- tbb-commits - lists.torproject.org

[tor-browser/tor-browser-68.9.0esr-9.5-1] fixup! Pick up latest Torbutton code
by sysrqb＠torproject.org 23 Jun '20

23 Jun '20

commit c48e4ca617fbeb0e6b0e5b7c44b601dfbe2a9531 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Tue Jun 23 14:40:28 2020 +0000 fixup! Pick up latest Torbutton code --- toolkit/torproject/torbutton | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/toolkit/torproject/torbutton b/toolkit/torproject/torbutton index 0b6562dfffd0..605e9d398ab0 160000 --- a/toolkit/torproject/torbutton +++ b/toolkit/torproject/torbutton @@ -1 +1 @@ -Subproject commit 0b6562dfffd0e032ea0051a8c09069fba37d4838 +Subproject commit 605e9d398ab026ce53ec8ad106848bfe5ae5e627

1 0

[tor-browser-build/master] Bug 32895: Improve MAR-signing check script
by sysrqb＠torproject.org 22 Jun '20

22 Jun '20

commit a3c272d2e53ea60c1a596bc25189e6f63a535471 Author: Georg Koppen <gk(a)torproject.org> Date: Sat May 23 20:37:55 2020 +0000 Bug 32895: Improve MAR-signing check script We improve the script in the following ways: 1) Properly check the signature of the MAR files 2) Take #20254 into account 3) Fix all issues `shellcheck` found --- tools/marsigning_check.sh | 127 +++++++++++++++++++++++++++++++++------------- 1 file changed, 91 insertions(+), 36 deletions(-) diff --git a/tools/marsigning_check.sh b/tools/marsigning_check.sh index 3e58249..fb5e4f6 100755 --- a/tools/marsigning_check.sh +++ b/tools/marsigning_check.sh @@ -1,6 +1,6 @@ #!/bin/sh -# Copyright (c) 2019, The Tor Project, Inc. +# Copyright (c) 2020, The Tor Project, Inc. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are @@ -33,9 +33,20 @@ # Usage: # 1) Let SIGNMAR point to your signmar binary # 2) Let LD_LIBRARY_PATH point to the mar-tools directory -# 3) Change into the directory containing the MAR files and the +# 3) Let NSS_DB_DIR point to the directory containing the database with the +# signing certificate to check against. +# +# To create the database to use for signature checking import the +# release*.der certificate of your choice found in +# toolkit/mozapps/update/updater by issuing the following commands: +# +# mkdir nssdb +# certutil -d nssdb -N --empty-password +# certutil -A -n "marsigner" -t,, -d nssdb -i /path/to/.der +# +# 4) Change into the directory containing the MAR files and the # sha256sums-unsigned-build.txt/sha256sums-unsigned-build.incrementals.txt. -# 4) Run /path/to/marsigning_check.sh +# 5) Run /path/to/marsigning_check.sh if [ -z "$SIGNMAR" ] then @@ -49,60 +60,104 @@ then exit 1 fi -UNSIGNED_MARS=0 -BADSIGNED_MARS=0 +if [ -z "$NSS_DB_DIR" ] +then + echo "The path to your nssdb directory is missing!" + exit 1 +fi + +unsigned_mars=0 +badsigned_mars=0 +not_reproduced_mars=0 +# XXX: Stripping the signature of signed macOS MAR files is currently not +# expected to be reproducible, see: #20254. +not_reproduced_mars_expected=0 mkdir tmp -for f in `ls *.mar`; do +for f in *.mar; do case $f in - *.incremental.mar) SHA256_TXT=`grep "$f" \ - sha256sums-unsigned-build.incrementals.txt`;; - *) SHA256_TXT=`grep "$f" sha256sums-unsigned-build.txt`;; + *.incremental.mar) sha256_txt=$(grep "$f" \ + sha256sums-unsigned-build.incrementals.txt);; + *) sha256_txt=$(grep "$f" sha256sums-unsigned-build.txt);; esac - # Test 1: Is the .mar file still unsigned? I.e. does its SHA-256 sum still - # match the one we had before we signed it? If so, notify us later and exit. - if [ "$SHA256_TXT" = "`sha256sum $f`" ] + # Test 1: Is the MAR file correctly signed? + echo "Verifying the MAR signature of $f..." + if ! $SIGNMAR -d "$NSS_DB_DIR" -n marsigner -v "$f" then - echo "$f has still the SHA-256 sum of the unsigned MAR file!" - UNSIGNED_MARS=`expr $UNSIGNED_MARS + 1` + # Something went wrong. Let's figure out what. + if [ "$sha256_txt" = "$(sha256sum "$f")" ] + then + echo "$f has still the SHA-256 sum of the unsigned MAR file!" + unsigned_mars=$((unsigned_mars + 1)) + else + echo "$f is either signed with the wrong key or the signature is" \ + "corrupted!" + badsigned_mars=$((badsigned_mars +1)) + fi fi - # Test 2: Do we get the old SHA-256 sum after stripping the MAR signature? If - # not, notify us later and exit. - if [ "$UNSIGNED_MARS" = "0" ] + # Test 2: Do we get the old SHA-256 sum after stripping the MAR signature? We + # want to have a test for that to be sure we've the signed MAR files in front + # of us which we actually want to ship to our users. + if [ "$unsigned_mars" = "0" ] && [ "$badsigned_mars" = "0" ] then - # At least we seem to have attempted to sign the MAR file. Let's see if we - # succeeded by stripping the signature. This behavior is reproducible. - # Thus, we know if we don't get the same SHA-256 sum we did not sign the - # bundle correctly. - echo "Trying to strip the MAR signature of $f..." - ${SIGNMAR} -r $f tmp/$f - cd tmp - if ! [ "$SHA256_TXT" = "`sha256sum $f`" ] + # At least we seem to have succeeded in signing the MAR file. Let's see if + # it is the expected one. + echo "Checking the SHA-256 sum of the stripped $f..." + ${SIGNMAR} -r "$f" tmp/"$f" + cd tmp || exit 1 + if ! [ "$sha256_txt" = "$(sha256sum "$f")" ] then - echo "$f does not have the SHA-256 sum of the unsigned MAR file!" - BADSIGNED_MARS=`expr $BADSIGNED_MARS + 1` + not_reproduced_mars=$((not_reproduced_mars + 1)) + case "$f" in + *osx64*) + not_reproduced_mars_expected=$((not_reproduced_mars_expected + 1)) + ;; + *) echo "$f does not have the SHA-256 sum of the unsigned MAR file!" + ;; + esac fi - rm $f + rm "$f" cd .. fi + echo "" done rm -rf tmp/ -if ! [ "$UNSIGNED_MARS" = "0" ] +if ! [ "$unsigned_mars" = "0" ] || ! [ "$badsigned_mars" = "0" ] then - echo "We got $UNSIGNED_MARS unsigned MAR file(s), exiting..." + echo "We got:" + if ! [ "$unsigned_mars" = "0" ] + then + echo "$unsigned_mars unsigned MAR file(s)" + fi + if ! [ "$badsigned_mars" = "0" ] + then + echo "$badsigned_mars badly signed MAR file(s)" + fi + echo "exiting..." exit 1 fi -if ! [ "$BADSIGNED_MARS" = "0" ] +if ! [ "$not_reproduced_mars" = "0" ] then - echo "We got $BADSIGNED_MARS badly signed MAR file(s), exiting..." - exit 1 + echo "We got $not_reproduced_mars non-matching, signed MAR files." + if [ "$not_reproduced_mars" -eq "$not_reproduced_mars_expected" ] + then + echo "This is currently expected as we got the same amount of" \ + "non-matching macOS MAR files." + echo "The signatures and non-macOS MAR files are fine." + exit 0 + else + echo "This is currently unexpected as we only got" \ + "$not_reproduced_mars_expected non-matching macOS MAR files," \ + "exiting..." + exit 1 + fi +else + echo "The signatures and MAR files are fine." + exit 0 fi - -echo "The signatures are fine." -exit 0

1 0

[tor-browser-build/master] Merge remote-tracking branch 'gktpo/bug_32895_v4'
by sysrqb＠torproject.org 22 Jun '20

22 Jun '20

commit b74754a3fb0af3c9b015a3113aba1d9f8671fa32 Merge: a6e6caf a3c272d Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Sat Jun 20 17:14:56 2020 +0000 Merge remote-tracking branch 'gktpo/bug_32895_v4' tools/marsigning_check.sh | 127 +++++++++++++++++++++++++++++++++------------- 1 file changed, 91 insertions(+), 36 deletions(-)

1 0

[tor-browser-build/master] Bug 40001: Don't bundle geckodriver in debug builds
by sysrqb＠torproject.org 22 Jun '20

22 Jun '20

commit a6e6caf5f11b578d7a177c519ca0d2bbb9a154dd Author: Georg Koppen <gk(a)torproject.org> Date: Thu Jun 18 08:11:13 2020 +0000 Bug 40001: Don't bundle geckodriver in debug builds --- projects/firefox/build | 18 +++++++++++------- projects/tor-browser/build | 4 +++- 2 files changed, 14 insertions(+), 8 deletions(-) diff --git a/projects/firefox/build b/projects/firefox/build index cd0d6b5..16984f3 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -160,7 +160,7 @@ rm -f js/src/configure [% END %] [% IF c("var/linux") %] - [% IF c("var/linux-x86_64") %] + [% IF c("var/linux-x86_64") && !c("var/asan") %] cp obj-*/testing/geckodriver/x86_64-unknown-linux-gnu/release/geckodriver $distdir [% END %] cp -a obj-*/dist/firefox/* $distdir/Browser/ @@ -225,8 +225,10 @@ cp -p obj-*/dist/host/bin/mbsdiff $MARTOOLS/ cd $distdir [% IF c("var/linux-x86_64") %] - # No need for an unstripped geckodriver - strip geckodriver + [% IF !c("var/asan") %] + # No need for an unstripped geckodriver + strip geckodriver + [% END %] mkdir -p $distdir/Debug/Browser/gtk2 # Strip and generate debuginfo for the firefox binary that we keep, all *.so # files, the plugin-container, and the updater (see ticket #10126) @@ -272,10 +274,12 @@ END; tar_src => [ 'Debug' ], tar_args => '-cJf ' _ dest_dir _ '/' _ c('filename') _ '/tor-browser-debug.tar.xz', }) %] -[% c('tar', { - tar_src => [ 'geckodriver' ], - tar_args => '-cJf ' _ dest_dir _ '/' _ c('filename') _ '/geckodriver-linux64.tar.xz', - }) %] + [% IF !c("var/asan") %] + [% c('tar', { + tar_src => [ 'geckodriver' ], + tar_args => '-cJf ' _ dest_dir _ '/' _ c('filename') _ '/geckodriver-linux64.tar.xz', + }) %] + [% END %] [% END %] [% c('zip', { diff --git a/projects/tor-browser/build b/projects/tor-browser/build index b9732e8..386ea26 100644 --- a/projects/tor-browser/build +++ b/projects/tor-browser/build @@ -293,7 +293,9 @@ SCRIPT_EOF cp $rootdir/[% c('input_files_by_name/firefox') %]/mar-tools-*.zip "$OUTDIR"/ [% IF c("var/linux-x86_64") -%] cp $rootdir/[% c('input_files_by_name/firefox') %]/tor-browser-debug.tar.xz "$OUTDIR"/tor-browser-[% c("var/mar_osname") %]-debug.tar.xz - cp $rootdir/[% c('input_files_by_name/firefox') %]/geckodriver-linux64.tar.xz "$OUTDIR"/ + [% IF !c("var/asan") -%] + cp $rootdir/[% c('input_files_by_name/firefox') %]/geckodriver-linux64.tar.xz "$OUTDIR"/ + [% END -%] [% END -%] [% IF c("var/linux") -%] cp $rootdir/[% c('input_files_by_name/tor') %]/tor-debug.tar.xz "$OUTDIR"/tor-[% c("var/mar_osname") %]-debug.tar.xz

1 0

[tor-browser-bundle-testsuite/master] Small fix in install instructions
by gk＠torproject.org 22 Jun '20

22 Jun '20

commit 674d327f80d2281f015d0e81dcd13ba8a782a19f Author: Georg Koppen <gk(a)torproject.org> Date: Mon Jun 22 14:28:59 2020 +0000 Small fix in install instructions --- doc/install.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/install.txt b/doc/install.txt index 8a47992..f42db00 100644 --- a/doc/install.txt +++ b/doc/install.txt @@ -9,7 +9,7 @@ virtualenv, and xvfb or the Xorg dummy driver. Those dependencies can be installed by running the 'install-deps' script as root, which will install the needed packages. This script has been -tested on Ubuntu, Debian, Fedora, Centos. +tested on Ubuntu, Debian, Fedora, and Centos. After installing the required dependencies, a python virtualenv needs to be created with marionette. This can be with the 'setup-virtualenv'

1 0

[rbm/master] Fix typos
by gk＠torproject.org 22 Jun '20

22 Jun '20

commit b9fb4a336ec3c81b4dad216b7c6cfca314ec1c72 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Jun 22 14:24:30 2020 +0000 Fix typos --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index e3ab848..c5cc595 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,8 @@ rbm: Reproducible Build Manager =============================== -rbm is a packaging tool that help you create and build packages for -multiple linux distributions, and automate the parts that can be +rbm is a packaging tool that helps you create and build packages for +multiple Linux distributions, and automate the parts that can be automated. It includes options to run the build in a defined environement to allow reproducing the build.

1 0

[tor-browser-spec/master] We don't have a beta series anymore
by gk＠torproject.org 22 Jun '20

22 Jun '20

commit 38e3ceaeeaa2de5e140d7fd6dcddf33ad0b7365a Author: Georg Koppen <gk(a)torproject.org> Date: Mon Jun 22 14:21:16 2020 +0000 We don't have a beta series anymore --- processes/VersionNumbers | 5 ----- 1 file changed, 5 deletions(-) diff --git a/processes/VersionNumbers b/processes/VersionNumbers index 80b32a5..210db16 100644 --- a/processes/VersionNumbers +++ b/processes/VersionNumbers @@ -6,11 +6,6 @@ An alpha version is a series of dot separated numbers, followed by an 4.0a1 4.0a2 -A beta version is a series of dot separated numbers, followed by a -'b' and an other number. Examples: - 4.0b1 - 4.0b2 - A stable version is a series of dot separated numbers. Examples: 3.6.6 4.0

1 0

[tor-browser-build/master] Fix typo in Changelog
by gk＠torproject.org 22 Jun '20

22 Jun '20

commit ce125d45ebf984bb043cdac24259e039adbcfe94 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Jun 22 14:17:24 2020 +0000 Fix typo in Changelog --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index c045d53..224248c 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -37,7 +37,7 @@ Tor Browser 9.5 -- June 2 2020 * Bug 30787: Add lt locale * Bug 30788: Add ms locale * Bug 30851: Move default preferences to 000-tor-browser.js - * Bug 30888: move torbutton_util.js to modules/utils.js + * Bug 30888: Move torbutton_util.js to modules/utils.js * Bug 31134: Govern graphite again by security settings * Bug 31395: Remove inline script in aboutTor.xhtml * Bug 31499: Update libevent to 2.1.11-stable

1 0

[tor-launcher/master] Translations update
by gk＠torproject.org 22 Jun '20

22 Jun '20

commit d9aef347505e6a6b0fa35f64c195ae078b6eeeed Author: Georg Koppen <gk(a)torproject.org> Date: Mon Jun 22 13:09:06 2020 +0000 Translations update --- src/chrome/locale/nl/network-settings.dtd | 2 +- src/chrome/locale/sw/network-settings.dtd | 4 ++-- src/chrome/locale/sw/torlauncher.properties | 6 +++--- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/src/chrome/locale/nl/network-settings.dtd b/src/chrome/locale/nl/network-settings.dtd index 0143044..aa8b25f 100644 --- a/src/chrome/locale/nl/network-settings.dtd +++ b/src/chrome/locale/nl/network-settings.dtd @@ -4,7 +4,7 @@ <!ENTITY torsettings.wizard.title.connecting "Een verbinding maken">  -<!ENTITY torlauncher.localePicker.title "Tor-browsertaal"> +<!ENTITY torlauncher.localePicker.title "Taal van Tor Browser"> <!ENTITY torlauncher.localePicker.prompt "Selecteer een taal.">  diff --git a/src/chrome/locale/sw/network-settings.dtd b/src/chrome/locale/sw/network-settings.dtd index dff7d1b..e49ccf7 100644 --- a/src/chrome/locale/sw/network-settings.dtd +++ b/src/chrome/locale/sw/network-settings.dtd @@ -12,7 +12,7 @@ <!ENTITY torSettings.connectPrompt "Click “Connect” to connect to Tor."> <!ENTITY torSettings.configurePrompt "Click “Configure” to adjust network settings if you are in a country that censors Tor (such as Egypt, China, Turkey) or if you are connecting from a private network that requires a proxy."> <!ENTITY torSettings.configure "Configure"> -<!ENTITY torSettings.connect "Connect"> +<!ENTITY torSettings.connect "Unganisha">  @@ -72,7 +72,7 @@ nenosiri"> <!ENTITY torPreferences.useBridge "Use a bridge"> <!ENTITY torPreferences.requestNewBridge "Request a New Bridge…"> <!ENTITY torPreferences.provideBridge "Provide a bridge"> -<!ENTITY torPreferences.advanced "Advanced"> +<!ENTITY torPreferences.advanced "Iliyoboreshwa"> <!ENTITY torPreferences.advancedDescription "Configure how Tor Browser connects to the internet."> <!ENTITY torPreferences.firewallPortsPlaceholder "Comma-separated values"> <!ENTITY torPreferences.requestBridgeDialogTitle "Request Bridge"> diff --git a/src/chrome/locale/sw/torlauncher.properties b/src/chrome/locale/sw/torlauncher.properties index 82e6d2e..7fc07c7 100644 --- a/src/chrome/locale/sw/torlauncher.properties +++ b/src/chrome/locale/sw/torlauncher.properties @@ -42,10 +42,10 @@ torlauncher.unable_to_get_bridge=Unable to obtain a bridge from BridgeDB.\n\n%S torlauncher.no_meek=This browser is not configured for meek, which is needed to obtain bridges. torlauncher.no_bridges_available=No bridges are available at this time. Sorry. -torlauncher.connect=Connect +torlauncher.connect=Unganisha torlauncher.restart_tor=Restart Tor -torlauncher.quit=Quit -torlauncher.quit_win=Exit +torlauncher.quit=Ondoka +torlauncher.quit_win=toka torlauncher.done=Imefanywa torlauncher.forAssistance=For assistance, contact %S

1 0

[tor-browser/tor-browser-68.9.0esr-10.0-1] fixup! Pick up latest Torbutton code
by gk＠torproject.org 22 Jun '20

22 Jun '20

commit a2b6a23473be3d6ee6e35bd3b35dfda763c8d988 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Jun 22 13:21:50 2020 +0000 fixup! Pick up latest Torbutton code --- toolkit/torproject/torbutton | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/toolkit/torproject/torbutton b/toolkit/torproject/torbutton index 11a79a1ca82f..1a5cedbe6b0a 160000 --- a/toolkit/torproject/torbutton +++ b/toolkit/torproject/torbutton @@ -1 +1 @@ -Subproject commit 11a79a1ca82f227ec5914f54c333d5cf90f4e7c5 +Subproject commit 1a5cedbe6b0a8cb3c9b37954ebda24385c9d9495

1 0