- tbb-commits - lists.torproject.org

[tor-browser-bundle/maint-7.0] Release preparations for 7.0.10
by gk＠torproject.org 08 Nov '17

08 Nov '17

commit d03218cdf30922b517ac3246e4abb5458e4b88a7 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Nov 8 08:39:31 2017 +0000 Release preparations for 7.0.10 Changelog update, version bumps, and config.yml update --- Bundle-Data/Docs/ChangeLog.txt | 15 +++++++++++++++ gitian/versions | 14 +++++++------- tools/update-responses/config.yml | 10 +++++----- 3 files changed, 27 insertions(+), 12 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 478814b..cf394ef 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,18 @@ +Tor Browser 7.0.10 -- November 14 2017 + * All Platforms + * Update Firefox to 52.5.0esr + * Update Tor to 0.3.1.8 + * Update Torbutton to 1.9.7.10 + * Bug 23997: Add link to Tor Browser manual for de, nl, tr, vi + * Translations update + * Update HTTPS-Everywhere to 2017.10.30 + * Update NoScript to 5.1.5 + * Bug 23968: NoScript icon jumps to the right after update + * Windows + * Bug 23582: Enable the Windows DLL blocklist for mingw-w64 builds + * Bug 23396: Update the msvcr100.dll we ship + * Bug 24052: Block file:// redirects early + Tor Browser 7.0.9 -- November 3 2017 * OS X * Bug 24052: Streamline handling of file:// resources diff --git a/gitian/versions b/gitian/versions index f0c1726..1f08327 100755 --- a/gitian/versions +++ b/gitian/versions @@ -10,15 +10,15 @@ DATA_OUTSIDE_APP_DIR=1 VERIFY_TAGS=1 -FIREFOX_VERSION=52.4.1esr +FIREFOX_VERSION=52.5.0esr TORBROWSER_UPDATE_CHANNEL=release TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.0-1-build1 -TOR_TAG=tor-0.3.1.7 +TOR_TAG=tor-0.3.1.8 TORLAUNCHER_TAG=0.2.12.3 -TORBUTTON_TAG=1.9.7.9 -HTTPSE_TAG=2017.10.4 +TORBUTTON_TAG=1.9.7.10 +HTTPSE_TAG=2017.10.30 NSIS_TAG=v0.3.1 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.22-stable @@ -45,7 +45,7 @@ GITIAN_TAG=tor-browser-builder-4-5 OPENSSL_VER=1.0.2k GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION -FIREFOX_LANG_BUILD=build1 +FIREFOX_LANG_BUILD=build2 BINUTILS_VER=2.24 GCC_VER=5.1.0 CLANG_VER=3.8.0 @@ -67,7 +67,7 @@ YASM_VER=1.2.0 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 -NOSCRIPT_PACKAGE=noscript_security_suite-5.1.2-fx+sm.xpi +NOSCRIPT_PACKAGE=noscript_security_suite-5.1.5-fx+sm.xpi CCTOOLS_PACKAGE=cctools.tar.gz OSXSDK_PACKAGE=MacOSX10.7.sdk.tar.gz MSVCR100_PACKAGE=msvcr100.dll @@ -102,7 +102,7 @@ YASM_PACKAGE=yasm-${YASM_VER}.tar.gz OPENSSL_HASH=6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf -NOSCRIPT_HASH=82687646b9ecc39d478ac5d4de035b32fdf88efc6faceec3e74b49c863bbfabb +NOSCRIPT_HASH=0620b8608441b5a346e347a07ce3c1e707edc8d4d04f2c72af53e73a0d9b6d5c CCTOOLS_HASH=e908fdebc2886ee5491ebfc7e7950af451b3c4e2439c2d7a923ed06ad05113e4 MSVCR100_HASH=8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index cf3cd4d..628b131 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -20,14 +20,14 @@ build_targets: osx64: Darwin_x86_64-gcc3 channels: alpha: 7.0a4 - release: 7.0.9 + release: 7.0.10 versions: - 7.0.9: - platformVersion: 52.4.1 - detailsURL: https://blog.torproject.org/tor-browser-709-released + 7.0.10: + platformVersion: 52.5.0 + detailsURL: https://blog.torproject.org/tor-browser-7010-released incremental_from: - - 7.0.7 - 7.0.8 + - 7.0.9 migrate_archs: osx32: osx64 migrate_langs:

1 0

[torbutton/maint-1.9.7] Translations update
by gk＠torproject.org 08 Nov '17

08 Nov '17

commit cc60e20b3f71b99908883db5cdd1eefa2a64beb5 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Nov 8 08:15:30 2017 +0000 Translations update --- src/chrome/locale/nl/aboutTBUpdate.dtd | 8 ++++---- src/chrome/locale/pt-BR/aboutTor.properties | 4 ++-- src/chrome/locale/zh-CN/torbutton.dtd | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/src/chrome/locale/nl/aboutTBUpdate.dtd b/src/chrome/locale/nl/aboutTBUpdate.dtd index e773a68..3fc2ec2 100644 --- a/src/chrome/locale/nl/aboutTBUpdate.dtd +++ b/src/chrome/locale/nl/aboutTBUpdate.dtd @@ -1,6 +1,6 @@ -<!ENTITY aboutTBUpdate.title "Tor-browserupdate"> -<!ENTITY aboutTBUpdate.updated "Tor-browser is bijgewerkt."> -<!ENTITY aboutTBUpdate.linkPrefix "Bezoek voor meer info over deze uitgave"> -<!ENTITY aboutTBUpdate.linkLabel "onze website"> +<!ENTITY aboutTBUpdate.title "Tor Browser Update"> +<!ENTITY aboutTBUpdate.updated "Tor Browser is bijgewerkt."> +<!ENTITY aboutTBUpdate.linkPrefix "Voor de meest recentste informatie over deze release,"> +<!ENTITY aboutTBUpdate.linkLabel "bezoek onze website"> <!ENTITY aboutTBUpdate.linkSuffix "."> <!ENTITY aboutTBUpdate.changeLogHeading "Wijzigingslogboek:"> diff --git a/src/chrome/locale/pt-BR/aboutTor.properties b/src/chrome/locale/pt-BR/aboutTor.properties index ca749aa..44b7303 100644 --- a/src/chrome/locale/pt-BR/aboutTor.properties +++ b/src/chrome/locale/pt-BR/aboutTor.properties @@ -10,8 +10,8 @@ aboutTor.searchDDG.search.link=https://duckduckgo.com/ aboutTor.donationBanner.donate=Faça uma Doação Agora! -aboutTor.donationBanner.slogan=Tor: Desligando a Resistência Digital -aboutTor.donationBanner.mozilla=Faça uma doação hoje e a Mozilla vai doará em dobro! +aboutTor.donationBanner.slogan=Tor: Fortalecendo a Resistência Digital +aboutTor.donationBanner.mozilla=Faça uma doação hoje e a Mozilla doará em dobro! aboutTor.donationBanner.tagline1=Protegendo Jornalistas, Whistleblowers e Ativistas desde 2006 aboutTor.donationBanner.tagline2=Construindo Redes de Liberdade no Mundo Todo diff --git a/src/chrome/locale/zh-CN/torbutton.dtd b/src/chrome/locale/zh-CN/torbutton.dtd index 16bbfda..c02f2c4 100644 --- a/src/chrome/locale/zh-CN/torbutton.dtd +++ b/src/chrome/locale/zh-CN/torbutton.dtd @@ -41,7 +41,7 @@ <!ENTITY torbutton.prefs.sec_html5_desc "HTML5 视频和音频需通过 NoScript 点击播放。"> <!ENTITY torbutton.prefs.sec_html5_tooltip "在某些网站，可通过 NoScript 工具栏按钮播放这些媒体。"> <!ENTITY torbutton.prefs.sec_some_jit_desc "禁用某些 JavaScript 性能优化。"> -<!ENTITY torbutton.prefs.sec_jit_desc_tooltip "ION JIT，原生正则表达式。"> +<!ENTITY torbutton.prefs.sec_jit_desc_tooltip "ION JIT，原版RegExp。"> <!ENTITY torbutton.prefs.sec_baseline_jit_desc_tooltip "Baseline JIT。"> <!ENTITY torbutton.prefs.sec_jit_slower_desc "一些网站脚本可能会缓执行。"> <!ENTITY torbutton.prefs.sec_mathml_desc "禁用数学方程式的某些显示机制。">

1 0

[torbutton/maint-1.9.7] Release preparations for 1.9.7.10
by gk＠torproject.org 08 Nov '17

08 Nov '17

commit 308b94d568d0d63e68a616ea321eb741b152ceea Author: Georg Koppen <gk(a)torproject.org> Date: Wed Nov 8 08:17:45 2017 +0000 Release preparations for 1.9.7.10 Version bump and CHANGELOG update --- src/CHANGELOG | 4 ++++ src/install.rdf | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/src/CHANGELOG b/src/CHANGELOG index 58800ee..8973359 100644 --- a/src/CHANGELOG +++ b/src/CHANGELOG @@ -1,3 +1,7 @@ +1.9.7.10 + * Bug 23997: Add link to Tor Browser manual for de, nl, tr, vi + * Translations update + 1.9.7.9 * Bug 23949: Fix donation banner display * Update locales with translated banner diff --git a/src/install.rdf b/src/install.rdf index 763b30d..3101291 100644 --- a/src/install.rdf +++ b/src/install.rdf @@ -6,7 +6,7 @@ <em:name>Torbutton</em:name> <em:creator>Mike Perry</em:creator> <em:id>torbutton(a)torproject.org</em:id> - <em:version>1.9.7.9</em:version> + <em:version>1.9.7.10</em:version> <em:multiprocessCompatible>true</em:multiprocessCompatible> <em:homepageURL>https://www.torproject.org/projects/torbrowser.html.en</em:homepageURL> <em:optionsURL>chrome://torbutton/content/preferences.xul</em:optionsURL>

1 0

[torbutton/master] Translations update
by gk＠torproject.org 08 Nov '17

08 Nov '17

commit 6c2eaa410c7897d1bcbbe9039c82c39880b3f6c9 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Nov 8 08:15:30 2017 +0000 Translations update --- src/chrome/locale/nl/aboutTBUpdate.dtd | 8 ++++---- src/chrome/locale/pt-BR/aboutTor.properties | 4 ++-- src/chrome/locale/zh-CN/torbutton.dtd | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/src/chrome/locale/nl/aboutTBUpdate.dtd b/src/chrome/locale/nl/aboutTBUpdate.dtd index e773a68..3fc2ec2 100644 --- a/src/chrome/locale/nl/aboutTBUpdate.dtd +++ b/src/chrome/locale/nl/aboutTBUpdate.dtd @@ -1,6 +1,6 @@ -<!ENTITY aboutTBUpdate.title "Tor-browserupdate"> -<!ENTITY aboutTBUpdate.updated "Tor-browser is bijgewerkt."> -<!ENTITY aboutTBUpdate.linkPrefix "Bezoek voor meer info over deze uitgave"> -<!ENTITY aboutTBUpdate.linkLabel "onze website"> +<!ENTITY aboutTBUpdate.title "Tor Browser Update"> +<!ENTITY aboutTBUpdate.updated "Tor Browser is bijgewerkt."> +<!ENTITY aboutTBUpdate.linkPrefix "Voor de meest recentste informatie over deze release,"> +<!ENTITY aboutTBUpdate.linkLabel "bezoek onze website"> <!ENTITY aboutTBUpdate.linkSuffix "."> <!ENTITY aboutTBUpdate.changeLogHeading "Wijzigingslogboek:"> diff --git a/src/chrome/locale/pt-BR/aboutTor.properties b/src/chrome/locale/pt-BR/aboutTor.properties index ca749aa..44b7303 100644 --- a/src/chrome/locale/pt-BR/aboutTor.properties +++ b/src/chrome/locale/pt-BR/aboutTor.properties @@ -10,8 +10,8 @@ aboutTor.searchDDG.search.link=https://duckduckgo.com/ aboutTor.donationBanner.donate=Faça uma Doação Agora! -aboutTor.donationBanner.slogan=Tor: Desligando a Resistência Digital -aboutTor.donationBanner.mozilla=Faça uma doação hoje e a Mozilla vai doará em dobro! +aboutTor.donationBanner.slogan=Tor: Fortalecendo a Resistência Digital +aboutTor.donationBanner.mozilla=Faça uma doação hoje e a Mozilla doará em dobro! aboutTor.donationBanner.tagline1=Protegendo Jornalistas, Whistleblowers e Ativistas desde 2006 aboutTor.donationBanner.tagline2=Construindo Redes de Liberdade no Mundo Todo diff --git a/src/chrome/locale/zh-CN/torbutton.dtd b/src/chrome/locale/zh-CN/torbutton.dtd index 16bbfda..c02f2c4 100644 --- a/src/chrome/locale/zh-CN/torbutton.dtd +++ b/src/chrome/locale/zh-CN/torbutton.dtd @@ -41,7 +41,7 @@ <!ENTITY torbutton.prefs.sec_html5_desc "HTML5 视频和音频需通过 NoScript 点击播放。"> <!ENTITY torbutton.prefs.sec_html5_tooltip "在某些网站，可通过 NoScript 工具栏按钮播放这些媒体。"> <!ENTITY torbutton.prefs.sec_some_jit_desc "禁用某些 JavaScript 性能优化。"> -<!ENTITY torbutton.prefs.sec_jit_desc_tooltip "ION JIT，原生正则表达式。"> +<!ENTITY torbutton.prefs.sec_jit_desc_tooltip "ION JIT，原版RegExp。"> <!ENTITY torbutton.prefs.sec_baseline_jit_desc_tooltip "Baseline JIT。"> <!ENTITY torbutton.prefs.sec_jit_slower_desc "一些网站脚本可能会缓执行。"> <!ENTITY torbutton.prefs.sec_mathml_desc "禁用数学方程式的某些显示机制。">

1 0

[tor-browser-bundle/maint-7.0] Revert "Apply patch for bug 24052"
by gk＠torproject.org 08 Nov '17

08 Nov '17

commit 35f17a0074dd9f0ef3af6079b10300468c2ba8e2 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Nov 8 07:47:14 2017 +0000 Revert "Apply patch for bug 24052" This reverts commit f1366de5a2a67dc5fda27718135ee2cff28c344d. We ship the patch as usual in the respective tor-browser branch. --- gitian/descriptors/linux/gitian-firefox.yml | 2 - gitian/descriptors/mac/gitian-firefox.yml | 2 - gitian/patches/24052.patch | 57 ----------------------------- 3 files changed, 61 deletions(-) diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index 766bf99..1ff66a2 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -36,7 +36,6 @@ files: - "re-dzip.sh" - "dzip.sh" - "versions" -- "24052.patch" script: | source versions INSTDIR="$HOME/install" @@ -89,7 +88,6 @@ script: | mkdir -p $INSTDIR/Debug/Browser/ cd tor-browser - patch -p1 < ../24052.patch # run get-moz-build-date before removing .git, which is used to get the year chmod +x ~/build/get-moz-build-date eval $(~/build/get-moz-build-date $(cat browser/config/version.txt)) diff --git a/gitian/descriptors/mac/gitian-firefox.yml b/gitian/descriptors/mac/gitian-firefox.yml index f47afc8..73c46bf 100644 --- a/gitian/descriptors/mac/gitian-firefox.yml +++ b/gitian/descriptors/mac/gitian-firefox.yml @@ -24,7 +24,6 @@ files: - "dzip.sh" - "fix-info-plist.py" - "versions" -- "24052.patch" script: | INSTDIR="$HOME/install/" source versions @@ -37,7 +36,6 @@ script: | mkdir -p $OUTDIR/ cd tor-browser - patch -p1 < ../24052.patch # Extracting all the necessary tools tar xaf ../MacOSX10.7.sdk.tar.gz tar xaf ../cctools.tar.gz diff --git a/gitian/patches/24052.patch b/gitian/patches/24052.patch deleted file mode 100644 index a418a97..0000000 --- a/gitian/patches/24052.patch +++ /dev/null @@ -1,57 +0,0 @@ -From c5d1bb91512f9dd20e0f54c6f3e6979588cf9f56 Mon Sep 17 00:00:00 2001 -From: Georg Koppen <gk(a)torproject.org> -Date: Fri, 27 Oct 2017 20:40:57 +0000 -Subject: [PATCH] Bug 24052: Streamline handling of file:// resources - -We should make sure restrictions regarding loading of file:// resources -are adhered to more strictly, at least on *nix platforms. - -This is a workaround for -https://bugzilla.mozilla.org/show_bug.cgi?id=1412081. - -diff --git a/netwerk/base/nsIOService.cpp b/netwerk/base/nsIOService.cpp -index 0da79c18ae41..0cc67da7b18f 100644 ---- a/netwerk/base/nsIOService.cpp -+++ b/netwerk/base/nsIOService.cpp -@@ -789,12 +789,20 @@ nsIOService::NewChannelFromURIWithProxyFlagsInternal(nsIURI* aURI, - // if calling newChannel2() fails we try to fall back to - // creating a new channel by calling NewChannel(). - if (NS_FAILED(rv)) { -+#ifdef XP_UNIX -+ if (rv == NS_ERROR_FILE_TARGET_DOES_NOT_EXIST) { -+ return rv; -+ } else { -+#endif - rv = handler->NewChannel(aURI, getter_AddRefs(channel)); - NS_ENSURE_SUCCESS(rv, rv); - // The protocol handler does not implement NewChannel2, so - // maybe we need to wrap the channel (see comment in MaybeWrap - // function). - channel = nsSecCheckWrapChannel::MaybeWrap(channel, aLoadInfo); -+#ifdef XP_UNIX -+ } -+#endif - } - } - -diff --git a/netwerk/protocol/file/nsFileProtocolHandler.cpp b/netwerk/protocol/file/nsFileProtocolHandler.cpp -index e55cb9d47460..c24c928b6f02 100644 ---- a/netwerk/protocol/file/nsFileProtocolHandler.cpp -+++ b/netwerk/protocol/file/nsFileProtocolHandler.cpp -@@ -188,6 +188,13 @@ nsFileProtocolHandler::NewChannel2(nsIURI* uri, - nsILoadInfo* aLoadInfo, - nsIChannel** result) - { -+#ifdef XP_UNIX -+ if (aLoadInfo && aLoadInfo->TriggeringPrincipal()) { -+ if (aLoadInfo->TriggeringPrincipal()->GetIsCodebasePrincipal()) { -+ return NS_ERROR_FILE_TARGET_DOES_NOT_EXIST; -+ } -+ } -+#endif - nsFileChannel *chan = new nsFileChannel(uri); - if (!chan) - return NS_ERROR_OUT_OF_MEMORY; --- -2.14.2 -

1 0

[tor-browser-bundle/maint-7.0] Revert "Apply follow-up patch for bug 24052"
by gk＠torproject.org 08 Nov '17

08 Nov '17

commit 15c4213ddbfdfe9459291436ba4e4f8cb326e977 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Nov 8 07:46:32 2017 +0000 Revert "Apply follow-up patch for bug 24052" This reverts commit a5388a804d47d7d4fb157beb351ebef9897e8a2b. We ship the patch as usual in the respective tor-browser branch. --- gitian/descriptors/linux/gitian-firefox.yml | 2 -- gitian/descriptors/mac/gitian-firefox.yml | 2 -- gitian/patches/24052_2.patch | 29 ----------------------------- 3 files changed, 33 deletions(-) diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index 967a981..766bf99 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -37,7 +37,6 @@ files: - "dzip.sh" - "versions" - "24052.patch" -- "24052_2.patch" script: | source versions INSTDIR="$HOME/install" @@ -91,7 +90,6 @@ script: | cd tor-browser patch -p1 < ../24052.patch - patch -p1 < ../24052_2.patch # run get-moz-build-date before removing .git, which is used to get the year chmod +x ~/build/get-moz-build-date eval $(~/build/get-moz-build-date $(cat browser/config/version.txt)) diff --git a/gitian/descriptors/mac/gitian-firefox.yml b/gitian/descriptors/mac/gitian-firefox.yml index a38fc0b..f47afc8 100644 --- a/gitian/descriptors/mac/gitian-firefox.yml +++ b/gitian/descriptors/mac/gitian-firefox.yml @@ -25,7 +25,6 @@ files: - "fix-info-plist.py" - "versions" - "24052.patch" -- "24052_2.patch" script: | INSTDIR="$HOME/install/" source versions @@ -39,7 +38,6 @@ script: | cd tor-browser patch -p1 < ../24052.patch - patch -p1 < ../24052_2.patch # Extracting all the necessary tools tar xaf ../MacOSX10.7.sdk.tar.gz tar xaf ../cctools.tar.gz diff --git a/gitian/patches/24052_2.patch b/gitian/patches/24052_2.patch deleted file mode 100644 index 0060428..0000000 --- a/gitian/patches/24052_2.patch +++ /dev/null @@ -1,29 +0,0 @@ -From e2c1240ad25f4edcc7d3828b29f6aeb953a24a2e Mon Sep 17 00:00:00 2001 -From: Arthur Edelstein <arthuredelstein(a)gmail.com> -Date: Wed, 1 Nov 2017 02:33:18 -0700 -Subject: [PATCH] Bug 24052: Handle redirects by blocking them early - -This is the second part of the workaround for -https://bugzilla.mozilla.org/show_bug.cgi?id=1412081. - -diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp -index 0e570e8cb57d..b38be48bf0c9 100644 ---- a/netwerk/protocol/http/nsHttpChannel.cpp -+++ b/netwerk/protocol/http/nsHttpChannel.cpp -@@ -5419,6 +5419,13 @@ nsHttpChannel::AsyncProcessRedirection(uint32_t redirectType) - return NS_ERROR_CORRUPTED_CONTENT; - } - -+ bool isRedirectToFile = false; -+ rv = mRedirectURI->SchemeIs("file", &isRedirectToFile); -+ if (!NS_FAILED(rv) && isRedirectToFile) { -+ LOG(("Attempted to redirect from a remote page to a file:// URI.")); -+ return NS_ERROR_FAILURE; -+ } -+ - if (mApplicationCache) { - // if we are redirected to a different origin check if there is a fallback - // cache entry to fall back to. we don't care about file strict --- -2.14.2 -

1 0

[tor-browser-bundle/maint-7.0] Bug 23396: Updating the msvcr100.dll we ship
by gk＠torproject.org 08 Nov '17

08 Nov '17

commit 50545b66c03d4fc8fb54b48ee6a34287516d43b7 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Nov 8 07:43:51 2017 +0000 Bug 23396: Updating the msvcr100.dll we ship We update the location to get the .dll as well, taking Mike out of the browser loop. --- gitian/fetch-inputs.sh | 4 ++-- gitian/versions | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/gitian/fetch-inputs.sh b/gitian/fetch-inputs.sh index 971cd23..6bd5c13 100755 --- a/gitian/fetch-inputs.sh +++ b/gitian/fetch-inputs.sh @@ -132,14 +132,14 @@ do fi done -for i in OSXSDK MSVCR100 +for i in OSXSDK do PACKAGE="${i}_PACKAGE" URL="${MIRROR_URL}${!PACKAGE}" get "${!PACKAGE}" "${MIRROR_URL}${!PACKAGE}" done -for i in CCTOOLS +for i in CCTOOLS MSVCR100 do PACKAGE="${i}_PACKAGE" URL="${MIRROR_URL_GK}${!PACKAGE}" diff --git a/gitian/versions b/gitian/versions index cc09cb0..f0c1726 100755 --- a/gitian/versions +++ b/gitian/versions @@ -104,7 +104,7 @@ GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf NOSCRIPT_HASH=82687646b9ecc39d478ac5d4de035b32fdf88efc6faceec3e74b49c863bbfabb CCTOOLS_HASH=e908fdebc2886ee5491ebfc7e7950af451b3c4e2439c2d7a923ed06ad05113e4 -MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 +MSVCR100_HASH=8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c ARGPARSE_HASH=ddaf4b0a618335a32b6664d4ae038a1de8fbada3b25033f9021510ed2b3941a4 PYYAML_HASH=c36c938a872e5ff494938b33b14aaa156cb439ec67548fcab3535bb78b0846e8

1 0

[tor-browser/tor-browser-52.4.1esr-7.0-1] Bug 1365047 Turn on the Windows DLL Blocklist in MinGW r=aklotz
by gk＠torproject.org 08 Nov '17

08 Nov '17

commit 979accc19fb297b0e73c515924d5dfe5c8236be4 Author: Tom Ritter <tom(a)mozilla.com> Date: Mon May 15 15:49:20 2017 -0500 Bug 1365047 Turn on the Windows DLL Blocklist in MinGW r=aklotz MozReview-Commit-ID: 3hF7iOdH89P --HG-- extra : rebase_source : 95614960544ae55b983dbbd40e1036ff236204b3 --- mozglue/build/WindowsDllBlocklist.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mozglue/build/WindowsDllBlocklist.h b/mozglue/build/WindowsDllBlocklist.h index 5afe6b8ceee8..82d4a365351f 100644 --- a/mozglue/build/WindowsDllBlocklist.h +++ b/mozglue/build/WindowsDllBlocklist.h @@ -6,7 +6,7 @@ #ifndef mozilla_windowsdllblocklist_h #define mozilla_windowsdllblocklist_h -#if defined(_MSC_VER) && (defined(_M_IX86) || defined(_M_X64)) +#if (defined(_MSC_VER) || defined(__MINGW32__)) && (defined(_M_IX86) || defined(_M_X64)) #include <windows.h> #include "mozilla/GuardObjects.h"

1 0

[tor-browser/tor-browser-52.4.1esr-7.0-1] Bug 24052: Handle redirects by blocking them early
by gk＠torproject.org 08 Nov '17

08 Nov '17

commit e2c1240ad25f4edcc7d3828b29f6aeb953a24a2e Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Wed Nov 1 02:33:18 2017 -0700 Bug 24052: Handle redirects by blocking them early This is the second part of the workaround for https://bugzilla.mozilla.org/show_bug.cgi?id=1412081. --- netwerk/protocol/http/nsHttpChannel.cpp | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp index 0e570e8cb57d..b38be48bf0c9 100644 --- a/netwerk/protocol/http/nsHttpChannel.cpp +++ b/netwerk/protocol/http/nsHttpChannel.cpp @@ -5419,6 +5419,13 @@ nsHttpChannel::AsyncProcessRedirection(uint32_t redirectType) return NS_ERROR_CORRUPTED_CONTENT; } + bool isRedirectToFile = false; + rv = mRedirectURI->SchemeIs("file", &isRedirectToFile); + if (!NS_FAILED(rv) && isRedirectToFile) { + LOG(("Attempted to redirect from a remote page to a file:// URI.")); + return NS_ERROR_FAILURE; + } + if (mApplicationCache) { // if we are redirected to a different origin check if there is a fallback // cache entry to fall back to. we don't care about file strict

1 0

[tor-browser/tor-browser-52.4.1esr-7.0-1] Bug 24052: Streamline handling of file:// resources
by gk＠torproject.org 08 Nov '17

08 Nov '17

commit c5d1bb91512f9dd20e0f54c6f3e6979588cf9f56 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Oct 27 20:40:57 2017 +0000 Bug 24052: Streamline handling of file:// resources We should make sure restrictions regarding loading of file:// resources are adhered to more strictly, at least on *nix platforms. This is a workaround for https://bugzilla.mozilla.org/show_bug.cgi?id=1412081. --- netwerk/base/nsIOService.cpp | 8 ++++++++ netwerk/protocol/file/nsFileProtocolHandler.cpp | 7 +++++++ 2 files changed, 15 insertions(+) diff --git a/netwerk/base/nsIOService.cpp b/netwerk/base/nsIOService.cpp index 0da79c18ae41..0cc67da7b18f 100644 --- a/netwerk/base/nsIOService.cpp +++ b/netwerk/base/nsIOService.cpp @@ -789,12 +789,20 @@ nsIOService::NewChannelFromURIWithProxyFlagsInternal(nsIURI* aURI, // if calling newChannel2() fails we try to fall back to // creating a new channel by calling NewChannel(). if (NS_FAILED(rv)) { +#ifdef XP_UNIX + if (rv == NS_ERROR_FILE_TARGET_DOES_NOT_EXIST) { + return rv; + } else { +#endif rv = handler->NewChannel(aURI, getter_AddRefs(channel)); NS_ENSURE_SUCCESS(rv, rv); // The protocol handler does not implement NewChannel2, so // maybe we need to wrap the channel (see comment in MaybeWrap // function). channel = nsSecCheckWrapChannel::MaybeWrap(channel, aLoadInfo); +#ifdef XP_UNIX + } +#endif } } diff --git a/netwerk/protocol/file/nsFileProtocolHandler.cpp b/netwerk/protocol/file/nsFileProtocolHandler.cpp index e55cb9d47460..c24c928b6f02 100644 --- a/netwerk/protocol/file/nsFileProtocolHandler.cpp +++ b/netwerk/protocol/file/nsFileProtocolHandler.cpp @@ -188,6 +188,13 @@ nsFileProtocolHandler::NewChannel2(nsIURI* uri, nsILoadInfo* aLoadInfo, nsIChannel** result) { +#ifdef XP_UNIX + if (aLoadInfo && aLoadInfo->TriggeringPrincipal()) { + if (aLoadInfo->TriggeringPrincipal()->GetIsCodebasePrincipal()) { + return NS_ERROR_FILE_TARGET_DOES_NOT_EXIST; + } + } +#endif nsFileChannel *chan = new nsFileChannel(uri); if (!chan) return NS_ERROR_OUT_OF_MEMORY;

1 0

[tor-browser-build/master] Bug 24156: remove dash in build_log when var/osname is not defined
by gk＠torproject.org 06 Nov '17

06 Nov '17

commit 072d3ab7f61733a071ca13a66bdb1fe1922e1e41 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Nov 6 18:44:41 2017 +0100 Bug 24156: remove dash in build_log when var/osname is not defined In projects/debootstrap-image, the option var/osname is not defined, so the build_log filename was logs/debootstrap-image-.log. --- rbm.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rbm.conf b/rbm.conf index 6e800f2..83c2086 100644 --- a/rbm.conf +++ b/rbm.conf @@ -3,7 +3,7 @@ debug: '[% GET ! ENV.RBM_NO_DEBUG %]' compress_tar: gz output_dir: "out/[% project %]" tmp_dir: '[% c("basedir") %]/tmp' -build_log: '[% GET ENV.RBM_LOGS_DIR ? ENV.RBM_LOGS_DIR : "logs" %]/[% project %]-[% c("var/osname") %].log' +build_log: '[% GET ENV.RBM_LOGS_DIR ? ENV.RBM_LOGS_DIR : "logs" %]/[% project %][% IF c("var/osname") %]-[% c("var/osname") %][% END %].log' pkg_type: build

1 0

[torbutton/maint-1.9.7] Bug 23997: Add link to Tor Browser manual for de, nl, tr, vi
by gk＠torproject.org 06 Nov '17

06 Nov '17

commit 40f35d5b280cf694d2a6cb3ade734511eed5593e Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Thu Oct 26 22:04:43 2017 -0700 Bug 23997: Add link to Tor Browser manual for de, nl, tr, vi --- src/chrome/content/torbutton.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index 9e18adb..4fa2fb9 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -2357,7 +2357,7 @@ function torbutton_update_noscript_button() // Returns true if we should show the tor browser manual. function torbutton_show_torbrowser_manual() { - let availableLocales = ["en", "es", "fr", "pt", "zh"]; + let availableLocales = ["de", "en", "es", "fr", "nl", "pt", "tr", "vi", "zh"]; let shortLocale = torbutton_get_general_useragent_locale().substring(0, 2); return availableLocales.indexOf(shortLocale) >= 0; }

1 0

[torbutton/master] Bug 23997: Add link to Tor Browser manual for de, nl, tr, vi
by gk＠torproject.org 06 Nov '17

06 Nov '17

commit 87e57187a18290b7f7bc02eefde8d9ba369f18f7 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Thu Oct 26 22:04:43 2017 -0700 Bug 23997: Add link to Tor Browser manual for de, nl, tr, vi --- src/chrome/content/torbutton.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index 9e18adb..4fa2fb9 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -2357,7 +2357,7 @@ function torbutton_update_noscript_button() // Returns true if we should show the tor browser manual. function torbutton_show_torbrowser_manual() { - let availableLocales = ["en", "es", "fr", "pt", "zh"]; + let availableLocales = ["de", "en", "es", "fr", "nl", "pt", "tr", "vi", "zh"]; let shortLocale = torbutton_get_general_useragent_locale().substring(0, 2); return availableLocales.indexOf(shortLocale) >= 0; }

1 0

[tor-browser-build/master] Bug 23456: build go for Windows 64
by gk＠torproject.org 06 Nov '17

06 Nov '17

commit 83407b9eee94991a7c8c13dbcaf35693f0e7c9e9 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Sep 11 17:03:01 2017 +0200 Bug 23456: build go for Windows 64 --- projects/go/build | 4 ++-- projects/go/config | 7 ++++++- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/projects/go/build b/projects/go/build index 3b51c32..5ab4c0c 100644 --- a/projects/go/build +++ b/projects/go/build @@ -64,11 +64,11 @@ cd /var/tmp/dist/go/src # https://github.com/golang/go/issues/15457 CC_FOR_TARGET="$(pwd)/cc-for-target" echo "#!/bin/sh" > "$CC_FOR_TARGET" - echo "exec i686-w64-mingw32-gcc [% c("var/CFLAGS") %] [% c("var/LDFLAGS") %] \"\$@\"" >> "$CC_FOR_TARGET" + echo "exec [% c("arch") %]-w64-mingw32-gcc [% c("var/CFLAGS") %] [% c("var/LDFLAGS") %] \"\$@\"" >> "$CC_FOR_TARGET" chmod +x "$CC_FOR_TARGET" # http://golang.org/doc/install/source#environment export GOOS=windows - export GOARCH=386 + export GOARCH=[% c("var/GOARCH") %] CGO_ENABLED=1 CC_FOR_TARGET="$CC_FOR_TARGET" CC= CFLAGS= LDFLAGS= ./make.bash [% END -%] diff --git a/projects/go/config b/projects/go/config index 21669c9..2a3b1ad 100644 --- a/projects/go/config +++ b/projects/go/config @@ -52,10 +52,15 @@ var: }) %] targets: - windows-i686: + windows: var: GOOS: windows + windows-i686: + var: GOARCH: 386 + windows-x86_64: + var: + GOARCH: amd64 osx-x86_64: var: GOOS: darwin

1 0

[tor-browser-build/master] Bug 10026: add support for building Tor for Windows 64
by gk＠torproject.org 06 Nov '17

06 Nov '17

commit 0292709b91ac032e7c6e69e39fc2aa760e4708ed Author: Nicolas Vigier <boklm(a)torproject.org> Date: Sat Aug 12 23:33:31 2017 +0200 Bug 10026: add support for building Tor for Windows 64 Fix the build of openssl and zlib for Windows 64. --- projects/openssl/config | 4 ++-- projects/tor/config | 2 +- projects/zlib/build | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/projects/openssl/config b/projects/openssl/config index dca3a1c..8c6ccbf 100644 --- a/projects/openssl/config +++ b/projects/openssl/config @@ -13,9 +13,9 @@ targets: linux-i686: var: configure_opts: -shared linux-generic32 - windows-i686: + windows: var: - configure_opts: '-shared --cross-compile-prefix=i686-w64-mingw32- mingw "-fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$gcclibs"' + configure_opts: '-shared --cross-compile-prefix=[% c("arch") %]-w64-mingw32- mingw[% IF c("var/windows-x86_64") %]64[% END %] "-fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$gcclibs"' osx-x86_64: var: configure_opts: --cross-compile-prefix=x86_64-apple-darwin10- darwin64-x86_64-cc enable-ec_nistp_64_gcc_128 diff --git a/projects/tor/config b/projects/tor/config index b5df573..af829cd 100644 --- a/projects/tor/config +++ b/projects/tor/config @@ -37,7 +37,7 @@ targets: var: arch_deps: - faketime - windows-i686: + windows: var: arch_deps: - faketime diff --git a/projects/zlib/build b/projects/zlib/build index 4031ef5..4cb384b 100644 --- a/projects/zlib/build +++ b/projects/zlib/build @@ -7,8 +7,8 @@ tar -C /var/tmp/build -xf [% project %]-[% c('version') %].tar.gz cd /var/tmp/build/[% project %]-[% c('version') %] export CFLAGS="[% c("var/CFLAGS") %]" export LDFLAGS="[% c("var/LDFLAGS") %]" -make BINARY_PATH=$distdir/lib INCLUDE_PATH=$distdir/include LIBRARY_PATH=$distdir/lib -f win32/Makefile.gcc PREFIX=i686-w64-mingw32- -j4 SHARED_MODE=1 LOC="-fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$gcclibs" -make BINARY_PATH=$distdir/lib INCLUDE_PATH=$distdir/include LIBRARY_PATH=$distdir/lib -f win32/Makefile.gcc PREFIX=i686-w64-mingw32- -j4 SHARED_MODE=1 LOC="-fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$gcclibs" install +make BINARY_PATH=$distdir/lib INCLUDE_PATH=$distdir/include LIBRARY_PATH=$distdir/lib -f win32/Makefile.gcc PREFIX=[% c("arch") %]-w64-mingw32- -j4 SHARED_MODE=1 LOC="-fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$gcclibs" +make BINARY_PATH=$distdir/lib INCLUDE_PATH=$distdir/include LIBRARY_PATH=$distdir/lib -f win32/Makefile.gcc PREFIX=[% c("arch") %]-w64-mingw32- -j4 SHARED_MODE=1 LOC="-fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$gcclibs" install cd /var/tmp/dist [% c('tar', {

1 0

[tor-browser-build/master] Bug 23228: add support for building mingw-w64 for Windows 64
by gk＠torproject.org 06 Nov '17

06 Nov '17

commit b82d82d9cf9cb751e088085fb1093026b20a0e4d Author: Nicolas Vigier <boklm(a)torproject.org> Date: Sat Aug 12 22:50:58 2017 +0200 Bug 23228: add support for building mingw-w64 for Windows 64 Add torbrowser-windows-x86_64 support to rbm.conf. Update mingw-w64 to use the x86_64-w64-mingw32 target (instead of i686-w64-mingw32) for torbrowser-windows-x86_64 builds. --- projects/binutils/64bit-fixups.patch | 55 +++++++++++++++++++++++++++++++++ projects/binutils/build | 7 +++-- projects/binutils/config | 6 ++-- projects/mingw-w64/build | 32 +++++++++++++------ projects/mingw-w64/config | 15 ++++++--- projects/mingw-w64/i686-w64-mingw32-g++ | 4 --- projects/mingw-w64/i686-w64-mingw32-gcc | 4 --- projects/mingw-w64/i686-w64-mingw32-ld | 4 --- rbm.conf | 33 ++++++++++++++------ 9 files changed, 122 insertions(+), 38 deletions(-) diff --git a/projects/binutils/64bit-fixups.patch b/projects/binutils/64bit-fixups.patch new file mode 100644 index 0000000..33c0297 --- /dev/null +++ b/projects/binutils/64bit-fixups.patch @@ -0,0 +1,55 @@ +From f3ba95e14437f10de8b8f296930ff2a8495d18c6 Mon Sep 17 00:00:00 2001 +From: Georg Koppen <gk(a)torproject.org> +Date: Tue, 12 Sep 2017 07:21:16 +0000 +Subject: [PATCH] 64bit fixups + + +diff --git a/ld/emultempl/pep.em b/ld/emultempl/pep.em +index b566903b14..27006bdf79 100644 +--- a/ld/emultempl/pep.em ++++ b/ld/emultempl/pep.em +@@ -730,7 +730,7 @@ gld${EMULATION_NAME}_handle_option (int optc) + pep_dll_exclude_all_symbols = 1; + break; + case OPTION_ENABLE_RELOC_SECTION: +- pe_dll_enable_reloc_section = 1; ++ pep_dll_enable_reloc_section = 1; + break; + case OPTION_EXCLUDE_LIBS: + pep_dll_add_excludes (optarg, EXCLUDELIBS); +@@ -1623,7 +1623,7 @@ gld_${EMULATION_NAME}_finish (void) + + #ifdef DLL_SUPPORT + if (link_info.shared +- || (!link_info.relocatable && pe_dll_enable_reloc_section) ++ || (!link_info.relocatable && pep_dll_enable_reloc_section) + || (!link_info.relocatable && pep_def_file->num_exports != 0)) + { + pep_dll_fill_sections (link_info.output_bfd, &link_info); +diff --git a/ld/pep-dll.c b/ld/pep-dll.c +index 0e5e8b1523..b5f99b90e0 100644 +--- a/ld/pep-dll.c ++++ b/ld/pep-dll.c +@@ -31,6 +31,7 @@ + #define pe_dll_export_everything pep_dll_export_everything + #define pe_dll_exclude_all_symbols pep_dll_exclude_all_symbols + #define pe_dll_do_default_excludes pep_dll_do_default_excludes ++#define pe_dll_enable_reloc_section pep_dll_enable_reloc_section + #define pe_dll_kill_ats pep_dll_kill_ats + #define pe_dll_stdcall_aliases pep_dll_stdcall_aliases + #define pe_dll_warn_dup_exports pep_dll_warn_dup_exports +diff --git a/ld/pep-dll.h b/ld/pep-dll.h +index 1e7e3d65d4..c31e69cc8e 100644 +--- a/ld/pep-dll.h ++++ b/ld/pep-dll.h +@@ -31,6 +31,7 @@ extern def_file * pep_def_file; + extern int pep_dll_export_everything; + extern int pep_dll_exclude_all_symbols; + extern int pep_dll_do_default_excludes; ++extern int pep_dll_enable_reloc_section; + extern int pep_dll_kill_ats; + extern int pep_dll_stdcall_aliases; + extern int pep_dll_warn_dup_exports; +-- +2.14.1 + diff --git a/projects/binutils/build b/projects/binutils/build index a7d83d9..6d8e0b2 100644 --- a/projects/binutils/build +++ b/projects/binutils/build @@ -21,10 +21,13 @@ cd [% project %]-[% c("version") %] [% IF c('var/windows') -%] # XXX: This is needed due to bug 10102. sed 's/= extern_rt_rel_d;/= extern_rt_rel_d;\n memset (extern_rt_rel_d, 0, PE_IDATA5_SIZE);/' -i ld/pe-dll.c - # Needed for the hardening... - patch -p1 < ../enable-reloc-section-ld.patch # Zeroing timestamps in PE headers reliably, see bug 12753. patch -p1 < ../peXXigen.patch + # Needed for the hardening... + patch -p1 < ../enable-reloc-section-ld.patch +[% END -%] +[% IF c('var/windows-x86_64') -%] + patch -p1 < ../64bit-fixups.patch [% END -%] [% IF c("var/linux") -%] # We need to work around a gold linker bug in 2.24 to get selfrando working, diff --git a/projects/binutils/config b/projects/binutils/config index f272c76..25417c0 100644 --- a/projects/binutils/config +++ b/projects/binutils/config @@ -7,9 +7,9 @@ var: use_container: 1 targets: - windows-i686: + windows: var: - configure_opt: '--target=i686-w64-mingw32 --disable-multilib --enable-deterministic-archives' + configure_opt: '--target=[% c("arch") %]-w64-mingw32 --disable-multilib --enable-deterministic-archives' input_files: - URL: https://ftp.gnu.org/gnu/binutils/binutils-[% c("version") %].tar.bz2 @@ -19,6 +19,8 @@ input_files: - project: container-image - filename: enable-reloc-section-ld.patch enable: '[% c("var/windows") %]' + - filename: 64bit-fixups.patch + enable: '[% c("var/windows-x86_64") %]' - filename: peXXigen.patch enable: '[% c("var/windows") %]' - filename: binutils-224-gold.patch diff --git a/projects/mingw-w64/build b/projects/mingw-w64/build index 0fc4517..8d3e567 100644 --- a/projects/mingw-w64/build +++ b/projects/mingw-w64/build @@ -14,7 +14,7 @@ tar xf $rootdir/[% project %]-[% c("version") %].tar.gz mkdir -p builddir/mingw-w64/mingw-w64-headers32 cd builddir/mingw-w64/mingw-w64-headers32 /var/tmp/build/[% project %]-[% c("version") %]/mingw-w64-headers/configure \ - --prefix=$distdir/i686-w64-mingw32 --host=i686-w64-mingw32 \ + --prefix=$distdir/[% c("arch") %]-w64-mingw32 --host=[% c("arch") %]-w64-mingw32 \ --enable-sdk=all --enable-secure-api --enable-idl make install @@ -23,28 +23,28 @@ mkdir gcc cd gcc tar xjf $rootdir/gcc-[% c("var/gcc_version") %].tar.bz2 # We don't want to link against msvcrt.dll due to bug 9084. -i686-w64-mingw32-g++ -dumpspecs > $distdir/msvcr100.spec +[% c("arch") %]-w64-mingw32-g++ -dumpspecs > $distdir/msvcr100.spec sed 's/msvcrt/msvcr100/' -i $distdir/msvcr100.spec # Linking libgcc against msvcrt is hard-coded... sed 's/msvcrt/msvcr100/' -i gcc-[% c("var/gcc_version") %]/gcc/config/i386/t-mingw-w32 # LDFLAGS_FOR_TARGET does not work for some reason. Thus, we take # CFLAGS_FOR_TARGET. export CFLAGS_FOR_TARGET="-specs=$distdir/msvcr100.spec -Wl,--nxcompat -Wl,--dynamicbase" -gcc-[% c("var/gcc_version") %]/configure --prefix=$distdir --target=i686-w64-mingw32 --disable-multilib --enable-languages=c,c++ +gcc-[% c("var/gcc_version") %]/configure --prefix=$distdir --target=[% c("arch") %]-w64-mingw32 --disable-multilib --enable-languages=c,c++ make -j[% c("buildconf/num_procs") %] all-gcc make install-gcc mkdir -p /var/tmp/build/builddir/mingw-w64/mingw-w64-crt32 cd /var/tmp/build/builddir/mingw-w64/mingw-w64-crt32 /var/tmp/build/[% project %]-[% c("version") %]/mingw-w64-crt/configure \ - --host=i686-w64-mingw32 --prefix=$distdir/i686-w64-mingw32 + --host=[% c("arch") %]-w64-mingw32 --prefix=$distdir/[% c("arch") %]-w64-mingw32 make -j[% c("buildconf/num_procs") %] make install mkdir -p /var/tmp/build/builddir/mingw-w64/widl32 cd /var/tmp/build/builddir/mingw-w64/widl32 /var/tmp/build/[% project %]-[% c("version") %]/mingw-w64-tools/widl/configure \ - --prefix=$distdir --target=i686-w64-mingw32 + --prefix=$distdir --target=[% c("arch") %]-w64-mingw32 make -j[% c("buildconf/num_procs") %] make install @@ -52,12 +52,26 @@ cd /var/tmp/build/gcc make -j[% c("buildconf/num_procs") %] make install mkdir -p $distdir/gcclibs -cp i686-w64-mingw32/libssp/.libs/libssp-0.dll $distdir/gcclibs -cp i686-w64-mingw32/libgcc/shlib/libgcc_s_sjlj-1.dll $distdir/gcclibs +cp [% c("arch") %]-w64-mingw32/libssp/.libs/libssp-0.dll $distdir/gcclibs +cp [% c("arch") %]-w64-mingw32/libgcc/shlib/[% c("var/libgcc_dll") %] $distdir/gcclibs mkdir -p $distdir/helpers -mv $rootdir/i686-w64-mingw32-g++ $rootdir/i686-w64-mingw32-gcc \ - $rootdir/i686-w64-mingw32-ld $distdir/helpers/ + +cat > $distdir/helpers/[% c("arch") %]-w64-mingw32-g++ << 'EOF' +#!/bin/sh +/var/tmp/dist/mingw-w64/bin/[% c("arch") %]-w64-mingw32-g++ -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -fstack-protector --param ssp-buffer-size=4 -fno-strict-overflow "$@" +EOF + +cat > $distdir/helpers/[% c("arch") %]-w64-mingw32-gcc << 'EOF' +#!/bin/sh +/var/tmp/dist/mingw-w64/bin/[% c("arch") %]-w64-mingw32-gcc -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -fstack-protector --param ssp-buffer-size=4 -fno-strict-overflow "$@" +EOF + +cat > $distdir/helpers/[% c("arch") %]-w64-mingw32-ld << 'EOF' +#!/bin/sh +/var/tmp/dist/mingw-w64/bin/[% c("arch") %]-w64-mingw32-ld --dynamicbase --nxcompat --enable-reloc-section -lssp -L$gcclibs "$@" +EOF + chmod +x $distdir/helpers/* cd /var/tmp/dist diff --git a/projects/mingw-w64/config b/projects/mingw-w64/config index ac1caa9..bb66167 100644 --- a/projects/mingw-w64/config +++ b/projects/mingw-w64/config @@ -11,19 +11,26 @@ var: - automake - build-essential - libmpc-dev - - g++-mingw-w64-i686 setup: | [% c("var/setarch") -%] mkdir -p /var/tmp/dist tar -C /var/tmp/dist -xf [% c("compiler_tarfile") %] export PATH="/var/tmp/dist/mingw-w64/helpers:/var/tmp/dist/mingw-w64/bin:$PATH" export gcclibs=/var/tmp/dist/mingw-w64/gcclibs +targets: + windows-i686: + var: + libgcc_dll: libgcc_s_sjlj-1.dll + arch_deps: + - g++-mingw-w64-i686 + windows-x86_64: + var: + libgcc_dll: libgcc_s_seh-1.dll + arch_deps: + - g++-mingw-w64-x86-64 input_files: - project: container-image - URL: 'https://ftp.gnu.org/gnu/gcc/gcc-[% c("var/gcc_version") %]/gcc-[% c("var/gcc_version") %].tar.bz2' sha256sum: 608df76dec2d34de6558249d8af4cbee21eceddbcb580d666f7a5a583ca3303a - name: binutils project: binutils - - filename: i686-w64-mingw32-g++ - - filename: i686-w64-mingw32-gcc - - filename: i686-w64-mingw32-ld diff --git a/projects/mingw-w64/i686-w64-mingw32-g++ b/projects/mingw-w64/i686-w64-mingw32-g++ deleted file mode 100755 index c5421a2..0000000 --- a/projects/mingw-w64/i686-w64-mingw32-g++ +++ /dev/null @@ -1,4 +0,0 @@ -#!/bin/sh -# Hardened mingw gcc wrapper - -/var/tmp/dist/mingw-w64/bin/i686-w64-mingw32-g++ -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -fstack-protector --param ssp-buffer-size=4 -fno-strict-overflow "$@" diff --git a/projects/mingw-w64/i686-w64-mingw32-gcc b/projects/mingw-w64/i686-w64-mingw32-gcc deleted file mode 100755 index 741ef8a..0000000 --- a/projects/mingw-w64/i686-w64-mingw32-gcc +++ /dev/null @@ -1,4 +0,0 @@ -#!/bin/sh -# Hardened mingw gcc wrapper - -/var/tmp/dist/mingw-w64/bin/i686-w64-mingw32-gcc -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -fstack-protector --param ssp-buffer-size=4 -fno-strict-overflow "$@" diff --git a/projects/mingw-w64/i686-w64-mingw32-ld b/projects/mingw-w64/i686-w64-mingw32-ld deleted file mode 100755 index bcf5e5b..0000000 --- a/projects/mingw-w64/i686-w64-mingw32-ld +++ /dev/null @@ -1,4 +0,0 @@ -#!/bin/sh -# Hardened mingw gcc wrapper - -/var/tmp/dist/mingw-w64/bin/i686-w64-mingw32-ld --dynamicbase --nxcompat --enable-reloc-section -lssp -L$gcclibs "$@" diff --git a/rbm.conf b/rbm.conf index ab2a080..6e800f2 100644 --- a/rbm.conf +++ b/rbm.conf @@ -171,15 +171,36 @@ targets: torbrowser-windows-i686: - windows-i686 + - windows + torbrowser-windows-x86_64: + - windows-x86_64 + - windows + windows-x86_64: + arch: x86_64 + var: + windows-x86_64: 1 + osname: windows-x86_64 + container: + arch: amd64 windows-i686: arch: i686 var: - windows: 1 + windows-i686: 1 osname: windows-i686 container: - suite: precise arch: i386 - configure_opt: '--host=i686-w64-mingw32 CFLAGS="[% c("var/CFLAGS") %]" LDFLAGS="[% c("var/LDFLAGS") %]"' + setarch: | + if test -z "$RBM_SETARCH" + then + export RBM_SETARCH=1 + exec setarch i686 ./build + fi + windows: + var: + windows: 1 + container: + suite: precise + configure_opt: '--host=[% c("arch") %]-w64-mingw32 CFLAGS="[% c("var/CFLAGS") %]" LDFLAGS="[% c("var/LDFLAGS") %]"' CFLAGS: '[% c("var/flag_mwindows") %] -fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security' LDFLAGS: '[% c("var/flag_mwindows") %] -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$gcclibs' flag_mwindows: '-mwindows' @@ -193,12 +214,6 @@ targets: - zip - unzip faketime_path: /usr/lib/faketime/libfaketime.so.1 - setarch: | - if test -z "$RBM_SETARCH" - then - export RBM_SETARCH=1 - exec setarch i686 ./build - fi fteproxy: 1 install_wine_ppa: | # Install a Wine new enough to have a fix for

1 0

[tor-browser-build/master] Fold in missing stable release notes
by gk＠torproject.org 03 Nov '17

03 Nov '17

commit 897d6d1a74fda13743828846fe9b1616d3455011 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Oct 30 10:00:38 2017 +0000 Fold in missing stable release notes --- .../tor-browser/Bundle-Data/Docs/ChangeLog.txt | 34 ++++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 7697b5c..e1c70f2 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -4,6 +4,13 @@ Tor Browser 7.5a7 -- November 6 2017 * Linux * Bug 24052: Streamline handling of file:// resources +Tor Browser 7.0.8 -- October 25 2017 + * All Platforms + * Update Torbutton to 1.9.7.9 + * Bug 23949: Fix donation banner display + * Update locales with translated banner + * Translations update + Tor Browser 7.5a6 -- October 19 2017 * All Platforms * Update Firefox to 52.4.1esr @@ -22,6 +29,33 @@ Tor Browser 7.5a6 -- October 19 2017 * Bug 23807: Tab crashes when playing video on High Sierra * Bug 23025: Add some hardening flags to macOS build +Tor Browser 7.0.7 -- October 19 2017 + * All Platforms + * Update Firefox to 52.4.1esr + * Update Torbutton to 1.9.7.8 + * Bug 23887: Update banner locales and Mozilla text + * Bug 23526: Add 2017 Donation banner text + * Bug 23483: Donation banner on about:tor for 2017 (testing mode) + * Bug 22610: Avoid crashes when canceling external helper app related downloads + * Bug 22472: Fix FTP downloads when external helper app dialog is shown + * Bug 22471: Downloading pdf files via the PDF viewer download button is broken + * Bug 22618: Downloading pdf file via file:/// is stalling + * Translations update + * Update HTTPS-Everywhere to 2017.10.4 + * Update NoScript to 5.1.2 + * Bug 23723: Loading entities from NoScript .dtd files is blocked + * Bug 23724: NoScript update breaks Security Slider and its icon disappears + * Bug 23745: Tab crashes when using Tor Browser to access Google Drive + * Bug 22610: Avoid crashes when canceling external helper app related downloads + * Bug 22472: Fix FTP downloads when external helper app dialog is shown + * Bug 22471: Downloading pdf files via the PDF viewer download button is broken + * Bug 22618: Downloading pdf file via file:/// is stalling + * Bug 23694: Update the detailsURL in update responses + * OS X + * Bug 23807: Tab crashes when playing video on High Sierra + * Linux + * Bug 22692: Enable content sandboxing on Linux + Tor Browser 7.5a5 -- September 28 2017 * All Platforms * Update Firefox to 52.4.0esr

1 0

[tor-browser-build/master] Apply follow-up patch for bug 24052
by gk＠torproject.org 03 Nov '17

03 Nov '17

commit 409a6951d0c081905fc44f12e5b2359032178f18 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Nov 2 11:10:00 2017 +0000 Apply follow-up patch for bug 24052 --- projects/firefox/24052_2.patch | 29 +++++++++++++++++++++++++++++ projects/firefox/build | 1 + projects/firefox/config | 2 ++ 3 files changed, 32 insertions(+) diff --git a/projects/firefox/24052_2.patch b/projects/firefox/24052_2.patch new file mode 100644 index 0000000..0060428 --- /dev/null +++ b/projects/firefox/24052_2.patch @@ -0,0 +1,29 @@ +From e2c1240ad25f4edcc7d3828b29f6aeb953a24a2e Mon Sep 17 00:00:00 2001 +From: Arthur Edelstein <arthuredelstein(a)gmail.com> +Date: Wed, 1 Nov 2017 02:33:18 -0700 +Subject: [PATCH] Bug 24052: Handle redirects by blocking them early + +This is the second part of the workaround for +https://bugzilla.mozilla.org/show_bug.cgi?id=1412081. + +diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp +index 0e570e8cb57d..b38be48bf0c9 100644 +--- a/netwerk/protocol/http/nsHttpChannel.cpp ++++ b/netwerk/protocol/http/nsHttpChannel.cpp +@@ -5419,6 +5419,13 @@ nsHttpChannel::AsyncProcessRedirection(uint32_t redirectType) + return NS_ERROR_CORRUPTED_CONTENT; + } + ++ bool isRedirectToFile = false; ++ rv = mRedirectURI->SchemeIs("file", &isRedirectToFile); ++ if (!NS_FAILED(rv) && isRedirectToFile) { ++ LOG(("Attempted to redirect from a remote page to a file:// URI.")); ++ return NS_ERROR_FAILURE; ++ } ++ + if (mApplicationCache) { + // if we are redirected to a different origin check if there is a fallback + // cache entry to fall back to. we don't care about file strict +-- +2.14.2 + diff --git a/projects/firefox/build b/projects/firefox/build index 97b148d..3806fdf 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -88,6 +88,7 @@ fi [% IF c("var/linux") || c("var/osx") %] patch -p1 < $rootdir/24052.patch + patch -p1 < $rootdir/24052_2.patch [% END -%] rm -f configure diff --git a/projects/firefox/config b/projects/firefox/config index c0c620f..2e30001 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -83,6 +83,8 @@ input_files: enable: '[% c("var/osx") %]' - filename: 24052.patch enable: '[% c("var/linux") || c("var/osx") %]' + - filename: 24052_2.patch + enable: '[% c("var/linux") || c("var/osx") %]' - URL: https://people.torproject.org/~gk/mirrors/sources/msvcr100.dll sha256sum: 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18 enable: '[% c("var/windows") %]'

1 0

[tor-browser-build/master] Version bump and Changelog update
by gk＠torproject.org 03 Nov '17

03 Nov '17

commit b0390291a524873a5e10ee2973999596c30d40c2 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Nov 2 11:12:52 2017 +0000 Version bump and Changelog update --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 6 ++++++ rbm.conf | 4 ++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index e18d650..7697b5c 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,9 @@ +Tor Browser 7.5a7 -- November 6 2017 + * OS X + * Bug 24052: Streamline handling of file:// resources + * Linux + * Bug 24052: Streamline handling of file:// resources + Tor Browser 7.5a6 -- October 19 2017 * All Platforms * Update Firefox to 52.4.1esr diff --git a/rbm.conf b/rbm.conf index 80a7091..ab2a080 100644 --- a/rbm.conf +++ b/rbm.conf @@ -15,10 +15,10 @@ buildconf: git_signtag_opt: '-s' var: - torbrowser_version: '7.5a6' + torbrowser_version: '7.5a7' torbrowser_build: 'build1' torbrowser_incremental_from: - - 7.5a5 + - 7.5a6 project_name: tor-browser multi_lingual: 0 build_mar: 1

1 0

[tor-browser-build/master] Applying patch for bug 24052
by gk＠torproject.org 03 Nov '17

03 Nov '17

commit e0e6bfd780cdbb529aecc57699a8f410f667c62f Author: Georg Koppen <gk(a)torproject.org> Date: Mon Oct 30 09:44:58 2017 +0000 Applying patch for bug 24052 --- projects/firefox/24052.patch | 57 ++++++++++++++++++++++++++++++++++++++++++++ projects/firefox/build | 4 ++++ projects/firefox/config | 2 ++ 3 files changed, 63 insertions(+) diff --git a/projects/firefox/24052.patch b/projects/firefox/24052.patch new file mode 100644 index 0000000..a418a97 --- /dev/null +++ b/projects/firefox/24052.patch @@ -0,0 +1,57 @@ +From c5d1bb91512f9dd20e0f54c6f3e6979588cf9f56 Mon Sep 17 00:00:00 2001 +From: Georg Koppen <gk(a)torproject.org> +Date: Fri, 27 Oct 2017 20:40:57 +0000 +Subject: [PATCH] Bug 24052: Streamline handling of file:// resources + +We should make sure restrictions regarding loading of file:// resources +are adhered to more strictly, at least on *nix platforms. + +This is a workaround for +https://bugzilla.mozilla.org/show_bug.cgi?id=1412081. + +diff --git a/netwerk/base/nsIOService.cpp b/netwerk/base/nsIOService.cpp +index 0da79c18ae41..0cc67da7b18f 100644 +--- a/netwerk/base/nsIOService.cpp ++++ b/netwerk/base/nsIOService.cpp +@@ -789,12 +789,20 @@ nsIOService::NewChannelFromURIWithProxyFlagsInternal(nsIURI* aURI, + // if calling newChannel2() fails we try to fall back to + // creating a new channel by calling NewChannel(). + if (NS_FAILED(rv)) { ++#ifdef XP_UNIX ++ if (rv == NS_ERROR_FILE_TARGET_DOES_NOT_EXIST) { ++ return rv; ++ } else { ++#endif + rv = handler->NewChannel(aURI, getter_AddRefs(channel)); + NS_ENSURE_SUCCESS(rv, rv); + // The protocol handler does not implement NewChannel2, so + // maybe we need to wrap the channel (see comment in MaybeWrap + // function). + channel = nsSecCheckWrapChannel::MaybeWrap(channel, aLoadInfo); ++#ifdef XP_UNIX ++ } ++#endif + } + } + +diff --git a/netwerk/protocol/file/nsFileProtocolHandler.cpp b/netwerk/protocol/file/nsFileProtocolHandler.cpp +index e55cb9d47460..c24c928b6f02 100644 +--- a/netwerk/protocol/file/nsFileProtocolHandler.cpp ++++ b/netwerk/protocol/file/nsFileProtocolHandler.cpp +@@ -188,6 +188,13 @@ nsFileProtocolHandler::NewChannel2(nsIURI* uri, + nsILoadInfo* aLoadInfo, + nsIChannel** result) + { ++#ifdef XP_UNIX ++ if (aLoadInfo && aLoadInfo->TriggeringPrincipal()) { ++ if (aLoadInfo->TriggeringPrincipal()->GetIsCodebasePrincipal()) { ++ return NS_ERROR_FILE_TARGET_DOES_NOT_EXIST; ++ } ++ } ++#endif + nsFileChannel *chan = new nsFileChannel(uri); + if (!chan) + return NS_ERROR_OUT_OF_MEMORY; +-- +2.14.2 + diff --git a/projects/firefox/build b/projects/firefox/build index 8ff265d..97b148d 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -86,6 +86,10 @@ fi export CC='gcc -m32' [% END -%] +[% IF c("var/linux") || c("var/osx") %] + patch -p1 < $rootdir/24052.patch +[% END -%] + rm -f configure rm -f js/src/configure make -f client.mk configure CONFIGURE_ARGS="--with-tor-browser-version=[% c("var/torbrowser_version") %] --with-distribution-id=org.torproject --enable-update-channel=[% c("var/torbrowser_update_channel") %] --enable-bundled-fonts" diff --git a/projects/firefox/config b/projects/firefox/config index 85a4f00..c0c620f 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -81,6 +81,8 @@ input_files: enable: '[% c("var/linux") %]' - filename: fix-info-plist.py enable: '[% c("var/osx") %]' + - filename: 24052.patch + enable: '[% c("var/linux") || c("var/osx") %]' - URL: https://people.torproject.org/~gk/mirrors/sources/msvcr100.dll sha256sum: 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18 enable: '[% c("var/windows") %]'

1 0

[tor-browser-bundle/maint-7.0] Update release date for 7.0.9
by boklm＠torproject.org 03 Nov '17

03 Nov '17

commit d92ad6b540e7330340a13fbdf52bd2cff0b10d79 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Nov 1 20:59:50 2017 +0000 Update release date for 7.0.9 --- Bundle-Data/Docs/ChangeLog.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 40e382b..478814b 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,4 +1,4 @@ -Tor Browser 7.0.9 -- October 31 2017 +Tor Browser 7.0.9 -- November 3 2017 * OS X * Bug 24052: Streamline handling of file:// resources * Linux

1 0

[tor-browser-bundle/maint-7.0] Prepare 7.0.9 release for Linux and OS X
by boklm＠torproject.org 03 Nov '17

03 Nov '17

commit 8c793c6e481079e21c8d73b4cbb95e6453c359e0 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Oct 30 08:55:00 2017 +0000 Prepare 7.0.9 release for Linux and OS X Changelog and config.yml update --- Bundle-Data/Docs/ChangeLog.txt | 6 ++++++ tools/update-responses/config.yml | 8 ++++---- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 835426f..40e382b 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,9 @@ +Tor Browser 7.0.9 -- October 31 2017 + * OS X + * Bug 24052: Streamline handling of file:// resources + * Linux + * Bug 24052: Streamline handling of file:// resources + Tor Browser 7.0.8 -- October 25 2017 * All Platforms * Update Torbutton to 1.9.7.9 diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index 82fa8f0..cf3cd4d 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -20,14 +20,14 @@ build_targets: osx64: Darwin_x86_64-gcc3 channels: alpha: 7.0a4 - release: 7.0.8 + release: 7.0.9 versions: - 7.0.8: + 7.0.9: platformVersion: 52.4.1 - detailsURL: https://blog.torproject.org/tor-browser-708-released + detailsURL: https://blog.torproject.org/tor-browser-709-released incremental_from: - - 7.0.6 - 7.0.7 + - 7.0.8 migrate_archs: osx32: osx64 migrate_langs:

1 0

[tor-browser-bundle/maint-7.0] Apply follow-up patch for bug 24052
by boklm＠torproject.org 03 Nov '17

03 Nov '17

commit a5388a804d47d7d4fb157beb351ebef9897e8a2b Author: Georg Koppen <gk(a)torproject.org> Date: Wed Nov 1 20:35:18 2017 +0000 Apply follow-up patch for bug 24052 --- gitian/descriptors/linux/gitian-firefox.yml | 2 ++ gitian/descriptors/mac/gitian-firefox.yml | 2 ++ gitian/patches/24052_2.patch | 29 +++++++++++++++++++++++++++++ 3 files changed, 33 insertions(+) diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index 766bf99..967a981 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -37,6 +37,7 @@ files: - "dzip.sh" - "versions" - "24052.patch" +- "24052_2.patch" script: | source versions INSTDIR="$HOME/install" @@ -90,6 +91,7 @@ script: | cd tor-browser patch -p1 < ../24052.patch + patch -p1 < ../24052_2.patch # run get-moz-build-date before removing .git, which is used to get the year chmod +x ~/build/get-moz-build-date eval $(~/build/get-moz-build-date $(cat browser/config/version.txt)) diff --git a/gitian/descriptors/mac/gitian-firefox.yml b/gitian/descriptors/mac/gitian-firefox.yml index f47afc8..a38fc0b 100644 --- a/gitian/descriptors/mac/gitian-firefox.yml +++ b/gitian/descriptors/mac/gitian-firefox.yml @@ -25,6 +25,7 @@ files: - "fix-info-plist.py" - "versions" - "24052.patch" +- "24052_2.patch" script: | INSTDIR="$HOME/install/" source versions @@ -38,6 +39,7 @@ script: | cd tor-browser patch -p1 < ../24052.patch + patch -p1 < ../24052_2.patch # Extracting all the necessary tools tar xaf ../MacOSX10.7.sdk.tar.gz tar xaf ../cctools.tar.gz diff --git a/gitian/patches/24052_2.patch b/gitian/patches/24052_2.patch new file mode 100644 index 0000000..0060428 --- /dev/null +++ b/gitian/patches/24052_2.patch @@ -0,0 +1,29 @@ +From e2c1240ad25f4edcc7d3828b29f6aeb953a24a2e Mon Sep 17 00:00:00 2001 +From: Arthur Edelstein <arthuredelstein(a)gmail.com> +Date: Wed, 1 Nov 2017 02:33:18 -0700 +Subject: [PATCH] Bug 24052: Handle redirects by blocking them early + +This is the second part of the workaround for +https://bugzilla.mozilla.org/show_bug.cgi?id=1412081. + +diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp +index 0e570e8cb57d..b38be48bf0c9 100644 +--- a/netwerk/protocol/http/nsHttpChannel.cpp ++++ b/netwerk/protocol/http/nsHttpChannel.cpp +@@ -5419,6 +5419,13 @@ nsHttpChannel::AsyncProcessRedirection(uint32_t redirectType) + return NS_ERROR_CORRUPTED_CONTENT; + } + ++ bool isRedirectToFile = false; ++ rv = mRedirectURI->SchemeIs("file", &isRedirectToFile); ++ if (!NS_FAILED(rv) && isRedirectToFile) { ++ LOG(("Attempted to redirect from a remote page to a file:// URI.")); ++ return NS_ERROR_FAILURE; ++ } ++ + if (mApplicationCache) { + // if we are redirected to a different origin check if there is a fallback + // cache entry to fall back to. we don't care about file strict +-- +2.14.2 +

1 0

[tor-browser-bundle/maint-7.0] Apply patch for bug 24052
by boklm＠torproject.org 03 Nov '17

03 Nov '17

commit f1366de5a2a67dc5fda27718135ee2cff28c344d Author: Georg Koppen <gk(a)torproject.org> Date: Mon Oct 30 08:45:44 2017 +0000 Apply patch for bug 24052 --- gitian/descriptors/linux/gitian-firefox.yml | 2 + gitian/descriptors/mac/gitian-firefox.yml | 2 + gitian/patches/24052.patch | 57 +++++++++++++++++++++++++++++ 3 files changed, 61 insertions(+) diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index 1ff66a2..766bf99 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -36,6 +36,7 @@ files: - "re-dzip.sh" - "dzip.sh" - "versions" +- "24052.patch" script: | source versions INSTDIR="$HOME/install" @@ -88,6 +89,7 @@ script: | mkdir -p $INSTDIR/Debug/Browser/ cd tor-browser + patch -p1 < ../24052.patch # run get-moz-build-date before removing .git, which is used to get the year chmod +x ~/build/get-moz-build-date eval $(~/build/get-moz-build-date $(cat browser/config/version.txt)) diff --git a/gitian/descriptors/mac/gitian-firefox.yml b/gitian/descriptors/mac/gitian-firefox.yml index 73c46bf..f47afc8 100644 --- a/gitian/descriptors/mac/gitian-firefox.yml +++ b/gitian/descriptors/mac/gitian-firefox.yml @@ -24,6 +24,7 @@ files: - "dzip.sh" - "fix-info-plist.py" - "versions" +- "24052.patch" script: | INSTDIR="$HOME/install/" source versions @@ -36,6 +37,7 @@ script: | mkdir -p $OUTDIR/ cd tor-browser + patch -p1 < ../24052.patch # Extracting all the necessary tools tar xaf ../MacOSX10.7.sdk.tar.gz tar xaf ../cctools.tar.gz diff --git a/gitian/patches/24052.patch b/gitian/patches/24052.patch new file mode 100644 index 0000000..a418a97 --- /dev/null +++ b/gitian/patches/24052.patch @@ -0,0 +1,57 @@ +From c5d1bb91512f9dd20e0f54c6f3e6979588cf9f56 Mon Sep 17 00:00:00 2001 +From: Georg Koppen <gk(a)torproject.org> +Date: Fri, 27 Oct 2017 20:40:57 +0000 +Subject: [PATCH] Bug 24052: Streamline handling of file:// resources + +We should make sure restrictions regarding loading of file:// resources +are adhered to more strictly, at least on *nix platforms. + +This is a workaround for +https://bugzilla.mozilla.org/show_bug.cgi?id=1412081. + +diff --git a/netwerk/base/nsIOService.cpp b/netwerk/base/nsIOService.cpp +index 0da79c18ae41..0cc67da7b18f 100644 +--- a/netwerk/base/nsIOService.cpp ++++ b/netwerk/base/nsIOService.cpp +@@ -789,12 +789,20 @@ nsIOService::NewChannelFromURIWithProxyFlagsInternal(nsIURI* aURI, + // if calling newChannel2() fails we try to fall back to + // creating a new channel by calling NewChannel(). + if (NS_FAILED(rv)) { ++#ifdef XP_UNIX ++ if (rv == NS_ERROR_FILE_TARGET_DOES_NOT_EXIST) { ++ return rv; ++ } else { ++#endif + rv = handler->NewChannel(aURI, getter_AddRefs(channel)); + NS_ENSURE_SUCCESS(rv, rv); + // The protocol handler does not implement NewChannel2, so + // maybe we need to wrap the channel (see comment in MaybeWrap + // function). + channel = nsSecCheckWrapChannel::MaybeWrap(channel, aLoadInfo); ++#ifdef XP_UNIX ++ } ++#endif + } + } + +diff --git a/netwerk/protocol/file/nsFileProtocolHandler.cpp b/netwerk/protocol/file/nsFileProtocolHandler.cpp +index e55cb9d47460..c24c928b6f02 100644 +--- a/netwerk/protocol/file/nsFileProtocolHandler.cpp ++++ b/netwerk/protocol/file/nsFileProtocolHandler.cpp +@@ -188,6 +188,13 @@ nsFileProtocolHandler::NewChannel2(nsIURI* uri, + nsILoadInfo* aLoadInfo, + nsIChannel** result) + { ++#ifdef XP_UNIX ++ if (aLoadInfo && aLoadInfo->TriggeringPrincipal()) { ++ if (aLoadInfo->TriggeringPrincipal()->GetIsCodebasePrincipal()) { ++ return NS_ERROR_FILE_TARGET_DOES_NOT_EXIST; ++ } ++ } ++#endif + nsFileChannel *chan = new nsFileChannel(uri); + if (!chan) + return NS_ERROR_OUT_OF_MEMORY; +-- +2.14.2 +

1 0

[tor-browser-build/master] Bug 23384: Add user brade on build-sunet-a.torproject.net
by boklm＠torproject.org 23 Oct '17

23 Oct '17

commit eec1680facf5b805e8860daa70602ab6b43272aa Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Oct 23 21:00:18 2017 +0200 Bug 23384: Add user brade on build-sunet-a.torproject.net --- tools/ansible/roles/tbb-team/defaults/main.yml | 1 + tools/ansible/roles/tbb-team/files/brade.pub | 1 + 2 files changed, 2 insertions(+) diff --git a/tools/ansible/roles/tbb-team/defaults/main.yml b/tools/ansible/roles/tbb-team/defaults/main.yml index fff2def..cf54157 100644 --- a/tools/ansible/roles/tbb-team/defaults/main.yml +++ b/tools/ansible/roles/tbb-team/defaults/main.yml @@ -1,5 +1,6 @@ --- tbb_team_members: - boklm + - brade - gk - mcs diff --git a/tools/ansible/roles/tbb-team/files/brade.pub b/tools/ansible/roles/tbb-team/files/brade.pub new file mode 100644 index 0000000..0a83b4d --- /dev/null +++ b/tools/ansible/roles/tbb-team/files/brade.pub @@ -0,0 +1 @@ +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC+p9eNuVj59oHkPe/uM+DFTchAxMsm1F6jsMMQqzcNd2sIVAxftMEu8OTM5/rdz+XemevzE+BYHhNUamW/05rur97AYJB7hsOYBtx0g9tGx/2zot72yU38TjmbhWE1FKct+9zc6ZQnYHXLtWBB6k/zJeQH2CvwDLrHsXxfUvOE9lXrcgFy1ugVC96EknBfqz5LTG2dsQhn+nzpEnb3IZYoaRc0h33BVGLkNyFQEtm+7JzylTX6/854kk1BqwZLl03U6++7XA4SjVOYPCM3K1++dJt3CwnARs7mR3t03FFUj0gyRoPuxB6iwPtaCDIDEhSOMmj8hfbFu1N4jm4XY1H3

1 0