- tbb-commits - lists.torproject.org

[Git][tpo/applications/tor-browser-build][maint-12.0] Bug 40708: tor.exe in tor-expert-bundle not writing stdout even when run from cmd.exe
by Richard Pospesel (＠richard) 09 Dec '22

09 Dec '22

Richard Pospesel pushed to branch maint-12.0 at The Tor Project / Applications / tor-browser-build Commits: 62a1f93c by Richard Pospesel at 2022-12-09T11:22:21+00:00 Bug 40708: tor.exe in tor-expert-bundle not writing stdout even when run from cmd.exe - - - - - 1 changed file: - projects/tor/config Changes: ===================================== projects/tor/config ===================================== @@ -15,6 +15,10 @@ targets: git_hash: main tag_gpg_id: 0 + windows: + var: + flag_mwindows: '-Wl,--subsystem,console' + linux-i686: var: libdir: lib32 View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/6… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/6… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 40708: tor.exe in tor-expert-bundle not writing stdout even when run from cmd.exe
by Richard Pospesel (＠richard) 09 Dec '22

09 Dec '22

Richard Pospesel pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 4068fc29 by Richard Pospesel at 2022-12-09T11:20:10+00:00 Bug 40708: tor.exe in tor-expert-bundle not writing stdout even when run from cmd.exe - - - - - 1 changed file: - projects/tor/config Changes: ===================================== projects/tor/config ===================================== @@ -15,6 +15,10 @@ targets: git_hash: main tag_gpg_id: 0 + windows: + var: + flag_mwindows: '-Wl,--subsystem,console' + linux-i686: var: libdir: lib32 View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/4… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/4… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser] Pushed new branch tor-browser-102.6.0esr-12.0-1
by Richard Pospesel (＠richard) 09 Dec '22

09 Dec '22

Richard Pospesel pushed new branch tor-browser-102.6.0esr-12.0-1 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/tor-brows… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][maint-12.0] 4 commits: Bug 40689: Update Ubuntu version in projects/mmdebstrap-image to 22.04.1
by boklm (＠boklm) 09 Dec '22

09 Dec '22

boklm pushed to branch maint-12.0 at The Tor Project / Applications / tor-browser-build Commits: 530ece27 by Nicolas Vigier at 2022-12-09T11:30:15+01:00 Bug 40689: Update Ubuntu version in projects/mmdebstrap-image to 22.04.1 - - - - - 6b48ead1 by Nicolas Vigier at 2022-12-09T11:30:50+01:00 Bug 40693: Patch apt-key to accept expired keys for jessie - - - - - bf8ef3b5 by Nicolas Vigier at 2022-12-09T11:30:55+01:00 Bug 40693: use faketime to run `apt-get update` on jessie - - - - - 4d2e38cd by Pier Angelo Vendrame at 2022-12-09T11:31:31+01:00 Bug 40653: Do not build compiler-rt with Clang Specifying compiler-rt as a project in LLVM is going to be deprecated. It should be compiled with runtimes, instead, or alone, if it will be still allowed. The only platform in which we were compiling compiler-rt with LLVM was Linux. But Firefox seems not to actually use it, and just use GCC's runtime, instead. However, we were also compiling compiler-rt for Android in the same project, which prevents to share the artifact with Windows and macOS. So, I have moved it to another project on its own. - - - - - 9 changed files: - projects/clang/build - projects/clang/config - + projects/compiler-rt/build - + projects/compiler-rt/config - projects/container-image/config - projects/geckoview/build - projects/geckoview/config - + projects/mmdebstrap-image/apt-key-allow-expired-key.patch - projects/mmdebstrap-image/config Changes: ===================================== projects/clang/build ===================================== @@ -3,16 +3,12 @@ distdir=/var/tmp/dist/[% project %] mkdir -p /var/tmp/dist tar -C /var/tmp/dist -xf [% c('input_files_by_name/cmake') %] -export PATH="/var/tmp/dist/cmake/bin:$PATH" +tar -C /var/tmp/dist -xf [% c('input_files_by_name/ninja') %] +export PATH="/var/tmp/dist/ninja:/var/tmp/dist/cmake/bin:$PATH" [% IF c("var/linux") %] [% pc('gcc', 'var/setup', { compiler_tarfile => c('input_files_by_name/gcc'), hardened_gcc => 0 }) %] [% pc('python', 'var/setup', { python_tarfile => c('input_files_by_name/python') }) %] -[% END -%] -[% IF c("var/android") %] - [% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] -[% END -%] -[% IF c("var/linux") || c("var/android") -%] tar -C /var/tmp/dist -xf [% c('input_files_by_name/binutils') %] export PATH="/var/tmp/dist/binutils/bin:$PATH" [% END -%] @@ -25,57 +21,15 @@ mkdir build cd build # LLVM_ENABLE_ZLIB solves the "contains a compressed section, but zlib is not available" on lld # LLVM_INSTALL_UTILS allows this LLVM to be used to compile Rust -cmake ../llvm -G "Unix Makefiles" \ +cmake ../llvm -GNinja \ -DCMAKE_INSTALL_PREFIX=$distdir \ -DCMAKE_BUILD_TYPE=Release \ - [% IF c("var/android") || c("var/macos") -%] - -DLLVM_TARGETS_TO_BUILD="X86;ARM;AArch64" \ - [% END -%] - [% IF c("var/rlbox") -%]-DLLVM_EXPERIMENTAL_TARGETS_TO_BUILD=WebAssembly[% END %] \ - -DLLVM_ENABLE_PROJECTS="clang;clang-tools-extra;compiler-rt;lld" \ + -DLLVM_TARGETS_TO_BUILD="X86;ARM;AArch64[% IF c("var/rlbox") -%];WebAssembly[% END %]" \ + -DLLVM_ENABLE_PROJECTS="clang;lld" \ -DLLVM_ENABLE_ZLIB=ON \ -DLLVM_INSTALL_UTILS=ON \ -make -j[% c("num_procs") %] -make install -cd .. - -[% IF c("var/android") -%] - echo "Compiling compiler-rt (Android only)" - rtdistdir=/var/tmp/build/rtdist - mkdir $rtdistdir - - make_compilerrt () { - mkdir "build-compilerrt-$1" - cd "build-compilerrt-$1" - cmake ../compiler-rt/ -G "Unix Makefiles" \ - -DCMAKE_INSTALL_PREFIX=$rtdistdir \ - -DCMAKE_BUILD_TYPE=Release \ - -DCMAKE_SYSTEM_NAME=Android \ - -DCMAKE_ANDROID_ARCH_ABI=$1 \ - -DCMAKE_ANDROID_NDK="$ANDROID_NDK_HOME" \ - -DCMAKE_C_FLAGS="$3 -fuse-ld=lld --rtlib=compiler-rt" \ - -DCMAKE_CXX_FLAGS="$3 -fuse-ld=lld --rtlib=compiler-rt" \ - -DCMAKE_EXE_LINKER_FLAGS="-L$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/$2" \ - -DCOMPILER_RT_BUILD_BUILTINS=ON \ - -DCOMPILER_RT_BUILD_LIBFUZZER=OFF \ - -DCOMPILER_RT_BUILD_MEMPROF=OFF \ - -DCOMPILER_RT_BUILD_ORC=OFF \ - -DCOMPILER_RT_BUILD_PROFILE=OFF \ - -DCOMPILER_RT_BUILD_SANITIZERS=OFF \ - -DCOMPILER_RT_BUILD_XRAY=OFF - make -j[% c("num_procs") %] - make install - cd .. - } - - make_compilerrt "armeabi-v7a" "arm-linux-androideabi/lib" "-DARMEABI_V7A" - make_compilerrt "arm64-v8a" "aarch64-linux-android/lib64" - make_compilerrt "x86" "i686-linux-android/lib" - make_compilerrt "x86_64" "x86_64-linux-android/lib64" - - mv $rtdistdir/lib/linux/libclang_rt.builtins-*-android.a $distdir/lib/clang/[% c("var/llvm_version") %]/lib/linux/ -[% END -%] +ninja -j[% c("num_procs") %] -v install cd /var/tmp/dist [% c('tar', { ===================================== projects/clang/config ===================================== @@ -11,14 +11,16 @@ input_files: - project: container-image - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]' - enable: '[% c("var/linux") || c("var/android") %]' + enable: '[% c("var/linux") %]' - name: binutils project: binutils - enable: '[% c("var/linux") || c("var/android") %]' + enable: '[% c("var/linux") %]' - project: cmake name: cmake - project: llvm-project name: clang-source + - project: ninja + name: ninja - project: python name: python enable: '[% c("var/linux") %]' ===================================== projects/compiler-rt/build ===================================== @@ -0,0 +1,51 @@ +#!/bin/bash +[% c("var/set_default_env") -%] +distdir=/var/tmp/dist/[% project %] +mkdir -p /var/tmp/dist +tar -C /var/tmp/dist -xf [% c('input_files_by_name/cmake') %] +tar -C /var/tmp/dist -xf [% c('input_files_by_name/ninja') %] +export PATH="/var/tmp/dist/ninja:/var/tmp/dist/cmake/bin:$PATH" + +[% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] + +tar -C /var/tmp/dist -xf [% c('input_files_by_name/binutils') %] +export PATH="/var/tmp/dist/binutils/bin:$PATH" + +mkdir -p /var/tmp/build +cd /var/tmp/build +tar -xf $rootdir/[% c('input_files_by_name/clang-source') %] +cd clang-source +export LLVM_HOME=$(pwd) +mkdir build +cd build + +installdir=/var/tmp/build/install +mkdir -p $installdir + +cmake ../compiler-rt/ -GNinja \ + -DCMAKE_INSTALL_PREFIX=$installdir \ + -DCMAKE_BUILD_TYPE=Release \ + -DCMAKE_SYSTEM_NAME=Android \ + -DCMAKE_ANDROID_ARCH_ABI="[% c('var/abi') %]" \ + -DCMAKE_ANDROID_NDK="$ANDROID_NDK_HOME" \ + -DCMAKE_C_FLAGS="-fuse-ld=lld --rtlib=compiler-rt $defines" \ + -DCMAKE_CXX_FLAGS="-fuse-ld=lld --rtlib=compiler-rt $defines" \ + -DCMAKE_EXE_LINKER_FLAGS="-L$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/[% c('var/libdir') %]" \ + -DCOMPILER_RT_BUILD_BUILTINS=ON \ + -DCOMPILER_RT_BUILD_LIBFUZZER=OFF \ + -DCOMPILER_RT_BUILD_MEMPROF=OFF \ + -DCOMPILER_RT_BUILD_ORC=OFF \ + -DCOMPILER_RT_BUILD_PROFILE=OFF \ + -DCOMPILER_RT_BUILD_SANITIZERS=OFF \ + -DCOMPILER_RT_BUILD_XRAY=OFF + +ninja -j[% c("num_procs") %] -v install + +mkdir -p $distdir/lib/clang/[% c("var/llvm_version") %]/lib/linux/ +mv $installdir/lib/linux/libclang_rt.builtins-*-android.a $distdir/lib/clang/[% c("var/llvm_version") %]/lib/linux/ + +cd /var/tmp/dist +[% c('tar', { + tar_src => [ project ], + tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'), + }) %] ===================================== projects/compiler-rt/config ===================================== @@ -0,0 +1,38 @@ +# vim: filetype=yaml sw=2 +version: '[% c("var/llvm_version") %]' +filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' +container: + use_container: 1 + +var: + llvm_version: '[% pc("llvm-project", "version") %]' + +targets: + android-armv7: + var: + libdir: 'arm-linux-androideabi/lib' + android-aarch64: + var: + libdir: 'aarch64-linux-android/lib64' + android-x86: + var: + libdir: 'i686-linux-android/lib' + android-x86_64: + var: + libdir: 'x86_64-linux-android/lib64' + +input_files: + - project: container-image + - name: '[% c("var/compiler") %]' + project: '[% c("var/compiler") %]' + - name: binutils + project: binutils + - project: cmake + name: cmake + - project: llvm-project + name: clang-source + - project: ninja + name: ninja + - project: python + name: python + enable: '[% c("var/linux") %]' ===================================== projects/container-image/config ===================================== @@ -37,9 +37,14 @@ pre: | [% IF c("var/linux-cross") -%] dpkg --add-architecture [% c("var/arch_debian") %] [% END -%] + [% IF c("var/container/suite") == "jessie" -%] + # We need to use faketime to run `apt-get update` on jessie, because of + # expired key. See tor-browser-build#40693 + dpkg -i ./libfaketime_0.9.6-3_amd64.deb ./faketime_0.9.6-3_amd64.deb + [% END -%] # Update the package cache again because `pre_pkginst` may change the # package manager configuration. - apt-get update -y -q + [% IF c("var/container/suite") == "jessie" %]faketime '2018-12-24 08:15:42' [% END %]apt-get update -y -q [% END -%] apt-get upgrade -y -q [% @@ -82,3 +87,9 @@ input_files: - project: mmdebstrap-image target: - '[% c("var/container/suite") %]-[% c("var/container/arch") %]' + - URL: http://deb.debian.org/debian/pool/main/f/faketime/faketime_0.9.6-3_amd64.deb + sha256sum: 19b2a01a2fae7e6d5a8b741fc0bc626451cb4c2cc884ee79f1136dd3c2c26213 + enable: '[% c("var/container/suite") == "jessie" %]' + - URL: http://deb.debian.org/debian/pool/main/f/faketime/libfaketime_0.9.6-3_amd64… + sha256sum: 82747d5815b226cfed7f6f9a751bf8c20d457f3ba786add6017d6904dea4fdb4 + enable: '[% c("var/container/suite") == "jessie" %]' ===================================== projects/geckoview/build ===================================== @@ -21,6 +21,8 @@ tar -C /var/tmp/dist -xf [% c('input_files_by_name/nasm') %] tar -C /var/tmp/dist -xf [% c('input_files_by_name/node') %] tar -C /var/tmp/dist -xf [% c('input_files_by_name/clang') %] export LLVM_CONFIG="/var/tmp/dist/clang/bin/llvm-config" +tar -C /var/tmp/dist -xf [% c('input_files_by_name/compiler-rt') %] +cp -r /var/tmp/dist/compiler-rt/* /var/tmp/dist/clang/ tar -C /var/tmp/dist -xf [% c('input_files_by_name/binutils') %] export PATH="/var/tmp/dist/rust/bin:/var/tmp/dist/cbindgen:/var/tmp/dist/nasm/bin:/var/tmp/dist/node/bin:/var/tmp/dist/clang/bin:/var/tmp/dist/binutils/bin:$PATH" ===================================== projects/geckoview/config ===================================== @@ -171,6 +171,8 @@ input_files: name: nasm - project: clang name: clang + - project: 'compiler-rt' + name: 'compiler-rt' - filename: 'gradle-dependencies-[% c("var/gradle_dependencies_version") %]' name: gradle-dependencies exec: '[% INCLUDE "fetch-gradle-dependencies" %]' ===================================== projects/mmdebstrap-image/apt-key-allow-expired-key.patch ===================================== @@ -0,0 +1,23 @@ +--- o/apt-key 2022-11-30 14:57:12.742026261 +0000 ++++ n/apt-key 2022-12-01 08:38:08.170140893 +0000 +@@ -815,11 +815,18 @@ + create_gpg_home + fi + setup_merged_keyring ++ tmpfile=$(mktemp) ++ set +e + if [ -n "$FORCED_KEYRING" ]; then +- "$GPGV" --homedir "${GPGHOMEDIR}" --keyring "$(dearmor_filename "${FORCED_KEYRING}")" --ignore-time-conflict "$@" ++ (eval "exec ${GPGSTATUSFD}>$tmpfile"; "$GPGV" --homedir "${GPGHOMEDIR}" --keyring "$(dearmor_filename "${FORCED_KEYRING}")" --ignore-time-conflict "$@") + else +- "$GPGV" --homedir "${GPGHOMEDIR}" --keyring "${GPGHOMEDIR}/pubring.gpg" --ignore-time-conflict "$@" ++ (eval "exec ${GPGSTATUSFD}>$tmpfile"; "$GPGV" --homedir "${GPGHOMEDIR}" --keyring "${GPGHOMEDIR}/pubring.gpg" --ignore-time-conflict "$@") + fi ++ err=$? ++ set -e ++ cat "$tmpfile" | sed 's/^\[GNUPG:\] EXPKEYSIG /\[GNUPG:\] GOODSIG /' >&${GPGSTATUSFD} ++ rm -f "$tmpfile" ++ exit $err + ;; + help) + usage ===================================== projects/mmdebstrap-image/config ===================================== @@ -6,7 +6,7 @@ container: use_container: 1 var: - ubuntu_version: 22.04 + ubuntu_version: 22.04.1 pre: | #!/bin/sh @@ -16,6 +16,14 @@ pre: | apt-get update -y -q apt-get install -y -q debian-archive-keyring ubuntu-keyring mmdebstrap gnupg + [% IF c("var/container/suite") == "jessie" -%] + apt-get install -y -q patch + cd /usr/bin + # The gpg key for jessie is expired. We patch apt-key to accept expired keys. + patch -p1 < $rootdir/apt-key-allow-expired-key.patch + cd $rootdir + [% END -%] + export SOURCE_DATE_EPOCH='[% c("timestamp") %]' tar -xf [% c('input_files_by_name/mmdebstrap') %] ./mmdebstrap/mmdebstrap --mode=unshare [% c("var/container/mmdebstrap_opt") %] [% c("var/container/suite") %] output.tar.gz [% c("var/container/debian_mirror") %] @@ -55,4 +63,6 @@ input_files: name: mmdebstrap - URL: 'https://cdimage.ubuntu.com/ubuntu-base/releases/[% c("var/ubuntu_version") %]/release/ubuntu-base-[% c("var/ubuntu_version") %]-base-amd64.tar.gz' filename: 'container-image_ubuntu-base-[% c("var/ubuntu_version") %]-base-amd64.tar.gz' - sha256sum: df6fe77cee11bd216ac532f0ee082bdc4da3c0cc1f1d9cb20f3f743196bc4b07 + sha256sum: e1f9200c99da008a473c9ae7b51e13f5ea05dc4c2e12beb43f0f9cbbbf6216f4 + - filename: apt-key-allow-expired-key.patch + enable: '[% c("var/container/suite") == "jessie" %]' View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/compare/… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/compare/… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][maint-12.0] Bug 40683: Reduce the number of custom containers
by boklm (＠boklm) 09 Dec '22

09 Dec '22

boklm pushed to branch maint-12.0 at The Tor Project / Applications / tor-browser-build Commits: b5077a28 by Nicolas Vigier at 2022-12-09T11:27:58+01:00 Bug 40683: Reduce the number of custom containers Install a few more packages in the default containers to reduce the number of custom containers we use. - - - - - 14 changed files: - projects/android-components/config - projects/android-toolchain/config - projects/application-services/config - projects/bison/config - projects/browser/config - projects/fenix/config - projects/gradle/config - projects/libevent/config - projects/rust/config - projects/tor-android-service/config - projects/tor-onion-proxy-library/config - projects/tor/config - projects/wasi-sysroot/config - rbm.conf Changes: ===================================== projects/android-components/config ===================================== @@ -19,8 +19,6 @@ var: gradle_version: 7.0.2 glean_parser: 5.0.1 git_branch: '[% project %]-[% c("var/android_components_version") %]-[% c("var/torbrowser_branch") %]-1' - arch_deps: - - python3-venv targets: nightly: ===================================== projects/android-toolchain/config ===================================== @@ -8,9 +8,6 @@ var: version_30: 30.0.2 version_29: 29.0.2 version_28: 28.0.3 - deps: - - unzip - - python3 setup: | mkdir -p /var/tmp/dist tar -C /var/tmp/dist -xf $rootdir/[% c("compiler_tarfile") %] ===================================== projects/application-services/config ===================================== @@ -13,8 +13,6 @@ var: gradle_dependencies_version: 9 gradle_version: 6.7.1 glean_parser: 4.0.0 - arch_deps: - - python3-venv input_files: - project: container-image ===================================== projects/bison/config ===================================== @@ -3,9 +3,6 @@ version: 3.8.2 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' container: use_container: 1 - deps: - - build_essential - - xz-utils input_files: - URL: https://ftp.gnu.org/gnu/bison/bison-[% c("version") %].tar.xz ===================================== projects/browser/config ===================================== @@ -17,12 +17,16 @@ var: - patch targets: - linux-i686: + linux: var: - mar_osname: linux32 arch_deps: - # Install libc6-i386 to be able to run 32bit mar tools (bug 29812) + # Install libc6-i386 to be able to run 32bit mar tools in linux-i686 + # builds (bug 29812). We don't need it in x86_64 builds, but we + # share the container to reduce space used. - libc6-i386 + linux-i686: + var: + mar_osname: linux32 linux-x86_64: var: mar_osname: linux64 ===================================== projects/fenix/config ===================================== @@ -20,8 +20,6 @@ var: gradle_dependencies_version: 37 gradle_version: 7.0.2 glean_parser: 5.0.1 - arch_deps: - - python3-venv targets: release: ===================================== projects/gradle/config ===================================== @@ -5,8 +5,6 @@ container: use_container: 1 var: - deps: - - unzip gradle_sha256sum: 5.1.1: 4953323605c5d7b89e97d0dc7779e275bccedefcdac090aec123375eae0cc798 5.6.4: 1f3067073041bc44554d0efe5d402a33bc3d3c93cc39ab684f308586d732a80d ===================================== projects/libevent/config ===================================== @@ -12,10 +12,6 @@ var: configure_opt_project: --disable-static targets: - macos: - var: - arch_deps: - - faketime windows: var: configure_opt_project: --disable-shared ===================================== projects/rust/config ===================================== @@ -7,23 +7,10 @@ container: targets: android: var: - arch_deps: - - libssl-dev - - pkg-config - - zlib1g-dev configure_opt: --enable-local-rust --enable-vendor --enable-extended --release-channel=stable --sysconfdir=etc --llvm-root=/var/tmp/dist/clang --set rust.jemalloc --target=x86_64-unknown-linux-gnu,armv7-linux-androideabi,thumbv7neon-linux-androideabi,aarch64-linux-android,i686-linux-android,x86_64-linux-android --set=target.armv7-linux-androideabi.cc=armv7a-linux-androideabi16-clang --set=target.armv7-linux-androideabi.ar=armv7a-linux-androideabi-ar --set=target.thumbv7neon-linux-androideabi.cc=armv7a-linux-androideabi16-clang --set=target.thumbv7neon-linux-androideabi.ar=armv7a-linux-androideabi-ar --set=target.aarch64-linux-android.cc=aarch64-linux-android21-clang --set=target.aarch64-linux-android.ar=aarch64-linux-android-ar --set=target.i686-linux-android.cc=i686-linux-android16-clang --set=target.i686-linux-android.ar=i686-linux-android-ar --set=target.x86_64-linux-android.cc=x86_64-linux-android21-clang --set=target.x86_64-linux-android.ar=x86_64-linux-android-ar linux: var: - deps: - - libc6-dev-i386 - - lib32stdc++6 - - build-essential - - python - - automake - - libssl-dev - - pkg-config - - hardening-wrapper # We use # `--enable-local-rust` to avoid downloading the required compiler during # build time @@ -58,21 +45,17 @@ targets: macos: var: + configure_opt: --enable-local-rust --enable-vendor --enable-extended --release-channel=stable --sysconfdir=etc --llvm-root=/var/tmp/dist/macosx-toolchain/clang --set rust.jemalloc --target=x86_64-unknown-linux-gnu,[% c("var/build_target") %] --set=target.[% c("var/build_target") %].cc=[% c("var/build_target") %]-clang --set target.x86_64-unknown-linux-gnu.linker=clang --set target.x86_64-unknown-linux-gnu.ar=llvm-ar --set target.x86_64-unknown-linux-gnu.ranlib=llvm-ranlib arch_deps: - - libssl-dev - pkg-config - - zlib1g-dev - configure_opt: --enable-local-rust --enable-vendor --enable-extended --release-channel=stable --sysconfdir=etc --llvm-root=/var/tmp/dist/macosx-toolchain/clang --set rust.jemalloc --target=x86_64-unknown-linux-gnu,[% c("var/build_target") %] --set=target.[% c("var/build_target") %].cc=[% c("var/build_target") %]-clang --set target.x86_64-unknown-linux-gnu.linker=clang --set target.x86_64-unknown-linux-gnu.ar=llvm-ar --set target.x86_64-unknown-linux-gnu.ranlib=llvm-ranlib windows: var: - arch_deps: - - libssl-dev - - pkg-config - - zlib1g-dev # See tor-browser-build#29320 compiler: mingw-w64 configure_opt: --enable-local-rust --enable-vendor --enable-extended --release-channel=stable --sysconfdir=etc --llvm-root=/var/tmp/dist/clang --target=x86_64-unknown-linux-gnu,[% c("arch") %]-pc-windows-gnu --set target.x86_64-unknown-linux-gnu.linker=clang --set target.x86_64-unknown-linux-gnu.ar=llvm-ar --set target.x86_64-unknown-linux-gnu.ranlib=llvm-ranlib + arch_deps: + - pkg-config input_files: - project: container-image ===================================== projects/tor-android-service/config ===================================== @@ -8,9 +8,6 @@ container: use_container: 1 var: - deps: - - build-essential - - unzip # this should be updated when the list of gradle dependencies is changed gradle_dependencies_version: 5 gradle_version: 5.6.4 ===================================== projects/tor-onion-proxy-library/config ===================================== @@ -8,10 +8,6 @@ container: use_container: 1 var: - deps: - - build-essential - - unzip - - zip # this should be updated when the list of gradle dependencies is changed gradle_dependencies_version: 5 gradle_version: 5.6.4 ===================================== projects/tor/config ===================================== @@ -9,13 +9,6 @@ tag_gpg_id: 1 container: use_container: 1 -var: - deps: - - build-essential - - automake - - zip - - unzip - targets: nightly: version: '[% c("abbrev") %]' @@ -27,25 +20,15 @@ targets: libdir: lib32 sort_deps: 0 arch_deps: - - libtool - zlib1g-dev:i386 - - hardening-wrapper linux-x86_64: var: libdir: lib64 arch_deps: - - libtool - zlib1g-dev - - hardening-wrapper - macos: - var: - arch_deps: - - faketime android: var: configure_opt_project: '--enable-android --enable-static-openssl --enable-static-libevent --enable-zstd --disable-tool-name-check --disable-system-torrc --disable-system-torrc' - arch_deps: - - libtinfo5 input_files: - project: container-image ===================================== projects/wasi-sysroot/config ===================================== @@ -8,12 +8,6 @@ git_submodule: 1 container: use_container: 1 -targets: - linux: - var: - arch_deps: - - patch - input_files: - project: container-image - name: binutils ===================================== rbm.conf ===================================== @@ -337,11 +337,15 @@ targets: - bison - python3 - python3-distutils + - python3-venv - automake - libtool - zip - unzip - libtinfo5 + - libssl-dev + - pkg-config + - zlib1g-dev configure_opt: '--host=[% c("var/cross_prefix") %] CC=[% c("var/CC") %] [% c("var/configure_opt_project") %]' pre_pkginst: | @@ -434,6 +438,8 @@ targets: deps: - libc6-dev-i386 - lib32stdc++6 + - pkg-config + - libssl-dev - build-essential - python - bison @@ -442,6 +448,8 @@ targets: - libtool - zip - unzip + - xz-utils + - patch linux-asan: var: asan: 1 @@ -500,6 +508,8 @@ targets: - libtool - zip - unzip + - libssl-dev + - zlib1g-dev torbrowser-macos: - macos-universal @@ -554,6 +564,7 @@ targets: rlbox: 0 deps: - build-essential + - faketime - python3 - python3-distutils - automake @@ -561,6 +572,8 @@ targets: - libtool - zip - unzip + - libssl-dev + - zlib1g-dev faketime_path: /usr/lib/x86_64-linux-gnu/faketime/libfaketime.so.1 # The no_build_id target can be useful if you want to quickly display View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/b… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/b… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][maint-12.0] Bug 40681: Run `apt-get clean` after installing packages
by boklm (＠boklm) 09 Dec '22

09 Dec '22

boklm pushed to branch maint-12.0 at The Tor Project / Applications / tor-browser-build Commits: 8fa7b5e1 by Nicolas Vigier at 2022-12-09T11:22:09+01:00 Bug 40681: Run `apt-get clean` after installing packages - - - - - 1 changed file: - projects/container-image/config Changes: ===================================== projects/container-image/config ===================================== @@ -66,6 +66,7 @@ pre: | [% IF pc(c('origin_project'), 'var/post_pkginst', { step => c('origin_step') }) -%] [% pc(c('origin_project'), 'var/post_pkginst', { step => c('origin_step') }) %] [% END -%] + apt-get clean remote_get: | #!/bin/sh View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/8… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/8… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] 6 commits: Bug 40681: Run `apt-get clean` after installing packages
by boklm (＠boklm) 09 Dec '22

09 Dec '22

boklm pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 1e4d64eb by Nicolas Vigier at 2022-12-09T11:12:31+01:00 Bug 40681: Run `apt-get clean` after installing packages - - - - - b3972182 by Nicolas Vigier at 2022-12-09T11:12:33+01:00 Bug 40683: Reduce the number of custom containers Install a few more packages in the default containers to reduce the number of custom containers we use. - - - - - ad51122f by Nicolas Vigier at 2022-12-09T11:12:34+01:00 Bug 40689: Update Ubuntu version in projects/mmdebstrap-image to 22.04.1 - - - - - 1c5314b5 by Nicolas Vigier at 2022-12-09T11:12:36+01:00 Bug 40693: Patch apt-key to accept expired keys for jessie - - - - - 5d387c8f by Nicolas Vigier at 2022-12-09T11:12:38+01:00 Bug 40693: use faketime to run `apt-get update` on jessie - - - - - 228a1188 by Pier Angelo Vendrame at 2022-12-09T11:12:39+01:00 Bug 40653: Do not build compiler-rt with Clang Specifying compiler-rt as a project in LLVM is going to be deprecated. It should be compiled with runtimes, instead, or alone, if it will be still allowed. The only platform in which we were compiling compiler-rt with LLVM was Linux. But Firefox seems not to actually use it, and just use GCC's runtime, instead. However, we were also compiling compiler-rt for Android in the same project, which prevents to share the artifact with Windows and macOS. So, I have moved it to another project on its own. - - - - - 23 changed files: - projects/android-components/config - projects/android-toolchain/config - projects/application-services/config - projects/bison/config - projects/browser/config - projects/clang/build - projects/clang/config - + projects/compiler-rt/build - + projects/compiler-rt/config - projects/container-image/config - projects/fenix/config - projects/geckoview/build - projects/geckoview/config - projects/gradle/config - projects/libevent/config - + projects/mmdebstrap-image/apt-key-allow-expired-key.patch - projects/mmdebstrap-image/config - projects/rust/config - projects/tor-android-service/config - projects/tor-onion-proxy-library/config - projects/tor/config - projects/wasi-sysroot/config - rbm.conf Changes: ===================================== projects/android-components/config ===================================== @@ -19,8 +19,6 @@ var: gradle_version: 7.0.2 glean_parser: 5.0.1 git_branch: '[% project %]-[% c("var/android_components_version") %]-[% c("var/torbrowser_branch") %]-1' - arch_deps: - - python3-venv targets: nightly: ===================================== projects/android-toolchain/config ===================================== @@ -8,9 +8,6 @@ var: version_30: 30.0.2 version_29: 29.0.2 version_28: 28.0.3 - deps: - - unzip - - python3 setup: | mkdir -p /var/tmp/dist tar -C /var/tmp/dist -xf $rootdir/[% c("compiler_tarfile") %] ===================================== projects/application-services/config ===================================== @@ -13,8 +13,6 @@ var: gradle_dependencies_version: 9 gradle_version: 6.7.1 glean_parser: 4.0.0 - arch_deps: - - python3-venv input_files: - project: container-image ===================================== projects/bison/config ===================================== @@ -3,9 +3,6 @@ version: 3.8.2 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' container: use_container: 1 - deps: - - build_essential - - xz-utils input_files: - URL: https://ftp.gnu.org/gnu/bison/bison-[% c("version") %].tar.xz ===================================== projects/browser/config ===================================== @@ -17,12 +17,16 @@ var: - patch targets: - linux-i686: + linux: var: - mar_osname: linux32 arch_deps: - # Install libc6-i386 to be able to run 32bit mar tools (bug 29812) + # Install libc6-i386 to be able to run 32bit mar tools in linux-i686 + # builds (bug 29812). We don't need it in x86_64 builds, but we + # share the container to reduce space used. - libc6-i386 + linux-i686: + var: + mar_osname: linux32 linux-x86_64: var: mar_osname: linux64 ===================================== projects/clang/build ===================================== @@ -3,16 +3,12 @@ distdir=/var/tmp/dist/[% project %] mkdir -p /var/tmp/dist tar -C /var/tmp/dist -xf [% c('input_files_by_name/cmake') %] -export PATH="/var/tmp/dist/cmake/bin:$PATH" +tar -C /var/tmp/dist -xf [% c('input_files_by_name/ninja') %] +export PATH="/var/tmp/dist/ninja:/var/tmp/dist/cmake/bin:$PATH" [% IF c("var/linux") %] [% pc('gcc', 'var/setup', { compiler_tarfile => c('input_files_by_name/gcc'), hardened_gcc => 0 }) %] [% pc('python', 'var/setup', { python_tarfile => c('input_files_by_name/python') }) %] -[% END -%] -[% IF c("var/android") %] - [% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] -[% END -%] -[% IF c("var/linux") || c("var/android") -%] tar -C /var/tmp/dist -xf [% c('input_files_by_name/binutils') %] export PATH="/var/tmp/dist/binutils/bin:$PATH" [% END -%] @@ -25,57 +21,15 @@ mkdir build cd build # LLVM_ENABLE_ZLIB solves the "contains a compressed section, but zlib is not available" on lld # LLVM_INSTALL_UTILS allows this LLVM to be used to compile Rust -cmake ../llvm -G "Unix Makefiles" \ +cmake ../llvm -GNinja \ -DCMAKE_INSTALL_PREFIX=$distdir \ -DCMAKE_BUILD_TYPE=Release \ - [% IF c("var/android") || c("var/macos") -%] - -DLLVM_TARGETS_TO_BUILD="X86;ARM;AArch64" \ - [% END -%] - [% IF c("var/rlbox") -%]-DLLVM_EXPERIMENTAL_TARGETS_TO_BUILD=WebAssembly[% END %] \ - -DLLVM_ENABLE_PROJECTS="clang;clang-tools-extra;compiler-rt;lld" \ + -DLLVM_TARGETS_TO_BUILD="X86;ARM;AArch64[% IF c("var/rlbox") -%];WebAssembly[% END %]" \ + -DLLVM_ENABLE_PROJECTS="clang;lld" \ -DLLVM_ENABLE_ZLIB=ON \ -DLLVM_INSTALL_UTILS=ON \ -make -j[% c("num_procs") %] -make install -cd .. - -[% IF c("var/android") -%] - echo "Compiling compiler-rt (Android only)" - rtdistdir=/var/tmp/build/rtdist - mkdir $rtdistdir - - make_compilerrt () { - mkdir "build-compilerrt-$1" - cd "build-compilerrt-$1" - cmake ../compiler-rt/ -G "Unix Makefiles" \ - -DCMAKE_INSTALL_PREFIX=$rtdistdir \ - -DCMAKE_BUILD_TYPE=Release \ - -DCMAKE_SYSTEM_NAME=Android \ - -DCMAKE_ANDROID_ARCH_ABI=$1 \ - -DCMAKE_ANDROID_NDK="$ANDROID_NDK_HOME" \ - -DCMAKE_C_FLAGS="$3 -fuse-ld=lld --rtlib=compiler-rt" \ - -DCMAKE_CXX_FLAGS="$3 -fuse-ld=lld --rtlib=compiler-rt" \ - -DCMAKE_EXE_LINKER_FLAGS="-L$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/$2" \ - -DCOMPILER_RT_BUILD_BUILTINS=ON \ - -DCOMPILER_RT_BUILD_LIBFUZZER=OFF \ - -DCOMPILER_RT_BUILD_MEMPROF=OFF \ - -DCOMPILER_RT_BUILD_ORC=OFF \ - -DCOMPILER_RT_BUILD_PROFILE=OFF \ - -DCOMPILER_RT_BUILD_SANITIZERS=OFF \ - -DCOMPILER_RT_BUILD_XRAY=OFF - make -j[% c("num_procs") %] - make install - cd .. - } - - make_compilerrt "armeabi-v7a" "arm-linux-androideabi/lib" "-DARMEABI_V7A" - make_compilerrt "arm64-v8a" "aarch64-linux-android/lib64" - make_compilerrt "x86" "i686-linux-android/lib" - make_compilerrt "x86_64" "x86_64-linux-android/lib64" - - mv $rtdistdir/lib/linux/libclang_rt.builtins-*-android.a $distdir/lib/clang/[% c("var/llvm_version") %]/lib/linux/ -[% END -%] +ninja -j[% c("num_procs") %] -v install cd /var/tmp/dist [% c('tar', { ===================================== projects/clang/config ===================================== @@ -11,14 +11,16 @@ input_files: - project: container-image - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]' - enable: '[% c("var/linux") || c("var/android") %]' + enable: '[% c("var/linux") %]' - name: binutils project: binutils - enable: '[% c("var/linux") || c("var/android") %]' + enable: '[% c("var/linux") %]' - project: cmake name: cmake - project: llvm-project name: clang-source + - project: ninja + name: ninja - project: python name: python enable: '[% c("var/linux") %]' ===================================== projects/compiler-rt/build ===================================== @@ -0,0 +1,51 @@ +#!/bin/bash +[% c("var/set_default_env") -%] +distdir=/var/tmp/dist/[% project %] +mkdir -p /var/tmp/dist +tar -C /var/tmp/dist -xf [% c('input_files_by_name/cmake') %] +tar -C /var/tmp/dist -xf [% c('input_files_by_name/ninja') %] +export PATH="/var/tmp/dist/ninja:/var/tmp/dist/cmake/bin:$PATH" + +[% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] + +tar -C /var/tmp/dist -xf [% c('input_files_by_name/binutils') %] +export PATH="/var/tmp/dist/binutils/bin:$PATH" + +mkdir -p /var/tmp/build +cd /var/tmp/build +tar -xf $rootdir/[% c('input_files_by_name/clang-source') %] +cd clang-source +export LLVM_HOME=$(pwd) +mkdir build +cd build + +installdir=/var/tmp/build/install +mkdir -p $installdir + +cmake ../compiler-rt/ -GNinja \ + -DCMAKE_INSTALL_PREFIX=$installdir \ + -DCMAKE_BUILD_TYPE=Release \ + -DCMAKE_SYSTEM_NAME=Android \ + -DCMAKE_ANDROID_ARCH_ABI="[% c('var/abi') %]" \ + -DCMAKE_ANDROID_NDK="$ANDROID_NDK_HOME" \ + -DCMAKE_C_FLAGS="-fuse-ld=lld --rtlib=compiler-rt $defines" \ + -DCMAKE_CXX_FLAGS="-fuse-ld=lld --rtlib=compiler-rt $defines" \ + -DCMAKE_EXE_LINKER_FLAGS="-L$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/[% c('var/libdir') %]" \ + -DCOMPILER_RT_BUILD_BUILTINS=ON \ + -DCOMPILER_RT_BUILD_LIBFUZZER=OFF \ + -DCOMPILER_RT_BUILD_MEMPROF=OFF \ + -DCOMPILER_RT_BUILD_ORC=OFF \ + -DCOMPILER_RT_BUILD_PROFILE=OFF \ + -DCOMPILER_RT_BUILD_SANITIZERS=OFF \ + -DCOMPILER_RT_BUILD_XRAY=OFF + +ninja -j[% c("num_procs") %] -v install + +mkdir -p $distdir/lib/clang/[% c("var/llvm_version") %]/lib/linux/ +mv $installdir/lib/linux/libclang_rt.builtins-*-android.a $distdir/lib/clang/[% c("var/llvm_version") %]/lib/linux/ + +cd /var/tmp/dist +[% c('tar', { + tar_src => [ project ], + tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'), + }) %] ===================================== projects/compiler-rt/config ===================================== @@ -0,0 +1,38 @@ +# vim: filetype=yaml sw=2 +version: '[% c("var/llvm_version") %]' +filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' +container: + use_container: 1 + +var: + llvm_version: '[% pc("llvm-project", "version") %]' + +targets: + android-armv7: + var: + libdir: 'arm-linux-androideabi/lib' + android-aarch64: + var: + libdir: 'aarch64-linux-android/lib64' + android-x86: + var: + libdir: 'i686-linux-android/lib' + android-x86_64: + var: + libdir: 'x86_64-linux-android/lib64' + +input_files: + - project: container-image + - name: '[% c("var/compiler") %]' + project: '[% c("var/compiler") %]' + - name: binutils + project: binutils + - project: cmake + name: cmake + - project: llvm-project + name: clang-source + - project: ninja + name: ninja + - project: python + name: python + enable: '[% c("var/linux") %]' ===================================== projects/container-image/config ===================================== @@ -37,9 +37,14 @@ pre: | [% IF c("var/linux-cross") -%] dpkg --add-architecture [% c("var/arch_debian") %] [% END -%] + [% IF c("var/container/suite") == "jessie" -%] + # We need to use faketime to run `apt-get update` on jessie, because of + # expired key. See tor-browser-build#40693 + dpkg -i ./libfaketime_0.9.6-3_amd64.deb ./faketime_0.9.6-3_amd64.deb + [% END -%] # Update the package cache again because `pre_pkginst` may change the # package manager configuration. - apt-get update -y -q + [% IF c("var/container/suite") == "jessie" %]faketime '2018-12-24 08:15:42' [% END %]apt-get update -y -q [% END -%] apt-get upgrade -y -q [% @@ -66,6 +71,7 @@ pre: | [% IF pc(c('origin_project'), 'var/post_pkginst', { step => c('origin_step') }) -%] [% pc(c('origin_project'), 'var/post_pkginst', { step => c('origin_step') }) %] [% END -%] + apt-get clean remote_get: | #!/bin/sh @@ -81,3 +87,9 @@ input_files: - project: mmdebstrap-image target: - '[% c("var/container/suite") %]-[% c("var/container/arch") %]' + - URL: http://deb.debian.org/debian/pool/main/f/faketime/faketime_0.9.6-3_amd64.deb + sha256sum: 19b2a01a2fae7e6d5a8b741fc0bc626451cb4c2cc884ee79f1136dd3c2c26213 + enable: '[% c("var/container/suite") == "jessie" %]' + - URL: http://deb.debian.org/debian/pool/main/f/faketime/libfaketime_0.9.6-3_amd64… + sha256sum: 82747d5815b226cfed7f6f9a751bf8c20d457f3ba786add6017d6904dea4fdb4 + enable: '[% c("var/container/suite") == "jessie" %]' ===================================== projects/fenix/config ===================================== @@ -20,8 +20,6 @@ var: gradle_dependencies_version: 37 gradle_version: 7.0.2 glean_parser: 5.0.1 - arch_deps: - - python3-venv targets: release: ===================================== projects/geckoview/build ===================================== @@ -21,6 +21,8 @@ tar -C /var/tmp/dist -xf [% c('input_files_by_name/nasm') %] tar -C /var/tmp/dist -xf [% c('input_files_by_name/node') %] tar -C /var/tmp/dist -xf [% c('input_files_by_name/clang') %] export LLVM_CONFIG="/var/tmp/dist/clang/bin/llvm-config" +tar -C /var/tmp/dist -xf [% c('input_files_by_name/compiler-rt') %] +cp -r /var/tmp/dist/compiler-rt/* /var/tmp/dist/clang/ tar -C /var/tmp/dist -xf [% c('input_files_by_name/binutils') %] export PATH="/var/tmp/dist/rust/bin:/var/tmp/dist/cbindgen:/var/tmp/dist/nasm/bin:/var/tmp/dist/node/bin:/var/tmp/dist/clang/bin:/var/tmp/dist/binutils/bin:$PATH" ===================================== projects/geckoview/config ===================================== @@ -171,6 +171,8 @@ input_files: name: nasm - project: clang name: clang + - project: 'compiler-rt' + name: 'compiler-rt' - filename: 'gradle-dependencies-[% c("var/gradle_dependencies_version") %]' name: gradle-dependencies exec: '[% INCLUDE "fetch-gradle-dependencies" %]' ===================================== projects/gradle/config ===================================== @@ -5,8 +5,6 @@ container: use_container: 1 var: - deps: - - unzip gradle_sha256sum: 5.1.1: 4953323605c5d7b89e97d0dc7779e275bccedefcdac090aec123375eae0cc798 5.6.4: 1f3067073041bc44554d0efe5d402a33bc3d3c93cc39ab684f308586d732a80d ===================================== projects/libevent/config ===================================== @@ -12,10 +12,6 @@ var: configure_opt_project: --disable-static targets: - macos: - var: - arch_deps: - - faketime windows: var: configure_opt_project: --disable-shared ===================================== projects/mmdebstrap-image/apt-key-allow-expired-key.patch ===================================== @@ -0,0 +1,23 @@ +--- o/apt-key 2022-11-30 14:57:12.742026261 +0000 ++++ n/apt-key 2022-12-01 08:38:08.170140893 +0000 +@@ -815,11 +815,18 @@ + create_gpg_home + fi + setup_merged_keyring ++ tmpfile=$(mktemp) ++ set +e + if [ -n "$FORCED_KEYRING" ]; then +- "$GPGV" --homedir "${GPGHOMEDIR}" --keyring "$(dearmor_filename "${FORCED_KEYRING}")" --ignore-time-conflict "$@" ++ (eval "exec ${GPGSTATUSFD}>$tmpfile"; "$GPGV" --homedir "${GPGHOMEDIR}" --keyring "$(dearmor_filename "${FORCED_KEYRING}")" --ignore-time-conflict "$@") + else +- "$GPGV" --homedir "${GPGHOMEDIR}" --keyring "${GPGHOMEDIR}/pubring.gpg" --ignore-time-conflict "$@" ++ (eval "exec ${GPGSTATUSFD}>$tmpfile"; "$GPGV" --homedir "${GPGHOMEDIR}" --keyring "${GPGHOMEDIR}/pubring.gpg" --ignore-time-conflict "$@") + fi ++ err=$? ++ set -e ++ cat "$tmpfile" | sed 's/^\[GNUPG:\] EXPKEYSIG /\[GNUPG:\] GOODSIG /' >&${GPGSTATUSFD} ++ rm -f "$tmpfile" ++ exit $err + ;; + help) + usage ===================================== projects/mmdebstrap-image/config ===================================== @@ -6,7 +6,7 @@ container: use_container: 1 var: - ubuntu_version: 22.04 + ubuntu_version: 22.04.1 pre: | #!/bin/sh @@ -16,6 +16,14 @@ pre: | apt-get update -y -q apt-get install -y -q debian-archive-keyring ubuntu-keyring mmdebstrap gnupg + [% IF c("var/container/suite") == "jessie" -%] + apt-get install -y -q patch + cd /usr/bin + # The gpg key for jessie is expired. We patch apt-key to accept expired keys. + patch -p1 < $rootdir/apt-key-allow-expired-key.patch + cd $rootdir + [% END -%] + export SOURCE_DATE_EPOCH='[% c("timestamp") %]' tar -xf [% c('input_files_by_name/mmdebstrap') %] ./mmdebstrap/mmdebstrap --mode=unshare [% c("var/container/mmdebstrap_opt") %] [% c("var/container/suite") %] output.tar.gz [% c("var/container/debian_mirror") %] @@ -55,4 +63,6 @@ input_files: name: mmdebstrap - URL: 'https://cdimage.ubuntu.com/ubuntu-base/releases/[% c("var/ubuntu_version") %]/release/ubuntu-base-[% c("var/ubuntu_version") %]-base-amd64.tar.gz' filename: 'container-image_ubuntu-base-[% c("var/ubuntu_version") %]-base-amd64.tar.gz' - sha256sum: df6fe77cee11bd216ac532f0ee082bdc4da3c0cc1f1d9cb20f3f743196bc4b07 + sha256sum: e1f9200c99da008a473c9ae7b51e13f5ea05dc4c2e12beb43f0f9cbbbf6216f4 + - filename: apt-key-allow-expired-key.patch + enable: '[% c("var/container/suite") == "jessie" %]' ===================================== projects/rust/config ===================================== @@ -7,23 +7,10 @@ container: targets: android: var: - arch_deps: - - libssl-dev - - pkg-config - - zlib1g-dev configure_opt: --enable-local-rust --enable-vendor --enable-extended --release-channel=stable --sysconfdir=etc --llvm-root=/var/tmp/dist/clang --set rust.jemalloc --target=x86_64-unknown-linux-gnu,armv7-linux-androideabi,thumbv7neon-linux-androideabi,aarch64-linux-android,i686-linux-android,x86_64-linux-android --set=target.armv7-linux-androideabi.cc=armv7a-linux-androideabi16-clang --set=target.armv7-linux-androideabi.ar=armv7a-linux-androideabi-ar --set=target.thumbv7neon-linux-androideabi.cc=armv7a-linux-androideabi16-clang --set=target.thumbv7neon-linux-androideabi.ar=armv7a-linux-androideabi-ar --set=target.aarch64-linux-android.cc=aarch64-linux-android21-clang --set=target.aarch64-linux-android.ar=aarch64-linux-android-ar --set=target.i686-linux-android.cc=i686-linux-android16-clang --set=target.i686-linux-android.ar=i686-linux-android-ar --set=target.x86_64-linux-android.cc=x86_64-linux-android21-clang --set=target.x86_64-linux-android.ar=x86_64-linux-android-ar linux: var: - deps: - - libc6-dev-i386 - - lib32stdc++6 - - build-essential - - python - - automake - - libssl-dev - - pkg-config - - hardening-wrapper # We use # `--enable-local-rust` to avoid downloading the required compiler during # build time @@ -58,21 +45,17 @@ targets: macos: var: + configure_opt: --enable-local-rust --enable-vendor --enable-extended --release-channel=stable --sysconfdir=etc --llvm-root=/var/tmp/dist/macosx-toolchain/clang --set rust.jemalloc --target=x86_64-unknown-linux-gnu,[% c("var/build_target") %] --set=target.[% c("var/build_target") %].cc=[% c("var/build_target") %]-clang --set target.x86_64-unknown-linux-gnu.linker=clang --set target.x86_64-unknown-linux-gnu.ar=llvm-ar --set target.x86_64-unknown-linux-gnu.ranlib=llvm-ranlib arch_deps: - - libssl-dev - pkg-config - - zlib1g-dev - configure_opt: --enable-local-rust --enable-vendor --enable-extended --release-channel=stable --sysconfdir=etc --llvm-root=/var/tmp/dist/macosx-toolchain/clang --set rust.jemalloc --target=x86_64-unknown-linux-gnu,[% c("var/build_target") %] --set=target.[% c("var/build_target") %].cc=[% c("var/build_target") %]-clang --set target.x86_64-unknown-linux-gnu.linker=clang --set target.x86_64-unknown-linux-gnu.ar=llvm-ar --set target.x86_64-unknown-linux-gnu.ranlib=llvm-ranlib windows: var: - arch_deps: - - libssl-dev - - pkg-config - - zlib1g-dev # See tor-browser-build#29320 compiler: mingw-w64 configure_opt: --enable-local-rust --enable-vendor --enable-extended --release-channel=stable --sysconfdir=etc --llvm-root=/var/tmp/dist/clang --target=x86_64-unknown-linux-gnu,[% c("arch") %]-pc-windows-gnu --set target.x86_64-unknown-linux-gnu.linker=clang --set target.x86_64-unknown-linux-gnu.ar=llvm-ar --set target.x86_64-unknown-linux-gnu.ranlib=llvm-ranlib + arch_deps: + - pkg-config input_files: - project: container-image ===================================== projects/tor-android-service/config ===================================== @@ -8,9 +8,6 @@ container: use_container: 1 var: - deps: - - build-essential - - unzip # this should be updated when the list of gradle dependencies is changed gradle_dependencies_version: 5 gradle_version: 5.6.4 ===================================== projects/tor-onion-proxy-library/config ===================================== @@ -8,10 +8,6 @@ container: use_container: 1 var: - deps: - - build-essential - - unzip - - zip # this should be updated when the list of gradle dependencies is changed gradle_dependencies_version: 5 gradle_version: 5.6.4 ===================================== projects/tor/config ===================================== @@ -9,13 +9,6 @@ tag_gpg_id: 1 container: use_container: 1 -var: - deps: - - build-essential - - automake - - zip - - unzip - targets: nightly: version: '[% c("abbrev") %]' @@ -27,25 +20,15 @@ targets: libdir: lib32 sort_deps: 0 arch_deps: - - libtool - zlib1g-dev:i386 - - hardening-wrapper linux-x86_64: var: libdir: lib64 arch_deps: - - libtool - zlib1g-dev - - hardening-wrapper - macos: - var: - arch_deps: - - faketime android: var: configure_opt_project: '--enable-android --enable-static-openssl --enable-static-libevent --enable-zstd --disable-tool-name-check --disable-system-torrc --disable-system-torrc' - arch_deps: - - libtinfo5 input_files: - project: container-image ===================================== projects/wasi-sysroot/config ===================================== @@ -8,12 +8,6 @@ git_submodule: 1 container: use_container: 1 -targets: - linux: - var: - arch_deps: - - patch - input_files: - project: container-image - name: binutils ===================================== rbm.conf ===================================== @@ -337,11 +337,15 @@ targets: - bison - python3 - python3-distutils + - python3-venv - automake - libtool - zip - unzip - libtinfo5 + - libssl-dev + - pkg-config + - zlib1g-dev configure_opt: '--host=[% c("var/cross_prefix") %] CC=[% c("var/CC") %] [% c("var/configure_opt_project") %]' pre_pkginst: | @@ -434,6 +438,8 @@ targets: deps: - libc6-dev-i386 - lib32stdc++6 + - pkg-config + - libssl-dev - build-essential - python - bison @@ -442,6 +448,8 @@ targets: - libtool - zip - unzip + - xz-utils + - patch linux-asan: var: asan: 1 @@ -500,6 +508,8 @@ targets: - libtool - zip - unzip + - libssl-dev + - zlib1g-dev torbrowser-macos: - macos-universal @@ -554,6 +564,7 @@ targets: rlbox: 0 deps: - build-essential + - faketime - python3 - python3-distutils - automake @@ -561,6 +572,8 @@ targets: - libtool - zip - unzip + - libssl-dev + - zlib1g-dev faketime_path: /usr/lib/x86_64-linux-gnu/faketime/libfaketime.so.1 # The no_build_id target can be useful if you want to quickly display View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/compare/… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/compare/… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] Update release prep templates
by Richard Pospesel (＠richard) 08 Dec '22

08 Dec '22

Richard Pospesel pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 9486bc9c by Richard Pospesel at 2022-12-08T16:47:31+00:00 Update release prep templates - - - - - 2 changed files: - .gitlab/issue_templates/Release Prep - Alpha.md - .gitlab/issue_templates/Release Prep - Stable.md Changes: ===================================== .gitlab/issue_templates/Release Prep - Alpha.md ===================================== @@ -28,20 +28,6 @@ - `$(TOR_BROWSER_BRANCH_PREV)` : the full name of the previous tor-browser branch (when rebasing) </details> -<details> - <summary>Desktop</summary> - -### **torbutton** : https://gitlab.torproject.org/tpo/applications/torbutton.git -- [ ] Update translations : - - [ ] `./import-translations.sh` - - **NOTE** : if there are no new strings imported then we are done here - - [ ] Commit with message `Translation updates` - - **NOTE** : only add files which are already being tracked - - [ ] ***(Optional)*** Backport to maintenance branch if present and necessary -- [ ] fixup! `tor-browser`'s `Bug 10760 : Integrate TorButton to TorBrowser core` issue to point to updated `torbutton` commit - -</details> - <details> <summary>Android</summary> @@ -83,6 +69,11 @@ <summary>Shared</summary> ### tor-browser: https://gitlab.torproject.org/tpo/applications/tor-browser.git +- [ ] ***(Optional)*** Update torbutton translations in `toolkit/torbutton` + - [ ] `./import-translations.sh` + - **NOTE** : if there are no new strings imported then we are done here + - [ ] Commit as `fixup!` to the `Add TorStrings module for localization` commit + - **NOTE** : only add files which are already being tracked - [ ] ***(Optional)*** Backport any Android-specific security fixes from Firefox rapid-release - [ ] ***(Optional, Chemspill)*** Backport security-fixes to both `tor-browser` and `base-browser` branches - [ ] ***(Optional)*** Rebase to `$(ESR_VERSION)` @@ -108,7 +99,7 @@ - [ ] `$(DIFF_TOOL) current_patchset.dif rebased_patchset.deff` - [ ] Open MR for the rebase - [ ] Sign/Tag `base-browser` commit: - - **NOTE** : Currently we are using the `Bug 40926: Implemented the New Identity feature` commit as the dividing line between `base-browser` and `tor-browser` + - **NOTE** : Currently we are using the `Bug 40926: Implemented the New Identity feature` commit as the final commit of `base-browser` before `tor-browser` - Tag : `base-browser-$(ESR_VERSION)esr-$(TOR_BROWSER_MAJOR).$(TOR_BROWSER_MINOR)-1-build1` - Message: `Tagging build1 for $(ESR_VERSION)esr-based alpha` - [ ] Sign/Tag `tor-browser` commit : @@ -120,7 +111,7 @@ </details> <details> - <summary>Build/Signing/Publishing</summary> + <summary>Build</summary> ### tor-browser-build: https://gitlab.torproject.org/tpo/applications/tor-browser-build.git Tor Browser Alpha (and Nightly) are on the `main` branch, while Stable lives in the various `maint-$(TOR_BROWSER_MAJOR).$(TOR_BROWSER_MINOR)` (and possibly more specific) branches @@ -195,8 +186,11 @@ Tor Browser Alpha (and Nightly) are on the `main` branch, while Stable lives in - [ ] Provide links to unsigned builds on `$(BUILD_SERVER)` - [ ] Call out any new functionality which needs testing - [ ] Link to any known issues -- [ ] Email Tails dev mailing list: tails-dev(a)boum.org - - [ ] Provide links to unsigned builds on `$(BUILD_SERVER)` + +</details> + +<details> + <summary>Signing/Publishing</summary> ### signing + publishing - [ ] Ensure builders have matching builds @@ -218,7 +212,7 @@ Tor Browser Alpha (and Nightly) are on the `main` branch, while Stable lives in - `cd tor-browser-build/tools/signing/` - `./macos-signer-proxy` - [ ] On `$(STAGING_SERVER)` in a separate `screen` session, ensure tor daemon is running with SOCKS5 proxy on the default port 9050 -- [ ] apk signing : *TODO* +- [ ] apk signing : copy signed `*multi.apk` files to the unsigned build outputs directory - [ ] run do-all-signing script: - `cd tor-browser-build/tools/signing/` - `./do-all-signing.sh` @@ -236,7 +230,7 @@ Tor Browser Alpha (and Nightly) are on the `main` branch, while Stable lives in - Select `Tor Browser (Alpha)` app - Navigate to `Release > Production` and click `Create new release` button - [ ] Upload the `*.multi.apk` APKs - - If necessary, update the 'Release Name' (should be automatically populated) + - [ ] Update Release Name to Tor Browser version number - [ ] Update Release Notes - Next to 'Release notes', click `Copy from a previous release` - [ ] Edit blog post url to point to most recent blog post @@ -248,7 +242,7 @@ Tor Browser Alpha (and Nightly) are on the `main` branch, while Stable lives in ### website: https://gitlab.torproject.org/tpo/web/tpo.git - [ ] `databags/versions.ini` : Update the downloads versions - `torbrowser-stable/version` : sort of a catch-all for latest stable version - - `torbrowser-stable/win32` : tor version in the expert bundle + - `torbrowser-alpha/version` : sort of a catch-all for latest stable version - `torbrowser-*-stable/version` : platform-specific stable versions - `torbrowser-*-alpha/version` : platform-specific alpha versions - `tor-stable`,`tor-alpha` : set by tor devs, do not touch ===================================== .gitlab/issue_templates/Release Prep - Stable.md ===================================== @@ -3,18 +3,13 @@ - `$(BUILD_SERVER)` : the server the main builder is using to build a tor-browser release - `$(STAGING_SERVER)` : the server the signer is using to to run the signing process -- `$(TOR_LAUNCHER_VERSION)` : version of `tor-launcher`, used in tags - - example : `0.2.33` - `$(ESR_VERSION)` : the Mozilla defined ESR version, used in various places for building tor-browser tags, labels, etc - example : `91.6.0` +- `$(RR_VERSION)` : the Mozilla defined Rapid-Release version; Tor Browser for Android is based off of the `$(ESR_VERSION)`, but Mozilla's Firefox for Android is based off of the `$(RR_VERSION)` so we need to keep track of security vulnerabilities to backport from the monthly Rapid-Release train and our frozen ESR train. + - example: `103` - `$(ESR_TAG)` : the Mozilla defined hg (Mercurial) tag associated with `$(ESR_VERSION)` - exmaple : `FIREFOX_91_7_0esr_BUILD2` - `$(ESR_TAG_PREV)` : the Mozilla defined hg (Mercurial) tag associated with the previous ESR version when rebasing (ie, the ESR version we are rebasing from) -- `$(RR_VERSION)` : the Mozilla defined 'Rapid Relese' version, used in various places for building geckoview tags, labels, etc - - example : `96.0.3` -- `$(RR_TAG)` : the Mozilla defined hg (Mercurial) tag associated with `$(ESR_VERSION)` - - exmaple : `FIREFOX_96_0_3_RELEASE` -- `$(RR_TAG_PREV)` : the Mozilla defined hg (Mercurial) tag associated with the previous ESR version when rebasing (ie, the ESR version we are rebasing from) - `$(TOR_BROWSER_MAJOR)` : the Tor Browser major version - example : `11` - `$(TOR_BROWSER_MINOR)` : the Tor Browser minor version @@ -31,46 +26,78 @@ - `$(TOR_BROWSER_BRANCH)` : the full name of tor-browser branch - typically of the form: `tor-browser-$(ESR_VERSION)esr-$(TOR_BROWSER_MAJOR).$(TOR-BROWSER_MINOR)-1` - `$(TOR_BROWSER_BRANCH_PREV)` : the full name of the previous tor-browser branch (when rebasing) -- `$(GECKOVIEW_BRANCH)` : the full name of geckoview branch - - typically of the form: `tor-browser-$(RR_VERSION)-$(TOR_BROWSER_MAJOR).$(TOR-BROWSER_MINOR)-1` -- `$(GECKOVIEW_BRANCH_PREV)` : the full name of the previous geckoview branch (when rebasing) </details> <details> <summary>Desktop</summary> -### **torbutton** ***(Optional)***: https://gitlab.torproject.org/tpo/applications/torbutton.git -- [ ] ***(Optional)*** Update translations : - - **NOTE** We only update strings in stable if a backported feature depends on new strings +### **torbutton** : https://gitlab.torproject.org/tpo/applications/torbutton.git +- [ ] Update translations : - [ ] `./import-translations.sh` - **NOTE** : if there are no new strings imported then we are done here - [ ] Commit with message `Translation updates` - **NOTE** : only add files which are already being tracked - [ ] fixup! `tor-browser`'s `Bug 10760 : Integrate TorButton to TorBrowser core` issue to point to updated `torbutton` commit -### **tor-launcher** ***(Optional)***: https://gitlab.torproject.org/tpo/applications/tor-launcher.git -- [ ] ***(Optional)*** Update translations: - - **NOTE** We only update strings in stable if a backported feature depends on new strings - - [ ] ./localization/import-translations.sh - - [ ] Commit with message `Translation updates` -- [ ] Update `install.rdf` file with new version -- [ ] Sign/Tag commit : - - Tag : `$(TOR_LAUNCHER_VERSION)` - - Message `Tagging $(TOR_LAUNCHER_VERSION)` -- [ ] Push `main` and tag to origin +</details> + +<details> + <summary>Android</summary> + +### ***Security Vulnerabilities Backport*** : https://www.mozilla.org/en-US/security/advisories/ +- **NOTE** : this work may have already occurred in the analogous stable release prep issue +- [ ] Create tor-browser issue `Backport Android-specific Firefox $(RR_VERSION) to ESR $(ESR_VERSION)-based Tor Browser` + - [ ] Link new backport issue to this release prep issue +- [ ] Go through any `Security Vulnerabilities fixed in Firefox $(RR_VERSION)` (or similar) and create list of CVEs which affect Android that need to be a backported + - Potentially Affected Components: + - `firefox` + - `application-services` + - `android-components` + - `fenix` + +### **application-services** ***(Optional)*** : *TODO: we need to setup a gitlab copy of this repo that we can apply security backports to* +- [ ] Backport any Android-specific security fixes from Firefox rapid-release +- [ ] Sign/Tag commit: + - Tag : `application-services-$(ESR_VERSION)-$(TOR_BROWSER_MAJOR).$(TOR_BROWSER_MINOR)-1-$(BUILD_N)` + - Message: `Tagging $(BUILD_N) for $(ESR_VERSION)-based alpha` +- [ ] Push tag to `origin` + +### **android-components** ***(Optional)*** : https://gitlab.torproject.org/tpo/applications/android-components.git +- [ ] Backport any Android-specific security fixes from Firefox rapid-release +- [ ] Sign/Tag commit: + - Tag : `android-components-$(ESR_VERSION)-$(TOR_BROWSER_MAJOR).$(TOR_BROWSER_MINOR)-1-$(BUILD_N)` + - Message: `Tagging $(BUILD_N) for $(ESR_VERSION)-based alpha)` +- [ ] Push tag to `origin` + +### **fenix** ***(Optional)*** : https://gitlab.torproject.org/tpo/applications/fenix.git +- [ ] Backport any Android-specific security fixes from Firefox rapid-release +- [ ] Sign/Tag commit: + - Tag : `tor-browser-$(ESR_VERSION)-$(TOR_BROWSER_MAJOR).$(TOR_BROWSER_MINOR)-1-$(BUILD_N)` + - Message: `Tagging $(BUILD_N) for $(ESR_VERSION)-based alpha)` +- [ ] Push tag to `origin` + +</details> + +<details> + <summary>Shared</summary> ### tor-browser: https://gitlab.torproject.org/tpo/applications/tor-browser.git +- [ ] ***(Optional)*** Backport any Android-specific security fixes from Firefox rapid-release +- [ ] ***(Optional, Chemspill)*** Backport security-fixes to both `tor-browser` and `base-browser` branches - [ ] ***(Optional)*** Rebase to `$(ESR_VERSION)` - - [ ] Find the Firefox hg tag here : https://hg.mozilla.org/releases/mozilla-esr91/tags + - [ ] Find the Firefox hg tag here : https://hg.mozilla.org/releases/mozilla-esr102/tags - [ ] `$(ESR_TAG)` : `<INSERT_TAG_HERE>` - [ ] Identify the hg patch associated with above hg tag, and find the equivalent `gecko-dev` git commit (search by commit message) - [ ] `gecko-dev` commit : `<INSERT_COMMIT_HASH_HERE>` - - [ ] Create new `tor-browser` branch with the discovered `gecko-dev` commit as `HEAD` named `tor-browser-$(ESR_VERSION)esr-$(TOR_BROWSER_MAJOR).$(TOR-BROWSER_MINOR)-1` - [ ] Sign/Tag commit : - Tag : `$(ESR_TAG)` - Message : `Hg tag $(ESR_TAG)` - - [ ] Push new branch and tag to origin - - [ ] Rebase `tor-browser` patches + - [ ] Create new branches with the discovered `gecko-dev` commit as `HEAD` named: + - [ ] `base-browser-$(ESR_VERSION)esr-$(TOR_BROWSER_MAJOR).$(TOR-BROWSER_MINOR)-1` + - [ ] `tor-browser-$(ESR_VERSION)esr-$(TOR_BROWSER_MAJOR).$(TOR-BROWSER_MINOR)-1` + - [ ] Push new branches and esr tag to origin + - [ ] Rebase `base-browser` patches onto the `gecko-dev` commit + - [ ] Rebase `tor-browser` patches onto the `base-browser` branch - [ ] Compare patch-sets (ensure nothing *weird* happened during rebase): - [ ] rangediff: `git range-diff $(ESR_TAG_PREV)..$(TOR_BROWSER_BRANCH_PREV) $(ESR_TAG)..$(TOR_BROWSER_BRANCH)` - [ ] diff of diffs: @@ -79,150 +106,65 @@ - [ ] `git diff $(ESR_TAG)..$(TOR_BROWSER_BRANCH) > rebased_patchset.diff` - [ ] `$(DIFF_TOOL) current_patchset.dif rebased_patchset.deff` - [ ] Open MR for the rebase -- [ ] ***(Optional)*** Backport any required Alpha patches to Stable - - [ ] cherry-pick patches on top of rebased branch (issues to backport should have `Backport` label and be linked to the associated `Release Prep` issue) - - [ ] Close associated `Backport` issues - - [ ] Open MR for the backport commits +- [ ] Sign/Tag `base-browser` commit: + - **NOTE** : Currently we are using the `Bug 40926: Implemented the New Identity feature` commit as the final commit of `base-browser` before `tor-browser` + - Tag : `base-browser-$(ESR_VERSION)esr-$(TOR_BROWSER_MAJOR).$(TOR_BROWSER_MINOR)-1-build1` + - Message: `Tagging build1 for $(ESR_VERSION)esr-based alpha` - [ ] Sign/Tag `tor-browser` commit : - Tag : `tor-browser-$(ESR_VERSION)esr-$(TOR_BROWSER_MAJOR).$(TOR_BROWSER_MINOR)-1-$(FIREFOX_BUILD_N)` - - Message : `Tagging $(FIREFOX_BUILD_N) for $(ESR_VERSION)esr-based (alpha|stable)` -- [ ] Push tag to `origin` + - Message : `Tagging $(FIREFOX_BUILD_N) for $(ESR_VERSION)esr-based alpha` +- [ ] Push rebased branches and tags to `origin` +- [ ] Update Gitlab Default Branch to new Alpha branch: https://gitlab.torproject.org/tpo/applications/tor-browser/-/settings/repos… </details> <details> - <summary>Android</summary> - -### **geckoview**: https://gitlab.torproject.org/tpo/applications/tor-browser.git -- [ ] ***(Optional)*** Rebase to `$(RR_VERSION)` - - [ ] Find the Firefox hg tag here : https://hg.mozilla.org/releases/mozilla-release/tags - - [ ] `$(RR_TAG)` : `<INSERT_TAG_HERE>` - - [ ] Identify the hg patch associated with above hg tag, and find the equivalent `gecko-dev` git commit (search by commit message) - - [ ] `gecko-dev` commit : `<INSERT_COMMIT_HASH_HERE>` - - [ ] Create new `geckoview` branch with the discovered `gecko-dev` commit as `HEAD` named `geckoview-$(RR_VERSION)-$(TOR_BROWSER_MAJOR).$(TOR-BROWSER_MINOR)-1` - - [ ] Sign/Tag commit : - - Tag : `$(RR_TAG)` - - Message : `Hg tag $(RR_TAG)` - - [ ] Push new branch and tag to origin - - [ ] Rebase `geckoview` patches - - [ ] Compare patch-sets (ensure nothing *weird* happened during rebase): - - [ ] rangediff: `git range-diff $(RR_TAG_PREV)..$(GECKOVIEW_BRANCH_PREV) $(RR_TAG)..$(GECKOVIEW_BRANCH)` - - [ ] diff of diffs: - - Do the diff between `current_patchset.diff` and `rebased_patchset.diff` with your preferred `$(DIFF_TOOL)` and look at differences on lines that starts with + or - - - [ ] `git diff $(RR_TAG_PREV)..$(GECKOVIEW_BRANCH_PREV) > current_patchset.diff` - - [ ] `git diff $(RR_TAG)..$(GECKOVIEW_BRANCH) > rebased_patchset.diff` - - [ ] `$(DIFF_TOOL) current_patchset.dif rebased_patchset.deff` - - [ ] Open MR for the rebase -- [ ] ***(Optional)*** Backport any required patches to Stable - - [ ] cherry-pick patches on top of rebased branch (issues to backport should have `Backport` label and be linked to the associated `Release Prep` issue) - - [ ] Close associated `Backport` issues - - [ ] Open MR for the backport commits - - [ ] Merge + Push -- [ ] Sign/Tag `geckoview` commit : - - Tag : `geckoview-$(RR_VERSION)-$(TOR_BROWSER_MAJOR).$(TOR_BROWSER_MINOR)-1-$(FIREFOX_BUILD_N)` - - Message : `Tagging $(FIREFOX_BUILD_N) for $(RR_VERSION)-based (alpha|stable)` -- [ ] Push tag to `origin` - -### **tba-translation** ***(Optional)***: https://gitlab.torproject.org/tpo/translation.git -- **NOTE** We only update strings in stable if a backported feature depends on new strings -- [ ] Fetch latest and identify new `HEAD` of `fenix-torbrowserstringsxml` branch - - [ ] `origin/fenix-torbrowserstringsxml` : `<INSERT COMMIT HASH HERE>` - -### **tor-android-service** ***(Optional)***: https://gitlab.torproject.org/tpo/applications/tor-android-service.git -- [ ] Fetch latest and identify new `HEAD` of `main` branch - - [ ] `origin/main` : `<INSERT COMMIT HASH HERE>` - -### **application-services** : *TODO: we need to setup a gitlab copy of this repo that we can apply security backports to* -- [ ] ***(Optional)*** Backport any Android-specific security fixes from Firefox rapid-release -- [ ] Sign/Tag commit: - - Tag : `application-services-$(ESR_VERSION)-$(TOR_BROWSER_MAJOR).$(TOR_BROWSER_MINOR)-1-$(BUILD_N)` - - Message: `Tagging $(BUILD_N) for $(ESR_VERSION)-based (alpha|stable)` -- [ ] Push tag to `origin` -### **android-components** ***(Optional)***: https://gitlab.torproject.org/tpo/applications/android-components.git -- [ ] ***(Optional)*** Rebase to `$(RR_VERSION)` - - [ ] Identify the `mozilla-mobile` git tag to start from by first updating `fenix` and then checking which `android-components` tag is used in `buildSrc/src/main/java/AndroidComponents.kt` - - Alternatively search for commit message like `Update Android-Components` - - [ ] Create new branch from tag named `android-components-$(RR_VERSION)-$(TOR_BROWSER_MAJOR).$(TOR_BROWSER_MINOR)-1` - - [ ] Push new branch to origin - - [ ] Rebase `android-components` patches - - [ ] Perform rangediff to ensure nothing weird happened resolving conflicts - - [ ] Open MR for the rebase - - [ ] Merge + Push -- [ ] ***(Optional)*** Backport any required patches to Stable - - [ ] cherry-pick patches on top of rebased branch (issues to backport should have `Backport` label and be linked to the associated `Release Prep` issue) - - [ ] Close associated `Backport` issues - - [ ] Open MR for the backport commits - - [ ] Merge + Push - [ ] Sign/Tag commit: - - Tag : `android-components-$(RR_VERSION)-$(TOR_BROWSER_MAJOR).$(TOR_BROWSER_MINOR)-1-$(BUILD_N)` - - Message: `Tagging $(BUILD_N) for $(RR_VERSION)-based (alpha|stable)` - - [ ] Push tag to origin - -### **fenix** ***(Optional)***: https://gitlab.torproject.org/tpo/applications/fenix.git -- [ ] ***(Optional)*** Rebase to `$(RR_VERSION)` - - Upstream git repo : https://github.com/mozilla-mobile/fenix.git - - [ ] Identify the `mozilla-mobile` git tag to start from - - Seem to be in the form `v$(RR_VERSION)` (for example, `v96.3.0`) - - [ ] Create new branch from tag named `tor-browser-$(RR_VERSION)-$(TOR_BROWSER_MAJOR).$(TOR_BROWSER_MINOR)-1` - - **NOTE** : it is weird but we do use `tor-browser` here rather than `fenix` - - [ ] Push new branch to origin - - [ ] Rebase `fenix` patches - - [ ] Perform rangediff to ensure nothing weird happened resolving conflicts - - [ ] Open MR for the rebase - - [ ] Merge + Push -- [ ] ***(Optional)*** Backport any required patches to Stable - - [ ] cherry-pick patches on top of rebased branch (issues to backport should have `Backport` label and be linked to the associated `Release Prep` issue) - - [ ] Close associated `Backport` issues - - [ ] Open MR for the backport commits - - [ ] Merge + Push -- [ ] Sign/Tag commit: - - Tag : `tor-browser-$(RR_VERSION)-$(TOR_BROWSER_MAJOR).$(TOR_BROWSER_MINOR)-1-$(BUILD_N)` - - Message: `Tagging $(BUILD_N) for $(RR_VERSION)-based (alpha|stable)` -- [ ] Push tag to origin - -</details> - -<details> - <summary>Build/Signing/Publishing</summary> + <summary>Build</summary> ### tor-browser-build: https://gitlab.torproject.org/tpo/applications/tor-browser-build.git -Tor Browser Alpha (and Nightly) are on the `main` branch, while Stable lives in the various `$(TOR_BROWSER_MAJOR).$(TOR_BROWSER_MINOR)-maint` (and possibly more specific) branches +Tor Browser Alpha (and Nightly) are on the `main` branch, while Stable lives in the various `maint-$(TOR_BROWSER_MAJOR).$(TOR_BROWSER_MINOR)` (and possibly more specific) branches - [ ] Update `rbm.conf` - [ ] `var/torbrowser_version` : update to next version - [ ] `var/torbrowser_build` : update to `$(TOR_BROWSER_BUILD_N)` - [ ] ***(Desktop Only)*** `var/torbrowser_incremental_from` : update to previous Desktop version - [ ] **IMPORTANT**: Really *actually* make sure this is the previous Desktop version or else the `make incrementals-*` step will fail -- [ ] ***(Desktop Only)*** Update `projects/firefox/config` +- [ ] Update `projects/firefox/config` - [ ] `git_hash` : update the `$(BUILD_N)` section to match `tor-browser` tag - [ ] ***(Optional)*** `var/firefox_platform_version` : update to latest `$(ESR_VERSION)` if rebased -- [ ] ***(Android Only)*** Update `projects/geckoview/config` - - [ ] `git_hash` : update the `$(BUILD_N)` section to match `geckoview` tag - - [ ] ***(Optional)*** `var/geckoview_version` : update to latest `$(RR_VERSION)` if rebased -- [ ] ***(Android Only, Optional)*** Update `projects/tba-translations/config`: +- [ ] Update `projects/geckoview/config` + - [ ] `git_hash` : update the `$(BUILD_N)` section to match `tor-browser` tag + - [ ] ***(Optional)*** `var/geckoview_version` : update to latest `$(ESR_VERSION)` if rebased +- [ ] Update `projects/translation-base-browser/config` + - [ ] `git_hash` : update with `HEAD` commit of project's `base-browser` branch +- [ ] Update `projects/translation-base-browser-fluent/config` + - [ ] `git_hash` : update with `HEAD` commit of project's `basebrowser-newidentityftl` branch +- [ ] Update `projects/tba-translations/config`: - [ ] `git_hash` : update with `HEAD` commit of project's `fenix-torbrowserstringsxml` branch -- [ ] ***(Android Only, Optional)*** Update `projects/tor-android-service/config` +- [ ] ***(Optional)*** Update `projects/tor-android-service/config` - [ ] `git_hash` : update with `HEAD` commit of project's `main` branch -- [ ] ***(Android Only, Optional)*** Update `projects/application-services/config`: +- [ ] ***(Optional)*** Update `projects/application-services/config`: **NOTE** we don't have any of our own patches for this project - - [ ] `git_hash` : update to appropriate git commit associated with $(RR_VERSION) -- [ ] ***(Android Only, Optional)*** Update `projects/android-components/config` - - [ ] `git_hash` : update the `$(BUILD_N)` section to match `android-components` tag - - [ ] ***(Optional)*** `var/android_components_version` : update to latest `$(RR_VERSION)` if rebased -- [ ] ***(Android Only, Optional)*** Update `projects/fenix/config` + - [ ] `git_hash` : update to appropriate git commit associated with `$(ESR_VERSION)` +- [ ] Update `projects/android-components/config`: + - [ ] `git_hash` : update the `$(BUILD_N)` section to match alpha `android-components` tag +- [ ] Update `projects/fenix/config` - [ ] `git_hash` : update the `$(BUILD_N)` section to match `fenix` tag - - [ ] ***(Optional)*** `var/fenix_version` : update to latest `$(RR_VERSION)` if rebased -- [ ] ***(Android Only)*** Update allowed_addons.json by running (from `tor-browser-build` root): - - `./tools/fetch_allowed_addons.py > projects/tor-browser/allowed_addons.json` + - [ ] ***(Optional)*** `var/fenix_version` : update to latest `$(ESR_VERSION)` if rebased +- [ ] Update allowed_addons.json by running (from `tor-browser-build` root): + - `./tools/fetch_allowed_addons.py > projects/browser/allowed_addons.json` - [ ] Check for NoScript updates here : https://addons.mozilla.org/en-US/firefox/addon/noscript - - [ ] ***(Optional)*** If new version available, update `noscript` section of `input_files` in `projects/tor-browser/config` + - [ ] ***(Optional)*** If new version available, update `noscript` section of `input_files` in `projects/browser/config` - [ ] `URL` - [ ] `sha256sum` -- [ ] Check for OpenSSL updates here : https://github.com/openssl/openssl/tags - - [ ] ***(Optional)*** If new 1.X.Y series tag available, update `projects/openssl/config` - - [ ] `version` : update to next 1.X.Y release tag +- [ ] Check for OpenSSL updates here : https://www.openssl.org/source/ + - [ ] ***(Optional)*** If new 1.X.Y version available, update `projects/openssl/config` + - [ ] `version` : update to next 1.X.Y version - [ ] `input_files/sha256sum` : update to sha256 sum of source tarball -- [ ] Check for tor updates here : https://gitlab.torproject.org/tpo/core/tor/-/tags ; Tor Browser Alpha uses `-alpha` tagged tor, while stable uses the stable series +- [ ] Check for zlib updates here: https://github.com/madler/zlib/releases + - [ ] **(Optional)** If new tag available, update `projects/zlib/config` + - [ ] `version` : update to next release tag +- [ ] Check for tor updates here : https://gitlab.torproject.org/tpo/core/tor/-/tags ; Tor Browser Alpha uses latest `-alpha` tagged tor (or latest of stable if newer) - [ ] ***(Optional)*** Update `projects/tor/config` - [ ] `version` : update to next release tag - [ ] Check for go updates here : https://golang.org/dl @@ -244,7 +186,7 @@ Tor Browser Alpha (and Nightly) are on the `main` branch, while Stable lives in - [ ] Ensure ChangeLog.txt is sync'd between alpha and stable branches - [ ] Open MR with above changes - [ ] Begin build on `$(BUILD_SERVER)` (and fix any issues which come up) -- [ ] Sign/Tag commit : `make signtag-(alpha|release)` +- [ ] Sign/Tag commit : `make signtag-release` - [ ] Push tag to origin ### notify stakeholders @@ -255,57 +197,32 @@ Tor Browser Alpha (and Nightly) are on the `main` branch, while Stable lives in - [ ] Email Tails dev mailing list: tails-dev(a)boum.org - [ ] Provide links to unsigned builds on `$(BUILD_SERVER)` -### blog: https://gitlab.torproject.org/tpo/web/blog.git - -- [ ] Duplicate previous Stable or Alpha release blog post as appropriate to new directory under `content/blog/new-release-tor-browser-$(TOR_BROWSER_VERSION)` and update with info on release : - - [ ] Update Tor Browser version numbers - - [ ] Note any ESR rebase - - [ ] Note any Rapid Release rebase - - [ ] Link to any Firefox security updates - - [ ] Note any updates to : - - [ ] tor - - [ ] OpenSSL - - [ ] go - - [ ] NoScript - - [ ] Convert ChangeLog.txt to markdown format used here by : `tor-browser-build/tools/changelog-format-blog-post` -- [ ] Push to origin as new branch, open 'Draft :' MR -- [ ] Remove `Draft:` from MR once signed-packages are uploaded -- [ ] Merge -- [ ] Publish after CI passes +</details> -### website: https://gitlab.torproject.org/tpo/web/tpo.git -- [ ] `databags/versions.ini` : Update the downloads versions - - `torbrowser-stable/version` : sort of a catch-all for latest stable version - - `torbrowser-stable/win32` : tor version in the expert bundle - - `torbrowser-*-stable/version` : platform-specific stable versions - - `torbrowser-*-alpha/version` : platform-specific alpha versions - - `tor-stable`,`tor-alpha` : set by tor devs, do not touch -- [ ] Push to origin as new branch, open 'Draft :' MR -- [ ] Remove `Draft:` from MR once signed-packages are uploaded -- [ ] Merge -- [ ] Publish after CI passes +<details> + <summary>Signing/Publishing</summary> ### signing + publishing - [ ] Ensure builders have matching builds - [ ] On `$(STAGING_SERVER)`, ensure updated: - [ ] `tor-browser-build/tools/signing/set-config` - - [ ] `NSS_DB_DIR` : location of the `nssdb7` directory + - `NSS_DB_DIR` : location of the `nssdb7` directory - [ ] `tor-browser-build/tools/signing/set-config.hosts` - - [ ] `ssh_host_builder` : ssh hostname of machine with unsigned builds + - `ssh_host_builder` : ssh hostname of machine with unsigned builds - **NOTE** : `tor-browser-build` is expected to be in the `$HOME` directory) - - [ ] `ssh_host_linux_signer` : ssh hostname of linux signing machine - - [ ] `ssh_host_macos_signer` : ssh hostname of macOS signing machine + - `ssh_host_linux_signer` : ssh hostname of linux signing machine + - `ssh_host_macos_signer` : ssh hostname of macOS signing machine - [ ] `tor-browser-build/tools/signing/set-config.macos-notarization` - - [ ] `macos_notarization_user` : the email login for a tor notariser Apple Developer account + - `macos_notarization_user` : the email login for a tor notariser Apple Developer account - [ ] `tor-browser-build/tools/signing/set-config.tbb-version` - - [ ] `tbb_version` : tor browser version string, same as `var/torbrowser_version` in `rbm.conf` (examples: `11.5a12`, `11.0.13`) - - [ ] `tbb_version_build` : the tor-browser-build build number (if `var/torbrowser_build` in `rbm.conf` is `buildN` then this value is `N`) - - [ ] `tbb_version_type` : either `alpha` for alpha releases or `release` for stable releases + - `tbb_version` : tor browser version string, same as `var/torbrowser_version` in `rbm.conf` (examples: `11.5a12`, `11.0.13`) + - `tbb_version_build` : the tor-browser-build build number (if `var/torbrowser_build` in `rbm.conf` is `buildN` then this value is `N`) + - `tbb_version_type` : either `alpha` for alpha releases or `release` for stable releases - [ ] On `$(STAGING_SERVER)` in a separate `screen` session, run the macOS proxy script: - `cd tor-browser-build/tools/signing/` - `./macos-signer-proxy` - [ ] On `$(STAGING_SERVER)` in a separate `screen` session, ensure tor daemon is running with SOCKS5 proxy on the default port 9050 -- [ ] ***(Android Only)*** APK Signing: *TODO* +- [ ] apk signing : copy signed `*multi.apk` files to the unsigned build outputs directory - [ ] run do-all-signing script: - `cd tor-browser-build/tools/signing/` - `./do-all-signing.sh` @@ -317,23 +234,51 @@ Tor Browser Alpha (and Nightly) are on the `main` branch, while Stable lives in - [ ] `/srv/cdn-master.torproject.org/htdocs/aus1/torbrowser` - [ ] `/srv/dist-master.torproject.org/htdocs/torbrowser` - [ ] Static update components : `static-update-component cdn.torproject.org && static-update-component dist.torproject.org` - - [ ] Enable update responses : - - [ ] alpha: `./deploy_update_responses-alpha.sh` - - [ ] release: `./deploy_update_responses-release.sh` -- [ ] ***(Android Only)*** : Publish APKs to Google Play: - - [ ] Log into https://play.google.com/apps/publish - - [ ] Select `Tor Browser` app - - [ ] Navigate to `Release > Production` and click `Create new release` button + - [ ] Enable update responses : `./deploy_update_responses-alpha.sh` +- [ ] Publish APKs to Google Play: + - Log into https://play.google.com/apps/publish + - Select `Tor Browser (Alpha)` app + - Navigate to `Release > Production` and click `Create new release` button - [ ] Upload the `*.multi.apk` APKs - - [ ] If necessary, update the 'Release Name' (should be automatically populated) + - [ ] Update Release Name to Tor Browser version number - [ ] Update Release Notes - - [ ] Next to 'Release notes', click `Copy from a previous release` + - Next to 'Release notes', click `Copy from a previous release` - [ ] Edit blog post url to point to most recent blog post - - [ ] Save, review, and configure rollout percentage + - Save, review, and configure rollout percentage - [ ] 25% rollout when publishing a scheduled update - [ ] 100% rollout when publishing a security-driven release - [ ] Update rollout percentage to 100% after confirmed no major issues +### website: https://gitlab.torproject.org/tpo/web/tpo.git +- [ ] `databags/versions.ini` : Update the downloads versions + - `torbrowser-stable/version` : sort of a catch-all for latest stable version + - `torbrowser-alpha/version` : sort of a catch-all for latest stable version + - `torbrowser-*-stable/version` : platform-specific stable versions + - `torbrowser-*-alpha/version` : platform-specific alpha versions + - `tor-stable`,`tor-alpha` : set by tor devs, do not touch +- [ ] Push to origin as new branch, open 'Draft :' MR +- [ ] Remove `Draft:` from MR once signed-packages are uploaded +- [ ] Merge +- [ ] Publish after CI passes and builds are published + +### blog: https://gitlab.torproject.org/tpo/web/blog.git + +- [ ] Duplicate previous Stable or Alpha release blog post as appropriate to new directory under `content/blog/new-release-tor-browser-$(TOR_BROWSER_VERSION)` and update with info on release : + - [ ] Update Tor Browser version numbers + - [ ] Note any ESR rebase + - [ ] Link to any Firefox security updates from ESR upgrade + - [ ] Link to any Android-specific security backports + - [ ] Note any updates to : + - tor + - OpenSSL + - NoScript + - [ ] Convert ChangeLog.txt to markdown format used here by : + - `tor-browser-build/tools/changelog-format-blog-post` +- [ ] Push to origin as new branch, open `Draft:` MR +- [ ] Remove `Draft:` from MR once signed-packages are uploaded +- [ ] Merge +- [ ] Publish after CI passes and website has been updated + ### tor-announce mailing list - [ ] Send an email to tor-announce(a)lists.torproject.org, using the same content as the blog post and subject "Tor Browser $version is released". View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/9… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/9… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-102.5.0esr-12.5-1] fixup! Bug 10760: Integrate TorButton to TorBrowser core
by Richard Pospesel (＠richard) 08 Dec '22

08 Dec '22

Richard Pospesel pushed to branch tor-browser-102.5.0esr-12.5-1 at The Tor Project / Applications / Tor Browser Commits: c52fe531 by Henry Wilkes at 2022-12-08T13:52:03+00:00 fixup! Bug 10760: Integrate TorButton to TorBrowser core - - - - - 1 changed file: - tools/lint/eslint/eslint-plugin-mozilla/lib/environments/browser-window.js Changes: ===================================== tools/lint/eslint/eslint-plugin-mozilla/lib/environments/browser-window.js ===================================== @@ -90,7 +90,7 @@ function getGlobalScriptIncludes(scriptPath) { .replace("chrome://global/content/", "toolkit/content/") .replace( "chrome://torbutton/content/", - "toolkit/torproject/torbutton/chrome/content/" + "toolkit/torbutton/chrome/content/" ); for (let mapping of Object.getOwnPropertyNames(MAPPINGS)) { View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/c52fe53… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/c52fe53… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser] Pushed new tag FIREFOX_102_6_0esr_BUILD1
by Richard Pospesel (＠richard) 08 Dec '22

08 Dec '22

Richard Pospesel pushed new tag FIREFOX_102_6_0esr_BUILD1 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/FIREFOX_1… You're receiving this email because of your account on gitlab.torproject.org.

1 0