- tbb-commits - lists.torproject.org

[tor-browser-build/master] Fold in stable changelog
by boklm＠torproject.org 12 May '17

12 May '17

commit cab94ec562e71a2e3e379111f35d319f739d1b49 Author: Georg Koppen <gk(a)torproject.org> Date: Tue May 2 09:04:21 2017 +0000 Fold in stable changelog --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index b2ee463..afe3999 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -83,6 +83,18 @@ Tor Browser 7.0a3 -- April 20 2017 * Bug 21960: Linux bundles based on ESR 52 are not reproducible anymore * Bug 21629: Fix broken ASan builds when switching to ESR 52 +Tor Browser 6.5.2 -- April 19 2017 + * All Platforms + * Update Firefox to 45.9.0esr + * Update HTTPS-Everywhere to 5.2.14 + * Update NoScript to 5.0.2 + * Bug 21555+16450: Don't remove Authorization header on subdomains (e.g. Twitter) + * Bug 19316: Make sure our Windows updates can deal with the SSE2 requirement + * Bug 21917: Add new obfs4 bridges + * Bug 21918: Move meek-amazon to d2cly7j4zqgua7.cloudfront.net backend + * Windows + * Bug 21795: Fix Tor Browser crashing on github.com + Tor Browser 7.0a2-hardened -- March 7 2017 * All Platforms * Update Firefox to 45.8.0esr

1 0

[tor-browser-build/master] Add ChangeLog.txt symlink
by boklm＠torproject.org 12 May '17

12 May '17

commit 905f80c552d967413df71790b11f85df5880c9ca Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri May 12 13:47:51 2017 +0200 Add ChangeLog.txt symlink --- ChangeLog.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog.txt b/ChangeLog.txt new file mode 120000 index 0000000..e9fcf5d --- /dev/null +++ b/ChangeLog.txt @@ -0,0 +1 @@ +projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt \ No newline at end of file

1 0

[tor-browser-build/master] Remove FTE from OSX torrc-defaults
by boklm＠torproject.org 12 May '17

12 May '17

commit 747b697d335a023bae8da70671275a6750e7e02d Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri May 12 13:42:11 2017 +0200 Remove FTE from OSX torrc-defaults --- projects/tor-browser/Bundle-Data/PTConfigs/mac/torrc-defaults-appendix | 3 --- 1 file changed, 3 deletions(-) diff --git a/projects/tor-browser/Bundle-Data/PTConfigs/mac/torrc-defaults-appendix b/projects/tor-browser/Bundle-Data/PTConfigs/mac/torrc-defaults-appendix index f5eb5e4..271b36c 100644 --- a/projects/tor-browser/Bundle-Data/PTConfigs/mac/torrc-defaults-appendix +++ b/projects/tor-browser/Bundle-Data/PTConfigs/mac/torrc-defaults-appendix @@ -1,6 +1,3 @@ -## fteproxy configuration -ClientTransportPlugin fte exec PluggableTransports/fteproxy.bin --managed - ## obfs4proxy configuration ClientTransportPlugin obfs2,obfs3,obfs4,scramblesuit exec PluggableTransports/obfs4proxy

1 0

[tor-browser-build/master] Bug 21879: Use our default bookmarks on OSX.
by boklm＠torproject.org 12 May '17

12 May '17

commit a826868cf9771049ae33a710f5a2cd764d99494a Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri May 12 13:12:47 2017 +0200 Bug 21879: Use our default bookmarks on OSX. Account for the changes Mozilla to support localized default bookmarks (see: https://bugzilla.mozilla.org/show_bug.cgi?id=1235107) Currently, Tor Browser uses the same bookmarks for all locales. tor-browser-bundle.git author: Kathy Brade <brade(a)pearlcrescent.com> tor-browser-bundle.git commit: 57f088b981a0292d5370b3c56c6d7e5a18f95aca --- projects/tor-browser/build | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/projects/tor-browser/build b/projects/tor-browser/build index 084ec7d..69469db 100644 --- a/projects/tor-browser/build +++ b/projects/tor-browser/build @@ -152,11 +152,12 @@ rm -rf chrome/en-US unzip omni.ja defaults/preferences/000-tor-browser.js || [ $? -lt 3 ] cp defaults/preferences/000-tor-browser.js $rootdir [% IF c("var/osx") %] - # Embed our default bookmarks. - mkdir -p defaults/profile/ - cp -p $rootdir/bookmarks.html defaults/profile/ - [% c("var/touch") %] defaults/profile/bookmarks.html - zip -Xm omni.ja defaults/profile/bookmarks.html + # Embed our default bookmarks within the en-US locale. + mkdir -p chrome/en-US/locale/browser + cp -p $rootdir/bookmarks.html chrome/en-US/locale/browser/ + [% c("var/touch") %] chrome/en-US/locale/browser/bookmarks.html + zip -Xm omni.ja chrome/en-US/locale/browser/bookmarks.html + rm -rf chrome [% END %] # Set the locale of the bundle. echo "pref(\"general.useragent.locale\", \"en-US\");" >> defaults/preferences/000-tor-browser.js @@ -165,8 +166,8 @@ zip -Xm omni.ja defaults/preferences/000-tor-browser.js rm -rf defaults popd -# Prepare our language packs for using the proper search engines. See bug -# 18915 for more details. +# Prepare our language packs for using the proper search engines and embed +# our default bookmarks. See bugs 18915 and 21879 for more details. [% FOREACH lang = c('var/locales') %] [% SET lang = tmpl(lang); SET xpi = '$rootdir/' _ c('input_files_by_name/firefox-langpacks') _ '/' _ lang _ '.xpi'; @@ -175,6 +176,9 @@ popd search_plugins_path=prep_[% lang %]/browser/chrome/[% lang %]/locale/browser rm -rf $search_plugins_path/searchplugins cp -rf $rootdir/searchplugins $search_plugins_path + [% IF c("var/osx") -%] + cp $rootdir/bookmarks.html prep_[% lang %]/browser/chrome/[% lang %]/locale/browser/ + [% END -%] rm [% xpi %] cd prep_[% lang %] [% c('zip', {

1 0

[tor-browser-build/master] Bug 21779: Non-admin users can't access Tor Browser on macOS.
by boklm＠torproject.org 12 May '17

12 May '17

commit dd6349a4c118d05797eb211d538ac36b6d08bb59 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri May 12 13:20:33 2017 +0200 Bug 21779: Non-admin users can't access Tor Browser on macOS. Use chmod to grant permission for "other" to access files within TorBrowser.app. tor-browser-bundle.git author: Kathy Brade <brade(a)pearlcrescent.com> tor-browser-bundle.git commit: f27d2cab4ed80a4c7b4f594b593b6b90f6148a82 --- projects/tor-browser/build | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/projects/tor-browser/build b/projects/tor-browser/build index 69469db..d580284 100644 --- a/projects/tor-browser/build +++ b/projects/tor-browser/build @@ -229,6 +229,12 @@ rm -f precomplete python $MARTOOLS/createprecomplete.py popd +[% IF c("var/osx") -%] + # Ensure that files and directories are accessible by non-admin users + # if the app bundle is placed in /Applications. See bug 21779. + chmod -R o+rX "$TBDIR" +[% END -%] + cd $distdir [% IF c("var/build_mar") -%] @@ -301,6 +307,12 @@ rm -rf $distdir/${PKG_DIR} python $MARTOOLS/createprecomplete.py popd + [% IF c("var/osx") -%] + # Ensure that files and directories are accessible by non-admin users + # if the app bundle is placed in /Applications. See bug 21779. + chmod -R o+rX "[% browserdir %]" + [% END -%] + # Create full MAR file and compressed package for this locale. MAR_FILE=tor-browser-[% c("var/mar_osname") %]-[% c("var/torbrowser_version") %]_[% lang %].mar MAR=$MARTOOLS/mar MBSDIFF=$MARTOOLS/mbsdiff $MARTOOLS/make_full_update.sh -q $OUTDIR/$MAR_FILE "[% browserdir %]"

1 0

[tor-browser-bundle/master] Bug 20761: Tor Browser 6.5a4 is ignoring additional SocksPorts
by gk＠torproject.org 12 May '17

12 May '17

commit 3f32f7a6dd4970936cc49d988369a61efa87c031 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue Jan 31 11:49:41 2017 -0500 Bug 20761: Tor Browser 6.5a4 is ignoring additional SocksPorts Remove the SocksPort and ControlPort configuration from torrc-defaults. Tor Launcher configures the ports via args when starting tor, and we must avoid conflicts. Also, strengthen the warning to users about not editing torrc-defaults. --- Bundle-Data/linux/Data/Tor/torrc-defaults | 8 +++----- Bundle-Data/mac/TorBrowser/Data/Tor/torrc-defaults | 8 +++----- Bundle-Data/windows/Data/Tor/torrc-defaults | 8 +++----- 3 files changed, 9 insertions(+), 15 deletions(-) diff --git a/Bundle-Data/linux/Data/Tor/torrc-defaults b/Bundle-Data/linux/Data/Tor/torrc-defaults index 0a87e5f..f383525 100644 --- a/Bundle-Data/linux/Data/Tor/torrc-defaults +++ b/Bundle-Data/linux/Data/Tor/torrc-defaults @@ -1,6 +1,8 @@ # torrc-defaults for Tor Browser # -# This file is distributed with Tor Browser and should not be modified (it +# DO NOT EDIT THIS FILE +# +# This file is distributed with Tor Browser and SHOULD NOT be modified (it # may be overwritten during the next Tor Browser update). To customize your # Tor configuration, shut down Tor Browser and edit the torrc file. # @@ -9,8 +11,4 @@ AvoidDiskWrites 1 # Where to send logging messages. Format is minSeverity[-maxSeverity] # (stderr|stdout|syslog|file FILENAME). Log notice stdout -# Bind to this address to listen to connections from SOCKS-speaking -# applications. -SocksPort 9150 IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth -ControlPort 9151 CookieAuthentication 1 diff --git a/Bundle-Data/mac/TorBrowser/Data/Tor/torrc-defaults b/Bundle-Data/mac/TorBrowser/Data/Tor/torrc-defaults index 0a87e5f..f383525 100644 --- a/Bundle-Data/mac/TorBrowser/Data/Tor/torrc-defaults +++ b/Bundle-Data/mac/TorBrowser/Data/Tor/torrc-defaults @@ -1,6 +1,8 @@ # torrc-defaults for Tor Browser # -# This file is distributed with Tor Browser and should not be modified (it +# DO NOT EDIT THIS FILE +# +# This file is distributed with Tor Browser and SHOULD NOT be modified (it # may be overwritten during the next Tor Browser update). To customize your # Tor configuration, shut down Tor Browser and edit the torrc file. # @@ -9,8 +11,4 @@ AvoidDiskWrites 1 # Where to send logging messages. Format is minSeverity[-maxSeverity] # (stderr|stdout|syslog|file FILENAME). Log notice stdout -# Bind to this address to listen to connections from SOCKS-speaking -# applications. -SocksPort 9150 IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth -ControlPort 9151 CookieAuthentication 1 diff --git a/Bundle-Data/windows/Data/Tor/torrc-defaults b/Bundle-Data/windows/Data/Tor/torrc-defaults index 0a87e5f..f383525 100644 --- a/Bundle-Data/windows/Data/Tor/torrc-defaults +++ b/Bundle-Data/windows/Data/Tor/torrc-defaults @@ -1,6 +1,8 @@ # torrc-defaults for Tor Browser # -# This file is distributed with Tor Browser and should not be modified (it +# DO NOT EDIT THIS FILE +# +# This file is distributed with Tor Browser and SHOULD NOT be modified (it # may be overwritten during the next Tor Browser update). To customize your # Tor configuration, shut down Tor Browser and edit the torrc file. # @@ -9,8 +11,4 @@ AvoidDiskWrites 1 # Where to send logging messages. Format is minSeverity[-maxSeverity] # (stderr|stdout|syslog|file FILENAME). Log notice stdout -# Bind to this address to listen to connections from SOCKS-speaking -# applications. -SocksPort 9150 IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth -ControlPort 9151 CookieAuthentication 1

1 0

[tor-launcher/master] By default, use TCP for the ControlPort and SocksPort.
by gk＠torproject.org 12 May '17

12 May '17

commit 485ba9456724e38b661c90dccc90322c74fa405f Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Thu May 11 17:34:16 2017 -0400 By default, use TCP for the ControlPort and SocksPort. For the stable releases of Tor Browser, we want to continue to use TCP so that packages like TorBirdy that use the tor that is started by Tor Browser continue to work. Also see bugs 20111 and 20761. --- src/defaults/preferences/prefs.js | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/src/defaults/preferences/prefs.js b/src/defaults/preferences/prefs.js index 875c300..752514a 100644 --- a/src/defaults/preferences/prefs.js +++ b/src/defaults/preferences/prefs.js @@ -9,27 +9,27 @@ pref("extensions.torlauncher.loglevel", 4); // 1=verbose, 2=debug, 3=info, 4=no pref("extensions.torlauncher.logmethod", 1); // 0=stdout, 1=errorconsole, 2=debuglog pref("extensions.torlauncher.max_tor_log_entries", 1000); -// By default, an IPC object (e.g., a Unix domain socket) at a default -// location is used for the Tor control port. -// Change control_port_use_ipc to false to use a TCP connection instead, as -// defined by control_host and control_port. -// Modify control_ipc_path to override the default IPC object location. If a -// relative path is used, it is handled like torrc_path (see below). -pref("extensions.torlauncher.control_port_use_ipc", true); -pref("extensions.torlauncher.control_ipc_path", ""); +// By default, Tor Launcher configures a TCP listener for the Tor +// control port, as defined by control_host and control_port. +// Set control_port_use_ipc to true to use an IPC object (e.g., a Unix +// domain socket) instead. You may also modify control_ipc_path to +// override the default IPC object location. If a relative path is used, +// it is handled like torrc_path (see below). pref("extensions.torlauncher.control_host", "127.0.0.1"); pref("extensions.torlauncher.control_port", 9151); +pref("extensions.torlauncher.control_port_use_ipc", false); +pref("extensions.torlauncher.control_ipc_path", ""); -// By default, an IPC object (e.g., a Unix domain socket) at a default -// location is used for the Tor SOCKS port. -// Change socks_port_use_ipc to false to use a TCP connection. When a -// TCP connection is used, the host is taken from the network.proxy.socks -// pref and the port is taken from the network.proxy.socks_port pref. -// Modify socks_ipc_path to override the default IPC object location. If a -// relative path is used, it is handled like torrc_path (see below). +// By default, Tor Launcher configures a TCP listener for the Tor +// SOCKS port. The host is taken from the network.proxy.socks pref and +// the port is taken from the network.proxy.socks_port pref. +// Set socks_port_use_ipc to true to use an IPC object (e.g., a Unix +// domain socket) instead. You may also modify socks_ipc_path to +// override the default IPC object location. If a relative path is used, +// it is handled like torrc_path (see below). // Modify socks_port_flags to use a different set of SocksPort flags (but be // careful). -pref("extensions.torlauncher.socks_port_use_ipc", true); +pref("extensions.torlauncher.socks_port_use_ipc", false); pref("extensions.torlauncher.socks_ipc_path", ""); pref("extensions.torlauncher.socks_port_flags", "IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth");

1 0

[tor-launcher/master] Bug 20761: Tor Browser 6.5a4 is ignoring additional SocksPorts
by gk＠torproject.org 12 May '17

12 May '17

commit 5154173e0facfff26bede4c37d2c47669350d0ff Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Fri May 5 14:37:52 2017 -0400 Bug 20761: Tor Browser 6.5a4 is ignoring additional SocksPorts When starting tor, pass "+__ControlPort" and "+__SocksPort" in the args. This causes Tor Launcher's control and SOCKS ports to be added to any ports the user has defined in their torrc and also prevents the ports defined by Tor Launcher from being written to torrc. Also, perform a one-time removal of the torrc lines that conflict with the ports that Tor Launcher will use when starting tor. This change depends on the fix for #20956. --- src/components/tl-process.js | 319 +++++++++++++++++++++++++++++++++++++++++- src/components/tl-protocol.js | 9 +- src/modules/tl-util.jsm | 11 +- 3 files changed, 332 insertions(+), 7 deletions(-) diff --git a/src/components/tl-process.js b/src/components/tl-process.js index 3284049..3db394e 100644 --- a/src/components/tl-process.js +++ b/src/components/tl-process.js @@ -1,4 +1,4 @@ -// Copyright (c) 2016, The Tor Project, Inc. +// Copyright (c) 2017, The Tor Project, Inc. // See LICENSE for licensing information. // // vim: set sw=2 sts=2 ts=8 et syntax=javascript: @@ -99,6 +99,17 @@ TorProcessService.prototype = } else if (TorLauncherUtil.shouldStartAndOwnTor) { + // If we have not already done so, perform a one-time fixup to remove + // any ControlPort and SocksPort lines from the user's torrc file that + // will conflict with the arguments we plan to pass when starting tor. + // See bug 20761. + const kTorrcFixupPref = "extensions.torlauncher.torrc_fixup_version"; + if ((TorLauncherUtil.getIntPref(kTorrcFixupPref, 0) < 1) + && this._fixupTorrc()) + { + TorLauncherUtil.setIntPref(kTorrcFixupPref, 1); + } + this._startTor(); this._controlTor(); } @@ -383,7 +394,10 @@ TorProcessService.prototype = args.push(hashedPassword); // Include a ControlPort argument to support switching between - // a TCP port and an IPC port (e.g., a Unix domain socket). + // a TCP port and an IPC port (e.g., a Unix domain socket). We + // include a "+__" prefix so that (1) this control port is added + // to any control ports that the user has defined in their torrc + // file and (2) it is never written to torrc. let controlPortArg; if (controlIPCFile) controlPortArg = this._ipcPortArg(controlIPCFile); @@ -391,12 +405,15 @@ TorProcessService.prototype = controlPortArg = "" + controlPort; if (controlPortArg) { - args.push("ControlPort"); + args.push("+__ControlPort"); args.push(controlPortArg); } // Include a SocksPort argument to support switching between - // a TCP port and an IPC port (e.g., a Unix domain socket). + // a TCP port and an IPC port (e.g., a Unix domain socket). We + // include a "+__" prefix so that (1) this SOCKS port is added + // to any SOCKS ports that the user has defined in their torrc + // file and (2) it is never written to torrc. if (socksPortInfo) { let socksPortArg; @@ -411,7 +428,7 @@ TorProcessService.prototype = "extensions.torlauncher.socks_port_flags"); if (socksPortFlags) socksPortArg += ' ' + socksPortFlags; - args.push("SocksPort"); + args.push("+__SocksPort"); args.push(socksPortArg); } } @@ -793,6 +810,298 @@ TorProcessService.prototype = return pid; }, + // Returns true if successful. + _fixupTorrc: function() + { + let torrcFile = TorLauncherUtil.getTorFile("torrc", true); + if (!torrcFile) + return true; // No torrc file; nothing to fixup. + + let torrcStr = this._getFileAsString(torrcFile); + if (torrcStr == undefined) + return false; + else if (torrcStr.length == 0) + return true; + + let controlIPCFile = this.mProtocolSvc.TorGetControlIPCFile(); + let controlPort = this.mProtocolSvc.TorGetControlPort(); + let socksPortInfo = this.mProtocolSvc.TorGetSOCKSPortInfo(); + + let lines = this._joinContinuedTorrcLines(torrcStr); + + let removedLinesCount = 0; + let revisedLines = []; + lines.forEach(aLine => + { + let removeLine = false; + // Look for "+ControlPort value" or "ControlPort value", skipping leading + // whitespace and ignoring case. + let matchResult = aLine.match(/\s*\+*controlport\s+(.*)/i); + if (matchResult) + { + if (controlIPCFile) + { + removeLine = this._valueContainsFilePath(matchResult[1], + controlIPCFile); + } + else + { + removeLine = this._valueContainsPort(matchResult[1], + controlPort); + } + } + else if (socksPortInfo) + { + // Look for "+SocksPort value" or "SocksPort value", skipping leading + // whitespace and ignoring case. + matchResult = aLine.match(/\s*\+*socksport\s+(.*)/i); + if (matchResult) + { + if (socksPortInfo.ipcFile) + { + removeLine = this._valueContainsFilePath(matchResult[1], + socksPortInfo.ipcFile); + } + else + { + removeLine = this._valueContainsPort(matchResult[1], + socksPortInfo.port); + } + } + } + + if (removeLine) + { + ++removedLinesCount; + TorLauncherLogger.log(3, "_fixupTorrc: removing " + aLine); + } + else + { + revisedLines.push(aLine); + } + }); + + if (removedLinesCount > 0) + { + let s = revisedLines.join('\n'); + if (!this._overwriteFile(torrcFile, s)) + return false; + + TorLauncherLogger.log(4, "_fixupTorrc: removed " + removedLinesCount + + " configuration options"); + } + + return true; + }, + + // Returns undefined if file contents could not be read. + _getFileAsString: function(aFile) + { + let str = "" + let inStream; + try + { + let fis = Cc['@mozilla.org/network/file-input-stream;1'] + .createInstance(Ci.nsIFileInputStream); + const kOpenFlagsReadOnly = 0x01; + fis.init(aFile, kOpenFlagsReadOnly, 0, 0); + inStream = Cc["@mozilla.org/intl/converter-input-stream;1"] + .createInstance(Ci.nsIConverterInputStream); + inStream.init(fis, "UTF-8", 0, + Ci.nsIConverterInputStream.DEFAULT_REPLACEMENT_CHARACTER); + const kReadSize = 0xffffffff; // PR_UINT32_MAX + while (true) + { + let outStr = {}; + let count = inStream.readString(kReadSize, outStr); + if (count == 0) + break; + + str += outStr.value; + } + } + catch (e) + { + TorLauncherLogger.log(5, "_getFileAsString " + aFile.path + + " error: " + e); + str = undefined; + } + + if (inStream) + inStream.close(); + + return str; + }, + + // After making a backup, replace the contents of aFile with aStr. + // Returns true if successful. + _overwriteFile: function(aFile, aStr) + { + let backupFile; + + try + { + // Convert the data to UTF-8. + let conv = Cc["@mozilla.org/intl/scriptableunicodeconverter"] + .createInstance(Ci.nsIScriptableUnicodeConverter); + conv.charset = "UTF-8"; + let data = conv.ConvertFromUnicode(aStr) + conv.Finish(); + + // Rename the file to .bak (we avoid .orig because tor uses it). This + // backup will be left on disk so the user can recover the original + // file contents. + backupFile = aFile.clone(); + backupFile.leafName += ".bak"; + backupFile.createUnique(Ci.nsIFile.NORMAL_FILE_TYPE, aFile.permissions); + aFile.renameTo(null, backupFile.leafName); + TorLauncherLogger.log(3, "created backup of " + aFile.leafName + + " in " + backupFile.leafName); + + // Write the new data to the file. + let stream = Cc["@mozilla.org/network/safe-file-output-stream;1"] + .createInstance(Ci.nsIFileOutputStream); + stream.init(aFile, 0x02 | 0x08 | 0x20, /* WRONLY CREATE TRUNCATE */ + 0600, 0); + stream.write(data, data.length); + stream.QueryInterface(Ci.nsISafeOutputStream).finish(); + } + catch (e) + { + // Report an error and try to recover by renaming the backup to the + // original name. + TorLauncherLogger.log(5, "failed to overwrite file " + aFile.path + + ": " + e); + if (backupFile) + backupFile.renameTo(null, aFile.leafName); + + return false; + } + + return true; + }, + + // Split aTorrcStr into lines, joining continued lines. + _joinContinuedTorrcLines: function(aTorrcStr) + { + let lines = []; + let rawLines = aTorrcStr.split('\n'); + let isContinuedLine = false; + let tmpLine; + rawLines.forEach(aLine => + { + let len = aLine.length; + + // Strip trailing CR if present. + if ((len > 0) && aLine.substr(len - 1) == '\r') + { + --len; + aLine = aLine.substr(0, len); + } + + // Check for a continued line. This is indicated by a trailing \ or, if + // we are already within a continued line sequence, a trailing comment. + if ((len > 0) && (aLine.substr(len - 1) == '\\')) + { + --len; + aLine = aLine.substr(0, len); + + // If this is the start of a continued line and it only contains a + // keyword (i.e., no spaces are present), append a space so that + // the keyword will be recognized (as it is by tor) after we join + // the pieces of the continued line into one line. + if (!isContinuedLine && (aLine.indexOf(' ') < 0)) + aLine += ' '; + + isContinuedLine = true; + } + else if (isContinuedLine) + { + if (len == 0) + { + isContinuedLine = false; + } + else + { + // Check for a comment. According to tor's doc/torrc_format.txt, + // comments do not terminate a sequence of continued lines. + let idx = aLine.indexOf("#"); + if (idx < 0) + { + isContinuedLine = false; // Not a comment; end continued line. + } + else + { + // Remove trailing comment from continued line. The continued + // line sequence continues. + aLine = aLine.substr(0, idx); + } + } + } + + if (isContinuedLine) + { + if (tmpLine) + tmpLine += aLine; + else + tmpLine = aLine; + } + else if (tmpLine) + { + lines.push(tmpLine + aLine); + tmpLine = undefined; + } + else + { + lines.push(aLine); + } + }); + + return lines; + }, + + _valueContainsFilePath: function(aValue, aFile) + { + // Handle several cases: + // "unix:/path options" + // unix:"/path" options + // unix:/path options + if (aValue.startsWith('"')) + aValue = this.mProtocolSvc.TorUnescapeString(aValue); + + let path; + let matchResult = aValue.match(/^unix:("[^"]*")/); + if (matchResult) + path = this.mProtocolSvc.TorUnescapeString(matchResult[1]); + else + { + matchResult = aValue.match(/^unix:(\S*)/); + if (matchResult) + path = matchResult[1]; + } + + if (!path) + return false; + + let file = Cc['@mozilla.org/file/local;1'].createInstance(Ci.nsIFile); + file.initWithPath(path); + return file.equals(aFile); + }, + + _valueContainsPort: function(aValue, aPort) + { + // Check for a match, ignoring "127.0.0.1" and "localhost" prefixes. + let val = this.mProtocolSvc.TorUnescapeString(aValue); + let pieces = val.split(':'); + if ((pieces.length >= 2) + && ((pieces[0] == "127.0.0.1") + || (pieces[0].toLowerCase() == "localhost"))) + { + val = pieces[1]; + } + + return aPort === parseInt(val); + }, + endOfObject: true }; diff --git a/src/components/tl-protocol.js b/src/components/tl-protocol.js index 12f3910..d6323f4 100644 --- a/src/components/tl-protocol.js +++ b/src/components/tl-protocol.js @@ -1,4 +1,4 @@ -// Copyright (c) 2016, The Tor Project, Inc. +// Copyright (c) 2017, The Tor Project, Inc. // See LICENSE for licensing information. // TODO: Some code came from torbutton.js (pull in copyright and license?) // @@ -299,6 +299,13 @@ TorProtocolService.prototype = return this.mSOCKSPortInfo; }, + // Unescape Tor Control string aStr (removing surrounding "" and \ escapes). + // Returns a string. + TorUnescapeString: function(aStr) + { + return this._strUnescape(aStr); + }, + // Escape non-ASCII characters for use within the Tor Control protocol. // Returns a string. TorEscapeString: function(aStr) diff --git a/src/modules/tl-util.jsm b/src/modules/tl-util.jsm index 0d33267..2e45fd1 100644 --- a/src/modules/tl-util.jsm +++ b/src/modules/tl-util.jsm @@ -1,4 +1,4 @@ -// Copyright (c) 2016, The Tor Project, Inc. +// Copyright (c) 2017, The Tor Project, Inc. // See LICENSE for licensing information. // // vim: set sw=2 sts=2 ts=8 et syntax=javascript: @@ -231,6 +231,15 @@ let TorLauncherUtil = // Public return rv; }, + setIntPref: function(aPrefName, aVal) + { + var val = (undefined != aVal) ? aVal : 0; + try + { + TLUtilInternal.mPrefsSvc.setIntPref(aPrefName, val); + } catch (e) {} + }, + getCharPref: function(aPrefName, aDefaultVal) { var rv = aDefaultVal ? aDefaultVal : "";

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 12 May '17

12 May '17

commit 611b3ff60078725f036e253c5d10a3d01d8fde90 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Fri May 12 01:29:04 2017 -0700 fixup! TB4: Tor Browser's Firefox preference overrides. Bug 21685: Disable remote new tab pages --- browser/app/profile/000-tor-browser.js | 1 + 1 file changed, 1 insertion(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index be74849..98cfec5 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -95,6 +95,7 @@ pref("browser.newtabpage.directory.source", "data:text/plain,"); // Bug 16316 - pref("browser.newtabpage.enhanced", false); // Bug 16316 - Avoid potential confusion over tiles for now. pref("browser.newtabpage.introShown", true); // Bug 16316 - Avoid potential confusion over tiles for now. pref("browser.newtabpage.preload", false); // Bug 16316 - Avoid potential confusion over tiles for now. +pref("browser.newtabpage.remote", false); // Bug 21685: Disable remote new tab pages pref("browser.search.countryCode", "US"); // The next three prefs disable GeoIP search lookups (#16254) pref("browser.search.region", "US"); pref("browser.search.geoip.url", "");

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 12 May '17

12 May '17

commit 1b6559c0763f2ae0c9ad56307642e6d6462c3ede Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Tue Apr 25 11:46:52 2017 -0700 fixup! TB4: Tor Browser's Firefox preference overrides. Bug 10286: Disable Touch API --- browser/app/profile/000-tor-browser.js | 1 + 1 file changed, 1 insertion(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index b8c3f41..be74849 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -160,6 +160,7 @@ pref("privacy.use_utc_timezone", true); pref("media.webspeech.synth.enabled", false); // Bug 10283: Disable SpeechSynthesis API pref("dom.webaudio.enabled", false); // Bug 13017: Disable Web Audio API pref("dom.maxHardwareConcurrency", 1); // Bug 21675: Spoof single-core cpu +pref("dom.w3c_touch_events.enabled", 0); // Bug 10286: Always disable Touch API // Third party stuff pref("network.cookie.cookieBehavior", 1);

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] Bug 10286: Regression tests for Touch API fingerprinting resistance
by gk＠torproject.org 12 May '17

12 May '17

commit 00d2bfb5067659c352690c06cb85a8b76bc7addb Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Wed Apr 26 08:57:21 2017 -0700 Bug 10286: Regression tests for Touch API fingerprinting resistance Also, fix typo in EventUtils.js --- dom/events/test/mochitest.ini | 1 + .../test_touchevent_resist_fingerprinting.html | 68 ++++++++++++++++++++++ testing/mochitest/tests/SimpleTest/EventUtils.js | 2 +- 3 files changed, 70 insertions(+), 1 deletion(-) diff --git a/dom/events/test/mochitest.ini b/dom/events/test/mochitest.ini index 4322a7b..92e68f3 100644 --- a/dom/events/test/mochitest.ini +++ b/dom/events/test/mochitest.ini @@ -185,3 +185,4 @@ skip-if = toolkit == 'android' #CRASH_DUMP, RANDOM [test_wheel_default_action.html] [test_bug687787.html] [test_bug1298970.html] +[test_touchevent_resist_fingerprinting.html] diff --git a/dom/events/test/test_touchevent_resist_fingerprinting.html b/dom/events/test/test_touchevent_resist_fingerprinting.html new file mode 100644 index 0000000..8ba7925 --- /dev/null +++ b/dom/events/test/test_touchevent_resist_fingerprinting.html @@ -0,0 +1,68 @@ +<!DOCTYPE HTML> +<html> + + <head> + <meta charset="utf-8"> + <title>Test for Tor Bug 10286</title> + <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/> + </head> + <body> + <div id="target0">target0</div> + <script type="application/javascript"> + SimpleTest.waitForExplicitFinish(); + + let promiseEvent = (target, eventName) => { + return new Promise(resolve => { + target.addEventListener(eventName, function eventOccurred(event) { + target.removeEventListener(eventName, eventOccurred, false); + resolve(event); + }, false); + }); + } + + let promiseTouchEvent = (target, type, offsetX, offsetY, params) => { + let touchEventPromise = promiseEvent(target, type); + params.type = type; + synthesizeTouch(target, offsetX, offsetY, params); + return touchEventPromise; + }; + + let target0 = document.getElementById("target0"); + let touchParams = { force: 1.0, angle: 1.0, rx: 2, ry: 3 }; + + let runTest = async () => { + await SpecialPowers.pushPrefEnv( + { set: [["dom.w3c_touch_events.enabled", 1]] }); + for (let resist of [false, true]) { + await SpecialPowers.pushPrefEnv( + { set: [["privacy.resistFingerprinting", resist]] }); + info("starting test with fingerprinting resistance " + + (resist ? "on" : "off")); + let touchEvent = await promiseTouchEvent(target0, "touchstart", + 5, 5, touchParams); + info("touch event received"); + let touch = touchEvent.touches[0]; + if (resist) { + is(touch.screenX, touch.clientX, + "touch.screenX should be the same as touch.clientX"); + is(touch.screenY, touch.clientY, + "touch.screenY should be the same as touch.clientY"); + } + is(touch.force, resist ? 0.0 : touchParams.force, "touch.force"); + is(touch.radiusX, resist ? 1 : touchParams.rx, "touch.radiusX"); + is(touch.radiusY, resist ? 1 : touchParams.ry, "touch.radiusY"); + is(touch.rotationAngle, resist ? 0 : touchParams.angle, + "touch.rotationAngle"); + } + } + + window.onload = () => { + runTest().then(() => SimpleTest.finish()); + }; + </script> + </body> +</html> diff --git a/testing/mochitest/tests/SimpleTest/EventUtils.js b/testing/mochitest/tests/SimpleTest/EventUtils.js index a0df2d5..c36a480 100644 --- a/testing/mochitest/tests/SimpleTest/EventUtils.js +++ b/testing/mochitest/tests/SimpleTest/EventUtils.js @@ -395,7 +395,7 @@ function synthesizeTouchAtPoint(left, top, aEvent, aWindow = window) if (utils) { var id = aEvent.id || 0; var rx = aEvent.rx || 1; - var ry = aEvent.rx || 1; + var ry = aEvent.ry || 1; var angle = aEvent.angle || 0; var force = aEvent.force || 1; var modifiers = _parseModifiers(aEvent, aWindow);

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] Bug 10286: Touch API fingerprinting resistance
by gk＠torproject.org 12 May '17

12 May '17

commit 331f089d6b6ba62463d8362d7ca01641a4cc92dc Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Mon Apr 24 08:18:25 2017 -0700 Bug 10286: Touch API fingerprinting resistance --- dom/events/Touch.cpp | 7 +++++++ dom/events/Touch.h | 16 ++++++++++------ 2 files changed, 17 insertions(+), 6 deletions(-) diff --git a/dom/events/Touch.cpp b/dom/events/Touch.cpp index a538fa6..39d50e3 100644 --- a/dom/events/Touch.cpp +++ b/dom/events/Touch.cpp @@ -188,5 +188,12 @@ Touch::GetParentObject() return mTarget->GetOwnerGlobal(); } +bool +Touch::ResistFingerprinting() const +{ + return !nsContentUtils::LegacyIsCallerChromeOrNativeCode() && + nsContentUtils::ResistFingerprinting(); +} + } // namespace dom } // namespace mozilla diff --git a/dom/events/Touch.h b/dom/events/Touch.h index f98f7f9..858fb16 100644 --- a/dom/events/Touch.h +++ b/dom/events/Touch.h @@ -67,16 +67,19 @@ public: // WebIDL int32_t Identifier() const { return mIdentifier; } EventTarget* GetTarget() const; - int32_t ScreenX() const { return mScreenPoint.x; } - int32_t ScreenY() const { return mScreenPoint.y; } + int32_t ScreenX() const { return ResistFingerprinting() ? + mClientPoint.x : mScreenPoint.x; } + int32_t ScreenY() const { return ResistFingerprinting() ? + mClientPoint.y : mScreenPoint.y; } int32_t ClientX() const { return mClientPoint.x; } int32_t ClientY() const { return mClientPoint.y; } int32_t PageX() const { return mPagePoint.x; } int32_t PageY() const { return mPagePoint.y; } - int32_t RadiusX() const { return mRadius.x; } - int32_t RadiusY() const { return mRadius.y; } - float RotationAngle() const { return mRotationAngle; } - float Force() const { return mForce; } + int32_t RadiusX() const { return ResistFingerprinting() ? 1 : mRadius.x; } + int32_t RadiusY() const { return ResistFingerprinting() ? 1 : mRadius.y; } + float RotationAngle() const { return ResistFingerprinting() ? + 0.0 : mRotationAngle; } + float Force() const { return ResistFingerprinting() ? 0.0 : mForce; } nsCOMPtr<EventTarget> mTarget; LayoutDeviceIntPoint mRefPoint; @@ -90,6 +93,7 @@ public: float mRotationAngle; float mForce; protected: + bool ResistFingerprinting() const; ~Touch(); bool mPointsInitialized;

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] Bug 13612: Disable Social API
by gk＠torproject.org 12 May '17

12 May '17

commit bd30c7b878b8c4a3a033db65f1f6dbfa46f543d4 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Thu May 11 15:13:36 2017 -0700 Bug 13612: Disable Social API --- browser/app/profile/000-tor-browser.js | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index d422694..b8c3f41 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -107,6 +107,14 @@ pref("browser.pocket.api", ""); pref("browser.pocket.site", ""); pref("network.http.referer.hideOnionSource", true); +// Disable Social API and related stuff (Bug #13612) +pref("social.directories", ""); +pref("social.remote-install.enabled", false); +pref("social.share.activationPanelEnabled", false); +pref("social.shareDirectory", ""); +pref("social.toast-notifications.enabled", false); +pref("social.whitelist", ""); + // Fingerprinting pref("webgl.min_capability_mode", true); pref("webgl.disable-extensions", true);

1 0

[tor-browser-build/master] Allow changing logs directory using RBM_LOGS_DIR environment variable
by boklm＠torproject.org 11 May '17

11 May '17

commit 43276de96ca5907cd07d388d8027bf3210a9e067 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu May 11 17:38:02 2017 +0200 Allow changing logs directory using RBM_LOGS_DIR environment variable --- rbm.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rbm.conf b/rbm.conf index 969922c..ce70215 100644 --- a/rbm.conf +++ b/rbm.conf @@ -2,7 +2,7 @@ debug: '[% GET ! ENV.RBM_NO_DEBUG %]' compress_tar: gz output_dir: "out/[% project %]" -build_log: 'logs/[% project %]-[% c("var/osname") %].log' +build_log: '[% GET ENV.RBM_LOGS_DIR ? ENV.RBM_LOGS_DIR : "logs" %]/[% project %]-[% c("var/osname") %].log' pkg_type: build

1 0

[tor-browser-bundle/master] Bug 21779: Non-admin users can't access Tor Browser on macOS.
by gk＠torproject.org 10 May '17

10 May '17

commit f27d2cab4ed80a4c7b4f594b593b6b90f6148a82 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Wed May 10 15:14:05 2017 -0400 Bug 21779: Non-admin users can't access Tor Browser on macOS. Use chmod to grant permission for "other" to access files within TorBrowser.app. --- gitian/descriptors/mac/gitian-bundle.yml | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/gitian/descriptors/mac/gitian-bundle.yml b/gitian/descriptors/mac/gitian-bundle.yml index a2c8408..54ce237 100644 --- a/gitian/descriptors/mac/gitian-bundle.yml +++ b/gitian/descriptors/mac/gitian-bundle.yml @@ -303,7 +303,11 @@ script: | rm -f precomplete python $MARTOOLS/createprecomplete.py popd - # + + # Ensure that files and directories are accessible by non-admin users + # if the app bundle is placed in /Applications. See bug 21779. + chmod -R o+rX ~/build/$TORBROWSER_NAME.app + # Create full MAR file and disk image. MAR_FILE=tor-browser-osx${GBUILD_BITS}-${TORBROWSER_VERSION}_${PKG_LOCALE}.mar MAR=$MARTOOLS/mar MBSDIFF=$MARTOOLS/mbsdiff $MARTOOLS/make_full_update.sh -q $OUTDIR/$MAR_FILE ~/build/$TORBROWSER_NAME.app @@ -341,7 +345,12 @@ script: | rm -f precomplete python $MARTOOLS/createprecomplete.py popd - # + + # Ensure that files and directories are accessible by non-admin users + # if the app bundle is placed in /Applications. See bug 21779. + chmod -R o+rX ~/build/dmg/$DEST.app + + # Create full MAR file and disk image. MAR_FILE=tor-browser-osx${GBUILD_BITS}-${TORBROWSER_VERSION}_$LANG.mar MAR=$MARTOOLS/mar MBSDIFF=$MARTOOLS/mbsdiff $MARTOOLS/make_full_update.sh -q $OUTDIR/$MAR_FILE ~/build/dmg/$DEST.app # Rename the Japanese bundle to not confuse users

1 0

[tor-browser-bundle/master] Bug 21879: Use our default bookmarks on OSX.
by gk＠torproject.org 10 May '17

10 May '17

commit 57f088b981a0292d5370b3c56c6d7e5a18f95aca Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Wed May 10 11:59:39 2017 -0400 Bug 21879: Use our default bookmarks on OSX. Account for the changes Mozilla to support localized default bookmarks (see: https://bugzilla.mozilla.org/show_bug.cgi?id=1235107) Currently, Tor Browser uses the same bookmarks for all locales. --- gitian/descriptors/mac/gitian-bundle.yml | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/gitian/descriptors/mac/gitian-bundle.yml b/gitian/descriptors/mac/gitian-bundle.yml index 8c7bbfc..a2c8408 100644 --- a/gitian/descriptors/mac/gitian-bundle.yml +++ b/gitian/descriptors/mac/gitian-bundle.yml @@ -231,10 +231,11 @@ script: | unzip omni.ja defaults/preferences/000-tor-browser.js cp defaults/preferences/000-tor-browser.js ~/build/ if [ "z$DATA_OUTSIDE_APP_DIR" = "z1" ]; then - # Embed our default bookmarks. - mkdir -p defaults/profile/ - cp -p ~/build/bookmarks.html defaults/profile/ - zip -Xm omni.ja defaults/profile/bookmarks.html + # Embed our default bookmarks within the en-US locale. + mkdir -p chrome/en-US/locale/browser + cp -p ~/build/bookmarks.html chrome/en-US/locale/browser/ + zip -Xm omni.ja chrome/en-US/locale/browser/bookmarks.html + rm -rf chrome fi # Set the locale of the bundle. echo "pref(\"general.useragent.locale\", \"en-US\");" >> defaults/preferences/000-tor-browser.js @@ -260,8 +261,8 @@ script: | unzip mac-langpacks.zip MAC_LOCALES="$BUNDLE_LOCALES $BUNDLE_LOCALES_MAC" - # Prepare our language packs for using the proper search engines. See bug - # 18915 for more details. + # Prepare our language packs for using the proper search engines and embed + # our default bookmarks. See bugs 18915 and 21879 for more details. for LANG in $MAC_LOCALES do xpi=mac-langpacks/$LANG.xpi @@ -269,6 +270,7 @@ script: | search_plugins_path=prep_$LANG/browser/chrome/$LANG/locale/browser rm -rf $search_plugins_path/searchplugins cp -rf ~/build/searchplugins $search_plugins_path + cp ~/build/bookmarks.html prep_$LANG/browser/chrome/$LANG/locale/browser/ rm $xpi cd prep_$LANG ~/build/dzip.sh ../$xpi .

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] Bug 21569: Add first-party domain to Permissions key
by gk＠torproject.org 10 May '17

10 May '17

commit d8b12ca703cd530b5c7684be00d5979fb1543705 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Wed Apr 19 15:54:41 2017 -0700 Bug 21569: Add first-party domain to Permissions key --- .../originattributes/test/browser/browser.ini | 1 + .../test/browser/browser_permissions_isolation.js | 46 ++++++++++++++++++++++ caps/BasePrincipal.cpp | 24 ----------- caps/BasePrincipal.h | 4 -- dom/permission/PermissionStatus.cpp | 2 +- extensions/cookie/nsPermission.cpp | 4 +- extensions/cookie/nsPermissionManager.cpp | 9 ----- 7 files changed, 50 insertions(+), 40 deletions(-) diff --git a/browser/components/originattributes/test/browser/browser.ini b/browser/components/originattributes/test/browser/browser.ini index d503e9e..6de2ce9 100644 --- a/browser/components/originattributes/test/browser/browser.ini +++ b/browser/components/originattributes/test/browser/browser.ini @@ -70,3 +70,4 @@ support-files = [browser_clientAuth.js] [browser_cacheAPI.js] [browser_permissions.js] +[browser_permissions_isolation.js] diff --git a/browser/components/originattributes/test/browser/browser_permissions_isolation.js b/browser/components/originattributes/test/browser/browser_permissions_isolation.js new file mode 100644 index 0000000..0fd5355 --- /dev/null +++ b/browser/components/originattributes/test/browser/browser_permissions_isolation.js @@ -0,0 +1,46 @@ +/** + * Tor Bug 21569 - A test case for permissions isolation. + */ + +const TEST_PAGE = "http://mochi.test:8888/browser/browser/components/" + + "originattributes/test/browser/file_firstPartyBasic.html"; + +function* init() { + let permPromise = TestUtils.topicObserved("perm-changed"); + Services.perms.removeAll(); + info("called removeAll"); + yield permPromise; + info("cleared permissions for new test"); +} + +// Define the testing function +function* doTest(aBrowser) { + // Promise will result when permissions popup appears: + let popupShowPromise = BrowserTestUtils.waitForEvent(PopupNotifications.panel, "popupshown"); + let originalStatus = yield ContentTask.spawn(aBrowser, null, function* (key) { + let status = (yield content.navigator.permissions.query({name: "notifications"})).state; + content.Notification.requestPermission(); + return status; + }); + info(`originalStatus: '${originalStatus}'`); + if (originalStatus === "prompt") { + // Wait for the popup requesting permission to show notifications: + yield popupShowPromise; + let popupHidePromise = BrowserTestUtils.waitForEvent(PopupNotifications.panel, "popuphidden"); + let popupNotification = PopupNotifications.panel.childNodes[0]; + // Click to grant permission: + popupNotification.button.click(); + // Wait for popup to hide again. + yield popupHidePromise; + } + return originalStatus; +} + +add_task(function* () { + yield SpecialPowers.pushPrefEnv({ + set: [["dom.webnotifications.enabled", true]] + }); + IsolationTestTools.runTests(TEST_PAGE, doTest, + (isolated, val1, val2) => (isolated === ( val2 === "prompt")), + init, true); +}); diff --git a/caps/BasePrincipal.cpp b/caps/BasePrincipal.cpp index 836adcb..584cb41 100644 --- a/caps/BasePrincipal.cpp +++ b/caps/BasePrincipal.cpp @@ -61,13 +61,6 @@ PrincipalOriginAttributes::InheritFromNecko(const NeckoOriginAttributes& aAttrs) } void -PrincipalOriginAttributes::StripUserContextIdAndFirstPartyDomain() -{ - mUserContextId = nsIScriptSecurityManager::DEFAULT_USER_CONTEXT_ID; - mFirstPartyDomain.Truncate(); -} - -void DocShellOriginAttributes::InheritFromDocToChildDocShell(const PrincipalOriginAttributes& aAttrs) { mAppId = aAttrs.mAppId; @@ -727,23 +720,6 @@ BasePrincipal::CreateCodebasePrincipal(const nsACString& aOrigin) return BasePrincipal::CreateCodebasePrincipal(uri, attrs); } -already_AddRefed<BasePrincipal> -BasePrincipal::CloneStrippingUserContextIdAndFirstPartyDomain() -{ - PrincipalOriginAttributes attrs = OriginAttributesRef(); - attrs.StripUserContextIdAndFirstPartyDomain(); - - nsAutoCString originNoSuffix; - nsresult rv = GetOriginNoSuffix(originNoSuffix); - NS_ENSURE_SUCCESS(rv, nullptr); - - nsCOMPtr<nsIURI> uri; - rv = NS_NewURI(getter_AddRefs(uri), originNoSuffix); - NS_ENSURE_SUCCESS(rv, nullptr); - - return BasePrincipal::CreateCodebasePrincipal(uri, attrs); -} - bool BasePrincipal::AddonAllowsLoad(nsIURI* aURI) { diff --git a/caps/BasePrincipal.h b/caps/BasePrincipal.h index 4c9ad9c..963b6ab 100644 --- a/caps/BasePrincipal.h +++ b/caps/BasePrincipal.h @@ -107,8 +107,6 @@ public: // Inherit OriginAttributes from Necko. void InheritFromNecko(const NeckoOriginAttributes& aAttrs); - - void StripUserContextIdAndFirstPartyDomain(); }; // For OriginAttributes stored on docshells / loadcontexts / browsing contexts. @@ -311,8 +309,6 @@ public: virtual PrincipalKind Kind() = 0; - already_AddRefed<BasePrincipal> CloneStrippingUserContextIdAndFirstPartyDomain(); - protected: virtual ~BasePrincipal(); diff --git a/dom/permission/PermissionStatus.cpp b/dom/permission/PermissionStatus.cpp index 680ece1..850dcee 100644 --- a/dom/permission/PermissionStatus.cpp +++ b/dom/permission/PermissionStatus.cpp @@ -107,7 +107,7 @@ PermissionStatus::GetPrincipal() const } nsCOMPtr<nsIPrincipal> principal = - mozilla::BasePrincipal::Cast(doc->NodePrincipal())->CloneStrippingUserContextIdAndFirstPartyDomain(); + mozilla::BasePrincipal::Cast(doc->NodePrincipal()); NS_ENSURE_TRUE(principal, nullptr); return principal.forget(); diff --git a/extensions/cookie/nsPermission.cpp b/extensions/cookie/nsPermission.cpp index 3d1eb14..3dac32e 100644 --- a/extensions/cookie/nsPermission.cpp +++ b/extensions/cookie/nsPermission.cpp @@ -36,7 +36,7 @@ nsPermission::Create(nsIPrincipal* aPrincipal, { NS_ENSURE_TRUE(aPrincipal, nullptr); nsCOMPtr<nsIPrincipal> principal = - mozilla::BasePrincipal::Cast(aPrincipal)->CloneStrippingUserContextIdAndFirstPartyDomain(); + mozilla::BasePrincipal::Cast(aPrincipal); NS_ENSURE_TRUE(principal, nullptr); @@ -90,7 +90,7 @@ nsPermission::Matches(nsIPrincipal* aPrincipal, bool aExactHost, bool* aMatches) *aMatches = false; nsCOMPtr<nsIPrincipal> principal = - mozilla::BasePrincipal::Cast(aPrincipal)->CloneStrippingUserContextIdAndFirstPartyDomain(); + mozilla::BasePrincipal::Cast(aPrincipal); if (!principal) { *aMatches = false; diff --git a/extensions/cookie/nsPermissionManager.cpp b/extensions/cookie/nsPermissionManager.cpp index d3696dd..860531b 100644 --- a/extensions/cookie/nsPermissionManager.cpp +++ b/extensions/cookie/nsPermissionManager.cpp @@ -122,9 +122,6 @@ GetOriginFromPrincipal(nsIPrincipal* aPrincipal, nsACString& aOrigin) // any knowledge of private browsing. Allowing it to be true changes the suffix being hashed. attrs.mPrivateBrowsingId = 0; - // Disable userContext and firstParty isolation for permissions. - attrs.StripUserContextIdAndFirstPartyDomain(); - attrs.CreateSuffix(suffix); aOrigin.Append(suffix); return NS_OK; @@ -139,9 +136,6 @@ GetPrincipalFromOrigin(const nsACString& aOrigin, nsIPrincipal** aPrincipal) return NS_ERROR_FAILURE; } - // Disable userContext and firstParty isolation for permissions. - attrs.StripUserContextIdAndFirstPartyDomain(); - nsCOMPtr<nsIURI> uri; nsresult rv = NS_NewURI(getter_AddRefs(uri), originNoSuffix); NS_ENSURE_SUCCESS(rv, rv); @@ -2201,9 +2195,6 @@ nsPermissionManager::GetPermissionHashKey(nsIPrincipal* aPrincipal, mozilla::PrincipalOriginAttributes attrs = mozilla::BasePrincipal::Cast(aPrincipal)->OriginAttributesRef(); - // Disable userContext and firstParty isolation for permissions. - attrs.StripUserContextIdAndFirstPartyDomain(); - nsCOMPtr<nsIPrincipal> principal = mozilla::BasePrincipal::CreateCodebasePrincipal(newURI, attrs);

1 0

[tor-browser-bundle/master] Bug 20683: Bump elfutils version as well
by gk＠torproject.org 10 May '17

10 May '17

commit 3e752843dfa39beec844822c9f6c3dd1f80355ea Author: Georg Koppen <gk(a)torproject.org> Date: Wed May 10 07:37:19 2017 +0000 Bug 20683: Bump elfutils version as well --- gitian/versions.alpha | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 063ce76..2179f8d 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -72,7 +72,7 @@ GO14_VER=1.4.3 GO_VER=1.8.1 NSIS_VER=2.51 YASM_VER=1.2.0 -ELFUTILS_VER=0.160 +ELFUTILS_VER=0.166 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz

1 0

[tor-browser-bundle/master] Stop our multi lingual experiment on nightlies
by gk＠torproject.org 10 May '17

10 May '17

commit db5cdfceb8fa095ad94eb9a413a35d30ccc60486 Author: Georg Koppen <gk(a)torproject.org> Date: Wed May 10 07:48:17 2017 +0000 Stop our multi lingual experiment on nightlies We are not showing the language prompt on first start anymore. Thus, the multi lingual setup has stopped working for nightlies. We remove that experiment until we solve #17400 properly or have a new prototype to try. --- gitian/versions.nightly | 4 ---- 1 file changed, 4 deletions(-) diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 533aead..2189139 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -11,10 +11,6 @@ BUILD_PT_BUNDLES=1 # DATA_OUTSIDE_APP_DIR is only implemented for Mac OS. DATA_OUTSIDE_APP_DIR=1 -# If you remove MULTI_LINGUAL=1, be sure to use a version of Tor Launcher -# that does not include the language prompt. -MULTI_LINGUAL=1 - VERIFY_TAGS=0 FIREFOX_VERSION=52.1.0esr

1 0

[tor-browser-bundle/master] Bug 20683: Use signed selfrando tag from now on
by gk＠torproject.org 10 May '17

10 May '17

commit 8fe0e322b950efa2456502428bee66dde8b4948a Author: Georg Koppen <gk(a)torproject.org> Date: Wed May 10 08:05:28 2017 +0000 Bug 20683: Use signed selfrando tag from now on --- gitian/gpg/selfrando.gpg | Bin 0 -> 2759 bytes gitian/verify-tags.sh | 2 +- gitian/versions.alpha | 2 +- gitian/versions.nightly | 2 +- 4 files changed, 3 insertions(+), 3 deletions(-) diff --git a/gitian/gpg/selfrando.gpg b/gitian/gpg/selfrando.gpg new file mode 100644 index 0000000..276955d Binary files /dev/null and b/gitian/gpg/selfrando.gpg differ diff --git a/gitian/verify-tags.sh b/gitian/verify-tags.sh index 7d551b8..123719d 100755 --- a/gitian/verify-tags.sh +++ b/gitian/verify-tags.sh @@ -105,6 +105,7 @@ obfs4 obfs4proxy.gpg $OBFS4_TAG https-everywhere https-everywhere.gpg $HTTPSE_TAG cmake cmake.gpg $CMAKE_TAG sandbox obfs4proxy.gpg $SANDBOX_TAG +selfrando selfrando.gpg $SELFRANDO_TAG EOF while read dir commit; do @@ -125,7 +126,6 @@ depot_tools $DEPOT_TOOLS_TAG go-webrtc $GO_WEBRTC_TAG snowflake $SNOWFLAKE_TAG uniuri $UNIURI_TAG -selfrando $SELFRANDO_TAG EOF # Verify signatures on signed packages diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 33be86d..063ce76 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -47,7 +47,7 @@ WEBRTC_TAG=c279861207c5b15fc51069e96595782350e0ac12 # https://chromium.googlesou GO_WEBRTC_TAG=ab1b64862e0c4b4182010699911c2c5818f0a101 SNOWFLAKE_TAG=9f2e9a6ecb696149708716ca06ce842df03cf492 UNIURI_TAG=8902c56451e9b58ff940bbe5fec35d5f9c04584a -SELFRANDO_TAG=aa4130fe9d782ff7ef581555ef3470663b110bdb +SELFRANDO_TAG=tb-v0.2 GITIAN_TAG=tor-browser-builder-4-4 diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 69ddb47..533aead 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -54,7 +54,7 @@ WEBRTC_TAG=c279861207c5b15fc51069e96595782350e0ac12 # https://chromium.googlesou GO_WEBRTC_TAG=master SNOWFLAKE_TAG=master UNIURI_TAG=master -SELFRANDO_TAG=aa4130fe9d782ff7ef581555ef3470663b110bdb +SELFRANDO_TAG=tb-v0.2 GITIAN_TAG=tor-browser-builder-4

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! Omnibox: Add DDG, Startpage, Disconnect, Youtube, Twitter;
by gk＠torproject.org 10 May '17

10 May '17

commit e6b99c78fdc1800988537c73ef13e75b56c28b3e Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue May 9 15:29:43 2017 -0400 fixup! Omnibox: Add DDG, Startpage, Disconnect, Youtube, Twitter; remove Amazon, eBay, bing. Use a data: URL for the browser.search.defaultenginename preference value so that the value is used when setting the default search engine. Fixes bug #22044. --- browser/app/profile/000-tor-browser.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 27cfe53..d422694 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -267,7 +267,7 @@ pref("browser.uiCustomization.state", "{\"placements\":{\"PanelUI-contents\":[\" // Putting the search engine prefs into this file to fix #11236. // Default search engine -pref("browser.search.defaultenginename", "DuckDuckGo"); +pref("browser.search.defaultenginename", "data:text/plain,browser.search.defaultenginename=DuckDuckGo"); // Make sure we use the same search engine regardless of locale pref("browser.search.geoSpecificDefaults", false);

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] Bug 16337: Round times exposed by Animation API to nearest 100ms
by gk＠torproject.org 10 May '17

10 May '17

commit 77f0de013fa2b5bedb851507f5ec94a8f39f8b8c Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Wed May 3 23:47:53 2017 -0700 Bug 16337: Round times exposed by Animation API to nearest 100ms --- dom/animation/AnimationUtils.h | 3 +- dom/animation/test/mochitest.ini | 1 + .../test/test_animation_time_rounding.html | 43 ++++++++++++++++++++++ 3 files changed, 46 insertions(+), 1 deletion(-) diff --git a/dom/animation/AnimationUtils.h b/dom/animation/AnimationUtils.h index 82ae69b..e20f314 100644 --- a/dom/animation/AnimationUtils.h +++ b/dom/animation/AnimationUtils.h @@ -28,7 +28,8 @@ public: dom::Nullable<double> result; if (!aTime.IsNull()) { - result.SetValue(aTime.Value().ToMilliseconds()); + double unrounded = aTime.Value().ToMilliseconds(); + result.SetValue(floor(unrounded / 100) * 100); } return result; diff --git a/dom/animation/test/mochitest.ini b/dom/animation/test/mochitest.ini index feb4245..49d230c 100644 --- a/dom/animation/test/mochitest.ini +++ b/dom/animation/test/mochitest.ini @@ -109,3 +109,4 @@ skip-if = toolkit == 'android' [style/test_animation-seeking-with-start-time.html] [style/test_animation-setting-effect.html] [style/test_animation-setting-spacing.html] +[test_animation_time_rounding.html] diff --git a/dom/animation/test/test_animation_time_rounding.html b/dom/animation/test/test_animation_time_rounding.html new file mode 100644 index 0000000..baad593 --- /dev/null +++ b/dom/animation/test/test_animation_time_rounding.html @@ -0,0 +1,43 @@ +<!DOCTYPE HTML> +<html> +  + <head> + <meta charset="utf-8"> + <title>Test for Tor Bug 16337</title> + <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/> + </head> + <body> + <div id="testDiv">test</div> + <script type="application/javascript"> + SimpleTest.waitForExplicitFinish(); + let runTest = async function () { + await SpecialPowers.pushPrefEnv({ set: [["dom.animations-api.core.enabled", true]] }); + let isRounded = x => (Math.floor(x/100)*100) === x; + let testDiv = document.getElementById("testDiv"); + let animation = testDiv.animate({ opacity: [0,1] }, 100000); + animation.play(); + SimpleTest.waitForCondition( + () => animation.currentTime > 1000, + function () { + ok(isRounded(animation.startTime), + "animation.startTime is rounded"); + ok(isRounded(animation.currentTime), + "animation.currentTime is rounded"); + ok(isRounded(animation.timeline.currentTime), + "animation.timeline.currentTime is rounded"); + if (document.timeline) { + ok(isRounded(document.timeline.currentTime), + "document.timeline.currentTime is rounded"); + } + SimpleTest.finish(); + }, + "animation failed to start"); + } + + window.onload = runTest; + </script> + </body> +</html>

1 0

[tor-browser-bundle/master] Bug 20683: Integrate Selfrando into alpha Linux builds
by gk＠torproject.org 08 May '17

08 May '17

commit 332c5b6c16f1b0915f537a4ad5af48295f80c733 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Apr 25 11:20:53 2017 +0000 Bug 20683: Integrate Selfrando into alpha Linux builds Selfrando is a new defense against code reuse attacks developed by the Redactor and Readactor++ people. We should give it a wider testing audience by including it in the alpha series. This is currently only available for 64bit Linux builds, though. Supporting other platforms and architectures is work in progress. --- RelativeLink/start-tor-browser | 1 + gitian/descriptors/linux/gitian-firefox.yml | 17 +++++ gitian/descriptors/linux/gitian-utils.yml | 46 +++++++++++++ gitian/fetch-inputs.sh | 4 +- gitian/gpg/ELFUTILS.gpg | Bin 0 -> 10483 bytes gitian/mkbundle-linux.sh | 13 ++-- gitian/patches/binutils-224-gold.patch | 98 ++++++++++++++++++++++++++++ gitian/verify-tags.sh | 3 +- gitian/versions.alpha | 4 ++ gitian/versions.nightly | 4 ++ 10 files changed, 183 insertions(+), 7 deletions(-) diff --git a/RelativeLink/start-tor-browser b/RelativeLink/start-tor-browser index a78b367..2dd40fc 100755 --- a/RelativeLink/start-tor-browser +++ b/RelativeLink/start-tor-browser @@ -270,6 +270,7 @@ fi LD_LIBRARY_PATH="${HOME}/TorBrowser/Tor/" export LD_LIBRARY_PATH +export SELFRANDO_write_layout_file= function setControlPortPasswd() { local ctrlPasswd=$1 diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index c9ced44..db4f232 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -27,6 +27,8 @@ reference_datetime: "2000-01-01 00:00:00" remotes: - "url": "https://git.torproject.org/tor-browser.git" "dir": "tor-browser" +- "url": "https://github.com/immunant/selfrando.git" + "dir": "selfrando" files: - "binutils-linux32-utils.zip" - "binutils-linux64-utils.zip" @@ -36,6 +38,8 @@ files: - "re-dzip.sh" - "dzip.sh" - "versions" +# XXX: 64bits only for now :(, see #20683. +- "selfrando-linux64-utils.zip" script: | source versions INSTDIR="$HOME/install" @@ -53,6 +57,11 @@ script: | export DEB_BUILD_HARDENING_FORMAT=1 export DEB_BUILD_HARDENING_PIE=1 # + # XXX: 64bits only for now :(, see #20683. + if [ $GBUILD_BITS == "64" ]; + then + unzip -d $INSTDIR selfrando-linux64-utils.zip + fi # Preparing Binutils and GCC for Tor Browser unzip -d $INSTDIR binutils-linux$GBUILD_BITS-utils.zip # Make sure gold is used with the hardening wrapper for full RELRO, see @@ -94,6 +103,14 @@ script: | find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" rm -f configure rm -f js/src/configure + # XXX: 64bits only for now :(, see #20683. + if [ $GBUILD_BITS == "64" ]; + then + # Selfrando wrapper + export PATH="$HOME/build/selfrando/Tools/TorBrowser/tc-wrapper/:$PATH" + # We need to avoid the shuffling while building as this breaks compilation + export SELFRANDO_skip_shuffle= + fi make -f client.mk configure CONFIGURE_ARGS="--with-tor-browser-version=${TORBROWSER_VERSION} --with-distribution-id=org.torproject --enable-update-channel=${TORBROWSER_UPDATE_CHANNEL} --enable-bundled-fonts" find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" make $MAKEOPTS -f client.mk build diff --git a/gitian/descriptors/linux/gitian-utils.yml b/gitian/descriptors/linux/gitian-utils.yml index d10422b..eb340b8 100644 --- a/gitian/descriptors/linux/gitian-utils.yml +++ b/gitian/descriptors/linux/gitian-utils.yml @@ -24,10 +24,14 @@ packages: - "libssl-dev" # Needed for binutils (64bit) as we are building with PIE enabled. - "libstdc++6-4.7-pic" +# Needed for Selfrando +- "scons" reference_datetime: "2000-01-01 00:00:00" remotes: - "url": "https://github.com/libevent/libevent.git" "dir": "libevent" +- "url": "https://github.com/immunant/selfrando.git" + "dir": "selfrando" files: - "binutils.tar.bz2" - "gcc.tar.bz2" @@ -37,6 +41,8 @@ files: - "go.tar.gz" - "versions" - "dzip.sh" +- "elfutils.tar.bz2" +- "binutils-224-gold.patch" script: | INSTDIR="$HOME/install" source versions @@ -52,6 +58,12 @@ script: | export DEB_BUILD_HARDENING_FORMAT=1 export DEB_BUILD_HARDENING_PIE=1 + ARCH="" + if [ $GBUILD_BITS == "64" ]; + then + ARCH="64" + fi + # Building Binutils tar xjf binutils.tar.bz2 # The libstdc++ shipped by default is non-PIC which breaks the binutils build @@ -63,6 +75,13 @@ script: | export LDFLAGS="-L/home/debian -lstdc++" fi cd binutils* + # We need to work around a gold linker bug in 2.24 to get selfrando working, + # see bug 20683. + # XXX: 64bits only for now :(, see #20683. + if [ $GBUILD_BITS == "64" ]; + then + patch -p1 < ../binutils-224-gold.patch + fi # We want to use gold as the linker in our toolchain mainly as it is way # faster when linking Tor Browser code (especially libxul). But apart from # that it fixes #12103 and issues with ESR 31 and our Gitian setup as well @@ -86,6 +105,28 @@ script: | cd .. export DEB_BUILD_HARDENING_FORMAT=1 + export PATH="$INSTDIR/binutils/bin:$INSTDIR/gcc/bin:$PATH" + export LD_LIBRARY_PATH="$INSTDIR/gcc/lib$ARCH" + + # XXX: 64bits only for now :(, see #20683. + if [ $GBUILD_BITS == "64" ]; + then + # Building Elfutils + tar xjf elfutils.tar.bz2 + cd elfutils*/ + ./configure --prefix=$INSTDIR/elfutils + make $MAKEOPTS + make install + cd .. + + # Building Selfrando + cd selfrando + scons -Q arch=x86_64 LIBELF_PATH="$INSTDIR/elfutils" FORCE_INPLACE=1 DEBUG_LEVEL=env WRITE_LAYOUTS=env LOG=console + mkdir -p $INSTDIR/selfrando + cp out/x86_64/bin/* $INSTDIR/selfrando/ + cd .. + fi + # Building Libevent cd libevent ./autogen.sh @@ -157,4 +198,9 @@ script: | ~/build/dzip.sh libevent-${LIBEVENT_TAG#release-}-linux$GBUILD_BITS-utils.zip libevent ~/build/dzip.sh gmp-$GMP_VER-linux$GBUILD_BITS-utils.zip gmp ~/build/dzip.sh go-$GO_VER-linux$GBUILD_BITS-utils.zip go + # XXX: 64bits only for now :(, see #20683. + if [ $GBUILD_BITS == "64" ]; + then + ~/build/dzip.sh selfrando-$SELFRANDO_TAG-linux$GBUILD_BITS-utils.zip selfrando + fi cp *utils.zip $OUTDIR/ diff --git a/gitian/fetch-inputs.sh b/gitian/fetch-inputs.sh index b7fcf36..c110eb8 100755 --- a/gitian/fetch-inputs.sh +++ b/gitian/fetch-inputs.sh @@ -113,7 +113,7 @@ update_git() { ############################################################################## # Get+verify sigs that exist -for i in OPENSSL BINUTILS GCC PYTHON_MSI GMP LLVM CFE LIBCXX LIBCXXABI +for i in OPENSSL BINUTILS GCC PYTHON_MSI GMP LLVM CFE LIBCXX LIBCXXABI ELFUTILS do PACKAGE="${i}_PACKAGE" URL="${i}_URL" @@ -252,6 +252,7 @@ ln -sf "$GO_PACKAGE" go.tar.gz ln -sf "$NSIS_PACKAGE" nsis.tar.bz2 ln -sf "$NSIS_DEBIAN_PACKAGE" nsis-debian.tar.xz ln -sf "$YASM_PACKAGE" yasm.tar.gz +ln -sf "$ELFUTILS_PACKAGE" elfutils.tar.bz2 # Fetch latest gitian-builder itself # XXX - this is broken if a non-standard inputs dir is selected using the command line flag. @@ -303,6 +304,7 @@ depot_tools https://chromium.googlesource.com/chromium/tools/depot_too go-webrtc https://github.com/keroserene/go-webrtc $GO_WEBRTC_TAG snowflake https://git.torproject.org/pluggable-transports/snowflake.git $SNOWFLAKE_TAG uniuri https://github.com/dchest/uniuri $UNIURI_TAG +selfrando https://github.com/immunant/selfrando.git $SELFRANDO_TAG EOF # HTTPS-Everywhere is special, too. We need to initialize the git submodules and diff --git a/gitian/gpg/ELFUTILS.gpg b/gitian/gpg/ELFUTILS.gpg new file mode 100644 index 0000000..f1cd4b3 Binary files /dev/null and b/gitian/gpg/ELFUTILS.gpg differ diff --git a/gitian/mkbundle-linux.sh b/gitian/mkbundle-linux.sh index 6dbbe51..0a1613f 100755 --- a/gitian/mkbundle-linux.sh +++ b/gitian/mkbundle-linux.sh @@ -35,7 +35,7 @@ fi if [ -z "$VM_MEMORY" ]; then - export VM_MEMORY=4000 + export VM_MEMORY=6000 fi ./make-vms.sh @@ -99,7 +99,7 @@ then fi cd $GITIAN_DIR - +# XXX: 64bits selfrando only for now :(, see #20683. if [ ! -f inputs/binutils-$BINUTILS_VER-linux32-utils.zip -o \ ! -f inputs/binutils-$BINUTILS_VER-linux64-utils.zip -o \ ! -f inputs/gcc-$GCC_VER-linux32-utils.zip -o \ @@ -111,13 +111,14 @@ if [ ! -f inputs/binutils-$BINUTILS_VER-linux32-utils.zip -o \ ! -f inputs/gmp-$GMP_VER-linux32-utils.zip -o \ ! -f inputs/gmp-$GMP_VER-linux64-utils.zip -o \ ! -f inputs/go-$GO_VER-linux32-utils.zip -o \ - ! -f inputs/go-$GO_VER-linux64-utils.zip ]; + ! -f inputs/go-$GO_VER-linux64-utils.zip -o \ + ! -f inputs/selfrando-$SELFRANDO_TAG-linux64-utils.zip ]; then echo echo "****** Starting Utilities Component of Linux Bundle (1/7 for Linux) ******" echo - ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit libevent=$LIBEVENT_TAG $DESCRIPTOR_DIR/linux/gitian-utils.yml + ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit libevent=$LIBEVENT_TAG,selfrando=$SELFRANDO_TAG $DESCRIPTOR_DIR/linux/gitian-utils.yml if [ $? -ne 0 ]; then #mv var/build.log ./utils-fail-linux.log.`date +%Y%m%d%H%M%S` @@ -138,6 +139,7 @@ then ln -sf gmp-$GMP_VER-linux64-utils.zip gmp-linux64-utils.zip ln -sf go-$GO_VER-linux32-utils.zip go-linux32-utils.zip ln -sf go-$GO_VER-linux64-utils.zip go-linux64-utils.zip + ln -sf selfrando-$SELFRANDO_TAG-linux64-utils.zip selfrando-linux64-utils.zip cd .. #cp -a result/utils-linux-res.yml inputs/ else @@ -159,6 +161,7 @@ else ln -sf gmp-$GMP_VER-linux64-utils.zip gmp-linux64-utils.zip ln -sf go-$GO_VER-linux32-utils.zip go-linux32-utils.zip ln -sf go-$GO_VER-linux64-utils.zip go-linux64-utils.zip + ln -sf selfrando-$SELFRANDO_TAG-linux64-utils.zip selfrando-linux64-utils.zip cd .. fi @@ -193,7 +196,7 @@ then echo "****** Starting TorBrowser Component of Linux Bundle (3/7 for Linux) ******" echo - ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit tor-browser=$TORBROWSER_TAG,faketime=$FAKETIME_TAG $DESCRIPTOR_DIR/linux/gitian-firefox.yml + ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit tor-browser=$TORBROWSER_TAG,faketime=$FAKETIME_TAG,selfrando=$SELFRANDO_TAG $DESCRIPTOR_DIR/linux/gitian-firefox.yml if [ $? -ne 0 ]; then #mv var/build.log ./firefox-fail-linux.log.`date +%Y%m%d%H%M%S` diff --git a/gitian/patches/binutils-224-gold.patch b/gitian/patches/binutils-224-gold.patch new file mode 100644 index 0000000..a45e49c --- /dev/null +++ b/gitian/patches/binutils-224-gold.patch @@ -0,0 +1,98 @@ +From f984741df04cd68bb116073fdfa9405808810ab4 Mon Sep 17 00:00:00 2001 +From: Cary Coutant <ccoutant(a)google.com> +Date: Wed, 5 Feb 2014 22:59:02 -0800 +Subject: [PATCH] Fix issues with gold undefined symbol diagnostics. + +PR binutils/15435 complains that gold issues a visibility error for an +weak undefined symbol with hidden visibility. The message should be +suppressed if the symbol is a weak undef. + +An earlier patch to add an extra note about key functions when a class's +vtable symbol is undefined missed a case where the reference to the +vtable came from a shared library. This patch moves the check to a +lower-level routine that catches both cases. + +gold/ + +2014-02-05 Cary Coutant <ccoutant(a)google.com> + + * errors.cc (Errors::undefined_symbol): Move undef vtable symbol + check to here. + * target-reloc.h (is_strong_undefined): New function. + (relocate_section): Move undef vtable symbol check from here. + Check for is_strong_undefined. + +diff --git a/gold/ChangeLog b/gold/ChangeLog +index dcf7ed41f8..dd7ef72980 100644 +--- a/gold/ChangeLog ++++ b/gold/ChangeLog +@@ -1,3 +1,14 @@ ++2014-02-05 Cary Coutant <ccoutant(a)google.com> ++ ++ Fix issues with gold undefined symbol diagnostics. ++ ++ PR binutils/15435 ++ * errors.cc (Errors::undefined_symbol): Move undef vtable symbol ++ check to here. ++ * target-reloc.h (is_strong_undefined): New function. ++ (relocate_section): Move undef vtable symbol check from here. ++ Check for is_strong_undefined. ++ + 2013-11-22 Cary Coutant <ccoutant(a)google.com> + + * testsuite/Makefile.am (exception_x86_64_bnd_test): Use in-tree +diff --git a/gold/errors.cc b/gold/errors.cc +index b79764bd1d..98db0fdd86 100644 +--- a/gold/errors.cc ++++ b/gold/errors.cc +@@ -193,6 +193,11 @@ Errors::undefined_symbol(const Symbol* sym, const std::string& location) + fprintf(stderr, + _("%s: %s: undefined reference to '%s', version '%s'\n"), + location.c_str(), zmsg, sym->demangled_name().c_str(), version); ++ ++ if (sym->is_cxx_vtable()) ++ gold_info(_("%s: the vtable symbol may be undefined because " ++ "the class is missing its key function"), ++ program_name); + } + + // Issue a debugging message. +diff --git a/gold/target-reloc.h b/gold/target-reloc.h +index b544c78f37..d609bcbaa8 100644 +--- a/gold/target-reloc.h ++++ b/gold/target-reloc.h +@@ -144,6 +144,12 @@ class Default_comdat_behavior + } + }; + ++inline bool ++is_strong_undefined(const Symbol* sym) ++{ ++ return sym->is_undefined() && sym->binding() != elfcpp::STB_WEAK; ++} ++ + // Give an error for a symbol with non-default visibility which is not + // defined locally. + +@@ -411,16 +417,10 @@ relocate_section( + } + + if (issue_undefined_symbol_error(sym)) +- { +- gold_undefined_symbol_at_location(sym, relinfo, i, offset); +- if (sym->is_cxx_vtable()) +- gold_info(_("%s: the vtable symbol may be undefined because " +- "the class is missing its key function"), +- program_name); +- } ++ gold_undefined_symbol_at_location(sym, relinfo, i, offset); + else if (sym != NULL + && sym->visibility() != elfcpp::STV_DEFAULT +- && (sym->is_undefined() || sym->is_from_dynobj())) ++ && (is_strong_undefined(sym) || sym->is_from_dynobj())) + visibility_error(sym); + + if (sym != NULL && sym->has_warning()) +-- +2.11.0 + diff --git a/gitian/verify-tags.sh b/gitian/verify-tags.sh index dc207f5..7d551b8 100755 --- a/gitian/verify-tags.sh +++ b/gitian/verify-tags.sh @@ -125,10 +125,11 @@ depot_tools $DEPOT_TOOLS_TAG go-webrtc $GO_WEBRTC_TAG snowflake $SNOWFLAKE_TAG uniuri $UNIURI_TAG +selfrando $SELFRANDO_TAG EOF # Verify signatures on signed packages -for i in OPENSSL BINUTILS GCC PYTHON_MSI GMP LLVM CFE LIBCXX LIBCXXABI +for i in OPENSSL BINUTILS GCC PYTHON_MSI GMP LLVM CFE LIBCXX LIBCXXABI ELFUTILS do PACKAGE="${i}_PACKAGE" URL="${i}_URL" diff --git a/gitian/versions.alpha b/gitian/versions.alpha index adb9dbf..33be86d 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -47,6 +47,7 @@ WEBRTC_TAG=c279861207c5b15fc51069e96595782350e0ac12 # https://chromium.googlesou GO_WEBRTC_TAG=ab1b64862e0c4b4182010699911c2c5818f0a101 SNOWFLAKE_TAG=9f2e9a6ecb696149708716ca06ce842df03cf492 UNIURI_TAG=8902c56451e9b58ff940bbe5fec35d5f9c04584a +SELFRANDO_TAG=aa4130fe9d782ff7ef581555ef3470663b110bdb GITIAN_TAG=tor-browser-builder-4-4 @@ -71,6 +72,7 @@ GO14_VER=1.4.3 GO_VER=1.8.1 NSIS_VER=2.51 YASM_VER=1.2.0 +ELFUTILS_VER=0.160 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz @@ -105,6 +107,7 @@ NOTOKRFONT_PACKAGE=NotoSansKR-Regular.otf NOTOSCFONT_PACKAGE=NotoSansSC-Regular.otf NOTOTCFONT_PACKAGE=NotoSansTC-Regular.otf YASM_PACKAGE=yasm-${YASM_VER}.tar.gz +ELFUTILS_PACKAGE=elfutils-${ELFUTILS_VER}.tar.bz2 # Hashes for packages with weak sigs or no sigs OPENSSL_HASH=6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 @@ -167,3 +170,4 @@ NOTOKRFONT_URL=${NOTOCJKBASE_URL}/${NOTOKRFONT_PACKAGE} NOTOSCFONT_URL=${NOTOCJKBASE_URL}/${NOTOSCFONT_PACKAGE} NOTOTCFONT_URL=${NOTOCJKBASE_URL}/${NOTOTCFONT_PACKAGE} YASM_URL=https://www.tortall.net/projects/yasm/releases/${YASM_PACKAGE} +ELFUTILS_URL=https://sourceware.org/elfutils/ftp/${ELFUTILS_VER}/${ELFUTILS_PACKAGE} diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 4e1618c..69ddb47 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -54,6 +54,7 @@ WEBRTC_TAG=c279861207c5b15fc51069e96595782350e0ac12 # https://chromium.googlesou GO_WEBRTC_TAG=master SNOWFLAKE_TAG=master UNIURI_TAG=master +SELFRANDO_TAG=aa4130fe9d782ff7ef581555ef3470663b110bdb GITIAN_TAG=tor-browser-builder-4 @@ -78,6 +79,7 @@ GO14_VER=1.4.3 GO_VER=1.8.1 NSIS_VER=2.51 YASM_VER=1.2.0 +ELFUTILS_VER=0.166 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz @@ -112,6 +114,7 @@ NOTOKRFONT_PACKAGE=NotoSansKR-Regular.otf NOTOSCFONT_PACKAGE=NotoSansSC-Regular.otf NOTOTCFONT_PACKAGE=NotoSansTC-Regular.otf YASM_PACKAGE=yasm-${YASM_VER}.tar.gz +ELFUTILS_PACKAGE=elfutils-${ELFUTILS_VER}.tar.bz2 # Hashes for packages with weak sigs or no sigs OPENSSL_HASH=6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 @@ -174,3 +177,4 @@ NOTOKRFONT_URL=${NOTOCJKBASE_URL}/${NOTOKRFONT_PACKAGE} NOTOSCFONT_URL=${NOTOCJKBASE_URL}/${NOTOSCFONT_PACKAGE} NOTOTCFONT_URL=${NOTOCJKBASE_URL}/${NOTOTCFONT_PACKAGE} YASM_URL=https://www.tortall.net/projects/yasm/releases/${YASM_PACKAGE} +ELFUTILS_URL=https://sourceware.org/elfutils/ftp/${ELFUTILS_VER}/${ELFUTILS_PACKAGE}

1 0

[tor-browser-build/master] Bug 22115: use i386 containers for the win32 build
by boklm＠torproject.org 08 May '17

08 May '17

commit bb32ec91b538ab17d309b645787149ff376d58e9 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon May 8 18:44:29 2017 +0200 Bug 22115: use i386 containers for the win32 build --- projects/firefox/build | 1 + projects/gcc/config | 3 +++ projects/mingw-w64/config | 1 + projects/tor-browser/build | 13 ------------- projects/tor-browser/config | 12 ++---------- rbm.conf | 8 +++++++- 6 files changed, 14 insertions(+), 24 deletions(-) diff --git a/projects/firefox/build b/projects/firefox/build index 1cf9be1..f445454 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -1,4 +1,5 @@ #!/bin/bash +[% c("var/setarch") -%] [% c("var/set_default_env") -%] [% IF c("var/windows") -%] mkdir -p /var/tmp/dist diff --git a/projects/gcc/config b/projects/gcc/config index 676d1fb..d740a93 100644 --- a/projects/gcc/config +++ b/projects/gcc/config @@ -38,6 +38,9 @@ targets: windows-i686: var: configure_opt: --disable-multilib --enable-languages=c,c++ + arch_deps: + - libc6-dev + - zlib1g-dev linux-i686: var: configure_opt: --enable-multilib --enable-languages=c,c++ --with-system-zlib diff --git a/projects/mingw-w64/config b/projects/mingw-w64/config index 21d498a..5e2c748 100644 --- a/projects/mingw-w64/config +++ b/projects/mingw-w64/config @@ -13,6 +13,7 @@ var: - libmpc-dev - g++-mingw-w64-i686 setup: | + [% c("var/setarch") -%] mkdir -p /var/tmp/dist tar -C /var/tmp/dist -xf [% c("compiler_tarfile") %] export PATH="/var/tmp/dist/mingw-w64/helpers:/var/tmp/dist/mingw-w64/bin:$PATH" diff --git a/projects/tor-browser/build b/projects/tor-browser/build index 7134367..084ec7d 100644 --- a/projects/tor-browser/build +++ b/projects/tor-browser/build @@ -201,19 +201,6 @@ popd [% IF c("var/windows") %] - # We need to install a recent version of python-pefile so that it works - # in a x86_64 container: - # https://github.com/TheTorProject/tor-messenger-build/pull/10 - tar xf $rootdir/[% c('input_files_by_name/python-future') %] - cd $(echo [% c('input_files_by_name/python-future') %] | sed s/\.tar\.gz$//) - python setup.py install --user - cd .. - - tar xf $rootdir/[% c('input_files_by_name/python-pefile') %] - cd $(echo [% c('input_files_by_name/python-pefile') %] | sed s/\.tar\.gz$//) - python setup.py install --user - cd .. - tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/nsis') %] export PATH="/var/tmp/dist/nsis/bin:$PATH" diff --git a/projects/tor-browser/config b/projects/tor-browser/config index c4c2521..805d7b6 100644 --- a/projects/tor-browser/config +++ b/projects/tor-browser/config @@ -27,8 +27,8 @@ targets: windows-i686: var: mar_osname: win32 - container: - suite: utopic + arch_deps: + - python-pefile input_files: - project: container-image @@ -70,11 +70,3 @@ input_files: enable: '[% c("var/windows") %]' - filename: pe_checksum_fix.py enable: '[% c("var/windows") %]' - - name: python-future - URL: https://pypi.python.org/packages/00/2b/8d082ddfed935f3608cc61140df6dcbf0ede… - sha256sum: e39ced1ab767b5936646cedba8bcce582398233d6a627067d4c6a454c90cfedb - enable: '[% c("var/windows") %]' - - name: python-pefile - URL: https://pypi.python.org/packages/92/c0/8589ce9734ffdba258bd3e5acd4afb2e3586… - sha256sum: f24021085b5c3ef7b0898bb1f1d93eecd3839e03512769e22b0c5a10d9095f7b - enable: '[% c("var/windows") %]' diff --git a/rbm.conf b/rbm.conf index 2060132..969922c 100644 --- a/rbm.conf +++ b/rbm.conf @@ -153,7 +153,7 @@ targets: osname: windows-i686 container: suite: precise - arch: amd64 + arch: i386 configure_opt: '--host=i686-w64-mingw32 CFLAGS="[% c("var/CFLAGS") %]" LDFLAGS="[% c("var/LDFLAGS") %]"' CFLAGS: '[% c("var/flag_mwindows") %] -fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security' LDFLAGS: '[% c("var/flag_mwindows") %] -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$gcclibs' @@ -168,6 +168,12 @@ targets: - zip - unzip faketime_path: /usr/lib/faketime/libfaketime.so.1 + setarch: | + if test -z "$RBM_SETARCH" + then + export RBM_SETARCH=1 + exec setarch i686 ./build + fi torbrowser-osx-x86_64: - osx-x86_64

1 0

[tor-browser-build/master] Bug 22115: use i386 containers for the linux32 build
by boklm＠torproject.org 08 May '17

08 May '17

commit d067aa03629fb87c47acf19f81ed51940ebc3ebb Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon May 1 19:58:30 2017 +0200 Bug 22115: use i386 containers for the linux32 build --- projects/binutils/build | 3 ++- projects/common/runc-config.json | 6 +++++- projects/debootstrap-image/config | 22 ++++++++++++++++++++++ projects/firefox/config | 21 ++++----------------- projects/gcc/build | 1 + projects/gcc/config | 17 ++++++++++++----- projects/go-webrtc/config | 8 +------- projects/go/build | 1 + projects/go/config | 1 + projects/snowflake/config | 8 +------- projects/tor/config | 14 +++++--------- projects/webrtc/config | 30 ++++++++---------------------- rbm.conf | 35 ++++++++++++++++------------------- 13 files changed, 79 insertions(+), 88 deletions(-) diff --git a/projects/binutils/build b/projects/binutils/build index 8d4f09f..bd949a5 100644 --- a/projects/binutils/build +++ b/projects/binutils/build @@ -8,7 +8,8 @@ distdir=/var/tmp/dist/binutils export DEB_BUILD_HARDENING_FORTIFY=1 export DEB_BUILD_HARDENING_FORMAT=1 export DEB_BUILD_HARDENING_PIE=1 - +[% END -%] +[% IF c("var/linux-x86_64") %] # The libstdc++ shipped by default is non-PIC which breaks the binutils build # if we build with DEB_BUILD_HARDENING_PIE=1. We need to install a PIC one AND # make sure it gets used before the non-PIC one would. diff --git a/projects/common/runc-config.json b/projects/common/runc-config.json index 4c231cd..3da6c24 100644 --- a/projects/common/runc-config.json +++ b/projects/common/runc-config.json @@ -2,7 +2,11 @@ "ociVersion": "1.0.0-rc1", "platform": { "os": "linux", - "arch": "amd64" +[% IF c("var/container/arch") == 'i386' -%] + "arch": "386" +[% ELSE -%] + "arch": "[% c("var/container/arch") %]" +[% END -%] }, "process": { "terminal": true, diff --git a/projects/debootstrap-image/config b/projects/debootstrap-image/config index bd204f5..15eec3b 100644 --- a/projects/debootstrap-image/config +++ b/projects/debootstrap-image/config @@ -27,23 +27,45 @@ targets: container: suite: wheezy arch: amd64 + wheezy-i386: + var: + container: + suite: wheezy + arch: i386 jessie-amd64: var: container: suite: jessie arch: amd64 + jessie-i386: + var: + container: + suite: jessie + arch: i386 precise-amd64: var: container: suite: precise arch: amd64 debootstrap_opt: --keyring=/usr/share/keyrings/ubuntu-archive-removed-keys.gpg + precise-i386: + var: + container: + suite: precise + arch: i386 + debootstrap_opt: --keyring=/usr/share/keyrings/ubuntu-archive-removed-keys.gpg utopic-amd64: var: container: suite: utopic arch: amd64 debootstrap_mirror: http://old-releases.ubuntu.com/ubuntu/ + utopic-i386: + var: + container: + suite: utopic + arch: i386 + debootstrap_mirror: http://old-releases.ubuntu.com/ubuntu/ input_files: - URL: 'http://cdimage.ubuntu.com/ubuntu-base/releases/[% c("var/ubuntu_version") %]/release/ubuntu-base-[% c("var/ubuntu_version") %]-base-amd64.tar.gz' diff --git a/projects/firefox/config b/projects/firefox/config index d6a68fe..f5c765f 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -28,9 +28,8 @@ targets: var: torbrowser_update_channel: default - linux-x86_64: + linux: var: - martools_filename: mar-tools-linux64.zip arch_deps: - libgtk2.0-dev - libdbus-glib-1-dev @@ -44,25 +43,13 @@ targets: - libx11-xcb-dev # We built GCC but not the libmpc2, thus we need to install it - libmpc2 + linux-x86_64: + var: + martools_filename: mar-tools-linux64.zip linux-i686: var: martools_filename: mar-tools-linux32.zip - sort_deps: 0 - arch_deps: - - libc6-dev-i386 - - libgtk2.0-dev:i386 - - libdbus-glib-1-dev:i386 - - libxt-dev:i386 - # To pass configure since ESR 31. - - libpulse-dev:i386 - # To pass configure since ESR 45. - - libgconf2-dev:i386 - # To pass configure since ESR 52 - - libx11-xcb-dev:i386 - # We built GCC but not the libmpc2, thus we need to install it - - libmpc2 - - hardening-wrapper osx-x86_64: var: diff --git a/projects/gcc/build b/projects/gcc/build index 1c24af7..e509aac 100644 --- a/projects/gcc/build +++ b/projects/gcc/build @@ -1,5 +1,6 @@ #!/bin/sh [% c("var/set_default_env") -%] +[% c("var/setarch") -%] distdir=/var/tmp/dist/[% project %] mkdir /var/tmp/build tar -C /var/tmp/build -xf [% project %]-[% c("version") %].tar.bz2 diff --git a/projects/gcc/config b/projects/gcc/config index 1acf30a..676d1fb 100644 --- a/projects/gcc/config +++ b/projects/gcc/config @@ -4,12 +4,11 @@ version: 5.1.0 var: container: use_container: 1 - configure_opt: --enable-multilib --enable-languages=c,c++ --with-arch_32=i686 deps: - build-essential - libmpc-dev - - libc6-dev-i386 setup: | + [% c("var/setarch") -%] mkdir -p /var/tmp/dist tar -C /var/tmp/dist -xf $rootdir/[% c("compiler_tarfile") %] export PATH="/var/tmp/dist/gcc/bin:$PATH" @@ -36,12 +35,20 @@ var: popd targets: - osx-x86_64: - var: - configure_opt: --enable-multilib --enable-languages=c,c++ windows-i686: var: configure_opt: --disable-multilib --enable-languages=c,c++ + linux-i686: + var: + configure_opt: --enable-multilib --enable-languages=c,c++ --with-system-zlib + arch_deps: + - libc6-dev + - zlib1g-dev + linux-x86_64: + var: + configure_opt: --enable-multilib --enable-languages=c,c++ --with-arch_32=i686 + arch_deps: + - libc6-dev-i386 input_files: - project: container-image - URL: 'https://ftp.gnu.org/gnu/gcc/gcc-[% c("version") %]/gcc-[% c("version") %].tar.bz2' diff --git a/projects/go-webrtc/config b/projects/go-webrtc/config index d7c31d6..673215b 100644 --- a/projects/go-webrtc/config +++ b/projects/go-webrtc/config @@ -31,17 +31,11 @@ var: targets: master: git_hash: master - linux-x86_64: + linux: var: arch_deps: - pkg-config - libx11-dev - linux-i686: - var: - arch_deps: - - pkg-config:i386 - - libx11-dev:i386 - - lib32stdc++6 input_files: - project: container-image diff --git a/projects/go/build b/projects/go/build index 2f87bf5..b7fac08 100644 --- a/projects/go/build +++ b/projects/go/build @@ -1,5 +1,6 @@ #!/bin/bash [% c("var/set_default_env") -%] +[% c("var/setarch") -%] distdir=/var/tmp/dist/[% project %] mkdir -p /var/tmp/dist diff --git a/projects/go/config b/projects/go/config index ef9c411..b36f211 100644 --- a/projects/go/config +++ b/projects/go/config @@ -8,6 +8,7 @@ var: use_container: 1 setup: | + [% c("var/setarch") -%] mkdir -p /var/tmp/dist tar -C /var/tmp/dist -xf $rootdir/[% c("go_tarfile") %] export GOOS=[% c("var/GOOS") %] diff --git a/projects/snowflake/config b/projects/snowflake/config index 212e86c..89e3eb6 100644 --- a/projects/snowflake/config +++ b/projects/snowflake/config @@ -9,13 +9,7 @@ var: use_container: 1 targets: - linux-i686: - var: - arch_deps: - - pkg-config - - libx11-dev:i386 - - lib32stdc++6 - linux-x86_64: + linux: var: arch_deps: - pkg-config diff --git a/projects/tor/config b/projects/tor/config index a9da811..c2d359c 100644 --- a/projects/tor/config +++ b/projects/tor/config @@ -21,22 +21,18 @@ targets: git_hash: master tag_gpg_id: 0 - linux-i686: + linux: var: - libdir: lib32 - sort_deps: 0 arch_deps: - - libc6-dev-i386 - libtool - - zlib1g-dev:i386 + - zlib1g-dev - hardening-wrapper + linux-i686: + var: + libdir: lib linux-x86_64: var: libdir: lib64 - arch_deps: - - libtool - - zlib1g-dev - - hardening-wrapper osx-x86_64: var: arch_deps: diff --git a/projects/webrtc/config b/projects/webrtc/config index d46d821..6882e87 100644 --- a/projects/webrtc/config +++ b/projects/webrtc/config @@ -26,28 +26,6 @@ targets: var: webrtc: os: linux - linux-i686: - var: - sort_deps: 0 - arch_deps: - - lib32asound2-dev - - lib64expat1 - - libexpat1-dev:i386 - - libglib2.0-dev:i386 - - libgtk2.0-dev:i386 - - libudev-dev:i386 - - libx11-dev:i386 - - libxext-dev:i386 - - libxrandr-dev:i386 - - lib32stdc++6 - - pkg-config - - hardening-wrapper - webrtc: - arch: ia32 - lib_arch: 386 - lib_path: lib/libwebrtc-linux-386-magic.a - linux-x86_64: - var: arch_deps: - libasound2-dev - libexpat1-dev @@ -58,6 +36,14 @@ targets: - libxext-dev - libxrandr-dev - pkg-config + linux-i686: + var: + webrtc: + arch: ia32 + lib_arch: 386 + lib_path: lib/libwebrtc-linux-386-magic.a + linux-x86_64: + var: webrtc: arch: x64 lib_arch: amd64 diff --git a/rbm.conf b/rbm.conf index 722c85a..2060132 100644 --- a/rbm.conf +++ b/rbm.conf @@ -111,26 +111,30 @@ targets: var: linux-x86_64: 1 osname: linux-x86_64 - deps: - - build-essential - - python - - bison - - hardening-wrapper - - automake - - libtool - - zip - - unzip # We only build snowflake on linux-x86_64 for now snowflake: 1 + container: + arch: amd64 linux-i686: arch: i686 var: linux-i686: 1 osname: linux-i686 - configure_opt: '--host=i686-linux-gnu CFLAGS=-m32 CXXFLAGS=-m32 LDFLAGS=-m32' - pre_pkginst: dpkg --add-architecture i386 + container: + arch: i386 + setarch: | + if test -z "$RBM_SETARCH" + then + export RBM_SETARCH=1 + exec setarch i686 ./build + fi + linux: + var: + linux: 1 + compiler: gcc + container: + suite: wheezy deps: - - libc6-dev-i386 - build-essential - python - bison @@ -139,13 +143,6 @@ targets: - libtool - zip - unzip - linux: - var: - linux: 1 - compiler: gcc - container: - suite: wheezy - arch: amd64 torbrowser-windows-i686: - windows-i686

1 0