3785f6607e470f927da39be02 Author: Richard Pospesel <richard(a)torproject.org> AuthorDate: Wed Nov 2 20:39:17 2022 +0000 squash! Firefox preference overrides. Bug 40183: Disable TLS ciphersuites using SHA-1 --- browser/app/profile/001-base-profile.js | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/browser/app/profile/001-base-profile.js b/browser/app/profile/001-base-profile.js index caf2f00ad8d6..3f93614a7bbb 100644 --- a/browser/app/profile/001-base-profile.js +++ b/browser/app/profile/001-base-profile.js @@ -79,6 +79,18 @@ pref("dom.security.https_only_mode.upgrade_onion", false); // [4] https://www.ssllabs.com/ssl-pulse/ pref("security.ssl.require_safe_negotiation", true); +// Bug 40183: Disable TLS ciphersuites using SHA-1 +// https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/40183 +pref("security.ssl3.dhe_rsa_aes_128_sha", false, locked); +pref("security.ssl3.dhe_rsa_aes_256_sha", false, locked); +pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false, locked); +pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false, locked); +pref("security.ssl3.ecdhe_rsa_aes_128_sha", false, locked); +pref("security.ssl3.ecdhe_rsa_aes_256_sha", false, locked); +pref("security.ssl3.rsa_aes_128_sha", false, locked); +pref("security.ssl3.rsa_aes_256_sha", false, locked); + + // Misc privacy: Remote pref("browser.send_pings", false); pref("geo.enabled", false); -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[tor-browser-spec] branch main updated: Bug 40029: FF95 Audit
by gitolite role 02 Nov '22

02 Nov '22

This is an automated email from the git hooks/post-receive script. richard pushed a commit to branch main in repository tor-browser-spec. The following commit(s) were added to refs/heads/main by this push: new 0fa797b Bug 40029: FF95 Audit 0fa797b is described below commit 0fa797bcb95e704a84dd9aab9abcf3c4c14201ad Author: Richard Pospesel <richard(a)torproject.org> AuthorDate: Wed Nov 2 20:47:14 2022 +0000 Bug 40029: FF95 Audit --- audits/FF95_AUDIT | 78 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 78 insertions(+) diff --git a/audits/FF95_AUDIT b/audits/FF95_AUDIT new file mode 100644 index 0000000..dd30696 --- /dev/null +++ b/audits/FF95_AUDIT @@ -0,0 +1,78 @@ +Tracking issue: https://gitlab.torproject.org/tpo/applications/tor-browser-spec/-/issues/40… + +# General + +The audit begins at the commit hash where the previous audit ended. Use code_audit.sh for creating the diff and highlighting potentially problematic code. The audit is scoped to a specific language (currently C/C++, Rust, Java/Kotlin, and Javascript). + +The output includes the entire patch where the new problematic code was introduced. Search for `XXX MATCH XXX` to find the next potential violation. + +`code_audit.sh` contains the list of known problematic APIs. New usage of these functions are documented and analyzed in this audit. + +## Firefox: https://github.com/mozilla/gecko-dev.git + +- Start: `6c9b6e1483551f220cd409e4e584349bc74a8231` ( `FIREFOX_RELEASE_95_BASE` ) +- End: `6a277ae5bdf6554793cd0da292a9c9ea804b4ed9` ( `FIREFOX_RELEASE_96_BASE` ) + +### Languages: +- [x] java +- [x] cpp +- [x] js +- [x] rust + +Nothing of interest (using `code_audit.sh`) + +--- + +## Application Services: https://github.com/mozilla/application-services.git + +- Start: `df1a47fde89f49201b1e839f960e8f16eb95a55d` ( `v87.1.0` ) +- End: `5ceeb43598871a7d8550acc574a6a3fb93803ad7` ( `v87.3.0` ) + +### Languages: +- [x] java +- [x] cpp +- [x] js +- [x] rust + +Nothing of interest (using `code_audit.sh`) + +## Android Components: https://github.com/mozilla-mobile/android-components.git + +- Start: `ef09fecd91dfcbffb85d9f4907b76cc9e5a0b70e` ( `v95.0.0` ) +- End: `93066a8f082fa2db3d38d361d0a538c438d2e1b8` ( `v95.0.15` ) + +### Languages: +- [x] java +- [x] cpp +- [x] js +- [x] rust + +Nothing of interest (using `code_audit.sh`) + +## Fenix: https://github.com/mozilla-mobile/fenix.git + +- Start: `9ab24a371b2dd51d18dab2f7f49facc6d2fd56ad` ( `v95.0.0-beta.1` ) +- End: `d01642a0b1e3819cd2802b42a8a6aae43eb5ff12` ( `releases_v95.0.0` ) + +### Languages: +- [x] java +- [x] cpp +- [x] js +- [x] rust + +Nothing of interest (using `code_audit.sh`) + +## Ticket Review ## + +### Review List + +#### 95 https://bugzilla.mozilla.org/buglist.cgi?query_format=advanced&resolution=F… + +- https://bugzilla.mozilla.org/show_bug.cgi?id=1732792 : @dan https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41125 + - put this feature behind MOZ_PROXY_BYPASS_PROTECTION and uplifted to Firefox +- https://bugzilla.mozilla.org/show_bug.cgi?id=1734262 : @ma1 https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41126 + - nothing to do here +- https://bugzilla.mozilla.org/show_bug.cgi?id=1726524 : @henry https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41127 + - not a blocking issue for release, but kept open so we can review our options and re-enable text to speech while also resisting fingerprinting +- https://bugzilla.mozilla.org/show_bug.cgi?id=1734331 : @boklm https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41128 + - nothing to do here \ No newline at end of file -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[builders/tor-browser-build] branch main updated (c9800a15 -> e4c676b3)
by gitolite role 02 Nov '22

02 Nov '22

This is an automated email from the git hooks/post-receive script. pierov pushed a change to branch main in repository builders/tor-browser-build. from c9800a15 Bug 40674: Add Secondary Snowflake Bridgeline new 04302abf Bug 40666: Fix compiler depedencies for Firefox on Windows new e4c676b3 Bug 40667: Update Node.js to 12.22.12 The 2 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: projects/firefox/build | 10 ++++++---- projects/firefox/config | 4 +--- projects/node/config | 4 ++-- 3 files changed, 9 insertions(+), 9 deletions(-) -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 2