- tbb-commits - lists.torproject.org

[tor-browser-build/master] Merge remote-tracking branch 'gkgl/bug_34234'
by sysrqb＠torproject.org 24 Aug '20

24 Aug '20

commit 4861f97c0f74bb1f69d422cdf6967a6628a05031 Merge: d3c7af8 8feea5a Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Mon Aug 24 18:53:59 2020 +0000 Merge remote-tracking branch 'gkgl/bug_34234' README | 2 +- projects/debootstrap-image/config | 7 ------- projects/https-everywhere/config | 6 +++--- rbm.conf | 8 ++++---- 4 files changed, 8 insertions(+), 15 deletions(-)

1 0

[tor-browser-build/master] Bug 34234: Move HTTPS Everywhere build to Debian Buster
by sysrqb＠torproject.org 24 Aug '20

24 Aug '20

commit 8feea5ace569b0529d6281b98d95340a0414ce91 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Aug 21 13:18:36 2020 +0000 Bug 34234: Move HTTPS Everywhere build to Debian Buster Additionally, clean up all Debian Stretch references. --- README | 2 +- projects/debootstrap-image/config | 7 ------- projects/https-everywhere/config | 6 +++--- rbm.conf | 8 ++++---- 4 files changed, 8 insertions(+), 15 deletions(-) diff --git a/README b/README index a95f466..3e98d02 100644 --- a/README +++ b/README @@ -193,7 +193,7 @@ of containers: the container-image project is still called, but it will just create an empty file instead of a real container image. The build without containers is currently only supported for the Android -builds, and will require that you run Debian Stretch and install build +builds, and will require that you run Debian Buster and install build dependencies for all the components that are built. This can be done with the following command: diff --git a/projects/debootstrap-image/config b/projects/debootstrap-image/config index 8e83d81..6ee4a64 100644 --- a/projects/debootstrap-image/config +++ b/projects/debootstrap-image/config @@ -56,13 +56,6 @@ targets: arch: amd64 debootstrap_mirror: "http://archive.debian.org/debian/" - stretch-amd64: - var: - minimal_apt_version: 1.4.9 - container: - suite: stretch - arch: amd64 - buster-amd64: var: minimal_apt_version: 1.8.2 diff --git a/projects/https-everywhere/config b/projects/https-everywhere/config index a5be759..f75a841 100644 --- a/projects/https-everywhere/config +++ b/projects/https-everywhere/config @@ -10,14 +10,14 @@ var: # HTTPS Everywhere is expected to be the same on all platforms. To avoid # building the same thing 4 times, using 4 different container images # (each one with a different suite or architecture), we set the container - # to stretch/amd64 for all platforms. This allows us to create only one + # to buster/amd64 for all platforms. This allows us to create only one # container image, and also build the extension only one time as the # filename does not contain the platform, and var/build_id should be # the same since there is now nothing platform specific in the build # inputs. This allows us to save a little time and disk space. container: use_container: 1 - suite: stretch + suite: buster arch: amd64 deps: - git @@ -34,4 +34,4 @@ input_files: - project: python name: python target_prepend: - - common-stretch + - common-buster diff --git a/rbm.conf b/rbm.conf index 8f1143e..ac56689 100644 --- a/rbm.conf +++ b/rbm.conf @@ -179,13 +179,13 @@ targets: # Don't create mar files to save time build_mar: 0 - # The common-stretch target is used to build components that are common to all - # platforms, using Debian stretch. - common-stretch: + # The common-buster target is used to build components that are common to all + # platforms, using Debian Buster. + common-buster: var: common: 1 container: - suite: stretch + suite: buster arch: amd64 pre_pkginst: '' deps:

1 0

[tor-browser-build/maint-9.5] No need for the 0.4.3.6 patch file anymore
by gk＠torproject.org 23 Aug '20

23 Aug '20

commit bad091590e3d4db6995ccfe5efa03756e5e7234f Author: Georg Koppen <gk(a)torproject.org> Date: Sun Aug 23 19:54:50 2020 +0000 No need for the 0.4.3.6 patch file anymore Thanks cypherpunk. --- ...ve-accessor-semantic-of-client-cached-obj.patch | 212 --------------------- 1 file changed, 212 deletions(-) diff --git a/projects/tor/0001-hs-v3-Improve-accessor-semantic-of-client-cached-obj.patch b/projects/tor/0001-hs-v3-Improve-accessor-semantic-of-client-cached-obj.patch deleted file mode 100644 index 1432039..0000000 --- a/projects/tor/0001-hs-v3-Improve-accessor-semantic-of-client-cached-obj.patch +++ /dev/null @@ -1,212 +0,0 @@ -From 1810771799dd0b434ac2b5926297d64e383582e1 Mon Sep 17 00:00:00 2001 -From: David Goulet <dgoulet(a)torproject.org> -Date: Tue, 10 Mar 2020 10:58:51 -0400 -Subject: [PATCH] hs-v3: Improve accessor semantic of client cached object - -Add an inline helper function that indicates if the cached object contains a -decrypted descriptor or not. - -The descriptor object is NULL if tor is unable to decrypt it (lacking client -authorization) and some actions need to be done only when we have a decrypted -object. - -This improves code semantic. - -Fixes #33458 - -Signed-off-by: David Goulet <dgoulet(a)torproject.org> ---- - src/feature/hs/hs_cache.c | 64 +++++++++++++++++++++++++++++++-------- - src/test/test_hs_client.c | 46 ++++++++++++++++++++++++++++ - 2 files changed, 98 insertions(+), 12 deletions(-) - -diff --git a/src/feature/hs/hs_cache.c b/src/feature/hs/hs_cache.c -index 9cf408ca3e..44cd2505fd 100644 ---- a/src/feature/hs/hs_cache.c -+++ b/src/feature/hs/hs_cache.c -@@ -27,6 +27,21 @@ - static int cached_client_descriptor_has_expired(time_t now, - const hs_cache_client_descriptor_t *cached_desc); - -+/** Helper function: Return true iff the cache entry has a decrypted -+ * descriptor. -+ * -+ * A NULL desc object in the entry means that we were not able to decrypt the -+ * descriptor because we are likely lacking client authorization. It is still -+ * a valid entry but some operations can't be done without the decrypted -+ * descriptor thus this function MUST be used to safe guard access to the -+ * decrypted desc object. */ -+static inline bool -+entry_has_decrypted_descriptor(const hs_cache_client_descriptor_t *entry) -+{ -+ tor_assert(entry); -+ return (entry->desc != NULL); -+} -+ - /********************** Directory HS cache ******************/ - - /** Directory descriptor cache. Map indexed by blinded key. */ -@@ -341,8 +356,23 @@ static digest256map_t *hs_cache_client_intro_state; - static size_t - cache_get_client_entry_size(const hs_cache_client_descriptor_t *entry) - { -- return sizeof(*entry) + -- strlen(entry->encoded_desc) + hs_desc_obj_size(entry->desc); -+ size_t size = 0; -+ -+ if (entry == NULL) { -+ goto end; -+ } -+ size += sizeof(*entry); -+ -+ if (entry->encoded_desc) { -+ size += strlen(entry->encoded_desc); -+ } -+ -+ if (entry_has_decrypted_descriptor(entry)) { -+ size += hs_desc_obj_size(entry->desc); -+ } -+ -+ end: -+ return size; - } - - /** Remove a given descriptor from our cache. */ -@@ -659,14 +689,20 @@ cache_store_as_client(hs_cache_client_descriptor_t *client_desc) - * client authorization. */ - cache_entry = lookup_v3_desc_as_client(client_desc->key.pubkey); - if (cache_entry != NULL) { -- /* Signalling an undecrypted descriptor. We'll always replace the one we -- * have with the new one just fetched. */ -- if (cache_entry->desc == NULL) { -+ /* If the current or the new cache entry don't have a decrypted descriptor -+ * (missing client authorization), we always replace the current one with -+ * the new one. Reason is that we can't inspect the revision counter -+ * within the plaintext data so we blindly replace. */ -+ if (!entry_has_decrypted_descriptor(cache_entry) || -+ !entry_has_decrypted_descriptor(client_desc)) { - remove_v3_desc_as_client(cache_entry); - cache_client_desc_free(cache_entry); - goto store; - } - -+ /* From this point on, we know that the decrypted descriptor is in the -+ * current entry and new object thus safe to access. */ -+ - /* If we have an entry in our cache that has a revision counter greater - * than the one we just fetched, discard the one we fetched. */ - if (cache_entry->desc->plaintext_data.revision_counter > -@@ -740,11 +776,15 @@ cache_clean_v3_as_client(time_t now) - MAP_DEL_CURRENT(key); - entry_size = cache_get_client_entry_size(entry); - bytes_removed += entry_size; -+ - /* We just removed an old descriptor. We need to close all intro circuits -- * so we don't have leftovers that can be selected while lacking a -- * descriptor. We leave the rendezvous circuits opened because they could -- * be in use. */ -- hs_client_close_intro_circuits_from_desc(entry->desc); -+ * if the descriptor is decrypted so we don't have leftovers that can be -+ * selected while lacking a descriptor. Circuits are selected by intro -+ * authentication key thus we need the descriptor. We leave the rendezvous -+ * circuits opened because they could be in use. */ -+ if (entry_has_decrypted_descriptor(entry)) { -+ hs_client_close_intro_circuits_from_desc(entry->desc); -+ } - /* Entry is not in the cache anymore, destroy it. */ - cache_client_desc_free(entry); - /* Update our OOM. We didn't use the remove() function because we are in -@@ -793,7 +833,7 @@ hs_cache_lookup_as_client(const ed25519_public_key_t *key) - tor_assert(key); - - cached_desc = lookup_v3_desc_as_client(key->pubkey); -- if (cached_desc && cached_desc->desc) { -+ if (cached_desc && entry_has_decrypted_descriptor(cached_desc)) { - return cached_desc->desc; - } - -@@ -866,7 +906,7 @@ hs_cache_remove_as_client(const ed25519_public_key_t *key) - /* If we have a decrypted/decoded descriptor, attempt to close its - * introduction circuit(s). We shouldn't have circuit(s) without a - * descriptor else it will lead to a failure. */ -- if (cached_desc->desc) { -+ if (entry_has_decrypted_descriptor(cached_desc)) { - hs_client_close_intro_circuits_from_desc(cached_desc->desc); - } - /* Remove and free. */ -@@ -995,7 +1035,7 @@ hs_cache_client_new_auth_parse(const ed25519_public_key_t *service_pk) - } - - cached_desc = lookup_v3_desc_as_client(service_pk->pubkey); -- if (cached_desc == NULL || cached_desc->desc != NULL) { -+ if (cached_desc == NULL || entry_has_decrypted_descriptor(cached_desc)) { - /* No entry for that service or the descriptor is already decoded. */ - goto end; - } -diff --git a/src/test/test_hs_client.c b/src/test/test_hs_client.c -index 5f7fe9c404..bff71d2645 100644 ---- a/src/test/test_hs_client.c -+++ b/src/test/test_hs_client.c -@@ -965,6 +965,7 @@ test_close_intro_circuits_new_desc(void *arg) - (void) arg; - - hs_init(); -+ rend_cache_init(); - - /* This is needed because of the client cache expiration timestamp is based - * on having a consensus. See cached_client_descriptor_has_expired(). */ -@@ -989,6 +990,51 @@ test_close_intro_circuits_new_desc(void *arg) - circ->purpose = CIRCUIT_PURPOSE_C_INTRODUCING; - ocirc = TO_ORIGIN_CIRCUIT(circ); - -+ /* Build a descriptor _without_ client authorization and thus not -+ * decryptable. Make sure the close circuit code path is not triggered. */ -+ { -+ char *desc_encoded = NULL; -+ uint8_t descriptor_cookie[HS_DESC_DESCRIPTOR_COOKIE_LEN]; -+ curve25519_keypair_t client_kp; -+ hs_descriptor_t *desc = NULL; -+ -+ tt_int_op(0, OP_EQ, curve25519_keypair_generate(&client_kp, 0)); -+ crypto_rand((char *) descriptor_cookie, sizeof(descriptor_cookie)); -+ -+ desc = hs_helper_build_hs_desc_with_client_auth(descriptor_cookie, -+ &client_kp.pubkey, -+ &service_kp); -+ tt_assert(desc); -+ ret = hs_desc_encode_descriptor(desc, &service_kp, descriptor_cookie, -+ &desc_encoded); -+ tt_int_op(ret, OP_EQ, 0); -+ /* Associate descriptor intro key with the dummy circuit. */ -+ const hs_desc_intro_point_t *ip = -+ smartlist_get(desc->encrypted_data.intro_points, 0); -+ tt_assert(ip); -+ ocirc->hs_ident = hs_ident_circuit_new(&service_kp.pubkey); -+ ed25519_pubkey_copy(&ocirc->hs_ident->intro_auth_pk, -+ &ip->auth_key_cert->signed_key); -+ hs_descriptor_free(desc); -+ tt_assert(desc_encoded); -+ /* Put it in the cache. Should not be decrypted since the client -+ * authorization creds were not added to the global map. */ -+ ret = hs_cache_store_as_client(desc_encoded, &service_kp.pubkey); -+ tor_free(desc_encoded); -+ tt_int_op(ret, OP_EQ, HS_DESC_DECODE_NEED_CLIENT_AUTH); -+ -+ /* Clean cache with a future timestamp. It will trigger the clean up and -+ * attempt to close the circuit but only if the descriptor is decryptable. -+ * Cache object should be removed and circuit untouched. */ -+ hs_cache_clean_as_client(mock_ns.valid_after + (60 * 60 * 24)); -+ tt_assert(!hs_cache_lookup_as_client(&service_kp.pubkey)); -+ -+ /* Make sure the circuit still there. */ -+ tt_assert(circuit_get_next_intro_circ(NULL, true)); -+ /* Get rid of the ident, it will be replaced in the next tests. */ -+ hs_ident_circuit_free(ocirc->hs_ident); -+ } -+ - /* Build the first descriptor and cache it. */ - { - char *encoded; --- -2.20.1 -

1 0

[tor-browser-build/master] Release preparations for 10.0a6
by sysrqb＠torproject.org 23 Aug '20

23 Aug '20

commit d3c7af80c77facabb2633927e264f16723ce983b Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Sun Aug 23 18:42:11 2020 +0000 Release preparations for 10.0a6 Versions bump and Changelog update --- projects/firefox/config | 2 +- projects/https-everywhere/config | 2 +- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 20 ++++++++++++++++++++ projects/tor-browser/config | 4 ++-- projects/tor-launcher/config | 2 +- rbm.conf | 4 ++-- 6 files changed, 27 insertions(+), 7 deletions(-) diff --git a/projects/firefox/config b/projects/firefox/config index d42474b..aa34b7e 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -8,7 +8,7 @@ git_submodule: 1 gpg_keyring: torbutton.gpg var: - firefox_platform_version: 78.1.0 + firefox_platform_version: 78.2.0 firefox_version: '[% c("var/firefox_platform_version") %]esr' torbrowser_branch: 10.0 branding_directory: '[% IF c("var/android") %]mobile/android[% ELSE %]browser[% END %]/branding/alpha' diff --git a/projects/https-everywhere/config b/projects/https-everywhere/config index a5be759..ec8669f 100644 --- a/projects/https-everywhere/config +++ b/projects/https-everywhere/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 2020.5.20 +version: 2020.8.13 git_url: https://git.torproject.org/https-everywhere.git git_hash: '[% c("version") %]' git_submodule: 1 diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 096e0d7..52f3b3c 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,23 @@ +Tor Browser 10.0a6 -- August 26 2020 + * Windows + OS X + Linux + * Update Firefox to 78.2.0esr + * Update Tor Launcher to 0.2.23 + * Translations update + * Bug 40002: After rebasing to 80.0b2 moat is broken [tor-launcher] + * Update NoScript to 11.0.39 + * Bug 21601: Remove unused media.webaudio.enabled pref + * Bug 40002: Remove about:pioneer [tor-browser] + * Bug 40082: Let JavaScript on safest setting handled by NoScript again [tor-browser] + * Bug 40088: Moat "Submit" button does not work + * Bug 40090: Disable v3 add-on blocklist for now [tor-browser] + * OS X + * Bug 40015: Tor Browser broken on MacOS 11 Big Sur + * Build System + * Windows + OS X + Linux + * Bump Go to 1.13.15 + * Linux + * Bug 40053: Also create the langpacks tarball for non-release builds [tor-browser-build] + Tor Browser 10.0a5 -- August 18 2020 * Windows + OS X + Linux * Update Firefox to 78.1.0esr diff --git a/projects/tor-browser/config b/projects/tor-browser/config index 251b1ca..fc81a4f 100644 --- a/projects/tor-browser/config +++ b/projects/tor-browser/config @@ -73,9 +73,9 @@ input_files: enable: '[% c("var/snowflake") && ! c("var/android") %]' - filename: Bundle-Data enable: '[% ! c("var/android") %]' - - URL: https://addons.cdn.mozilla.net/user-media/addons/722/noscript_security_suit… + - URL: https://addons.cdn.mozilla.net/user-media/addons/722/noscript_security_suit… name: noscript - sha256sum: fed4b7554da3e334c32f27d155967fd1bc40e7b80941290bb9a57bb3f40e7480 + sha256sum: d0ade42bee14ea2498cf8868c2d0ef2d5acae563d22cb788b33a86b80e7f7b5e - filename: 'RelativeLink/start-tor-browser.desktop' enable: '[% c("var/linux") %]' - filename: 'RelativeLink/execdesktop' diff --git a/projects/tor-launcher/config b/projects/tor-launcher/config index ba799c5..95a2f02 100644 --- a/projects/tor-launcher/config +++ b/projects/tor-launcher/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 0.2.22 +version: 0.2.23 git_url: https://git.torproject.org/tor-launcher.git git_hash: '[% c("version") %]' gpg_keyring: torbutton.gpg diff --git a/rbm.conf b/rbm.conf index 8f1143e..ab73841 100644 --- a/rbm.conf +++ b/rbm.conf @@ -24,10 +24,10 @@ buildconf: git_signtag_opt: '-s' var: - torbrowser_version: '10.0a5' + torbrowser_version: '10.0a6' torbrowser_build: 'build2' torbrowser_incremental_from: - - 10.0a4 + - 10.0a5 project_name: tor-browser multi_lingual: 0 build_mar: 1

1 0

[tor-browser/tor-browser-78.2.0esr-10.0-1] fixup! Bug 10760: Integrate TorButton to TorBrowser core
by sysrqb＠torproject.org 23 Aug '20

23 Aug '20

commit 37e128fe3e2d9ddf2867b5e875e02d7de246a387 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Sun Aug 23 18:17:00 2020 +0000 fixup! Bug 10760: Integrate TorButton to TorBrowser core --- toolkit/torproject/torbutton | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/toolkit/torproject/torbutton b/toolkit/torproject/torbutton index 6c2cf4bce30c..8ed0f04ce76f 160000 --- a/toolkit/torproject/torbutton +++ b/toolkit/torproject/torbutton @@ -1 +1 @@ -Subproject commit 6c2cf4bce30cf21bb3cb121e940248cd3b8a164a +Subproject commit 8ed0f04ce76f0ed311975082c739823ecbbbaf80

1 0

[tor-launcher/master] Release preparations for 0.2.23
by sysrqb＠torproject.org 23 Aug '20

23 Aug '20

commit 76b474b3fc7eb2a7653f2edc264273030766256a Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Sun Aug 23 18:22:37 2020 +0000 Release preparations for 0.2.23 Translations update and version bump --- src/chrome/locale/es-AR/network-settings.dtd | 10 +++++----- src/chrome/locale/zh-HK/torlauncher.properties | 2 +- src/install.rdf | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/src/chrome/locale/es-AR/network-settings.dtd b/src/chrome/locale/es-AR/network-settings.dtd index 1c353d2..208046a 100644 --- a/src/chrome/locale/es-AR/network-settings.dtd +++ b/src/chrome/locale/es-AR/network-settings.dtd @@ -54,8 +54,8 @@ <!ENTITY torsettings.proxyHelpTitle "Ayuda para Proxy"> <!ENTITY torsettings.proxyHelp1 "Un proxy local puede ser necesario cuando te estés conectando a través de una red de una compañía, escuela o universidad. Si no estás seguro si un proxy es necesario, mirá los ajustes de Internet en otro navegador o revisá tus ajustes de red del sistema."> -<!ENTITY torsettings.bridgeHelpTitle "Ayuda para relevo puente"> -<!ENTITY torsettings.bridgeHelp1 "Puentes son relevos no listados que hacen más dificultoso bloquear conexiones a la red de Tor.  Cada uno de los tipos de puente usa un método diferente para evitar censura.  Los obfs hacen que tu tráfico parezca ruido aleatorio, y los meek hacen que tu tráfico parezca que se está conectando a otro servicio en vez de Tor."> +<!ENTITY torsettings.bridgeHelpTitle "Ayuda para Repetidor Puente"> +<!ENTITY torsettings.bridgeHelp1 "Los puentes son repetidores no listados que hacen más dificultoso bloquear conexiones a la red Tor.  Cada uno de los tipos de puente usa un método diferente para evitar censura.  Los obfs hacen que tu tráfico parezca ruido aleatorio, y los meek hacen que tu tráfico parezca que se está conectando a otro servicio en vez de Tor."> <!ENTITY torsettings.bridgeHelp2 "Por la manera en que ciertos países intentan bloquear a Tor, ciertos puentes funcionan en ciertos países pero no otros.  Si no estás seguro acerca de cuáles puentes funcionan en tu país, visitá torproject.org/about/contact.html#support">  @@ -64,15 +64,15 @@  <!ENTITY torPreferences.categoryTitle "Tor"> <!ENTITY torPreferences.torSettings "Configuraciones de Tor"> -<!ENTITY torPreferences.torSettingsDescription "El navegador Tor enruta tu trafico a través de la red Tor, mantenida por miles de voluntarios en todo el mundo." > +<!ENTITY torPreferences.torSettingsDescription "El navegador Tor enruta tu tráfico a través de la red Tor, mantenida por miles de voluntarios en todo el mundo." > <!ENTITY torPreferences.learnMore "Aprendé más"> <!ENTITY torPreferences.bridges "Puentes"> -<!ENTITY torPreferences.bridgesDescription "Los puentes te permiten acceder a la red Tor desde lugares donde Tor esta bloqueado. Dependiendo de donde te encuentres, algunos puentes funcionaran mejor que otros."> +<!ENTITY torPreferences.bridgesDescription "Los puentes te permiten acceder a la red Tor desde lugares donde Tor está bloqueado. Dependiendo de dónde te encuentres, algunos puentes funcionarán mejor que otros."> <!ENTITY torPreferences.useBridge "Usar un puente"> <!ENTITY torPreferences.requestNewBridge "Solicitá un nuevo puente..."> <!ENTITY torPreferences.provideBridge "Proveer un puente"> <!ENTITY torPreferences.advanced "Avanzado"> -<!ENTITY torPreferences.advancedDescription "Configurar como el Navegador Tor se conecta a internet."> +<!ENTITY torPreferences.advancedDescription "Configurar cómo se conecta a internet el Navegador Tor."> <!ENTITY torPreferences.firewallPortsPlaceholder "Valores separados por coma"> <!ENTITY torPreferences.requestBridgeDialogTitle "Solicitá un puente"> <!ENTITY torPreferences.requestBridgeDialogWaitPrompt "Contactando BridgeDB. Por favor esperá."> diff --git a/src/chrome/locale/zh-HK/torlauncher.properties b/src/chrome/locale/zh-HK/torlauncher.properties index 12ed3d5..bf53b9f 100644 --- a/src/chrome/locale/zh-HK/torlauncher.properties +++ b/src/chrome/locale/zh-HK/torlauncher.properties @@ -53,7 +53,7 @@ torlauncher.forAssistance2=如需協助，請到訪%S torlauncher.copiedNLogMessages=複製完成。%S Tor洋蔥路由日誌已準備好被貼到文字編輯器或電郵。 -torlauncher.bootstrapStatus.starting=Starting +torlauncher.bootstrapStatus.starting=啟動中 torlauncher.bootstrapStatus.conn_pt=Connecting to bridge torlauncher.bootstrapStatus.conn_done_pt=Connected to bridge torlauncher.bootstrapStatus.conn_proxy=Connecting to proxy diff --git a/src/install.rdf b/src/install.rdf index 8eed6d4..b0a80cc 100644 --- a/src/install.rdf +++ b/src/install.rdf @@ -7,7 +7,7 @@ <em:creator>The Tor Project, Inc.</em:creator> <em:contributor>Pearl Crescent, LLC</em:contributor> <em:id>tor-launcher(a)torproject.org</em:id> - <em:version>0.2.22</em:version> + <em:version>0.2.23</em:version> <em:multiprocessCompatible>true</em:multiprocessCompatible> <em:homepageURL>https://www.torproject.org/projects/torbrowser.html</em:homepageURL> <em:updateURL>data:text/plain,</em:updateURL>

1 0

[tor-launcher/master] Bug 40002: After rebasing to 80.0b2 moat is broken
by gk＠torproject.org 22 Aug '20

22 Aug '20

commit 9f77f5a02cd02b71fdb06fd934de26569d6876be Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue Aug 18 13:59:24 2020 -0400 Bug 40002: After rebasing to 80.0b2 moat is broken Mozilla renamed some of the nsILoadInfo security flags. --- src/modules/tl-bridgedb.jsm | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/src/modules/tl-bridgedb.jsm b/src/modules/tl-bridgedb.jsm index 8cc7919..6f088e1 100644 --- a/src/modules/tl-bridgedb.jsm +++ b/src/modules/tl-bridgedb.jsm @@ -1,4 +1,4 @@ -// Copyright (c) 2019, The Tor Project, Inc. +// Copyright (c) 2020, The Tor Project, Inc. // See LICENSE for licensing information. // // vim: set sw=2 sts=2 ts=8 et syntax=javascript: @@ -546,10 +546,18 @@ _MoatRequestor.prototype = // There does not seem to be a way to directly create an nsILoadInfo from // JavaScript, so we create a throw away non-proxied channel to get one. + // In Firefox 80 the nsILoadInfo security flags were renamed. When + // backwards compatibility with older Firefox code is no longer a + // requirement we can remove the following conditional and always use + // Ci.nsILoadInfo.SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULL. + const secFlags = + "SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULL" in Ci.nsILoadInfo + ? Ci.nsILoadInfo.SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULL + : Ci.nsILoadInfo.SEC_ALLOW_CROSS_ORIGIN_DATA_IS_NULL; let loadInfo = Services.io.newChannelFromURI(uri, undefined, Services.scriptSecurityManager.getSystemPrincipal(), undefined, - Ci.nsILoadInfo.SEC_ALLOW_CROSS_ORIGIN_DATA_IS_NULL, + secFlags, Ci.nsIContentPolicy.TYPE_OTHER).loadInfo; let httpHandler = Services.io.getProtocolHandler("http") .QueryInterface(Ci.nsIHttpProtocolHandler);

1 0

[torbutton/master] Bug 21601: Remove unused media.webaudio.enabled pref
by gk＠torproject.org 21 Aug '20

21 Aug '20

commit 3b29f04cf3429724ec00506324493635614fb5bb Author: Georg Koppen <gk(a)torproject.org> Date: Thu Aug 20 11:21:54 2020 +0000 Bug 21601: Remove unused media.webaudio.enabled pref It is gone since https://bugzilla.mozilla.org/show_bug.cgi?id=968479. --- modules/security-prefs.js | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/modules/security-prefs.js b/modules/security-prefs.js index f6e397d4..c0128eea 100644 --- a/modules/security-prefs.js +++ b/modules/security-prefs.js @@ -2,7 +2,7 @@ // ### Utilities -let { getBoolPref, setBoolPref, getIntPref, setIntPref } = +let { getBoolPref, setBoolPref, getIntPref, setIntPref, clearUserPref } = ChromeUtils.import("resource://gre/modules/Services.jsm", {}).Services.prefs; // Used for detecting the current system architecture @@ -28,7 +28,6 @@ const kSecuritySettings = { "javascript.options.ion" : [, false, false, false, true ], "javascript.options.baselinejit" : [, false, false, false, true ], "javascript.options.native_regexp" : [, false, false, false, true ], - "media.webaudio.enabled" : [, false, false, false, true ], "mathml.disabled" : [, true, true, true, false], "gfx.font_rendering.graphite.enabled" : [, false, false, false, true ], "gfx.font_rendering.opentype_svg.enabled" : [, false, false, false, true ], @@ -143,7 +142,6 @@ var initialize = function () { // If the security settings level and the prefs that we did not change // have the default value, reset to default security level. const prefNames = [ - "media.webaudio.enabled", "mathml.disabled", "gfx.font_rendering.opentype_svg.enabled", "svg.disabled" @@ -153,6 +151,7 @@ var initialize = function () { read_setting_from_prefs(prefNames) === 4) { setBoolPref(kCustomPref, false); } + clearUserPref("media.webaudio.enabled"); setIntPref(kSliderMigration, 1); } log(4, "security-prefs.js initialization complete");

1 0

[torbutton/master] Bug 40082: Let JavaScript on safest setting handled by NoScript again
by gk＠torproject.org 21 Aug '20

21 Aug '20

commit 8ed0f04ce76f0ed311975082c739823ecbbbaf80 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Aug 20 18:10:34 2020 +0000 Bug 40082: Let JavaScript on safest setting handled by NoScript again --- modules/security-prefs.js | 28 ++++++++-------------------- 1 file changed, 8 insertions(+), 20 deletions(-) diff --git a/modules/security-prefs.js b/modules/security-prefs.js index c0128eea..d02e0d94 100644 --- a/modules/security-prefs.js +++ b/modules/security-prefs.js @@ -4,11 +4,6 @@ let { getBoolPref, setBoolPref, getIntPref, setIntPref, clearUserPref } = ChromeUtils.import("resource://gre/modules/Services.jsm", {}).Services.prefs; - -// Used for detecting the current system architecture -let { XPCOMABI } = - Cu.import("resource://gre/modules/Services.jsm", {}).Services.appinfo; - let { bindPref, bindPrefAndInit } = ChromeUtils.import("resource://torbutton/modules/utils.js", {}); let logger = Cc["@torproject.org/torbutton-logger;1"] @@ -34,7 +29,6 @@ const kSecuritySettings = { "svg.disabled" : [, true, false, false, false], "javascript.options.asmjs" : [, false, false, false, true ], "javascript.options.wasm" : [, false, false, false, true ], - "javascript.enabled" : [, false, true, true, true ], }; // The Security Settings prefs in question. @@ -137,22 +131,16 @@ var initialize = function () { write_setting_to_prefs(2); } - // Revert #31616 and #31140 fixes - if (getIntPref(kSliderMigration, 0) < 1) { - // If the security settings level and the prefs that we did not change - // have the default value, reset to default security level. - const prefNames = [ - "mathml.disabled", - "gfx.font_rendering.opentype_svg.enabled", - "svg.disabled" - ]; - if (getBoolPref(kCustomPref) && XPCOMABI.split("-")[0] == "aarch64" && - getIntPref(kSliderPref) === 4 && - read_setting_from_prefs(prefNames) === 4) { - setBoolPref(kCustomPref, false); + // Revert #33613 fix + if (getIntPref(kSliderMigration, 0) < 2) { + // We can't differentiate between users having flipped `javascript.enabled` + // to `false` before it got governed by the security settings vs. those who + // had it flipped due to #33613. Reset the preference for everyone. + if (getIntPref(kSliderPref) === 1) { + setBoolPref("javascript.enabled", true); } clearUserPref("media.webaudio.enabled"); - setIntPref(kSliderMigration, 1); + setIntPref(kSliderMigration, 2); } log(4, "security-prefs.js initialization complete"); };

1 0

[tor-browser-build/master] Bug 40053: Also create the langpacks tarball for non-release builds.
by gk＠torproject.org 20 Aug '20

20 Aug '20

commit 3a845c42c631e0a746bc0cd702c54fdf7e8c08d3 Author: anonym <anonym(a)riseup.net> Date: Mon Aug 17 12:52:38 2020 +0200 Bug 40053: Also create the langpacks tarball for non-release builds. This is useful for Tails' QA when integrating new Tor Browser major releases. --- projects/tor-browser/build | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/tor-browser/build b/projects/tor-browser/build index 24c8265..2763ce4 100644 --- a/projects/tor-browser/build +++ b/projects/tor-browser/build @@ -301,7 +301,7 @@ cp $rootdir/[% c('input_files_by_name/firefox') %]/mar-tools-*.zip "$OUTDIR"/ [% END -%] # Create a tarball with all Linux x86_64 language packs (Bug 32676) -[% IF c("var/release") && c("var/linux-x86_64") && ! c("var/multi_lingual") && ! c("var/testbuild") -%] +[% IF c("var/linux-x86_64") && ! c("var/multi_lingual") && ! c("var/testbuild") -%] pushd $rootdir/[% c('input_files_by_name/firefox-langpacks') %] [% c('tar', { tar_src => [ '.' ],

1 0