- tbb-commits - lists.torproject.org

[tor-browser-build/master] Add sysrqb's key to our keyfile
by gk＠torproject.org 29 Nov '19

29 Nov '19

commit 692233cabe9431979d5df687a8f2690808fde384 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Nov 29 12:11:15 2019 +0000 Add sysrqb's key to our keyfile --- keyring/torbutton.gpg | Bin 5120 -> 68812 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/keyring/torbutton.gpg b/keyring/torbutton.gpg index 7100dcd..b7c5373 100644 Binary files a/keyring/torbutton.gpg and b/keyring/torbutton.gpg differ

1 0

[tor-browser-build/master] Bug 27265: fix output_dir value in sub-projects
by gk＠torproject.org 28 Nov '19

28 Nov '19

commit a182f67a608ad65fbbde4238aff7ee7c2f01b162 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Nov 12 18:34:13 2018 +0100 Bug 27265: fix output_dir value in sub-projects We update rbm for bug 27265: fix output_dir value in sub-projects. As part of this fix, the patch in rbm is changing how the value of output_dir is overriden by rbm when handling input_files: the output_dir option is now defined under norec, which has priority over normal options but is not inherided in sub-projects. In rbm.conf we are also changing the output_dir option in var/build_id_txt so that the build ids do not depend on the path on the current system. Because of the change in rbm we now need to reset `norec` so that our value of `output_dir` is correctly taken into account. --- rbm | 2 +- rbm.conf | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/rbm b/rbm index 5a41aae..03d53fc 160000 --- a/rbm +++ b/rbm @@ -1 +1 @@ -Subproject commit 5a41aae4a0d745f74b675d3c9c142b3d5fb3ca09 +Subproject commit 03d53fcb0444fe9d752719bfbb62e3658d15d26d diff --git a/rbm.conf b/rbm.conf index cb5e972..018df39 100644 --- a/rbm.conf +++ b/rbm.conf @@ -46,7 +46,7 @@ var: [% END -%] input_files: [% c("input_files_id") %] build: - [% c("build", { filename => 'f', output_dir => '/out' }) %] + [% c("build", { filename => 'f', output_dir => '/out', norec => {} }) %] container: dir: '[% c("rbm_tmp_dir") %]/rbm-containers/[% sha256(c("build_id")) %]' user: rbm

1 0

[rbm/master] Bug 27265: fix output_dir value in sub-projects
by gk＠torproject.org 28 Nov '19

28 Nov '19

commit 03d53fcb0444fe9d752719bfbb62e3658d15d26d Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Aug 22 12:34:40 2018 +0200 Bug 27265: fix output_dir value in sub-projects In the build_pkg call in input_files, we were setting the output_dir option to the project's directory, causing this directory to be incorrectly used as the output directory in some cases. But there is no need to set output_dir at this point, so we can just remove it. We also introduce a new feature allowing to set options for the current project but not for the child projects listed in `input_files`. By default the options are applied recursively to all projects. If some options are defined under `norec/` then they are only applied on the current project. We use this feature in two places where we were setting the output_dir, which removes the need to reset it in two places. At the same time, we fix the `urlget()` call in input_files which was incorrectly ignoring options. --- doc/rbm_input_files.asc | 45 +++++++++++++++++++++++++++++++++++++++++++++ doc/rbm_templates.asc | 10 ++++++++++ lib/RBM.pm | 29 ++++++++++++++--------------- 3 files changed, 69 insertions(+), 15 deletions(-) diff --git a/doc/rbm_input_files.asc b/doc/rbm_input_files.asc index d56f125..de47638 100644 --- a/doc/rbm_input_files.asc +++ b/doc/rbm_input_files.asc @@ -143,6 +143,51 @@ array can be a string. In that case the string is the name of the option containing the file descriptor hash. This can be useful when you are using the same file in multiple projects. + +INHERITANCE OF PROJECTS OPTIONS +------------------------------- + +When defining a file of type +project+, the options defined in the ++input_files+ entry are transmitted to the child project. If this +project is also using other projects in its +input_files+ then the +options from the first +input_files+ entry are inherited. + +In this example, both project B and C are getting the definition of ++option1+: +---- +projects/A/config: + input_files: + - project: B + option1: value1 + +projects/B/config: + input_files: + - project: C + +projects/C/config: + input_files: [] +---- + +In some cases you might want to define options that only apply to the +first level of child projects. To do that you can define the options +under +norec+. In this example, only project B is getting the definition +of +option1+: +---- +projects/A/config: + input_files: + - project: B + norec: + option1: value1 + +projects/B/config: + input_files: + - project: C + +projects/C/config: + input_files: [] +---- + + EXAMPLES -------- diff --git a/doc/rbm_templates.asc b/doc/rbm_templates.asc index d34f3b2..2f72c94 100644 --- a/doc/rbm_templates.asc +++ b/doc/rbm_templates.asc @@ -69,6 +69,16 @@ c:: - 'as_array' : if set to 1, then return all matching results as an array reference, instead of only the first one. + - 'norec' : + this option is useful in the cases where the value of + an option depends on the input files of the current + project, for example to compute a hash based on the + input files. In +norec+ you can define options that + will apply to the current project, but will not be + applied on the child projects defined in the + +input_files+ section. For more details, you can read + the "Inheritance of projects options" section in + link:rbm_input_files.html[rbm_input_files(7)]. pc:: This variable is a function reference. It is the same as +c+, diff --git a/lib/RBM.pm b/lib/RBM.pm index 9659f16..4db951a 100644 --- a/lib/RBM.pm +++ b/lib/RBM.pm @@ -220,8 +220,8 @@ sub project_config { goto FINISH unless @$name; my $opt_save = $config->{opt}; $config->{opt} = { %{$config->{opt}}, %$options } if $options; - $res = config($project, $name, $options, ['opt'], ['run'], - ['projects', $project], ['local'], [], + $res = config($project, $name, $options, ['opt', 'norec'], ['opt'], + ['run'], ['projects', $project], ['local'], [], ['system'], ['default']); if (!$options->{no_tmpl} && defined($res) && !ref $res && !notmpl(confkey_str($name), $project)) { @@ -747,7 +747,7 @@ sub input_file_id { return $t->('input_file_id') if $input_file->{input_file_id}; return $input_file->{project} . ':' . $filename if $input_file->{project}; return $filename . ':' . $t->('sha256sum') if $input_file->{sha256sum}; - return $filename . ':' . sha256_hex($t->('exec', { output_dir => '/out' })) + return $filename . ':' . sha256_hex($t->('exec', { norec => { output_dir => '/out' } })) if $input_file->{exec}; return input_file_id_hash($fname, $filename); } @@ -774,6 +774,7 @@ sub input_files { my $getfnames_noname = 0; my $input_files_id = ''; $options = {$options ? %$options : ()}; + $options->{norec} = {}; my $input_files = project_config($project, 'input_files', $options); goto RETURN_RES unless $input_files; my $proj_dir = rbm_path(project_config($project, 'projects_dir', $options)); @@ -789,8 +790,7 @@ sub input_files { next unless $input_file; my $t = sub { project_config($project, $_[0], {$options ? %$options : (), - %$input_file, output_dir => $src_dir, - $_[1] ? %{$_[1]} : ()}); + %$input_file, $_[1] ? %{$_[1]} : ()}); }; if ($input_file->{enable} && !$t->('enable')) { next; @@ -849,11 +849,10 @@ sub input_files { if ($input_file->{project}) { $proj_out_dir = rbm_path(project_step_config($t->('project'), 'output_dir', { %$options, step => $t->('pkg_type'), - origin_project => $project, - output_dir => undef, %$input_file })); + origin_project => $project, %$input_file })); } else { $proj_out_dir = rbm_path(project_config($project, 'output_dir', - { %$input_file, output_dir => undef })); + { %$options, %$input_file })); } create_dir($proj_out_dir); my $url = $t->('URL'); @@ -871,7 +870,7 @@ sub input_files { if ($t->('content')) { path("$proj_out_dir/$name")->spew_utf8($t->('content')); } elsif ($t->('URL')) { - urlget($project, {%$input_file, filename => $name}, 1); + urlget($project, {%$options, %$input_file, filename => $name}, 1); } elsif ($t->('exec')) { my $exec_script = project_config($project, 'exec', { $options ? %$options : (), %$input_file }); @@ -885,8 +884,8 @@ sub input_files { my $run_save = $config->{run}; $config->{run} = { target => $input_file->{target} }; $config->{run}{target} //= $run_save->{target}; - build_pkg($p, {%$options, origin_project => $project, %$input_file, - output_dir => $proj_out_dir}); + build_pkg($p, {%$options, origin_project => $project, + %$input_file}); $config->{run} = $run_save; print "Finished build of project $p - $name\n"; } else { @@ -940,8 +939,8 @@ sub input_files { } foreach my $s ($sig_file ? () : @$sig_ext) { if ($url) { - my $f = { %$input_file, 'override.URL' => "$url.$s", - filename => "$name.$s" }; + my $f = { %$options, %$input_file, + 'override.URL' => "$url.$s", filename => "$name.$s" }; if (urlget($project, $f, 0)) { $sig_file = "$fname.$s"; last; @@ -1039,7 +1038,7 @@ sub build_run { } my $o = { %$options, - output_dir => $remote_tmp_dst, + norec => { output_dir => $remote_tmp_dst }, }; foreach my $s (@scripts) { $build_script{$s} = project_config($project, $s, $o); @@ -1163,7 +1162,7 @@ sub publish { if (!$publish_src_dir) { $publish_src_dir = File::Temp->newdir(get_tmp_dir($project) . '/rbm-XXXXXX'); - build_pkg($project, {output_dir => $publish_src_dir}); + build_pkg($project, { norec => { output_dir => $publish_src_dir } }); } build_run($project, 'publish', { build_srcdir => $publish_src_dir }); }

1 0

[rbm/master] Bug 27265: add an error when we fail to download/create a file
by gk＠torproject.org 28 Nov '19

28 Nov '19

commit ef4df05a484c746f33e361eb8d82d5fb85009c14 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Aug 22 12:24:23 2018 +0200 Bug 27265: add an error when we fail to download/create a file --- lib/RBM.pm | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/RBM.pm b/lib/RBM.pm index 087ebe3..9659f16 100644 --- a/lib/RBM.pm +++ b/lib/RBM.pm @@ -893,8 +893,9 @@ sub input_files { dd $input_file; exit_error "Missing file $name"; } + ($fname) = file_in_dir($name, $src_dir, $proj_out_dir); + exit_error "Error getting file $name" unless $fname; } - ($fname) = file_in_dir($name, $src_dir, $proj_out_dir); if ($action eq 'input_files_id') { $input_files_id .= input_file_id($input_file, $t, $fname, $name); $input_files_id .= "\n";

1 0

[tor-browser-build/maint-9.0] Pick up new bridge for Android (#32606)
by gk＠torproject.org 28 Nov '19

28 Nov '19

commit 9b96257a1720851159372ab03cdbd2726b21e55b Author: Georg Koppen <gk(a)torproject.org> Date: Thu Nov 28 07:48:47 2019 +0000 Pick up new bridge for Android (#32606) --- projects/tor-android-service/config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/tor-android-service/config b/projects/tor-android-service/config index 1ca2cac..d63b778 100644 --- a/projects/tor-android-service/config +++ b/projects/tor-android-service/config @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %]' -git_hash: 50d01b1fbc6e776d0b39f42f644137dd25a92c7a +git_hash: 3d3de669452f563f3f7b58f57f757f7a7cdae621 git_url: https://git.torproject.org/tor-android-service.git git_submodule: 1

1 0

[tor-browser-build/master] Pick up new bridge for Android (#32606)
by gk＠torproject.org 28 Nov '19

28 Nov '19

commit 8d61174e8400449388260b18876d9f189d3a2152 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Nov 28 07:45:42 2019 +0000 Pick up new bridge for Android (#32606) --- projects/tor-android-service/config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/tor-android-service/config b/projects/tor-android-service/config index 492a3e1..4611757 100644 --- a/projects/tor-android-service/config +++ b/projects/tor-android-service/config @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %]' -git_hash: e9bbdc6fb25af47ccaf3bace0162125d94812072 +git_hash: 3d3de669452f563f3f7b58f57f757f7a7cdae621 git_url: https://git.torproject.org/tor-android-service.git git_submodule: 1

1 0

[tor-android-service/master] Add new default bridge at Georgetown University.
by gk＠torproject.org 28 Nov '19

28 Nov '19

commit 3d3de669452f563f3f7b58f57f757f7a7cdae621 Author: Philipp Winter <phw(a)nymity.ch> Date: Wed Nov 27 16:29:01 2019 -0800 Add new default bridge at Georgetown University. This commit fixes <https://bugs.torproject.org/32606>. --- service/src/main/assets/common/bridges.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/service/src/main/assets/common/bridges.txt b/service/src/main/assets/common/bridges.txt index 89b6404..02a3926 100644 --- a/service/src/main/assets/common/bridges.txt +++ b/service/src/main/assets/common/bridges.txt @@ -10,4 +10,5 @@ obfs4 144.217.20.138:80 FB70B257C162BF1038CA669D568D76F5B7F0BABB cert=vYIV5Mgrgh obfs4 193.11.166.194:27015 2D82C2E354D531A68469ADF7F878FA6060C6BACA cert=4TLQPJrTSaDffMK7Nbao6LC7G9OW/NHkUwIdjLSS3KYf0Nv4/nQiiI8dY2TcsQx01NniOg iat-mode=0 obfs4 193.11.166.194:27020 86AC7B8D430DAC4117E9F42C9EAED18133863AAF cert=0LDeJH4JzMDtkJJrFphJCiPqKx7loozKN7VNfuukMGfHO0Z8OGdzHVkhVAOfo1mUdv9cMg iat-mode=0 obfs4 193.11.166.194:27025 1AE2C08904527FEA90C4C4F8C1083EA59FBC6FAF cert=ItvYZzW5tn6v3G4UnQa6Qz04Npro6e81AP70YujmK/KXwDFPTs3aHXcHp4n8Vt6w/bv8cA iat-mode=0 +obfs4 209.148.46.65:443 74FAD13168806246602538555B5521A0383A1875 cert=ssH+9rP8dG2NLDN2XuFw63hIO/9MNNinLmxQDpVa+7kTOa9/m+tGWT1SmSYpQ9uTBGa6Hw iat-mode=0 meek_lite 0.0.2.0:2 97700DFE9F483596DDA6264C4D7DF7641E1E39CE url=https://meek.azureedge.net/ front=ajax.aspnetcdn.com

1 0

[tor-browser-build/maint-9.0] Add new default bridge at Georgetown University.
by gk＠torproject.org 28 Nov '19

28 Nov '19

commit d8033881110e0717ef5c9d4e2265b0b8c79d9b7d Author: Philipp Winter <phw(a)nymity.ch> Date: Wed Nov 27 16:23:34 2019 -0800 Add new default bridge at Georgetown University. This commit fixes <https://bugs.torproject.org/32606>. --- projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js | 1 + 1 file changed, 1 insertion(+) diff --git a/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js b/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js index aa464d6..fae920a 100644 --- a/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js @@ -15,6 +15,7 @@ pref("extensions.torlauncher.default_bridge.obfs4.10", "obfs4 144.217.20.138:80 pref("extensions.torlauncher.default_bridge.obfs4.11", "obfs4 193.11.166.194:27015 2D82C2E354D531A68469ADF7F878FA6060C6BACA cert=4TLQPJrTSaDffMK7Nbao6LC7G9OW/NHkUwIdjLSS3KYf0Nv4/nQiiI8dY2TcsQx01NniOg iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.12", "obfs4 193.11.166.194:27020 86AC7B8D430DAC4117E9F42C9EAED18133863AAF cert=0LDeJH4JzMDtkJJrFphJCiPqKx7loozKN7VNfuukMGfHO0Z8OGdzHVkhVAOfo1mUdv9cMg iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.13", "obfs4 193.11.166.194:27025 1AE2C08904527FEA90C4C4F8C1083EA59FBC6FAF cert=ItvYZzW5tn6v3G4UnQa6Qz04Npro6e81AP70YujmK/KXwDFPTs3aHXcHp4n8Vt6w/bv8cA iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.14", "obfs4 209.148.46.65:443 74FAD13168806246602538555B5521A0383A1875 cert=ssH+9rP8dG2NLDN2XuFw63hIO/9MNNinLmxQDpVa+7kTOa9/m+tGWT1SmSYpQ9uTBGa6Hw iat-mode=0"); pref("extensions.torlauncher.default_bridge.meek-azure.1", "meek_lite 0.0.2.0:2 97700DFE9F483596DDA6264C4D7DF7641E1E39CE url=https://meek.azureedge.net/ front=ajax.aspnetcdn.com");

1 0

[tor-browser-build/master] Add new default bridge at Georgetown University.
by gk＠torproject.org 28 Nov '19

28 Nov '19

commit b7c78701ed87062a5daa6a8d634da98873ad10dd Author: Philipp Winter <phw(a)nymity.ch> Date: Wed Nov 27 16:23:34 2019 -0800 Add new default bridge at Georgetown University. This commit fixes <https://bugs.torproject.org/32606>. --- projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js | 1 + 1 file changed, 1 insertion(+) diff --git a/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js b/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js index aa464d6..fae920a 100644 --- a/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js @@ -15,6 +15,7 @@ pref("extensions.torlauncher.default_bridge.obfs4.10", "obfs4 144.217.20.138:80 pref("extensions.torlauncher.default_bridge.obfs4.11", "obfs4 193.11.166.194:27015 2D82C2E354D531A68469ADF7F878FA6060C6BACA cert=4TLQPJrTSaDffMK7Nbao6LC7G9OW/NHkUwIdjLSS3KYf0Nv4/nQiiI8dY2TcsQx01NniOg iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.12", "obfs4 193.11.166.194:27020 86AC7B8D430DAC4117E9F42C9EAED18133863AAF cert=0LDeJH4JzMDtkJJrFphJCiPqKx7loozKN7VNfuukMGfHO0Z8OGdzHVkhVAOfo1mUdv9cMg iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.13", "obfs4 193.11.166.194:27025 1AE2C08904527FEA90C4C4F8C1083EA59FBC6FAF cert=ItvYZzW5tn6v3G4UnQa6Qz04Npro6e81AP70YujmK/KXwDFPTs3aHXcHp4n8Vt6w/bv8cA iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.14", "obfs4 209.148.46.65:443 74FAD13168806246602538555B5521A0383A1875 cert=ssH+9rP8dG2NLDN2XuFw63hIO/9MNNinLmxQDpVa+7kTOa9/m+tGWT1SmSYpQ9uTBGa6Hw iat-mode=0"); pref("extensions.torlauncher.default_bridge.meek-azure.1", "meek_lite 0.0.2.0:2 97700DFE9F483596DDA6264C4D7DF7641E1E39CE url=https://meek.azureedge.net/ front=ajax.aspnetcdn.com");

1 0

[tor-browser-build/maint-9.0] Prepare build2
by gk＠torproject.org 27 Nov '19

27 Nov '19

commit e671308fc5b74507aa2435f0b8601fa8b84c0b95 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Nov 27 19:50:03 2019 +0000 Prepare build2 --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 2 ++ rbm.conf | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 8b9c8f0..38cfd3f 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -13,6 +13,8 @@ Tor Browser 9.0.2 -- December 3 2019 * Windows * Bug 31989: Backport backout of old mingw-gcc patch * Bug 32616: Disable GetSecureOutputDirectoryPath() functionality + * Android + * Bug 32365: Localization is broken in Tor Browser 9 on Android * Build System * All Platforms * Bug 32413: Bump Go version to 1.12.13 diff --git a/rbm.conf b/rbm.conf index f5da4c7..de42014 100644 --- a/rbm.conf +++ b/rbm.conf @@ -25,7 +25,7 @@ buildconf: var: torbrowser_version: '9.0.2' - torbrowser_build: 'build1' + torbrowser_build: 'build2' torbrowser_incremental_from: - 9.0.1 project_name: tor-browser

1 0

[tor-browser-build/master] Bug 32505: Enable library validation on macOS
by gk＠torproject.org 27 Nov '19

27 Nov '19

commit e01d78d95fa019b9418e17ac03b3b26e655d6cd9 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Nov 27 11:28:31 2019 +0000 Bug 32505: Enable library validation on macOS --- tools/signing/alpha.entitlements.xml | 3 --- 1 file changed, 3 deletions(-) diff --git a/tools/signing/alpha.entitlements.xml b/tools/signing/alpha.entitlements.xml index 3097c05..3062b9d 100644 --- a/tools/signing/alpha.entitlements.xml +++ b/tools/signing/alpha.entitlements.xml @@ -20,9 +20,6 @@  <key>com.apple.security.cs.disable-executable-page-protection</key><false/> -  - <key>com.apple.security.cs.disable-library-validation</key><true/> -  <key>com.apple.security.cs.allow-dyld-environment-variables</key><true/>

1 0

[tor-browser-build/maint-9.0] Bug 32365: Package multi-locale apk in a new way
by gk＠torproject.org 27 Nov '19

27 Nov '19

commit 54091ab8d4a431458105d2be5346ac5232fea265 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Fri Nov 8 01:47:32 2019 +0000 Bug 32365: Package multi-locale apk in a new way --- projects/firefox/build | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/projects/firefox/build b/projects/firefox/build index 456aa07..6b42d74 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -115,7 +115,11 @@ rm -f js/src/configure cp /var/tmp/dist/tba-translation/[% lang %]/torbrowser_strings.dtd /var/tmp/dist/locales/[% lang %]/mobile/android/base/ ./mach build chrome-[% lang %]; [% END %] + # Include localization for all available locales. + # mk is excluded above because Mozilla does not provide mk localization. + # mk is included here because we may have localization for torbutton. export MOZ_CHROME_MULTILOCALE='[% tmpl(c('var/locales').join(' ')) %]' + ./mach android assemble-app AB_CD=multi ./mach package # Copy the result over and return. There is nothing more to do for mobile. cp obj-*/dist/*unsigned-unaligned.apk [% dest_dir _ '/' _ c('filename') %]/tor-browser-unsigned-unaligned.apk

1 0

[tor-browser-build/master] Bug 32365: Package multi-locale apk in a new way
by gk＠torproject.org 27 Nov '19

27 Nov '19

commit 4f97d497ea11a8325cafeaec6ac51fb10ef56de1 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Fri Nov 8 01:47:32 2019 +0000 Bug 32365: Package multi-locale apk in a new way --- projects/firefox/build | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/projects/firefox/build b/projects/firefox/build index 53d425b..5179634 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -115,7 +115,11 @@ rm -f js/src/configure cp /var/tmp/dist/tba-translation/[% lang %]/torbrowser_strings.dtd /var/tmp/dist/locales/[% lang %]/mobile/android/base/ ./mach build chrome-[% lang %]; [% END %] + # Include localization for all available locales. + # mk is excluded above because Mozilla does not provide mk localization. + # mk is included here because we may have localization for torbutton. export MOZ_CHROME_MULTILOCALE='[% tmpl(c('var/locales').join(' ')) %]' + ./mach android assemble-app AB_CD=multi ./mach package # Copy the result over and return. There is nothing more to do for mobile. cp obj-*/dist/*unsigned-unaligned.apk [% dest_dir _ '/' _ c('filename') %]/tor-browser-unsigned-unaligned.apk

1 0

[tor-browser-build/maint-9.0] Changelog update and 9.0.2 version bump
by gk＠torproject.org 27 Nov '19

27 Nov '19

commit 0e5a9486bd726eaf442fa8e5d21a8e38e22f32f0 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Nov 27 08:15:18 2019 +0000 Changelog update and 9.0.2 version bump --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 1 + rbm.conf | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index dd67e02..8b9c8f0 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -12,6 +12,7 @@ Tor Browser 9.0.2 -- December 3 2019 * Bug 32250: Backport enhanced letterboxing support (bug 1546832 and 1556017) * Windows * Bug 31989: Backport backout of old mingw-gcc patch + * Bug 32616: Disable GetSecureOutputDirectoryPath() functionality * Build System * All Platforms * Bug 32413: Bump Go version to 1.12.13 diff --git a/rbm.conf b/rbm.conf index e2e9c75..f5da4c7 100644 --- a/rbm.conf +++ b/rbm.conf @@ -24,10 +24,10 @@ buildconf: git_signtag_opt: '-s' var: - torbrowser_version: '9.0.1' - torbrowser_build: 'build2' + torbrowser_version: '9.0.2' + torbrowser_build: 'build1' torbrowser_incremental_from: - - 9.0 + - 9.0.1 project_name: tor-browser multi_lingual: 0 build_mar: 1

1 0

[tor-browser/tor-browser-68.3.0esr-9.0-1] squash! Bug 4234: Use the Firefox Update Process for Tor Browser.
by gk＠torproject.org 27 Nov '19

27 Nov '19

commit acaf32506a39f94751853ff55869855ac3563a54 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue Nov 26 15:12:59 2019 -0500 squash! Bug 4234: Use the Firefox Update Process for Tor Browser. Also fix 32616: Disable GetSecureOutputDirectoryPath() functionality. --- toolkit/mozapps/update/common/updatehelper.cpp | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/toolkit/mozapps/update/common/updatehelper.cpp b/toolkit/mozapps/update/common/updatehelper.cpp index 893a507a5c61..e9ee4886dea2 100644 --- a/toolkit/mozapps/update/common/updatehelper.cpp +++ b/toolkit/mozapps/update/common/updatehelper.cpp @@ -62,6 +62,13 @@ BOOL PathGetSiblingFilePath(LPWSTR destinationBuffer, LPCWSTR siblingFilePath, * @return TRUE if successful */ BOOL GetSecureOutputDirectoryPath(LPWSTR outBuf) { +#ifdef TOR_BROWSER_UPDATE + // This function is used to support the maintenance service and elevated + // updates and is therefore not called by Tor Browser's updater. We stub + // it out to avoid any chance that the Tor Browser updater will create + // files under C:\Program Files (x86)\ or a similar location. + return FALSE; +#else PWSTR progFilesX86; if (FAILED(SHGetKnownFolderPath(FOLDERID_ProgramFilesX86, KF_FLAG_CREATE, nullptr, &progFilesX86))) { @@ -95,6 +102,7 @@ BOOL GetSecureOutputDirectoryPath(LPWSTR outBuf) { } return TRUE; +#endif } /**

1 0

[tor-browser-build/master] Bug 25101: Add support for generating nightly incremental mars
by gk＠torproject.org 26 Nov '19

26 Nov '19

commit d4460a92659808f8d29547197e23cb6defcf2f35 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Nov 18 19:19:12 2019 +0100 Bug 25101: Add support for generating nightly incremental mars --- Makefile | 5 +++++ README.MAKEFILE | 14 +++++++++++++- projects/release/hash_incrementals | 6 +++++- projects/release/update_responses_config | 11 ++++++----- projects/release/update_responses_config.yml | 5 +++-- rbm.conf | 19 +++++++++++++++++++ tools/update-responses/update_responses | 3 ++- 7 files changed, 53 insertions(+), 10 deletions(-) diff --git a/Makefile b/Makefile index 6edb7e3..6d82f93 100644 --- a/Makefile +++ b/Makefile @@ -164,6 +164,11 @@ incrementals-alpha: submodule-update tools/update-responses/gen_incrementals alpha $(rbm) build release --step hash_incrementals --target alpha +incrementals-nightly: submodule-update + $(rbm) build release --step update_responses_config --target nightly + NO_CODESIGNATURE=1 tools/update-responses/gen_incrementals nightly + $(rbm) build release --step hash_incrementals --target nightly + update_responses-release: submodule-update $(rbm) build release --step update_responses_config --target release --target signed $(rbm) build release --step create_update_responses_tar --target release --target signed diff --git a/README.MAKEFILE b/README.MAKEFILE index e07224e..62b54df 100644 --- a/README.MAKEFILE +++ b/README.MAKEFILE @@ -82,7 +82,19 @@ build number defined as var/torbrowser_version and var/torbrowser_build. incrementals-{release,alpha} ---------------------------- Create incremental mar files for an unsigned build in the release or -alpha channel. +alpha channel. The list of versions we create incrementals from is +defined as var/torbrowser_incremental_from in rbm.conf. + +incrementals-nightly +-------------------- +Create incremental mar files for the current nightly build. The number +of previous versions we should generate incremental mars from is defined +as var/max_torbrowser_incremental_from in rbm.conf. + +If you want to create incremental mars for a version that is not the +current one, you can define the environment variable +TORBROWSER_NIGHTLY_VERSION to the version you want to generate +incremental mars for. dmg2mar-{release,alpha) ----------------------- diff --git a/projects/release/hash_incrementals b/projects/release/hash_incrementals index 9cf1b27..ba95ac7 100644 --- a/projects/release/hash_incrementals +++ b/projects/release/hash_incrementals @@ -1,4 +1,8 @@ #!/bin/bash [% c("var/set_default_env") -%] -cd [% shell_quote(path(dest_dir)) %]/[% c("var/signed_status") %]/[% c("version") %]-[% c("var/torbrowser_build") %] +[% IF c("var/nightly") -%] + cd [% shell_quote(path(dest_dir)) %]/[% c("version") %] +[% ELSE -%] + cd [% shell_quote(path(dest_dir)) %]/[% c("var/signed_status") %]/[% c("version") %]-[% c("var/torbrowser_build") %] +[% END -%] sha256sum `ls -1 | grep '\.incremental\.mar$' | sort` > sha256sums-[% c("var/signed_status") %]-build.incrementals.txt diff --git a/projects/release/update_responses_config b/projects/release/update_responses_config index 4ff470d..ce1d846 100644 --- a/projects/release/update_responses_config +++ b/projects/release/update_responses_config @@ -4,8 +4,9 @@ cat > [% shell_quote(c("basedir")) %]/tools/update-responses/config.yml << 'EOF' [% INCLUDE update_responses_config.yml -%] EOF -# Update / create symlink $torbrowser_version -> $torbrowser_version-buildN -versiondir=[% shell_quote(path(dest_dir)) _ '/' _ c("var/signed_status") _ '/' _ c("version") %] -test -L "$versiondir" && rm -f "$versiondir" -test -d "$versiondir" || ln -s [% shell_quote(c("version")) %]-[% shell_quote(c("var/torbrowser_build")) %] "$versiondir" - +[% IF ! c("var/nightly") -%] + # Update / create symlink $torbrowser_version -> $torbrowser_version-buildN + versiondir=[% shell_quote(path(dest_dir)) _ '/' _ c("var/signed_status") _ '/' _ c("version") %] + test -L "$versiondir" && rm -f "$versiondir" + test -d "$versiondir" || ln -s [% shell_quote(c("version")) %]-[% shell_quote(c("var/torbrowser_build")) %] "$versiondir" +[% END -%] diff --git a/projects/release/update_responses_config.yml b/projects/release/update_responses_config.yml index f2542d6..85a1d43 100644 --- a/projects/release/update_responses_config.yml +++ b/projects/release/update_responses_config.yml @@ -5,7 +5,7 @@ appname_bundle_osx: TorBrowser appname_bundle_linux: tor-browser appname_bundle_win32: torbrowser-install appname_bundle_win64: torbrowser-install-win64 -releases_dir: [% path(c('output_dir')) %]/signed +releases_dir: [% path(c('output_dir')) %][% IF ! c("var/nightly") %]/signed[% END %] download: archive_url: https://archive.torproject.org/tor-package-archive/torbrowser gpg_keyring: ../../keyring/torbrowser.gpg @@ -31,7 +31,8 @@ versions: platformVersion: [% pc('firefox', 'var/firefox_platform_version') %] detailsURL: https://blog.torproject.org/new-release-tor-browser-[% c("var/torbrowser_version") FILTER remove('\.') %] incremental_from: -[% FOREACH v IN c("var/torbrowser_incremental_from") -%] +[% SET incr_from = c("var/nightly") ? c("var_p/nightly_torbrowser_incremental_from") : c("var/torbrowser_incremental_from"); + FOREACH v IN incr_from -%] - [% v %] [% END -%] migrate_archs: diff --git a/rbm.conf b/rbm.conf index 15d8ef1..cb5e972 100644 --- a/rbm.conf +++ b/rbm.conf @@ -154,6 +154,7 @@ targets: - es-ES - fr - ru + max_torbrowser_incremental_from: 2 torbrowser-testbuild: - testbuild @@ -521,5 +522,23 @@ ENV: $version = sprintf("tbb-nightly.%u.%02u.%02u", $year + 1900, $mon + 1, $day); return $version; }, + nightly_torbrowser_incremental_from => sub { + my ($project, $options) = @_; + my $nightly_dir = project_config($project, 'basedir', $options) . '/nightly'; + my $current_version = project_config($project, 'var/torbrowser_version', $options); + use Path::Tiny; + return [] unless -d $nightly_dir; + my @dirs = sort map { $_->basename } path($nightly_dir)->children(qr/^tbb-nightly\./); + my $nb_incr = project_config($project, ['var', 'max_torbrowser_incremental_from'], $options); + my @res; + while ($nb_incr > 0) { + my $dir = pop @dirs; + last unless $dir; + next if $dir eq $current_version; + $nb_incr--; + push @res, $dir; + } + return [@res]; + }, }, ) diff --git a/tools/update-responses/update_responses b/tools/update-responses/update_responses index 59cd2ef..3dfd05d 100755 --- a/tools/update-responses/update_responses +++ b/tools/update-responses/update_responses @@ -220,7 +220,8 @@ sub create_incremental_mar { extract_mar(mar_filename($config, $appname, $new_version, $os, $lang), "$tmpdir/B", $mar_c_new); # bug 26054: make sure previous macOS version is code signed - if (($os eq 'osx64') && ! -f "$tmpdir/A/Contents/_CodeSignature/CodeResources") { + if (!$ENV{NO_CODESIGNATURE} && ($os eq 'osx64') + && ! -f "$tmpdir/A/Contents/_CodeSignature/CodeResources") { exit_error "Missing code signature in $from_version while creating $mar_file"; } if ($ENV{CHECK_CODESIGNATURE_EXISTS}) {

1 0

[tor-browser-build/master] Bug 32556: Keep track of entitlement files and add signing script templates
by gk＠torproject.org 26 Nov '19

26 Nov '19

commit f1cc6bc762c337d9cbc7187d2958dcb54007f9ff Author: Georg Koppen <gk(a)torproject.org> Date: Tue Nov 26 18:16:10 2019 +0000 Bug 32556: Keep track of entitlement files and add signing script templates --- tools/signing/README | 7 ++++ tools/signing/alpha.entitlements.xml | 53 ++++++++++++++++++++++++++++++ tools/signing/authenticode-signing.sh | 48 +++++++++++++++++++++++++++ tools/signing/authenticode-timestamping.sh | 46 ++++++++++++++++++++++++++ tools/signing/gatekeeper-bundling.sh | 49 +++++++++++++++++++++++++++ tools/signing/gatekeeper-signing.sh | 51 ++++++++++++++++++++++++++++ tools/signing/notarization.sh | 50 ++++++++++++++++++++++++++++ tools/signing/stable.entitlements.xml | 53 ++++++++++++++++++++++++++++++ tools/signing/stapler.sh | 47 ++++++++++++++++++++++++++ tools/signing/tbb-signing.sh | 38 +++++++++++++++++++++ 10 files changed, 442 insertions(+) diff --git a/tools/signing/README b/tools/signing/README new file mode 100644 index 0000000..e18a761 --- /dev/null +++ b/tools/signing/README @@ -0,0 +1,7 @@ +The files in this directory are a large part of what we use when signing +releases. The scripts are meant to be templates, though, at the moment +omitting specific paths and credential information. + +Additionally, when starting to used them for an own signing setup don't forget +to adapt the locale list if needed. The entitlement files, however, are kept +up-to-date. diff --git a/tools/signing/alpha.entitlements.xml b/tools/signing/alpha.entitlements.xml new file mode 100644 index 0000000..3097c05 --- /dev/null +++ b/tools/signing/alpha.entitlements.xml @@ -0,0 +1,53 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> + +<plist version="1.0"> + <dict> +  + <key>com.apple.security.cs.allow-jit</key><false/> + +  + <key>com.apple.security.cs.allow-unsigned-executable-memory</key><true/> + +  + <key>com.apple.security.cs.disable-executable-page-protection</key><false/> + +  + <key>com.apple.security.cs.disable-library-validation</key><true/> + +  + <key>com.apple.security.cs.allow-dyld-environment-variables</key><true/> + +  + <key>com.apple.security.get-task-allow</key><false/> + +  + <key>com.apple.security.device.audio-input</key><true/> + +  + <key>com.apple.security.device.camera</key><true/> + +  + <key>com.apple.security.personal-information.location</key><true/> + +  + <key>com.apple.security.automation.apple-events</key><true/> + +  + <key>com.apple.security.smartcard</key><true/> + </dict> +</plist> diff --git a/tools/signing/authenticode-signing.sh b/tools/signing/authenticode-signing.sh new file mode 100755 index 0000000..7e2e6f0 --- /dev/null +++ b/tools/signing/authenticode-signing.sh @@ -0,0 +1,48 @@ +#!/bin/bash + +# Copyright (c) 2019, The Tor Project, Inc. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are +# met: + +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following disclaimer +# in the documentation and/or other materials provided with the +# distribution. +# +# * Neither the names of the copyright owners nor the names of its +# contributors may be used to endorse or promote products derived from +# this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +set -e + +read -sp "Enter passphrase: " pass +echo +for i in `find . -name "*.exe" -print` +do + /path/to/patched/osslsigncode/build/osslsigncode \ + -pkcs11engine /usr/lib/engines/engine_pkcs11.so \ + -pkcs11module /usr/lib/libeTPkcs11.so \ + -pass $pass \ + -h sha256 \ + -certs $path/to/cert \ + -key $key \ + $i $i-signed +done +rename -f 's/-signed//' *-signed diff --git a/tools/signing/authenticode-timestamping.sh b/tools/signing/authenticode-timestamping.sh new file mode 100755 index 0000000..77973b7 --- /dev/null +++ b/tools/signing/authenticode-timestamping.sh @@ -0,0 +1,46 @@ +#!/bin/bash + +# Copyright (c) 2019, The Tor Project, Inc. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are +# met: + +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following disclaimer +# in the documentation and/or other materials provided with the +# distribution. +# +# * Neither the names of the copyright owners nor the names of its +# contributors may be used to endorse or promote products derived from +# this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +set -e + +COUNT=0 +for i in `find . -name "*.exe" -print` +do + /path/to/patched/osslsigncode add \ + -t http://timestamp.digicert.com \ + -p socks://127.0.0.1:9050 \ + $i $i-timestamped + COUNT=$((COUNT + 1)) + +done +echo "Timestamped $COUNT .exe files, now renaming" +rename -f 's/-timestamped//' *-timestamped diff --git a/tools/signing/gatekeeper-bundling.sh b/tools/signing/gatekeeper-bundling.sh new file mode 100755 index 0000000..742bc61 --- /dev/null +++ b/tools/signing/gatekeeper-bundling.sh @@ -0,0 +1,49 @@ +#!/bin/bash + +# Copyright (c) 2019, The Tor Project, Inc. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are +# met: + +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following disclaimer +# in the documentation and/or other materials provided with the +# distribution. +# +# * Neither the names of the copyright owners nor the names of its +# contributors may be used to endorse or promote products derived from +# this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +TORBROWSER_VERSION=$1 +if [ -z $TORBROWSER_VERSION ]; +then + echo "Please call this script with a Tor Browser version!" + exit 1 +fi +BUNDLE_LOCALES="ar ca cs da de el en-US es-AR es-ES fa fr ga-IE he hu id is it ja ka ko mk nb-NO nl pl pt-BR ro ru sv-SE tr vi zh-CN zh-TW" +builddir=/path/to/the/build/dir +mkdir $builddir/$TORBROWSER_VERSION-signed +for LANG in $BUNDLE_LOCALES +do + cd $builddir/dmg + unzip -q $builddir/$TORBROWSER_VERSION/tb-${TORBROWSER_VERSION}_$LANG-stapled.zip + cd .. + $builddir/ddmg.sh $builddir/$TORBROWSER_VERSION-signed/TorBrowser-${TORBROWSER_VERSION}-osx64_$LANG.dmg $builddir/dmg/ + rm -rf 'dmg/Tor Browser.app' +done diff --git a/tools/signing/gatekeeper-signing.sh b/tools/signing/gatekeeper-signing.sh new file mode 100755 index 0000000..3f31f82 --- /dev/null +++ b/tools/signing/gatekeeper-signing.sh @@ -0,0 +1,51 @@ +#!/bin/bash + +# Copyright (c) 2019, The Tor Project, Inc. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are +# met: + +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following disclaimer +# in the documentation and/or other materials provided with the +# distribution. +# +# * Neither the names of the copyright owners nor the names of its +# contributors may be used to endorse or promote products derived from +# this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +TORBROWSER_VERSION=$1 +if [ -z "$TORBROWSER_VERSION" ]; +then + echo "Please call this script with a Tor Browser version!" + exit 1 +fi +ENTITLEMENTS=/path/to/stable.entitlements.xml +BUNDLE_LOCALES="ar ca cs da de el en-US es-AR es-ES fa fr ga-IE he hu id is it ja ka ko mk nb-NO nl pl pt-BR ro ru sv-SE tr vi zh-CN zh-TW" +for LANG in $BUNDLE_LOCALES +do + hdiutil attach TorBrowser-${TORBROWSER_VERSION}-osx64_$LANG.dmg + cp -rf "/Volumes/Tor Browser/Tor Browser.app" "Tor Browser.app" + echo "Signing Tor Browser_$LANG.app" + codesign -vvv --deep -o runtime --entitlements="$ENTITLEMENTS" --timestamp -f -s "$ID" "Tor Browser.app/" + echo "Zipping up" + zip -qr tb-${TORBROWSER_VERSION}_${LANG}.zip "Tor Browser.app" + rm -rf "Tor Browser.app" + hdiutil detach "/Volumes/Tor Browser" +done diff --git a/tools/signing/notarization.sh b/tools/signing/notarization.sh new file mode 100755 index 0000000..eb29e74 --- /dev/null +++ b/tools/signing/notarization.sh @@ -0,0 +1,50 @@ +#!/bin/bash + +# Copyright (c) 2019, The Tor Project, Inc. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are +# met: + +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following disclaimer +# in the documentation and/or other materials provided with the +# distribution. +# +# * Neither the names of the copyright owners nor the names of its +# contributors may be used to endorse or promote products derived from +# this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +TORBROWSER_VERSION=$1 +if [ -z "$TORBROWSER_VERSION" ]; +then + echo "Please call this script with a Tor Browser version!" + exit 1 +fi +BUNDLE_LOCALES="ar ca cs da de el en-US es-AR es-ES fa fr ga-IE he hu id is it ja ka ko mk nb-NO nl pl pt-BR ro ru sv-SE tr vi zh-CN zh-TW" +for LANG in $BUNDLE_LOCALES +do + mkdir $LANG + cd $LANG + mv ../tb-${TORBROWSER_VERSION}_$LANG.zip . + unzip -q tb-${TORBROWSER_VERSION}_$LANG.zip + echo "Notarizing $LANG..." + xcrun altool --notarize-app -t osx -f tb-${TORBROWSER_VERSION}_$LANG.zip + --primary-bundle-id org.torproject.torbrowser -u USERNAME -p @env:PW --output-format xml + cd .. +done diff --git a/tools/signing/stable.entitlements.xml b/tools/signing/stable.entitlements.xml new file mode 100644 index 0000000..3097c05 --- /dev/null +++ b/tools/signing/stable.entitlements.xml @@ -0,0 +1,53 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> + +<plist version="1.0"> + <dict> +  + <key>com.apple.security.cs.allow-jit</key><false/> + +  + <key>com.apple.security.cs.allow-unsigned-executable-memory</key><true/> + +  + <key>com.apple.security.cs.disable-executable-page-protection</key><false/> + +  + <key>com.apple.security.cs.disable-library-validation</key><true/> + +  + <key>com.apple.security.cs.allow-dyld-environment-variables</key><true/> + +  + <key>com.apple.security.get-task-allow</key><false/> + +  + <key>com.apple.security.device.audio-input</key><true/> + +  + <key>com.apple.security.device.camera</key><true/> + +  + <key>com.apple.security.personal-information.location</key><true/> + +  + <key>com.apple.security.automation.apple-events</key><true/> + +  + <key>com.apple.security.smartcard</key><true/> + </dict> +</plist> diff --git a/tools/signing/stapler.sh b/tools/signing/stapler.sh new file mode 100755 index 0000000..cdbb466 --- /dev/null +++ b/tools/signing/stapler.sh @@ -0,0 +1,47 @@ +#!/bin/bash + +# Copyright (c) 2019, The Tor Project, Inc. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are +# met: + +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following disclaimer +# in the documentation and/or other materials provided with the +# distribution. +# +# * Neither the names of the copyright owners nor the names of its +# contributors may be used to endorse or promote products derived from +# this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +TORBROWSER_VERSION=$1 +if [ -z "$TORBROWSER_VERSION" ]; +then + echo "Please call this script with a Tor Browser version!" + exit 1 +fi +BUNDLE_LOCALES="ar ca cs da de el en-US es-AR es-ES fa fr ga-IE he hu id is it ja ka ko mk nb-NO nl pl pt-BR ro ru sv-SE tr vi zh-CN zh-TW" +for LANG in $BUNDLE_LOCALES +do + echo "Stapling $LANG..." + cd $LANG + xcrun stapler staple Tor\ Browser.app + zip -qr ../tb-${TORBROWSER_VERSION}_$LANG-stapled.zip Tor\ Browser.app + cd .. +done diff --git a/tools/signing/tbb-signing.sh b/tools/signing/tbb-signing.sh new file mode 100755 index 0000000..42ea235 --- /dev/null +++ b/tools/signing/tbb-signing.sh @@ -0,0 +1,38 @@ +#!/bin/bash + +# Copyright (c) 2019, The Tor Project, Inc. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are +# met: + +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following disclaimer +# in the documentation and/or other materials provided with the +# distribution. +# +# * Neither the names of the copyright owners nor the names of its +# contributors may be used to endorse or promote products derived from +# this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +export GNUPGHOME=/path/to/gpg-key +read -sp "Enter passphrase: " pass +for i in `find . -name "*.dmg" -o -name "*.exe" -o -name "*.tar.xz" -o -name "*.txt" -o -name "*.zip" -o -name "*.tar.gz" -o -name "*.apk"` +do + echo "$pass" | gpg -absu $key! --passphrase-fd 0 $i +done

1 0

[tor-browser-build/master] Bug 32475: Limit the number of mar file locales in nightly builds
by gk＠torproject.org 26 Nov '19

26 Nov '19

commit 8d5805ae26b873762ec823ae7ec1180d8d89b585 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Nov 20 19:14:37 2019 +0100 Bug 32475: Limit the number of mar file locales in nightly builds We will start supporting updates in the nightly channel only for a limited set of locales. --- projects/tor-browser/build | 18 ++++++++++++++++-- rbm.conf | 6 ++++++ 2 files changed, 22 insertions(+), 2 deletions(-) diff --git a/projects/tor-browser/build b/projects/tor-browser/build index 67419a8..0869f50 100644 --- a/projects/tor-browser/build +++ b/projects/tor-browser/build @@ -290,6 +290,17 @@ cp $rootdir/[% c('input_files_by_name/firefox') %]/mar-tools-*.zip "$OUTDIR"/ ELSE; SET browserdir = tbdir _ '/Browser'; END; + SET build_mar = c("var/build_mar"); + # On nightly we only build mar files for some locales + IF c("var/nightly") && c("var/build_mar"); + build_mar = 0; + FOREACH mar_lang = c("var/mar_locales"); + mar_lang = tmpl(mar_lang); + IF mar_lang == lang; + build_mar = 1; + END; + END; + END; %] cat > "$scripts_dir/create-tor-browser_[% lang %]" << SCRIPT_EOF #!/bin/bash @@ -323,8 +334,11 @@ cp $rootdir/[% c('input_files_by_name/firefox') %]/mar-tools-*.zip "$OUTDIR"/ cd $distdir - # Create full MAR file and compressed package for this locale. - MAR=$MARTOOLS/mar MBSDIFF=$MARTOOLS/mbsdiff $MARTOOLS/make_full_update.sh -q $OUTDIR/[% mar_file %] "[% browserdir %]" + [% IF build_mar -%] + # Create full MAR file and compressed package for this locale. + MAR=$MARTOOLS/mar MBSDIFF=$MARTOOLS/mbsdiff $MARTOOLS/make_full_update.sh -q $OUTDIR/[% mar_file %] "[% browserdir %]" + [% END -%] + [% IF c("var/linux") %] [% SET tardir = 'tor-browser_' _ lang; c('tar', { diff --git a/rbm.conf b/rbm.conf index f0ae4f9..15d8ef1 100644 --- a/rbm.conf +++ b/rbm.conf @@ -148,6 +148,12 @@ targets: nightly: 1 channel: nightly torbrowser_version: '[% ENV.TORBROWSER_NIGHTLY_VERSION ? ENV.TORBROWSER_NIGHTLY_VERSION : c("var_p/nightly_torbrowser_version") %]' + # For nightly builds, we support updates for a limited set of locales + mar_locales: + - de + - es-ES + - fr + - ru torbrowser-testbuild: - testbuild

1 0

[tor-browser/tor-browser-68.2.0esr-9.5-1] fixup! Bug 4234: Use the Firefox Update Process for Tor Browser.
by gk＠torproject.org 26 Nov '19

26 Nov '19

commit 9579237949269ef391e474f222011fa218608fae Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Nov 25 17:25:29 2019 +0100 fixup! Bug 4234: Use the Firefox Update Process for Tor Browser. Bug 32498: Update MAR_CHANNEL_ID for nightly We also add the -alpha channel ID to the list of ACCEPTED_MAR_CHANNEL_IDS for the alpha, so that we can change the alpha channel name at some point. --- browser/confvars.sh | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/browser/confvars.sh b/browser/confvars.sh index 428adaf6bcbc..adf45362014a 100755 --- a/browser/confvars.sh +++ b/browser/confvars.sh @@ -33,6 +33,15 @@ MOZ_APP_ID={ec8030f7-c20a-464f-9b0e-13a3a9e97384} if test "$MOZ_UPDATE_CHANNEL" = "aurora"; then ACCEPTED_MAR_CHANNEL_IDS=firefox-mozilla-aurora MAR_CHANNEL_ID=firefox-mozilla-aurora +elif test "$MOZ_UPDATE_CHANNEL" = "alpha"; then + # alpha is currently using the -release channel id. However we accept + # both -alpha and -release channel ID for the alpha so that we can + # switch it to -alpha at some point. See bug 32498. + ACCEPTED_MAR_CHANNEL_IDS=torbrowser-torproject-alpha,torbrowser-torproject-release + MAR_CHANNEL_ID=torbrowser-torproject-release +elif test "$MOZ_UPDATE_CHANNEL" = "nightly"; then + ACCEPTED_MAR_CHANNEL_IDS=torbrowser-torproject-nightly + MAR_CHANNEL_ID=torbrowser-torproject-nightly else ACCEPTED_MAR_CHANNEL_IDS=torbrowser-torproject-release MAR_CHANNEL_ID=torbrowser-torproject-release

1 0

[tor-browser/tor-browser-68.2.0esr-9.5-1] Bug 1598647 - Set Origin to null with network.http.referer.hideOnionSource r=JuniorHsu
by gk＠torproject.org 26 Nov '19

26 Nov '19

commit 1b5b65b5c8f11e3f2fd30ca0604fde741bc2c749 Author: Alex Catarineu <acat(a)torproject.org> Date: Mon Nov 25 13:29:47 2019 +0000 Bug 1598647 - Set Origin to null with network.http.referer.hideOnionSource r=JuniorHsu Differential Revision: https://phabricator.services.mozilla.com/D54303 --HG-- extra : moz-landing-system : lando --- dom/security/ReferrerInfo.cpp | 3 ++- dom/security/ReferrerInfo.h | 2 +- netwerk/protocol/http/nsCORSListenerProxy.cpp | 2 +- netwerk/protocol/http/nsHttpChannel.cpp | 17 +++++++---------- 4 files changed, 11 insertions(+), 13 deletions(-) diff --git a/dom/security/ReferrerInfo.cpp b/dom/security/ReferrerInfo.cpp index 2d06d9b3d3d3..25d9cd3290c0 100644 --- a/dom/security/ReferrerInfo.cpp +++ b/dom/security/ReferrerInfo.cpp @@ -322,7 +322,8 @@ nsresult ReferrerInfo::HandleUserReferrerSendingPolicy(nsIHttpChannel* aChannel, return NS_OK; } -bool ReferrerInfo::IsCrossOriginRequest(nsIHttpChannel* aChannel) const { +/* static */ +bool ReferrerInfo::IsCrossOriginRequest(nsIHttpChannel* aChannel) { nsCOMPtr<nsILoadInfo> loadInfo = aChannel->LoadInfo(); nsCOMPtr<nsIURI> triggeringURI; diff --git a/dom/security/ReferrerInfo.h b/dom/security/ReferrerInfo.h index bf21233a0510..5fa052f3f32d 100644 --- a/dom/security/ReferrerInfo.h +++ b/dom/security/ReferrerInfo.h @@ -155,7 +155,7 @@ class ReferrerInfo : public nsIReferrerInfo { * Computing whether the request is cross-origin may be expensive, so please * do that in cases where we're going to use this information later on. */ - bool IsCrossOriginRequest(nsIHttpChannel* aChannel) const; + static bool IsCrossOriginRequest(nsIHttpChannel* aChannel); /* * Check whether referrer is allowed to send in secure to insecure scenario. diff --git a/netwerk/protocol/http/nsCORSListenerProxy.cpp b/netwerk/protocol/http/nsCORSListenerProxy.cpp index 36b263ddf003..36027a5d2809 100644 --- a/netwerk/protocol/http/nsCORSListenerProxy.cpp +++ b/netwerk/protocol/http/nsCORSListenerProxy.cpp @@ -985,7 +985,7 @@ nsresult nsCORSListenerProxy::UpdateChannel(nsIChannel* aChannel, if (!currentOrgin.EqualsIgnoreCase(origin.get()) && StringEndsWith(potentialOnionHost, NS_LITERAL_CSTRING(".onion"))) { - origin.Truncate(); + origin.AssignLiteral("null"); } } diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp index b2d58379affe..7e1730c13b6a 100644 --- a/netwerk/protocol/http/nsHttpChannel.cpp +++ b/netwerk/protocol/http/nsHttpChannel.cpp @@ -9631,8 +9631,7 @@ void nsHttpChannel::SetOriginHeader() { nsContentUtils::GetASCIIOrigin(referrer, origin); } - // Restrict Origin to same-origin loads if requested by user or leaving from - // .onion + // Restrict Origin to same-origin loads if requested by user if (sSendOriginHeader == 1) { nsAutoCString currentOrigin; nsContentUtils::GetASCIIOrigin(mURI, currentOrigin); @@ -9640,16 +9639,14 @@ void nsHttpChannel::SetOriginHeader() { // Origin header suppressed by user setting return; } - } else if (dom::ReferrerInfo::HideOnionReferrerSource()) { + } + + if (dom::ReferrerInfo::HideOnionReferrerSource()) { nsAutoCString host; if (referrer && NS_SUCCEEDED(referrer->GetAsciiHost(host)) && - StringEndsWith(host, NS_LITERAL_CSTRING(".onion"))) { - nsAutoCString currentOrigin; - nsContentUtils::GetASCIIOrigin(mURI, currentOrigin); - if (!origin.EqualsIgnoreCase(currentOrigin.get())) { - // Origin header is suppressed by .onion - return; - } + StringEndsWith(host, NS_LITERAL_CSTRING(".onion")) && + dom::ReferrerInfo::IsCrossOriginRequest(this)) { + origin.AssignLiteral("null"); } }

1 0

[tor-browser/tor-browser-68.2.0esr-9.5-1] Revert "Bug 32255: Set Origin to null for CORS requests"
by gk＠torproject.org 26 Nov '19

26 Nov '19

commit 9de14da5e2a82b6e1ea4a4c68328996cbcc847ce Author: Alex Catarineu <acat(a)torproject.org> Date: Tue Nov 26 13:31:20 2019 +0100 Revert "Bug 32255: Set Origin to null for CORS requests" This reverts commit f26fb9c17d71f3373c8ccb91ae74c438d9e13f80. --- netwerk/protocol/http/nsCORSListenerProxy.cpp | 2 +- netwerk/protocol/http/nsHttpChannel.cpp | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/netwerk/protocol/http/nsCORSListenerProxy.cpp b/netwerk/protocol/http/nsCORSListenerProxy.cpp index 36027a5d2809..36b263ddf003 100644 --- a/netwerk/protocol/http/nsCORSListenerProxy.cpp +++ b/netwerk/protocol/http/nsCORSListenerProxy.cpp @@ -985,7 +985,7 @@ nsresult nsCORSListenerProxy::UpdateChannel(nsIChannel* aChannel, if (!currentOrgin.EqualsIgnoreCase(origin.get()) && StringEndsWith(potentialOnionHost, NS_LITERAL_CSTRING(".onion"))) { - origin.AssignLiteral("null"); + origin.Truncate(); } } diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp index 362607d113ca..b2d58379affe 100644 --- a/netwerk/protocol/http/nsHttpChannel.cpp +++ b/netwerk/protocol/http/nsHttpChannel.cpp @@ -9647,8 +9647,8 @@ void nsHttpChannel::SetOriginHeader() { nsAutoCString currentOrigin; nsContentUtils::GetASCIIOrigin(mURI, currentOrigin); if (!origin.EqualsIgnoreCase(currentOrigin.get())) { - // Origin header set to null by .onion - origin.AssignLiteral("null"); + // Origin header is suppressed by .onion + return; } } }

1 0

[tor-browser-build/maint-9.0] Bug 30548: Clean up keyring file
by gk＠torproject.org 26 Nov '19

26 Nov '19

commit 6b722f712e666bdc4b80694a89b0950e42f3574a Author: Georg Koppen <gk(a)torproject.org> Date: Thu Nov 21 11:56:54 2019 +0000 Bug 30548: Clean up keyring file --- keyring/cmake.gpg | Bin 16939 -> 22706 bytes keyring/llvm.gpg | Bin 3335 -> 4309 bytes keyring/tor.gpg | Bin 159585 -> 9148 bytes keyring/torbrowser.gpg | Bin 125669 -> 2839 bytes keyring/torbutton.gpg | Bin 290913 -> 5120 bytes keyring/yawning.gpg | Bin 58959 -> 36705 bytes 6 files changed, 0 insertions(+), 0 deletions(-) diff --git a/keyring/cmake.gpg b/keyring/cmake.gpg index 51f19e7..05e12fc 100644 Binary files a/keyring/cmake.gpg and b/keyring/cmake.gpg differ diff --git a/keyring/llvm.gpg b/keyring/llvm.gpg index a94f435..7c7ab06 100644 Binary files a/keyring/llvm.gpg and b/keyring/llvm.gpg differ diff --git a/keyring/tor.gpg b/keyring/tor.gpg index 45b333f..3bca5c5 100644 Binary files a/keyring/tor.gpg and b/keyring/tor.gpg differ diff --git a/keyring/torbrowser.gpg b/keyring/torbrowser.gpg index 4f19dd0..ec64740 100644 Binary files a/keyring/torbrowser.gpg and b/keyring/torbrowser.gpg differ diff --git a/keyring/torbutton.gpg b/keyring/torbutton.gpg index 5a505f2..7100dcd 100644 Binary files a/keyring/torbutton.gpg and b/keyring/torbutton.gpg differ diff --git a/keyring/yawning.gpg b/keyring/yawning.gpg index e3384c5..067e96e 100644 Binary files a/keyring/yawning.gpg and b/keyring/yawning.gpg differ

1 0

[tor-browser-build/master] Fix Changelog errors
by gk＠torproject.org 26 Nov '19

26 Nov '19

commit 89c948c3ca5cfd06d9d03c270974b3027bc370dd Author: Georg Koppen <gk(a)torproject.org> Date: Tue Nov 26 13:26:41 2019 +0000 Fix Changelog errors --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index d010aa3..4dcf083 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -6,7 +6,6 @@ Tor Browser 9.5a2 -- November 11 2019 * Bug 30783: Fundraising banner for EOY 2019 campain * Bug 32321: Don't ping Mozilla for Man-in-the-Middle-detection * Bug 32318: Backport Mozilla's fix for bug 1534339 - * Bug 32250: Backport enhanced letterboxing support (bug 1546832 and 1556017) * Bug 31573: Catch SessionStore.jsm exception * Bug 27268: Preferences clean-up * Windows + OS X + Linux @@ -14,6 +13,7 @@ Tor Browser 9.5a2 -- November 11 2019 * Update Tor Launcher to 0.2.20.2 * Bug 32164: Trim each received log line from tor * Translations update + * Bug 32250: Backport enhanced letterboxing support (bug 1546832 and 1556017) * Bug 31803: Replaced about:debugging logo with flat version * Bug 31764: Fix for error when navigating via 'Paste and go' * Bug 32169: Fix TB9 Wikipedia address bar search @@ -77,13 +77,13 @@ Tor Browser 9.5a1 -- October 23 2019 * Bug 31920: Fix Security Level panel when its toolbar button moves to overflow * Bug 31748+31961: Fix 'Learn More' links in Security Level preferences and panel * Translations update + * Windows + * Bug 32132: Re-enable jemalloc for Windows users + * Bug 31989: Backport backout of old mingw-gcc patch * Android * Bug 32097: Fix conflicts in mobile onboarding while rebasing to 68.2.0esr * Bug 26529: Notify user about possible proxy-bypass before opening external app * Build System - * Windows - * Bug 32132: Re-enable jemalloc for Windows users - * Bug 31989: Backport backout of old mingw-gcc patch * Android * Bug 30461: Clean up tor-android-service project

1 0

[tor-browser-build/master] Bump NoScript to 11.0.9
by gk＠torproject.org 26 Nov '19

26 Nov '19

commit 9515c45588dd5a72c44ddf4a0474ef09efa39c13 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Nov 26 13:11:50 2019 +0000 Bump NoScript to 11.0.9 --- projects/tor-browser/config | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/projects/tor-browser/config b/projects/tor-browser/config index 908a6a1..819ebad 100644 --- a/projects/tor-browser/config +++ b/projects/tor-browser/config @@ -73,9 +73,9 @@ input_files: enable: '[% c("var/snowflake") %]' - filename: Bundle-Data enable: '[% ! c("var/android") %]' - - URL: https://addons.cdn.mozilla.net/user-media/addons/722/noscript_security_suit… + - URL: https://addons.cdn.mozilla.net/user-media/addons/722/noscript_security_suit… name: noscript - sha256sum: 0e3f0cfbf3563f0f6d6153d47833101b53e593ebcf6feee2e881d2516a4ce0c0 + sha256sum: 1522903c3486c790e842f9d5204cfbc93672676df4090f99c4d1ee3578ac8c07 - filename: 'RelativeLink/start-tor-browser.desktop' enable: '[% c("var/linux") %]' - filename: 'RelativeLink/execdesktop'

1 0

[tor-browser-build/maint-9.0] Release preparations for 9.0.2
by gk＠torproject.org 26 Nov '19

26 Nov '19

commit e7bfed8ba6236194c6fc2723a7fae30af2cc62aa Author: Georg Koppen <gk(a)torproject.org> Date: Tue Nov 26 13:21:54 2019 +0000 Release preparations for 9.0.2 Versions bump and Changelog update --- projects/firefox-langpacks/config | 2 +- projects/firefox-locale-bundle/config | 2 +- projects/firefox/config | 4 ++-- projects/https-everywhere/config | 2 +- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 18 ++++++++++++++++++ 5 files changed, 23 insertions(+), 5 deletions(-) diff --git a/projects/firefox-langpacks/config b/projects/firefox-langpacks/config index 34d6fad..17a707a 100644 --- a/projects/firefox-langpacks/config +++ b/projects/firefox-langpacks/config @@ -4,7 +4,7 @@ filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/buil var: ff_version: '[% pc("firefox", "var/firefox_version") %]' - ff_build: build1 + ff_build: build2 input_filename: 'dl-langpack-[% c("var/ff_arch") %]-[% c("version") %]' targets: diff --git a/projects/firefox-locale-bundle/config b/projects/firefox-locale-bundle/config index 2f4997f..2ea6db6 100644 --- a/projects/firefox-locale-bundle/config +++ b/projects/firefox-locale-bundle/config @@ -5,4 +5,4 @@ filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' var: use_container: 0 ff_version: '[% pc("firefox", "var/firefox_version") %]' - ff_build: build1 + ff_build: build2 diff --git a/projects/firefox/config b/projects/firefox/config index c3bd1f2..16c0c34 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -1,14 +1,14 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' filename: 'firefox-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build2' +git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build1' tag_gpg_id: 1 git_url: https://git.torproject.org/tor-browser.git git_submodule: 1 gpg_keyring: torbutton.gpg var: - firefox_platform_version: 68.2.0 + firefox_platform_version: 68.3.0 firefox_version: '[% c("var/firefox_platform_version") %]esr' torbrowser_branch: 9.0 torbrowser_update_channel: alpha diff --git a/projects/https-everywhere/config b/projects/https-everywhere/config index 6232669..1bc6f98 100644 --- a/projects/https-everywhere/config +++ b/projects/https-everywhere/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 2019.6.27 +version: 2019.11.7 git_url: https://git.torproject.org/https-everywhere.git git_hash: '[% c("version") %]' git_submodule: 1 diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index e19b00e..dd67e02 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,21 @@ +Tor Browser 9.0.2 -- December 3 2019 + * All Platforms + * Update Firefox to 68.3.0esr + * Bump NoScript to 11.0.9 + * Bug 32362: NoScript TRUSTED setting doesn't work + * Bug 32429: Issues with about:blank and NoScript on .onion sites + * Bump HTTPS Everywhere to 2019.11.7 + * Bug 27268: Preferences clean-up in Torbutton code + * Translations update + * Windows + OS X + Linux + * Bug 32125: Fix circuit display for bridge without a fingerprint + * Bug 32250: Backport enhanced letterboxing support (bug 1546832 and 1556017) + * Windows + * Bug 31989: Backport backout of old mingw-gcc patch + * Build System + * All Platforms + * Bug 32413: Bump Go version to 1.12.13 + Tor Browser 9.0.1 -- November 4 2019 * All Platforms * Update NoScript to 11.0.4

1 0