- tbb-commits - lists.torproject.org

[tor-browser-bundle/master] Bug 22267: fix setup of hardened mingw wrappers
by gk＠torproject.org 21 May '17

21 May '17

commit 2db406eba4657e5876994002070f92ace6d2dcc3 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri May 19 23:33:12 2017 +0200 Bug 22267: fix setup of hardened mingw wrappers Add the hardened wrappers to the PATH before running the firefox configure script. It seems that the wrappers are not used in the build if they were not in the PATH during the configure step. --- gitian/descriptors/windows/gitian-firefox.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/gitian/descriptors/windows/gitian-firefox.yml b/gitian/descriptors/windows/gitian-firefox.yml index a83ad5b..f3738eb 100644 --- a/gitian/descriptors/windows/gitian-firefox.yml +++ b/gitian/descriptors/windows/gitian-firefox.yml @@ -79,15 +79,16 @@ script: | find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" # Make sure widl is not inserting random timestamps, see #21837. export WIDL_TIME_OVERRIDE="0" - rm -f configure - rm -f js/src/configure - make -f client.mk configure CONFIGURE_ARGS="--with-tor-browser-version=${TORBROWSER_VERSION} --with-distribution-id=org.torproject --enable-update-channel=${TORBROWSER_UPDATE_CHANNEL} --enable-bundled-fonts" - find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" # mkdir -p ~/build/bin/ cp ~/build/i686* ~/build/bin/ export PATH=~/build/bin:$PATH # + rm -f configure + rm -f js/src/configure + make -f client.mk configure CONFIGURE_ARGS="--with-tor-browser-version=${TORBROWSER_VERSION} --with-distribution-id=org.torproject --enable-update-channel=${TORBROWSER_UPDATE_CHANNEL} --enable-bundled-fonts" + find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" + # make $MAKEOPTS -f client.mk build # make -C obj-* package INNER_MAKE_PACKAGE=true

1 0

[tor-browser-build/master] projects/release: reset HOME for gpg
by boklm＠torproject.org 17 May '17

17 May '17

commit 5f85afd771daaf9e1f6f1f8797188b5523839a1e Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed May 17 20:53:42 2017 +0200 projects/release: reset HOME for gpg If HOME is set to a temporary directory, $HOME/.gnupg cannot be used to sign the build. --- projects/release/config | 2 ++ 1 file changed, 2 insertions(+) diff --git a/projects/release/config b/projects/release/config index f6712c0..3351959 100644 --- a/projects/release/config +++ b/projects/release/config @@ -120,6 +120,8 @@ input_files: build: | #!/bin/sh [% c("var/set_default_env") -%] + # reset HOME which was changed by var/set_default_env, for gpg + [% IF ENV.HOME %]export HOME="[% ENV.HOME %]"[% END %] destdir="[% dest_dir _ '/' _ c("var/publish_dir") %]" mkdir -p "$destdir" [% IF c("var/torbrowser-windows-i686") -%]

1 0

[tor-browser-build/master] Bug 22194/20683: Integrate Selfrando into alpha Linux builds
by boklm＠torproject.org 17 May '17

17 May '17

commit 16d87451179ed55fd6422cd09988a99f5ee886b7 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu May 18 00:10:16 2017 +0200 Bug 22194/20683: Integrate Selfrando into alpha Linux builds Selfrando is a new defense against code reuse attacks developed by the Redactor and Readactor++ people. We should give it a wider testing audience by including it in the alpha series. This is currently only available for 64bit Linux builds, though. Supporting other platforms and architectures is work in progress. tor-browser-bundle.git author: Georg Koppen <gk(a)torproject.org> tor-browser-bundle.git commit: 332c5b6c16f1b0915f537a4ad5af48295f80c733 tor-browser-bundle.git commit: 8fe0e322b950efa2456502428bee66dde8b4948a tor-browser-bundle.git commit: 3e752843dfa39beec844822c9f6c3dd1f80355ea --- keyring/elfutils.gpg | Bin 0 -> 10483 bytes keyring/selfrando.gpg | Bin 0 -> 2759 bytes projects/binutils/binutils-224-gold.patch | 98 +++++++++++++++++++++ projects/binutils/build | 6 ++ projects/binutils/config | 2 + projects/elfutils/build | 23 +++++ projects/elfutils/config | 22 +++++ projects/firefox/build | 9 ++ projects/firefox/config | 4 + projects/selfrando/build | 25 ++++++ projects/selfrando/config | 23 +++++ .../tor-browser/RelativeLink/start-tor-browser | 1 + 12 files changed, 213 insertions(+) diff --git a/keyring/elfutils.gpg b/keyring/elfutils.gpg new file mode 100644 index 0000000..f1cd4b3 Binary files /dev/null and b/keyring/elfutils.gpg differ diff --git a/keyring/selfrando.gpg b/keyring/selfrando.gpg new file mode 100644 index 0000000..276955d Binary files /dev/null and b/keyring/selfrando.gpg differ diff --git a/projects/binutils/binutils-224-gold.patch b/projects/binutils/binutils-224-gold.patch new file mode 100644 index 0000000..a45e49c --- /dev/null +++ b/projects/binutils/binutils-224-gold.patch @@ -0,0 +1,98 @@ +From f984741df04cd68bb116073fdfa9405808810ab4 Mon Sep 17 00:00:00 2001 +From: Cary Coutant <ccoutant(a)google.com> +Date: Wed, 5 Feb 2014 22:59:02 -0800 +Subject: [PATCH] Fix issues with gold undefined symbol diagnostics. + +PR binutils/15435 complains that gold issues a visibility error for an +weak undefined symbol with hidden visibility. The message should be +suppressed if the symbol is a weak undef. + +An earlier patch to add an extra note about key functions when a class's +vtable symbol is undefined missed a case where the reference to the +vtable came from a shared library. This patch moves the check to a +lower-level routine that catches both cases. + +gold/ + +2014-02-05 Cary Coutant <ccoutant(a)google.com> + + * errors.cc (Errors::undefined_symbol): Move undef vtable symbol + check to here. + * target-reloc.h (is_strong_undefined): New function. + (relocate_section): Move undef vtable symbol check from here. + Check for is_strong_undefined. + +diff --git a/gold/ChangeLog b/gold/ChangeLog +index dcf7ed41f8..dd7ef72980 100644 +--- a/gold/ChangeLog ++++ b/gold/ChangeLog +@@ -1,3 +1,14 @@ ++2014-02-05 Cary Coutant <ccoutant(a)google.com> ++ ++ Fix issues with gold undefined symbol diagnostics. ++ ++ PR binutils/15435 ++ * errors.cc (Errors::undefined_symbol): Move undef vtable symbol ++ check to here. ++ * target-reloc.h (is_strong_undefined): New function. ++ (relocate_section): Move undef vtable symbol check from here. ++ Check for is_strong_undefined. ++ + 2013-11-22 Cary Coutant <ccoutant(a)google.com> + + * testsuite/Makefile.am (exception_x86_64_bnd_test): Use in-tree +diff --git a/gold/errors.cc b/gold/errors.cc +index b79764bd1d..98db0fdd86 100644 +--- a/gold/errors.cc ++++ b/gold/errors.cc +@@ -193,6 +193,11 @@ Errors::undefined_symbol(const Symbol* sym, const std::string& location) + fprintf(stderr, + _("%s: %s: undefined reference to '%s', version '%s'\n"), + location.c_str(), zmsg, sym->demangled_name().c_str(), version); ++ ++ if (sym->is_cxx_vtable()) ++ gold_info(_("%s: the vtable symbol may be undefined because " ++ "the class is missing its key function"), ++ program_name); + } + + // Issue a debugging message. +diff --git a/gold/target-reloc.h b/gold/target-reloc.h +index b544c78f37..d609bcbaa8 100644 +--- a/gold/target-reloc.h ++++ b/gold/target-reloc.h +@@ -144,6 +144,12 @@ class Default_comdat_behavior + } + }; + ++inline bool ++is_strong_undefined(const Symbol* sym) ++{ ++ return sym->is_undefined() && sym->binding() != elfcpp::STB_WEAK; ++} ++ + // Give an error for a symbol with non-default visibility which is not + // defined locally. + +@@ -411,16 +417,10 @@ relocate_section( + } + + if (issue_undefined_symbol_error(sym)) +- { +- gold_undefined_symbol_at_location(sym, relinfo, i, offset); +- if (sym->is_cxx_vtable()) +- gold_info(_("%s: the vtable symbol may be undefined because " +- "the class is missing its key function"), +- program_name); +- } ++ gold_undefined_symbol_at_location(sym, relinfo, i, offset); + else if (sym != NULL + && sym->visibility() != elfcpp::STV_DEFAULT +- && (sym->is_undefined() || sym->is_from_dynobj())) ++ && (is_strong_undefined(sym) || sym->is_from_dynobj())) + visibility_error(sym); + + if (sym != NULL && sym->has_warning()) +-- +2.11.0 + diff --git a/projects/binutils/build b/projects/binutils/build index bd949a5..baef68f 100644 --- a/projects/binutils/build +++ b/projects/binutils/build @@ -26,6 +26,12 @@ cd [% project %]-[% c("version") %] # Zeroing timestamps in PE headers reliably, see bug 12753. patch -p1 < ../peXXigen.patch [% END -%] +[% IF c("var/linux-x86_64") -%] + # We need to work around a gold linker bug in 2.24 to get selfrando working, + # see bug 20683. + # XXX: 64bits only for now :(, see #20683. + patch -p1 < $rootdir/binutils-224-gold.patch +[% END -%] ./configure --prefix=$distdir [% c('var/configure_opt') %] make -j4 make install diff --git a/projects/binutils/config b/projects/binutils/config index 0cb2088..88640f8 100644 --- a/projects/binutils/config +++ b/projects/binutils/config @@ -21,3 +21,5 @@ input_files: enable: '[% c("var/windows") %]' - filename: peXXigen.patch enable: '[% c("var/windows") %]' + - filename: binutils-224-gold.patch + enable: '[% c("var/linux-x86_64") %]' diff --git a/projects/elfutils/build b/projects/elfutils/build new file mode 100644 index 0000000..8fdd013 --- /dev/null +++ b/projects/elfutils/build @@ -0,0 +1,23 @@ +#!/bin/bash +[% c("var/set_default_env") -%] +distdir=/var/tmp/dist/[% project %] +[% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] + +mkdir -p /var/tmp/dist + +tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/binutils') %] +export PATH="/var/tmp/dist/binutils/bin:$PATH" + +mkdir -p /var/tmp/build +tar -C /var/tmp/build -xf $rootdir/[% c('input_files_by_name/elfutils') %] + +cd /var/tmp/build/[% project %]-[% c("version") %] +./configure --prefix="$distdir" +make -j4 +make install + +cd /var/tmp/dist +[% c('tar', { + tar_src => [ project ], + tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'), + }) %] diff --git a/projects/elfutils/config b/projects/elfutils/config new file mode 100644 index 0000000..2c21cf2 --- /dev/null +++ b/projects/elfutils/config @@ -0,0 +1,22 @@ +# vim: filetype=yaml sw=2 +version: '0.166' +filename: 'elfutils-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' +tag_gpg_id: 1 + +var: + container: + use_container: 1 + arch_deps: + - zlib1g-dev + +input_files: + - project: container-image + - name: elfutils + URL: 'https://sourceware.org/elfutils/ftp/[% c("version") %]/elfutils-[% c("version") %].tar.bz2' + file_gpg_id: 1 + gpg_keyring: elfutils.gpg + sig_ext: sig + - name: '[% c("var/compiler") %]' + project: '[% c("var/compiler") %]' + - project: binutils + name: binutils diff --git a/projects/firefox/build b/projects/firefox/build index f445454..afb11bb 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -27,6 +27,15 @@ mkdir -p /var/tmp/build export PATH="/var/tmp/dist/binutils/bin:$PATH" [% END -%] +[% IF c("var/linux-x86_64") -%] + # XXX: 64bits only for now :(, see #20683. + tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/selfrando') %] + # Selfrando wrapper + export PATH="/var/tmp/dist/selfrando/Tools/TorBrowser/tc-wrapper/:$PATH" + # We need to avoid the shuffling while building as this breaks compilation + export SELFRANDO_skip_shuffle= +[% END -%] + tar -C /var/tmp/build -xf [% project %]-[% c('version') %].tar.gz [% IF c("var/osx") %] diff --git a/projects/firefox/config b/projects/firefox/config index 9c807ad..1cd986f 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -71,6 +71,10 @@ input_files: - project: binutils name: binutils enable: '[% c("var/linux") %]' + - project: selfrando + name: selfrando + # XXX: 64bits only for now :(, see #20683. + enable: '[% c("var/linux-x86_64") %]' - filename: fix-info-plist.py enable: '[% c("var/osx") %]' - URL: https://people.torproject.org/~mikeperry/mirrors/sources/msvcr100.dll diff --git a/projects/selfrando/build b/projects/selfrando/build new file mode 100644 index 0000000..8bbd63e --- /dev/null +++ b/projects/selfrando/build @@ -0,0 +1,25 @@ +#!/bin/bash +[% c("var/set_default_env") -%] +distdir=/var/tmp/dist/[% project %] +[% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] + +mkdir -p /var/tmp/dist + +tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/elfutils') %] +tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/binutils') %] +export PATH="/var/tmp/dist/binutils/bin:$PATH" + +tar -C /var/tmp/dist -xf $rootdir/[% project %]-[% c("version") %].tar.gz + +cd /var/tmp/dist +mv [% project %]-[% c("version") %] [% project %] +cd [% project %] +scons -Q arch=x86_64 LIBELF_PATH="/var/tmp/dist/elfutils" FORCE_INPLACE=1 DEBUG_LEVEL=env WRITE_LAYOUTS=env LOG=console +# Fix the path where we install selfrando +sed -i 's|^SR_PATH=.*|SR_PATH=/var/tmp/dist/selfrando/out/x86_64/bin|' Tools/TorBrowser/tc-wrapper/ld + +cd /var/tmp/dist +[% c('tar', { + tar_src => [ project ], + tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'), + }) %] diff --git a/projects/selfrando/config b/projects/selfrando/config new file mode 100644 index 0000000..8b73080 --- /dev/null +++ b/projects/selfrando/config @@ -0,0 +1,23 @@ +# vim: filetype=yaml sw=2 +filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' +version: 0.2 +git_hash: 'tb-v[% c("version") %]' +git_url: https://github.com/immunant/selfrando.git +gpg_keyring: selfrando.gpg +tag_gpg_id: 1 + +var: + container: + use_container: 1 + arch_deps: + - scons + - zlib1g-dev + +input_files: + - project: container-image + - name: binutils + project: binutils + - name: elfutils + project: elfutils + - name: '[% c("var/compiler") %]' + project: '[% c("var/compiler") %]' diff --git a/projects/tor-browser/RelativeLink/start-tor-browser b/projects/tor-browser/RelativeLink/start-tor-browser index a78b367..2dd40fc 100755 --- a/projects/tor-browser/RelativeLink/start-tor-browser +++ b/projects/tor-browser/RelativeLink/start-tor-browser @@ -270,6 +270,7 @@ fi LD_LIBRARY_PATH="${HOME}/TorBrowser/Tor/" export LD_LIBRARY_PATH +export SELFRANDO_write_layout_file= function setControlPortPasswd() { local ctrlPasswd=$1

1 0

[tor-browser-bundle/master] Bumping versions of nightly components
by gk＠torproject.org 17 May '17

17 May '17

commit 3a18baaa14b4ce1837b7e71d7d623b546789db9f Author: Georg Koppen <gk(a)torproject.org> Date: Wed May 17 19:14:14 2017 +0000 Bumping versions of nightly components --- gitian/versions.nightly | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 2189139..c3a6545 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -13,11 +13,11 @@ DATA_OUTSIDE_APP_DIR=1 VERIFY_TAGS=0 -FIREFOX_VERSION=52.1.0esr +FIREFOX_VERSION=52.1.1esr TORBROWSER_UPDATE_CHANNEL=default -TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.0-2 +TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.0-1 TOR_TAG=master TORLAUNCHER_TAG=master TORBUTTON_TAG=master @@ -57,7 +57,7 @@ GITIAN_TAG=tor-browser-builder-4 OPENSSL_VER=1.0.2k GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION -FIREFOX_LANG_BUILD=build3 +FIREFOX_LANG_BUILD=build1 BINUTILS_VER=2.24 GCC_VER=5.1.0 CLANG_VER=3.8.0 @@ -80,7 +80,7 @@ ELFUTILS_VER=0.166 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 -NOSCRIPT_PACKAGE=noscript_security_suite-5.0.2-fx+sm.xpi +NOSCRIPT_PACKAGE=noscript_security_suite-5.0.4-fx+sm.xpi CCTOOLS_PACKAGE=cctools.tar.gz OSXSDK_PACKAGE=MacOSX10.7.sdk.tar.gz MSVCR100_PACKAGE=msvcr100.dll @@ -116,7 +116,7 @@ ELFUTILS_PACKAGE=elfutils-${ELFUTILS_VER}.tar.bz2 OPENSSL_HASH=6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf -NOSCRIPT_HASH=31ba7743699deefb606bcc49197d26d926f6b4e3d3526cd2f8a339f857a04fb1 +NOSCRIPT_HASH=cd8e5561bdd7331d9fdd510fb1bd1cb6460d64f351076b523d31361ff9853c76 CCTOOLS_HASH=e908fdebc2886ee5491ebfc7e7950af451b3c4e2439c2d7a923ed06ad05113e4 MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c

1 0

[tor-browser-build/master] Bug 22238: Fix use of hardened wrapper for the Linux build
by boklm＠torproject.org 17 May '17

17 May '17

commit efdf11accdd4c440b867409fb4153b969f58bcd8 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed May 17 18:15:11 2017 +0200 Bug 22238: Fix use of hardened wrapper for the Linux build ESR52 includes this commit: https://hg.mozilla.org/mozilla-central/rev/f8cf0fe7c810 which changes the compiler used from 'c++' to 'g++'. tor-browser-bundle.git commit: 48b68f84b34aef3567aeffe6932ff1e40d900f2b --- projects/gcc/config | 2 ++ 1 file changed, 2 insertions(+) diff --git a/projects/gcc/config b/projects/gcc/config index d740a93..3871455 100644 --- a/projects/gcc/config +++ b/projects/gcc/config @@ -30,8 +30,10 @@ var: cp /usr/bin/hardened-cc ./ mv gcc gcc.real mv c++ c++.real + mv g++ g++.real ln -sf hardened-cc gcc ln -sf hardened-cc c++ + ln -sf hardened-cc g++ popd targets:

1 0

[tor-browser-build/master] Release preparations for 7.0a4
by boklm＠torproject.org 17 May '17

17 May '17

commit 18416a106aa9ba82320758a29436dd1d3b20d6f7 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed May 17 18:01:11 2017 +0200 Release preparations for 7.0a4 tor-browser-bundle.git author: 999a7afe0f50c6d6503d99ff3fab3879cd069a85 tor-browser-bundle.git commit: Georg Koppen <gk(a)torproject.org> --- projects/https-everywhere/config | 2 +- .../tor-browser/Bundle-Data/Docs/ChangeLog.txt | 43 ++++++++++++++++++++++ projects/tor-browser/config | 4 +- projects/tor-launcher/config | 2 +- projects/tor/config | 2 +- rbm.conf | 2 +- 6 files changed, 49 insertions(+), 6 deletions(-) diff --git a/projects/https-everywhere/config b/projects/https-everywhere/config index f149cac..23c4e1e 100644 --- a/projects/https-everywhere/config +++ b/projects/https-everywhere/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 5.2.14 +version: 5.2.16 git_url: https://git.torproject.org/https-everywhere.git git_hash: '[% c("version") %]' git_submodule: 1 diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 11c178c..9f00100 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,46 @@ +Tor Browser 7.0a4 -- May 15 2017 + * All Platforms + * Update Firefox to 52.1.1esr + * Update Tor to 0.3.0.6 + * Update Tor Launcher to 0.2.12.1 + * Bug 20761: Don't ignore additional SocksPorts + * Translation update + * Update HTTPS-Everywhere to 5.2.16 + * Update NoScript to 5.0.4 + * Bug 21962: Fix crash on about:addons page + * Bug 21778: Canvas prompt is not shown in Tor Browser based on ESR52 + * Bug 21569: Add first-party domain to Permissions key + * Bug 22165: Don't allow collection of local IP addresses + * Bug 13017: Work around audio fingerprinting by disabling the Web Audio API + * Bug 10286: Disable Touch API and add fingerprinting resistance as fallback + * Bug 13612: Disable Social API + * Bug 10283: Disable SpeechSynthesis API + * Bug 21675: Spoof window.navigator.hardwareConcurrency + * Bug 21792: Suppress MediaError.message + * Bug 16337: Round times exposed by Animation API to nearest 100ms + * Bug 21726: Keep Graphite support disabled + * Bug 21685: Disable remote new tab pages + * Bug 21790: Disable captive portal detection + * Bug 21686: Disable Microsoft Family Safety support + * Bug 22073: Make sure Mozilla's experiments are disabled + * Bug 21683: Disable newly added Safebrowsing capabilities + * Bug 22071: Disable Kinto-based blocklist update mechanism + * Bug 22072: Hide TLS error reporting checkbox + * Bug 20761: Don't ignore additional SocksPorts + * Bug 21340: Identify and backport new patches from Firefox + * Bug 22153: Fix broken feeds on higher security levels + * Bug 22025: Fix broken certificate error pages on higher security levels + * Bug 21710: Upgrade Go to 1.8.1 + * Mac + * Bug 21940: Don't allow privilege escalation during update + * Bug 22044: Fix broken default search engine on macOS + * Bug 21879: Use our default bookmarks on OSX + * Bug 21779: Non-admin users can't access Tor Browser on macOS + * Linux + * Bug 22041: Fix update error during update to 7.0a3 + * Bug 22238: Fix use of hardened wrapper for Firefox build + * Bug 20683: Selfrando support for 64-bit Linux systems + Tor Browser 7.0a3 -- April 20 2017 * All Platforms * Update Firefox to 52.1.0esr diff --git a/projects/tor-browser/config b/projects/tor-browser/config index 805d7b6..a2c21ed 100644 --- a/projects/tor-browser/config +++ b/projects/tor-browser/config @@ -54,9 +54,9 @@ input_files: name: snowflake enable: '[% c("var/snowflake") %]' - filename: Bundle-Data - - URL: https://addons.cdn.mozilla.net/user-media/addons/722/noscript_security_suit… + - URL: https://addons.cdn.mozilla.net/user-media/addons/722/noscript_security_suit… name: noscript - sha256sum: 31ba7743699deefb606bcc49197d26d926f6b4e3d3526cd2f8a339f857a04fb1 + sha256sum: cd8e5561bdd7331d9fdd510fb1bd1cb6460d64f351076b523d31361ff9853c76 - filename: RelativeLink enable: '[% c("var/linux") %]' - project: libdmg-hfsplus diff --git a/projects/tor-launcher/config b/projects/tor-launcher/config index 9211844..a164ef3 100644 --- a/projects/tor-launcher/config +++ b/projects/tor-launcher/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 0.2.12 +version: 0.2.12.1 git_url: https://git.torproject.org/tor-launcher.git git_hash: '[% c("version") %]' gpg_keyring: torbutton.gpg diff --git a/projects/tor/config b/projects/tor/config index c2d359c..b92fb4f 100644 --- a/projects/tor/config +++ b/projects/tor/config @@ -1,6 +1,6 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -version: 0.3.0.5-rc +version: 0.3.0.6 git_hash: 'tor-[% c("version") %]' git_url: https://git.torproject.org/tor.git gpg_keyring: tor.gpg diff --git a/rbm.conf b/rbm.conf index ce70215..6a1cc43 100644 --- a/rbm.conf +++ b/rbm.conf @@ -7,7 +7,7 @@ build_log: '[% GET ENV.RBM_LOGS_DIR ? ENV.RBM_LOGS_DIR : "logs" %]/[% project %] pkg_type: build var: - torbrowser_version: '7.0a3' + torbrowser_version: '7.0a4' project_name: tor-browser multi_lingual: 0 build_mar: 1

1 0

[tor-browser-build/master] Changelog fixup
by boklm＠torproject.org 17 May '17

17 May '17

commit e457c3fc6fe94a5b0e624ac400a32f374b654342 Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 21:37:03 2017 +0000 Changelog fixup We actually released sandboxed-tor-browser 0.0.6 with 7.0a3 due to a last minute fix. --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index afe3999..11c178c 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -18,7 +18,7 @@ Tor Browser 7.0a3 -- April 20 2017 * Translations update * Update HTTPS-Everywhere to 5.2.14 * Update NoScript to 5.0.2 - * Update sandboxed-tor-browser to 0.0.5 + * Update sandboxed-tor-browser to 0.0.6 * Bug 21764: Use bubblewrap's `--die-with-parent` when supported * Fix e10s Web Content crash on systems with grsec kernels * Bug 21928: Force a reinstall if an existing hardened bundle is present @@ -26,6 +26,7 @@ Tor Browser 7.0a3 -- April 20 2017 * Bug 21927: Remove the ability to install/update the hardened bundle * Bug 21244: Update the MAR signing key for 7.0 * Bug 21536: Remove asn's scramblesuit bridge from Tor Browser + * Add back the old release MAR signing key * Add `prlimit64` to the firefox system call whitelist * Fix compilation with Go 1.8 * Use Config.Clone() to clone TLS configs when available

1 0

[tor-browser-build/master] Update firefox-langpacks build
by boklm＠torproject.org 15 May '17

15 May '17

commit abc84a40419c8d8a37d0ac1db63a860fdcc39997 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon May 15 16:51:11 2017 +0200 Update firefox-langpacks build --- projects/firefox-langpacks/config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/firefox-langpacks/config b/projects/firefox-langpacks/config index 39f04cb..a645b92 100644 --- a/projects/firefox-langpacks/config +++ b/projects/firefox-langpacks/config @@ -4,7 +4,7 @@ filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/buil var: ff_version: '[% pc("firefox", "var/firefox_version") %]' - ff_build: build3 + ff_build: build1 ff_arch: linux-i686 input_filename: 'dl-langpack-[% c("var/ff_arch") %]-[% c("version") %]'

1 0

[tor-browser-bundle/master] Add a timestamp to the log file after each invokation of make(1).
by gk＠torproject.org 15 May '17

15 May '17

commit 6a2238b2a607687b501b51a12803e0337d710d7b Author: Linus Nordberg <linus(a)torproject.org> Date: Mon May 15 16:21:50 2017 +0200 Add a timestamp to the log file after each invokation of make(1). This makes it easier to track build times. --- tools/continuous-builds/build-tbb.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/continuous-builds/build-tbb.sh b/tools/continuous-builds/build-tbb.sh index 1c1118d..1075b9c 100755 --- a/tools/continuous-builds/build-tbb.sh +++ b/tools/continuous-builds/build-tbb.sh @@ -53,6 +53,7 @@ while [ $status != done ]; do killall qemu-system-i386 qemu-system-x86_64 make $MAKE_TARGET > build-logs/build-$(date -u +%s).log && status=done printf "%s: Tried building $MAKE_TARGET %d times. Status: %s.\n" $0 $n $status | tee -a $logfile + date -u | tee -a $logfile MAKE_TARGET=build-$TARGET [ $n -ge $N ] && break done

1 0

[tor-browser-build/master] Pick up new tor-browser tag
by boklm＠torproject.org 15 May '17

15 May '17

commit 5084700b66e5c2420554cbfea9e11995b4be5ec5 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon May 15 02:03:23 2017 +0200 Pick up new tor-browser tag --- projects/firefox/config | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/projects/firefox/config b/projects/firefox/config index f5c765f..9c807ad 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -1,13 +1,13 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' filename: 'firefox-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-2-build1' +git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build2' tag_gpg_id: 1 git_url: https://git.torproject.org/tor-browser.git gpg_keyring: torbutton.gpg var: - firefox_version: 52.1.0esr + firefox_version: 52.1.1esr torbrowser_branch: 7.0 torbrowser_update_channel: alpha copyright_year: '[% exec("git show -s --format=%ci").remove("-.*") %]'

1 0

[tor-browser-bundle/master] Pick up new tor-browser tag
by gk＠torproject.org 14 May '17

14 May '17

commit 78ddfcbe48e0d08eab7019072ebae938da91c1a4 Author: Georg Koppen <gk(a)torproject.org> Date: Sun May 14 20:15:05 2017 +0000 Pick up new tor-browser tag --- gitian/versions.alpha | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gitian/versions.alpha b/gitian/versions.alpha index cdce2e8..99bc2d7 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -14,7 +14,7 @@ FIREFOX_VERSION=52.1.1esr TORBROWSER_UPDATE_CHANNEL=alpha -TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.0-1-build1 +TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.0-1-build2 TOR_TAG=tor-0.3.0.6 TORLAUNCHER_TAG=0.2.12.1 TORBUTTON_TAG=1.9.7.2

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 14 May '17

14 May '17

commit 0d5ad00985cbeb4c1f06e328145a7863fd706851 Author: Georg Koppen <gk(a)torproject.org> Date: Sun May 14 19:50:41 2017 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. This fixes bug 22254: `pref()` does not like a `;` between pref name and value. --- browser/app/profile/000-tor-browser.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 33e8f99..fb7b078 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -258,7 +258,7 @@ pref("mathml.disabled", false); pref("javascript.options.asmjs", false); // Mozilla keeps still finding critical bugs in Graphite code. Disable it for // now, see bug 21726. -pref("gfx.font_rendering.graphite.enabled"; false); +pref("gfx.font_rendering.graphite.enabled", false); // Network and performance pref("network.http.pipelining", true);

1 0

[tor-browser/tor-browser-52.1.1esr-7.0-1] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 14 May '17

14 May '17

commit 7bbd69956bd1a30051599a1dd4bf615bc40e55e8 Author: Georg Koppen <gk(a)torproject.org> Date: Sun May 14 19:50:41 2017 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. This fixes bug 22254: `pref()` does not like a `;` between pref name and value. --- browser/app/profile/000-tor-browser.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 33e8f99..fb7b078 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -258,7 +258,7 @@ pref("mathml.disabled", false); pref("javascript.options.asmjs", false); // Mozilla keeps still finding critical bugs in Graphite code. Disable it for // now, see bug 21726. -pref("gfx.font_rendering.graphite.enabled"; false); +pref("gfx.font_rendering.graphite.enabled", false); // Network and performance pref("network.http.pipelining", true);

1 0

[tor-browser-bundle/master] Release preparations for 7.0a4
by gk＠torproject.org 13 May '17

13 May '17

commit 999a7afe0f50c6d6503d99ff3fab3879cd069a85 Author: Georg Koppen <gk(a)torproject.org> Date: Sat May 13 07:36:24 2017 +0000 Release preparations for 7.0a4 Version bumps, Changelog update, and update of config.yml --- Bundle-Data/Docs/ChangeLog.txt | 43 +++++++++++++++++++++++++++++++++++++++ gitian/versions.alpha | 16 +++++++-------- tools/update-responses/config.yml | 10 ++++----- 3 files changed, 56 insertions(+), 13 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 11c178c..9f00100 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,46 @@ +Tor Browser 7.0a4 -- May 15 2017 + * All Platforms + * Update Firefox to 52.1.1esr + * Update Tor to 0.3.0.6 + * Update Tor Launcher to 0.2.12.1 + * Bug 20761: Don't ignore additional SocksPorts + * Translation update + * Update HTTPS-Everywhere to 5.2.16 + * Update NoScript to 5.0.4 + * Bug 21962: Fix crash on about:addons page + * Bug 21778: Canvas prompt is not shown in Tor Browser based on ESR52 + * Bug 21569: Add first-party domain to Permissions key + * Bug 22165: Don't allow collection of local IP addresses + * Bug 13017: Work around audio fingerprinting by disabling the Web Audio API + * Bug 10286: Disable Touch API and add fingerprinting resistance as fallback + * Bug 13612: Disable Social API + * Bug 10283: Disable SpeechSynthesis API + * Bug 21675: Spoof window.navigator.hardwareConcurrency + * Bug 21792: Suppress MediaError.message + * Bug 16337: Round times exposed by Animation API to nearest 100ms + * Bug 21726: Keep Graphite support disabled + * Bug 21685: Disable remote new tab pages + * Bug 21790: Disable captive portal detection + * Bug 21686: Disable Microsoft Family Safety support + * Bug 22073: Make sure Mozilla's experiments are disabled + * Bug 21683: Disable newly added Safebrowsing capabilities + * Bug 22071: Disable Kinto-based blocklist update mechanism + * Bug 22072: Hide TLS error reporting checkbox + * Bug 20761: Don't ignore additional SocksPorts + * Bug 21340: Identify and backport new patches from Firefox + * Bug 22153: Fix broken feeds on higher security levels + * Bug 22025: Fix broken certificate error pages on higher security levels + * Bug 21710: Upgrade Go to 1.8.1 + * Mac + * Bug 21940: Don't allow privilege escalation during update + * Bug 22044: Fix broken default search engine on macOS + * Bug 21879: Use our default bookmarks on OSX + * Bug 21779: Non-admin users can't access Tor Browser on macOS + * Linux + * Bug 22041: Fix update error during update to 7.0a3 + * Bug 22238: Fix use of hardened wrapper for Firefox build + * Bug 20683: Selfrando support for 64-bit Linux systems + Tor Browser 7.0a3 -- April 20 2017 * All Platforms * Update Firefox to 52.1.0esr diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 2179f8d..cdce2e8 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -10,15 +10,15 @@ DATA_OUTSIDE_APP_DIR=1 VERIFY_TAGS=1 -FIREFOX_VERSION=52.1.0esr +FIREFOX_VERSION=52.1.1esr TORBROWSER_UPDATE_CHANNEL=alpha -TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.0-2-build1 -TOR_TAG=tor-0.3.0.5-rc -TORLAUNCHER_TAG=0.2.12 +TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.0-1-build1 +TOR_TAG=tor-0.3.0.6 +TORLAUNCHER_TAG=0.2.12.1 TORBUTTON_TAG=1.9.7.2 -HTTPSE_TAG=5.2.14 +HTTPSE_TAG=5.2.16 NSIS_TAG=v0.3.1 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.22-stable @@ -54,7 +54,7 @@ GITIAN_TAG=tor-browser-builder-4-4 OPENSSL_VER=1.0.2k GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION -FIREFOX_LANG_BUILD=build3 +FIREFOX_LANG_BUILD=build1 BINUTILS_VER=2.24 GCC_VER=5.1.0 CLANG_VER=3.8.0 @@ -77,7 +77,7 @@ ELFUTILS_VER=0.166 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 -NOSCRIPT_PACKAGE=noscript_security_suite-5.0.2-fx+sm.xpi +NOSCRIPT_PACKAGE=noscript_security_suite-5.0.4-fx+sm.xpi CCTOOLS_PACKAGE=cctools.tar.gz OSXSDK_PACKAGE=MacOSX10.7.sdk.tar.gz MSVCR100_PACKAGE=msvcr100.dll @@ -113,7 +113,7 @@ ELFUTILS_PACKAGE=elfutils-${ELFUTILS_VER}.tar.bz2 OPENSSL_HASH=6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf -NOSCRIPT_HASH=31ba7743699deefb606bcc49197d26d926f6b4e3d3526cd2f8a339f857a04fb1 +NOSCRIPT_HASH=cd8e5561bdd7331d9fdd510fb1bd1cb6460d64f351076b523d31361ff9853c76 CCTOOLS_HASH=e908fdebc2886ee5491ebfc7e7950af451b3c4e2439c2d7a923ed06ad05113e4 MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index 78f3a2c..6a9a142 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -19,7 +19,7 @@ build_targets: osx32: Darwin_x86-gcc3 osx64: Darwin_x86_64-gcc3 channels: - alpha: 7.0a3 + alpha: 7.0a4 release: 6.0.1 versions: 6.0.1: @@ -33,11 +33,11 @@ versions: osx32: minSupportedOSVersion: 10.8 detailsURL: https://blog.torproject.org/blog/end-life-plan-tor-browser-32-bit-macs#upda… - 7.0a3: - platformVersion: 52.1.0 - detailsURL: https://blog.torproject.org/blog/tor-browser-70a3-released + 7.0a4: + platformVersion: 52.1.1 + detailsURL: https://blog.torproject.org/blog/tor-browser-70a4-released incremental_from: - - 7.0a2 + - 7.0a3 migrate_archs: osx32: osx64 migrate_langs:

1 0

[tor-browser-bundle/master] Changelog fixup
by gk＠torproject.org 12 May '17

12 May '17

commit 2c11fc5ae73266dab8e6c8de68740c809b6675c1 Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 21:37:03 2017 +0000 Changelog fixup We actually released sandboxed-tor-browser 0.0.6 with 7.0a3 due to a last minute fix. --- Bundle-Data/Docs/ChangeLog.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index afe3999..11c178c 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -18,7 +18,7 @@ Tor Browser 7.0a3 -- April 20 2017 * Translations update * Update HTTPS-Everywhere to 5.2.14 * Update NoScript to 5.0.2 - * Update sandboxed-tor-browser to 0.0.5 + * Update sandboxed-tor-browser to 0.0.6 * Bug 21764: Use bubblewrap's `--die-with-parent` when supported * Fix e10s Web Content crash on systems with grsec kernels * Bug 21928: Force a reinstall if an existing hardened bundle is present @@ -26,6 +26,7 @@ Tor Browser 7.0a3 -- April 20 2017 * Bug 21927: Remove the ability to install/update the hardened bundle * Bug 21244: Update the MAR signing key for 7.0 * Bug 21536: Remove asn's scramblesuit bridge from Tor Browser + * Add back the old release MAR signing key * Add `prlimit64` to the firefox system call whitelist * Fix compilation with Go 1.8 * Use Config.Clone() to clone TLS configs when available

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! Bug #4234: Use the Firefox Update Process for Tor Browser.
by gk＠torproject.org 12 May '17

12 May '17

commit d5211d99de2f37fc3e21329fd32fe80bcc663d37 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Thu May 11 15:37:54 2017 -0400 fixup! Bug #4234: Use the Firefox Update Process for Tor Browser. Disable the updater's OSX privilege elevation feature. If the user does not have write permission to the .app directory, they will be prompted to download a new copy of the browser. Fixes bug 21940. As defense-in-depth measures, we also removed the code that is used by Firefox to launch an OSX process with administrator privileges as well as the extra copy of the updater executable that was located under TorBrowser.app/Contents/Library/LaunchServices/. --- browser/app/Makefile.in | 3 +++ browser/installer/package-manifest.in | 2 ++ toolkit/mozapps/update/nsUpdateService.js | 10 ++++++++++ toolkit/mozapps/update/updater/launchchild_osx.mm | 2 ++ toolkit/mozapps/update/updater/updater.cpp | 10 ++++++++++ toolkit/xre/MacLaunchHelper.h | 2 ++ toolkit/xre/MacLaunchHelper.mm | 2 ++ toolkit/xre/nsUpdateDriver.cpp | 4 ++++ 8 files changed, 35 insertions(+) diff --git a/browser/app/Makefile.in b/browser/app/Makefile.in index 1fe7676..1fbdc1e 100644 --- a/browser/app/Makefile.in +++ b/browser/app/Makefile.in @@ -86,9 +86,12 @@ tools repackage:: $(DIST)/bin/$(MOZ_APP_NAME) $(RM) $(dist_dest)/Contents/MacOS/$(MOZ_APP_NAME) rsync -aL $(DIST)/bin/$(MOZ_APP_NAME) $(dist_dest)/Contents/MacOS cp -RL $(DIST)/branding/firefox.icns $(dist_dest)/Contents/Resources/firefox.icns + cp -RL $(DIST)/branding/document.icns $(dist_dest)/Contents/Resources/document.icns +ifndef TOR_BROWSER_UPDATE $(MKDIR) -p $(dist_dest)/Contents/Library/LaunchServices mv -f $(dist_dest)/Contents/MacOS/updater.app/Contents/MacOS/org.mozilla.updater $(dist_dest)/Contents/Library/LaunchServices ln -s ../../../../Library/LaunchServices/org.mozilla.updater $(dist_dest)/Contents/MacOS/updater.app/Contents/MacOS/org.mozilla.updater +endif printf APPLTORB > $(dist_dest)/Contents/PkgInfo endif diff --git a/browser/installer/package-manifest.in b/browser/installer/package-manifest.in index 8192f93..43c89a9 100644 --- a/browser/installer/package-manifest.in +++ b/browser/installer/package-manifest.in @@ -35,7 +35,9 @@ #ifdef XP_MACOSX ; Mac bundle stuff @APPNAME@/Contents/Info.plist +#ifndef TOR_BROWSER_UPDATE @APPNAME@/Contents/Library/LaunchServices +#endif @APPNAME@/Contents/PkgInfo @RESPATH@/firefox.icns @RESPATH@/document.icns diff --git a/toolkit/mozapps/update/nsUpdateService.js b/toolkit/mozapps/update/nsUpdateService.js index 8abc55a..59c36e8 100644 --- a/toolkit/mozapps/update/nsUpdateService.js +++ b/toolkit/mozapps/update/nsUpdateService.js @@ -378,6 +378,11 @@ function areDirectoryEntriesWriteable(aDir) { * @return true if elevation is required, false otherwise */ function getElevationRequired() { +#if defined(TOR_BROWSER_UPDATE) + // To avoid potential security holes associated with running the updater + // process with elevated privileges, Tor Browser does not support elevation. + return false; +#else if (AppConstants.platform != "macosx") { return false; } @@ -401,6 +406,7 @@ function getElevationRequired() { LOG("getElevationRequired - able to write to application bundle, elevation " + "not required"); return false; +#endif } /** @@ -1203,6 +1209,9 @@ function handleUpdateFailure(update, errorCode) { cancelations++; Services.prefs.setIntPref(PREF_APP_UPDATE_CANCELATIONS, cancelations); if (AppConstants.platform == "macosx") { +#if defined(TOR_BROWSER_UPDATE) + cleanupActiveUpdate(); +#else let osxCancelations = getPref("getIntPref", PREF_APP_UPDATE_CANCELATIONS_OSX, 0); osxCancelations++; @@ -1219,6 +1228,7 @@ function handleUpdateFailure(update, errorCode) { writeStatusFile(getUpdatesDir(), update.state = STATE_PENDING_ELEVATE); } +#endif update.statusText = gUpdateBundle.GetStringFromName("elevationFailure"); update.QueryInterface(Ci.nsIWritablePropertyBag); update.setProperty("patchingFailed", "elevationFailure"); diff --git a/toolkit/mozapps/update/updater/launchchild_osx.mm b/toolkit/mozapps/update/updater/launchchild_osx.mm index 97e31b9..749cb1f 100644 --- a/toolkit/mozapps/update/updater/launchchild_osx.mm +++ b/toolkit/mozapps/update/updater/launchchild_osx.mm @@ -284,6 +284,7 @@ bool ObtainUpdaterArguments(int* argc, char*** argv) @end +#ifndef TOR_BROWSER_UPDATE bool ServeElevatedUpdate(int argc, const char** argv) { MacAutoreleasePool pool; @@ -300,6 +301,7 @@ bool ServeElevatedUpdate(int argc, const char** argv) [updater release]; return didSucceed; } +#endif bool IsOwnedByGroupAdmin(const char* aAppBundle) { diff --git a/toolkit/mozapps/update/updater/updater.cpp b/toolkit/mozapps/update/updater/updater.cpp index 1bc4867..bf4a4bb 100644 --- a/toolkit/mozapps/update/updater/updater.cpp +++ b/toolkit/mozapps/update/updater/updater.cpp @@ -83,7 +83,9 @@ bool IsRecursivelyWritable(const char* aPath); void LaunchChild(int argc, const char** argv); void LaunchMacPostProcess(const char* aAppBundle); bool ObtainUpdaterArguments(int* argc, char*** argv); +#ifndef TOR_BROWSER_UPDATE bool ServeElevatedUpdate(int argc, const char** argv); +#endif void SetGroupOwnershipAndPermissions(const char* aAppBundle); struct UpdateServerThreadArgs { @@ -2913,11 +2915,15 @@ UpdateThreadFunc(void *param) static void ServeElevatedUpdateThreadFunc(void* param) { +#ifdef TOR_BROWSER_UPDATE + WriteStatusFile(ELEVATION_CANCELED); +#else UpdateServerThreadArgs* threadArgs = (UpdateServerThreadArgs*)param; gSucceeded = ServeElevatedUpdate(threadArgs->argc, threadArgs->argv); if (!gSucceeded) { WriteStatusFile(ELEVATION_CANCELED); } +#endif QuitProgressUI(); } @@ -2986,7 +2992,11 @@ int NS_main(int argc, NS_tchar **argv) #ifdef XP_MACOSX bool isElevated = +#ifdef TOR_BROWSER_UPDATE + false; +#else strstr(argv[0], "/Library/PrivilegedHelperTools/org.mozilla.updater") != 0; +#endif if (isElevated) { if (!ObtainUpdaterArguments(&argc, &argv)) { // Won't actually get here because ObtainUpdaterArguments will terminate diff --git a/toolkit/xre/MacLaunchHelper.h b/toolkit/xre/MacLaunchHelper.h index 08035c5..46e1570 100644 --- a/toolkit/xre/MacLaunchHelper.h +++ b/toolkit/xre/MacLaunchHelper.h @@ -17,7 +17,9 @@ extern "C" { * pid of the terminated process to confirm that it executed successfully. */ void LaunchChildMac(int aArgc, char** aArgv, pid_t* aPid = 0); +#ifndef TOR_BROWSER_UPDATE bool LaunchElevatedUpdate(int aArgc, char** aArgv, pid_t* aPid = 0); +#endif } #endif diff --git a/toolkit/xre/MacLaunchHelper.mm b/toolkit/xre/MacLaunchHelper.mm index 0dadb8d..84e28a4 100644 --- a/toolkit/xre/MacLaunchHelper.mm +++ b/toolkit/xre/MacLaunchHelper.mm @@ -43,6 +43,7 @@ void LaunchChildMac(int aArgc, char** aArgv, pid_t* aPid) } } +#ifndef TOR_BROWSER_UPDATE BOOL InstallPrivilegedHelper() { AuthorizationRef authRef = NULL; @@ -135,3 +136,4 @@ bool LaunchElevatedUpdate(int aArgc, char** aArgv, pid_t* aPid) } return didSucceed; } +#endif diff --git a/toolkit/xre/nsUpdateDriver.cpp b/toolkit/xre/nsUpdateDriver.cpp index 3abbf7f..b87c84e 100644 --- a/toolkit/xre/nsUpdateDriver.cpp +++ b/toolkit/xre/nsUpdateDriver.cpp @@ -1114,6 +1114,7 @@ ApplyUpdate(nsIFile *greDir, nsIFile *updateDir, nsIFile *statusFile, #ifdef DEBUG dump_argv("ApplyUpdate after SetupMacCommandLine", argv, argc); #endif +#ifndef TOR_BROWSER_UPDATE // We need to detect whether elevation is required for this update. This can // occur when an admin user installs the application, but another admin // user attempts to update (see bug 394984). @@ -1124,12 +1125,15 @@ ApplyUpdate(nsIFile *greDir, nsIFile *updateDir, nsIFile *statusFile, } exit(0); } else { +#endif if (restart) { LaunchChildMac(argc, argv); exit(0); } LaunchChildMac(argc, argv, outpid); +#ifndef TOR_BROWSER_UPDATE } +#endif #else *outpid = PR_CreateProcess(updaterPath.get(), argv, nullptr, nullptr); if (restart) {

1 0

[tor-launcher/master] Release preparations for 0.2.12.1
by gk＠torproject.org 12 May '17

12 May '17

commit 7bf517510843337823373fe53c2b7a9ebcd7f1e0 Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 19:12:46 2017 +0000 Release preparations for 0.2.12.1 Version bump --- src/install.rdf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/install.rdf b/src/install.rdf index ae89a4c..c0a6e20 100644 --- a/src/install.rdf +++ b/src/install.rdf @@ -7,7 +7,7 @@ <em:creator>The Tor Project, Inc.</em:creator> <em:contributor>Pearl Crescent, LLC</em:contributor> <em:id>tor-launcher(a)torproject.org</em:id> - <em:version>0.2.12</em:version> + <em:version>0.2.12.1</em:version> <em:multiprocessCompatible>true</em:multiprocessCompatible> <em:homepageURL>https://www.torproject.org/projects/torbrowser.html</em:homepageURL> <em:updateURL>data:text/plain,</em:updateURL>

1 0

[tor-launcher/master] Translation update
by gk＠torproject.org 12 May '17

12 May '17

commit f8edca4204b8d99508d660b64ef9af7270231f42 Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 19:09:22 2017 +0000 Translation update --- src/chrome/locale/sv/network-settings.dtd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/chrome/locale/sv/network-settings.dtd b/src/chrome/locale/sv/network-settings.dtd index 5975310..0648ead 100644 --- a/src/chrome/locale/sv/network-settings.dtd +++ b/src/chrome/locale/sv/network-settings.dtd @@ -2,7 +2,7 @@  <!ENTITY torlauncher.localePicker.title "Språk i Tor-webbläsare"> -<!ENTITY torlauncher.localePicker.prompt "Vänligen välj ett språk."> +<!ENTITY torlauncher.localePicker.prompt "Välj ett språk.">

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 12 May '17

12 May '17

commit e6b28367e061f9b6912c3b150383255bdff0ef5c Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 18:51:56 2017 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. We disable the newly added safebrowsing capabilities, see bug 21683. --- browser/app/profile/000-tor-browser.js | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 05899cc..33e8f99 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -71,6 +71,17 @@ pref("geo.wifi.uri", ""); pref("browser.search.suggest.enabled", false); pref("browser.safebrowsing.enabled", false); pref("browser.safebrowsing.malware.enabled", false); +pref("browser.safebrowsing.phishing.enabled", false); +pref("browser.safebrowsing.downloads.enabled", false); +pref("browser.safebrowsing.downloads.remote.enabled", false); +pref("browser.safebrowsing.blockedURIs.enabled", false); +pref("browser.safebrowsing.downloads.remote.url", ""); +pref("browser.safebrowsing.provider.google.updateURL", ""); +pref("browser.safebrowsing.provider.google.gethashURL", ""); +pref("browser.safebrowsing.provider.google4.updateURL", ""); +pref("browser.safebrowsing.provider.google4.gethashURL", ""); +pref("browser.safebrowsing.provider.mozilla.updateURL", ""); +pref("browser.safebrowsing.provider.mozilla.gethashURL", ""); pref("browser.download.manager.scanWhenDone", false); // prevents AV remote reporting of downloads pref("extensions.ui.lastCategory", "addons://list/extension"); pref("datareporting.healthreport.service.enabled", false); // Yes, all three of these must be set

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] Revert "fixup! TB3: Tor Browser's official .mozconfigs."
by gk＠torproject.org 12 May '17

12 May '17

commit c474e8a83bff73cff6a26aac945e110bc44846a0 Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 17:55:31 2017 +0000 Revert "fixup! TB3: Tor Browser's official .mozconfigs." This reverts commit b51157dc9a520a693c2fb27ab3213e3bdf1cb5f1. --- .mozconfig | 1 - .mozconfig-asan | 1 - 2 files changed, 2 deletions(-) diff --git a/.mozconfig b/.mozconfig index 4398849..cde5b49 100755 --- a/.mozconfig +++ b/.mozconfig @@ -27,4 +27,3 @@ ac_add_options --disable-webrtc ac_add_options --disable-eme #ac_add_options --disable-ctypes ac_add_options --enable-jemalloc=4 -ac_add_options --enable-pie diff --git a/.mozconfig-asan b/.mozconfig-asan index 87e5008..096bcc6 100644 --- a/.mozconfig-asan +++ b/.mozconfig-asan @@ -41,4 +41,3 @@ ac_add_options --disable-crashreporter ac_add_options --disable-webrtc #ac_add_options --disable-ctypes ac_add_options --disable-eme -ac_add_options --enable-pie

1 0

[tor-browser-bundle/master] Bug 22238: Fix use of hardened wrapper for the Linux build
by gk＠torproject.org 12 May '17

12 May '17

commit 48b68f84b34aef3567aeffe6932ff1e40d900f2b Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri May 12 18:14:24 2017 +0200 Bug 22238: Fix use of hardened wrapper for the Linux build ESR52 includes this commit: https://hg.mozilla.org/mozilla-central/rev/f8cf0fe7c810 which changes the compiler used from 'c++' to 'g++'. --- gitian/descriptors/linux/gitian-firefox.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index db4f232..a3bc37f 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -79,8 +79,10 @@ script: | cp /usr/bin/hardened-cc ./ mv gcc gcc.real mv c++ c++.real + mv g++ g++.real ln -sf hardened-cc gcc ln -sf hardened-cc c++ + ln -sf hardened-cc g++ cd ~/build export PATH=$INSTDIR/gcc/bin:$INSTDIR/binutils/bin:$PATH ARCH=""

1 0

[tor-browser-build/master] Bug 22153: Fix broken feeds on higher security levels
by boklm＠torproject.org 12 May '17

12 May '17

commit 6a5f359bd20050f5af00551488eb0933731ce651 Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 14:21:04 2017 +0000 Bug 22153: Fix broken feeds on higher security levels We need to allow JavaScript on feed pages explicitly. Otherwise are those pages broken on higher security levels. --- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/projects/tor-browser/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js b/projects/tor-browser/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js index 2ad9731..53c1a25 100644 --- a/projects/tor-browser/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/projects/tor-browser/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false); diff --git a/projects/tor-browser/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js b/projects/tor-browser/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js index 2ad9731..53c1a25 100644 --- a/projects/tor-browser/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/projects/tor-browser/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false); diff --git a/projects/tor-browser/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js b/projects/tor-browser/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js index 2ad9731..53c1a25 100644 --- a/projects/tor-browser/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/projects/tor-browser/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false);

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 12 May '17

12 May '17

commit 9b5324a8bb68e1e8e10d113e087db24aee712fe4 Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 12:49:08 2017 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. Mozilla still finds critical bugs in Graphite, let#s keep it disabled for now. Fixes bug 21726. --- browser/app/profile/000-tor-browser.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 9483702..05899cc 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -245,6 +245,9 @@ pref("mathml.disabled", false); // Until we address at least the linkability concerns in #19417 let's disable // asmjs. pref("javascript.options.asmjs", false); +// Mozilla keeps still finding critical bugs in Graphite code. Disable it for +// now, see bug 21726. +pref("gfx.font_rendering.graphite.enabled"; false); // Network and performance pref("network.http.pipelining", true);

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] Bug 22165: Block DoListAddresses when resisting fingerprinting
by gk＠torproject.org 12 May '17

12 May '17

commit 2c50abdbdd215f7a84211ce70d8c75a0a6f97187 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Thu May 11 13:58:24 2017 -0700 Bug 22165: Block DoListAddresses when resisting fingerprinting --- netwerk/base/NetworkInfoServiceCocoa.cpp | 6 ++++++ netwerk/base/NetworkInfoServiceLinux.cpp | 6 ++++++ netwerk/base/NetworkInfoServiceWindows.cpp | 6 ++++++ 3 files changed, 18 insertions(+) diff --git a/netwerk/base/NetworkInfoServiceCocoa.cpp b/netwerk/base/NetworkInfoServiceCocoa.cpp index 937c726..c2d8e2c 100644 --- a/netwerk/base/NetworkInfoServiceCocoa.cpp +++ b/netwerk/base/NetworkInfoServiceCocoa.cpp @@ -17,6 +17,8 @@ #include "NetworkInfoServiceImpl.h" +#include "nsContentUtils.h" + namespace mozilla { namespace net { @@ -26,6 +28,10 @@ ListInterfaceAddresses(int aFd, const char* aIface, AddrMapType& aAddrMap); nsresult DoListAddresses(AddrMapType& aAddrMap) { + if (nsContentUtils::ShouldResistFingerprinting()) { + return NS_ERROR_FAILURE; + } + int fd = socket(AF_INET, SOCK_DGRAM, 0); if (fd < 0) { return NS_ERROR_FAILURE; diff --git a/netwerk/base/NetworkInfoServiceLinux.cpp b/netwerk/base/NetworkInfoServiceLinux.cpp index 96627cf..6f72e9c 100644 --- a/netwerk/base/NetworkInfoServiceLinux.cpp +++ b/netwerk/base/NetworkInfoServiceLinux.cpp @@ -17,6 +17,8 @@ #include "NetworkInfoServiceImpl.h" +#include "nsContentUtils.h" + namespace mozilla { namespace net { @@ -26,6 +28,10 @@ ListInterfaceAddresses(int aFd, const char* aIface, AddrMapType& aAddrMap); nsresult DoListAddresses(AddrMapType& aAddrMap) { + if (nsContentUtils::ShouldResistFingerprinting()) { + return NS_ERROR_FAILURE; + } + int fd = socket(AF_INET, SOCK_DGRAM, 0); if (fd < 0) { return NS_ERROR_FAILURE; diff --git a/netwerk/base/NetworkInfoServiceWindows.cpp b/netwerk/base/NetworkInfoServiceWindows.cpp index 2a9448e..9e01d81 100644 --- a/netwerk/base/NetworkInfoServiceWindows.cpp +++ b/netwerk/base/NetworkInfoServiceWindows.cpp @@ -12,12 +12,18 @@ #include "NetworkInfoServiceImpl.h" +#include "nsContentUtils.h" + namespace mozilla { namespace net { nsresult DoListAddresses(AddrMapType& aAddrMap) { + if (nsContentUtils::ShouldResistFingerprinting()) { + return NS_ERROR_FAILURE; + } + UniquePtr<MIB_IPADDRTABLE> ipAddrTable; DWORD size = sizeof(MIB_IPADDRTABLE);

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 12 May '17

12 May '17

commit 38e1a1966adbbcb5a15edbf300f33f5de8d7aae6 Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 15:11:46 2017 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. The old blocklist update system is still running. Thus, no need to contact the new, on Kinto based system in addition. Fixes bug 22071. --- browser/app/profile/000-tor-browser.js | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 73cb896..9483702 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -29,6 +29,10 @@ pref("extensions.hotfix.id", ""); // Bug 16837: Disable hotfix updates as they m pref("app.update.staging.enabled", false); #endif +// No need to contact the Kinto-based blocklist system in addition to the old +// one which is still used, see bug 22071. +pref("services.blocklist.update_enabled", false); + // Disable "Slow startup" warnings and associated disk history // (bug #13346) pref("browser.slowStartup.notificationDisabled", true);

1 0

[tor-browser-bundle/master] Bug 22153: Fix broken feeds on higher security levels
by gk＠torproject.org 12 May '17

12 May '17

commit f367c1dca399a1b15e3da8e098c1de2d7fd36c72 Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 14:21:04 2017 +0000 Bug 22153: Fix broken feeds on higher security levels We need to allow JavaScript on feed pages explicitly. Otherwise are those pages broken on higher security levels. --- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js index 2ad9731..53c1a25 100644 --- a/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false); diff --git a/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js index 2ad9731..53c1a25 100644 --- a/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false); diff --git a/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js index 2ad9731..53c1a25 100644 --- a/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false);

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 12 May '17

12 May '17

commit 7406c8357ef42e8ec3fa19dc2bb20e0b9f8f3025 Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 10:23:09 2017 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. We disable the Microsoft's Family Safety for MitM concerns, see bug 21686. --- browser/app/profile/000-tor-browser.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index a948c45..73cb896 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -314,6 +314,9 @@ pref("security.tls.unrestricted_rc4_fallback", false); // Enforce certificate pinning, see: https://bugs.torproject.org/16206 pref("security.cert_pinning.enforcement_level", 2); +// Don't allow MitM via Microsoft Family Safety, see bug 21686 +pref("security.family_safety.mode", 0); + // Enforce SHA1 deprecation, see: bug 18042. pref("security.pki.sha1_enforcement_level", 2);

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 12 May '17

12 May '17

commit 859140af51e3a6e9aee5b745cc2e48d061d7fb4f Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 10:31:59 2017 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. No need to leak local network things to Mozilla, see bug 21790 --- browser/app/profile/000-tor-browser.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 5261c28..a948c45 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -257,7 +257,8 @@ pref("network.http.pipelining.read-timeout", 60000); pref("network.http.pipelining.max-optimistic-requests", 3); pref("security.ssl.disable_session_identifiers", true); pref("network.manage-offline-status", false); - +// No need to leak things to Mozilla, see bug 21790 +pref("network.captive-portal-service.enabled", false); // As a "defense in depth" measure, configure an empty push server URL (the // DOM Push features are disabled by default via other prefs). pref("dom.push.serverURL", "");

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB3: Tor Browser's official .mozconfigs.
by gk＠torproject.org 12 May '17

12 May '17

commit b51157dc9a520a693c2fb27ab3213e3bdf1cb5f1 Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 14:05:05 2017 +0000 fixup! TB3: Tor Browser's official .mozconfigs. The executables are not PIE anymore with the switch to ESR52. We need to set --enable-pie now even though we still use the hardening wrapper. Fixes #22238, patch by boklm. --- .mozconfig | 1 + .mozconfig-asan | 1 + 2 files changed, 2 insertions(+) diff --git a/.mozconfig b/.mozconfig index cde5b49..4398849 100755 --- a/.mozconfig +++ b/.mozconfig @@ -27,3 +27,4 @@ ac_add_options --disable-webrtc ac_add_options --disable-eme #ac_add_options --disable-ctypes ac_add_options --enable-jemalloc=4 +ac_add_options --enable-pie diff --git a/.mozconfig-asan b/.mozconfig-asan index 096bcc6..87e5008 100644 --- a/.mozconfig-asan +++ b/.mozconfig-asan @@ -41,3 +41,4 @@ ac_add_options --disable-crashreporter ac_add_options --disable-webrtc #ac_add_options --disable-ctypes ac_add_options --disable-eme +ac_add_options --enable-pie

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 12 May '17

12 May '17

commit c56819cf6e7f9f394d2ce8553ccd77f7a6559644 Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 13:28:50 2017 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. We don't need any Mozilla experiments in Tor Browser. Let's make sure this feature is disabled. Fixes bug 22073. --- browser/app/profile/000-tor-browser.js | 2 ++ 1 file changed, 2 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 956eb2d..5261c28 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -80,6 +80,8 @@ pref("datareporting.healthreport.about.reportUrlUnified", "data:text/plain,"); pref("browser.selfsupport.enabled", false); pref("browser.selfsupport.url", ""); pref("toolkit.telemetry.unified", false); +// No experiments, use Tor Browser. See 21797. +pref("experiments.enabled", false); // Disable the UITour backend so there is no chance that a remote page // can use it to confuse Tor Browser users. pref("browser.uitour.enabled", false);

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 12 May '17

12 May '17

commit e4848686fd6078cd9cbdf3c8a9fe979f0f9a7283 Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 13:05:35 2017 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. Hide the TLS error reporting checkbox for now as Mozilla seems to be the wrong party to get Tor Browser reports. One day we might want to repurpose this checkbox to point to our own infrastructure to help finding bad relays (see bug 19119). Fixes bug 22072. --- browser/app/profile/000-tor-browser.js | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 98cfec5..956eb2d 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -314,6 +314,11 @@ pref("security.cert_pinning.enforcement_level", 2); // Enforce SHA1 deprecation, see: bug 18042. pref("security.pki.sha1_enforcement_level", 2); +// Avoid report TLS errors to Mozilla. We might want to repurpose this feature +// one day to help detecting bad relays (which is bug 19119). For now we just +// hide the checkbox, see bug 22072. +pref("security.ssl.errorReporting.enabled", false); + // Workaround for https://bugs.torproject.org/13579. Progress on // `about:downloads` is only shown if the following preference is set to `true` // in case the download panel got removed from the toolbar.

1 0

[tor-browser-build/master] Remove FTE from OSX torrc-defaults
by boklm＠torproject.org 12 May '17

12 May '17

commit 747b697d335a023bae8da70671275a6750e7e02d Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri May 12 13:42:11 2017 +0200 Remove FTE from OSX torrc-defaults --- projects/tor-browser/Bundle-Data/PTConfigs/mac/torrc-defaults-appendix | 3 --- 1 file changed, 3 deletions(-) diff --git a/projects/tor-browser/Bundle-Data/PTConfigs/mac/torrc-defaults-appendix b/projects/tor-browser/Bundle-Data/PTConfigs/mac/torrc-defaults-appendix index f5eb5e4..271b36c 100644 --- a/projects/tor-browser/Bundle-Data/PTConfigs/mac/torrc-defaults-appendix +++ b/projects/tor-browser/Bundle-Data/PTConfigs/mac/torrc-defaults-appendix @@ -1,6 +1,3 @@ -## fteproxy configuration -ClientTransportPlugin fte exec PluggableTransports/fteproxy.bin --managed - ## obfs4proxy configuration ClientTransportPlugin obfs2,obfs3,obfs4,scramblesuit exec PluggableTransports/obfs4proxy

1 0

[tor-browser-build/master] Add ChangeLog.txt symlink
by boklm＠torproject.org 12 May '17

12 May '17

commit 905f80c552d967413df71790b11f85df5880c9ca Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri May 12 13:47:51 2017 +0200 Add ChangeLog.txt symlink --- ChangeLog.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog.txt b/ChangeLog.txt new file mode 120000 index 0000000..e9fcf5d --- /dev/null +++ b/ChangeLog.txt @@ -0,0 +1 @@ +projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt \ No newline at end of file

1 0

[tor-browser-build/master] Fold in stable changelog
by boklm＠torproject.org 12 May '17

12 May '17

commit cab94ec562e71a2e3e379111f35d319f739d1b49 Author: Georg Koppen <gk(a)torproject.org> Date: Tue May 2 09:04:21 2017 +0000 Fold in stable changelog --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index b2ee463..afe3999 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -83,6 +83,18 @@ Tor Browser 7.0a3 -- April 20 2017 * Bug 21960: Linux bundles based on ESR 52 are not reproducible anymore * Bug 21629: Fix broken ASan builds when switching to ESR 52 +Tor Browser 6.5.2 -- April 19 2017 + * All Platforms + * Update Firefox to 45.9.0esr + * Update HTTPS-Everywhere to 5.2.14 + * Update NoScript to 5.0.2 + * Bug 21555+16450: Don't remove Authorization header on subdomains (e.g. Twitter) + * Bug 19316: Make sure our Windows updates can deal with the SSE2 requirement + * Bug 21917: Add new obfs4 bridges + * Bug 21918: Move meek-amazon to d2cly7j4zqgua7.cloudfront.net backend + * Windows + * Bug 21795: Fix Tor Browser crashing on github.com + Tor Browser 7.0a2-hardened -- March 7 2017 * All Platforms * Update Firefox to 45.8.0esr

1 0

[tor-browser-build/master] Bug 20761: Tor Browser 6.5a4 is ignoring additional SocksPorts
by boklm＠torproject.org 12 May '17

12 May '17

commit 6395f3e322cfea745c6d0521d407ac5d68a0fe36 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue Jan 31 11:49:41 2017 -0500 Bug 20761: Tor Browser 6.5a4 is ignoring additional SocksPorts Remove the SocksPort and ControlPort configuration from torrc-defaults. Tor Launcher configures the ports via args when starting tor, and we must avoid conflicts. Also, strengthen the warning to users about not editing torrc-defaults. --- projects/tor-browser/Bundle-Data/linux/Data/Tor/torrc-defaults | 8 +++----- .../Bundle-Data/mac/TorBrowser/Data/Tor/torrc-defaults | 8 +++----- projects/tor-browser/Bundle-Data/windows/Data/Tor/torrc-defaults | 8 +++----- 3 files changed, 9 insertions(+), 15 deletions(-) diff --git a/projects/tor-browser/Bundle-Data/linux/Data/Tor/torrc-defaults b/projects/tor-browser/Bundle-Data/linux/Data/Tor/torrc-defaults index 0a87e5f..f383525 100644 --- a/projects/tor-browser/Bundle-Data/linux/Data/Tor/torrc-defaults +++ b/projects/tor-browser/Bundle-Data/linux/Data/Tor/torrc-defaults @@ -1,6 +1,8 @@ # torrc-defaults for Tor Browser # -# This file is distributed with Tor Browser and should not be modified (it +# DO NOT EDIT THIS FILE +# +# This file is distributed with Tor Browser and SHOULD NOT be modified (it # may be overwritten during the next Tor Browser update). To customize your # Tor configuration, shut down Tor Browser and edit the torrc file. # @@ -9,8 +11,4 @@ AvoidDiskWrites 1 # Where to send logging messages. Format is minSeverity[-maxSeverity] # (stderr|stdout|syslog|file FILENAME). Log notice stdout -# Bind to this address to listen to connections from SOCKS-speaking -# applications. -SocksPort 9150 IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth -ControlPort 9151 CookieAuthentication 1 diff --git a/projects/tor-browser/Bundle-Data/mac/TorBrowser/Data/Tor/torrc-defaults b/projects/tor-browser/Bundle-Data/mac/TorBrowser/Data/Tor/torrc-defaults index 0a87e5f..f383525 100644 --- a/projects/tor-browser/Bundle-Data/mac/TorBrowser/Data/Tor/torrc-defaults +++ b/projects/tor-browser/Bundle-Data/mac/TorBrowser/Data/Tor/torrc-defaults @@ -1,6 +1,8 @@ # torrc-defaults for Tor Browser # -# This file is distributed with Tor Browser and should not be modified (it +# DO NOT EDIT THIS FILE +# +# This file is distributed with Tor Browser and SHOULD NOT be modified (it # may be overwritten during the next Tor Browser update). To customize your # Tor configuration, shut down Tor Browser and edit the torrc file. # @@ -9,8 +11,4 @@ AvoidDiskWrites 1 # Where to send logging messages. Format is minSeverity[-maxSeverity] # (stderr|stdout|syslog|file FILENAME). Log notice stdout -# Bind to this address to listen to connections from SOCKS-speaking -# applications. -SocksPort 9150 IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth -ControlPort 9151 CookieAuthentication 1 diff --git a/projects/tor-browser/Bundle-Data/windows/Data/Tor/torrc-defaults b/projects/tor-browser/Bundle-Data/windows/Data/Tor/torrc-defaults index 0a87e5f..f383525 100644 --- a/projects/tor-browser/Bundle-Data/windows/Data/Tor/torrc-defaults +++ b/projects/tor-browser/Bundle-Data/windows/Data/Tor/torrc-defaults @@ -1,6 +1,8 @@ # torrc-defaults for Tor Browser # -# This file is distributed with Tor Browser and should not be modified (it +# DO NOT EDIT THIS FILE +# +# This file is distributed with Tor Browser and SHOULD NOT be modified (it # may be overwritten during the next Tor Browser update). To customize your # Tor configuration, shut down Tor Browser and edit the torrc file. # @@ -9,8 +11,4 @@ AvoidDiskWrites 1 # Where to send logging messages. Format is minSeverity[-maxSeverity] # (stderr|stdout|syslog|file FILENAME). Log notice stdout -# Bind to this address to listen to connections from SOCKS-speaking -# applications. -SocksPort 9150 IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth -ControlPort 9151 CookieAuthentication 1

1 0

[tor-browser-build/master] Bug 21879: Use our default bookmarks on OSX.
by boklm＠torproject.org 12 May '17

12 May '17

commit a826868cf9771049ae33a710f5a2cd764d99494a Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri May 12 13:12:47 2017 +0200 Bug 21879: Use our default bookmarks on OSX. Account for the changes Mozilla to support localized default bookmarks (see: https://bugzilla.mozilla.org/show_bug.cgi?id=1235107) Currently, Tor Browser uses the same bookmarks for all locales. tor-browser-bundle.git author: Kathy Brade <brade(a)pearlcrescent.com> tor-browser-bundle.git commit: 57f088b981a0292d5370b3c56c6d7e5a18f95aca --- projects/tor-browser/build | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/projects/tor-browser/build b/projects/tor-browser/build index 084ec7d..69469db 100644 --- a/projects/tor-browser/build +++ b/projects/tor-browser/build @@ -152,11 +152,12 @@ rm -rf chrome/en-US unzip omni.ja defaults/preferences/000-tor-browser.js || [ $? -lt 3 ] cp defaults/preferences/000-tor-browser.js $rootdir [% IF c("var/osx") %] - # Embed our default bookmarks. - mkdir -p defaults/profile/ - cp -p $rootdir/bookmarks.html defaults/profile/ - [% c("var/touch") %] defaults/profile/bookmarks.html - zip -Xm omni.ja defaults/profile/bookmarks.html + # Embed our default bookmarks within the en-US locale. + mkdir -p chrome/en-US/locale/browser + cp -p $rootdir/bookmarks.html chrome/en-US/locale/browser/ + [% c("var/touch") %] chrome/en-US/locale/browser/bookmarks.html + zip -Xm omni.ja chrome/en-US/locale/browser/bookmarks.html + rm -rf chrome [% END %] # Set the locale of the bundle. echo "pref(\"general.useragent.locale\", \"en-US\");" >> defaults/preferences/000-tor-browser.js @@ -165,8 +166,8 @@ zip -Xm omni.ja defaults/preferences/000-tor-browser.js rm -rf defaults popd -# Prepare our language packs for using the proper search engines. See bug -# 18915 for more details. +# Prepare our language packs for using the proper search engines and embed +# our default bookmarks. See bugs 18915 and 21879 for more details. [% FOREACH lang = c('var/locales') %] [% SET lang = tmpl(lang); SET xpi = '$rootdir/' _ c('input_files_by_name/firefox-langpacks') _ '/' _ lang _ '.xpi'; @@ -175,6 +176,9 @@ popd search_plugins_path=prep_[% lang %]/browser/chrome/[% lang %]/locale/browser rm -rf $search_plugins_path/searchplugins cp -rf $rootdir/searchplugins $search_plugins_path + [% IF c("var/osx") -%] + cp $rootdir/bookmarks.html prep_[% lang %]/browser/chrome/[% lang %]/locale/browser/ + [% END -%] rm [% xpi %] cd prep_[% lang %] [% c('zip', {

1 0

[tor-browser-build/master] Bug 21779: Non-admin users can't access Tor Browser on macOS.
by boklm＠torproject.org 12 May '17

12 May '17

commit dd6349a4c118d05797eb211d538ac36b6d08bb59 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri May 12 13:20:33 2017 +0200 Bug 21779: Non-admin users can't access Tor Browser on macOS. Use chmod to grant permission for "other" to access files within TorBrowser.app. tor-browser-bundle.git author: Kathy Brade <brade(a)pearlcrescent.com> tor-browser-bundle.git commit: f27d2cab4ed80a4c7b4f594b593b6b90f6148a82 --- projects/tor-browser/build | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/projects/tor-browser/build b/projects/tor-browser/build index 69469db..d580284 100644 --- a/projects/tor-browser/build +++ b/projects/tor-browser/build @@ -229,6 +229,12 @@ rm -f precomplete python $MARTOOLS/createprecomplete.py popd +[% IF c("var/osx") -%] + # Ensure that files and directories are accessible by non-admin users + # if the app bundle is placed in /Applications. See bug 21779. + chmod -R o+rX "$TBDIR" +[% END -%] + cd $distdir [% IF c("var/build_mar") -%] @@ -301,6 +307,12 @@ rm -rf $distdir/${PKG_DIR} python $MARTOOLS/createprecomplete.py popd + [% IF c("var/osx") -%] + # Ensure that files and directories are accessible by non-admin users + # if the app bundle is placed in /Applications. See bug 21779. + chmod -R o+rX "[% browserdir %]" + [% END -%] + # Create full MAR file and compressed package for this locale. MAR_FILE=tor-browser-[% c("var/mar_osname") %]-[% c("var/torbrowser_version") %]_[% lang %].mar MAR=$MARTOOLS/mar MBSDIFF=$MARTOOLS/mbsdiff $MARTOOLS/make_full_update.sh -q $OUTDIR/$MAR_FILE "[% browserdir %]"

1 0

[tor-browser-bundle/master] Bug 20761: Tor Browser 6.5a4 is ignoring additional SocksPorts
by gk＠torproject.org 12 May '17

12 May '17

commit 3f32f7a6dd4970936cc49d988369a61efa87c031 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue Jan 31 11:49:41 2017 -0500 Bug 20761: Tor Browser 6.5a4 is ignoring additional SocksPorts Remove the SocksPort and ControlPort configuration from torrc-defaults. Tor Launcher configures the ports via args when starting tor, and we must avoid conflicts. Also, strengthen the warning to users about not editing torrc-defaults. --- Bundle-Data/linux/Data/Tor/torrc-defaults | 8 +++----- Bundle-Data/mac/TorBrowser/Data/Tor/torrc-defaults | 8 +++----- Bundle-Data/windows/Data/Tor/torrc-defaults | 8 +++----- 3 files changed, 9 insertions(+), 15 deletions(-) diff --git a/Bundle-Data/linux/Data/Tor/torrc-defaults b/Bundle-Data/linux/Data/Tor/torrc-defaults index 0a87e5f..f383525 100644 --- a/Bundle-Data/linux/Data/Tor/torrc-defaults +++ b/Bundle-Data/linux/Data/Tor/torrc-defaults @@ -1,6 +1,8 @@ # torrc-defaults for Tor Browser # -# This file is distributed with Tor Browser and should not be modified (it +# DO NOT EDIT THIS FILE +# +# This file is distributed with Tor Browser and SHOULD NOT be modified (it # may be overwritten during the next Tor Browser update). To customize your # Tor configuration, shut down Tor Browser and edit the torrc file. # @@ -9,8 +11,4 @@ AvoidDiskWrites 1 # Where to send logging messages. Format is minSeverity[-maxSeverity] # (stderr|stdout|syslog|file FILENAME). Log notice stdout -# Bind to this address to listen to connections from SOCKS-speaking -# applications. -SocksPort 9150 IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth -ControlPort 9151 CookieAuthentication 1 diff --git a/Bundle-Data/mac/TorBrowser/Data/Tor/torrc-defaults b/Bundle-Data/mac/TorBrowser/Data/Tor/torrc-defaults index 0a87e5f..f383525 100644 --- a/Bundle-Data/mac/TorBrowser/Data/Tor/torrc-defaults +++ b/Bundle-Data/mac/TorBrowser/Data/Tor/torrc-defaults @@ -1,6 +1,8 @@ # torrc-defaults for Tor Browser # -# This file is distributed with Tor Browser and should not be modified (it +# DO NOT EDIT THIS FILE +# +# This file is distributed with Tor Browser and SHOULD NOT be modified (it # may be overwritten during the next Tor Browser update). To customize your # Tor configuration, shut down Tor Browser and edit the torrc file. # @@ -9,8 +11,4 @@ AvoidDiskWrites 1 # Where to send logging messages. Format is minSeverity[-maxSeverity] # (stderr|stdout|syslog|file FILENAME). Log notice stdout -# Bind to this address to listen to connections from SOCKS-speaking -# applications. -SocksPort 9150 IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth -ControlPort 9151 CookieAuthentication 1 diff --git a/Bundle-Data/windows/Data/Tor/torrc-defaults b/Bundle-Data/windows/Data/Tor/torrc-defaults index 0a87e5f..f383525 100644 --- a/Bundle-Data/windows/Data/Tor/torrc-defaults +++ b/Bundle-Data/windows/Data/Tor/torrc-defaults @@ -1,6 +1,8 @@ # torrc-defaults for Tor Browser # -# This file is distributed with Tor Browser and should not be modified (it +# DO NOT EDIT THIS FILE +# +# This file is distributed with Tor Browser and SHOULD NOT be modified (it # may be overwritten during the next Tor Browser update). To customize your # Tor configuration, shut down Tor Browser and edit the torrc file. # @@ -9,8 +11,4 @@ AvoidDiskWrites 1 # Where to send logging messages. Format is minSeverity[-maxSeverity] # (stderr|stdout|syslog|file FILENAME). Log notice stdout -# Bind to this address to listen to connections from SOCKS-speaking -# applications. -SocksPort 9150 IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth -ControlPort 9151 CookieAuthentication 1

1 0

[tor-launcher/master] Bug 20761: Tor Browser 6.5a4 is ignoring additional SocksPorts
by gk＠torproject.org 12 May '17

12 May '17

commit 5154173e0facfff26bede4c37d2c47669350d0ff Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Fri May 5 14:37:52 2017 -0400 Bug 20761: Tor Browser 6.5a4 is ignoring additional SocksPorts When starting tor, pass "+__ControlPort" and "+__SocksPort" in the args. This causes Tor Launcher's control and SOCKS ports to be added to any ports the user has defined in their torrc and also prevents the ports defined by Tor Launcher from being written to torrc. Also, perform a one-time removal of the torrc lines that conflict with the ports that Tor Launcher will use when starting tor. This change depends on the fix for #20956. --- src/components/tl-process.js | 319 +++++++++++++++++++++++++++++++++++++++++- src/components/tl-protocol.js | 9 +- src/modules/tl-util.jsm | 11 +- 3 files changed, 332 insertions(+), 7 deletions(-) diff --git a/src/components/tl-process.js b/src/components/tl-process.js index 3284049..3db394e 100644 --- a/src/components/tl-process.js +++ b/src/components/tl-process.js @@ -1,4 +1,4 @@ -// Copyright (c) 2016, The Tor Project, Inc. +// Copyright (c) 2017, The Tor Project, Inc. // See LICENSE for licensing information. // // vim: set sw=2 sts=2 ts=8 et syntax=javascript: @@ -99,6 +99,17 @@ TorProcessService.prototype = } else if (TorLauncherUtil.shouldStartAndOwnTor) { + // If we have not already done so, perform a one-time fixup to remove + // any ControlPort and SocksPort lines from the user's torrc file that + // will conflict with the arguments we plan to pass when starting tor. + // See bug 20761. + const kTorrcFixupPref = "extensions.torlauncher.torrc_fixup_version"; + if ((TorLauncherUtil.getIntPref(kTorrcFixupPref, 0) < 1) + && this._fixupTorrc()) + { + TorLauncherUtil.setIntPref(kTorrcFixupPref, 1); + } + this._startTor(); this._controlTor(); } @@ -383,7 +394,10 @@ TorProcessService.prototype = args.push(hashedPassword); // Include a ControlPort argument to support switching between - // a TCP port and an IPC port (e.g., a Unix domain socket). + // a TCP port and an IPC port (e.g., a Unix domain socket). We + // include a "+__" prefix so that (1) this control port is added + // to any control ports that the user has defined in their torrc + // file and (2) it is never written to torrc. let controlPortArg; if (controlIPCFile) controlPortArg = this._ipcPortArg(controlIPCFile); @@ -391,12 +405,15 @@ TorProcessService.prototype = controlPortArg = "" + controlPort; if (controlPortArg) { - args.push("ControlPort"); + args.push("+__ControlPort"); args.push(controlPortArg); } // Include a SocksPort argument to support switching between - // a TCP port and an IPC port (e.g., a Unix domain socket). + // a TCP port and an IPC port (e.g., a Unix domain socket). We + // include a "+__" prefix so that (1) this SOCKS port is added + // to any SOCKS ports that the user has defined in their torrc + // file and (2) it is never written to torrc. if (socksPortInfo) { let socksPortArg; @@ -411,7 +428,7 @@ TorProcessService.prototype = "extensions.torlauncher.socks_port_flags"); if (socksPortFlags) socksPortArg += ' ' + socksPortFlags; - args.push("SocksPort"); + args.push("+__SocksPort"); args.push(socksPortArg); } } @@ -793,6 +810,298 @@ TorProcessService.prototype = return pid; }, + // Returns true if successful. + _fixupTorrc: function() + { + let torrcFile = TorLauncherUtil.getTorFile("torrc", true); + if (!torrcFile) + return true; // No torrc file; nothing to fixup. + + let torrcStr = this._getFileAsString(torrcFile); + if (torrcStr == undefined) + return false; + else if (torrcStr.length == 0) + return true; + + let controlIPCFile = this.mProtocolSvc.TorGetControlIPCFile(); + let controlPort = this.mProtocolSvc.TorGetControlPort(); + let socksPortInfo = this.mProtocolSvc.TorGetSOCKSPortInfo(); + + let lines = this._joinContinuedTorrcLines(torrcStr); + + let removedLinesCount = 0; + let revisedLines = []; + lines.forEach(aLine => + { + let removeLine = false; + // Look for "+ControlPort value" or "ControlPort value", skipping leading + // whitespace and ignoring case. + let matchResult = aLine.match(/\s*\+*controlport\s+(.*)/i); + if (matchResult) + { + if (controlIPCFile) + { + removeLine = this._valueContainsFilePath(matchResult[1], + controlIPCFile); + } + else + { + removeLine = this._valueContainsPort(matchResult[1], + controlPort); + } + } + else if (socksPortInfo) + { + // Look for "+SocksPort value" or "SocksPort value", skipping leading + // whitespace and ignoring case. + matchResult = aLine.match(/\s*\+*socksport\s+(.*)/i); + if (matchResult) + { + if (socksPortInfo.ipcFile) + { + removeLine = this._valueContainsFilePath(matchResult[1], + socksPortInfo.ipcFile); + } + else + { + removeLine = this._valueContainsPort(matchResult[1], + socksPortInfo.port); + } + } + } + + if (removeLine) + { + ++removedLinesCount; + TorLauncherLogger.log(3, "_fixupTorrc: removing " + aLine); + } + else + { + revisedLines.push(aLine); + } + }); + + if (removedLinesCount > 0) + { + let s = revisedLines.join('\n'); + if (!this._overwriteFile(torrcFile, s)) + return false; + + TorLauncherLogger.log(4, "_fixupTorrc: removed " + removedLinesCount + + " configuration options"); + } + + return true; + }, + + // Returns undefined if file contents could not be read. + _getFileAsString: function(aFile) + { + let str = "" + let inStream; + try + { + let fis = Cc['@mozilla.org/network/file-input-stream;1'] + .createInstance(Ci.nsIFileInputStream); + const kOpenFlagsReadOnly = 0x01; + fis.init(aFile, kOpenFlagsReadOnly, 0, 0); + inStream = Cc["@mozilla.org/intl/converter-input-stream;1"] + .createInstance(Ci.nsIConverterInputStream); + inStream.init(fis, "UTF-8", 0, + Ci.nsIConverterInputStream.DEFAULT_REPLACEMENT_CHARACTER); + const kReadSize = 0xffffffff; // PR_UINT32_MAX + while (true) + { + let outStr = {}; + let count = inStream.readString(kReadSize, outStr); + if (count == 0) + break; + + str += outStr.value; + } + } + catch (e) + { + TorLauncherLogger.log(5, "_getFileAsString " + aFile.path + + " error: " + e); + str = undefined; + } + + if (inStream) + inStream.close(); + + return str; + }, + + // After making a backup, replace the contents of aFile with aStr. + // Returns true if successful. + _overwriteFile: function(aFile, aStr) + { + let backupFile; + + try + { + // Convert the data to UTF-8. + let conv = Cc["@mozilla.org/intl/scriptableunicodeconverter"] + .createInstance(Ci.nsIScriptableUnicodeConverter); + conv.charset = "UTF-8"; + let data = conv.ConvertFromUnicode(aStr) + conv.Finish(); + + // Rename the file to .bak (we avoid .orig because tor uses it). This + // backup will be left on disk so the user can recover the original + // file contents. + backupFile = aFile.clone(); + backupFile.leafName += ".bak"; + backupFile.createUnique(Ci.nsIFile.NORMAL_FILE_TYPE, aFile.permissions); + aFile.renameTo(null, backupFile.leafName); + TorLauncherLogger.log(3, "created backup of " + aFile.leafName + + " in " + backupFile.leafName); + + // Write the new data to the file. + let stream = Cc["@mozilla.org/network/safe-file-output-stream;1"] + .createInstance(Ci.nsIFileOutputStream); + stream.init(aFile, 0x02 | 0x08 | 0x20, /* WRONLY CREATE TRUNCATE */ + 0600, 0); + stream.write(data, data.length); + stream.QueryInterface(Ci.nsISafeOutputStream).finish(); + } + catch (e) + { + // Report an error and try to recover by renaming the backup to the + // original name. + TorLauncherLogger.log(5, "failed to overwrite file " + aFile.path + + ": " + e); + if (backupFile) + backupFile.renameTo(null, aFile.leafName); + + return false; + } + + return true; + }, + + // Split aTorrcStr into lines, joining continued lines. + _joinContinuedTorrcLines: function(aTorrcStr) + { + let lines = []; + let rawLines = aTorrcStr.split('\n'); + let isContinuedLine = false; + let tmpLine; + rawLines.forEach(aLine => + { + let len = aLine.length; + + // Strip trailing CR if present. + if ((len > 0) && aLine.substr(len - 1) == '\r') + { + --len; + aLine = aLine.substr(0, len); + } + + // Check for a continued line. This is indicated by a trailing \ or, if + // we are already within a continued line sequence, a trailing comment. + if ((len > 0) && (aLine.substr(len - 1) == '\\')) + { + --len; + aLine = aLine.substr(0, len); + + // If this is the start of a continued line and it only contains a + // keyword (i.e., no spaces are present), append a space so that + // the keyword will be recognized (as it is by tor) after we join + // the pieces of the continued line into one line. + if (!isContinuedLine && (aLine.indexOf(' ') < 0)) + aLine += ' '; + + isContinuedLine = true; + } + else if (isContinuedLine) + { + if (len == 0) + { + isContinuedLine = false; + } + else + { + // Check for a comment. According to tor's doc/torrc_format.txt, + // comments do not terminate a sequence of continued lines. + let idx = aLine.indexOf("#"); + if (idx < 0) + { + isContinuedLine = false; // Not a comment; end continued line. + } + else + { + // Remove trailing comment from continued line. The continued + // line sequence continues. + aLine = aLine.substr(0, idx); + } + } + } + + if (isContinuedLine) + { + if (tmpLine) + tmpLine += aLine; + else + tmpLine = aLine; + } + else if (tmpLine) + { + lines.push(tmpLine + aLine); + tmpLine = undefined; + } + else + { + lines.push(aLine); + } + }); + + return lines; + }, + + _valueContainsFilePath: function(aValue, aFile) + { + // Handle several cases: + // "unix:/path options" + // unix:"/path" options + // unix:/path options + if (aValue.startsWith('"')) + aValue = this.mProtocolSvc.TorUnescapeString(aValue); + + let path; + let matchResult = aValue.match(/^unix:("[^"]*")/); + if (matchResult) + path = this.mProtocolSvc.TorUnescapeString(matchResult[1]); + else + { + matchResult = aValue.match(/^unix:(\S*)/); + if (matchResult) + path = matchResult[1]; + } + + if (!path) + return false; + + let file = Cc['@mozilla.org/file/local;1'].createInstance(Ci.nsIFile); + file.initWithPath(path); + return file.equals(aFile); + }, + + _valueContainsPort: function(aValue, aPort) + { + // Check for a match, ignoring "127.0.0.1" and "localhost" prefixes. + let val = this.mProtocolSvc.TorUnescapeString(aValue); + let pieces = val.split(':'); + if ((pieces.length >= 2) + && ((pieces[0] == "127.0.0.1") + || (pieces[0].toLowerCase() == "localhost"))) + { + val = pieces[1]; + } + + return aPort === parseInt(val); + }, + endOfObject: true }; diff --git a/src/components/tl-protocol.js b/src/components/tl-protocol.js index 12f3910..d6323f4 100644 --- a/src/components/tl-protocol.js +++ b/src/components/tl-protocol.js @@ -1,4 +1,4 @@ -// Copyright (c) 2016, The Tor Project, Inc. +// Copyright (c) 2017, The Tor Project, Inc. // See LICENSE for licensing information. // TODO: Some code came from torbutton.js (pull in copyright and license?) // @@ -299,6 +299,13 @@ TorProtocolService.prototype = return this.mSOCKSPortInfo; }, + // Unescape Tor Control string aStr (removing surrounding "" and \ escapes). + // Returns a string. + TorUnescapeString: function(aStr) + { + return this._strUnescape(aStr); + }, + // Escape non-ASCII characters for use within the Tor Control protocol. // Returns a string. TorEscapeString: function(aStr) diff --git a/src/modules/tl-util.jsm b/src/modules/tl-util.jsm index 0d33267..2e45fd1 100644 --- a/src/modules/tl-util.jsm +++ b/src/modules/tl-util.jsm @@ -1,4 +1,4 @@ -// Copyright (c) 2016, The Tor Project, Inc. +// Copyright (c) 2017, The Tor Project, Inc. // See LICENSE for licensing information. // // vim: set sw=2 sts=2 ts=8 et syntax=javascript: @@ -231,6 +231,15 @@ let TorLauncherUtil = // Public return rv; }, + setIntPref: function(aPrefName, aVal) + { + var val = (undefined != aVal) ? aVal : 0; + try + { + TLUtilInternal.mPrefsSvc.setIntPref(aPrefName, val); + } catch (e) {} + }, + getCharPref: function(aPrefName, aDefaultVal) { var rv = aDefaultVal ? aDefaultVal : "";

1 0

[tor-launcher/master] By default, use TCP for the ControlPort and SocksPort.
by gk＠torproject.org 12 May '17

12 May '17

commit 485ba9456724e38b661c90dccc90322c74fa405f Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Thu May 11 17:34:16 2017 -0400 By default, use TCP for the ControlPort and SocksPort. For the stable releases of Tor Browser, we want to continue to use TCP so that packages like TorBirdy that use the tor that is started by Tor Browser continue to work. Also see bugs 20111 and 20761. --- src/defaults/preferences/prefs.js | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/src/defaults/preferences/prefs.js b/src/defaults/preferences/prefs.js index 875c300..752514a 100644 --- a/src/defaults/preferences/prefs.js +++ b/src/defaults/preferences/prefs.js @@ -9,27 +9,27 @@ pref("extensions.torlauncher.loglevel", 4); // 1=verbose, 2=debug, 3=info, 4=no pref("extensions.torlauncher.logmethod", 1); // 0=stdout, 1=errorconsole, 2=debuglog pref("extensions.torlauncher.max_tor_log_entries", 1000); -// By default, an IPC object (e.g., a Unix domain socket) at a default -// location is used for the Tor control port. -// Change control_port_use_ipc to false to use a TCP connection instead, as -// defined by control_host and control_port. -// Modify control_ipc_path to override the default IPC object location. If a -// relative path is used, it is handled like torrc_path (see below). -pref("extensions.torlauncher.control_port_use_ipc", true); -pref("extensions.torlauncher.control_ipc_path", ""); +// By default, Tor Launcher configures a TCP listener for the Tor +// control port, as defined by control_host and control_port. +// Set control_port_use_ipc to true to use an IPC object (e.g., a Unix +// domain socket) instead. You may also modify control_ipc_path to +// override the default IPC object location. If a relative path is used, +// it is handled like torrc_path (see below). pref("extensions.torlauncher.control_host", "127.0.0.1"); pref("extensions.torlauncher.control_port", 9151); +pref("extensions.torlauncher.control_port_use_ipc", false); +pref("extensions.torlauncher.control_ipc_path", ""); -// By default, an IPC object (e.g., a Unix domain socket) at a default -// location is used for the Tor SOCKS port. -// Change socks_port_use_ipc to false to use a TCP connection. When a -// TCP connection is used, the host is taken from the network.proxy.socks -// pref and the port is taken from the network.proxy.socks_port pref. -// Modify socks_ipc_path to override the default IPC object location. If a -// relative path is used, it is handled like torrc_path (see below). +// By default, Tor Launcher configures a TCP listener for the Tor +// SOCKS port. The host is taken from the network.proxy.socks pref and +// the port is taken from the network.proxy.socks_port pref. +// Set socks_port_use_ipc to true to use an IPC object (e.g., a Unix +// domain socket) instead. You may also modify socks_ipc_path to +// override the default IPC object location. If a relative path is used, +// it is handled like torrc_path (see below). // Modify socks_port_flags to use a different set of SocksPort flags (but be // careful). -pref("extensions.torlauncher.socks_port_use_ipc", true); +pref("extensions.torlauncher.socks_port_use_ipc", false); pref("extensions.torlauncher.socks_ipc_path", ""); pref("extensions.torlauncher.socks_port_flags", "IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth");

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 12 May '17

12 May '17

commit 611b3ff60078725f036e253c5d10a3d01d8fde90 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Fri May 12 01:29:04 2017 -0700 fixup! TB4: Tor Browser's Firefox preference overrides. Bug 21685: Disable remote new tab pages --- browser/app/profile/000-tor-browser.js | 1 + 1 file changed, 1 insertion(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index be74849..98cfec5 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -95,6 +95,7 @@ pref("browser.newtabpage.directory.source", "data:text/plain,"); // Bug 16316 - pref("browser.newtabpage.enhanced", false); // Bug 16316 - Avoid potential confusion over tiles for now. pref("browser.newtabpage.introShown", true); // Bug 16316 - Avoid potential confusion over tiles for now. pref("browser.newtabpage.preload", false); // Bug 16316 - Avoid potential confusion over tiles for now. +pref("browser.newtabpage.remote", false); // Bug 21685: Disable remote new tab pages pref("browser.search.countryCode", "US"); // The next three prefs disable GeoIP search lookups (#16254) pref("browser.search.region", "US"); pref("browser.search.geoip.url", "");

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 12 May '17

12 May '17

commit 1b6559c0763f2ae0c9ad56307642e6d6462c3ede Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Tue Apr 25 11:46:52 2017 -0700 fixup! TB4: Tor Browser's Firefox preference overrides. Bug 10286: Disable Touch API --- browser/app/profile/000-tor-browser.js | 1 + 1 file changed, 1 insertion(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index b8c3f41..be74849 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -160,6 +160,7 @@ pref("privacy.use_utc_timezone", true); pref("media.webspeech.synth.enabled", false); // Bug 10283: Disable SpeechSynthesis API pref("dom.webaudio.enabled", false); // Bug 13017: Disable Web Audio API pref("dom.maxHardwareConcurrency", 1); // Bug 21675: Spoof single-core cpu +pref("dom.w3c_touch_events.enabled", 0); // Bug 10286: Always disable Touch API // Third party stuff pref("network.cookie.cookieBehavior", 1);

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] Bug 10286: Touch API fingerprinting resistance
by gk＠torproject.org 12 May '17

12 May '17

commit 331f089d6b6ba62463d8362d7ca01641a4cc92dc Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Mon Apr 24 08:18:25 2017 -0700 Bug 10286: Touch API fingerprinting resistance --- dom/events/Touch.cpp | 7 +++++++ dom/events/Touch.h | 16 ++++++++++------ 2 files changed, 17 insertions(+), 6 deletions(-) diff --git a/dom/events/Touch.cpp b/dom/events/Touch.cpp index a538fa6..39d50e3 100644 --- a/dom/events/Touch.cpp +++ b/dom/events/Touch.cpp @@ -188,5 +188,12 @@ Touch::GetParentObject() return mTarget->GetOwnerGlobal(); } +bool +Touch::ResistFingerprinting() const +{ + return !nsContentUtils::LegacyIsCallerChromeOrNativeCode() && + nsContentUtils::ResistFingerprinting(); +} + } // namespace dom } // namespace mozilla diff --git a/dom/events/Touch.h b/dom/events/Touch.h index f98f7f9..858fb16 100644 --- a/dom/events/Touch.h +++ b/dom/events/Touch.h @@ -67,16 +67,19 @@ public: // WebIDL int32_t Identifier() const { return mIdentifier; } EventTarget* GetTarget() const; - int32_t ScreenX() const { return mScreenPoint.x; } - int32_t ScreenY() const { return mScreenPoint.y; } + int32_t ScreenX() const { return ResistFingerprinting() ? + mClientPoint.x : mScreenPoint.x; } + int32_t ScreenY() const { return ResistFingerprinting() ? + mClientPoint.y : mScreenPoint.y; } int32_t ClientX() const { return mClientPoint.x; } int32_t ClientY() const { return mClientPoint.y; } int32_t PageX() const { return mPagePoint.x; } int32_t PageY() const { return mPagePoint.y; } - int32_t RadiusX() const { return mRadius.x; } - int32_t RadiusY() const { return mRadius.y; } - float RotationAngle() const { return mRotationAngle; } - float Force() const { return mForce; } + int32_t RadiusX() const { return ResistFingerprinting() ? 1 : mRadius.x; } + int32_t RadiusY() const { return ResistFingerprinting() ? 1 : mRadius.y; } + float RotationAngle() const { return ResistFingerprinting() ? + 0.0 : mRotationAngle; } + float Force() const { return ResistFingerprinting() ? 0.0 : mForce; } nsCOMPtr<EventTarget> mTarget; LayoutDeviceIntPoint mRefPoint; @@ -90,6 +93,7 @@ public: float mRotationAngle; float mForce; protected: + bool ResistFingerprinting() const; ~Touch(); bool mPointsInitialized;

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] Bug 10286: Regression tests for Touch API fingerprinting resistance
by gk＠torproject.org 12 May '17

12 May '17

commit 00d2bfb5067659c352690c06cb85a8b76bc7addb Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Wed Apr 26 08:57:21 2017 -0700 Bug 10286: Regression tests for Touch API fingerprinting resistance Also, fix typo in EventUtils.js --- dom/events/test/mochitest.ini | 1 + .../test_touchevent_resist_fingerprinting.html | 68 ++++++++++++++++++++++ testing/mochitest/tests/SimpleTest/EventUtils.js | 2 +- 3 files changed, 70 insertions(+), 1 deletion(-) diff --git a/dom/events/test/mochitest.ini b/dom/events/test/mochitest.ini index 4322a7b..92e68f3 100644 --- a/dom/events/test/mochitest.ini +++ b/dom/events/test/mochitest.ini @@ -185,3 +185,4 @@ skip-if = toolkit == 'android' #CRASH_DUMP, RANDOM [test_wheel_default_action.html] [test_bug687787.html] [test_bug1298970.html] +[test_touchevent_resist_fingerprinting.html] diff --git a/dom/events/test/test_touchevent_resist_fingerprinting.html b/dom/events/test/test_touchevent_resist_fingerprinting.html new file mode 100644 index 0000000..8ba7925 --- /dev/null +++ b/dom/events/test/test_touchevent_resist_fingerprinting.html @@ -0,0 +1,68 @@ +<!DOCTYPE HTML> +<html> + + <head> + <meta charset="utf-8"> + <title>Test for Tor Bug 10286</title> + <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/> + </head> + <body> + <div id="target0">target0</div> + <script type="application/javascript"> + SimpleTest.waitForExplicitFinish(); + + let promiseEvent = (target, eventName) => { + return new Promise(resolve => { + target.addEventListener(eventName, function eventOccurred(event) { + target.removeEventListener(eventName, eventOccurred, false); + resolve(event); + }, false); + }); + } + + let promiseTouchEvent = (target, type, offsetX, offsetY, params) => { + let touchEventPromise = promiseEvent(target, type); + params.type = type; + synthesizeTouch(target, offsetX, offsetY, params); + return touchEventPromise; + }; + + let target0 = document.getElementById("target0"); + let touchParams = { force: 1.0, angle: 1.0, rx: 2, ry: 3 }; + + let runTest = async () => { + await SpecialPowers.pushPrefEnv( + { set: [["dom.w3c_touch_events.enabled", 1]] }); + for (let resist of [false, true]) { + await SpecialPowers.pushPrefEnv( + { set: [["privacy.resistFingerprinting", resist]] }); + info("starting test with fingerprinting resistance " + + (resist ? "on" : "off")); + let touchEvent = await promiseTouchEvent(target0, "touchstart", + 5, 5, touchParams); + info("touch event received"); + let touch = touchEvent.touches[0]; + if (resist) { + is(touch.screenX, touch.clientX, + "touch.screenX should be the same as touch.clientX"); + is(touch.screenY, touch.clientY, + "touch.screenY should be the same as touch.clientY"); + } + is(touch.force, resist ? 0.0 : touchParams.force, "touch.force"); + is(touch.radiusX, resist ? 1 : touchParams.rx, "touch.radiusX"); + is(touch.radiusY, resist ? 1 : touchParams.ry, "touch.radiusY"); + is(touch.rotationAngle, resist ? 0 : touchParams.angle, + "touch.rotationAngle"); + } + } + + window.onload = () => { + runTest().then(() => SimpleTest.finish()); + }; + </script> + </body> +</html> diff --git a/testing/mochitest/tests/SimpleTest/EventUtils.js b/testing/mochitest/tests/SimpleTest/EventUtils.js index a0df2d5..c36a480 100644 --- a/testing/mochitest/tests/SimpleTest/EventUtils.js +++ b/testing/mochitest/tests/SimpleTest/EventUtils.js @@ -395,7 +395,7 @@ function synthesizeTouchAtPoint(left, top, aEvent, aWindow = window) if (utils) { var id = aEvent.id || 0; var rx = aEvent.rx || 1; - var ry = aEvent.rx || 1; + var ry = aEvent.ry || 1; var angle = aEvent.angle || 0; var force = aEvent.force || 1; var modifiers = _parseModifiers(aEvent, aWindow);

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] Bug 13612: Disable Social API
by gk＠torproject.org 12 May '17

12 May '17

commit bd30c7b878b8c4a3a033db65f1f6dbfa46f543d4 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Thu May 11 15:13:36 2017 -0700 Bug 13612: Disable Social API --- browser/app/profile/000-tor-browser.js | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index d422694..b8c3f41 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -107,6 +107,14 @@ pref("browser.pocket.api", ""); pref("browser.pocket.site", ""); pref("network.http.referer.hideOnionSource", true); +// Disable Social API and related stuff (Bug #13612) +pref("social.directories", ""); +pref("social.remote-install.enabled", false); +pref("social.share.activationPanelEnabled", false); +pref("social.shareDirectory", ""); +pref("social.toast-notifications.enabled", false); +pref("social.whitelist", ""); + // Fingerprinting pref("webgl.min_capability_mode", true); pref("webgl.disable-extensions", true);

1 0

[tor-browser-build/master] Allow changing logs directory using RBM_LOGS_DIR environment variable
by boklm＠torproject.org 11 May '17

11 May '17

commit 43276de96ca5907cd07d388d8027bf3210a9e067 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu May 11 17:38:02 2017 +0200 Allow changing logs directory using RBM_LOGS_DIR environment variable --- rbm.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rbm.conf b/rbm.conf index 969922c..ce70215 100644 --- a/rbm.conf +++ b/rbm.conf @@ -2,7 +2,7 @@ debug: '[% GET ! ENV.RBM_NO_DEBUG %]' compress_tar: gz output_dir: "out/[% project %]" -build_log: 'logs/[% project %]-[% c("var/osname") %].log' +build_log: '[% GET ENV.RBM_LOGS_DIR ? ENV.RBM_LOGS_DIR : "logs" %]/[% project %]-[% c("var/osname") %].log' pkg_type: build

1 0

[tor-browser-bundle/master] Bug 21779: Non-admin users can't access Tor Browser on macOS.
by gk＠torproject.org 10 May '17

10 May '17

commit f27d2cab4ed80a4c7b4f594b593b6b90f6148a82 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Wed May 10 15:14:05 2017 -0400 Bug 21779: Non-admin users can't access Tor Browser on macOS. Use chmod to grant permission for "other" to access files within TorBrowser.app. --- gitian/descriptors/mac/gitian-bundle.yml | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/gitian/descriptors/mac/gitian-bundle.yml b/gitian/descriptors/mac/gitian-bundle.yml index a2c8408..54ce237 100644 --- a/gitian/descriptors/mac/gitian-bundle.yml +++ b/gitian/descriptors/mac/gitian-bundle.yml @@ -303,7 +303,11 @@ script: | rm -f precomplete python $MARTOOLS/createprecomplete.py popd - # + + # Ensure that files and directories are accessible by non-admin users + # if the app bundle is placed in /Applications. See bug 21779. + chmod -R o+rX ~/build/$TORBROWSER_NAME.app + # Create full MAR file and disk image. MAR_FILE=tor-browser-osx${GBUILD_BITS}-${TORBROWSER_VERSION}_${PKG_LOCALE}.mar MAR=$MARTOOLS/mar MBSDIFF=$MARTOOLS/mbsdiff $MARTOOLS/make_full_update.sh -q $OUTDIR/$MAR_FILE ~/build/$TORBROWSER_NAME.app @@ -341,7 +345,12 @@ script: | rm -f precomplete python $MARTOOLS/createprecomplete.py popd - # + + # Ensure that files and directories are accessible by non-admin users + # if the app bundle is placed in /Applications. See bug 21779. + chmod -R o+rX ~/build/dmg/$DEST.app + + # Create full MAR file and disk image. MAR_FILE=tor-browser-osx${GBUILD_BITS}-${TORBROWSER_VERSION}_$LANG.mar MAR=$MARTOOLS/mar MBSDIFF=$MARTOOLS/mbsdiff $MARTOOLS/make_full_update.sh -q $OUTDIR/$MAR_FILE ~/build/dmg/$DEST.app # Rename the Japanese bundle to not confuse users

1 0

[tor-browser-bundle/master] Bug 21879: Use our default bookmarks on OSX.
by gk＠torproject.org 10 May '17

10 May '17

commit 57f088b981a0292d5370b3c56c6d7e5a18f95aca Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Wed May 10 11:59:39 2017 -0400 Bug 21879: Use our default bookmarks on OSX. Account for the changes Mozilla to support localized default bookmarks (see: https://bugzilla.mozilla.org/show_bug.cgi?id=1235107) Currently, Tor Browser uses the same bookmarks for all locales. --- gitian/descriptors/mac/gitian-bundle.yml | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/gitian/descriptors/mac/gitian-bundle.yml b/gitian/descriptors/mac/gitian-bundle.yml index 8c7bbfc..a2c8408 100644 --- a/gitian/descriptors/mac/gitian-bundle.yml +++ b/gitian/descriptors/mac/gitian-bundle.yml @@ -231,10 +231,11 @@ script: | unzip omni.ja defaults/preferences/000-tor-browser.js cp defaults/preferences/000-tor-browser.js ~/build/ if [ "z$DATA_OUTSIDE_APP_DIR" = "z1" ]; then - # Embed our default bookmarks. - mkdir -p defaults/profile/ - cp -p ~/build/bookmarks.html defaults/profile/ - zip -Xm omni.ja defaults/profile/bookmarks.html + # Embed our default bookmarks within the en-US locale. + mkdir -p chrome/en-US/locale/browser + cp -p ~/build/bookmarks.html chrome/en-US/locale/browser/ + zip -Xm omni.ja chrome/en-US/locale/browser/bookmarks.html + rm -rf chrome fi # Set the locale of the bundle. echo "pref(\"general.useragent.locale\", \"en-US\");" >> defaults/preferences/000-tor-browser.js @@ -260,8 +261,8 @@ script: | unzip mac-langpacks.zip MAC_LOCALES="$BUNDLE_LOCALES $BUNDLE_LOCALES_MAC" - # Prepare our language packs for using the proper search engines. See bug - # 18915 for more details. + # Prepare our language packs for using the proper search engines and embed + # our default bookmarks. See bugs 18915 and 21879 for more details. for LANG in $MAC_LOCALES do xpi=mac-langpacks/$LANG.xpi @@ -269,6 +270,7 @@ script: | search_plugins_path=prep_$LANG/browser/chrome/$LANG/locale/browser rm -rf $search_plugins_path/searchplugins cp -rf ~/build/searchplugins $search_plugins_path + cp ~/build/bookmarks.html prep_$LANG/browser/chrome/$LANG/locale/browser/ rm $xpi cd prep_$LANG ~/build/dzip.sh ../$xpi .

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] Bug 21569: Add first-party domain to Permissions key
by gk＠torproject.org 10 May '17

10 May '17

commit d8b12ca703cd530b5c7684be00d5979fb1543705 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Wed Apr 19 15:54:41 2017 -0700 Bug 21569: Add first-party domain to Permissions key --- .../originattributes/test/browser/browser.ini | 1 + .../test/browser/browser_permissions_isolation.js | 46 ++++++++++++++++++++++ caps/BasePrincipal.cpp | 24 ----------- caps/BasePrincipal.h | 4 -- dom/permission/PermissionStatus.cpp | 2 +- extensions/cookie/nsPermission.cpp | 4 +- extensions/cookie/nsPermissionManager.cpp | 9 ----- 7 files changed, 50 insertions(+), 40 deletions(-) diff --git a/browser/components/originattributes/test/browser/browser.ini b/browser/components/originattributes/test/browser/browser.ini index d503e9e..6de2ce9 100644 --- a/browser/components/originattributes/test/browser/browser.ini +++ b/browser/components/originattributes/test/browser/browser.ini @@ -70,3 +70,4 @@ support-files = [browser_clientAuth.js] [browser_cacheAPI.js] [browser_permissions.js] +[browser_permissions_isolation.js] diff --git a/browser/components/originattributes/test/browser/browser_permissions_isolation.js b/browser/components/originattributes/test/browser/browser_permissions_isolation.js new file mode 100644 index 0000000..0fd5355 --- /dev/null +++ b/browser/components/originattributes/test/browser/browser_permissions_isolation.js @@ -0,0 +1,46 @@ +/** + * Tor Bug 21569 - A test case for permissions isolation. + */ + +const TEST_PAGE = "http://mochi.test:8888/browser/browser/components/" + + "originattributes/test/browser/file_firstPartyBasic.html"; + +function* init() { + let permPromise = TestUtils.topicObserved("perm-changed"); + Services.perms.removeAll(); + info("called removeAll"); + yield permPromise; + info("cleared permissions for new test"); +} + +// Define the testing function +function* doTest(aBrowser) { + // Promise will result when permissions popup appears: + let popupShowPromise = BrowserTestUtils.waitForEvent(PopupNotifications.panel, "popupshown"); + let originalStatus = yield ContentTask.spawn(aBrowser, null, function* (key) { + let status = (yield content.navigator.permissions.query({name: "notifications"})).state; + content.Notification.requestPermission(); + return status; + }); + info(`originalStatus: '${originalStatus}'`); + if (originalStatus === "prompt") { + // Wait for the popup requesting permission to show notifications: + yield popupShowPromise; + let popupHidePromise = BrowserTestUtils.waitForEvent(PopupNotifications.panel, "popuphidden"); + let popupNotification = PopupNotifications.panel.childNodes[0]; + // Click to grant permission: + popupNotification.button.click(); + // Wait for popup to hide again. + yield popupHidePromise; + } + return originalStatus; +} + +add_task(function* () { + yield SpecialPowers.pushPrefEnv({ + set: [["dom.webnotifications.enabled", true]] + }); + IsolationTestTools.runTests(TEST_PAGE, doTest, + (isolated, val1, val2) => (isolated === ( val2 === "prompt")), + init, true); +}); diff --git a/caps/BasePrincipal.cpp b/caps/BasePrincipal.cpp index 836adcb..584cb41 100644 --- a/caps/BasePrincipal.cpp +++ b/caps/BasePrincipal.cpp @@ -61,13 +61,6 @@ PrincipalOriginAttributes::InheritFromNecko(const NeckoOriginAttributes& aAttrs) } void -PrincipalOriginAttributes::StripUserContextIdAndFirstPartyDomain() -{ - mUserContextId = nsIScriptSecurityManager::DEFAULT_USER_CONTEXT_ID; - mFirstPartyDomain.Truncate(); -} - -void DocShellOriginAttributes::InheritFromDocToChildDocShell(const PrincipalOriginAttributes& aAttrs) { mAppId = aAttrs.mAppId; @@ -727,23 +720,6 @@ BasePrincipal::CreateCodebasePrincipal(const nsACString& aOrigin) return BasePrincipal::CreateCodebasePrincipal(uri, attrs); } -already_AddRefed<BasePrincipal> -BasePrincipal::CloneStrippingUserContextIdAndFirstPartyDomain() -{ - PrincipalOriginAttributes attrs = OriginAttributesRef(); - attrs.StripUserContextIdAndFirstPartyDomain(); - - nsAutoCString originNoSuffix; - nsresult rv = GetOriginNoSuffix(originNoSuffix); - NS_ENSURE_SUCCESS(rv, nullptr); - - nsCOMPtr<nsIURI> uri; - rv = NS_NewURI(getter_AddRefs(uri), originNoSuffix); - NS_ENSURE_SUCCESS(rv, nullptr); - - return BasePrincipal::CreateCodebasePrincipal(uri, attrs); -} - bool BasePrincipal::AddonAllowsLoad(nsIURI* aURI) { diff --git a/caps/BasePrincipal.h b/caps/BasePrincipal.h index 4c9ad9c..963b6ab 100644 --- a/caps/BasePrincipal.h +++ b/caps/BasePrincipal.h @@ -107,8 +107,6 @@ public: // Inherit OriginAttributes from Necko. void InheritFromNecko(const NeckoOriginAttributes& aAttrs); - - void StripUserContextIdAndFirstPartyDomain(); }; // For OriginAttributes stored on docshells / loadcontexts / browsing contexts. @@ -311,8 +309,6 @@ public: virtual PrincipalKind Kind() = 0; - already_AddRefed<BasePrincipal> CloneStrippingUserContextIdAndFirstPartyDomain(); - protected: virtual ~BasePrincipal(); diff --git a/dom/permission/PermissionStatus.cpp b/dom/permission/PermissionStatus.cpp index 680ece1..850dcee 100644 --- a/dom/permission/PermissionStatus.cpp +++ b/dom/permission/PermissionStatus.cpp @@ -107,7 +107,7 @@ PermissionStatus::GetPrincipal() const } nsCOMPtr<nsIPrincipal> principal = - mozilla::BasePrincipal::Cast(doc->NodePrincipal())->CloneStrippingUserContextIdAndFirstPartyDomain(); + mozilla::BasePrincipal::Cast(doc->NodePrincipal()); NS_ENSURE_TRUE(principal, nullptr); return principal.forget(); diff --git a/extensions/cookie/nsPermission.cpp b/extensions/cookie/nsPermission.cpp index 3d1eb14..3dac32e 100644 --- a/extensions/cookie/nsPermission.cpp +++ b/extensions/cookie/nsPermission.cpp @@ -36,7 +36,7 @@ nsPermission::Create(nsIPrincipal* aPrincipal, { NS_ENSURE_TRUE(aPrincipal, nullptr); nsCOMPtr<nsIPrincipal> principal = - mozilla::BasePrincipal::Cast(aPrincipal)->CloneStrippingUserContextIdAndFirstPartyDomain(); + mozilla::BasePrincipal::Cast(aPrincipal); NS_ENSURE_TRUE(principal, nullptr); @@ -90,7 +90,7 @@ nsPermission::Matches(nsIPrincipal* aPrincipal, bool aExactHost, bool* aMatches) *aMatches = false; nsCOMPtr<nsIPrincipal> principal = - mozilla::BasePrincipal::Cast(aPrincipal)->CloneStrippingUserContextIdAndFirstPartyDomain(); + mozilla::BasePrincipal::Cast(aPrincipal); if (!principal) { *aMatches = false; diff --git a/extensions/cookie/nsPermissionManager.cpp b/extensions/cookie/nsPermissionManager.cpp index d3696dd..860531b 100644 --- a/extensions/cookie/nsPermissionManager.cpp +++ b/extensions/cookie/nsPermissionManager.cpp @@ -122,9 +122,6 @@ GetOriginFromPrincipal(nsIPrincipal* aPrincipal, nsACString& aOrigin) // any knowledge of private browsing. Allowing it to be true changes the suffix being hashed. attrs.mPrivateBrowsingId = 0; - // Disable userContext and firstParty isolation for permissions. - attrs.StripUserContextIdAndFirstPartyDomain(); - attrs.CreateSuffix(suffix); aOrigin.Append(suffix); return NS_OK; @@ -139,9 +136,6 @@ GetPrincipalFromOrigin(const nsACString& aOrigin, nsIPrincipal** aPrincipal) return NS_ERROR_FAILURE; } - // Disable userContext and firstParty isolation for permissions. - attrs.StripUserContextIdAndFirstPartyDomain(); - nsCOMPtr<nsIURI> uri; nsresult rv = NS_NewURI(getter_AddRefs(uri), originNoSuffix); NS_ENSURE_SUCCESS(rv, rv); @@ -2201,9 +2195,6 @@ nsPermissionManager::GetPermissionHashKey(nsIPrincipal* aPrincipal, mozilla::PrincipalOriginAttributes attrs = mozilla::BasePrincipal::Cast(aPrincipal)->OriginAttributesRef(); - // Disable userContext and firstParty isolation for permissions. - attrs.StripUserContextIdAndFirstPartyDomain(); - nsCOMPtr<nsIPrincipal> principal = mozilla::BasePrincipal::CreateCodebasePrincipal(newURI, attrs);

1 0

[tor-browser-bundle/master] Stop our multi lingual experiment on nightlies
by gk＠torproject.org 10 May '17

10 May '17

commit db5cdfceb8fa095ad94eb9a413a35d30ccc60486 Author: Georg Koppen <gk(a)torproject.org> Date: Wed May 10 07:48:17 2017 +0000 Stop our multi lingual experiment on nightlies We are not showing the language prompt on first start anymore. Thus, the multi lingual setup has stopped working for nightlies. We remove that experiment until we solve #17400 properly or have a new prototype to try. --- gitian/versions.nightly | 4 ---- 1 file changed, 4 deletions(-) diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 533aead..2189139 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -11,10 +11,6 @@ BUILD_PT_BUNDLES=1 # DATA_OUTSIDE_APP_DIR is only implemented for Mac OS. DATA_OUTSIDE_APP_DIR=1 -# If you remove MULTI_LINGUAL=1, be sure to use a version of Tor Launcher -# that does not include the language prompt. -MULTI_LINGUAL=1 - VERIFY_TAGS=0 FIREFOX_VERSION=52.1.0esr

1 0

[tor-browser-bundle/master] Bug 20683: Use signed selfrando tag from now on
by gk＠torproject.org 10 May '17

10 May '17

commit 8fe0e322b950efa2456502428bee66dde8b4948a Author: Georg Koppen <gk(a)torproject.org> Date: Wed May 10 08:05:28 2017 +0000 Bug 20683: Use signed selfrando tag from now on --- gitian/gpg/selfrando.gpg | Bin 0 -> 2759 bytes gitian/verify-tags.sh | 2 +- gitian/versions.alpha | 2 +- gitian/versions.nightly | 2 +- 4 files changed, 3 insertions(+), 3 deletions(-) diff --git a/gitian/gpg/selfrando.gpg b/gitian/gpg/selfrando.gpg new file mode 100644 index 0000000..276955d Binary files /dev/null and b/gitian/gpg/selfrando.gpg differ diff --git a/gitian/verify-tags.sh b/gitian/verify-tags.sh index 7d551b8..123719d 100755 --- a/gitian/verify-tags.sh +++ b/gitian/verify-tags.sh @@ -105,6 +105,7 @@ obfs4 obfs4proxy.gpg $OBFS4_TAG https-everywhere https-everywhere.gpg $HTTPSE_TAG cmake cmake.gpg $CMAKE_TAG sandbox obfs4proxy.gpg $SANDBOX_TAG +selfrando selfrando.gpg $SELFRANDO_TAG EOF while read dir commit; do @@ -125,7 +126,6 @@ depot_tools $DEPOT_TOOLS_TAG go-webrtc $GO_WEBRTC_TAG snowflake $SNOWFLAKE_TAG uniuri $UNIURI_TAG -selfrando $SELFRANDO_TAG EOF # Verify signatures on signed packages diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 33be86d..063ce76 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -47,7 +47,7 @@ WEBRTC_TAG=c279861207c5b15fc51069e96595782350e0ac12 # https://chromium.googlesou GO_WEBRTC_TAG=ab1b64862e0c4b4182010699911c2c5818f0a101 SNOWFLAKE_TAG=9f2e9a6ecb696149708716ca06ce842df03cf492 UNIURI_TAG=8902c56451e9b58ff940bbe5fec35d5f9c04584a -SELFRANDO_TAG=aa4130fe9d782ff7ef581555ef3470663b110bdb +SELFRANDO_TAG=tb-v0.2 GITIAN_TAG=tor-browser-builder-4-4 diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 69ddb47..533aead 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -54,7 +54,7 @@ WEBRTC_TAG=c279861207c5b15fc51069e96595782350e0ac12 # https://chromium.googlesou GO_WEBRTC_TAG=master SNOWFLAKE_TAG=master UNIURI_TAG=master -SELFRANDO_TAG=aa4130fe9d782ff7ef581555ef3470663b110bdb +SELFRANDO_TAG=tb-v0.2 GITIAN_TAG=tor-browser-builder-4

1 0

[tor-browser-bundle/master] Bug 20683: Bump elfutils version as well
by gk＠torproject.org 10 May '17

10 May '17

commit 3e752843dfa39beec844822c9f6c3dd1f80355ea Author: Georg Koppen <gk(a)torproject.org> Date: Wed May 10 07:37:19 2017 +0000 Bug 20683: Bump elfutils version as well --- gitian/versions.alpha | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 063ce76..2179f8d 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -72,7 +72,7 @@ GO14_VER=1.4.3 GO_VER=1.8.1 NSIS_VER=2.51 YASM_VER=1.2.0 -ELFUTILS_VER=0.160 +ELFUTILS_VER=0.166 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! Omnibox: Add DDG, Startpage, Disconnect, Youtube, Twitter;
by gk＠torproject.org 10 May '17

10 May '17

commit e6b99c78fdc1800988537c73ef13e75b56c28b3e Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue May 9 15:29:43 2017 -0400 fixup! Omnibox: Add DDG, Startpage, Disconnect, Youtube, Twitter; remove Amazon, eBay, bing. Use a data: URL for the browser.search.defaultenginename preference value so that the value is used when setting the default search engine. Fixes bug #22044. --- browser/app/profile/000-tor-browser.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 27cfe53..d422694 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -267,7 +267,7 @@ pref("browser.uiCustomization.state", "{\"placements\":{\"PanelUI-contents\":[\" // Putting the search engine prefs into this file to fix #11236. // Default search engine -pref("browser.search.defaultenginename", "DuckDuckGo"); +pref("browser.search.defaultenginename", "data:text/plain,browser.search.defaultenginename=DuckDuckGo"); // Make sure we use the same search engine regardless of locale pref("browser.search.geoSpecificDefaults", false);

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] Bug 16337: Round times exposed by Animation API to nearest 100ms
by gk＠torproject.org 10 May '17

10 May '17

commit 77f0de013fa2b5bedb851507f5ec94a8f39f8b8c Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Wed May 3 23:47:53 2017 -0700 Bug 16337: Round times exposed by Animation API to nearest 100ms --- dom/animation/AnimationUtils.h | 3 +- dom/animation/test/mochitest.ini | 1 + .../test/test_animation_time_rounding.html | 43 ++++++++++++++++++++++ 3 files changed, 46 insertions(+), 1 deletion(-) diff --git a/dom/animation/AnimationUtils.h b/dom/animation/AnimationUtils.h index 82ae69b..e20f314 100644 --- a/dom/animation/AnimationUtils.h +++ b/dom/animation/AnimationUtils.h @@ -28,7 +28,8 @@ public: dom::Nullable<double> result; if (!aTime.IsNull()) { - result.SetValue(aTime.Value().ToMilliseconds()); + double unrounded = aTime.Value().ToMilliseconds(); + result.SetValue(floor(unrounded / 100) * 100); } return result; diff --git a/dom/animation/test/mochitest.ini b/dom/animation/test/mochitest.ini index feb4245..49d230c 100644 --- a/dom/animation/test/mochitest.ini +++ b/dom/animation/test/mochitest.ini @@ -109,3 +109,4 @@ skip-if = toolkit == 'android' [style/test_animation-seeking-with-start-time.html] [style/test_animation-setting-effect.html] [style/test_animation-setting-spacing.html] +[test_animation_time_rounding.html] diff --git a/dom/animation/test/test_animation_time_rounding.html b/dom/animation/test/test_animation_time_rounding.html new file mode 100644 index 0000000..baad593 --- /dev/null +++ b/dom/animation/test/test_animation_time_rounding.html @@ -0,0 +1,43 @@ +<!DOCTYPE HTML> +<html> +  + <head> + <meta charset="utf-8"> + <title>Test for Tor Bug 16337</title> + <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/> + </head> + <body> + <div id="testDiv">test</div> + <script type="application/javascript"> + SimpleTest.waitForExplicitFinish(); + let runTest = async function () { + await SpecialPowers.pushPrefEnv({ set: [["dom.animations-api.core.enabled", true]] }); + let isRounded = x => (Math.floor(x/100)*100) === x; + let testDiv = document.getElementById("testDiv"); + let animation = testDiv.animate({ opacity: [0,1] }, 100000); + animation.play(); + SimpleTest.waitForCondition( + () => animation.currentTime > 1000, + function () { + ok(isRounded(animation.startTime), + "animation.startTime is rounded"); + ok(isRounded(animation.currentTime), + "animation.currentTime is rounded"); + ok(isRounded(animation.timeline.currentTime), + "animation.timeline.currentTime is rounded"); + if (document.timeline) { + ok(isRounded(document.timeline.currentTime), + "document.timeline.currentTime is rounded"); + } + SimpleTest.finish(); + }, + "animation failed to start"); + } + + window.onload = runTest; + </script> + </body> +</html>

1 0

[tor-browser-bundle/master] Bug 20683: Integrate Selfrando into alpha Linux builds
by gk＠torproject.org 08 May '17

08 May '17

commit 332c5b6c16f1b0915f537a4ad5af48295f80c733 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Apr 25 11:20:53 2017 +0000 Bug 20683: Integrate Selfrando into alpha Linux builds Selfrando is a new defense against code reuse attacks developed by the Redactor and Readactor++ people. We should give it a wider testing audience by including it in the alpha series. This is currently only available for 64bit Linux builds, though. Supporting other platforms and architectures is work in progress. --- RelativeLink/start-tor-browser | 1 + gitian/descriptors/linux/gitian-firefox.yml | 17 +++++ gitian/descriptors/linux/gitian-utils.yml | 46 +++++++++++++ gitian/fetch-inputs.sh | 4 +- gitian/gpg/ELFUTILS.gpg | Bin 0 -> 10483 bytes gitian/mkbundle-linux.sh | 13 ++-- gitian/patches/binutils-224-gold.patch | 98 ++++++++++++++++++++++++++++ gitian/verify-tags.sh | 3 +- gitian/versions.alpha | 4 ++ gitian/versions.nightly | 4 ++ 10 files changed, 183 insertions(+), 7 deletions(-) diff --git a/RelativeLink/start-tor-browser b/RelativeLink/start-tor-browser index a78b367..2dd40fc 100755 --- a/RelativeLink/start-tor-browser +++ b/RelativeLink/start-tor-browser @@ -270,6 +270,7 @@ fi LD_LIBRARY_PATH="${HOME}/TorBrowser/Tor/" export LD_LIBRARY_PATH +export SELFRANDO_write_layout_file= function setControlPortPasswd() { local ctrlPasswd=$1 diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index c9ced44..db4f232 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -27,6 +27,8 @@ reference_datetime: "2000-01-01 00:00:00" remotes: - "url": "https://git.torproject.org/tor-browser.git" "dir": "tor-browser" +- "url": "https://github.com/immunant/selfrando.git" + "dir": "selfrando" files: - "binutils-linux32-utils.zip" - "binutils-linux64-utils.zip" @@ -36,6 +38,8 @@ files: - "re-dzip.sh" - "dzip.sh" - "versions" +# XXX: 64bits only for now :(, see #20683. +- "selfrando-linux64-utils.zip" script: | source versions INSTDIR="$HOME/install" @@ -53,6 +57,11 @@ script: | export DEB_BUILD_HARDENING_FORMAT=1 export DEB_BUILD_HARDENING_PIE=1 # + # XXX: 64bits only for now :(, see #20683. + if [ $GBUILD_BITS == "64" ]; + then + unzip -d $INSTDIR selfrando-linux64-utils.zip + fi # Preparing Binutils and GCC for Tor Browser unzip -d $INSTDIR binutils-linux$GBUILD_BITS-utils.zip # Make sure gold is used with the hardening wrapper for full RELRO, see @@ -94,6 +103,14 @@ script: | find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" rm -f configure rm -f js/src/configure + # XXX: 64bits only for now :(, see #20683. + if [ $GBUILD_BITS == "64" ]; + then + # Selfrando wrapper + export PATH="$HOME/build/selfrando/Tools/TorBrowser/tc-wrapper/:$PATH" + # We need to avoid the shuffling while building as this breaks compilation + export SELFRANDO_skip_shuffle= + fi make -f client.mk configure CONFIGURE_ARGS="--with-tor-browser-version=${TORBROWSER_VERSION} --with-distribution-id=org.torproject --enable-update-channel=${TORBROWSER_UPDATE_CHANNEL} --enable-bundled-fonts" find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" make $MAKEOPTS -f client.mk build diff --git a/gitian/descriptors/linux/gitian-utils.yml b/gitian/descriptors/linux/gitian-utils.yml index d10422b..eb340b8 100644 --- a/gitian/descriptors/linux/gitian-utils.yml +++ b/gitian/descriptors/linux/gitian-utils.yml @@ -24,10 +24,14 @@ packages: - "libssl-dev" # Needed for binutils (64bit) as we are building with PIE enabled. - "libstdc++6-4.7-pic" +# Needed for Selfrando +- "scons" reference_datetime: "2000-01-01 00:00:00" remotes: - "url": "https://github.com/libevent/libevent.git" "dir": "libevent" +- "url": "https://github.com/immunant/selfrando.git" + "dir": "selfrando" files: - "binutils.tar.bz2" - "gcc.tar.bz2" @@ -37,6 +41,8 @@ files: - "go.tar.gz" - "versions" - "dzip.sh" +- "elfutils.tar.bz2" +- "binutils-224-gold.patch" script: | INSTDIR="$HOME/install" source versions @@ -52,6 +58,12 @@ script: | export DEB_BUILD_HARDENING_FORMAT=1 export DEB_BUILD_HARDENING_PIE=1 + ARCH="" + if [ $GBUILD_BITS == "64" ]; + then + ARCH="64" + fi + # Building Binutils tar xjf binutils.tar.bz2 # The libstdc++ shipped by default is non-PIC which breaks the binutils build @@ -63,6 +75,13 @@ script: | export LDFLAGS="-L/home/debian -lstdc++" fi cd binutils* + # We need to work around a gold linker bug in 2.24 to get selfrando working, + # see bug 20683. + # XXX: 64bits only for now :(, see #20683. + if [ $GBUILD_BITS == "64" ]; + then + patch -p1 < ../binutils-224-gold.patch + fi # We want to use gold as the linker in our toolchain mainly as it is way # faster when linking Tor Browser code (especially libxul). But apart from # that it fixes #12103 and issues with ESR 31 and our Gitian setup as well @@ -86,6 +105,28 @@ script: | cd .. export DEB_BUILD_HARDENING_FORMAT=1 + export PATH="$INSTDIR/binutils/bin:$INSTDIR/gcc/bin:$PATH" + export LD_LIBRARY_PATH="$INSTDIR/gcc/lib$ARCH" + + # XXX: 64bits only for now :(, see #20683. + if [ $GBUILD_BITS == "64" ]; + then + # Building Elfutils + tar xjf elfutils.tar.bz2 + cd elfutils*/ + ./configure --prefix=$INSTDIR/elfutils + make $MAKEOPTS + make install + cd .. + + # Building Selfrando + cd selfrando + scons -Q arch=x86_64 LIBELF_PATH="$INSTDIR/elfutils" FORCE_INPLACE=1 DEBUG_LEVEL=env WRITE_LAYOUTS=env LOG=console + mkdir -p $INSTDIR/selfrando + cp out/x86_64/bin/* $INSTDIR/selfrando/ + cd .. + fi + # Building Libevent cd libevent ./autogen.sh @@ -157,4 +198,9 @@ script: | ~/build/dzip.sh libevent-${LIBEVENT_TAG#release-}-linux$GBUILD_BITS-utils.zip libevent ~/build/dzip.sh gmp-$GMP_VER-linux$GBUILD_BITS-utils.zip gmp ~/build/dzip.sh go-$GO_VER-linux$GBUILD_BITS-utils.zip go + # XXX: 64bits only for now :(, see #20683. + if [ $GBUILD_BITS == "64" ]; + then + ~/build/dzip.sh selfrando-$SELFRANDO_TAG-linux$GBUILD_BITS-utils.zip selfrando + fi cp *utils.zip $OUTDIR/ diff --git a/gitian/fetch-inputs.sh b/gitian/fetch-inputs.sh index b7fcf36..c110eb8 100755 --- a/gitian/fetch-inputs.sh +++ b/gitian/fetch-inputs.sh @@ -113,7 +113,7 @@ update_git() { ############################################################################## # Get+verify sigs that exist -for i in OPENSSL BINUTILS GCC PYTHON_MSI GMP LLVM CFE LIBCXX LIBCXXABI +for i in OPENSSL BINUTILS GCC PYTHON_MSI GMP LLVM CFE LIBCXX LIBCXXABI ELFUTILS do PACKAGE="${i}_PACKAGE" URL="${i}_URL" @@ -252,6 +252,7 @@ ln -sf "$GO_PACKAGE" go.tar.gz ln -sf "$NSIS_PACKAGE" nsis.tar.bz2 ln -sf "$NSIS_DEBIAN_PACKAGE" nsis-debian.tar.xz ln -sf "$YASM_PACKAGE" yasm.tar.gz +ln -sf "$ELFUTILS_PACKAGE" elfutils.tar.bz2 # Fetch latest gitian-builder itself # XXX - this is broken if a non-standard inputs dir is selected using the command line flag. @@ -303,6 +304,7 @@ depot_tools https://chromium.googlesource.com/chromium/tools/depot_too go-webrtc https://github.com/keroserene/go-webrtc $GO_WEBRTC_TAG snowflake https://git.torproject.org/pluggable-transports/snowflake.git $SNOWFLAKE_TAG uniuri https://github.com/dchest/uniuri $UNIURI_TAG +selfrando https://github.com/immunant/selfrando.git $SELFRANDO_TAG EOF # HTTPS-Everywhere is special, too. We need to initialize the git submodules and diff --git a/gitian/gpg/ELFUTILS.gpg b/gitian/gpg/ELFUTILS.gpg new file mode 100644 index 0000000..f1cd4b3 Binary files /dev/null and b/gitian/gpg/ELFUTILS.gpg differ diff --git a/gitian/mkbundle-linux.sh b/gitian/mkbundle-linux.sh index 6dbbe51..0a1613f 100755 --- a/gitian/mkbundle-linux.sh +++ b/gitian/mkbundle-linux.sh @@ -35,7 +35,7 @@ fi if [ -z "$VM_MEMORY" ]; then - export VM_MEMORY=4000 + export VM_MEMORY=6000 fi ./make-vms.sh @@ -99,7 +99,7 @@ then fi cd $GITIAN_DIR - +# XXX: 64bits selfrando only for now :(, see #20683. if [ ! -f inputs/binutils-$BINUTILS_VER-linux32-utils.zip -o \ ! -f inputs/binutils-$BINUTILS_VER-linux64-utils.zip -o \ ! -f inputs/gcc-$GCC_VER-linux32-utils.zip -o \ @@ -111,13 +111,14 @@ if [ ! -f inputs/binutils-$BINUTILS_VER-linux32-utils.zip -o \ ! -f inputs/gmp-$GMP_VER-linux32-utils.zip -o \ ! -f inputs/gmp-$GMP_VER-linux64-utils.zip -o \ ! -f inputs/go-$GO_VER-linux32-utils.zip -o \ - ! -f inputs/go-$GO_VER-linux64-utils.zip ]; + ! -f inputs/go-$GO_VER-linux64-utils.zip -o \ + ! -f inputs/selfrando-$SELFRANDO_TAG-linux64-utils.zip ]; then echo echo "****** Starting Utilities Component of Linux Bundle (1/7 for Linux) ******" echo - ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit libevent=$LIBEVENT_TAG $DESCRIPTOR_DIR/linux/gitian-utils.yml + ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit libevent=$LIBEVENT_TAG,selfrando=$SELFRANDO_TAG $DESCRIPTOR_DIR/linux/gitian-utils.yml if [ $? -ne 0 ]; then #mv var/build.log ./utils-fail-linux.log.`date +%Y%m%d%H%M%S` @@ -138,6 +139,7 @@ then ln -sf gmp-$GMP_VER-linux64-utils.zip gmp-linux64-utils.zip ln -sf go-$GO_VER-linux32-utils.zip go-linux32-utils.zip ln -sf go-$GO_VER-linux64-utils.zip go-linux64-utils.zip + ln -sf selfrando-$SELFRANDO_TAG-linux64-utils.zip selfrando-linux64-utils.zip cd .. #cp -a result/utils-linux-res.yml inputs/ else @@ -159,6 +161,7 @@ else ln -sf gmp-$GMP_VER-linux64-utils.zip gmp-linux64-utils.zip ln -sf go-$GO_VER-linux32-utils.zip go-linux32-utils.zip ln -sf go-$GO_VER-linux64-utils.zip go-linux64-utils.zip + ln -sf selfrando-$SELFRANDO_TAG-linux64-utils.zip selfrando-linux64-utils.zip cd .. fi @@ -193,7 +196,7 @@ then echo "****** Starting TorBrowser Component of Linux Bundle (3/7 for Linux) ******" echo - ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit tor-browser=$TORBROWSER_TAG,faketime=$FAKETIME_TAG $DESCRIPTOR_DIR/linux/gitian-firefox.yml + ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit tor-browser=$TORBROWSER_TAG,faketime=$FAKETIME_TAG,selfrando=$SELFRANDO_TAG $DESCRIPTOR_DIR/linux/gitian-firefox.yml if [ $? -ne 0 ]; then #mv var/build.log ./firefox-fail-linux.log.`date +%Y%m%d%H%M%S` diff --git a/gitian/patches/binutils-224-gold.patch b/gitian/patches/binutils-224-gold.patch new file mode 100644 index 0000000..a45e49c --- /dev/null +++ b/gitian/patches/binutils-224-gold.patch @@ -0,0 +1,98 @@ +From f984741df04cd68bb116073fdfa9405808810ab4 Mon Sep 17 00:00:00 2001 +From: Cary Coutant <ccoutant(a)google.com> +Date: Wed, 5 Feb 2014 22:59:02 -0800 +Subject: [PATCH] Fix issues with gold undefined symbol diagnostics. + +PR binutils/15435 complains that gold issues a visibility error for an +weak undefined symbol with hidden visibility. The message should be +suppressed if the symbol is a weak undef. + +An earlier patch to add an extra note about key functions when a class's +vtable symbol is undefined missed a case where the reference to the +vtable came from a shared library. This patch moves the check to a +lower-level routine that catches both cases. + +gold/ + +2014-02-05 Cary Coutant <ccoutant(a)google.com> + + * errors.cc (Errors::undefined_symbol): Move undef vtable symbol + check to here. + * target-reloc.h (is_strong_undefined): New function. + (relocate_section): Move undef vtable symbol check from here. + Check for is_strong_undefined. + +diff --git a/gold/ChangeLog b/gold/ChangeLog +index dcf7ed41f8..dd7ef72980 100644 +--- a/gold/ChangeLog ++++ b/gold/ChangeLog +@@ -1,3 +1,14 @@ ++2014-02-05 Cary Coutant <ccoutant(a)google.com> ++ ++ Fix issues with gold undefined symbol diagnostics. ++ ++ PR binutils/15435 ++ * errors.cc (Errors::undefined_symbol): Move undef vtable symbol ++ check to here. ++ * target-reloc.h (is_strong_undefined): New function. ++ (relocate_section): Move undef vtable symbol check from here. ++ Check for is_strong_undefined. ++ + 2013-11-22 Cary Coutant <ccoutant(a)google.com> + + * testsuite/Makefile.am (exception_x86_64_bnd_test): Use in-tree +diff --git a/gold/errors.cc b/gold/errors.cc +index b79764bd1d..98db0fdd86 100644 +--- a/gold/errors.cc ++++ b/gold/errors.cc +@@ -193,6 +193,11 @@ Errors::undefined_symbol(const Symbol* sym, const std::string& location) + fprintf(stderr, + _("%s: %s: undefined reference to '%s', version '%s'\n"), + location.c_str(), zmsg, sym->demangled_name().c_str(), version); ++ ++ if (sym->is_cxx_vtable()) ++ gold_info(_("%s: the vtable symbol may be undefined because " ++ "the class is missing its key function"), ++ program_name); + } + + // Issue a debugging message. +diff --git a/gold/target-reloc.h b/gold/target-reloc.h +index b544c78f37..d609bcbaa8 100644 +--- a/gold/target-reloc.h ++++ b/gold/target-reloc.h +@@ -144,6 +144,12 @@ class Default_comdat_behavior + } + }; + ++inline bool ++is_strong_undefined(const Symbol* sym) ++{ ++ return sym->is_undefined() && sym->binding() != elfcpp::STB_WEAK; ++} ++ + // Give an error for a symbol with non-default visibility which is not + // defined locally. + +@@ -411,16 +417,10 @@ relocate_section( + } + + if (issue_undefined_symbol_error(sym)) +- { +- gold_undefined_symbol_at_location(sym, relinfo, i, offset); +- if (sym->is_cxx_vtable()) +- gold_info(_("%s: the vtable symbol may be undefined because " +- "the class is missing its key function"), +- program_name); +- } ++ gold_undefined_symbol_at_location(sym, relinfo, i, offset); + else if (sym != NULL + && sym->visibility() != elfcpp::STV_DEFAULT +- && (sym->is_undefined() || sym->is_from_dynobj())) ++ && (is_strong_undefined(sym) || sym->is_from_dynobj())) + visibility_error(sym); + + if (sym != NULL && sym->has_warning()) +-- +2.11.0 + diff --git a/gitian/verify-tags.sh b/gitian/verify-tags.sh index dc207f5..7d551b8 100755 --- a/gitian/verify-tags.sh +++ b/gitian/verify-tags.sh @@ -125,10 +125,11 @@ depot_tools $DEPOT_TOOLS_TAG go-webrtc $GO_WEBRTC_TAG snowflake $SNOWFLAKE_TAG uniuri $UNIURI_TAG +selfrando $SELFRANDO_TAG EOF # Verify signatures on signed packages -for i in OPENSSL BINUTILS GCC PYTHON_MSI GMP LLVM CFE LIBCXX LIBCXXABI +for i in OPENSSL BINUTILS GCC PYTHON_MSI GMP LLVM CFE LIBCXX LIBCXXABI ELFUTILS do PACKAGE="${i}_PACKAGE" URL="${i}_URL" diff --git a/gitian/versions.alpha b/gitian/versions.alpha index adb9dbf..33be86d 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -47,6 +47,7 @@ WEBRTC_TAG=c279861207c5b15fc51069e96595782350e0ac12 # https://chromium.googlesou GO_WEBRTC_TAG=ab1b64862e0c4b4182010699911c2c5818f0a101 SNOWFLAKE_TAG=9f2e9a6ecb696149708716ca06ce842df03cf492 UNIURI_TAG=8902c56451e9b58ff940bbe5fec35d5f9c04584a +SELFRANDO_TAG=aa4130fe9d782ff7ef581555ef3470663b110bdb GITIAN_TAG=tor-browser-builder-4-4 @@ -71,6 +72,7 @@ GO14_VER=1.4.3 GO_VER=1.8.1 NSIS_VER=2.51 YASM_VER=1.2.0 +ELFUTILS_VER=0.160 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz @@ -105,6 +107,7 @@ NOTOKRFONT_PACKAGE=NotoSansKR-Regular.otf NOTOSCFONT_PACKAGE=NotoSansSC-Regular.otf NOTOTCFONT_PACKAGE=NotoSansTC-Regular.otf YASM_PACKAGE=yasm-${YASM_VER}.tar.gz +ELFUTILS_PACKAGE=elfutils-${ELFUTILS_VER}.tar.bz2 # Hashes for packages with weak sigs or no sigs OPENSSL_HASH=6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 @@ -167,3 +170,4 @@ NOTOKRFONT_URL=${NOTOCJKBASE_URL}/${NOTOKRFONT_PACKAGE} NOTOSCFONT_URL=${NOTOCJKBASE_URL}/${NOTOSCFONT_PACKAGE} NOTOTCFONT_URL=${NOTOCJKBASE_URL}/${NOTOTCFONT_PACKAGE} YASM_URL=https://www.tortall.net/projects/yasm/releases/${YASM_PACKAGE} +ELFUTILS_URL=https://sourceware.org/elfutils/ftp/${ELFUTILS_VER}/${ELFUTILS_PACKAGE} diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 4e1618c..69ddb47 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -54,6 +54,7 @@ WEBRTC_TAG=c279861207c5b15fc51069e96595782350e0ac12 # https://chromium.googlesou GO_WEBRTC_TAG=master SNOWFLAKE_TAG=master UNIURI_TAG=master +SELFRANDO_TAG=aa4130fe9d782ff7ef581555ef3470663b110bdb GITIAN_TAG=tor-browser-builder-4 @@ -78,6 +79,7 @@ GO14_VER=1.4.3 GO_VER=1.8.1 NSIS_VER=2.51 YASM_VER=1.2.0 +ELFUTILS_VER=0.166 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz @@ -112,6 +114,7 @@ NOTOKRFONT_PACKAGE=NotoSansKR-Regular.otf NOTOSCFONT_PACKAGE=NotoSansSC-Regular.otf NOTOTCFONT_PACKAGE=NotoSansTC-Regular.otf YASM_PACKAGE=yasm-${YASM_VER}.tar.gz +ELFUTILS_PACKAGE=elfutils-${ELFUTILS_VER}.tar.bz2 # Hashes for packages with weak sigs or no sigs OPENSSL_HASH=6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 @@ -174,3 +177,4 @@ NOTOKRFONT_URL=${NOTOCJKBASE_URL}/${NOTOKRFONT_PACKAGE} NOTOSCFONT_URL=${NOTOCJKBASE_URL}/${NOTOSCFONT_PACKAGE} NOTOTCFONT_URL=${NOTOCJKBASE_URL}/${NOTOTCFONT_PACKAGE} YASM_URL=https://www.tortall.net/projects/yasm/releases/${YASM_PACKAGE} +ELFUTILS_URL=https://sourceware.org/elfutils/ftp/${ELFUTILS_VER}/${ELFUTILS_PACKAGE}

1 0

[tor-browser-build/master] Bug 22115: use i386 containers for the win32 build
by boklm＠torproject.org 08 May '17

08 May '17

commit bb32ec91b538ab17d309b645787149ff376d58e9 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon May 8 18:44:29 2017 +0200 Bug 22115: use i386 containers for the win32 build --- projects/firefox/build | 1 + projects/gcc/config | 3 +++ projects/mingw-w64/config | 1 + projects/tor-browser/build | 13 ------------- projects/tor-browser/config | 12 ++---------- rbm.conf | 8 +++++++- 6 files changed, 14 insertions(+), 24 deletions(-) diff --git a/projects/firefox/build b/projects/firefox/build index 1cf9be1..f445454 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -1,4 +1,5 @@ #!/bin/bash +[% c("var/setarch") -%] [% c("var/set_default_env") -%] [% IF c("var/windows") -%] mkdir -p /var/tmp/dist diff --git a/projects/gcc/config b/projects/gcc/config index 676d1fb..d740a93 100644 --- a/projects/gcc/config +++ b/projects/gcc/config @@ -38,6 +38,9 @@ targets: windows-i686: var: configure_opt: --disable-multilib --enable-languages=c,c++ + arch_deps: + - libc6-dev + - zlib1g-dev linux-i686: var: configure_opt: --enable-multilib --enable-languages=c,c++ --with-system-zlib diff --git a/projects/mingw-w64/config b/projects/mingw-w64/config index 21d498a..5e2c748 100644 --- a/projects/mingw-w64/config +++ b/projects/mingw-w64/config @@ -13,6 +13,7 @@ var: - libmpc-dev - g++-mingw-w64-i686 setup: | + [% c("var/setarch") -%] mkdir -p /var/tmp/dist tar -C /var/tmp/dist -xf [% c("compiler_tarfile") %] export PATH="/var/tmp/dist/mingw-w64/helpers:/var/tmp/dist/mingw-w64/bin:$PATH" diff --git a/projects/tor-browser/build b/projects/tor-browser/build index 7134367..084ec7d 100644 --- a/projects/tor-browser/build +++ b/projects/tor-browser/build @@ -201,19 +201,6 @@ popd [% IF c("var/windows") %] - # We need to install a recent version of python-pefile so that it works - # in a x86_64 container: - # https://github.com/TheTorProject/tor-messenger-build/pull/10 - tar xf $rootdir/[% c('input_files_by_name/python-future') %] - cd $(echo [% c('input_files_by_name/python-future') %] | sed s/\.tar\.gz$//) - python setup.py install --user - cd .. - - tar xf $rootdir/[% c('input_files_by_name/python-pefile') %] - cd $(echo [% c('input_files_by_name/python-pefile') %] | sed s/\.tar\.gz$//) - python setup.py install --user - cd .. - tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/nsis') %] export PATH="/var/tmp/dist/nsis/bin:$PATH" diff --git a/projects/tor-browser/config b/projects/tor-browser/config index c4c2521..805d7b6 100644 --- a/projects/tor-browser/config +++ b/projects/tor-browser/config @@ -27,8 +27,8 @@ targets: windows-i686: var: mar_osname: win32 - container: - suite: utopic + arch_deps: + - python-pefile input_files: - project: container-image @@ -70,11 +70,3 @@ input_files: enable: '[% c("var/windows") %]' - filename: pe_checksum_fix.py enable: '[% c("var/windows") %]' - - name: python-future - URL: https://pypi.python.org/packages/00/2b/8d082ddfed935f3608cc61140df6dcbf0ede… - sha256sum: e39ced1ab767b5936646cedba8bcce582398233d6a627067d4c6a454c90cfedb - enable: '[% c("var/windows") %]' - - name: python-pefile - URL: https://pypi.python.org/packages/92/c0/8589ce9734ffdba258bd3e5acd4afb2e3586… - sha256sum: f24021085b5c3ef7b0898bb1f1d93eecd3839e03512769e22b0c5a10d9095f7b - enable: '[% c("var/windows") %]' diff --git a/rbm.conf b/rbm.conf index 2060132..969922c 100644 --- a/rbm.conf +++ b/rbm.conf @@ -153,7 +153,7 @@ targets: osname: windows-i686 container: suite: precise - arch: amd64 + arch: i386 configure_opt: '--host=i686-w64-mingw32 CFLAGS="[% c("var/CFLAGS") %]" LDFLAGS="[% c("var/LDFLAGS") %]"' CFLAGS: '[% c("var/flag_mwindows") %] -fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security' LDFLAGS: '[% c("var/flag_mwindows") %] -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$gcclibs' @@ -168,6 +168,12 @@ targets: - zip - unzip faketime_path: /usr/lib/faketime/libfaketime.so.1 + setarch: | + if test -z "$RBM_SETARCH" + then + export RBM_SETARCH=1 + exec setarch i686 ./build + fi torbrowser-osx-x86_64: - osx-x86_64

1 0

[tor-browser-build/master] Bug 22115: use i386 containers for the linux32 build
by boklm＠torproject.org 08 May '17

08 May '17

commit d067aa03629fb87c47acf19f81ed51940ebc3ebb Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon May 1 19:58:30 2017 +0200 Bug 22115: use i386 containers for the linux32 build --- projects/binutils/build | 3 ++- projects/common/runc-config.json | 6 +++++- projects/debootstrap-image/config | 22 ++++++++++++++++++++++ projects/firefox/config | 21 ++++----------------- projects/gcc/build | 1 + projects/gcc/config | 17 ++++++++++++----- projects/go-webrtc/config | 8 +------- projects/go/build | 1 + projects/go/config | 1 + projects/snowflake/config | 8 +------- projects/tor/config | 14 +++++--------- projects/webrtc/config | 30 ++++++++---------------------- rbm.conf | 35 ++++++++++++++++------------------- 13 files changed, 79 insertions(+), 88 deletions(-) diff --git a/projects/binutils/build b/projects/binutils/build index 8d4f09f..bd949a5 100644 --- a/projects/binutils/build +++ b/projects/binutils/build @@ -8,7 +8,8 @@ distdir=/var/tmp/dist/binutils export DEB_BUILD_HARDENING_FORTIFY=1 export DEB_BUILD_HARDENING_FORMAT=1 export DEB_BUILD_HARDENING_PIE=1 - +[% END -%] +[% IF c("var/linux-x86_64") %] # The libstdc++ shipped by default is non-PIC which breaks the binutils build # if we build with DEB_BUILD_HARDENING_PIE=1. We need to install a PIC one AND # make sure it gets used before the non-PIC one would. diff --git a/projects/common/runc-config.json b/projects/common/runc-config.json index 4c231cd..3da6c24 100644 --- a/projects/common/runc-config.json +++ b/projects/common/runc-config.json @@ -2,7 +2,11 @@ "ociVersion": "1.0.0-rc1", "platform": { "os": "linux", - "arch": "amd64" +[% IF c("var/container/arch") == 'i386' -%] + "arch": "386" +[% ELSE -%] + "arch": "[% c("var/container/arch") %]" +[% END -%] }, "process": { "terminal": true, diff --git a/projects/debootstrap-image/config b/projects/debootstrap-image/config index bd204f5..15eec3b 100644 --- a/projects/debootstrap-image/config +++ b/projects/debootstrap-image/config @@ -27,23 +27,45 @@ targets: container: suite: wheezy arch: amd64 + wheezy-i386: + var: + container: + suite: wheezy + arch: i386 jessie-amd64: var: container: suite: jessie arch: amd64 + jessie-i386: + var: + container: + suite: jessie + arch: i386 precise-amd64: var: container: suite: precise arch: amd64 debootstrap_opt: --keyring=/usr/share/keyrings/ubuntu-archive-removed-keys.gpg + precise-i386: + var: + container: + suite: precise + arch: i386 + debootstrap_opt: --keyring=/usr/share/keyrings/ubuntu-archive-removed-keys.gpg utopic-amd64: var: container: suite: utopic arch: amd64 debootstrap_mirror: http://old-releases.ubuntu.com/ubuntu/ + utopic-i386: + var: + container: + suite: utopic + arch: i386 + debootstrap_mirror: http://old-releases.ubuntu.com/ubuntu/ input_files: - URL: 'http://cdimage.ubuntu.com/ubuntu-base/releases/[% c("var/ubuntu_version") %]/release/ubuntu-base-[% c("var/ubuntu_version") %]-base-amd64.tar.gz' diff --git a/projects/firefox/config b/projects/firefox/config index d6a68fe..f5c765f 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -28,9 +28,8 @@ targets: var: torbrowser_update_channel: default - linux-x86_64: + linux: var: - martools_filename: mar-tools-linux64.zip arch_deps: - libgtk2.0-dev - libdbus-glib-1-dev @@ -44,25 +43,13 @@ targets: - libx11-xcb-dev # We built GCC but not the libmpc2, thus we need to install it - libmpc2 + linux-x86_64: + var: + martools_filename: mar-tools-linux64.zip linux-i686: var: martools_filename: mar-tools-linux32.zip - sort_deps: 0 - arch_deps: - - libc6-dev-i386 - - libgtk2.0-dev:i386 - - libdbus-glib-1-dev:i386 - - libxt-dev:i386 - # To pass configure since ESR 31. - - libpulse-dev:i386 - # To pass configure since ESR 45. - - libgconf2-dev:i386 - # To pass configure since ESR 52 - - libx11-xcb-dev:i386 - # We built GCC but not the libmpc2, thus we need to install it - - libmpc2 - - hardening-wrapper osx-x86_64: var: diff --git a/projects/gcc/build b/projects/gcc/build index 1c24af7..e509aac 100644 --- a/projects/gcc/build +++ b/projects/gcc/build @@ -1,5 +1,6 @@ #!/bin/sh [% c("var/set_default_env") -%] +[% c("var/setarch") -%] distdir=/var/tmp/dist/[% project %] mkdir /var/tmp/build tar -C /var/tmp/build -xf [% project %]-[% c("version") %].tar.bz2 diff --git a/projects/gcc/config b/projects/gcc/config index 1acf30a..676d1fb 100644 --- a/projects/gcc/config +++ b/projects/gcc/config @@ -4,12 +4,11 @@ version: 5.1.0 var: container: use_container: 1 - configure_opt: --enable-multilib --enable-languages=c,c++ --with-arch_32=i686 deps: - build-essential - libmpc-dev - - libc6-dev-i386 setup: | + [% c("var/setarch") -%] mkdir -p /var/tmp/dist tar -C /var/tmp/dist -xf $rootdir/[% c("compiler_tarfile") %] export PATH="/var/tmp/dist/gcc/bin:$PATH" @@ -36,12 +35,20 @@ var: popd targets: - osx-x86_64: - var: - configure_opt: --enable-multilib --enable-languages=c,c++ windows-i686: var: configure_opt: --disable-multilib --enable-languages=c,c++ + linux-i686: + var: + configure_opt: --enable-multilib --enable-languages=c,c++ --with-system-zlib + arch_deps: + - libc6-dev + - zlib1g-dev + linux-x86_64: + var: + configure_opt: --enable-multilib --enable-languages=c,c++ --with-arch_32=i686 + arch_deps: + - libc6-dev-i386 input_files: - project: container-image - URL: 'https://ftp.gnu.org/gnu/gcc/gcc-[% c("version") %]/gcc-[% c("version") %].tar.bz2' diff --git a/projects/go-webrtc/config b/projects/go-webrtc/config index d7c31d6..673215b 100644 --- a/projects/go-webrtc/config +++ b/projects/go-webrtc/config @@ -31,17 +31,11 @@ var: targets: master: git_hash: master - linux-x86_64: + linux: var: arch_deps: - pkg-config - libx11-dev - linux-i686: - var: - arch_deps: - - pkg-config:i386 - - libx11-dev:i386 - - lib32stdc++6 input_files: - project: container-image diff --git a/projects/go/build b/projects/go/build index 2f87bf5..b7fac08 100644 --- a/projects/go/build +++ b/projects/go/build @@ -1,5 +1,6 @@ #!/bin/bash [% c("var/set_default_env") -%] +[% c("var/setarch") -%] distdir=/var/tmp/dist/[% project %] mkdir -p /var/tmp/dist diff --git a/projects/go/config b/projects/go/config index ef9c411..b36f211 100644 --- a/projects/go/config +++ b/projects/go/config @@ -8,6 +8,7 @@ var: use_container: 1 setup: | + [% c("var/setarch") -%] mkdir -p /var/tmp/dist tar -C /var/tmp/dist -xf $rootdir/[% c("go_tarfile") %] export GOOS=[% c("var/GOOS") %] diff --git a/projects/snowflake/config b/projects/snowflake/config index 212e86c..89e3eb6 100644 --- a/projects/snowflake/config +++ b/projects/snowflake/config @@ -9,13 +9,7 @@ var: use_container: 1 targets: - linux-i686: - var: - arch_deps: - - pkg-config - - libx11-dev:i386 - - lib32stdc++6 - linux-x86_64: + linux: var: arch_deps: - pkg-config diff --git a/projects/tor/config b/projects/tor/config index a9da811..c2d359c 100644 --- a/projects/tor/config +++ b/projects/tor/config @@ -21,22 +21,18 @@ targets: git_hash: master tag_gpg_id: 0 - linux-i686: + linux: var: - libdir: lib32 - sort_deps: 0 arch_deps: - - libc6-dev-i386 - libtool - - zlib1g-dev:i386 + - zlib1g-dev - hardening-wrapper + linux-i686: + var: + libdir: lib linux-x86_64: var: libdir: lib64 - arch_deps: - - libtool - - zlib1g-dev - - hardening-wrapper osx-x86_64: var: arch_deps: diff --git a/projects/webrtc/config b/projects/webrtc/config index d46d821..6882e87 100644 --- a/projects/webrtc/config +++ b/projects/webrtc/config @@ -26,28 +26,6 @@ targets: var: webrtc: os: linux - linux-i686: - var: - sort_deps: 0 - arch_deps: - - lib32asound2-dev - - lib64expat1 - - libexpat1-dev:i386 - - libglib2.0-dev:i386 - - libgtk2.0-dev:i386 - - libudev-dev:i386 - - libx11-dev:i386 - - libxext-dev:i386 - - libxrandr-dev:i386 - - lib32stdc++6 - - pkg-config - - hardening-wrapper - webrtc: - arch: ia32 - lib_arch: 386 - lib_path: lib/libwebrtc-linux-386-magic.a - linux-x86_64: - var: arch_deps: - libasound2-dev - libexpat1-dev @@ -58,6 +36,14 @@ targets: - libxext-dev - libxrandr-dev - pkg-config + linux-i686: + var: + webrtc: + arch: ia32 + lib_arch: 386 + lib_path: lib/libwebrtc-linux-386-magic.a + linux-x86_64: + var: webrtc: arch: x64 lib_arch: amd64 diff --git a/rbm.conf b/rbm.conf index 722c85a..2060132 100644 --- a/rbm.conf +++ b/rbm.conf @@ -111,26 +111,30 @@ targets: var: linux-x86_64: 1 osname: linux-x86_64 - deps: - - build-essential - - python - - bison - - hardening-wrapper - - automake - - libtool - - zip - - unzip # We only build snowflake on linux-x86_64 for now snowflake: 1 + container: + arch: amd64 linux-i686: arch: i686 var: linux-i686: 1 osname: linux-i686 - configure_opt: '--host=i686-linux-gnu CFLAGS=-m32 CXXFLAGS=-m32 LDFLAGS=-m32' - pre_pkginst: dpkg --add-architecture i386 + container: + arch: i386 + setarch: | + if test -z "$RBM_SETARCH" + then + export RBM_SETARCH=1 + exec setarch i686 ./build + fi + linux: + var: + linux: 1 + compiler: gcc + container: + suite: wheezy deps: - - libc6-dev-i386 - build-essential - python - bison @@ -139,13 +143,6 @@ targets: - libtool - zip - unzip - linux: - var: - linux: 1 - compiler: gcc - container: - suite: wheezy - arch: amd64 torbrowser-windows-i686: - windows-i686

1 0

[tor-browser-build/master] Bug 21824: use runc instead of docker
by boklm＠torproject.org 05 May '17

05 May '17

commit 2d98c063010fc5b0f8da3e386587a501e27507b9 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Tue Apr 25 22:06:10 2017 +0200 Bug 21824: use runc instead of docker --- README | 25 ++---- keyring/ubuntu.gpg | Bin 0 -> 32904 bytes projects/binutils/config | 5 +- projects/cmake/config | 6 +- projects/common/runc-config.json | 179 ++++++++++++++++++++++++++++++++++++++ projects/container-image/build | 3 + projects/container-image/config | 86 ++++++++++++++++++ projects/debootstrap-image/build | 3 + projects/debootstrap-image/config | 52 +++++++++++ projects/docker-image/build | 4 - projects/docker-image/config | 51 ----------- projects/ed25519/config | 5 +- projects/firefox/config | 5 +- projects/fonts/config | 5 +- projects/gcc/config | 5 +- projects/gmp/config | 7 +- projects/go-webrtc/config | 5 +- projects/go/config | 5 +- projects/goerrors/config | 5 +- projects/gogb/config | 5 +- projects/goptlib/config | 5 +- projects/goxcrypto/config | 5 +- projects/goxnet/config | 5 +- projects/https-everywhere/config | 9 +- projects/libdmg-hfsplus/config | 5 +- projects/libevent/config | 7 +- projects/llvm/config | 7 +- projects/macosx-toolchain/config | 5 +- projects/meek/config | 6 +- projects/mingw-w64/config | 5 +- projects/nsis/config | 5 +- projects/obfs4/config | 7 +- projects/openssl/config | 7 +- projects/sandbox/config | 8 +- projects/siphash/config | 5 +- projects/snowflake/config | 7 +- projects/tor-browser/config | 8 +- projects/tor-launcher/config | 6 +- projects/tor/config | 5 +- projects/torbutton/config | 6 +- projects/uniuri/config | 5 +- projects/webrtc/config | 10 ++- projects/yasm/config | 6 +- projects/zlib/config | 7 +- rbm | 2 +- rbm.conf | 93 ++++++++++++++++++-- rbm.local.conf.example | 6 -- tools/clean-old | 21 ----- 48 files changed, 549 insertions(+), 185 deletions(-) diff --git a/README b/README index 08904fb..fa968ff 100644 --- a/README +++ b/README @@ -5,13 +5,12 @@ Installing build dependencies ----------------------------- To build Tor Browser, you need a Linux distribution that has support -for Docker (such as Debian jessie, Ubuntu 14.04, Fedora 20, etc ...). -The Docker package is usually named docker.io or docker-io. -On Debian jessie, the docker.io package is available in backports. +for runC (such as Debian jessie, Ubuntu 14.04, Fedora 20, etc ...). +On Debian jessie, the runc package is available in backports. -Your user account should have access to the docker command without using -sudo, so it should be in the docker group. The docker daemon should -also be running. +Your user account should have access sudo access, which is required to +be able to extract container file systems, start containers and copy +files to and from containers. The sources of most components are downloaded using git, which needs to be installed. The sources of webrtc are downloaded using gclient, which @@ -41,7 +40,7 @@ If you are running Debian or Ubuntu, you can install them with: libio-captureoutput-perl libfile-slurp-perl \ libstring-shellquote-perl libsort-versions-perl \ libdigest-sha-perl libdata-uuid-perl libdata-dump-perl \ - libfile-copy-recursive-perl git libgtk2.0-dev curl + libfile-copy-recursive-perl git libgtk2.0-dev curl runc Starting a build @@ -184,18 +183,6 @@ of files and containers that would be removed without doing it, you can use 'make clean-dry-run'. -Multiple build directories on the same host -------------------------------------------- - -You can do multiple builds of Tor Browser in different directories on -the same host. However the docker images namespace is global, so you -may have some conflicts with the same image names used by the -different builds. By default, the docker images are prefixed with -tor-browser_$USER. You can change this prefix by defining the -docker_image_prefix option in rbm.local.conf, using a different prefix -for each of your build directories. - - Common Build Errors ------------------- diff --git a/keyring/ubuntu.gpg b/keyring/ubuntu.gpg new file mode 100644 index 0000000..8b77bf0 Binary files /dev/null and b/keyring/ubuntu.gpg differ diff --git a/projects/binutils/config b/projects/binutils/config index 2975f14..0cb2088 100644 --- a/projects/binutils/config +++ b/projects/binutils/config @@ -1,9 +1,10 @@ # vim: filetype=yaml sw=2 version: 2.24 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 var: configure_opt: '--disable-multilib --enable-gold --enable-deterministic-archives --enable-plugins' + container: + use_container: 1 targets: windows-i686: @@ -15,7 +16,7 @@ input_files: sig_ext: sig file_gpg_id: 1 gpg_keyring: binutils.gpg - - project: docker-image + - project: container-image - filename: enable-reloc-section-ld.patch enable: '[% c("var/windows") %]' - filename: peXXigen.patch diff --git a/projects/cmake/config b/projects/cmake/config index 837d9e1..357370d 100644 --- a/projects/cmake/config +++ b/projects/cmake/config @@ -5,7 +5,9 @@ git_hash: 'v[% c("version") %]' tag_gpg_id: 1 gpg_keyring: cmake.gpg filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 +var: + container: + use_container: 1 input_files: - - project: docker-image + - project: container-image diff --git a/projects/common/runc-config.json b/projects/common/runc-config.json new file mode 100644 index 0000000..4c231cd --- /dev/null +++ b/projects/common/runc-config.json @@ -0,0 +1,179 @@ +{ + "ociVersion": "1.0.0-rc1", + "platform": { + "os": "linux", + "arch": "amd64" + }, + "process": { + "terminal": true, + "user": { + "uid": 0, + "gid": 0 + }, + "args": [ + "/rbm/run" + ], + "env": [ + "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "TERM=xterm" + ], + "cwd": "/", + "capabilities": [ + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_SETGID", + "CAP_SETUID", + "CAP_MKNOD", + "CAP_SYS_CHROOT", +[% IF c("var/container/CAP_SYS_ADMIN") -%] + "CAP_SYS_ADMIN", +[% END -%] + "CAP_FSETID", + "CAP_FOWNER", + "CAP_DAC_OVERRIDE", + "CAP_CHOWN" + ], + "rlimits": [ + { + "type": "RLIMIT_NOFILE", + "hard": 1024, + "soft": 1024 + } + ], + "noNewPrivileges": true + }, + "root": { + "path": "rootfs", + "readonly": false + }, + "hostname": "runc", + "mounts": [ + { + "destination": "/proc", + "type": "proc", + "source": "proc" + }, + { + "type": "bind", + "source": "/etc/resolv.conf", + "destination": "/etc/resolv.conf", + "options": [ + "rbind", + "ro" + ] + }, + { + "destination": "/dev", + "type": "tmpfs", + "source": "tmpfs", + "options": [ + "nosuid", + "strictatime", + "mode=755", + "size=65536k" + ] + }, + { + "destination": "/dev/pts", + "type": "devpts", + "source": "devpts", + "options": [ + "nosuid", + "noexec", + "newinstance", + "ptmxmode=0666", + "mode=0620", + "gid=5" + ] + }, + { + "destination": "/dev/shm", + "type": "tmpfs", + "source": "shm", + "options": [ + "nosuid", + "noexec", + "nodev", + "mode=1777", + "size=65536k" + ] + }, + { + "destination": "/dev/mqueue", + "type": "mqueue", + "source": "mqueue", + "options": [ + "nosuid", + "noexec", + "nodev" + ] + }, + { + "destination": "/sys", + "type": "sysfs", + "source": "sysfs", + "options": [ + "nosuid", + "noexec", + "nodev", + "ro" + ] + }, + { + "destination": "/sys/fs/cgroup", + "type": "cgroup", + "source": "cgroup", + "options": [ + "nosuid", + "noexec", + "nodev", + "relatime", + "ro" + ] + } + ], + "hooks": {}, + "linux": { + "resources": { + "devices": [ + { + "allow": false, + "access": "rwm" + } + ] + }, + "namespaces": [ + { + "type": "pid" + }, + { + "type": "ipc" + }, + { + "type": "uts" + }, + { + "type": "mount" + } + ], + "maskedPaths": [ + "/proc/kcore", + "/proc/latency_stats", + "/proc/timer_stats", + "/proc/sched_debug" + ], + "readonlyPaths": [ + "/proc/asound", + "/proc/bus", + "/proc/fs", + "/proc/irq", + "/proc/sys", + "/proc/sysrq-trigger" + ] + }, + "solaris": { + "cappedCPU": {}, + "cappedMemory": {} + } +} diff --git a/projects/container-image/build b/projects/container-image/build new file mode 100644 index 0000000..c7d1c46 --- /dev/null +++ b/projects/container-image/build @@ -0,0 +1,3 @@ +#!/bin/sh +set -e +# Doing nothing diff --git a/projects/container-image/config b/projects/container-image/config new file mode 100644 index 0000000..c9f377f --- /dev/null +++ b/projects/container-image/config @@ -0,0 +1,86 @@ +# vim: filetype=yaml sw=2 +filename: 'container-image_[% c("var/container/suite") %]-[% c("var/container/arch") %]-[% sha256(c("pre")).substr(0, 12) %].tar.gz' +pkg_type: build + +var: + container: + use_container: 1 + suite: '[% pc(c("origin_project"), "var/container/suite") %]' + arch: '[% pc(c("origin_project"), "var/container/arch") %]' + +lsb_release: + id: Debian + codename: wheezy + release: 7.11 + +pre: | + #!/bin/sh + # [% c('var/container/suite') %] + set -e + [% IF pc(c('origin_project'), 'var/pre_pkginst') -%] + [% pc(c('origin_project'), 'var/pre_pkginst') %] + [% END -%] + [% IF c("var/container/suite") == "precise" -%] + export INITRD=no + mkdir -p /etc/container_environment + echo -n no > /etc/container_environment/INITRD + dpkg-divert --local --rename --add /sbin/initctl + ln -s /bin/true /sbin/initctl + dpkg-divert --local --rename --add /usr/bin/ischroot + ln -sf /bin/true /usr/bin/ischroot + cat >> /etc/apt/sources.list << EOF + deb http://archive.ubuntu.com/ubuntu/ precise-updates main + deb-src http://archive.ubuntu.com/ubuntu/ precise-updates main + + deb http://archive.ubuntu.com/ubuntu/ precise universe + deb-src http://archive.ubuntu.com/ubuntu/ precise universe + deb http://archive.ubuntu.com/ubuntu/ precise-updates universe + deb-src http://archive.ubuntu.com/ubuntu/ precise-updates universe + + deb http://archive.ubuntu.com/ubuntu/ precise-security main + deb-src http://archive.ubuntu.com/ubuntu/ precise-security main + deb http://archive.ubuntu.com/ubuntu/ precise-security universe + deb-src http://archive.ubuntu.com/ubuntu/ precise-security universe + EOF + [% END -%] + apt-get update -y + apt-get upgrade -y + [% + deps = []; + IF pc(c('origin_project'), 'var/deps'); + CALL deps.import(pc(c('origin_project'), 'var/deps')); + END; + IF pc(c('origin_project'), 'var/arch_deps'); + CALL deps.import(pc(c('origin_project'), 'var/arch_deps')); + END; + IF deps.size; + IF pc(c('origin_project'), 'var/sort_deps'); + deps = deps.sort; + END; + FOREACH pkg IN deps; + SET p = tmpl(pkg); + IF p; + GET c('install_package', { pkg_name => p }); + GET "\n"; + END; + END; + END; + -%] + [% IF pc(c('origin_project'), 'var/post_pkginst') -%] + [% pc(c('origin_project'), 'var/post_pkginst') %] + [% END -%] + +remote_get: | + #!/bin/sh + set -e + [% + SET src = shell_quote(c('get_src', { error_if_undef => 1 })); + SET dst = shell_quote(c('get_dst', { error_if_undef => 1 })); + -%] + mkdir -p "[% dst %]" + sudo tar -C "[% c("var/container/dir") %]/rootfs" -czf "[% dst %]/[% c("filename") %]" . + +input_files: + - project: debootstrap-image + target: + - '[% c("var/container/suite") %]-[% c("var/container/arch") %]' diff --git a/projects/debootstrap-image/build b/projects/debootstrap-image/build new file mode 100644 index 0000000..c7d1c46 --- /dev/null +++ b/projects/debootstrap-image/build @@ -0,0 +1,3 @@ +#!/bin/sh +set -e +# Doing nothing diff --git a/projects/debootstrap-image/config b/projects/debootstrap-image/config new file mode 100644 index 0000000..bd204f5 --- /dev/null +++ b/projects/debootstrap-image/config @@ -0,0 +1,52 @@ +# vim: filetype=yaml sw=2 +filename: 'container-image_[% c("var/container/suite") %]-[% c("var/container/arch") %].tar.gz' +pkg_type: build + +var: + ubuntu_version: 17.04 + + container_dir: '[% c("tmp_dir") %]/rbm-containers/[% sha256(c("build_id")) %]' + container_user: rbm + + container: + use_container: 1 + # We need CAP_SYS_ADMIN for debootstrap to work + CAP_SYS_ADMIN: 1 + +pre: | + #!/bin/sh + set -e + apt-get update -y + apt-get install -y debian-archive-keyring ubuntu-keyring debootstrap + debootstrap --arch=[% c("var/container/arch") %] [% c("var/container/debootstrap_opt") %] [% c("var/container/suite") %] base-image [% c("var/container/debootstrap_mirror") %] + tar -C ./base-image -czf [% dest_dir %]/[% c("filename") %] . + +targets: + wheezy-amd64: + var: + container: + suite: wheezy + arch: amd64 + jessie-amd64: + var: + container: + suite: jessie + arch: amd64 + precise-amd64: + var: + container: + suite: precise + arch: amd64 + debootstrap_opt: --keyring=/usr/share/keyrings/ubuntu-archive-removed-keys.gpg + utopic-amd64: + var: + container: + suite: utopic + arch: amd64 + debootstrap_mirror: http://old-releases.ubuntu.com/ubuntu/ + +input_files: + - URL: 'http://cdimage.ubuntu.com/ubuntu-base/releases/[% c("var/ubuntu_version") %]/release/ubuntu-base-[% c("var/ubuntu_version") %]-base-amd64.tar.gz' + filename: 'container-image_ubuntu-base-[% c("var/ubuntu_version") %]-base-amd64.tar.gz' + sha256sum: df2c8fd540e474b8e1e29c0db8ed6b43a932918f1b9a8149bb82104a7c07ba2a + diff --git a/projects/docker-image/build b/projects/docker-image/build deleted file mode 100644 index ced6ad3..0000000 --- a/projects/docker-image/build +++ /dev/null @@ -1,4 +0,0 @@ -#!/bin/sh -set -e -echo 1 > [% dest_dir %]/[% c('filename') %] -echo Creating [% dest_dir %]/[% c('filename') %] diff --git a/projects/docker-image/config b/projects/docker-image/config deleted file mode 100644 index 1968b77..0000000 --- a/projects/docker-image/config +++ /dev/null @@ -1,51 +0,0 @@ -# vim: filetype=yaml sw=2 -filename: '[% sha256(c("pre")).substr(0, 12) %]' -remote_docker: 1 -docker_save_image: '[% c("docker_image_prefix") %]:[% c("filename") %]' -pkg_type: build - -docker_image: '[% c("lsb_release/id").lower %]:[% c("lsb_release/release") %]' - -lsb_release: - id: '[% pc(c("origin_project", { no_distro => 1 }), "lsb_release/id", { no_distro => 1 }) %]' - release: '[% pc(c("origin_project", { no_distro => 1 }), "lsb_release/release", { no_distro => 1 }) %]' - codename: '[% pc(c("origin_project", { no_distro => 1 }), "lsb_release/codename", { no_distro => 1 }) %]' - -pre: | - #!/bin/sh - # [% c('docker_image') %] - set -e - [% IF c('lsb_release/release') == '14.10' -%] - sed -i 's/archive\.ubuntu\.com/old-releases.ubuntu.com/' /etc/apt/sources.list - [% END -%] - [% IF pc(c('origin_project'), 'var/pre_pkginst') -%] - [% pc(c('origin_project'), 'var/pre_pkginst') %] - [% END -%] - [% IF c('lsb_release/id') == 'Ubuntu' || c('lsb_release/id') == 'Debian' %] - apt-get update -y - apt-get upgrade -y - [% END %] - [% - deps = []; - IF pc(c('origin_project'), 'var/deps'); - CALL deps.import(pc(c('origin_project'), 'var/deps')); - END; - IF pc(c('origin_project'), 'var/arch_deps'); - CALL deps.import(pc(c('origin_project'), 'var/arch_deps')); - END; - IF deps.size; - IF pc(c('origin_project'), 'var/sort_deps'); - deps = deps.sort; - END; - FOREACH pkg IN deps; - SET p = tmpl(pkg); - IF p; - GET c('install_package', { pkg_name => p }); - GET "\n"; - END; - END; - END; - -%] - [% IF pc(c('origin_project'), 'var/post_pkginst') -%] - [% pc(c('origin_project'), 'var/post_pkginst') %] - [% END -%] diff --git a/projects/ed25519/config b/projects/ed25519/config index 5bab68b..c6790b8 100644 --- a/projects/ed25519/config +++ b/projects/ed25519/config @@ -3,16 +3,17 @@ version: '[% c("abbrev") %]' git_url: https://github.com/agl/ed25519.git git_hash: c4161f4c7483313562781c61b9a20aba73daf9de filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 build: '[% c("projects/go/var/build_go_lib") %]' var: + container: + use_container: 1 go_lib: github.com/agl/ed25519 go_lib_install: - github.com/agl/ed25519/extra25519 input_files: - - project: docker-image + - project: container-image - name: go project: go diff --git a/projects/firefox/config b/projects/firefox/config index 2c74e4b..d6a68fe 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -5,7 +5,6 @@ git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branc tag_gpg_id: 1 git_url: https://git.torproject.org/tor-browser.git gpg_keyring: torbutton.gpg -remote_docker: 1 var: firefox_version: 52.1.0esr @@ -19,6 +18,8 @@ var: - autoconf2.13 - yasm - python + container: + use_container: 1 targets: nightly: @@ -74,7 +75,7 @@ targets: martools_filename: mar-tools-win32.zip input_files: - - project: docker-image + - project: container-image - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]' - filename: get-moz-build-date diff --git a/projects/fonts/config b/projects/fonts/config index 69e16b3..382804d 100644 --- a/projects/fonts/config +++ b/projects/fonts/config @@ -3,8 +3,9 @@ version: '[% c("abbrev") %]' git_url: https://github.com/googlei18n/noto-fonts.git git_hash: 720e34851382ee3c1ef024d8dffb68ffbfb234c2 filename: "[% project %]-[% c('version') %]-[% c('var/build_id') %].tar.gz" -remote_docker: 1 var: + container: + use_container: 1 noto_fonts_hinted: - Arimo-Regular.ttf - Arimo-Bold.ttf @@ -85,7 +86,7 @@ targets: - NotoSansYi-Regular.ttf input_files: - - project: docker-image + - project: container-image - URL: https://github.com/googlei18n/noto-emoji/raw/2f1ffdd6fbbd05d6f382138a3d3adc… sha256sum: 415dc6290378574135b64c808dc640c1df7531973290c4970c51fdeb849cb0c5 enable: '[% c("var/linux") %]' diff --git a/projects/gcc/config b/projects/gcc/config index 391e453..1acf30a 100644 --- a/projects/gcc/config +++ b/projects/gcc/config @@ -1,8 +1,9 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' version: 5.1.0 -remote_docker: 1 var: + container: + use_container: 1 configure_opt: --enable-multilib --enable-languages=c,c++ --with-arch_32=i686 deps: - build-essential @@ -42,6 +43,6 @@ targets: var: configure_opt: --disable-multilib --enable-languages=c,c++ input_files: + - project: container-image - URL: 'https://ftp.gnu.org/gnu/gcc/gcc-[% c("version") %]/gcc-[% c("version") %].tar.bz2' sha256sum: b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad - - project: docker-image diff --git a/projects/gmp/config b/projects/gmp/config index 913f181..41eb630 100644 --- a/projects/gmp/config +++ b/projects/gmp/config @@ -1,7 +1,10 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' version: 5.1.3 -remote_docker: 1 + +var: + container: + use_container: 1 targets: linux: @@ -9,9 +12,9 @@ targets: configure_opt_gmp: --enable-fat input_files: + - project: container-image - name: gmp URL: 'https://ftp.gnu.org/gnu/gmp/gmp-[% c("version") %].tar.bz2' sha256sum: 752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]' - - project: docker-image diff --git a/projects/go-webrtc/config b/projects/go-webrtc/config index 3a1a9d4..d7c31d6 100644 --- a/projects/go-webrtc/config +++ b/projects/go-webrtc/config @@ -3,11 +3,12 @@ version: '[% c("abbrev") %]' git_url: https://github.com/keroserene/go-webrtc.git git_hash: ab1b64862e0c4b4182010699911c2c5818f0a101 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 build: '[% c("projects/go/var/build_go_lib") %]' var: + container: + use_container: 1 go_lib: github.com/keroserene/go-webrtc build_go_lib_pre: | [% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] @@ -43,7 +44,7 @@ targets: - lib32stdc++6 input_files: - - project: docker-image + - project: container-image - name: go project: go - name: webrtc diff --git a/projects/go/config b/projects/go/config index 89b4b45..ef9c411 100644 --- a/projects/go/config +++ b/projects/go/config @@ -1,10 +1,11 @@ # vim: filetype=yaml sw=2 version: 1.7.5 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 var: go14_version: 1.4.3 + container: + use_container: 1 setup: | mkdir -p /var/tmp/dist @@ -69,7 +70,7 @@ targets: GOARCH: 386 input_files: - - project: docker-image + - project: container-image - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]' enable: '[% c("var/windows") || c("var/osx") %]' diff --git a/projects/goerrors/config b/projects/goerrors/config index 4451f7b..3c11fab 100644 --- a/projects/goerrors/config +++ b/projects/goerrors/config @@ -3,14 +3,15 @@ version: '[% c("abbrev") %]' git_url: https://github.com/pkg/errors git_hash: 248dadf4e9068a0b3e79f02ed0a610d935de5302 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 build: '[% c("projects/go/var/build_go_lib") %]' var: + container: + use_container: 1 go_lib: github.com/pkg/errors input_files: - - project: docker-image + - project: container-image - name: go project: go diff --git a/projects/gogb/config b/projects/gogb/config index a358819..dcf30f6 100644 --- a/projects/gogb/config +++ b/projects/gogb/config @@ -3,18 +3,19 @@ version: '[% c("abbrev") %]' git_url: https://github.com/constabulary/gb git_hash: 06cc925cce6592e922dcc4839a8b44feb384e71e filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 build: '[% c("projects/go/var/build_go_lib") %]' var: + container: + use_container: 1 go_lib: github.com/constabulary/gb go_lib_install: github.com/constabulary/gb/cmd/gb go_lib_deps: - goerrors input_files: - - project: docker-image + - project: container-image - name: go project: go - name: goerrors diff --git a/projects/goptlib/config b/projects/goptlib/config index dd520ec..c083763 100644 --- a/projects/goptlib/config +++ b/projects/goptlib/config @@ -5,14 +5,15 @@ git_hash: '[% c("version") %]' tag_gpg_id: 1 gpg_keyring: goptlib.gpg filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 build: '[% c("projects/go/var/build_go_lib") %]' var: + container: + use_container: 1 go_lib: git.torproject.org/pluggable-transports/goptlib.git input_files: - - project: docker-image + - project: container-image - name: go project: go diff --git a/projects/goxcrypto/config b/projects/goxcrypto/config index 8362f28..b51b578 100644 --- a/projects/goxcrypto/config +++ b/projects/goxcrypto/config @@ -3,11 +3,12 @@ version: '[% c("abbrev") %]' git_url: https://go.googlesource.com/crypto git_hash: 4ed45ec682102c643324fae5dff8dab085b6c300 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 build: '[% c("projects/go/var/build_go_lib") %]' var: + container: + use_container: 1 go_lib: golang.org/x/crypto go_lib_install: - golang.org/x/crypto/curve25519 @@ -19,6 +20,6 @@ targets: git_hash: master input_files: - - project: docker-image + - project: container-image - name: go project: go diff --git a/projects/goxnet/config b/projects/goxnet/config index 507f997..ec368a2 100644 --- a/projects/goxnet/config +++ b/projects/goxnet/config @@ -3,11 +3,12 @@ version: '[% c("abbrev") %]' git_url: https://go.googlesource.com/net git_hash: 7dbad50ab5b31073856416cdcfeb2796d682f844 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 build: '[% c("projects/go/var/build_go_lib") %]' var: + container: + use_container: 1 go_lib: golang.org/x/net go_lib_install: - golang.org/x/net/proxy @@ -17,6 +18,6 @@ targets: git_hash: master input_files: - - project: docker-image + - project: container-image - name: go project: go diff --git a/projects/https-everywhere/config b/projects/https-everywhere/config index 3e5100e..f149cac 100644 --- a/projects/https-everywhere/config +++ b/projects/https-everywhere/config @@ -6,9 +6,11 @@ git_submodule: 1 gpg_keyring: https-everywhere.gpg tag_gpg_id: 1 filename: "[% project %]-[% c('version') %]-[% c('var/build_id') %].xpi" -remote_docker: 1 -distribution: Debian-7.11 var: + container: + use_container: 1 + suite: wheezy + arch: amd64 deps: - git - python @@ -19,8 +21,9 @@ var: - rsync - zip - unzip + input_files: - - project: docker-image + - project: container-image targets: nightly: diff --git a/projects/libdmg-hfsplus/config b/projects/libdmg-hfsplus/config index 9071078..67e8287 100644 --- a/projects/libdmg-hfsplus/config +++ b/projects/libdmg-hfsplus/config @@ -3,13 +3,14 @@ version: '[% c("abbrev") %]' git_url: https://github.com/vasi/libdmg-hfsplus git_hash: dfd5e5cc3dc1191e37d3c3a6118975afdd1d7014 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 var: + container: + use_container: 1 deps: - build-essential - cmake - zlib1g-dev - libbz2-dev input_files: + - project: container-image - filename: libdmg.patch - - project: docker-image diff --git a/projects/libevent/config b/projects/libevent/config index 15ada11..46cbb7e 100644 --- a/projects/libevent/config +++ b/projects/libevent/config @@ -5,7 +5,10 @@ git_hash: 'release-[% c("version") %]-stable' tag_gpg_id: 1 gpg_keyring: libevent.gpg filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 + +var: + container: + use_container: 1 targets: osx-x86_64: @@ -14,6 +17,6 @@ targets: - faketime input_files: - - project: docker-image + - project: container-image - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]' diff --git a/projects/llvm/config b/projects/llvm/config index 81f7aaa..f0a803b 100644 --- a/projects/llvm/config +++ b/projects/llvm/config @@ -1,10 +1,13 @@ # vim: filetype=yaml sw=2 version: 3.8.0 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 + +var: + container: + use_container: 1 input_files: - - project: docker-image + - project: container-image - project: cmake name: cmake - URL: 'http://releases.llvm.org/[% c("version") %]/llvm-[% c("version") %].src.tar.xz' diff --git a/projects/macosx-toolchain/config b/projects/macosx-toolchain/config index b237e4d..55fb554 100644 --- a/projects/macosx-toolchain/config +++ b/projects/macosx-toolchain/config @@ -1,8 +1,9 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' version: 10.7-1 -remote_docker: 1 var: + container: + use_container: 1 setup: | mkdir -p /var/tmp/dist tar -C /var/tmp/dist -xf [% c("compiler_tarfile") %] @@ -15,6 +16,7 @@ var: export LDFLAGS="[% c('var/LDFLAGS') %]" input_files: + - project: container-image - name: llvm project: llvm - name: cctools @@ -23,4 +25,3 @@ input_files: - name: SDK URL: https://people.torproject.org/~mikeperry/mirrors/sources/MacOSX10.7.sdk.tar… sha256sum: da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf - - project: docker-image diff --git a/projects/meek/config b/projects/meek/config index 84ed2bd..46f4ec9 100644 --- a/projects/meek/config +++ b/projects/meek/config @@ -5,10 +5,12 @@ git_hash: '[% c("version") %]' tag_gpg_id: 1 gpg_keyring: meek.gpg filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 +var: + container: + use_container: 1 input_files: - - project: docker-image + - project: container-image - name: go project: go - name: goptlib diff --git a/projects/mingw-w64/config b/projects/mingw-w64/config index 060857c..21d498a 100644 --- a/projects/mingw-w64/config +++ b/projects/mingw-w64/config @@ -3,8 +3,9 @@ filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' git_url: http://git.code.sf.net/p/mingw-w64/mingw-w64 git_hash: 98e5b4930a717eafddd8ca0f0dfeb7c57c6b026a version: '[% c("abbrev") %]' -remote_docker: 1 var: + container: + use_container: 1 gcc_version: 5.1.0 deps: - automake @@ -17,6 +18,7 @@ var: export PATH="/var/tmp/dist/mingw-w64/helpers:/var/tmp/dist/mingw-w64/bin:$PATH" export gcclibs=/var/tmp/dist/mingw-w64/gcclibs input_files: + - project: container-image - URL: 'https://ftp.gnu.org/gnu/gcc/gcc-[% c("var/gcc_version") %]/gcc-[% c("var/gcc_version") %].tar.bz2' sha256sum: b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad - name: binutils @@ -24,4 +26,3 @@ input_files: - filename: i686-w64-mingw32-g++ - filename: i686-w64-mingw32-gcc - filename: i686-w64-mingw32-ld - - project: docker-image diff --git a/projects/nsis/config b/projects/nsis/config index 6729101..2812a22 100644 --- a/projects/nsis/config +++ b/projects/nsis/config @@ -1,8 +1,9 @@ # vim: filetype=yaml sw=2 version: 2.51 filename: 'nsis-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 var: + container: + use_container: 1 deps: - build-essential - libmpc-dev @@ -12,6 +13,7 @@ var: - xsltproc input_files: + - project: container-image - filename: 'nsis-[% c("version") %].tar.bz2' URL: 'http://downloads.sourceforge.net/nsis/nsis-[% c("version") %]-src.tar.bz2' sha256sum: 43d4c9209847e35eb6e2c7cd5a7586e1445374c056c2c7899e40a080e17a1be7 @@ -21,4 +23,3 @@ input_files: - filename: nsis-missing-unistd-include.patch - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]' - - project: docker-image diff --git a/projects/obfs4/config b/projects/obfs4/config index 952b054..44db79d 100644 --- a/projects/obfs4/config +++ b/projects/obfs4/config @@ -5,7 +5,10 @@ git_hash: 'obfs4proxy-[% c("version") %]' tag_gpg_id: 1 gpg_keyring: obfs4.gpg filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 + +var: + container: + use_container: 1 targets: nightly: @@ -13,7 +16,7 @@ targets: tag_gpg_id: 0 input_files: - - project: docker-image + - project: container-image - name: go project: go - name: goptlib diff --git a/projects/openssl/config b/projects/openssl/config index 1a2e4dd..8b4ea4f 100644 --- a/projects/openssl/config +++ b/projects/openssl/config @@ -1,7 +1,10 @@ # vim: filetype=yaml sw=2 version: 1.0.2k filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 + +var: + container: + use_container: 1 targets: linux-x86_64: @@ -18,7 +21,7 @@ targets: configure_opts: --cross-compile-prefix=x86_64-apple-darwin10- darwin64-x86_64-cc enable-ec_nistp_64_gcc_128 input_files: - - project: docker-image + - project: container-image - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]' - URL: 'https://www.openssl.org/source/openssl-[% c("version") %].tar.gz' diff --git a/projects/sandbox/config b/projects/sandbox/config index 218a276..3970322 100644 --- a/projects/sandbox/config +++ b/projects/sandbox/config @@ -5,10 +5,12 @@ git_hash: 'sandboxed-tor-browser-[% c("version") %]' tag_gpg_id: 1 gpg_keyring: obfs4.gpg filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 -distribution: Debian-8.7 var: + container: + use_container: 1 + suite: jessie + arch: amd64 deps: - libx11-dev - pkg-config @@ -22,7 +24,7 @@ targets: tag_gpg_id: 0 input_files: - - project: docker-image + - project: container-image - name: go project: go - name: gogb diff --git a/projects/siphash/config b/projects/siphash/config index 0f3f4b5..b2cb2a9 100644 --- a/projects/siphash/config +++ b/projects/siphash/config @@ -3,14 +3,15 @@ version: '[% c("abbrev") %]' git_url: https://github.com/dchest/siphash.git git_hash: 42ba037e748c9062a75e0924705c43b893edefcd filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 build: '[% c("projects/go/var/build_go_lib") %]' var: + container: + use_container: 1 go_lib: github.com/dchest/siphash input_files: - - project: docker-image + - project: container-image - name: go project: go diff --git a/projects/snowflake/config b/projects/snowflake/config index 3233ba4..212e86c 100644 --- a/projects/snowflake/config +++ b/projects/snowflake/config @@ -3,7 +3,10 @@ version: '[% c("abbrev") %]' git_url: https://git.torproject.org/pluggable-transports/snowflake.git git_hash: 9f2e9a6ecb696149708716ca06ce842df03cf492 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 + +var: + container: + use_container: 1 targets: linux-i686: @@ -19,7 +22,7 @@ targets: - libx11-dev input_files: - - project: docker-image + - project: container-image - name: go project: go - name: '[% c("var/compiler") %]' diff --git a/projects/tor-browser/config b/projects/tor-browser/config index 87cc6b2..c4c2521 100644 --- a/projects/tor-browser/config +++ b/projects/tor-browser/config @@ -1,9 +1,10 @@ # vim: filetype=yaml sw=2 version: '[% c("var/torbrowser_version") %]' filename: 'tor-browser-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -remote_docker: 1 var: + container: + use_container: 1 ddmg: '[% INCLUDE ddmg.sh %]' targets: @@ -24,12 +25,13 @@ targets: - bzip2 - faketime windows-i686: - distribution: Ubuntu-14.10 var: mar_osname: win32 + container: + suite: utopic input_files: - - project: docker-image + - project: container-image - project: firefox name: firefox - project: tor diff --git a/projects/tor-launcher/config b/projects/tor-launcher/config index 70f8acd..9211844 100644 --- a/projects/tor-launcher/config +++ b/projects/tor-launcher/config @@ -5,9 +5,11 @@ git_hash: '[% c("version") %]' gpg_keyring: torbutton.gpg tag_gpg_id: 1 filename: "[% project %]-[% c('version') %]-[% c('var/build_id') %].xpi" -remote_docker: 1 +var: + container: + use_container: 1 input_files: - - project: docker-image + - project: container-image targets: nightly: diff --git a/projects/tor/config b/projects/tor/config index c8940dd..a9da811 100644 --- a/projects/tor/config +++ b/projects/tor/config @@ -5,9 +5,10 @@ git_hash: 'tor-[% c("version") %]' git_url: https://git.torproject.org/tor.git gpg_keyring: tor.gpg tag_gpg_id: 1 -remote_docker: 1 var: + container: + use_container: 1 deps: - build-essential - automake @@ -50,6 +51,7 @@ targets: flag_mwindows: '' input_files: + - project: container-image - name: openssl project: openssl - name: libevent @@ -59,4 +61,3 @@ input_files: enable: '[% c("var/windows") %]' - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]' - - project: docker-image diff --git a/projects/torbutton/config b/projects/torbutton/config index b60e217..41d4d69 100644 --- a/projects/torbutton/config +++ b/projects/torbutton/config @@ -5,9 +5,11 @@ git_hash: '[% c("version") %]' gpg_keyring: torbutton.gpg tag_gpg_id: 1 filename: "[% project %]-[% c('version') %]-[% c('var/build_id') %].xpi" -remote_docker: 1 +var: + container: + use_container: 1 input_files: - - project: docker-image + - project: container-image targets: nightly: diff --git a/projects/uniuri/config b/projects/uniuri/config index 62fa8ef..e4c7294 100644 --- a/projects/uniuri/config +++ b/projects/uniuri/config @@ -3,11 +3,12 @@ version: '[% c("abbrev") %]' git_url: https://github.com/dchest/uniuri git_hash: 8902c56451e9b58ff940bbe5fec35d5f9c04584a filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 build: '[% c("projects/go/var/build_go_lib") %]' var: + container: + use_container: 1 go_lib: github.com/dchest/uniuri targets: @@ -15,6 +16,6 @@ targets: git_hash: master input_files: - - project: docker-image + - project: container-image - name: go project: go diff --git a/projects/webrtc/config b/projects/webrtc/config index bfd38c9..d46d821 100644 --- a/projects/webrtc/config +++ b/projects/webrtc/config @@ -1,13 +1,14 @@ # vim: filetype=yaml sw=2 version: '[% c("var/webrtc_tag") %]' -remote_docker: 1 filename: 'webrtc-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' var: + container: + use_container: 1 webrtc_tag: c279861207c5b15fc51069e96595782350e0ac12 input_files: - - project: docker-image + - project: container-image - project: webrtc pkg_type: fetch_sources - project: depot_tools @@ -27,7 +28,6 @@ targets: os: linux linux-i686: var: - dockerbuild: "[% pc('docker-image', 'pre') %]" sort_deps: 0 arch_deps: - lib32asound2-dev @@ -65,7 +65,9 @@ targets: steps: fetch_sources: - remote_docker: 0 + var: + container: + use_container: 0 filename: 'webrtc-sources-[% c("var/webrtc_tag") %].tar.gz' fetch_sources: | #!/bin/bash diff --git a/projects/yasm/config b/projects/yasm/config index 3d8a28a..12d009b 100644 --- a/projects/yasm/config +++ b/projects/yasm/config @@ -1,10 +1,12 @@ # vim: filetype=yaml sw=2 version: 1.2.0 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 +var: + container: + use_container: 1 input_files: - - project: docker-image + - project: container-image - URL: 'https://www.tortall.net/projects/yasm/releases/yasm-[% c("version") %].tar.gz' name: yasm sha256sum: 768ffab457b90a20a6d895c39749adb547c1b7cb5c108e84b151a838a23ccf31 diff --git a/projects/zlib/config b/projects/zlib/config index 5219559..3ad562c 100644 --- a/projects/zlib/config +++ b/projects/zlib/config @@ -5,9 +5,12 @@ git_hash: 'v[% c("version") %]' git_url: https://github.com/madler/zlib.git gpg_keyring: zlib.gpg tag_gpg_id: 1 -remote_docker: 1 + +var: + container: + use_container: 1 input_files: + - project: container-image - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]' - - project: docker-image diff --git a/rbm b/rbm index 3f3886e..106e9b0 160000 --- a/rbm +++ b/rbm @@ -1 +1 @@ -Subproject commit 3f3886e1f210ad2853209c5aecd0951350a6f758 +Subproject commit 106e9b05aeff6309e241a3c9bae1781e0d551e7a diff --git a/rbm.conf b/rbm.conf index 651acfa..722c85a 100644 --- a/rbm.conf +++ b/rbm.conf @@ -20,12 +20,16 @@ var: build_id_txt: | [% c("version") %] [% IF c("git_hash") || c("hg_hash"); GET c("abbrev"); END; %] - [% IF c("remote_docker") -%] - [% c("distribution") %] + [% IF c("var/container/use_container") -%] + [% c("var/container/suite") %] + [% c("var/container/arch") %] [% END -%] input_files: [% c("input_files_id") %] build: [% c("build", { filename => 'f', output_dir => '/out' }) %] + container: + dir: '[% c("tmp_dir") %]/rbm-containers/[% sha256(c("build_id")) %]' + user: rbm input_files_list: | [% FOREACH file IN c("input_files_by_name").keys.sort -%] [% c("input_files_by_name/" _ file) %] @@ -136,19 +140,23 @@ targets: - zip - unzip linux: - distribution: Debian-7.11 var: linux: 1 compiler: gcc + container: + suite: wheezy + arch: amd64 torbrowser-windows-i686: - windows-i686 windows-i686: - distribution: Ubuntu-12.04 arch: i686 var: windows: 1 osname: windows-i686 + container: + suite: precise + arch: amd64 configure_opt: '--host=i686-w64-mingw32 CFLAGS="[% c("var/CFLAGS") %]" LDFLAGS="[% c("var/LDFLAGS") %]"' CFLAGS: '[% c("var/flag_mwindows") %] -fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security' LDFLAGS: '[% c("var/flag_mwindows") %] -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$gcclibs' @@ -167,11 +175,13 @@ targets: torbrowser-osx-x86_64: - osx-x86_64 osx-x86_64: - distribution: Debian-8.7 arch: x86_64 var: osx: 1 osname: osx-x86_64 + container: + suite: jessie + arch: amd64 compiler: 'macosx-toolchain' configure_opt: '--host=x86_64-apple-darwin10 CC="x86_64-apple-darwin10-clang [% c("var/FLAGS") %]" CXX="x86_64-apple-darwin10-clang++ [% c("var/FLAGS") %]"' FLAGS: "-target x86_64-apple-darwin10 -mlinker-version=136 -B $cctoolsdir -isysroot $sysrootdir" @@ -195,9 +205,6 @@ targets: build_id: 1 -docker_image: '[% pc("docker-image", "docker_save_image") %]' -docker_image_prefix: '[% GET c("var/project_name") ? c("var/project_name") : "rbm-build" %]_[% GET ENV.RBM_BUILDNAME ? ENV.RBM_BUILDNAME : ENV.USER ? ENV.USER : c("uid") %]' - # change the default gpg_wrapper to allow git tag signed using an # expired key. # https://bugs.torproject.org/19737 @@ -218,6 +225,76 @@ gpg_wrapper: | exec [% c('gpg_bin') %] [% c('gpg_args') %] --with-fingerprint [% gpg_kr %] "$@" fi +remote_start: '[% IF c("var/container/use_container") %][% c("runc/remote_start") %][% END %]' +remote_exec: '[% IF c("var/container/use_container") %][% c("runc/remote_exec") %][% END %]' +remote_put: '[% IF c("var/container/use_container") %][% c("runc/remote_put") %][% END %]' +remote_get: '[% IF c("var/container/use_container") %][% c("runc/remote_get") %][% END %]' +remote_finish: '[% IF c("var/container/use_container") %][% c("runc/remote_finish") %][% END %]' + +runc: + remote_start: | + #!/bin/sh + set -e + if [ $(ls -1 '[% c("remote_srcdir", { error_if_undef => 1 }) %]/container-image_'* | wc -l) -ne 1 ] + then + echo "Can't find container image in input files" >&2 + ls -l '[% c("remote_srcdir") %]' >&2 + exit 1 + fi + mkdir -p '[% c("var/container/dir") %]'/rootfs/rbm + sudo tar -C '[% c("var/container/dir") %]'/rootfs -xf $(ls -1 '[% c("remote_srcdir", { error_if_undef => 1 }) %]/container-image_'*) + cat > '[% c("var/container/dir") %]'/config.json << EOF + [% INCLUDE 'runc-config.json' %] + EOF + [% SET user = c("var/container/user") -%] + [% c("remote_exec", { exec_as_root => 1, exec_cmd => 'id ' _ user + _ ' >/dev/null 2>&1 || adduser -m ' _ user _ ' || useradd -m ' _ user }) %] + + remote_exec: | + #!/bin/sh + set -e + mkdir -p '[% c("var/container/dir", { error_if_undef => 1 }) %]'/rootfs/rbm + echo '#!/bin/sh' > '[% c("var/container/dir") %]'/rootfs/rbm/cmd + echo [% shell_quote(c('exec_cmd')) %] >> '[% c("var/container/dir") %]'/rootfs/rbm/cmd + echo '#!/bin/sh' > '[% c("var/container/dir") %]'/rootfs/rbm/run + [% IF c('exec_as_root'); SET user = 'root'; ELSE; SET user = c("var/container/user", { error_if_undef => 1 }); END; %] + echo 'su - [% user %] -c /rbm/cmd' >> '[% c("var/container/dir") %]'/rootfs/rbm/run + chmod +x '[% c("var/container/dir") %]'/rootfs/rbm/cmd + chmod +x '[% c("var/container/dir") %]'/rootfs/rbm/run + sudo runc start -b '[% c("var/container/dir") %]' rbm-[% sha256(c("build_id", { error_if_undef => 1 })) %] + + remote_put: | + #!/bin/sh + set -e + [% + SET src = shell_quote(c('put_src', { error_if_undef => 1 })); + SET dst = shell_quote(c('put_dst', { error_if_undef => 1 })); + -%] + sudo mkdir -p '[% c("var/container/dir") %]'/rootfs/[% dst %] + sudo cp -aP [% src %] '[% c("var/container/dir") %]'/rootfs/[% dst %] + [% c("remote_exec", { exec_as_root => 1, exec_cmd => 'chown -R ' _ c("var/container/user") _ ' ' _ dst }) %] + + remote_get: | + #!/bin/sh + set -e + [% + SET src = shell_quote(c('get_src', { error_if_undef => 1 })); + SET dst = shell_quote(c('get_dst', { error_if_undef => 1 })); + -%] + mkdir -p [% dst %] + srcdir='[% c("var/container/dir", { error_if_undef => 1 }) %]'/rootfs/[% src %] + if [ $(ls -1 "$srcdir"/* 2> /dev/null | wc -l) -gt 0 ] + then + sudo chown $(whoami) "$srcdir"/* + sudo mv -f "$srcdir"/* [% dst %]/ + fi + + remote_finish: | + #!/bin/sh + set -e + sudo rm -Rf '[% c("var/container/dir", { error_if_undef => 1 }) %]'/rootfs '[% c("var/container/dir", { error_if_undef => 1 }) %]'/config.json + rmdir '[% c("var/container/dir") %]' + ENV: TZ: UTC LC_ALL: C diff --git a/rbm.local.conf.example b/rbm.local.conf.example index 78de08f..203ce5f 100644 --- a/rbm.local.conf.example +++ b/rbm.local.conf.example @@ -16,12 +16,6 @@ ### this. #debug: 0 -### If you are doing multiple builds in different directories on the -### same host, you should define docker_image_prefix with a different -### value for each build directory, so that the different builds don't -### use the same docker image names. -#docker_image_prefix: tor-browser_XXXXX - ### The build_log option defines in which file the build logs of each ### component are stored. If you set it to '-' the logs are output on ### stdout and stderr. diff --git a/tools/clean-old b/tools/clean-old index 4d603fc..c7d9e0c 100755 --- a/tools/clean-old +++ b/tools/clean-old @@ -27,24 +27,6 @@ sub clean_file { } } -sub clean_docker_images { - my ($dockerdir, $used_files) = @_; - my $imgprefix = RBM::project_config('docker-image', 'docker_image_prefix'); - my @imgs = read_dir($dockerdir); - foreach my $dockerimage (@imgs) { - next if $used_files->{"$dockerdir/$dockerimage"}; - my $img = "$imgprefix:$dockerimage"; - print "Cleaning docker image $img\n"; - next if $options{'dry-run'}; - my ($out, $err, $success) = capture_exec('docker', 'rmi', '-f', $img); - if (!$success) { - print STDERR "Error removing docker image $img:\n$err\n"; - exit 1; - } - unlink "$dockerdir/$dockerimage"; - } -} - sub get_project_input_files { my ($project, @targets) = @_; print "Getting input files for $project ", join(' ', @targets), "\n"; @@ -108,7 +90,4 @@ foreach my $branch (keys %$clean) { } my %used_files = map { $_ => 1 } @files; my $outdir = $RBM::config->{basedir} . '/out'; -# Don't clean docker-image files yet -$used_files{"$outdir/docker-image"} = 1; clean_file($outdir, \%used_files); -clean_docker_images("$outdir/docker-image", \%used_files);

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] Bug 21792: Suppress MediaError.message when privacy.resistFingerprinting = true
by gk＠torproject.org 03 May '17

03 May '17

commit 58d186df19450f9aef0423c71e78f6eaa17679f8 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Thu Apr 27 15:00:14 2017 -0700 Bug 21792: Suppress MediaError.message when privacy.resistFingerprinting = true --- dom/html/MediaError.cpp | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/dom/html/MediaError.cpp b/dom/html/MediaError.cpp index 83b9ffc..fae0981 100644 --- a/dom/html/MediaError.cpp +++ b/dom/html/MediaError.cpp @@ -7,6 +7,7 @@ #include "mozilla/dom/MediaError.h" #include "nsDOMClassInfoID.h" #include "mozilla/dom/MediaErrorBinding.h" +#include "nsContentUtils.h" namespace mozilla { namespace dom { @@ -31,7 +32,12 @@ MediaError::MediaError(HTMLMediaElement* aParent, uint16_t aCode, void MediaError::GetMessage(nsAString& aResult) const { - CopyUTF8toUTF16(mMessage, aResult); + if (nsContentUtils::IsCallerChrome() || + !nsContentUtils::ShouldResistFingerprinting()) { + CopyUTF8toUTF16(mMessage, aResult); + } else { + aResult.Truncate(); + } } JSObject*

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 02 May '17

02 May '17

commit 29b3b7af8e3b9528204ae49a396af80b3e4c4d61 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Wed Apr 26 15:38:30 2017 -0700 fixup! TB4: Tor Browser's Firefox preference overrides. We fix bug 21675 by pretending every user has just one core available. --- browser/app/profile/000-tor-browser.js | 1 + 1 file changed, 1 insertion(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 0715a01..27cfe53 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -151,6 +151,7 @@ pref("reader.parse-on-load.enabled", false); pref("privacy.use_utc_timezone", true); pref("media.webspeech.synth.enabled", false); // Bug 10283: Disable SpeechSynthesis API pref("dom.webaudio.enabled", false); // Bug 13017: Disable Web Audio API +pref("dom.maxHardwareConcurrency", 1); // Bug 21675: Spoof single-core cpu // Third party stuff pref("network.cookie.cookieBehavior", 1);

1 0

[tor-browser-bundle/master] Fold in stable changelog
by gk＠torproject.org 02 May '17

02 May '17

commit a89f99a8b8700a04af9f795f4d2115fb1dd3eabb Author: Georg Koppen <gk(a)torproject.org> Date: Tue May 2 09:04:21 2017 +0000 Fold in stable changelog --- Bundle-Data/Docs/ChangeLog.txt | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index b2ee463..afe3999 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -83,6 +83,18 @@ Tor Browser 7.0a3 -- April 20 2017 * Bug 21960: Linux bundles based on ESR 52 are not reproducible anymore * Bug 21629: Fix broken ASan builds when switching to ESR 52 +Tor Browser 6.5.2 -- April 19 2017 + * All Platforms + * Update Firefox to 45.9.0esr + * Update HTTPS-Everywhere to 5.2.14 + * Update NoScript to 5.0.2 + * Bug 21555+16450: Don't remove Authorization header on subdomains (e.g. Twitter) + * Bug 19316: Make sure our Windows updates can deal with the SSE2 requirement + * Bug 21917: Add new obfs4 bridges + * Bug 21918: Move meek-amazon to d2cly7j4zqgua7.cloudfront.net backend + * Windows + * Bug 21795: Fix Tor Browser crashing on github.com + Tor Browser 7.0a2-hardened -- March 7 2017 * All Platforms * Update Firefox to 45.8.0esr

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! Bug #4234: Use the Firefox Update Process for Tor Browser.
by gk＠torproject.org 02 May '17

02 May '17

commit d70009f425f9da6a74413b286ef768ba97c899cd Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue Apr 25 11:34:07 2017 -0400 fixup! Bug #4234: Use the Firefox Update Process for Tor Browser. Bug 22041: libmozsandbox.so error after upgrading to 7.0a3 Fix a problem with unstaged updates on Linux and OSX where the original files were not restored after a partial update failed to apply due to changes the user made within their installation. This would leave the browser in a state where it had a mix of old files and new (patched) files, which can cause the browser to not be able to start, and therefore not be able to fallback to a complete update. --- toolkit/mozapps/update/updater/updater.cpp | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/toolkit/mozapps/update/updater/updater.cpp b/toolkit/mozapps/update/updater/updater.cpp index 988cf55..1bc4867 100644 --- a/toolkit/mozapps/update/updater/updater.cpp +++ b/toolkit/mozapps/update/updater/updater.cpp @@ -1037,9 +1037,10 @@ static int backup_restore(const NS_tchar *path, const NS_tchar *relPath) bool isLink = false; #ifndef XP_WIN struct stat linkInfo; - int rv = lstat(path, &linkInfo); - if (!rv) { - LOG(("backup_restore: cannot get info for backup file: " LOG_S, relBackup)); + int rv = lstat(backup, &linkInfo); + if (rv) { + LOG(("backup_restore: cannot get info for backup file: " LOG_S ", err: %d", + relBackup, errno)); return OK; } isLink = S_ISLNK(linkInfo.st_mode);

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 02 May '17

02 May '17

commit ff923c1609c6bc4d9dd3a8b60f684d7c410a7399 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Fri Apr 28 11:20:24 2017 -0700 fixup! TB4: Tor Browser's Firefox preference overrides. We work around bug 13017 by disabling the Web Audio API for now. --- browser/app/profile/000-tor-browser.js | 1 + 1 file changed, 1 insertion(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 9ca4149..0715a01 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -150,6 +150,7 @@ pref("browser.reader.detectedFirstArticle", true); pref("reader.parse-on-load.enabled", false); pref("privacy.use_utc_timezone", true); pref("media.webspeech.synth.enabled", false); // Bug 10283: Disable SpeechSynthesis API +pref("dom.webaudio.enabled", false); // Bug 13017: Disable Web Audio API // Third party stuff pref("network.cookie.cookieBehavior", 1);

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] Bug 1282655 - Test if site permissions are universal across origin attributes. r=tanvi
by gk＠torproject.org 27 Apr '17

27 Apr '17

commit 59cba8d0681caf53c46cd3718e34c9a49f9c5921 Author: Jonathan Hao <jhao(a)mozilla.com> Date: Mon Dec 26 22:38:00 2016 -0500 Bug 1282655 - Test if site permissions are universal across origin attributes. r=tanvi --HG-- extra : rebase_source : 6155960b626c29092c96ea7fbc605cc0b637d918 --- .../originattributes/test/browser/browser.ini | 1 + .../test/browser/browser_permissions.js | 44 ++++++++++++++++++++++ 2 files changed, 45 insertions(+) diff --git a/browser/components/originattributes/test/browser/browser.ini b/browser/components/originattributes/test/browser/browser.ini index 911d42f..d503e9e 100644 --- a/browser/components/originattributes/test/browser/browser.ini +++ b/browser/components/originattributes/test/browser/browser.ini @@ -69,3 +69,4 @@ support-files = [browser_httpauth.js] [browser_clientAuth.js] [browser_cacheAPI.js] +[browser_permissions.js] diff --git a/browser/components/originattributes/test/browser/browser_permissions.js b/browser/components/originattributes/test/browser/browser_permissions.js new file mode 100644 index 0000000..fd3220b --- /dev/null +++ b/browser/components/originattributes/test/browser/browser_permissions.js @@ -0,0 +1,44 @@ +/** + * Bug 1282655 - Test if site permissions are universal across origin attributes. + * + * This test is testing the cookie "permission" for a specific URI. + */ + +const TEST_PAGE = "http://example.net"; +const uri = Services.io.newURI(TEST_PAGE, null, null); + +function disableCookies() { + Services.cookies.removeAll(); + Services.perms.add(uri, "cookie", Services.perms.DENY_ACTION); +} + +function ensureCookieNotSet(aBrowser) { + ContentTask.spawn(aBrowser, null, function*() { + content.document.cookie = "key=value"; + is(content.document.cookie, "", "Setting/reading cookies should be disabled" + + " for this domain for all origin attribute combinations."); + }); +} + +IsolationTestTools.runTests(TEST_PAGE, ensureCookieNotSet, () => true, + disableCookies); + +function enableCookies() { + Services.cookies.removeAll(); + Services.perms.add(uri, "cookie", Services.perms.ALLOW_ACTION); +} + +function ensureCookieSet(aBrowser) { + ContentTask.spawn(aBrowser, null, function() { + content.document.cookie = "key=value"; + is(content.document.cookie, "key=value", "Setting/reading cookies should be" + + " enabled for this domain for all origin attribute combinations."); + }); +} + +IsolationTestTools.runTests(TEST_PAGE, ensureCookieSet, () => true, + enableCookies); + +registerCleanupFunction(() => { + Services.cookies.removeAll(); +});

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] Bug 1274020 - Tests that shows the Cache Web API is separated by origin attributes. r=baku
by gk＠torproject.org 27 Apr '17

27 Apr '17

commit 3da33fc90ce348fbc594d5aa45e85d8a4f08e539 Author: Jonathan Hao <jhao(a)mozilla.com> Date: Tue Dec 13 11:44:59 2016 +0800 Bug 1274020 - Tests that shows the Cache Web API is separated by origin attributes. r=baku --HG-- extra : rebase_source : 8964090126795ed45650e76c4f9e02b2e60f62cf --- .../originattributes/test/browser/browser.ini | 1 + .../originattributes/test/browser/browser_cacheAPI.js | 18 ++++++++++++++++++ .../components/originattributes/test/browser/head.js | 7 +++++-- 3 files changed, 24 insertions(+), 2 deletions(-) diff --git a/browser/components/originattributes/test/browser/browser.ini b/browser/components/originattributes/test/browser/browser.ini index 121dd0c..911d42f 100644 --- a/browser/components/originattributes/test/browser/browser.ini +++ b/browser/components/originattributes/test/browser/browser.ini @@ -68,3 +68,4 @@ support-files = [browser_sharedworker.js] [browser_httpauth.js] [browser_clientAuth.js] +[browser_cacheAPI.js] diff --git a/browser/components/originattributes/test/browser/browser_cacheAPI.js b/browser/components/originattributes/test/browser/browser_cacheAPI.js new file mode 100644 index 0000000..87dcfe5 --- /dev/null +++ b/browser/components/originattributes/test/browser/browser_cacheAPI.js @@ -0,0 +1,18 @@ +const requestURL = "https://test1.example.com"; + +function getResult(aBrowser) { + return ContentTask.spawn(aBrowser, requestURL, function* (url) { + let cache = yield content.caches.open("TEST_CACHE"); + let response = yield cache.match(url); + if (response) { + return response.statusText; + } + let result = Math.random().toString(); + response = new content.Response("", { statusText: result }); + yield cache.put(url, response); + return result; + }); +} + +IsolationTestTools.runTests("https://test2.example.com", getResult, null, null, + false, /* aUseHttps */ true); diff --git a/browser/components/originattributes/test/browser/head.js b/browser/components/originattributes/test/browser/head.js index 96559a1..7835ccf 100644 --- a/browser/components/originattributes/test/browser/head.js +++ b/browser/components/originattributes/test/browser/head.js @@ -279,7 +279,7 @@ this.IsolationTestTools = { * An optional boolean to ensure we get results before the next tab is opened. */ runTests(aURL, aGetResultFuncs, aCompareResultFunc, aBeforeFunc, - aGetResultImmediately) { + aGetResultImmediately, aUseHttps) { let pageURL; let firstFrameSetting; let secondFrameSetting; @@ -301,7 +301,10 @@ this.IsolationTestTools = { aGetResultFuncs = [aGetResultFuncs]; } - let tabSettings = [ + let tabSettings = aUseHttps ? [ + { firstPartyDomain: "https://example.com", userContextId: 1}, + { firstPartyDomain: "https://example.org", userContextId: 2} + ] : [ { firstPartyDomain: "http://example.com", userContextId: 1}, { firstPartyDomain: "http://example.org", userContextId: 2} ];

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] Bug 1315602 - Remove the assertion of FirstPartyDomain should be empty in HTTP redirect. r=smaug
by gk＠torproject.org 27 Apr '17

27 Apr '17

commit efd86213b996d351757498968481962eb610c06c Author: Yoshi Huang <allstars.chh(a)mozilla.com> Date: Mon Nov 7 14:59:05 2016 +0800 Bug 1315602 - Remove the assertion of FirstPartyDomain should be empty in HTTP redirect. r=smaug --- .../originattributes/test/browser/browser.ini | 6 ++ .../test/browser/browser_firstPartyIsolation.js | 105 +++++++++++++++++++++ ...st_firstParty_http_redirect_to_same_domain.html | 9 ++ ...arty_http_redirect_to_same_domain.html^headers^ | 2 + .../originattributes/test/browser/test_form.html | 14 +++ .../originattributes/test/browser/window2.html | 11 +++ .../originattributes/test/browser/window3.html | 11 +++ .../test/browser/window_redirect.html | 12 +++ netwerk/protocol/http/HttpBaseChannel.cpp | 2 - 9 files changed, 170 insertions(+), 2 deletions(-) diff --git a/browser/components/originattributes/test/browser/browser.ini b/browser/components/originattributes/test/browser/browser.ini index 61f6743..121dd0c 100644 --- a/browser/components/originattributes/test/browser/browser.ini +++ b/browser/components/originattributes/test/browser/browser.ini @@ -44,9 +44,15 @@ support-files = test_firstParty_html_redirect.html test_firstParty_http_redirect.html test_firstParty_http_redirect.html^headers^ + test_firstParty_http_redirect_to_same_domain.html + test_firstParty_http_redirect_to_same_domain.html^headers^ test_firstParty_iframe_http_redirect.html test_firstParty_postMessage.html + test_form.html window.html + window2.html + window3.html + window_redirect.html worker_blobify.js worker_deblobify.js diff --git a/browser/components/originattributes/test/browser/browser_firstPartyIsolation.js b/browser/components/originattributes/test/browser/browser_firstPartyIsolation.js index ddda6af..53fa858 100644 --- a/browser/components/originattributes/test/browser/browser_firstPartyIsolation.js +++ b/browser/components/originattributes/test/browser/browser_firstPartyIsolation.js @@ -172,3 +172,108 @@ add_task(function* openWindow_test() { yield BrowserTestUtils.closeWindow(win); }); +/** + * When the web page calls window.open, the top-level docshell in the new + * created window will have firstPartyDomain set. + */ +add_task(function* window_open_redirect_test() { + Services.prefs.setIntPref("browser.link.open_newwindow", 2); + registerCleanupFunction(function() { + Services.prefs.clearUserPref("browser.link.open_newwindow"); + }); + + let tab = gBrowser.addTab(BASE_URL + "window_redirect.html"); + let win = yield BrowserTestUtils.waitForNewWindow(); + yield BrowserTestUtils.browserLoaded(win.gBrowser.selectedBrowser); + + yield ContentTask.spawn(win.gBrowser.selectedBrowser, { firstPartyDomain: "mochi.test" }, function* (attrs) { + Assert.equal(docShell.getOriginAttributes().firstPartyDomain, attrs.firstPartyDomain, + "window.open() should have firstPartyDomain attribute"); + Assert.equal(content.document.nodePrincipal.originAttributes.firstPartyDomain, + attrs.firstPartyDomain, "The document should have firstPartyDomain"); + }); + + gBrowser.removeTab(tab); + yield BrowserTestUtils.closeWindow(win); +}); + +/** + * When the web page calls window.open, the top-level docshell in the new + * created window will inherit the firstPartyDomain attribute. + * However the top-level document will override the firstPartyDomain if the + * document is from another domain. + */ +add_task(function* window_open_iframe_test() { + Services.prefs.setIntPref("browser.link.open_newwindow", 2); + registerCleanupFunction(function() { + Services.prefs.clearUserPref("browser.link.open_newwindow"); + }); + + let tab = gBrowser.addTab(BASE_URL + "window2.html"); + let win = yield BrowserTestUtils.waitForNewWindow(); + yield BrowserTestUtils.browserLoaded(win.gBrowser.selectedBrowser, true); + + yield ContentTask.spawn(win.gBrowser.selectedBrowser, { firstPartyDomain: "mochi.test" }, function* (attrs) { + Assert.equal(docShell.getOriginAttributes().firstPartyDomain, attrs.firstPartyDomain, + "window.open() should have firstPartyDomain attribute"); + + // The document is http://example.com/browser/browser/components/originattributes/test/browser… + // so the firstPartyDomain will be overriden to 'example.com'. + Assert.equal(content.document.nodePrincipal.originAttributes.firstPartyDomain, + "example.com", "The document should have firstPartyDomain"); + + let iframe = content.document.getElementById("iframe1"); + Assert.equal(iframe.frameLoader.docShell.getOriginAttributes().firstPartyDomain, + "example.com", "iframe's docshell should have firstPartyDomain"); + Assert.equal(iframe.contentDocument.nodePrincipal.originAttributes.firstPartyDomain, + "example.com", "iframe should have firstPartyDomain"); + }); + + gBrowser.removeTab(tab); + yield BrowserTestUtils.closeWindow(win); +}); + +/** + * Test for the loadInfo->TriggeringPrincipal is the document itself. + */ +add_task(function* form_test() { + let tab = gBrowser.addTab(BASE_URL + "test_form.html"); + yield BrowserTestUtils.browserLoaded(tab.linkedBrowser); + + yield ContentTask.spawn(tab.linkedBrowser, { firstPartyDomain: "mochi.test" }, function* (attrs) { + Assert.equal(content.document.nodePrincipal.originAttributes.firstPartyDomain, + attrs.firstPartyDomain, "The document should have firstPartyDomain"); + + let submit = content.document.getElementById("submit"); + submit.click(); + }); + + gBrowser.removeTab(tab); +}); + +/** + * Another test for loadInfo->TriggeringPrincipal in the window.open case. + */ +add_task(function* window_open_form_test() { + Services.prefs.setIntPref("browser.link.open_newwindow", 2); + registerCleanupFunction(function() { + Services.prefs.clearUserPref("browser.link.open_newwindow"); + }); + + let tab = gBrowser.addTab(BASE_URL + "window3.html"); + let win = yield BrowserTestUtils.waitForNewWindow(); + yield BrowserTestUtils.browserLoaded(win.gBrowser.selectedBrowser, true); + + yield ContentTask.spawn(win.gBrowser.selectedBrowser, { firstPartyDomain: "mochi.test" }, function* (attrs) { + Assert.equal(docShell.getOriginAttributes().firstPartyDomain, attrs.firstPartyDomain, + "window.open() should have firstPartyDomain attribute"); + Assert.equal(content.document.nodePrincipal.originAttributes.firstPartyDomain, + "example.com", "The document should have firstPartyDomain"); + + let submit = content.document.getElementById("submit"); + submit.click(); + }); + + gBrowser.removeTab(tab); + yield BrowserTestUtils.closeWindow(win); +}); diff --git a/browser/components/originattributes/test/browser/test_firstParty_http_redirect_to_same_domain.html b/browser/components/originattributes/test/browser/test_firstParty_http_redirect_to_same_domain.html new file mode 100644 index 0000000..7b794a0 --- /dev/null +++ b/browser/components/originattributes/test/browser/test_firstParty_http_redirect_to_same_domain.html @@ -0,0 +1,9 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"/> + <title>Test for Bug 1260931</title> +</head> +<body> +</body> +</html> diff --git a/browser/components/originattributes/test/browser/test_firstParty_http_redirect_to_same_domain.html^headers^ b/browser/components/originattributes/test/browser/test_firstParty_http_redirect_to_same_domain.html^headers^ new file mode 100644 index 0000000..e4af8ed --- /dev/null +++ b/browser/components/originattributes/test/browser/test_firstParty_http_redirect_to_same_domain.html^headers^ @@ -0,0 +1,2 @@ +HTTP 302 Found +Location: http://mochi.test:8888/browser/browser/components/originattributes/test/bro… diff --git a/browser/components/originattributes/test/browser/test_form.html b/browser/components/originattributes/test/browser/test_form.html new file mode 100644 index 0000000..db1b900 --- /dev/null +++ b/browser/components/originattributes/test/browser/test_form.html @@ -0,0 +1,14 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test for Bug 1260931</title> +</head> +<body> +<form action="test_firstParty_http_redirect_to_same_domain.html" method="POST"> + First name: <input type="text" name="fname"><br> + Last name: <input type="text" name="lname"><br> + <input type="submit" id="submit" value="Submit"> +</form> +</body> +</html> diff --git a/browser/components/originattributes/test/browser/window2.html b/browser/components/originattributes/test/browser/window2.html new file mode 100644 index 0000000..3c5a7fb --- /dev/null +++ b/browser/components/originattributes/test/browser/window2.html @@ -0,0 +1,11 @@ +<html> + <head> + <meta charset="utf8"> + <title>Page creating a popup</title> + </head> + <body> + <script type="text/javascript"> + var w = window.open("http://example.com/browser/browser/components/originattributes/test/browser…", "test"); + </script> + </body> +</html> diff --git a/browser/components/originattributes/test/browser/window3.html b/browser/components/originattributes/test/browser/window3.html new file mode 100644 index 0000000..168ced6 --- /dev/null +++ b/browser/components/originattributes/test/browser/window3.html @@ -0,0 +1,11 @@ +<html> + <head> + <meta charset="utf8"> + <title>Page creating a popup</title> + </head> + <body> + <script type="text/javascript"> + var w = window.open("http://example.com/browser/browser/components/originattributes/test/browser…", "test"); + </script> + </body> +</html> diff --git a/browser/components/originattributes/test/browser/window_redirect.html b/browser/components/originattributes/test/browser/window_redirect.html new file mode 100644 index 0000000..b51cdf4 --- /dev/null +++ b/browser/components/originattributes/test/browser/window_redirect.html @@ -0,0 +1,12 @@ +<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"> +<html> + <head> + <meta charset="utf8"> + <title>Page creating a popup</title> + </head> + <body> + <script type="text/javascript"> + var w = window.open('test_firstParty_http_redirect_to_same_domain.html', "test"); + </script> + </body> +</html> diff --git a/netwerk/protocol/http/HttpBaseChannel.cpp b/netwerk/protocol/http/HttpBaseChannel.cpp index d2bc0cc..e0f7ede 100644 --- a/netwerk/protocol/http/HttpBaseChannel.cpp +++ b/netwerk/protocol/http/HttpBaseChannel.cpp @@ -3034,8 +3034,6 @@ HttpBaseChannel::SetupReplacementChannel(nsIURI *newURI, if (loadContext) { loadContext->GetOriginAttributes(docShellAttrs); } - MOZ_ASSERT(docShellAttrs.mFirstPartyDomain.IsEmpty(), - "top-level docshell shouldn't have firstPartyDomain attribute."); NeckoOriginAttributes attrs = newLoadInfo->GetOriginAttributes();

1 0

[rbm/master] Add process_template_opt subroutine
by boklm＠torproject.org 27 Apr '17

27 Apr '17

commit 36d9a7357740ba9d7b939738b199f7ec11ce80b2 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Apr 27 12:19:57 2017 +0200 Add process_template_opt subroutine In the few places where we are using process_template directly, the $options is ignored. We fix that by adding a process_template_opt subroutine which applies the $options. --- lib/RBM.pm | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/lib/RBM.pm b/lib/RBM.pm index 57a6161..3fa8d35 100644 --- a/lib/RBM.pm +++ b/lib/RBM.pm @@ -587,6 +587,15 @@ sub sha256file { return $res{$f} = -f $f ? sha256_hex(scalar read_file($f)) : ''; } +sub process_template_opt { + my ($project, $tmpl, $opt, $dest_dir) = @_; + my $save_opt = $config->{opt}; + $config->{opt} = {%{$config->{opt}}, %$opt} if $opt; + my $res = process_template($project, $tmpl, $dest_dir); + $config->{opt} = $save_opt; + return $res; +} + sub process_template { my ($project, $tmpl, $dest_dir) = @_; return undef unless defined $tmpl; @@ -745,7 +754,7 @@ sub input_files { foreach my $input_file (@$input_files) { if (!ref $input_file) { $input_file = project_config($project, - process_template($project, $input_file), $options); + process_template_opt($project, $input_file, $options), $options); } next unless $input_file; my $t = sub { @@ -757,8 +766,8 @@ sub input_files { next; } if ($input_file->{target} && ! $input_file->{_target_processed}) { - $input_file->{target} = process_template($project, - $input_file->{target}); + $input_file->{target} = process_template_opt($project, + $input_file->{target}, $options); $input_file->{_target_processed} = 1; } if ($action eq 'getfnames') {

1 0

[rbm/master] Avoid modifying $input_files
by boklm＠torproject.org 27 Apr '17

27 Apr '17

commit 106e9b05aeff6309e241a3c9bae1781e0d551e7a Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Apr 27 12:30:25 2017 +0200 Avoid modifying $input_files If an input_file contains a 'target' value we process it as a template and modify it. However we should not do that as a project (and its input files) can be used multiple times with different contexts in the same build. Instead we should make a copy of the $input_file before we modify it. --- lib/RBM.pm | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/lib/RBM.pm b/lib/RBM.pm index 50332d7..6825050 100644 --- a/lib/RBM.pm +++ b/lib/RBM.pm @@ -751,7 +751,8 @@ sub input_files { my $src_dir = "$proj_dir/$project"; my $old_cwd = getcwd; chdir $src_dir || exit_error "cannot chdir to $src_dir"; - foreach my $input_file (@$input_files) { + foreach my $input_file_alias (@$input_files) { + my $input_file = $input_file_alias; if (!ref $input_file) { $input_file = project_config($project, process_template_opt($project, $input_file, $options), $options); @@ -765,10 +766,10 @@ sub input_files { if ($input_file->{enable} && !$t->('enable')) { next; } - if ($input_file->{target} && ! $input_file->{_target_processed}) { + if ($input_file->{target}) { + $input_file = { %$input_file }; $input_file->{target} = process_template_opt($project, $input_file->{target}, $options); - $input_file->{_target_processed} = 1; } if ($action eq 'getfnames') { my $getfnames_name;

1 0

[rbm/master] Remove useless comma
by boklm＠torproject.org 27 Apr '17

27 Apr '17

commit 0bf69095d566885d3daa23fd51dae28a02d84590 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Apr 27 12:29:03 2017 +0200 Remove useless comma --- lib/RBM.pm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/RBM.pm b/lib/RBM.pm index 3fa8d35..50332d7 100644 --- a/lib/RBM.pm +++ b/lib/RBM.pm @@ -745,7 +745,7 @@ sub input_files { my $need_dl = $action ne 'getfpaths'; my $input_files_id = ''; $options = {$options ? %$options : ()}; - my $input_files = project_config($project, 'input_files', $options,); + my $input_files = project_config($project, 'input_files', $options); goto RETURN_RES unless $input_files; my $proj_dir = path(project_config($project, 'projects_dir', $options)); my $src_dir = "$proj_dir/$project";

1 0

[rbm/master] Fix how we set origin_project in input_files
by boklm＠torproject.org 27 Apr '17

27 Apr '17

commit 1a2a9d99ee058d5ca9d4e0f524cbb4eb771762e7 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Apr 27 12:14:12 2017 +0200 Fix how we set origin_project in input_files --- lib/RBM.pm | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/lib/RBM.pm b/lib/RBM.pm index c92ae65..57a6161 100644 --- a/lib/RBM.pm +++ b/lib/RBM.pm @@ -761,7 +761,6 @@ sub input_files { $input_file->{target}); $input_file->{_target_processed} = 1; } - $options->{origin_project} = $project; if ($action eq 'getfnames') { my $getfnames_name; if ($input_file->{name}) { @@ -773,7 +772,10 @@ sub input_files { $res_getfnames{$getfnames_name} = sub { my ($project, $options) = @_; $options //= {}; - $options->{origin_project} = $project; + if ($input_file->{project}) { + $options = {%$options}; + $options->{origin_project} = $project; + } my $t = sub { RBM::project_config($project, $_[0], { %$options, %$input_file }) }; @@ -791,6 +793,7 @@ sub input_files { if ($input_file->{project}) { $proj_out_dir = path(project_step_config($t->('project'), 'output_dir', { %$options, step => $t->('pkg_type'), + origin_project => $project, output_dir => undef, %$input_file })); } else { $proj_out_dir = path(project_config($project, 'output_dir', @@ -802,7 +805,8 @@ sub input_files { $url ? basename($url) : undef; $name //= project_step_config($t->('project'), 'filename', - {%$options, step => $t->('pkg_type'), %$input_file}) + {%$options, step => $t->('pkg_type'), + origin_project => $project, %$input_file}) if $input_file->{project}; exit_error("Missing filename:\n" . pp($input_file)) unless $name; my ($fname) = file_in_dir($name, $src_dir, $proj_out_dir); @@ -827,7 +831,8 @@ sub input_files { my $run_save = $config->{run}; $config->{run} = { target => $input_file->{target} }; $config->{run}{target} //= $run_save->{target}; - build_pkg($p, {%$options, %$input_file, output_dir => $proj_out_dir}); + build_pkg($p, {%$options, origin_project => $project, %$input_file, + output_dir => $proj_out_dir}); $config->{run} = $run_save; print "Finished build of project $p - $name\n"; } else {

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! Bug 12827: Create preference to disable SVG.
by gk＠torproject.org 26 Apr '17

26 Apr '17

commit 2d386f0b0ce34aaf97b814da1867bb94a93b62a2 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Wed Apr 19 16:29:59 2017 -0400 fixup! Bug 12827: Create preference to disable SVG. If the top window's URI is not available, check for the system principal to determine if SVGs may be used. This fixes bug 21962. --- layout/svg/nsSVGUtils.cpp | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/layout/svg/nsSVGUtils.cpp b/layout/svg/nsSVGUtils.cpp index 1217e92..98dd287e 100644 --- a/layout/svg/nsSVGUtils.cpp +++ b/layout/svg/nsSVGUtils.cpp @@ -114,6 +114,7 @@ NS_SVGEnabledForChannel(nsIChannel *aChannel) #ifdef DEBUG_SVG_ENABLE nsAutoCString topDocSpec; // Set if approved via a whitelisted top doc. + bool checkedSystemPrincipal = false; #endif bool isSVGAllowed = false; @@ -152,6 +153,18 @@ NS_SVGEnabledForChannel(nsIChannel *aChannel) if (isSVGAllowed) topDocURI->GetSpec(topDocSpec); #endif + } else { + // Unable to retrieve the top window's URI. Fallback to checking + // the system principal (see bug 21962). +#ifdef DEBUG_SVG_ENABLE + checkedSystemPrincipal = true; +#endif + nsCOMPtr<nsIScriptObjectPrincipal> scriptObjPrin = + do_QueryInterface(topWin); + if (scriptObjPrin) { + isSVGAllowed = nsContentUtils::IsSystemPrincipal( + scriptObjPrin->GetPrincipal()); + } } } } @@ -166,7 +179,10 @@ NS_SVGEnabledForChannel(nsIChannel *aChannel) if (uri) uri->GetSpec(spec); - if (topDocSpec.IsEmpty()) { + if (checkedSystemPrincipal) { + printf("NS_SVGEnabledForChannel for %s: %s (via system principal check)\n", + spec.get(), isSVGAllowed ? "YES" : "NO"); + } else if (topDocSpec.IsEmpty()) { printf("NS_SVGEnabledForChannel for %s: %s\n", spec.get(), isSVGAllowed ? "YES" : "NO"); } else {

1 0

[rbm/master] Give access to input files in remote_start
by boklm＠torproject.org 25 Apr '17

25 Apr '17

commit 4ba70051b24eb0cf71f3d57f66a1c604d7d1125d Author: Nicolas Vigier <boklm(a)torproject.org> Date: Tue Apr 25 22:17:17 2017 +0200 Give access to input files in remote_start --- doc/rbm_remote.asc | 4 +++- lib/RBM.pm | 5 ++++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/doc/rbm_remote.asc b/doc/rbm_remote.asc index 8888696..479062a 100644 --- a/doc/rbm_remote.asc +++ b/doc/rbm_remote.asc @@ -44,7 +44,9 @@ remote_get:: remote_start:: the template of a command that will start the remote host before we can access it. This can be useful for instance if you need - to start a VM, or fetch a container. + to start a VM, or fetch a container. If access to an input file is + needed, the +remote_srcdir+ option is pointing to a temporary + directory containing the input files. remote_finish:: the template of a command that will stop the remote host after diff --git a/lib/RBM.pm b/lib/RBM.pm index 79e0670..c92ae65 100644 --- a/lib/RBM.pm +++ b/lib/RBM.pm @@ -949,7 +949,10 @@ sub build_run { my @scripts = ('pre', $script_name, 'post'); my %scripts_root = ( pre => 1, post => 1); if (project_config($project, "remote_exec", $options)) { - my $cmd = project_config($project, "remote_start", $options); + my $cmd = project_config($project, "remote_start", { + %$options, + remote_srcdir => $srcdir, + }); if ($cmd) { my ($stdout, $stderr, $success, $exit_code) = run_script($project, $cmd, \&capture_exec);

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! Bug 6253: Add canvas image extraction prompt.
by gk＠torproject.org 25 Apr '17

25 Apr '17

commit 1182bee9789a632f374f0a6d3ed90f21af1e37c5 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue Apr 25 11:52:26 2017 -0400 fixup! Bug 6253: Add canvas image extraction prompt. Bug 21778: Canvas prompt not showing in Tor Browser based in ESR52 When running in multiprocess mode, use IPC to relay the canvas-permissions-prompt observer notification to the chrome (parent) process. --- browser/base/content/browser.js | 23 +++++++++++++++++++---- dom/canvas/CanvasUtils.cpp | 17 ++++++++++++++--- dom/ipc/PBrowser.ipdl | 8 ++++++++ dom/ipc/TabParent.cpp | 12 ++++++++++++ dom/ipc/TabParent.h | 1 + 5 files changed, 54 insertions(+), 7 deletions(-) diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js index 686805fb..83aca07 100755 --- a/browser/base/content/browser.js +++ b/browser/base/content/browser.js @@ -6302,20 +6302,35 @@ var CanvasPermissionPromptHelper = { Services.obs.removeObserver(this, this._permissionsPrompt, false); }, - // aSubject is an nsIDOMWindow. + // aSubject is an nsIBrowser (e10s) or an nsIDOMWindow (non-e10s). // aData is an URL string. observe: function CanvasPermissionPromptHelper_observe(aSubject, aTopic, aData) { if (aTopic != this._permissionsPrompt) { - throw new Error("Unexpected topic"); + throw new Error("Unexpected topic"); } + + let browser; + try { + browser = aSubject.QueryInterface(Ci.nsIBrowser); + } catch (e) {} + + if (!browser) { + try { + let contentWindow = aSubject.QueryInterface(Ci.nsIDOMWindow); + browser = gBrowser.getBrowserForContentWindow(contentWindow); + } catch (e) {} + + if (!browser) { + throw new Error("No browser"); + } + } + if (!aData) { throw new Error("Missing URL"); } var uri = makeURI(aData); - var contentWindow = aSubject.QueryInterface(Ci.nsIDOMWindow); - var browser = gBrowser.getBrowserForContentWindow(contentWindow); if (gBrowser.selectedBrowser !== browser) { // Must belong to some other window. return; diff --git a/dom/canvas/CanvasUtils.cpp b/dom/canvas/CanvasUtils.cpp index bd5c44d..dceccfd 100644 --- a/dom/canvas/CanvasUtils.cpp +++ b/dom/canvas/CanvasUtils.cpp @@ -15,6 +15,7 @@ #include "nsICanvasRenderingContextInternal.h" #include "nsIHTMLCollection.h" #include "mozilla/dom/HTMLCanvasElement.h" +#include "mozilla/dom/TabChild.h" #include "nsIPrincipal.h" #include "nsGfxCIID.h" @@ -144,9 +145,19 @@ bool IsImageExtractionAllowed(nsIDocument *aDocument, JSContext *aCx) nsContentUtils::LogMessageToConsole(message.get()); // Prompt the user (asynchronous). - nsCOMPtr<nsIObserverService> obs = mozilla::services::GetObserverService(); - obs->NotifyObservers(win, TOPIC_CANVAS_PERMISSIONS_PROMPT, - NS_ConvertUTF8toUTF16(topLevelDocURISpec).get()); + if (XRE_IsContentProcess()) { + TabChild* tabChild = TabChild::GetFrom(win); + if (tabChild) { + tabChild->SendShowCanvasPermissionPrompt(topLevelDocURISpec); + } + } else { + nsCOMPtr<nsIObserverService> obs = + mozilla::services::GetObserverService(); + if (obs) { + obs->NotifyObservers(win, TOPIC_CANVAS_PERMISSIONS_PROMPT, + NS_ConvertUTF8toUTF16(topLevelDocURISpec).get()); + } + } // We don't extract the image for now -- user may override at prompt. return false; diff --git a/dom/ipc/PBrowser.ipdl b/dom/ipc/PBrowser.ipdl index 249657c..cc4c4dc 100644 --- a/dom/ipc/PBrowser.ipdl +++ b/dom/ipc/PBrowser.ipdl @@ -619,6 +619,14 @@ parent: */ async RequestCrossBrowserNavigation(uint32_t aGlobalIndex); + /** + * This function is used to notify the parent that it should display a + * canvas permission prompt. + * + * @param aFirstPartyURI first party of the tab that is requesting access. + */ + async ShowCanvasPermissionPrompt(nsCString aFirstPartyURI); + child: /** * Notify the remote browser that it has been Show()n on this diff --git a/dom/ipc/TabParent.cpp b/dom/ipc/TabParent.cpp index 0df4c12..ff1b41a 100644 --- a/dom/ipc/TabParent.cpp +++ b/dom/ipc/TabParent.cpp @@ -3277,6 +3277,18 @@ TabParent::RecvRequestCrossBrowserNavigation(const uint32_t& aGlobalIndex) return NS_SUCCEEDED(frameLoader->RequestGroupedHistoryNavigation(aGlobalIndex)); } +bool +TabParent::RecvShowCanvasPermissionPrompt(const nsCString& firstPartyURI) +{ + nsCOMPtr<nsIBrowser> browser = do_QueryInterface(mFrameElement); + NS_ENSURE_TRUE(browser, false); + nsCOMPtr<nsIObserverService> os = services::GetObserverService(); + NS_ENSURE_TRUE(os, false); + nsresult rv = os->NotifyObservers(browser, "canvas-permissions-prompt", + NS_ConvertUTF8toUTF16(firstPartyURI).get()); + return NS_SUCCEEDED(rv); +} + NS_IMETHODIMP FakeChannel::OnAuthAvailable(nsISupports *aContext, nsIAuthInformation *aAuthInfo) { diff --git a/dom/ipc/TabParent.h b/dom/ipc/TabParent.h index 43afb05..b8022e1 100644 --- a/dom/ipc/TabParent.h +++ b/dom/ipc/TabParent.h @@ -633,6 +633,7 @@ protected: virtual bool RecvNotifySessionHistoryChange(const uint32_t& aCount) override; virtual bool RecvRequestCrossBrowserNavigation(const uint32_t& aGlobalIndex) override; + virtual bool RecvShowCanvasPermissionPrompt(const nsCString& firstPartyURI) override; ContentCacheInParent mContentCache;

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 25 Apr '17

25 Apr '17

commit 6133397c142c1c58ec7da8aabd5a952a01d6fc6b Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Mon Apr 24 10:35:08 2017 -0700 fixup! TB4: Tor Browser's Firefox preference overrides. Fixes bug 10283 and disables the SpeechSynthesis API. --- browser/app/profile/000-tor-browser.js | 1 + 1 file changed, 1 insertion(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 305666a..9ca4149 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -149,6 +149,7 @@ pref("ui.use_standins_for_native_colors", true); // https://bugzilla.mozilla.org pref("browser.reader.detectedFirstArticle", true); pref("reader.parse-on-load.enabled", false); pref("privacy.use_utc_timezone", true); +pref("media.webspeech.synth.enabled", false); // Bug 10283: Disable SpeechSynthesis API // Third party stuff pref("network.cookie.cookieBehavior", 1);

1 0

[tor-browser-build/master] Update ChangeLog
by boklm＠torproject.org 23 Apr '17

23 Apr '17

commit b9fc5fc4a562ea8c5d7fdb797fd3c1ea6f6b413e Author: Nicolas Vigier <boklm(a)torproject.org> Date: Sun Apr 23 23:37:40 2017 +0200 Update ChangeLog --- .../tor-browser/Bundle-Data/Docs/ChangeLog.txt | 291 +++++++++++++++++++++ 1 file changed, 291 insertions(+) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 92b638d..b2ee463 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,294 @@ +Tor Browser 7.0a3 -- April 20 2017 + * All Platforms + * Update Firefox to 52.1.0esr + * Tor to 0.3.0.5-rc + * Update Torbutton to 1.9.7.2 + * Bug 21865: Update our JIT preferences in the security slider + * Bug 21747: Make 'New Tor Circuit for this Site' work in ESR52 + * Bug 21745: Fix handling of catch-all circuit + * Bug 21547: Fix circuit display under e10s + * Bug 21268: e10s compatibility for New Identity + * Bug 21267: Remove window resize implementation for now + * Bug 21201: Make Torbutton multiprocess compatible + * Translations update + * Update Tor Launcher to 0.2.12 + * Bug 21920: Don't show locale selection dialog + * Bug 21546: Mark Tor Launcher as multiprocess compatible + * Bug 21264: Add a README file + * Translations update + * Update HTTPS-Everywhere to 5.2.14 + * Update NoScript to 5.0.2 + * Update sandboxed-tor-browser to 0.0.5 + * Bug 21764: Use bubblewrap's `--die-with-parent` when supported + * Fix e10s Web Content crash on systems with grsec kernels + * Bug 21928: Force a reinstall if an existing hardened bundle is present + * Bug 21929: Remove hardened/ASAN related code + * Bug 21927: Remove the ability to install/update the hardened bundle + * Bug 21244: Update the MAR signing key for 7.0 + * Bug 21536: Remove asn's scramblesuit bridge from Tor Browser + * Add `prlimit64` to the firefox system call whitelist + * Fix compilation with Go 1.8 + * Use Config.Clone() to clone TLS configs when available + * Update Go to 1.7.5 (bug 21709) + * Bug 21555+16450: Don't remove Authorization header on subdomains (e.g. Twitter) + * Bug 21887: Fix broken error pages on higher security levels + * Bug 21876: Enable e10s by default on all supported platforms + * Bug 21876: Always use esr policies for e10s + * Bug 20905: Fix resizing issues after moving to a direct Firefox patch + * Bug 21875: Modal dialogs are maximized in ESR52 nightly builds + * Bug 21885: SVG is not disabled in Tor Browser based on ESR52 + * Bug 17334: Hide Referer when leaving a .onion domain (improved patch) + * Bug 3246: Double-key cookies + * Bug 8842: Fix XML parsing error + * Bug 16886: 16886: "Add-on compatibility check dialog" contains Firefox logo + * Bug 19192: Untrust Blue Coat CA + * Bug 19955: Avoid confusing warning that favicon load request got cancelled + * Bug 20005: Backport fixes for memory leaks investigation + * Bug 20755: ltn.com.tw is broken in Tor Browser + * Bug 21896: Commenting on website is broken due to CAPTCHA not being displayed + * Bug 20680: Rebase Tor Browser patches to 52 ESR + * Bug 21917: Add new obfs4 bridges + * Bug 21918: Move meek-amazon to d2cly7j4zqgua7.cloudfront.net backend + * Windows + * Bug 21795: Fix Tor Browser crashing on github.com + * Bug 12426: Make use of HeapEnableTerminationOnCorruption + * Bug 19316: Make sure our Windows updates can deal with the SSE2 requirement + * Bug 21868: Fix build bustage with FIREFOX_52_0_2esr_RELEASE for Windows + * OS X + * Bug 21723: Fix inconsistent generation of MOZ_MACBUNDLE_ID + * Bug 21724: Make Firefox and Tor Browser distinct macOS apps + * Bug 21931: Backport OSX SetupMacCommandLine updater fixes + * Bug 15910: Don't download GMPs via the local fallback + * Linux + * Bug 21907: Fix runtime error on CentOS 6 + * Bug 21748: Fix broken Snowflake build and update bridge details + * Bug 21954: Snowflake breaks the 7.0a3 build + * Bug 15910: Don't download GMPs via the local fallback + * Build system + * Windows + * Bug 21837: Fix reproducibility of accessibility code for Windows + * Bug 21240: Create patches to fix mingw-w64 compilation of Firefox ESR 52 + * Bug 21904: Bump mingw-w64 commit to help with sandbox compilation + * Bug 18831: Use own Yasm for Firefox cross-compilation + * OS X + * Bug 21328: Updating to clang 3.8.0 + * Bug 21754: Remove old GCC toolchain and macOS SDK + * Bug 19783: Remove unused macOS helper scripts + * Bug 10369: Don't use old GCC toolchain anymore for utils + * Bug 21753: Replace our old GCC toolchain in PT descriptor + * Bug 18530: ESR52 based Tor Browser only runs on macOS 10.9+ + * Linux + * Bug 21930: NSS libraries are missing from mar-tools archive + * Bug 21239: Adapt Linux Firefox descriptor to ESR52 (use GTK2) + * Bug 21960: Linux bundles based on ESR 52 are not reproducible anymore + * Bug 21629: Fix broken ASan builds when switching to ESR 52 + +Tor Browser 7.0a2-hardened -- March 7 2017 + * All Platforms + * Update Firefox to 45.8.0esr + * Tor to 0.3.0.4-rc + * OpenSSL to 1.0.2k + * Update Torbutton to 1.9.7.1 + * Bug 21396: Allow leaking of resource/chrome URIs (off by default) + * Bug 21574: Add link for zh manual and create manual links dynamically + * Bug 21330: Non-usable scrollbar appears in tor browser security settings + * Bug 21324: Don't update NoScript button with timer update + * Translation updates + * Update HTTPS-Everywhere to 5.2.11 + * Bug 21514: Restore W^X JIT implementation removed from ESR45 + * Bug 21536: Remove scramblesuit bridge + * Bug 21342: Move meek-azure to the meek.azureedge.net backend and cymrubridge02 bridge + * Bug 21326: Update the "Using a system-installed Tor" section in start script + * Build system + * Bug 17034: Use our built binutils and GCC for building tor + * Code clean-up + +Tor Browser 7.0a2 -- March 7 2017 + * All Platforms + * Update Firefox to 45.8.0esr + * Tor to 0.3.0.4-rc + * OpenSSL to 1.0.2k + * Update Torbutton to 1.9.7.1 + * Bug 21396: Allow leaking of resource/chrome URIs (off by default) + * Bug 21574: Add link for zh manual and create manual links dynamically + * Bug 21330: Non-usable scrollbar appears in tor browser security settings + * Bug 21324: Don't update NoScript button with timer update + * Translation updates + * Update HTTPS-Everywhere to 5.2.11 + * Bug 21514: Restore W^X JIT implementation removed from ESR45 + * Bug 21536: Remove scramblesuit bridge + * Bug 21342: Move meek-azure to the meek.azureedge.net backend and cymrubridge02 bridge + * Bug 21348: Make snowflake only available on Linux for now + * Linux + * Bug 21326: Update the "Using a system-installed Tor" section in start script + * Build system + * OS X + * Bug 21343: Remove unused FTE related parts for macOS + * Linux + * Bug 17034: Use our built binutils and GCC for building tor + * Clean-up + +Tor Browser 6.5.1 -- March 7 2017 + * All Platforms + * Update Firefox to 45.8.0esr + * Tor to 0.2.9.10 + * OpenSSL to 1.0.2k + * Update Torbutton to 1.9.6.14 + * Bug 21396: Allow leaking of resource/chrome URIs (off by default) + * Bug 21574: Add link for zh manual and create manual links dynamically + * Bug 21330: Non-usable scrollbar appears in tor browser security settings + * Translation updates + * Update HTTPS-Everywhere to 5.2.11 + * Bug 21514: Restore W^X JIT implementation removed from ESR45 + * Bug 21536: Remove scramblesuit bridge + * Bug 21342: Move meek-azure to the meek.azureedge.net backend and cymrubridge02 bridge + * Linux + * Bug 21326: Update the "Using a system-installed Tor" section in start script + +Tor Browser 7.0a1-hardened -- January 25 2017 + * All Platforms + * Update Firefox to 45.7.0esr + * Tor to 0.3.0.2-alpha + * Update Torbutton to 1.9.7 + * Bug 19898: Use DuckDuckGo on about:tor + * Bug 21091: Hide the update check menu entry when running under the sandbox + * Bug 21243: Add links to es, fr, and pt Tor Browser manual + * Bug 21194: Show snowflake in the circuit display + * Bug 21131: Remove 2016 donation banner + * Translation updates + * Update HTTPS-Everywhere to 5.2.9 + * Update NoScript to 2.9.5.3 + * Bug 20471: Allow javascript: links from HTTPS first party pages + * Bug 20651: DuckDuckGo does not work with JavaScript disabled + * Bug 20589: Add new MAR signing key + * Bug 20735: Add snowflake pluggable transport to alpha Linux builds + * Build system + * All platforms + * Bug 20927: Upgrade Go to 1.7.4 + +Tor Browser 7.0a1 -- January 25 2017 + * All Platforms + * Update Firefox to 45.7.0esr + * Tor to 0.3.0.2-alpha + * Update Torbutton to 1.9.7 + * Bug 19898: Use DuckDuckGo on about:tor + * Bug 21091: Hide the update check menu entry when running under the sandbox + * Bug 21243: Add links to es, fr, and pt Tor Browser manual + * Bug 21194: Show snowflake in the circuit display + * Bug 21131: Remove 2016 donation banner + * Translation updates + * Update HTTPS-Everywhere to 5.2.9 + * Update NoScript to 2.9.5.3 + * Bug 20471: Allow javascript: links from HTTPS first party pages + * Bug 20651: DuckDuckGo does not work with JavaScript disabled + * Bug 20589: Add new MAR signing key + * Windows + * Bug 20981: On Windows, check TZ for timezone first + * OS X + * Bug 20989: Browser sandbox profile is too restrictive on OSX 10.12.2 + * Linux + * Update sandboxed-tor-browser to 0.0.3 + * Bug 20735: Add snowflake pluggable transport to alpha Linux builds + * Build system + * All platforms + * Bug 20927: Upgrade Go to 1.7.4 + * Linux + * Bug 21103: Update descriptors for sandboxed-tor-browser 0.0.3 + +Tor Browser 6.5 -- January 24 2017 + * All Platforms + * Update Firefox to 45.7.0esr + * Tor to 0.2.9.9 + * OpenSSL to 1.0.2j + * Update Torbutton to 1.9.6.12 + * Bug 16622: Timezone spoofing moved to tor-browser.git + * Bug 17334: Move referrer spoofing for .onion domains into tor-browser.git + * Bug 8725: Block addon resource and url fingerprinting with nsIContentPolicy + * Bug 20701: Allow the directory listing stylesheet in the content policy + * Bug 19837: Whitelist internal URLs that Firefox requires for media + * Bug 19206: Avoid SOCKS auth and NEWNYM collisions when sharing a tor client + * Bug 19273: Improve external app launch handling and associated warnings + * Bug 15852: Remove/synchronize Torbutton SOCKS pref logic + * Bug 19733: GETINFO response parser doesn't handle AF_UNIX entries + IPv6 + * Bug 17767: Make "JavaScript disabled" more visible in Security Slider + * Bug 20556: Use pt-BR strings from now on + * Bug 20614: Add links to Tor Browser User Manual + * Bug 20414: Fix non-rendering arrow on OS X + * Bug 20728: Fix bad preferences.xul dimensions + * Bug 19898: Use DuckDuckGo on about:tor + * Bug 21091: Hide the update check menu entry when running under the sandbox + * Bug 19459: Move resizing code to tor-browser.git + * Bug 20264: Change security slider to 3 options + * Bug 20347: Enhance security slider's custom mode + * Bug 20123: Disable remote jar on all security levels + * Bug 20244: Move privacy checkboxes to about:preferences#privacy + * Bug 17546: Add tooltips to explain our privacy checkboxes + * Bug 17904: Allow security settings dialog to resize + * Bug 18093: Remove 'Restore Defaults' button + * Bug 20373: Prevent redundant dialogs opening + * Bug 20318: Remove helpdesk link from about:tor + * Bug 21243: Add links for pt, es, and fr Tor Browser manuals + * Bug 20753: Remove obsolete StartPage locale strings + * Bug 21131: Remove 2016 donation banner + * Bug 18980: Remove obsolete toolbar button code + * Bug 18238: Remove unused Torbutton code and strings + * Bug 20388+20399+20394: Code clean-up + * Translation updates + * Update Tor Launcher to 0.2.10.3 + * Bug 19568: Set CurProcD for Thunderbird/Instantbird + * Bug 19432: Remove special handling for Instantbird/Thunderbird + * Translation updates + * Update HTTPS-Everywhere to 5.2.9 + * Update NoScript to 2.9.5.3 + * Bug 16622: Spoof timezone with Firefox patch + * Bug 17334: Spoof referrer when leaving a .onion domain + * Bug 19273: Write C++ patch for external app launch handling + * Bug 19459: Size new windows to 1000x1000 or nearest 200x100 (Firefox patch) + * Bug 12523: Mark JIT pages as non-writable + * Bug 20123: Always block remote jar files + * Bug 19193: Reduce timing precision for AudioContext, HTMLMediaElement, and MediaStream + * Bug 19164: Remove support for SHA-1 HPKP pins + * Bug 19186: KeyboardEvents are only rounding to 100ms + * Bug 16998: Isolate preconnect requests to URL bar domain + * Bug 19478: Prevent millisecond resolution leaks in File API + * Bug 20471: Allow javascript: links from HTTPS first party pages + * Bug 20244: Move privacy checkboxes to about:preferences#privacy + * Bug 20707: Fix broken preferences tab in non-en-US alpha bundles + * Bug 20709: Fix wrong update URL in alpha bundles + * Bug 19481: Point the update URL to aus1.torproject.org + * Bug 20556: Start using pt-BR instead of pt-PT for Portuguese + * Bug 20442: Backport fix for local path disclosure after drag and drop + * Bug 20160: Backport fix for broken MP3-playback + * Bug 20043: Isolate SharedWorker script requests to first party + * Bug 18923: Add script to run all Tor Browser regression tests + * Bug 20651: DuckDuckGo does not work with JavaScript disabled + * Bug 19336+19835: Enhance about:tbupdate page + * Bug 20399+15852: Code clean-up + * Windows + * Bug 20981: On Windows, check TZ for timezone first + * Bug 18175: Maximizing window and restarting leads to non-rounded window size + * Bug 13437: Rounded inner window accidentally grows to non-rounded size + * OS X + * Bug 20590: Badly resized window due to security slider notification bar on OS X + * Bug 20439: Make the build PIE on OSX + * Linux + * Bug 20691: Updater breaks if unix domain sockets are used + * Bug 15953: Weird resizing dance on Tor Browser startup + * Build system + * All platforms + * Bug 20927: Upgrade Go to 1.7.4 + * Bug 20583: Make the downloads.json file reproducible + * Bug 20133: Don't apply OpenSSL patch anymore + * Bug 19528: Set MOZ_BUILD_DATE based on Firefox version + * Bug 18291: Remove some uses of libfaketime + * Bug 18845: Make zip and tar helpers generate reproducible archives + * OS X + * Bug 20258: Make OS X Tor archive reproducible again + * Bug 20184: Make OS X builds reproducible (use clang for compiling tor) + * Bug 19856: Make OS X builds reproducible (getting libfaketime back) + * Bug 19410: Fix incremental updates by taking signatures into account + * Bug 20210: In dmg2mar, extract old mar file to copy permissions to the new one + Tor Browser 6.5a6-hardened -- December 14 2016 * All Platforms * Update Firefox to 45.6.0esr

1 0

[tor-browser-build/master] Update webrtc, go-webrtc and snowflake
by boklm＠torproject.org 23 Apr '17

23 Apr '17

commit cebffc5e3931f7f921068f44214ff19a0350bf11 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Sun Apr 23 23:29:41 2017 +0200 Update webrtc, go-webrtc and snowflake tor-browser-bundle.git commit: 38689af2a845dfa85765bf52e535c89476863378 tor-browser-bundle.git commit: 121de1ca7cbee29f34f99753a7948c7447e38965 tor-browser-bundle.git commit: e9b16e19134655aa16a8840e09093e01692138d5 --- projects/go-webrtc/config | 6 ++- projects/snowflake/config | 2 +- .../Bundle-Data/PTConfigs/bridge_prefs.js | 2 +- projects/webrtc/build | 58 +++++++++++++--------- projects/webrtc/config | 17 ++++--- projects/webrtc/webrtc-linux.patch | 25 ++++++++++ 6 files changed, 75 insertions(+), 35 deletions(-) diff --git a/projects/go-webrtc/config b/projects/go-webrtc/config index 778d3db..3a1a9d4 100644 --- a/projects/go-webrtc/config +++ b/projects/go-webrtc/config @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' git_url: https://github.com/keroserene/go-webrtc.git -git_hash: 69c5ca70533142494d145b43ef2f46ca94715557 +git_hash: ab1b64862e0c4b4182010699911c2c5818f0a101 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' remote_docker: 1 @@ -23,7 +23,9 @@ var: # the prebuilt libwebrtc-magic.a libraries. Since we build our own # libwebrtc-magic.a with the C++11 ABI, we have to undo that setting here, # using CGO_CXXFLAGS. - export CGO_CXXFLAGS=-D_GLIBCXX_USE_CXX11_ABI=1 + # __STDC_FORMAT_MACROS is needed for a definition of PRIxPTR from inttypes.h. + export CGO_CXXFLAGS="-D_GLIBCXX_USE_CXX11_ABI=1 -D__STDC_FORMAT_MACROS=1" + export CGO_LDFLAGS=-latomic targets: master: diff --git a/projects/snowflake/config b/projects/snowflake/config index 5ba006b..3233ba4 100644 --- a/projects/snowflake/config +++ b/projects/snowflake/config @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' git_url: https://git.torproject.org/pluggable-transports/snowflake.git -git_hash: 6cecd31fd896eb26e64ad8bab8a9ea510ec3b21d +git_hash: 9f2e9a6ecb696149708716ca06ce842df03cf492 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' remote_docker: 1 diff --git a/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js b/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js index bcf3a19..922e181 100644 --- a/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js @@ -39,4 +39,4 @@ pref("extensions.torlauncher.default_bridge.obfs4.21", "obfs4 38.229.1.78:80 C8C pref("extensions.torlauncher.default_bridge.meek-amazon.1", "meek 0.0.2.0:2 B9E7141C594AF25699E0079C1F0146F409495296 url=https://d2zfqthxsdq309.cloudfront.net/ front=a0.awsstatic.com"); pref("extensions.torlauncher.default_bridge.meek-azure.1", "meek 0.0.2.0:3 97700DFE9F483596DDA6264C4D7DF7641E1E39CE url=https://meek.azureedge.net/ front=ajax.aspnetcdn.com"); -pref("extensions.torlauncher.default_bridge.snowflake.1", "snowflake 0.0.3.0:1 B05EC36590AC0374F0E4D36DDA77908FD59D97F3"); +pref("extensions.torlauncher.default_bridge.snowflake.1", "snowflake 0.0.3.0:1 2B280B23E1107BB62ABFC40DDCC8824814F80A72"); diff --git a/projects/webrtc/build b/projects/webrtc/build index 5a70fbe..3ae7ed0 100644 --- a/projects/webrtc/build +++ b/projects/webrtc/build @@ -22,20 +22,17 @@ tar -C /var/tmp/build -xf webrtc-sources-[% c('version') %].tar.gz builddir=/var/tmp/build/[% project %]/src cd $builddir -export GYP_CROSSCOMPILE=1 -export GYP_DEFINES="OS=[% c("var/webrtc/os") %] target_arch=[% c("var/webrtc/arch") %]" -# Do not use bundled utilities. -GYP_DEFINES+=" clang=0 host_clang=0 use_sysroot=0" -GYP_DEFINES+=" linux_use_bundled_gold=0 linux_use_gold_flags=0 linux_use_bundled_binutils=0" -# Avoid some dependencies. Some of these don't seem to work fully; for -# example even with use_alsa=0 we need libasound2-dev. -GYP_DEFINES+=" use_x11=0 use_gtk=0 use_gconf=0 use_alsa=0 use_pulseaudio=0 use_libpci=0 include_internal_audio_device=0 enabled_libjingle_device_manager=0" -# examples and tests also bring in dependencies. -GYP_DEFINES+=" include_examples=0 include_tests=0" -# embedded=1 is supposed to turn of various features; see -# https://bugs.chromium.org/p/chromium/issues/detail?id=318413. -GYP_DEFINES+=" embedded=1" -GYP_DEFINES+=" werror=" + +patch -p1 < $rootdir/webrtc-linux.patch + +# First, build a copy of GN, rather than use the prebuilt copy in buildtools/linux64. +cd tools/gn +# __STDC_FORMAT_MACROS is needed for a definition of PRIxPTR from inttypes.h. +CXXFLAGS=-D__STDC_FORMAT_MACROS=1 LDFLAGS=-latomic ./bootstrap/bootstrap.py --no-rebuild --no-clean +cd ../.. +# This is where bootstrap.py stashes the built gn. +GN="$PWD/out_bootstrap/gn" + [% IF c("var/linux") -%] export CC=gcc export CXX=g++ @@ -48,16 +45,31 @@ GYP_DEFINES+=" werror=" export CXXFLAGS=-m32 export LDFLAGS=-m32 [% END -%] -JAVA_HOME=/usr/lib/jvm/default-java webrtc/build/gyp_webrtc.py -ninja -C out/Release -# Run ninja once more, without include_tests=0, in order to build just the -# FakeAudioCaptureModule that go-webrtc uses. -GYP_DEFINES="$(echo "$GYP_DEFINES" | sed -e 's/include_tests=0//g')" -JAVA_HOME=/usr/lib/jvm/default-java webrtc/build/gyp_webrtc.py -ninja -C out/Release obj/webrtc/api/test/peerconnection_unittests.fakeaudiocapturemodule.o + +export GN_ARGS="" +# For a list of all possible GN args, do "gn gen out/Release; gn args --list out/Release". +# https://chromium.googlesource.com/chromium/src/+/master/tools/gn/docs/cross… +GN_ARGS+=" target_os=\"linux\" target_cpu=\"[% IF c("var/linux-i686") %]x86[% ELSE %]x64[% END %]\"" +# Not debug. +GN_ARGS+=" is_debug=false" +# There are warnings from unused returns. +GN_ARGS+=" treat_warnings_as_errors=false" +# Build static libraries. +GN_ARGS+=" is_component_build=false" +# Do not use bundled utilities. +GN_ARGS+=" is_clang=false use_sysroot=false" +GN_ARGS+=" gold_path=\"$INSTDIR/binutils/bin\"" +# Make extra sure we don't use bundled binutils. +rm -rf third_party/binutils/Linux_* +# Avoid some dependencies. +GN_ARGS+=" use_ozone=true use_gconf=false" +GN_ARGS+=" rtc_include_opus=false rtc_include_ilbc=false rtc_include_internal_audio_device=false rtc_include_pulse_audio=false" +# Included for "field_trial" below. Maybe "fieldtrial_testing_like_official_build" could help here? +#GN_ARGS+=" rtc_include_tests=false" +rm -rf out/Release +"$GN" gen out/Release --args="$GN_ARGS" +ninja -C out/Release webrtc field_trial metrics_default pc_test_utils # https://github.com/keroserene/go-webrtc/issues/23#issuecomment-175312648 -# dump_syms_regtest.o is actually an executable, not an object file. If not -# excluded, it results in the error: # libwebrtc-linux-386-magic.a(dump_syms_regtest.o): unsupported ELF file type 2 ar crs libwebrtc-magic.a $(find . -name '*.o' -not -name '*.main.o' -not -name 'dump_syms_regtest.o' | sort) diff --git a/projects/webrtc/config b/projects/webrtc/config index 52618c2..bfd38c9 100644 --- a/projects/webrtc/config +++ b/projects/webrtc/config @@ -4,7 +4,7 @@ remote_docker: 1 filename: 'webrtc-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' var: - webrtc_tag: f33698296719f956497d2dbff81b5080864a8804 + webrtc_tag: c279861207c5b15fc51069e96595782350e0ac12 input_files: - project: docker-image @@ -17,6 +17,8 @@ input_files: - project: binutils name: binutils enable: '[% c("var/linux") %]' + - filename: webrtc-linux.patch + enable: '[% c("var/linux") %]' targets: linux: @@ -28,16 +30,17 @@ targets: dockerbuild: "[% pc('docker-image', 'pre') %]" sort_deps: 0 arch_deps: - - default-jre-headless - - default-jdk - lib32asound2-dev - lib64expat1 - libexpat1-dev:i386 + - libglib2.0-dev:i386 + - libgtk2.0-dev:i386 - libudev-dev:i386 - libx11-dev:i386 - libxext-dev:i386 - libxrandr-dev:i386 - lib32stdc++6 + - pkg-config - hardening-wrapper webrtc: arch: ia32 @@ -46,14 +49,15 @@ targets: linux-x86_64: var: arch_deps: - - default-jre-headless - - default-jdk - libasound2-dev - libexpat1-dev + - libglib2.0-dev + - libgtk2.0-dev - libudev-dev - libx11-dev - libxext-dev - libxrandr-dev + - pkg-config webrtc: arch: x64 lib_arch: amd64 @@ -70,10 +74,7 @@ steps: # https://webrtc.org/native-code/development/ tar xf [% c('input_files_by_name/depot_tools') %] export PATH="$rootdir/depot_tools:$PATH" - # GYP_CROSSCOMPILE=1 and GYP_DEFINES="use_x11=0" prevent probing for certain dependencies. # Use --no-history because the whole checkout with history is about 12 GB. - export GYP_CROSSCOMPILE=1 - export GYP_DEFINES="use_x11=0" # JAVA_HOME is needed in a hook for libjingle. The readlink line tries to find the current JRE. # default-java comes from the package default-jdk-headless. export JAVA_HOME=/usr/lib/jvm/default-java diff --git a/projects/webrtc/webrtc-linux.patch b/projects/webrtc/webrtc-linux.patch new file mode 100644 index 0000000..b1efb7a --- /dev/null +++ b/projects/webrtc/webrtc-linux.patch @@ -0,0 +1,25 @@ +From ebc1773a92884bec7d93274b2d729ccf76050197 Mon Sep 17 00:00:00 2001 +From: David Fifield <fifield(a)eecs.berkeley.edu> +Date: Wed, 22 Mar 2017 09:53:07 -0400 +Subject: [PATCH] Disable some settings in build_overrides. + +--- + build_overrides/build.gni | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/build_overrides/build.gni b/build_overrides/build.gni +index af4924d4c..ffaafdebc 100644 +--- a/build_overrides/build.gni ++++ b/build_overrides/build.gni +@@ -14,7 +14,7 @@ mac_sdk_min_build_override = "10.11" + enable_java_templates = true + + # Some non-Chromium builds don't use Chromium's third_party/binutils. +-linux_use_bundled_binutils_override = true ++linux_use_bundled_binutils_override = false + + # Variable that can be used to support multiple build scenarios, like having + # Chromium specific targets in a client project's GN file etc. +-- +2.12.1 +

1 0

[tor-browser-build/master] Bug 22025: Fix broken certificate error pages on higher security levels
by boklm＠torproject.org 23 Apr '17

23 Apr '17

commit 899fe6b89d2e5a2bdc46aa50db61c96fbf01927a Author: Georg Koppen <gk(a)torproject.org> Date: Fri Apr 21 06:51:11 2017 +0000 Bug 22025: Fix broken certificate error pages on higher security levels We need to allow JavaScript on `about:certerror` pages explicitly. Otherwise are those pages broken on higher security levels. --- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/projects/tor-browser/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js b/projects/tor-browser/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js index 09f3f8e..2ad9731 100644 --- a/projects/tor-browser/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/projects/tor-browser/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false); diff --git a/projects/tor-browser/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js b/projects/tor-browser/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js index 09f3f8e..2ad9731 100644 --- a/projects/tor-browser/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/projects/tor-browser/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false); diff --git a/projects/tor-browser/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js b/projects/tor-browser/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js index 09f3f8e..2ad9731 100644 --- a/projects/tor-browser/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/projects/tor-browser/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false);

1 0

[tor-browser-build/master] Bug 21918: Move meek-amazon to the d2cly7j4zqgua7.cloudfront.net backend.
by boklm＠torproject.org 23 Apr '17

23 Apr '17

commit abfa8f3f04988154da35154924d8b43c04550b92 Author: David Fifield <david(a)bamsoftware.com> Date: Mon Jan 23 17:48:50 2017 -0800 Bug 21918: Move meek-amazon to the d2cly7j4zqgua7.cloudfront.net backend. Still using the same TorLandMeek bridge. --- projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js b/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js index 922e181..fea436d 100644 --- a/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js @@ -36,7 +36,7 @@ pref("extensions.torlauncher.default_bridge.obfs4.20", "obfs4 85.17.30.79:443 FC pref("extensions.torlauncher.default_bridge.obfs4.21", "obfs4 38.229.1.78:80 C8CBDB2464FC9804A69531437BCF2BE31FDD2EE4 cert=Hmyfd2ev46gGY7NoVxA9ngrPF2zCZtzskRTzoWXbxNkzeVnGFPWmrTtILRyqCTjHR+s9dg iat-mode=1"); /**/pref/**/(/**/"extensions.torlauncher.default_bridge.obfs4.22"/**/, /**/"obfs4 38.229.33.83:80 0BAC39417268B96B9F514E7F63FA6FBA1A788955 cert=VwEFpk9F/UN9JED7XpG1XOjm/O8ZCXK80oPecgWnNDZDv5pdkhq1OpbAH0wNqOT6H6BmRQ iat-mode=1"); -pref("extensions.torlauncher.default_bridge.meek-amazon.1", "meek 0.0.2.0:2 B9E7141C594AF25699E0079C1F0146F409495296 url=https://d2zfqthxsdq309.cloudfront.net/ front=a0.awsstatic.com"); +pref("extensions.torlauncher.default_bridge.meek-amazon.1", "meek 0.0.2.0:2 B9E7141C594AF25699E0079C1F0146F409495296 url=https://d2cly7j4zqgua7.cloudfront.net/ front=a0.awsstatic.com"); pref("extensions.torlauncher.default_bridge.meek-azure.1", "meek 0.0.2.0:3 97700DFE9F483596DDA6264C4D7DF7641E1E39CE url=https://meek.azureedge.net/ front=ajax.aspnetcdn.com"); pref("extensions.torlauncher.default_bridge.snowflake.1", "snowflake 0.0.3.0:1 2B280B23E1107BB62ABFC40DDCC8824814F80A72");

1 0

[tor-browser-bundle/master] Bug 21710: Upgrade Go to 1.8.1.
by gk＠torproject.org 21 Apr '17

21 Apr '17

commit 9d546f20ae711e7df9c574d9bdfccf34ddf1b650 Author: David Fifield <david(a)bamsoftware.com> Date: Mon Mar 13 17:19:30 2017 -0700 Bug 21710: Upgrade Go to 1.8.1. Remove workaround for fixed upstream bug, GitHub #17732 (__MAC_OS_X_VERSION_MAX_ALLOWED). I wasn't able to remove the cc-for-target workaround for GitHub #15457 (CC_FOR_TARGET). Even though according to https://github.com/golang/go/issues/15457 it has been been fixed, make.bash still seems to lose all but the first argument of CC_FOR_TARGET somewhere. --- gitian/descriptors/mac/gitian-pluggable-transports.yml | 3 --- gitian/versions | 4 ++-- gitian/versions.alpha | 4 ++-- gitian/versions.beta | 4 ++-- gitian/versions.nightly | 4 ++-- 5 files changed, 8 insertions(+), 11 deletions(-) diff --git a/gitian/descriptors/mac/gitian-pluggable-transports.yml b/gitian/descriptors/mac/gitian-pluggable-transports.yml index c430bb8..75ad899 100644 --- a/gitian/descriptors/mac/gitian-pluggable-transports.yml +++ b/gitian/descriptors/mac/gitian-pluggable-transports.yml @@ -93,9 +93,6 @@ script: | export GOARCH=amd64 tar xvf go.tar.gz cd go/src - # Remove a preprocessor directive that causes problems when building with the 10.7 SDK. - # https://github.com/golang/go/issues/17732 - sed -i -e '/^#cgo CFLAGS:/s/-D__MAC_OS_X_VERSION_MAX_ALLOWED=1060//' crypto/x509/root_cgo_darwin.go CGO_ENABLED=1 CC_FOR_TARGET="$CC_FOR_TARGET" CC= CFLAGS= LDFLAGS= ./make.bash cd ../.. export PATH="$PATH:$PWD/go/bin" diff --git a/gitian/versions b/gitian/versions index e64baa4..8cb2278 100755 --- a/gitian/versions +++ b/gitian/versions @@ -65,7 +65,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 # We need a Go 1.4 to bootstrap later versions; see https://golang.org/doc/install/source#go14 GO14_VER=1.4.3 -GO_VER=1.7.5 +GO_VER=1.8.1 NSIS_VER=2.51 YASM_VER=1.2.0 @@ -119,7 +119,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 -GO_HASH=4e834513a2079f8cbbd357502cccaac9507fd00a1efe672375798858ff291815 +GO_HASH=33daf4c03f86120fdfdc66bddf6bfff4661c7ca11c5da473e537f4d69b470e57 NSIS_HASH=43d4c9209847e35eb6e2c7cd5a7586e1445374c056c2c7899e40a080e17a1be7 NSIS_DEBIAN_HASH=1dee6957b4a4b8dfe69bcf28bc7f301a13b96b3fa5a394e36c8926ae781e774a GCC_HASH=b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad diff --git a/gitian/versions.alpha b/gitian/versions.alpha index d1ea48b..adb9dbf 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -68,7 +68,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 # We need a Go 1.4 to bootstrap later versions; see https://golang.org/doc/install/source#go14 GO14_VER=1.4.3 -GO_VER=1.7.5 +GO_VER=1.8.1 NSIS_VER=2.51 YASM_VER=1.2.0 @@ -122,7 +122,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 -GO_HASH=4e834513a2079f8cbbd357502cccaac9507fd00a1efe672375798858ff291815 +GO_HASH=33daf4c03f86120fdfdc66bddf6bfff4661c7ca11c5da473e537f4d69b470e57 NSIS_HASH=43d4c9209847e35eb6e2c7cd5a7586e1445374c056c2c7899e40a080e17a1be7 NSIS_DEBIAN_HASH=1dee6957b4a4b8dfe69bcf28bc7f301a13b96b3fa5a394e36c8926ae781e774a GCC_HASH=b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad diff --git a/gitian/versions.beta b/gitian/versions.beta index ed7c124..7d843c7 100755 --- a/gitian/versions.beta +++ b/gitian/versions.beta @@ -54,7 +54,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 # We need a Go 1.4 to bootstrap later versions; see https://golang.org/doc/install/source#go14 GO14_VER=1.4.3 -GO_VER=1.7.5 +GO_VER=1.8.1 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz @@ -99,7 +99,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 -GO_HASH=4e834513a2079f8cbbd357502cccaac9507fd00a1efe672375798858ff291815 +GO_HASH=33daf4c03f86120fdfdc66bddf6bfff4661c7ca11c5da473e537f4d69b470e57 STIXMATHFONT_HASH=e3b0f712e2644438eee2d0dcd2b10b2d54f1b972039de95b2f8e800bae1adbd8 NOTOEMOJIFONT_HASH=415dc6290378574135b64c808dc640c1df7531973290c4970c51fdeb849cb0c5 NOTOJPFONT_HASH=3e8146c4ce0945f255cb9dbc12b392380af80bd117e0a60eae555c99c7e618da diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 9142915..4e1618c 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -75,7 +75,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 # We need a Go 1.4 to bootstrap later versions; see https://golang.org/doc/install/source#go14 GO14_VER=1.4.3 -GO_VER=1.7.5 +GO_VER=1.8.1 NSIS_VER=2.51 YASM_VER=1.2.0 @@ -129,7 +129,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 -GO_HASH=4e834513a2079f8cbbd357502cccaac9507fd00a1efe672375798858ff291815 +GO_HASH=33daf4c03f86120fdfdc66bddf6bfff4661c7ca11c5da473e537f4d69b470e57 NSIS_HASH=43d4c9209847e35eb6e2c7cd5a7586e1445374c056c2c7899e40a080e17a1be7 NSIS_DEBIAN_HASH=1dee6957b4a4b8dfe69bcf28bc7f301a13b96b3fa5a394e36c8926ae781e774a GCC_HASH=b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad

1 0

[tor-browser-bundle/master] Bug 22025: Fix broken certificate error pages on higher security levels
by gk＠torproject.org 21 Apr '17

21 Apr '17

commit bf51814f82a93a2f26322a3eea7e31ef061edc6d Author: Georg Koppen <gk(a)torproject.org> Date: Fri Apr 21 06:51:11 2017 +0000 Bug 22025: Fix broken certificate error pages on higher security levels We need to allow JavaScript on `about:certerror` pages explicitly. Otherwise are those pages broken on higher security levels. --- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js index 09f3f8e..2ad9731 100644 --- a/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false); diff --git a/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js index 09f3f8e..2ad9731 100644 --- a/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false); diff --git a/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js index 09f3f8e..2ad9731 100644 --- a/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false);

1 0

[tor-browser-bundle/master] Bump tor-browser branch for nightly builds
by gk＠torproject.org 21 Apr '17

21 Apr '17

commit 5eb70e227d1111080e63b32d24e39b572410237c Author: Georg Koppen <gk(a)torproject.org> Date: Fri Apr 21 08:17:49 2017 +0000 Bump tor-browser branch for nightly builds --- gitian/versions.nightly | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 360f1ba..9142915 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -17,7 +17,7 @@ MULTI_LINGUAL=1 VERIFY_TAGS=0 -FIREFOX_VERSION=52.0.2esr +FIREFOX_VERSION=52.1.0esr TORBROWSER_UPDATE_CHANNEL=default @@ -60,7 +60,7 @@ GITIAN_TAG=tor-browser-builder-4 OPENSSL_VER=1.0.2k GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION -FIREFOX_LANG_BUILD=build1 +FIREFOX_LANG_BUILD=build3 BINUTILS_VER=2.24 GCC_VER=5.1.0 CLANG_VER=3.8.0

1 0

[tor-browser-build/master] Bump sandboxed to browser tag to 0.0.6
by boklm＠torproject.org 20 Apr '17

20 Apr '17

commit 41a5df93e6c92b3481057f077201472caef8b9e5 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Apr 20 09:44:20 2017 +0200 Bump sandboxed to browser tag to 0.0.6 tor-browser-bundle.git commit: 947fedb72f4a43b46fcc2e72531db79e8aa7d943 --- projects/sandbox/config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/sandbox/config b/projects/sandbox/config index 9dc52c6..218a276 100644 --- a/projects/sandbox/config +++ b/projects/sandbox/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 0.0.5 +version: 0.0.6 git_url: https://git.torproject.org/tor-browser/sandboxed-tor-browser git_hash: 'sandboxed-tor-browser-[% c("version") %]' tag_gpg_id: 1

1 0

[tor-browser-build/master] Pick up build3 from Mozilla and bug fixes
by boklm＠torproject.org 20 Apr '17

20 Apr '17

commit da2bb257968d238a538ebc6ddfb7da2e35041985 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Apr 20 09:47:04 2017 +0200 Pick up build3 from Mozilla and bug fixes tor-browser-bundle.git commit: 421091532d3536893e715f62cab9055cd822b95a --- projects/firefox-langpacks/config | 2 +- projects/firefox/config | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/projects/firefox-langpacks/config b/projects/firefox-langpacks/config index a645b92..39f04cb 100644 --- a/projects/firefox-langpacks/config +++ b/projects/firefox-langpacks/config @@ -4,7 +4,7 @@ filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/buil var: ff_version: '[% pc("firefox", "var/firefox_version") %]' - ff_build: build1 + ff_build: build3 ff_arch: linux-i686 input_filename: 'dl-langpack-[% c("var/ff_arch") %]-[% c("version") %]' diff --git a/projects/firefox/config b/projects/firefox/config index 14c1cd5..2c74e4b 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' filename: 'firefox-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build2' +git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-2-build1' tag_gpg_id: 1 git_url: https://git.torproject.org/tor-browser.git gpg_keyring: torbutton.gpg

1 0

[tor-browser-bundle/master] Bump sandboxed to browser tag to 0.0.6
by gk＠torproject.org 20 Apr '17

20 Apr '17

commit 947fedb72f4a43b46fcc2e72531db79e8aa7d943 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Apr 20 06:50:18 2017 +0000 Bump sandboxed to browser tag to 0.0.6 --- gitian/versions.alpha | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gitian/versions.alpha b/gitian/versions.alpha index fffb050..d1ea48b 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -41,7 +41,7 @@ OBFS4_TAG=obfs4proxy-0.0.5 NOTOFONTS_TAG=720e34851382ee3c1ef024d8dffb68ffbfb234c2 ERRORS_TAG=248dadf4e9068a0b3e79f02ed0a610d935de5302 GB_TAG=06cc925cce6592e922dcc4839a8b44feb384e71e -SANDBOX_TAG=sandboxed-tor-browser-0.0.5 +SANDBOX_TAG=sandboxed-tor-browser-0.0.6 DEPOT_TOOLS_TAG=28216cd14b44716db5c83634afbdc6e90492652b WEBRTC_TAG=c279861207c5b15fc51069e96595782350e0ac12 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/58 GO_WEBRTC_TAG=ab1b64862e0c4b4182010699911c2c5818f0a101

1 0

[tor-browser-bundle/master] Bug 19316: add support for minSupportedInstructionSet in config.yml
by gk＠torproject.org 19 Apr '17

19 Apr '17

commit 70961a33301ca42b1fe3eb9eee87ea16bef4fea2 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Apr 19 12:14:04 2017 +0200 Bug 19316: add support for minSupportedInstructionSet in config.yml --- tools/update-responses/update_responses | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tools/update-responses/update_responses b/tools/update-responses/update_responses index b7f4b63..0ed19c1 100755 --- a/tools/update-responses/update_responses +++ b/tools/update-responses/update_responses @@ -292,6 +292,7 @@ sub get_response { goto CLOSETAGS; } my $minversion = get_config($config, $version, $os, 'minSupportedOSVersion'); + my $mininstruc = get_config($config, $version, $os, 'minSupportedInstructionSet'); $writer->startTag('update', type => 'minor', displayVersion => $version, @@ -302,6 +303,7 @@ sub get_response { actions => 'showURL', openURL => get_config($config, $version, $os, 'detailsURL'), defined $minversion ? ( minSupportedOSVersion => $minversion ) : (), + defined $mininstruc ? ( minSupportedInstructionSet => $mininstruc ) : (), ); foreach my $patch (@patches) { my @sorted_patch = map { $_ => $patch->{$_} } sort keys %$patch;

1 0

[tor-browser-bundle/master] Pick up build3 from Mozilla and bug fixes
by gk＠torproject.org 18 Apr '17

18 Apr '17

commit 421091532d3536893e715f62cab9055cd822b95a Author: Georg Koppen <gk(a)torproject.org> Date: Tue Apr 18 11:26:23 2017 +0000 Pick up build3 from Mozilla and bug fixes --- Bundle-Data/Docs/ChangeLog.txt | 3 +++ gitian/versions.alpha | 6 +++--- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 3d36c6e..b2ee463 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -58,10 +58,12 @@ Tor Browser 7.0a3 -- April 20 2017 * Bug 21723: Fix inconsistent generation of MOZ_MACBUNDLE_ID * Bug 21724: Make Firefox and Tor Browser distinct macOS apps * Bug 21931: Backport OSX SetupMacCommandLine updater fixes + * Bug 15910: Don't download GMPs via the local fallback * Linux * Bug 21907: Fix runtime error on CentOS 6 * Bug 21748: Fix broken Snowflake build and update bridge details * Bug 21954: Snowflake breaks the 7.0a3 build + * Bug 15910: Don't download GMPs via the local fallback * Build system * Windows * Bug 21837: Fix reproducibility of accessibility code for Windows @@ -78,6 +80,7 @@ Tor Browser 7.0a3 -- April 20 2017 * Linux * Bug 21930: NSS libraries are missing from mar-tools archive * Bug 21239: Adapt Linux Firefox descriptor to ESR52 (use GTK2) + * Bug 21960: Linux bundles based on ESR 52 are not reproducible anymore * Bug 21629: Fix broken ASan builds when switching to ESR 52 Tor Browser 7.0a2-hardened -- March 7 2017 diff --git a/gitian/versions.alpha b/gitian/versions.alpha index b16341a..fffb050 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -14,7 +14,7 @@ FIREFOX_VERSION=52.1.0esr TORBROWSER_UPDATE_CHANNEL=alpha -TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.0-1-build2 +TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.0-2-build1 TOR_TAG=tor-0.3.0.5-rc TORLAUNCHER_TAG=0.2.12 TORBUTTON_TAG=1.9.7.2 @@ -48,12 +48,12 @@ GO_WEBRTC_TAG=ab1b64862e0c4b4182010699911c2c5818f0a101 SNOWFLAKE_TAG=9f2e9a6ecb696149708716ca06ce842df03cf492 UNIURI_TAG=8902c56451e9b58ff940bbe5fec35d5f9c04584a -GITIAN_TAG=tor-browser-builder-4-3 +GITIAN_TAG=tor-browser-builder-4-4 OPENSSL_VER=1.0.2k GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION -FIREFOX_LANG_BUILD=build2 +FIREFOX_LANG_BUILD=build3 BINUTILS_VER=2.24 GCC_VER=5.1.0 CLANG_VER=3.8.0

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 18 Apr '17

18 Apr '17

commit 72667935298e11ca5a0e2e5202a5d9e33981eedf Author: Georg Koppen <gk(a)torproject.org> Date: Tue Apr 18 11:09:53 2017 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. This blocks downloading GMPs via the new local fallback. See: https://trac.torproject.org/projects/tor/ticket/15910#comment:25 --- browser/app/profile/000-tor-browser.js | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index e07a5a1..305666a 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -195,6 +195,10 @@ pref("media.navigator.enabled", false); // clever solution for https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769716. pref("media.gmp-provider.enabled", false); pref("media.gmp-manager.url.override", "data:text/plain,"); +// Since ESR52 it is not enough anymore to block pinging the GMP update/download +// server. There is a local fallback that must be blocked now as well. See: +// https://bugzilla.mozilla.org/show_bug.cgi?id=1267495. +pref("media.gmp-manager.updateEnabled", false); // EME prefs: Strictly speaking these prefs don't need to be set as we are // using the --disable-eme compile flag. However, in order to not confuse users, // who might stumble upon them while looking into about:config, we set them to

1 0

[gitian-builder/tor-browser-builder-4] Increase base VM size from 15360M to 20480M.
by gk＠torproject.org 17 Apr '17

17 Apr '17

commit 6185a530122f5476335bcd46dba6a3e8b3eefed8 Author: David Fifield <fifield(a)eecs.berkeley.edu> Date: Sat Apr 15 18:20:45 2017 -0700 Increase base VM size from 15360M to 20480M. Needed to hold the webrtc source code. https://bugs.torproject.org/21954#comment:2 --- bin/make-base-vm | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bin/make-base-vm b/bin/make-base-vm index 9e796eb..4ada11f 100755 --- a/bin/make-base-vm +++ b/bin/make-base-vm @@ -172,7 +172,7 @@ if [ $LXC = "1" ]; then sudo cp $OUT-bootstrap/usr/lib/i386-linux-gnu/lxc/lxc-init $OUT-bootstrap/usr/sbin/init.lxc fi fi - dd if=/dev/zero of=$OUT-lxc bs=1M count=1 seek=15360 + dd if=/dev/zero of=$OUT-lxc bs=1M count=1 seek=20480 /sbin/mkfs.ext4 -F $OUT-lxc t=`mktemp -d gitian.XXXXXXXX` sudo mount $OUT-lxc $t @@ -191,7 +191,7 @@ else libexec/config-bootstrap-fixup rm -rf $OUT - env -i LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8 sudo vmbuilder kvm $DISTRO --rootsize 20000 --arch=$ARCH --suite=$SUITE --addpkg=$addpkg --removepkg=$removepkg --ssh-key=var/id_rsa.pub --ssh-user-key=var/id_rsa.pub --mirror=$MIRROR --security-mirror=$SECURITY_MIRROR --dest=$OUT --flavour=$FLAVOUR --firstboot=`pwd`/target-bin/bootstrap-fixup + env -i LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8 sudo vmbuilder kvm $DISTRO --rootsize 20480 --arch=$ARCH --suite=$SUITE --addpkg=$addpkg --removepkg=$removepkg --ssh-key=var/id_rsa.pub --ssh-user-key=var/id_rsa.pub --mirror=$MIRROR --security-mirror=$SECURITY_MIRROR --dest=$OUT --flavour=$FLAVOUR --firstboot=`pwd`/target-bin/bootstrap-fixup mv $OUT/*.qcow2 $OUT.qcow2 rm -rf $OUT # bootstrap-fixup is done on first boot

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-1] Bug 1351071: Get rid of pre-generated startup cache r=glandium
by gk＠torproject.org 17 Apr '17

17 Apr '17

commit ec0b55bdfb638c63f30116b19583456632ad708d Author: Chris AtLee <catlee(a)mozilla.com> Date: Tue Apr 4 09:26:25 2017 -0400 Bug 1351071: Get rid of pre-generated startup cache r=glandium MozReview-Commit-ID: BcWcqEKwGBv --HG-- extra : rebase_source : 4bd21805a89359a5a2ed7ffd2ee2b76cf1e9e634 --- python/mozbuild/mozpack/packager/formats.py | 7 +- python/mozbuild/mozpack/packager/unpack.py | 8 +-- .../mozbuild/mozpack/test/test_packager_formats.py | 2 - toolkit/mozapps/installer/packager.py | 74 ---------------------- 4 files changed, 3 insertions(+), 88 deletions(-) diff --git a/python/mozbuild/mozpack/packager/formats.py b/python/mozbuild/mozpack/packager/formats.py index c4adaba..be5fafe 100644 --- a/python/mozbuild/mozpack/packager/formats.py +++ b/python/mozbuild/mozpack/packager/formats.py @@ -23,11 +23,6 @@ from mozpack.copier import ( Jarrer, ) -STARTUP_CACHE_PATHS = [ - 'jsloader', - 'jssubloader', -] - ''' Formatters are classes receiving packaging instructions and creating the appropriate package layout. @@ -321,4 +316,4 @@ class OmniJarSubFormatter(PiecemealFormatter): 'greprefs.js', 'hyphenation', 'update.locale', - ] or path[0] in STARTUP_CACHE_PATHS + ] diff --git a/python/mozbuild/mozpack/packager/unpack.py b/python/mozbuild/mozpack/packager/unpack.py index fa2b474..3f6633e 100644 --- a/python/mozbuild/mozpack/packager/unpack.py +++ b/python/mozbuild/mozpack/packager/unpack.py @@ -23,10 +23,7 @@ from mozpack.copier import ( FileCopier, ) from mozpack.packager import SimplePackager -from mozpack.packager.formats import ( - FlatFormatter, - STARTUP_CACHE_PATHS, -) +from mozpack.packager.formats import FlatFormatter from urlparse import urlparse @@ -188,8 +185,7 @@ def unpack_to_registry(source, registry): finder = UnpackFinder(source) packager = SimplePackager(FlatFormatter(registry)) for p, f in finder.find('*'): - if mozpath.split(p)[0] not in STARTUP_CACHE_PATHS: - packager.add(p, f) + packager.add(p, f) packager.close() diff --git a/python/mozbuild/mozpack/test/test_packager_formats.py b/python/mozbuild/mozpack/test/test_packager_formats.py index 1af4336..ca141b0 100644 --- a/python/mozbuild/mozpack/test/test_packager_formats.py +++ b/python/mozbuild/mozpack/test/test_packager_formats.py @@ -408,8 +408,6 @@ class TestFormatters(unittest.TestCase): self.assertTrue(is_resource(base, 'greprefs.js')) self.assertTrue(is_resource(base, 'hyphenation/foo')) self.assertTrue(is_resource(base, 'update.locale')) - self.assertTrue( - is_resource(base, 'jsloader/resource/gre/modules/foo.jsm')) self.assertFalse(is_resource(base, 'foo')) self.assertFalse(is_resource(base, 'foo/bar/greprefs.js')) self.assertTrue(is_resource(base, 'defaults/messenger/foo.dat')) diff --git a/toolkit/mozapps/installer/packager.py b/toolkit/mozapps/installer/packager.py index f2dc3fa..1a1b335 100644 --- a/toolkit/mozapps/installer/packager.py +++ b/toolkit/mozapps/installer/packager.py @@ -30,7 +30,6 @@ from argparse import ArgumentParser import os from StringIO import StringIO import subprocess -import platform import mozinfo # List of libraries to shlibsign. @@ -125,60 +124,6 @@ class LibSignFile(File): errors.fatal('Error while signing %s' % self.path) -def precompile_cache(registry, source_path, gre_path, app_path): - ''' - Create startup cache for the given application directory, using the - given GRE path. - - registry is a FileRegistry-like instance where to add the startup cache. - - source_path is the base path of the package. - - gre_path is the GRE path, relative to source_path. - - app_path is the application path, relative to source_path. - Startup cache for all resources under resource://app/ are generated, - except when gre_path == app_path, in which case it's under - resource://gre/. - ''' - from tempfile import mkstemp - source_path = os.path.abspath(source_path) - if app_path != gre_path: - resource = 'app' - else: - resource = 'gre' - app_path = os.path.join(source_path, app_path) - gre_path = os.path.join(source_path, gre_path) - - fd, cache = mkstemp('.zip') - os.close(fd) - os.remove(cache) - - try: - extra_env = {'MOZ_STARTUP_CACHE': cache} - if buildconfig.substs.get('MOZ_TSAN'): - extra_env['TSAN_OPTIONS'] = 'report_bugs=0' - if buildconfig.substs.get('MOZ_ASAN'): - extra_env['ASAN_OPTIONS'] = 'detect_leaks=0' - if launcher.launch(['xpcshell', '-g', gre_path, '-a', app_path, - '-f', os.path.join(os.path.dirname(__file__), - 'precompile_cache.js'), - '-e', 'precompile_startupcache("resource://%s/");' - % resource], - extra_linker_path=gre_path, - extra_env=extra_env): - errors.fatal('Error while running startup cache precompilation') - return - from mozpack.mozjar import JarReader - jar = JarReader(cache) - resource = '/resource/%s/' % resource - for f in jar: - if resource in f.filename: - path = f.filename[f.filename.index(resource) + len(resource):] - if registry.contains(path): - registry.add(f.filename, GeneratedFile(f.read())) - jar.close() - finally: - if os.path.exists(cache): - os.remove(cache) - - class RemovedFiles(GeneratedFile): ''' File class for removed-files. Is used as a preprocessor parser. @@ -389,25 +334,6 @@ def main(): if key in log: f.preload(log[key]) - # Fill startup cache - if isinstance(formatter, OmniJarFormatter) and launcher.can_launch() \ - and buildconfig.substs['MOZ_DISABLE_STARTUPCACHE'] != '1': - gre_path = None - def get_bases(): - for b in sink.packager.get_bases(addons=False): - for p in (mozpath.join('bin', b), b): - if os.path.exists(os.path.join(args.source, p)): - yield p - break - for base in sorted(get_bases()): - if not gre_path: - gre_path = base - omnijar_path = mozpath.join(sink.normalize_path(base), - buildconfig.substs['OMNIJAR_NAME']) - if formatter.contains(omnijar_path): - precompile_cache(formatter.copier[omnijar_path], - args.source, gre_path, base) - copier.copy(args.destination)

1 0

[tor-browser-bundle/master] Fixing typo in changelog
by gk＠torproject.org 17 Apr '17

17 Apr '17

commit 3491397ce91183922204e7e3e2a760f6f6de8f9a Author: Georg Koppen <gk(a)torproject.org> Date: Mon Apr 17 14:49:21 2017 +0000 Fixing typo in changelog Thanks arma. --- Bundle-Data/Docs/ChangeLog.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 808a3bb..3d36c6e 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -45,7 +45,7 @@ Tor Browser 7.0a3 -- April 20 2017 * Bug 19955: Avoid confusing warning that favicon load request got cancelled * Bug 20005: Backport fixes for memory leaks investigation * Bug 20755: ltn.com.tw is broken in Tor Browser - * Bug 21896: Commenting on website is broken due to CAPTCHA not being disaplyed + * Bug 21896: Commenting on website is broken due to CAPTCHA not being displayed * Bug 20680: Rebase Tor Browser patches to 52 ESR * Bug 21917: Add new obfs4 bridges * Bug 21918: Move meek-amazon to d2cly7j4zqgua7.cloudfront.net backend

1 0

[tor-browser-build/master] Fix tor-browser.git branch for nightly build
by boklm＠torproject.org 15 Apr '17

15 Apr '17

commit 8abc7fb0e05c8470c55f38a4b2142d2a1949cc36 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Sat Apr 15 22:26:07 2017 +0200 Fix tor-browser.git branch for nightly build --- projects/firefox/config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/firefox/config b/projects/firefox/config index 408852f..14c1cd5 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -22,7 +22,7 @@ var: targets: nightly: - git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-2' + git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1' tag_gpg_id: 0 var: torbrowser_update_channel: default

1 0

[tor-browser-bundle/master] Add new Gitian tag and update the Changelog
by gk＠torproject.org 15 Apr '17

15 Apr '17

commit 01e7e2c69107e78ffad79a932edbbf8d2b6fcc46 Author: Georg Koppen <gk(a)torproject.org> Date: Sat Apr 15 19:31:40 2017 +0000 Add new Gitian tag and update the Changelog --- Bundle-Data/Docs/ChangeLog.txt | 1 + gitian/versions.alpha | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 7767a74..808a3bb 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -61,6 +61,7 @@ Tor Browser 7.0a3 -- April 20 2017 * Linux * Bug 21907: Fix runtime error on CentOS 6 * Bug 21748: Fix broken Snowflake build and update bridge details + * Bug 21954: Snowflake breaks the 7.0a3 build * Build system * Windows * Bug 21837: Fix reproducibility of accessibility code for Windows diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 72d7006..b16341a 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -48,7 +48,7 @@ GO_WEBRTC_TAG=ab1b64862e0c4b4182010699911c2c5818f0a101 SNOWFLAKE_TAG=9f2e9a6ecb696149708716ca06ce842df03cf492 UNIURI_TAG=8902c56451e9b58ff940bbe5fec35d5f9c04584a -GITIAN_TAG=tor-browser-builder-4-2 +GITIAN_TAG=tor-browser-builder-4-3 OPENSSL_VER=1.0.2k GMP_VER=5.1.3

1 0

[tor-browser-bundle/master] Bug 21954: Ignore dump_syms_regtest.o when building libwebrtc
by gk＠torproject.org 15 Apr '17

15 Apr '17

commit e9b16e19134655aa16a8840e09093e01692138d5 Author: Arlo Breault <arlolra(a)gmail.com> Date: Sat Apr 15 08:29:53 2017 -0400 Bug 21954: Ignore dump_syms_regtest.o when building libwebrtc This was mistakenly removed in 121de1ca (see bug 21748). --- gitian/descriptors/linux/gitian-webrtc.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/gitian/descriptors/linux/gitian-webrtc.yml b/gitian/descriptors/linux/gitian-webrtc.yml index 0622fee..ccf2d4a 100644 --- a/gitian/descriptors/linux/gitian-webrtc.yml +++ b/gitian/descriptors/linux/gitian-webrtc.yml @@ -121,7 +121,8 @@ script: | "$GN" gen out/Release --args="$GN_ARGS" ninja -C out/Release webrtc field_trial metrics_default pc_test_utils # https://github.com/keroserene/go-webrtc/issues/23#issuecomment-175312648 - ar crs libwebrtc-magic.a $(find . -name '*.o' -not -name '*.main.o' | sort) + # libwebrtc-linux-386-magic.a(dump_syms_regtest.o): unsupported ELF file type 2 + ar crs libwebrtc-magic.a $(find . -name '*.o' -not -name '*.main.o' -not -name 'dump_syms_regtest.o' | sort) cd ../.. # Grabbing the result

1 0

[gitian-builder/tor-browser-builder-4] The WebRTC beast needs more space
by gk＠torproject.org 15 Apr '17

15 Apr '17

commit 5fbd2a1955328f1450a127f67be2c9d0e12c0ccb Author: Georg Koppen <gk(a)torproject.org> Date: Sat Apr 15 10:34:06 2017 +0000 The WebRTC beast needs more space --- bin/make-base-vm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bin/make-base-vm b/bin/make-base-vm index 59f0734..9e796eb 100755 --- a/bin/make-base-vm +++ b/bin/make-base-vm @@ -191,7 +191,7 @@ else libexec/config-bootstrap-fixup rm -rf $OUT - env -i LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8 sudo vmbuilder kvm $DISTRO --rootsize 15360 --arch=$ARCH --suite=$SUITE --addpkg=$addpkg --removepkg=$removepkg --ssh-key=var/id_rsa.pub --ssh-user-key=var/id_rsa.pub --mirror=$MIRROR --security-mirror=$SECURITY_MIRROR --dest=$OUT --flavour=$FLAVOUR --firstboot=`pwd`/target-bin/bootstrap-fixup + env -i LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8 sudo vmbuilder kvm $DISTRO --rootsize 20000 --arch=$ARCH --suite=$SUITE --addpkg=$addpkg --removepkg=$removepkg --ssh-key=var/id_rsa.pub --ssh-user-key=var/id_rsa.pub --mirror=$MIRROR --security-mirror=$SECURITY_MIRROR --dest=$OUT --flavour=$FLAVOUR --firstboot=`pwd`/target-bin/bootstrap-fixup mv $OUT/*.qcow2 $OUT.qcow2 rm -rf $OUT # bootstrap-fixup is done on first boot

1 0

[tor-browser-bundle/master] There is no need for a precise amd64 VM anymore
by gk＠torproject.org 15 Apr '17

15 Apr '17

commit aecb932682f23d4d5802367db3773a32b2ca56bb Author: Georg Koppen <gk(a)torproject.org> Date: Sat Apr 15 18:05:22 2017 +0000 There is no need for a precise amd64 VM anymore --- gitian/make-vms.sh | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/gitian/make-vms.sh b/gitian/make-vms.sh index 59632da..b5e4be2 100755 --- a/gitian/make-vms.sh +++ b/gitian/make-vms.sh @@ -106,13 +106,3 @@ do echo "Precise amd64 VM build failed... Trying again" echo done - -while ! build_and_test_vm precise amd64 64 -do - stop-target 64 precise - rm ./base-precise-amd64* - echo - echo "Precise amd64 VM build failed... Trying again" - echo -done -

1 0

[tor-browser-bundle/master] We are actually moving to 52.1.0esr for the alphas
by gk＠torproject.org 15 Apr '17

15 Apr '17

commit 77db4e6ba0acf381d5c7184a1a245b487fd68c3c Author: Georg Koppen <gk(a)torproject.org> Date: Sat Apr 15 12:10:17 2017 +0000 We are actually moving to 52.1.0esr for the alphas --- Bundle-Data/Docs/ChangeLog.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 7b1d91e..7767a74 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,6 +1,6 @@ Tor Browser 7.0a3 -- April 20 2017 * All Platforms - * Update Firefox to 45.9.0esr + * Update Firefox to 52.1.0esr * Tor to 0.3.0.5-rc * Update Torbutton to 1.9.7.2 * Bug 21865: Update our JIT preferences in the security slider

1 0

[tor-browser-build/master] Update firefox, tor, tor-launcher, torbutton, httpe, sandbox versions
by boklm＠torproject.org 15 Apr '17

15 Apr '17

commit 2446cfd04907596f9116d49852008f5dd2ef69f6 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Sat Apr 15 12:42:48 2017 +0200 Update firefox, tor, tor-launcher, torbutton, httpe, sandbox versions tor-browser-bundle.git commit: c90110d354e7f7dded306a61d5bf9fc7677dca53 --- projects/firefox/config | 8 +++----- projects/https-everywhere/config | 2 +- projects/sandbox/config | 2 +- projects/tor-launcher/config | 2 +- projects/tor/config | 2 +- projects/torbutton/config | 2 +- 6 files changed, 8 insertions(+), 10 deletions(-) diff --git a/projects/firefox/config b/projects/firefox/config index 0b8995b..408852f 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -1,16 +1,14 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' filename: 'firefox-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -## There is no signed tag yet, so we use a fixed commit -git_hash: 4c6219dc621d139cd39e8aaca578dd69b9c063d0 -#git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build1' -#tag_gpg_id: 1 +git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build2' +tag_gpg_id: 1 git_url: https://git.torproject.org/tor-browser.git gpg_keyring: torbutton.gpg remote_docker: 1 var: - firefox_version: 52.0.2esr + firefox_version: 52.1.0esr torbrowser_branch: 7.0 torbrowser_update_channel: alpha copyright_year: '[% exec("git show -s --format=%ci").remove("-.*") %]' diff --git a/projects/https-everywhere/config b/projects/https-everywhere/config index 7ef8568..3e5100e 100644 --- a/projects/https-everywhere/config +++ b/projects/https-everywhere/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 5.2.13 +version: 5.2.14 git_url: https://git.torproject.org/https-everywhere.git git_hash: '[% c("version") %]' git_submodule: 1 diff --git a/projects/sandbox/config b/projects/sandbox/config index 44faca9..9dc52c6 100644 --- a/projects/sandbox/config +++ b/projects/sandbox/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 0.0.3 +version: 0.0.5 git_url: https://git.torproject.org/tor-browser/sandboxed-tor-browser git_hash: 'sandboxed-tor-browser-[% c("version") %]' tag_gpg_id: 1 diff --git a/projects/tor-launcher/config b/projects/tor-launcher/config index 2d9c939..70f8acd 100644 --- a/projects/tor-launcher/config +++ b/projects/tor-launcher/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 0.2.10.2 +version: 0.2.12 git_url: https://git.torproject.org/tor-launcher.git git_hash: '[% c("version") %]' gpg_keyring: torbutton.gpg diff --git a/projects/tor/config b/projects/tor/config index 961c1f3..c8940dd 100644 --- a/projects/tor/config +++ b/projects/tor/config @@ -1,6 +1,6 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -version: 0.3.0.4-rc +version: 0.3.0.5-rc git_hash: 'tor-[% c("version") %]' git_url: https://git.torproject.org/tor.git gpg_keyring: tor.gpg diff --git a/projects/torbutton/config b/projects/torbutton/config index fdc9208..b60e217 100644 --- a/projects/torbutton/config +++ b/projects/torbutton/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 1.9.7.1 +version: 1.9.7.2 git_url: https://git.torproject.org/torbutton.git git_hash: '[% c("version") %]' gpg_keyring: torbutton.gpg

1 0

[tor-browser-bundle/master] Picking up correct tor-browser tag
by gk＠torproject.org 15 Apr '17

15 Apr '17

commit 25ba546b29d5ccb66cd2333e23afcf3b5495f873 Author: Georg Koppen <gk(a)torproject.org> Date: Sat Apr 15 06:33:07 2017 +0000 Picking up correct tor-browser tag --- gitian/versions.alpha | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 30de9d3..72d7006 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -14,7 +14,7 @@ FIREFOX_VERSION=52.1.0esr TORBROWSER_UPDATE_CHANNEL=alpha -TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.0-1-build1 +TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.0-1-build2 TOR_TAG=tor-0.3.0.5-rc TORLAUNCHER_TAG=0.2.12 TORBUTTON_TAG=1.9.7.2

1 0

[tor-browser-bundle/master] No March anymore
by gk＠torproject.org 14 Apr '17

14 Apr '17

commit 64f2c7dd739a2f842a5aea5ed824683efc653aa4 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Apr 14 20:26:33 2017 +0000 No March anymore --- Bundle-Data/Docs/ChangeLog.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 0b7daa1..7b1d91e 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,4 +1,4 @@ -Tor Browser 7.0a3 -- March 20 2017 +Tor Browser 7.0a3 -- April 20 2017 * All Platforms * Update Firefox to 45.9.0esr * Tor to 0.3.0.5-rc

1 0

[tor-browser-bundle/master] Release preparations for 7.0a3
by gk＠torproject.org 14 Apr '17

14 Apr '17

commit c90110d354e7f7dded306a61d5bf9fc7677dca53 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Apr 14 20:19:34 2017 +0000 Release preparations for 7.0a3 --- Bundle-Data/Docs/ChangeLog.txt | 81 +++++++++++++++++++++++++++++++++++++++ gitian/versions.alpha | 16 ++++---- tools/update-responses/config.yml | 17 ++++---- 3 files changed, 99 insertions(+), 15 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 58dc3d1..0b7daa1 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,84 @@ +Tor Browser 7.0a3 -- March 20 2017 + * All Platforms + * Update Firefox to 45.9.0esr + * Tor to 0.3.0.5-rc + * Update Torbutton to 1.9.7.2 + * Bug 21865: Update our JIT preferences in the security slider + * Bug 21747: Make 'New Tor Circuit for this Site' work in ESR52 + * Bug 21745: Fix handling of catch-all circuit + * Bug 21547: Fix circuit display under e10s + * Bug 21268: e10s compatibility for New Identity + * Bug 21267: Remove window resize implementation for now + * Bug 21201: Make Torbutton multiprocess compatible + * Translations update + * Update Tor Launcher to 0.2.12 + * Bug 21920: Don't show locale selection dialog + * Bug 21546: Mark Tor Launcher as multiprocess compatible + * Bug 21264: Add a README file + * Translations update + * Update HTTPS-Everywhere to 5.2.14 + * Update NoScript to 5.0.2 + * Update sandboxed-tor-browser to 0.0.5 + * Bug 21764: Use bubblewrap's `--die-with-parent` when supported + * Fix e10s Web Content crash on systems with grsec kernels + * Bug 21928: Force a reinstall if an existing hardened bundle is present + * Bug 21929: Remove hardened/ASAN related code + * Bug 21927: Remove the ability to install/update the hardened bundle + * Bug 21244: Update the MAR signing key for 7.0 + * Bug 21536: Remove asn's scramblesuit bridge from Tor Browser + * Add `prlimit64` to the firefox system call whitelist + * Fix compilation with Go 1.8 + * Use Config.Clone() to clone TLS configs when available + * Update Go to 1.7.5 (bug 21709) + * Bug 21555+16450: Don't remove Authorization header on subdomains (e.g. Twitter) + * Bug 21887: Fix broken error pages on higher security levels + * Bug 21876: Enable e10s by default on all supported platforms + * Bug 21876: Always use esr policies for e10s + * Bug 20905: Fix resizing issues after moving to a direct Firefox patch + * Bug 21875: Modal dialogs are maximized in ESR52 nightly builds + * Bug 21885: SVG is not disabled in Tor Browser based on ESR52 + * Bug 17334: Hide Referer when leaving a .onion domain (improved patch) + * Bug 3246: Double-key cookies + * Bug 8842: Fix XML parsing error + * Bug 16886: 16886: "Add-on compatibility check dialog" contains Firefox logo + * Bug 19192: Untrust Blue Coat CA + * Bug 19955: Avoid confusing warning that favicon load request got cancelled + * Bug 20005: Backport fixes for memory leaks investigation + * Bug 20755: ltn.com.tw is broken in Tor Browser + * Bug 21896: Commenting on website is broken due to CAPTCHA not being disaplyed + * Bug 20680: Rebase Tor Browser patches to 52 ESR + * Bug 21917: Add new obfs4 bridges + * Bug 21918: Move meek-amazon to d2cly7j4zqgua7.cloudfront.net backend + * Windows + * Bug 21795: Fix Tor Browser crashing on github.com + * Bug 12426: Make use of HeapEnableTerminationOnCorruption + * Bug 19316: Make sure our Windows updates can deal with the SSE2 requirement + * Bug 21868: Fix build bustage with FIREFOX_52_0_2esr_RELEASE for Windows + * OS X + * Bug 21723: Fix inconsistent generation of MOZ_MACBUNDLE_ID + * Bug 21724: Make Firefox and Tor Browser distinct macOS apps + * Bug 21931: Backport OSX SetupMacCommandLine updater fixes + * Linux + * Bug 21907: Fix runtime error on CentOS 6 + * Bug 21748: Fix broken Snowflake build and update bridge details + * Build system + * Windows + * Bug 21837: Fix reproducibility of accessibility code for Windows + * Bug 21240: Create patches to fix mingw-w64 compilation of Firefox ESR 52 + * Bug 21904: Bump mingw-w64 commit to help with sandbox compilation + * Bug 18831: Use own Yasm for Firefox cross-compilation + * OS X + * Bug 21328: Updating to clang 3.8.0 + * Bug 21754: Remove old GCC toolchain and macOS SDK + * Bug 19783: Remove unused macOS helper scripts + * Bug 10369: Don't use old GCC toolchain anymore for utils + * Bug 21753: Replace our old GCC toolchain in PT descriptor + * Bug 18530: ESR52 based Tor Browser only runs on macOS 10.9+ + * Linux + * Bug 21930: NSS libraries are missing from mar-tools archive + * Bug 21239: Adapt Linux Firefox descriptor to ESR52 (use GTK2) + * Bug 21629: Fix broken ASan builds when switching to ESR 52 + Tor Browser 7.0a2-hardened -- March 7 2017 * All Platforms * Update Firefox to 45.8.0esr diff --git a/gitian/versions.alpha b/gitian/versions.alpha index dbdaa97..30de9d3 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -10,15 +10,15 @@ DATA_OUTSIDE_APP_DIR=1 VERIFY_TAGS=1 -FIREFOX_VERSION=45.8.0esr +FIREFOX_VERSION=52.1.0esr TORBROWSER_UPDATE_CHANNEL=alpha TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.0-1-build1 -TOR_TAG=tor-0.3.0.4-rc -TORLAUNCHER_TAG=0.2.10.2 -TORBUTTON_TAG=1.9.7.1 -HTTPSE_TAG=5.2.11 +TOR_TAG=tor-0.3.0.5-rc +TORLAUNCHER_TAG=0.2.12 +TORBUTTON_TAG=1.9.7.2 +HTTPSE_TAG=5.2.14 NSIS_TAG=v0.3.1 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.22-stable @@ -41,7 +41,7 @@ OBFS4_TAG=obfs4proxy-0.0.5 NOTOFONTS_TAG=720e34851382ee3c1ef024d8dffb68ffbfb234c2 ERRORS_TAG=248dadf4e9068a0b3e79f02ed0a610d935de5302 GB_TAG=06cc925cce6592e922dcc4839a8b44feb384e71e -SANDBOX_TAG=sandboxed-tor-browser-0.0.3 +SANDBOX_TAG=sandboxed-tor-browser-0.0.5 DEPOT_TOOLS_TAG=28216cd14b44716db5c83634afbdc6e90492652b WEBRTC_TAG=c279861207c5b15fc51069e96595782350e0ac12 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/58 GO_WEBRTC_TAG=ab1b64862e0c4b4182010699911c2c5818f0a101 @@ -75,7 +75,7 @@ YASM_VER=1.2.0 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 -NOSCRIPT_PACKAGE=noscript_security_suite-2.9.5.3-fx+sm.xpi +NOSCRIPT_PACKAGE=noscript_security_suite-5.0.2-fx+sm.xpi CCTOOLS_PACKAGE=cctools.tar.gz OSXSDK_PACKAGE=MacOSX10.7.sdk.tar.gz MSVCR100_PACKAGE=msvcr100.dll @@ -110,7 +110,7 @@ YASM_PACKAGE=yasm-${YASM_VER}.tar.gz OPENSSL_HASH=6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf -NOSCRIPT_HASH=ce9779a3a5a2574b958f8e4d079a99d43a8f84193bef52c587c704ed81c2fbbd +NOSCRIPT_HASH=31ba7743699deefb606bcc49197d26d926f6b4e3d3526cd2f8a339f857a04fb1 CCTOOLS_HASH=e908fdebc2886ee5491ebfc7e7950af451b3c4e2439c2d7a923ed06ad05113e4 MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index 1861a8c..78f3a2c 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -19,7 +19,7 @@ build_targets: osx32: Darwin_x86-gcc3 osx64: Darwin_x86_64-gcc3 channels: - alpha: 7.0a2 + alpha: 7.0a3 release: 6.0.1 versions: 6.0.1: @@ -33,15 +33,18 @@ versions: osx32: minSupportedOSVersion: 10.8 detailsURL: https://blog.torproject.org/blog/end-life-plan-tor-browser-32-bit-macs#upda… - 7.0a2: - platformVersion: 45.8.0 - detailsURL: https://blog.torproject.org/blog/tor-browser-70a2-released + 7.0a3: + platformVersion: 52.1.0 + detailsURL: https://blog.torproject.org/blog/tor-browser-70a3-released incremental_from: - - 7.0a1 + - 7.0a2 migrate_archs: osx32: osx64 migrate_langs: pt-PT: pt-BR + win32: + minSupportedInstructionSet: SSE2 osx32: - minSupportedOSVersion: 10.8 - detailsURL: https://blog.torproject.org/blog/end-life-plan-tor-browser-32-bit-macs#upda… + minSupportedOSVersion: 10.9 + osx64: + minSupportedOSVersion: 10.9

1 0