- tbb-commits - lists.torproject.org

[tor-browser-bundle/master] fixup! Bug 16285: Remove clearkey related library stripping
by gk＠torproject.org 23 May '17

23 May '17

commit c18c6f80c49d7da97d006d3fd5201b11f1312bbc Author: Georg Koppen <gk(a)torproject.org> Date: Tue May 23 09:50:12 2017 +0000 fixup! Bug 16285: Remove clearkey related library stripping --- gitian/descriptors/linux/gitian-firefox.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index b68dba7..ae0d14f 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -94,6 +94,7 @@ script: | export LD_LIBRARY_PATH=$INSTDIR/gcc/lib$ARCH # mkdir -p $INSTDIR/Browser/ + mkdir -p $INSTDIR/Debug/Browser/ cd tor-browser # run get-moz-build-date before removing .git, which is used to get the year

1 0

[tor-browser-bundle/master] Bug 16285: Remove clearkey related library stripping
by gk＠torproject.org 23 May '17

23 May '17

commit e8d869e142439436104b8b1f8b807406fd68e104 Author: Georg Koppen <gk(a)torproject.org> Date: Tue May 23 09:01:45 2017 +0000 Bug 16285: Remove clearkey related library stripping We don't ship the clearkey DRM system yet, thus we don't need to strip the respective binaries. --- gitian/descriptors/linux/gitian-firefox.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index a3bc37f..b68dba7 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -94,7 +94,6 @@ script: | export LD_LIBRARY_PATH=$INSTDIR/gcc/lib$ARCH # mkdir -p $INSTDIR/Browser/ - mkdir -p $INSTDIR/Debug/Browser/gmp-clearkey/0.1 cd tor-browser # run get-moz-build-date before removing .git, which is used to get the year @@ -150,7 +149,7 @@ script: | # Strip and generate debuginfo for the firefox binary that we keep, all *.so # files, the plugin-container, and the updater (see ticket #10126) cd $INSTDIR - for LIB in Browser/*.so Browser/firefox Browser/plugin-container Browser/gmp-clearkey/0.1/*.so Browser/updater + for LIB in Browser/*.so Browser/firefox Browser/plugin-container Browser/updater do objcopy --only-keep-debug $LIB Debug/$LIB strip $LIB

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 22 May '17

22 May '17

commit 726b6d699e101570b14e3eb091ec94e9d5ee1946 Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 22 12:52:09 2017 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. Adapt preferences to take new EME related ones into account. --- browser/app/profile/000-tor-browser.js | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 7b0ad71..53d1ac2 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -228,12 +228,15 @@ pref("media.gmp-manager.url.override", "data:text/plain,"); // server. There is a local fallback that must be blocked now as well. See: // https://bugzilla.mozilla.org/show_bug.cgi?id=1267495. pref("media.gmp-manager.updateEnabled", false); -// EME prefs: Strictly speaking these prefs don't need to be set as we are -// using the --disable-eme compile flag. However, in order to not confuse users, -// who might stumble upon them while looking into about:config, we set them to -// 'false' communicating that EME is really disabled. +// Mozilla is relying on preferences to make sure no DRM blob is downloaded and +// run. Even though those prefs should be set correctly by specifying +// --disable-eme (which we do), we disable all of them here as well for defense +// in depth. pref("browser.eme.ui.enabled", false); +pref("media.gmp-eme-adobe.visible", false); pref("media.gmp-eme-adobe.enabled", false); +pref("media.gmp-widevinecdm.visible", false); +pref("media.gmp-widevinecdm.enabled", false); pref("media.eme.enabled", false); pref("media.eme.apiVisible", false); // WebIDE can bypass proxy settings for remote debugging. It also downloads

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB3: Tor Browser's official .mozconfigs.
by gk＠torproject.org 22 May '17

22 May '17

commit 62546181d759aaf44216e6f32a79c89e55335c4e Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 22 12:41:17 2017 +0000 fixup! TB3: Tor Browser's official .mozconfigs. Make EME comment clearer for ESR52. --- .mozconfig | 2 +- .mozconfig-mac | 3 +-- .mozconfig-mingw | 2 +- 3 files changed, 3 insertions(+), 4 deletions(-) diff --git a/.mozconfig b/.mozconfig index cde5b49..4eeb339 100755 --- a/.mozconfig +++ b/.mozconfig @@ -23,7 +23,7 @@ ac_add_options --disable-debug ac_add_options --disable-maintenance-service ac_add_options --disable-crashreporter ac_add_options --disable-webrtc -# Let's not compile EME at least until we can enable ClearKey and only Clearkey. +# Let's make sure no preference is enabling either Adobe's or Google's CDM. ac_add_options --disable-eme #ac_add_options --disable-ctypes ac_add_options --enable-jemalloc=4 diff --git a/.mozconfig-mac b/.mozconfig-mac index 7088e48..844ee2e 100644 --- a/.mozconfig-mac +++ b/.mozconfig-mac @@ -49,7 +49,6 @@ ac_add_options --disable-crashreporter ac_add_options --disable-maintenance-service ac_add_options --disable-webrtc ac_add_options --disable-tests -# Let's not compile EME at least until we can enable ClearKey and only Clearkey. -# (Apart from that there is no Adobe CRM module for OS X right now) +# Let's make sure no preference is enabling either Adobe's or Google's CDM. ac_add_options --disable-eme # ac_add_options --disable-ctypes diff --git a/.mozconfig-mingw b/.mozconfig-mingw index de86c49b..af30573 100644 --- a/.mozconfig-mingw +++ b/.mozconfig-mingw @@ -21,7 +21,7 @@ ac_add_options --enable-verify-mar # We can't build the sandbox code with mingw-w64: # https://bugzilla.mozilla.org/show_bug.cgi?id=1042426 ac_add_options --disable-sandbox -# EME is not running without sandbox. Thus, don't compile it in the first place. +# Let's make sure no preference is enabling either Adobe's or Google's CDM. ac_add_options --disable-eme ac_add_options --disable-crashreporter ac_add_options --disable-maintenance-service

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] Bug 16285: Exclude ClearKey system for now
by gk＠torproject.org 22 May '17

22 May '17

commit 46d6d3a534c8f8c56194415c0839a4a90d17049b Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 22 12:44:40 2017 +0000 Bug 16285: Exclude ClearKey system for now In the past the ClearKey system had not been compiled when specifying --disable-eme. But that changed and it is even bundled nowadays (see: Mozilla's bug 1300654). We don't want to ship it right now as the use case for it is not really visible while the code had security vulnerabilities in the past. --- browser/installer/package-manifest.in | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/browser/installer/package-manifest.in b/browser/installer/package-manifest.in index 43c89a9..1233249 100644 --- a/browser/installer/package-manifest.in +++ b/browser/installer/package-manifest.in @@ -814,8 +814,8 @@ bin/libfreebl_32int64_3.so ; media -@RESPATH@/gmp-clearkey/0.1/@DLL_PREFIX@clearkey@DLL_SUFFIX@ -@RESPATH@/gmp-clearkey/0.1/clearkey.info +;@RESPATH@/gmp-clearkey/0.1/@DLL_PREFIX@clearkey@DLL_SUFFIX@ +;@RESPATH@/gmp-clearkey/0.1/clearkey.info ; gfx #ifdef XP_WIN

1 0

[tor-browser/tor-browser-52.1.1esr-7.0-1] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 22 May '17

22 May '17

commit ba7cbd186c5692267ba80eb6a998c7abab2a76a9 Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 22 12:52:09 2017 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. Adapt preferences to take new EME related ones into account. --- browser/app/profile/000-tor-browser.js | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 7b0ad71..53d1ac2 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -228,12 +228,15 @@ pref("media.gmp-manager.url.override", "data:text/plain,"); // server. There is a local fallback that must be blocked now as well. See: // https://bugzilla.mozilla.org/show_bug.cgi?id=1267495. pref("media.gmp-manager.updateEnabled", false); -// EME prefs: Strictly speaking these prefs don't need to be set as we are -// using the --disable-eme compile flag. However, in order to not confuse users, -// who might stumble upon them while looking into about:config, we set them to -// 'false' communicating that EME is really disabled. +// Mozilla is relying on preferences to make sure no DRM blob is downloaded and +// run. Even though those prefs should be set correctly by specifying +// --disable-eme (which we do), we disable all of them here as well for defense +// in depth. pref("browser.eme.ui.enabled", false); +pref("media.gmp-eme-adobe.visible", false); pref("media.gmp-eme-adobe.enabled", false); +pref("media.gmp-widevinecdm.visible", false); +pref("media.gmp-widevinecdm.enabled", false); pref("media.eme.enabled", false); pref("media.eme.apiVisible", false); // WebIDE can bypass proxy settings for remote debugging. It also downloads

1 0

[tor-browser/tor-browser-52.1.1esr-7.0-1] Bug 16285: Exclude ClearKey system for now
by gk＠torproject.org 22 May '17

22 May '17

commit e948ae5d404321a1ed0316ffb97baf45ee0163a5 Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 22 12:44:40 2017 +0000 Bug 16285: Exclude ClearKey system for now In the past the ClearKey system had not been compiled when specifying --disable-eme. But that changed and it is even bundled nowadays (see: Mozilla's bug 1300654). We don't want to ship it right now as the use case for it is not really visible while the code had security vulnerabilities in the past. --- browser/installer/package-manifest.in | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/browser/installer/package-manifest.in b/browser/installer/package-manifest.in index 43c89a9..1233249 100644 --- a/browser/installer/package-manifest.in +++ b/browser/installer/package-manifest.in @@ -814,8 +814,8 @@ bin/libfreebl_32int64_3.so ; media -@RESPATH@/gmp-clearkey/0.1/@DLL_PREFIX@clearkey@DLL_SUFFIX@ -@RESPATH@/gmp-clearkey/0.1/clearkey.info +;@RESPATH@/gmp-clearkey/0.1/@DLL_PREFIX@clearkey@DLL_SUFFIX@ +;@RESPATH@/gmp-clearkey/0.1/clearkey.info ; gfx #ifdef XP_WIN

1 0

[tor-browser/tor-browser-52.1.1esr-7.0-1] fixup! TB3: Tor Browser's official .mozconfigs.
by gk＠torproject.org 22 May '17

22 May '17

commit 100fea0348ed02fd181080fbc2b131994adaab4b Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 22 12:41:17 2017 +0000 fixup! TB3: Tor Browser's official .mozconfigs. Make EME comment clearer for ESR52. --- .mozconfig | 2 +- .mozconfig-mac | 3 +-- .mozconfig-mingw | 2 +- 3 files changed, 3 insertions(+), 4 deletions(-) diff --git a/.mozconfig b/.mozconfig index cde5b49..4eeb339 100755 --- a/.mozconfig +++ b/.mozconfig @@ -23,7 +23,7 @@ ac_add_options --disable-debug ac_add_options --disable-maintenance-service ac_add_options --disable-crashreporter ac_add_options --disable-webrtc -# Let's not compile EME at least until we can enable ClearKey and only Clearkey. +# Let's make sure no preference is enabling either Adobe's or Google's CDM. ac_add_options --disable-eme #ac_add_options --disable-ctypes ac_add_options --enable-jemalloc=4 diff --git a/.mozconfig-mac b/.mozconfig-mac index 7088e48..844ee2e 100644 --- a/.mozconfig-mac +++ b/.mozconfig-mac @@ -49,7 +49,6 @@ ac_add_options --disable-crashreporter ac_add_options --disable-maintenance-service ac_add_options --disable-webrtc ac_add_options --disable-tests -# Let's not compile EME at least until we can enable ClearKey and only Clearkey. -# (Apart from that there is no Adobe CRM module for OS X right now) +# Let's make sure no preference is enabling either Adobe's or Google's CDM. ac_add_options --disable-eme # ac_add_options --disable-ctypes diff --git a/.mozconfig-mingw b/.mozconfig-mingw index de86c49b..af30573 100644 --- a/.mozconfig-mingw +++ b/.mozconfig-mingw @@ -21,7 +21,7 @@ ac_add_options --enable-verify-mar # We can't build the sandbox code with mingw-w64: # https://bugzilla.mozilla.org/show_bug.cgi?id=1042426 ac_add_options --disable-sandbox -# EME is not running without sandbox. Thus, don't compile it in the first place. +# Let's make sure no preference is enabling either Adobe's or Google's CDM. ac_add_options --disable-eme ac_add_options --disable-crashreporter ac_add_options --disable-maintenance-service

1 0

[tor-browser-bundle/master] Bug 22324: Fix broken tab crash pages on higher security levels
by gk＠torproject.org 22 May '17

22 May '17

commit 78de9734135f21077410d295b689751d60727592 Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 22 09:30:33 2017 +0000 Bug 22324: Fix broken tab crash pages on higher security levels We need to allow JavaScript on `about:tabcrashed` pages explicitly. Otherwise are those pages broken on higher security levels. --- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js index 53c1a25..1465e29 100644 --- a/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false); diff --git a/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js index 53c1a25..1465e29 100644 --- a/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false); diff --git a/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js index 53c1a25..1465e29 100644 --- a/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds about:tabcrashed"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false);

1 0

[tor-browser/tor-browser-52.1.1esr-7.0-1] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 22 May '17

22 May '17

commit 886808dc4e21eef3595fa1042f792927bb898193 Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 22 08:36:35 2017 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. The Battery API is not available to content anymore since Firefox 52. Thus, we don't need to set `dom.battery.enabled` anymore. Fixes bug 5293. --- browser/app/profile/000-tor-browser.js | 1 - 1 file changed, 1 deletion(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index fb7b078..7b0ad71 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -137,7 +137,6 @@ pref("social.whitelist", ""); pref("webgl.min_capability_mode", true); pref("webgl.disable-extensions", true); pref("webgl.disable-fail-if-major-performance-caveat", true); -pref("dom.battery.enabled", false); // fingerprinting due to differing OS implementations pref("dom.network.enabled",false); // fingerprinting due to differing OS implementations pref("gfx.downloadable_fonts.fallback_delay", -1); pref("general.appname.override", "Netscape");

1 0