February 2024 - tbb-commits - lists.torproject.org

[Git][tpo/applications/mullvad-browser][mullvad-browser-115.8.0esr-13.5-1] 3 commits: fixup! MB 38: Mullvad Browser configuration
by Pier Angelo Vendrame (＠pierov) 29 Feb '24

29 Feb '24

Pier Angelo Vendrame pushed to branch mullvad-browser-115.8.0esr-13.5-1 at The Tor Project / Applications / Mullvad Browser Commits: ed66bd0f by Pier Angelo Vendrame at 2024-02-29T14:09:03+01:00 fixup! MB 38: Mullvad Browser configuration s/privacy-browser/mullvad-browser/ - - - - - b9146e90 by Pier Angelo Vendrame at 2024-02-29T14:09:08+01:00 fixup! MB 112: Updater customization for Mullvad Browser s/privacy-browser/mullvad-browser/ - - - - - e473a103 by Pier Angelo Vendrame at 2024-02-29T14:09:08+01:00 MB 234: Disable OS spoofing in HTTP User-Agent. This commits makes it possible to disable OS spoofing in the HTTP User-Agent header, to see if matching header and JS property improve usability. - - - - - 3 changed files: - browser/app/profile/000-mullvad-browser.js - netwerk/protocol/http/nsHttpHandler.cpp - toolkit/components/resistfingerprinting/nsRFPService.cpp Changes: ===================================== browser/app/profile/000-mullvad-browser.js ===================================== @@ -7,23 +7,23 @@ pref("browser.startup.homepage", "about:mullvad-browser"); // a result. pref("browser.toolbars.bookmarks.visibility", "never"); -// privacy-browser#19: Enable Mullvad's DOH +// mullvad-browser#19: Enable Mullvad's DOH pref("network.trr.uri", "https://dns.mullvad.net/dns-query"); pref("network.trr.default_provider_uri", "https://dns.mullvad.net/dns-query"); pref("network.trr.mode", 3); pref("doh-rollout.provider-list", "[{\"UIName\":\"Mullvad\",\"autoDefault\":true,\"canonicalName\":\"\",\"id\":\"mullvad\",\"last_modified\":0,\"schema\":0,\"uri\":\"https://dns.mullvad.net/dns-query\"},{\"UIName\":\"Mullvad (Ad-blocking)\",\"autoDefault\":false,\"canonicalName\":\"\",\"id\":\"mullvad\",\"last_modified\":0,\"schema\":0,\"uri\":\"https://adblock.dns.mullvad.net/dns-query\"}]"); -// privacy-browser#122: Audit DoH heuristics +// mullvad-browser#122: Audit DoH heuristics pref("doh-rollout.disable-heuristics", true); -// privacy-browser#37: Customization for the about dialog +// mullvad-browser#37: Customization for the about dialog pref("app.releaseNotesURL.aboutDialog", "about:blank"); -// privacy-browser#94: Disable legacy global microphone/webcam indicator +// mullvad-browser#94: Disable legacy global microphone/webcam indicator // Disable the legacy Firefox Quantum-styled global webcam/microphone indicator in favor of each // platform's native indicator pref("privacy.webrtc.legacyGlobalIndicator", false); -// privacy-browser#87: Windows and Linux need additional work to make the +// mullvad-browser#87: Windows and Linux need additional work to make the // default browser choice working. // We are shipping only the portable versions for the initial release anyway, so // we leave this popup enabled only on macOS. @@ -34,7 +34,7 @@ pref("browser.shell.checkDefaultBrowser", false); // mullvad-browser#228: default to spoof en-US and skip showing the dialog pref("privacy.spoof_english", 2); -// privacy-browser#131: Review a few updater preferences +// mullvad-browser#131: Review a few updater preferences pref("app.update.notifyDuringDownload", true); pref("app.update.url.manual", "https://mullvad.net/download/browser"); pref("app.update.url.details", "https://mullvad.net/download/browser"); @@ -45,3 +45,6 @@ pref("app.releaseNotesURL", "https://github.com/mullvad/mullvad-browser/releases pref("app.releaseNotesURL.aboutDialog", "about:blank"); // point to our feedback url rather than Mozilla's pref("app.feedback.baseURL", "https://mullvad.net/help/tag/browser/"); + +// mullvad-browser#234: Do not spoof the OS in the User-Agent header +pref("privacy.resistFingerprinting.spoofOsInUserAgentHeader", false); ===================================== netwerk/protocol/http/nsHttpHandler.cpp ===================================== @@ -497,6 +497,9 @@ nsresult nsHttpHandler::Init() { // obsService->AddObserver(this, "net:failed-to-process-uri-content", true); } + Preferences::AddWeakObserver( + this, "privacy.resistFingerprinting.spoofOsInUserAgentHeader"_ns); + MakeNewRequestTokenBucket(); mWifiTickler = new Tickler(); if (NS_FAILED(mWifiTickler->Init())) mWifiTickler = nullptr; @@ -2071,6 +2074,9 @@ nsHttpHandler::Observe(nsISupports* subject, const char* topic, // Inform nsIOService that network is tearing down. gIOService->SetHttpHandlerAlreadyShutingDown(); + Preferences::RemoveObserver( + this, "privacy.resistFingerprinting.spoofOsInUserAgentHeader"_ns); + ShutdownConnectionManager(); // need to reset the session start time since cache validation may @@ -2196,6 +2202,11 @@ nsHttpHandler::Observe(nsISupports* subject, const char* topic, ShutdownConnectionManager(); mConnMgr = nullptr; Unused << InitConnectionMgr(); + } else if (!strcmp(topic, "nsPref:changed") && + !NS_strcmp( + data, + u"privacy.resistFingerprinting.spoofOsInUserAgentHeader")) { + nsRFPService::GetSpoofedUserAgent(mSpoofedUserAgent, true); } return NS_OK; ===================================== toolkit/components/resistfingerprinting/nsRFPService.cpp ===================================== @@ -939,12 +939,17 @@ void nsRFPService::GetSpoofedUserAgent(nsACString& userAgent, // https://developer.mozilla.org/en-US/docs/Web/API/NavigatorID/userAgent // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/User-Agent + const bool spoofOs = + isForHTTPHeader && + Preferences::GetBool( + "privacy.resistFingerprinting.spoofOsInUserAgentHeader", true); + // These magic numbers are the lengths of the UA string literals below. // Assume three-digit Firefox version numbers so we have room to grow. size_t preallocatedLength = 13 + - (isForHTTPHeader ? mozilla::ArrayLength(SPOOFED_HTTP_UA_OS) - : mozilla::ArrayLength(SPOOFED_UA_OS)) - + (spoofOs ? mozilla::ArrayLength(SPOOFED_HTTP_UA_OS) + : mozilla::ArrayLength(SPOOFED_UA_OS)) - 1 + 5 + 3 + 10 + mozilla::ArrayLength(LEGACY_UA_GECKO_TRAIL) - 1 + 9 + 3 + 2; userAgent.SetCapacity(preallocatedLength); @@ -954,7 +959,7 @@ void nsRFPService::GetSpoofedUserAgent(nsACString& userAgent, // "Mozilla/5.0 (%s; rv:%d.0) Gecko/%d Firefox/%d.0" userAgent.AssignLiteral("Mozilla/5.0 ("); - if (isForHTTPHeader) { + if (spoofOs) { userAgent.AppendLiteral(SPOOFED_HTTP_UA_OS); } else { userAgent.AppendLiteral(SPOOFED_UA_OS); View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/compare/3b… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/compare/3b… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41098: Fix URL in tor-qa email in TB Release Prep issue templates
by richard (＠richard) 29 Feb '24

29 Feb '24

richard pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 5ee43d20 by Nicolas Vigier at 2024-02-29T12:46:52+00:00 Bug 41098: Fix URL in tor-qa email in TB Release Prep issue templates - - - - - 2 changed files: - .gitlab/issue_templates/Release Prep - Tor Browser Alpha.md - .gitlab/issue_templates/Release Prep - Tor Browser Stable.md Changes: ===================================== .gitlab/issue_templates/Release Prep - Tor Browser Alpha.md ===================================== @@ -147,7 +147,7 @@ Tor Browser Alpha (and Nightly) are on the `main` branch Unsigned Tor Browser $(TOR_BROWSER_VERSION) alpha candidate builds are now available for testing: - - https://tb-build-02.torproject.org/~$(BUILDER)/builds/alpha/unsigned/$(TOR_… + - https://tb-build-02.torproject.org/~$(BUILDER)/builds/torbrowser/alpha/unsi… The full changelog can be found here: ===================================== .gitlab/issue_templates/Release Prep - Tor Browser Stable.md ===================================== @@ -148,7 +148,7 @@ Tor Browser Stable lives in the various `maint-$(TOR_BROWSER_MAJOR).$(TOR_BROWSE Unsigned Tor Browser $(TOR_BROWSER_VERSION) release candidate builds are now available for testing: - - https://tb-build-02.torproject.org/~$(BUILDER)/builds/release/unsigned/$(TO… + - https://tb-build-02.torproject.org/~$(BUILDER)/builds/torbrowser/release/un… The full changelog can be found here: View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/5… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/5… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][maint-13.0] Bug 41097: authenticode-timestamping.sh: create $tmp_dir with mktemp -d
by richard (＠richard) 29 Feb '24

29 Feb '24

richard pushed to branch maint-13.0 at The Tor Project / Applications / tor-browser-build Commits: 02f786b2 by Nicolas Vigier at 2024-02-29T12:41:41+00:00 Bug 41097: authenticode-timestamping.sh: create $tmp_dir with mktemp -d (cherry picked from commit 800e2fff2d33150beffc086a46921807532bddcc) - - - - - 1 changed file: - tools/signing/authenticode-timestamping.sh Changes: ===================================== tools/signing/authenticode-timestamping.sh ===================================== @@ -46,8 +46,8 @@ test -f "$osslsigncode_file" || which rename > /dev/null 2>&1 || exit_error '`rename` is missing.' -tmp_dir="$signed_dir/$tbb_version/tmp-timestamp" -mkdir "$tmp_dir" +tmp_dir=$(mktemp -d) +trap "rm -Rf $tmp_dir" EXIT tar -C "$tmp_dir" -xf "$osslsigncode_file" export PATH="$PATH:$tmp_dir/osslsigncode/bin" @@ -64,5 +64,3 @@ do done echo "Timestamped $COUNT .exe files, now renaming" rename -f 's/-timestamped//' *-timestamped - -rm -Rf "$tmp_dir" View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/0… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/0… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41097: authenticode-timestamping.sh: create $tmp_dir with mktemp -d
by richard (＠richard) 29 Feb '24

29 Feb '24

richard pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 800e2fff by Nicolas Vigier at 2024-02-29T12:37:42+00:00 Bug 41097: authenticode-timestamping.sh: create $tmp_dir with mktemp -d - - - - - 1 changed file: - tools/signing/authenticode-timestamping.sh Changes: ===================================== tools/signing/authenticode-timestamping.sh ===================================== @@ -46,8 +46,8 @@ test -f "$osslsigncode_file" || which rename > /dev/null 2>&1 || exit_error '`rename` is missing.' -tmp_dir="$signed_dir/$tbb_version/tmp-timestamp" -mkdir "$tmp_dir" +tmp_dir=$(mktemp -d) +trap "rm -Rf $tmp_dir" EXIT tar -C "$tmp_dir" -xf "$osslsigncode_file" export PATH="$PATH:$tmp_dir/osslsigncode/bin" @@ -64,5 +64,3 @@ do done echo "Timestamped $COUNT .exe files, now renaming" rename -f 's/-timestamped//' *-timestamped - -rm -Rf "$tmp_dir" View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/8… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/8… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-115.8.0esr-13.5-1] fixup! Firefox preference overrides.
by Pier Angelo Vendrame (＠pierov) 29 Feb '24

29 Feb '24

Pier Angelo Vendrame pushed to branch mullvad-browser-115.8.0esr-13.5-1 at The Tor Project / Applications / Mullvad Browser Commits: 3b8bacb8 by Pier Angelo Vendrame at 2024-02-29T10:05:37+01:00 fixup! Firefox preference overrides. Bug 41676: Set privacy.resistFingerprinting.testing.setTZtoUTC as a defense-in-depth. We will have to revert this during the ESR-transition. - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -406,6 +406,9 @@ pref("browser.display.use_system_colors", false); // Enforce non-native widget theme (true by default, defense in depth). // Provides a uniform look and feel across platforms. Added with tor-browser#41496. pref("widget.non-native-theme.enabled", true); +// tor-browser#41676: Set the TZ environment variable as a defense-in-depth. +// TODO: Remove this in ESR-128, as it has been removed in 116 with Bug 1837582. +pref("privacy.resistFingerprinting.testing.setTZtoUTC", true); // tor-browser#41943: lock and revisit after it gets flipped to true in stable Firefox pref("javascript.options.spectre.disable_for_isolated_content", false, locked); View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/3b8… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/3b8… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][base-browser-115.8.0esr-13.5-1] fixup! Firefox preference overrides.
by Pier Angelo Vendrame (＠pierov) 29 Feb '24

29 Feb '24

Pier Angelo Vendrame pushed to branch base-browser-115.8.0esr-13.5-1 at The Tor Project / Applications / Tor Browser Commits: 4c125e5a by Pier Angelo Vendrame at 2024-02-29T10:05:12+01:00 fixup! Firefox preference overrides. Bug 41676: Set privacy.resistFingerprinting.testing.setTZtoUTC as a defense-in-depth. We will have to revert this during the ESR-transition. - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -407,6 +407,9 @@ pref("browser.display.use_system_colors", false); // Enforce non-native widget theme (true by default, defense in depth). // Provides a uniform look and feel across platforms. Added with tor-browser#41496. pref("widget.non-native-theme.enabled", true); +// tor-browser#41676: Set the TZ environment variable as a defense-in-depth. +// TODO: Remove this in ESR-128, as it has been removed in 116 with Bug 1837582. +pref("privacy.resistFingerprinting.testing.setTZtoUTC", true); // tor-browser#41943: lock and revisit after it gets flipped to true in stable Firefox pref("javascript.options.spectre.disable_for_isolated_content", false, locked); View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/4c125e5… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/4c125e5… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41082: Tor Expert Bundle android builds create .aar file
by Pier Angelo Vendrame (＠pierov) 28 Feb '24

28 Feb '24

Pier Angelo Vendrame pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: b5acc813 by Dan Ballard at 2024-02-28T12:59:28-08:00 Bug 41082: Tor Expert Bundle android builds create .aar file - - - - - 7 changed files: - projects/browser/build - projects/browser/build.android - projects/tor-android-service/build - + projects/tor-expert-bundle/AndroidManifest.xml - projects/tor-expert-bundle/build - projects/tor-expert-bundle/config - projects/tor-onion-proxy-library/build Changes: ===================================== projects/browser/build ===================================== @@ -90,10 +90,10 @@ mv [% c('input_files_by_name/noscript') %] "$TBDIR/$EXTSPATH/{73a6fe31-595d-460b [% END -%] } - tar -xvf [% c('input_files_by_name/tor-expert-bundle') %] + tar -xvf [% c('input_files_by_name/tor-expert-bundle') %]/tor-expert-bundle.tar.gz [% IF c("var/macos_universal") -%] mkdir aarch64 - tar -C aarch64 -xf [% c('input_files_by_name/tor-expert-bundle-aarch64') %] + tar -C aarch64 -xf [% c('input_files_by_name/tor-expert-bundle-aarch64') %]/tor-expert-bundle.tar.gz [% END -%] # geoip(6) and anything else that belongs in the data dir from the expert bundle @@ -451,13 +451,13 @@ fi [%IF c("var/tor-browser") -%] tor_expert_bundle_src="[% c("input_files_by_name/tor-expert-bundle") %]" # strip off trailing "$buildid.tar.gz" - tor_expert_bundle_dest=${tor_expert_bundle_src:0:-14}.tar.gz - cp $rootdir/[% c("input_files_by_name/tor-expert-bundle") %] "$OUTDIR"/$tor_expert_bundle_dest + tor_expert_bundle_dest=${tor_expert_bundle_src:0:-7}.tar.gz + cp $rootdir/[% c("input_files_by_name/tor-expert-bundle") %]/tor-expert-bundle.tar.gz "$OUTDIR"/$tor_expert_bundle_dest [% IF c("var/macos_universal") %] tor_expert_bundle_src="[% c('input_files_by_name/tor-expert-bundle-aarch64') %]" # strip off trailing "$buildid.tar.gz" - tor_expert_bundle_dest=${tor_expert_bundle_src:0:-14}.tar.gz - cp $rootdir/[% c('input_files_by_name/tor-expert-bundle-aarch64') %] "$OUTDIR"/$tor_expert_bundle_dest + tor_expert_bundle_dest=${tor_expert_bundle_src:0:-7}.tar.gz + cp $rootdir/[% c('input_files_by_name/tor-expert-bundle-aarch64') %]/tor-expert-bundle.tar.gz "$OUTDIR"/$tor_expert_bundle_dest [% END -%] [% END -%] [% IF c("var/build_infos_json") -%] ===================================== projects/browser/build.android ===================================== @@ -24,7 +24,7 @@ cd /var/tmp/build mv $rootdir/[% c('input_files_by_name/noscript') %] "$noscript_path" [%IF c("var/tor-browser") -%] - tar -xaf "$rootdir/[% c("input_files_by_name/tor-expert-bundle") %]" tor/pluggable_transports/pt_config.json + tar -xaf "$rootdir/[% c("input_files_by_name/tor-expert-bundle") %]/tor-expert-bundle.tar.gz" tor/pluggable_transports/pt_config.json [% END -%] unzip -j "$apk" assets/omni.ja mkdir omni @@ -70,8 +70,8 @@ unsign_patch="[% dest_dir %]/[% c('filename') %]/[% c('var/project-name') %]-qa- bsdiff $qa_apk $aligned_apk $unsign_patch [%IF c("var/tor-browser") -%] - tor_expert_bundle_src="[% c("input_files_by_name/tor-expert-bundle") %]" + tor_expert_bundle_src="[% c('input_files_by_name/tor-expert-bundle') %]" # strip off trailing "$buildid.tar.gz" - tor_expert_bundle_dest=${tor_expert_bundle_src:0:-14}.tar.gz - cp $rootdir/$tor_expert_bundle_src [% dest_dir %]/[% c('filename') %]/$tor_expert_bundle_dest + tor_expert_bundle_dest=${tor_expert_bundle_src:0:-7}.tar.gz + cp "$rootdir/[% c("input_files_by_name/tor-expert-bundle") %]/tor-expert-bundle.tar.gz" [% dest_dir %]/[% c('filename') %]/$tor_expert_bundle_dest [% END -%] ===================================== projects/tor-android-service/build ===================================== @@ -35,7 +35,7 @@ rm -fR service/src/main/jniLibs/* # Extract tor-expert-bundle tebdir=$rootdir/tor-expert-bundle-[% arch %] mkdir $tebdir - tar -C $tebdir -xf $rootdir/[% c('input_files_by_name/tor-expert-bundle-' _ arch) %] + tar -C $tebdir -xf $rootdir/[% c('input_files_by_name/tor-expert-bundle-' _ arch) %]/tor-expert-bundle.tar.gz # Figure out our android abi from our arch [% IF arch == "armv7" -%] ===================================== projects/tor-expert-bundle/AndroidManifest.xml ===================================== @@ -0,0 +1,16 @@ +<?xml version="1.0" encoding="utf-8"?> +<manifest xmlns:android="http://schemas.android.com/apk/res/android" + package="org.torproject.torExpertBundle" + android:versionCode="1" + android:versionName="0.0.1" > + + <uses-sdk + android:minSdkVersion="16" + android:targetSdkVersion="29" /> + + <uses-permission android:name="android.permission.INTERNET" /> + + <application android:allowBackup="false" > + </application> + +</manifest> \ No newline at end of file ===================================== projects/tor-expert-bundle/build ===================================== @@ -2,6 +2,10 @@ [% c("var/set_default_env") -%] distdir=/var/tmp/dist/[% project %] mkdir -p $distdir + +output_dir=[% dest_dir %]/[% c('filename') %] +mkdir -p $output_dir + cd $distdir tar -xkf $rootdir/[% c('input_files_by_name/tor') %] @@ -18,6 +22,32 @@ tar -xkf $rootdir/[% c('input_files_by_name/conjure') %] awk '{gsub(/\$\{pt_extension\}/, "[% c("var/pt_extension") %]"); print}' $rootdir/pt_config.json > pt_config.json cd $distdir + +# package a .aar on android +[% IF c("var/android") -%] + aar_file=torExpertBundle-[% c('arch') %].aar + + mkdir aar + mkdir -p aar/jni/[% c('arch') %] + mkdir -p aar/assets/common + + cp -a tor/libTor.so aar/jni/[% c('arch') %]/ + cp -a tor/pluggable_transports/conjure-client aar/jni/[% c('arch') %]/libConjure.so + cp -a tor/pluggable_transports/lyrebird aar/jni/[% c('arch') %]/Lyrebird.so + cp -a tor/pluggable_transports/snowflake-client aar/jni/[% c('arch') %]/libSnowflake.so + cp -a tor/pluggable_transports/webtunnel-client aar/jni/[% c('arch') %]/libWebtunnel.so + + cp -a data/* aar/assets/common/ + + cp -a tor/pluggable_transports/pt_config.json aar/assets/common/ + + cp -a $rootdir/AndroidManifest.xml aar/ + + cd aar + jar -cvf $output_dir/tor-expert-bundle-[% c('arch') %].aar * + cd .. +[% END %] + [% SET tar_src = [ "tor", "data" ]; IF c("var/linux"); @@ -25,6 +55,6 @@ cd $distdir END; c('tar', { tar_src => tar_src, - tar_args => '-czvf' _ dest_dir _ '/' _ c('filename'), + tar_args => '-czvf' _ dest_dir _ '/' _ c('filename') _ '/tor-expert-bundle.tar.gz', }); -%] +%] \ No newline at end of file ===================================== projects/tor-expert-bundle/config ===================================== @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -filename: '[% project %]-[% c("var/osname") %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' +filename: '[% project %]-[% c("var/osname") %]-[% c("version") %]-[% c("var/build_id") %]' version: '[% c("var/torbrowser_version") %]' container: @@ -23,3 +23,4 @@ input_files: - name: conjure project: conjure - filename: pt_config.json + - filename: AndroidManifest.xml ===================================== projects/tor-onion-proxy-library/build ===================================== @@ -43,7 +43,7 @@ patch -p1 < $rootdir/0001-Bug-40800-Add-WebTunnel-support.patch # Extract tor-expert-bundle tebdir=$rootdir/tor-expert-bundle-[% arch %] mkdir $tebdir - tar -C $tebdir -xf $rootdir/[% c('input_files_by_name/tor-expert-bundle-' _ arch) %] + tar -C $tebdir -xf $rootdir/[% c('input_files_by_name/tor-expert-bundle-' _ arch) %]/tor-expert-bundle.tar.gz ptdir=$tebdir/tor/pluggable_transports # Overwrite the obfs4proxy binary provided by Pluto and add Snowflake View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/b… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/b… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-update-responses][main] alpha: new version, 13.5a5
by boklm (＠boklm) 28 Feb '24

28 Feb '24

boklm pushed to branch main at The Tor Project / Applications / Tor Browser update responses Commits: db64cd7d by Nicolas Vigier at 2024-02-28T17:02:15+01:00 alpha: new version, 13.5a5 - - - - - 30 changed files: - update_3/alpha/.htaccess - − update_3/alpha/13.5a1-13.5a4-linux-i686-ALL.xml - − update_3/alpha/13.5a1-13.5a4-linux-x86_64-ALL.xml - − update_3/alpha/13.5a1-13.5a4-macos-ALL.xml - − update_3/alpha/13.5a1-13.5a4-windows-i686-ALL.xml - − update_3/alpha/13.5a1-13.5a4-windows-x86_64-ALL.xml - − update_3/alpha/13.5a2-13.5a4-linux-i686-ALL.xml - − update_3/alpha/13.5a2-13.5a4-linux-x86_64-ALL.xml - − update_3/alpha/13.5a2-13.5a4-macos-ALL.xml - − update_3/alpha/13.5a2-13.5a4-windows-i686-ALL.xml - − update_3/alpha/13.5a2-13.5a4-windows-x86_64-ALL.xml - + update_3/alpha/13.5a2-13.5a5-linux-i686-ALL.xml - + update_3/alpha/13.5a2-13.5a5-linux-x86_64-ALL.xml - + update_3/alpha/13.5a2-13.5a5-macos-ALL.xml - + update_3/alpha/13.5a2-13.5a5-windows-i686-ALL.xml - + update_3/alpha/13.5a2-13.5a5-windows-x86_64-ALL.xml - − update_3/alpha/13.5a3-13.5a4-linux-i686-ALL.xml - − update_3/alpha/13.5a3-13.5a4-linux-x86_64-ALL.xml - − update_3/alpha/13.5a3-13.5a4-macos-ALL.xml - − update_3/alpha/13.5a3-13.5a4-windows-i686-ALL.xml - − update_3/alpha/13.5a3-13.5a4-windows-x86_64-ALL.xml - + update_3/alpha/13.5a3-13.5a5-linux-i686-ALL.xml - + update_3/alpha/13.5a3-13.5a5-linux-x86_64-ALL.xml - + update_3/alpha/13.5a3-13.5a5-macos-ALL.xml - + update_3/alpha/13.5a3-13.5a5-windows-i686-ALL.xml - + update_3/alpha/13.5a3-13.5a5-windows-x86_64-ALL.xml - + update_3/alpha/13.5a4-13.5a5-linux-i686-ALL.xml - + update_3/alpha/13.5a4-13.5a5-linux-x86_64-ALL.xml - + update_3/alpha/13.5a4-13.5a5-macos-ALL.xml - + update_3/alpha/13.5a4-13.5a5-windows-i686-ALL.xml The diff was not included because it is too large. View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-update-responses… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-update-responses… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-115.8.0esr-13.5-1] fixup! Firefox preference overrides.
by Pier Angelo Vendrame (＠pierov) 28 Feb '24

28 Feb '24

Pier Angelo Vendrame pushed to branch tor-browser-115.8.0esr-13.5-1 at The Tor Project / Applications / Tor Browser Commits: 5bb3b747 by Pier Angelo Vendrame at 2024-02-28T11:26:08+01:00 fixup! Firefox preference overrides. Bug 41676: Set privacy.resistFingerprinting.testing.setTZtoUTC as a defense-in-depth. We will have to revert this during the ESR-transition. - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -407,6 +407,9 @@ pref("browser.display.use_system_colors", false); // Enforce non-native widget theme (true by default, defense in depth). // Provides a uniform look and feel across platforms. Added with tor-browser#41496. pref("widget.non-native-theme.enabled", true); +// tor-browser#41676: Set the TZ environment variable as a defense-in-depth. +// TODO: Remove this in ESR-128, as it has been removed in 116 with Bug 1837582. +pref("privacy.resistFingerprinting.testing.setTZtoUTC", true); // tor-browser#41943: lock and revisit after it gets flipped to true in stable Firefox pref("javascript.options.spectre.disable_for_isolated_content", false, locked); View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/5bb3b74… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/5bb3b74… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41093: Unsign APKs before signing them
by boklm (＠boklm) 28 Feb '24

28 Feb '24

boklm pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 7c9183b0 by Nicolas Vigier at 2024-02-28T16:17:42+01:00 Bug 41093: Unsign APKs before signing them Use the bspatch file we create during the build to unsign the apk (which was signed by the QA key) before signing it with the release key. - - - - - 2 changed files: - tools/signing/linux-signer-sign-android-apks - tools/signing/machines-setup/setup-signing-machine Changes: ===================================== tools/signing/linux-signer-sign-android-apks ===================================== @@ -68,14 +68,19 @@ setup_build_tools mkdir -p ~/"$SIGNING_PROJECTNAME-$tbb_version-apks" chgrp signing ~/"$SIGNING_PROJECTNAME-$tbb_version-apks" chmod g+w ~/"$SIGNING_PROJECTNAME-$tbb_version-apks" -cp -af ~/"$SIGNING_PROJECTNAME-$tbb_version"/*.apk ~/"$SIGNING_PROJECTNAME-$tbb_version-apks" +cp -af ~/"$SIGNING_PROJECTNAME-$tbb_version"/*.apk \ + ~/"$SIGNING_PROJECTNAME-$tbb_version"/*.bspatch \ + ~/"$SIGNING_PROJECTNAME-$tbb_version-apks" cd ~/"$SIGNING_PROJECTNAME-$tbb_version-apks" # Sign all packages for arch in ${ARCHS}; do qa_apk=${projname}-qa-android-${arch}-${tbb_version}.apk + unsigned_apk=${projname}-qa-unsigned-android-${arch}-${tbb_version}.apk + unsigned_apk_bspatch=${projname}-qa-unsign-android-${arch}-${tbb_version}.bspatch signed_apk=${projname}-android-${arch}-${tbb_version}.apk - sign_apk "$qa_apk" "$signed_apk" + bspatch "$qa_apk" "$unsigned_apk" "$unsigned_apk_bspatch" + sign_apk "$unsigned_apk" "$signed_apk" verify_apk "$signed_apk" cp -f "$signed_apk" ~/"$SIGNING_PROJECTNAME-$tbb_version" done ===================================== tools/signing/machines-setup/setup-signing-machine ===================================== @@ -116,7 +116,7 @@ install_packages opensc libengine-pkcs11-openssl install_packages cmake libusb-1.0-0-dev libedit-dev gengetopt libpcsclite-dev help2man chrpath dh-exec # Install deps for android/apk signing -install_packages unzip openjdk-11-jdk-headless openjdk-11-jre-headless +install_packages unzip openjdk-11-jdk-headless openjdk-11-jre-headless bsdiff # Install deps for macos-rcodesign signing install_packages p7zip-full zstd View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/7… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/7… You're receiving this email because of your account on gitlab.torproject.org.

1 0