- tbb-commits - lists.torproject.org

[tor-browser-build/master] Bug 21824: use runc instead of docker
by boklm＠torproject.org 05 May '17

05 May '17

commit 2d98c063010fc5b0f8da3e386587a501e27507b9 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Tue Apr 25 22:06:10 2017 +0200 Bug 21824: use runc instead of docker --- README | 25 ++---- keyring/ubuntu.gpg | Bin 0 -> 32904 bytes projects/binutils/config | 5 +- projects/cmake/config | 6 +- projects/common/runc-config.json | 179 ++++++++++++++++++++++++++++++++++++++ projects/container-image/build | 3 + projects/container-image/config | 86 ++++++++++++++++++ projects/debootstrap-image/build | 3 + projects/debootstrap-image/config | 52 +++++++++++ projects/docker-image/build | 4 - projects/docker-image/config | 51 ----------- projects/ed25519/config | 5 +- projects/firefox/config | 5 +- projects/fonts/config | 5 +- projects/gcc/config | 5 +- projects/gmp/config | 7 +- projects/go-webrtc/config | 5 +- projects/go/config | 5 +- projects/goerrors/config | 5 +- projects/gogb/config | 5 +- projects/goptlib/config | 5 +- projects/goxcrypto/config | 5 +- projects/goxnet/config | 5 +- projects/https-everywhere/config | 9 +- projects/libdmg-hfsplus/config | 5 +- projects/libevent/config | 7 +- projects/llvm/config | 7 +- projects/macosx-toolchain/config | 5 +- projects/meek/config | 6 +- projects/mingw-w64/config | 5 +- projects/nsis/config | 5 +- projects/obfs4/config | 7 +- projects/openssl/config | 7 +- projects/sandbox/config | 8 +- projects/siphash/config | 5 +- projects/snowflake/config | 7 +- projects/tor-browser/config | 8 +- projects/tor-launcher/config | 6 +- projects/tor/config | 5 +- projects/torbutton/config | 6 +- projects/uniuri/config | 5 +- projects/webrtc/config | 10 ++- projects/yasm/config | 6 +- projects/zlib/config | 7 +- rbm | 2 +- rbm.conf | 93 ++++++++++++++++++-- rbm.local.conf.example | 6 -- tools/clean-old | 21 ----- 48 files changed, 549 insertions(+), 185 deletions(-) diff --git a/README b/README index 08904fb..fa968ff 100644 --- a/README +++ b/README @@ -5,13 +5,12 @@ Installing build dependencies ----------------------------- To build Tor Browser, you need a Linux distribution that has support -for Docker (such as Debian jessie, Ubuntu 14.04, Fedora 20, etc ...). -The Docker package is usually named docker.io or docker-io. -On Debian jessie, the docker.io package is available in backports. +for runC (such as Debian jessie, Ubuntu 14.04, Fedora 20, etc ...). +On Debian jessie, the runc package is available in backports. -Your user account should have access to the docker command without using -sudo, so it should be in the docker group. The docker daemon should -also be running. +Your user account should have access sudo access, which is required to +be able to extract container file systems, start containers and copy +files to and from containers. The sources of most components are downloaded using git, which needs to be installed. The sources of webrtc are downloaded using gclient, which @@ -41,7 +40,7 @@ If you are running Debian or Ubuntu, you can install them with: libio-captureoutput-perl libfile-slurp-perl \ libstring-shellquote-perl libsort-versions-perl \ libdigest-sha-perl libdata-uuid-perl libdata-dump-perl \ - libfile-copy-recursive-perl git libgtk2.0-dev curl + libfile-copy-recursive-perl git libgtk2.0-dev curl runc Starting a build @@ -184,18 +183,6 @@ of files and containers that would be removed without doing it, you can use 'make clean-dry-run'. -Multiple build directories on the same host -------------------------------------------- - -You can do multiple builds of Tor Browser in different directories on -the same host. However the docker images namespace is global, so you -may have some conflicts with the same image names used by the -different builds. By default, the docker images are prefixed with -tor-browser_$USER. You can change this prefix by defining the -docker_image_prefix option in rbm.local.conf, using a different prefix -for each of your build directories. - - Common Build Errors ------------------- diff --git a/keyring/ubuntu.gpg b/keyring/ubuntu.gpg new file mode 100644 index 0000000..8b77bf0 Binary files /dev/null and b/keyring/ubuntu.gpg differ diff --git a/projects/binutils/config b/projects/binutils/config index 2975f14..0cb2088 100644 --- a/projects/binutils/config +++ b/projects/binutils/config @@ -1,9 +1,10 @@ # vim: filetype=yaml sw=2 version: 2.24 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 var: configure_opt: '--disable-multilib --enable-gold --enable-deterministic-archives --enable-plugins' + container: + use_container: 1 targets: windows-i686: @@ -15,7 +16,7 @@ input_files: sig_ext: sig file_gpg_id: 1 gpg_keyring: binutils.gpg - - project: docker-image + - project: container-image - filename: enable-reloc-section-ld.patch enable: '[% c("var/windows") %]' - filename: peXXigen.patch diff --git a/projects/cmake/config b/projects/cmake/config index 837d9e1..357370d 100644 --- a/projects/cmake/config +++ b/projects/cmake/config @@ -5,7 +5,9 @@ git_hash: 'v[% c("version") %]' tag_gpg_id: 1 gpg_keyring: cmake.gpg filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 +var: + container: + use_container: 1 input_files: - - project: docker-image + - project: container-image diff --git a/projects/common/runc-config.json b/projects/common/runc-config.json new file mode 100644 index 0000000..4c231cd --- /dev/null +++ b/projects/common/runc-config.json @@ -0,0 +1,179 @@ +{ + "ociVersion": "1.0.0-rc1", + "platform": { + "os": "linux", + "arch": "amd64" + }, + "process": { + "terminal": true, + "user": { + "uid": 0, + "gid": 0 + }, + "args": [ + "/rbm/run" + ], + "env": [ + "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "TERM=xterm" + ], + "cwd": "/", + "capabilities": [ + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", + "CAP_SETGID", + "CAP_SETUID", + "CAP_MKNOD", + "CAP_SYS_CHROOT", +[% IF c("var/container/CAP_SYS_ADMIN") -%] + "CAP_SYS_ADMIN", +[% END -%] + "CAP_FSETID", + "CAP_FOWNER", + "CAP_DAC_OVERRIDE", + "CAP_CHOWN" + ], + "rlimits": [ + { + "type": "RLIMIT_NOFILE", + "hard": 1024, + "soft": 1024 + } + ], + "noNewPrivileges": true + }, + "root": { + "path": "rootfs", + "readonly": false + }, + "hostname": "runc", + "mounts": [ + { + "destination": "/proc", + "type": "proc", + "source": "proc" + }, + { + "type": "bind", + "source": "/etc/resolv.conf", + "destination": "/etc/resolv.conf", + "options": [ + "rbind", + "ro" + ] + }, + { + "destination": "/dev", + "type": "tmpfs", + "source": "tmpfs", + "options": [ + "nosuid", + "strictatime", + "mode=755", + "size=65536k" + ] + }, + { + "destination": "/dev/pts", + "type": "devpts", + "source": "devpts", + "options": [ + "nosuid", + "noexec", + "newinstance", + "ptmxmode=0666", + "mode=0620", + "gid=5" + ] + }, + { + "destination": "/dev/shm", + "type": "tmpfs", + "source": "shm", + "options": [ + "nosuid", + "noexec", + "nodev", + "mode=1777", + "size=65536k" + ] + }, + { + "destination": "/dev/mqueue", + "type": "mqueue", + "source": "mqueue", + "options": [ + "nosuid", + "noexec", + "nodev" + ] + }, + { + "destination": "/sys", + "type": "sysfs", + "source": "sysfs", + "options": [ + "nosuid", + "noexec", + "nodev", + "ro" + ] + }, + { + "destination": "/sys/fs/cgroup", + "type": "cgroup", + "source": "cgroup", + "options": [ + "nosuid", + "noexec", + "nodev", + "relatime", + "ro" + ] + } + ], + "hooks": {}, + "linux": { + "resources": { + "devices": [ + { + "allow": false, + "access": "rwm" + } + ] + }, + "namespaces": [ + { + "type": "pid" + }, + { + "type": "ipc" + }, + { + "type": "uts" + }, + { + "type": "mount" + } + ], + "maskedPaths": [ + "/proc/kcore", + "/proc/latency_stats", + "/proc/timer_stats", + "/proc/sched_debug" + ], + "readonlyPaths": [ + "/proc/asound", + "/proc/bus", + "/proc/fs", + "/proc/irq", + "/proc/sys", + "/proc/sysrq-trigger" + ] + }, + "solaris": { + "cappedCPU": {}, + "cappedMemory": {} + } +} diff --git a/projects/container-image/build b/projects/container-image/build new file mode 100644 index 0000000..c7d1c46 --- /dev/null +++ b/projects/container-image/build @@ -0,0 +1,3 @@ +#!/bin/sh +set -e +# Doing nothing diff --git a/projects/container-image/config b/projects/container-image/config new file mode 100644 index 0000000..c9f377f --- /dev/null +++ b/projects/container-image/config @@ -0,0 +1,86 @@ +# vim: filetype=yaml sw=2 +filename: 'container-image_[% c("var/container/suite") %]-[% c("var/container/arch") %]-[% sha256(c("pre")).substr(0, 12) %].tar.gz' +pkg_type: build + +var: + container: + use_container: 1 + suite: '[% pc(c("origin_project"), "var/container/suite") %]' + arch: '[% pc(c("origin_project"), "var/container/arch") %]' + +lsb_release: + id: Debian + codename: wheezy + release: 7.11 + +pre: | + #!/bin/sh + # [% c('var/container/suite') %] + set -e + [% IF pc(c('origin_project'), 'var/pre_pkginst') -%] + [% pc(c('origin_project'), 'var/pre_pkginst') %] + [% END -%] + [% IF c("var/container/suite") == "precise" -%] + export INITRD=no + mkdir -p /etc/container_environment + echo -n no > /etc/container_environment/INITRD + dpkg-divert --local --rename --add /sbin/initctl + ln -s /bin/true /sbin/initctl + dpkg-divert --local --rename --add /usr/bin/ischroot + ln -sf /bin/true /usr/bin/ischroot + cat >> /etc/apt/sources.list << EOF + deb http://archive.ubuntu.com/ubuntu/ precise-updates main + deb-src http://archive.ubuntu.com/ubuntu/ precise-updates main + + deb http://archive.ubuntu.com/ubuntu/ precise universe + deb-src http://archive.ubuntu.com/ubuntu/ precise universe + deb http://archive.ubuntu.com/ubuntu/ precise-updates universe + deb-src http://archive.ubuntu.com/ubuntu/ precise-updates universe + + deb http://archive.ubuntu.com/ubuntu/ precise-security main + deb-src http://archive.ubuntu.com/ubuntu/ precise-security main + deb http://archive.ubuntu.com/ubuntu/ precise-security universe + deb-src http://archive.ubuntu.com/ubuntu/ precise-security universe + EOF + [% END -%] + apt-get update -y + apt-get upgrade -y + [% + deps = []; + IF pc(c('origin_project'), 'var/deps'); + CALL deps.import(pc(c('origin_project'), 'var/deps')); + END; + IF pc(c('origin_project'), 'var/arch_deps'); + CALL deps.import(pc(c('origin_project'), 'var/arch_deps')); + END; + IF deps.size; + IF pc(c('origin_project'), 'var/sort_deps'); + deps = deps.sort; + END; + FOREACH pkg IN deps; + SET p = tmpl(pkg); + IF p; + GET c('install_package', { pkg_name => p }); + GET "\n"; + END; + END; + END; + -%] + [% IF pc(c('origin_project'), 'var/post_pkginst') -%] + [% pc(c('origin_project'), 'var/post_pkginst') %] + [% END -%] + +remote_get: | + #!/bin/sh + set -e + [% + SET src = shell_quote(c('get_src', { error_if_undef => 1 })); + SET dst = shell_quote(c('get_dst', { error_if_undef => 1 })); + -%] + mkdir -p "[% dst %]" + sudo tar -C "[% c("var/container/dir") %]/rootfs" -czf "[% dst %]/[% c("filename") %]" . + +input_files: + - project: debootstrap-image + target: + - '[% c("var/container/suite") %]-[% c("var/container/arch") %]' diff --git a/projects/debootstrap-image/build b/projects/debootstrap-image/build new file mode 100644 index 0000000..c7d1c46 --- /dev/null +++ b/projects/debootstrap-image/build @@ -0,0 +1,3 @@ +#!/bin/sh +set -e +# Doing nothing diff --git a/projects/debootstrap-image/config b/projects/debootstrap-image/config new file mode 100644 index 0000000..bd204f5 --- /dev/null +++ b/projects/debootstrap-image/config @@ -0,0 +1,52 @@ +# vim: filetype=yaml sw=2 +filename: 'container-image_[% c("var/container/suite") %]-[% c("var/container/arch") %].tar.gz' +pkg_type: build + +var: + ubuntu_version: 17.04 + + container_dir: '[% c("tmp_dir") %]/rbm-containers/[% sha256(c("build_id")) %]' + container_user: rbm + + container: + use_container: 1 + # We need CAP_SYS_ADMIN for debootstrap to work + CAP_SYS_ADMIN: 1 + +pre: | + #!/bin/sh + set -e + apt-get update -y + apt-get install -y debian-archive-keyring ubuntu-keyring debootstrap + debootstrap --arch=[% c("var/container/arch") %] [% c("var/container/debootstrap_opt") %] [% c("var/container/suite") %] base-image [% c("var/container/debootstrap_mirror") %] + tar -C ./base-image -czf [% dest_dir %]/[% c("filename") %] . + +targets: + wheezy-amd64: + var: + container: + suite: wheezy + arch: amd64 + jessie-amd64: + var: + container: + suite: jessie + arch: amd64 + precise-amd64: + var: + container: + suite: precise + arch: amd64 + debootstrap_opt: --keyring=/usr/share/keyrings/ubuntu-archive-removed-keys.gpg + utopic-amd64: + var: + container: + suite: utopic + arch: amd64 + debootstrap_mirror: http://old-releases.ubuntu.com/ubuntu/ + +input_files: + - URL: 'http://cdimage.ubuntu.com/ubuntu-base/releases/[% c("var/ubuntu_version") %]/release/ubuntu-base-[% c("var/ubuntu_version") %]-base-amd64.tar.gz' + filename: 'container-image_ubuntu-base-[% c("var/ubuntu_version") %]-base-amd64.tar.gz' + sha256sum: df2c8fd540e474b8e1e29c0db8ed6b43a932918f1b9a8149bb82104a7c07ba2a + diff --git a/projects/docker-image/build b/projects/docker-image/build deleted file mode 100644 index ced6ad3..0000000 --- a/projects/docker-image/build +++ /dev/null @@ -1,4 +0,0 @@ -#!/bin/sh -set -e -echo 1 > [% dest_dir %]/[% c('filename') %] -echo Creating [% dest_dir %]/[% c('filename') %] diff --git a/projects/docker-image/config b/projects/docker-image/config deleted file mode 100644 index 1968b77..0000000 --- a/projects/docker-image/config +++ /dev/null @@ -1,51 +0,0 @@ -# vim: filetype=yaml sw=2 -filename: '[% sha256(c("pre")).substr(0, 12) %]' -remote_docker: 1 -docker_save_image: '[% c("docker_image_prefix") %]:[% c("filename") %]' -pkg_type: build - -docker_image: '[% c("lsb_release/id").lower %]:[% c("lsb_release/release") %]' - -lsb_release: - id: '[% pc(c("origin_project", { no_distro => 1 }), "lsb_release/id", { no_distro => 1 }) %]' - release: '[% pc(c("origin_project", { no_distro => 1 }), "lsb_release/release", { no_distro => 1 }) %]' - codename: '[% pc(c("origin_project", { no_distro => 1 }), "lsb_release/codename", { no_distro => 1 }) %]' - -pre: | - #!/bin/sh - # [% c('docker_image') %] - set -e - [% IF c('lsb_release/release') == '14.10' -%] - sed -i 's/archive\.ubuntu\.com/old-releases.ubuntu.com/' /etc/apt/sources.list - [% END -%] - [% IF pc(c('origin_project'), 'var/pre_pkginst') -%] - [% pc(c('origin_project'), 'var/pre_pkginst') %] - [% END -%] - [% IF c('lsb_release/id') == 'Ubuntu' || c('lsb_release/id') == 'Debian' %] - apt-get update -y - apt-get upgrade -y - [% END %] - [% - deps = []; - IF pc(c('origin_project'), 'var/deps'); - CALL deps.import(pc(c('origin_project'), 'var/deps')); - END; - IF pc(c('origin_project'), 'var/arch_deps'); - CALL deps.import(pc(c('origin_project'), 'var/arch_deps')); - END; - IF deps.size; - IF pc(c('origin_project'), 'var/sort_deps'); - deps = deps.sort; - END; - FOREACH pkg IN deps; - SET p = tmpl(pkg); - IF p; - GET c('install_package', { pkg_name => p }); - GET "\n"; - END; - END; - END; - -%] - [% IF pc(c('origin_project'), 'var/post_pkginst') -%] - [% pc(c('origin_project'), 'var/post_pkginst') %] - [% END -%] diff --git a/projects/ed25519/config b/projects/ed25519/config index 5bab68b..c6790b8 100644 --- a/projects/ed25519/config +++ b/projects/ed25519/config @@ -3,16 +3,17 @@ version: '[% c("abbrev") %]' git_url: https://github.com/agl/ed25519.git git_hash: c4161f4c7483313562781c61b9a20aba73daf9de filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 build: '[% c("projects/go/var/build_go_lib") %]' var: + container: + use_container: 1 go_lib: github.com/agl/ed25519 go_lib_install: - github.com/agl/ed25519/extra25519 input_files: - - project: docker-image + - project: container-image - name: go project: go diff --git a/projects/firefox/config b/projects/firefox/config index 2c74e4b..d6a68fe 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -5,7 +5,6 @@ git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branc tag_gpg_id: 1 git_url: https://git.torproject.org/tor-browser.git gpg_keyring: torbutton.gpg -remote_docker: 1 var: firefox_version: 52.1.0esr @@ -19,6 +18,8 @@ var: - autoconf2.13 - yasm - python + container: + use_container: 1 targets: nightly: @@ -74,7 +75,7 @@ targets: martools_filename: mar-tools-win32.zip input_files: - - project: docker-image + - project: container-image - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]' - filename: get-moz-build-date diff --git a/projects/fonts/config b/projects/fonts/config index 69e16b3..382804d 100644 --- a/projects/fonts/config +++ b/projects/fonts/config @@ -3,8 +3,9 @@ version: '[% c("abbrev") %]' git_url: https://github.com/googlei18n/noto-fonts.git git_hash: 720e34851382ee3c1ef024d8dffb68ffbfb234c2 filename: "[% project %]-[% c('version') %]-[% c('var/build_id') %].tar.gz" -remote_docker: 1 var: + container: + use_container: 1 noto_fonts_hinted: - Arimo-Regular.ttf - Arimo-Bold.ttf @@ -85,7 +86,7 @@ targets: - NotoSansYi-Regular.ttf input_files: - - project: docker-image + - project: container-image - URL: https://github.com/googlei18n/noto-emoji/raw/2f1ffdd6fbbd05d6f382138a3d3adc… sha256sum: 415dc6290378574135b64c808dc640c1df7531973290c4970c51fdeb849cb0c5 enable: '[% c("var/linux") %]' diff --git a/projects/gcc/config b/projects/gcc/config index 391e453..1acf30a 100644 --- a/projects/gcc/config +++ b/projects/gcc/config @@ -1,8 +1,9 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' version: 5.1.0 -remote_docker: 1 var: + container: + use_container: 1 configure_opt: --enable-multilib --enable-languages=c,c++ --with-arch_32=i686 deps: - build-essential @@ -42,6 +43,6 @@ targets: var: configure_opt: --disable-multilib --enable-languages=c,c++ input_files: + - project: container-image - URL: 'https://ftp.gnu.org/gnu/gcc/gcc-[% c("version") %]/gcc-[% c("version") %].tar.bz2' sha256sum: b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad - - project: docker-image diff --git a/projects/gmp/config b/projects/gmp/config index 913f181..41eb630 100644 --- a/projects/gmp/config +++ b/projects/gmp/config @@ -1,7 +1,10 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' version: 5.1.3 -remote_docker: 1 + +var: + container: + use_container: 1 targets: linux: @@ -9,9 +12,9 @@ targets: configure_opt_gmp: --enable-fat input_files: + - project: container-image - name: gmp URL: 'https://ftp.gnu.org/gnu/gmp/gmp-[% c("version") %].tar.bz2' sha256sum: 752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]' - - project: docker-image diff --git a/projects/go-webrtc/config b/projects/go-webrtc/config index 3a1a9d4..d7c31d6 100644 --- a/projects/go-webrtc/config +++ b/projects/go-webrtc/config @@ -3,11 +3,12 @@ version: '[% c("abbrev") %]' git_url: https://github.com/keroserene/go-webrtc.git git_hash: ab1b64862e0c4b4182010699911c2c5818f0a101 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 build: '[% c("projects/go/var/build_go_lib") %]' var: + container: + use_container: 1 go_lib: github.com/keroserene/go-webrtc build_go_lib_pre: | [% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] @@ -43,7 +44,7 @@ targets: - lib32stdc++6 input_files: - - project: docker-image + - project: container-image - name: go project: go - name: webrtc diff --git a/projects/go/config b/projects/go/config index 89b4b45..ef9c411 100644 --- a/projects/go/config +++ b/projects/go/config @@ -1,10 +1,11 @@ # vim: filetype=yaml sw=2 version: 1.7.5 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 var: go14_version: 1.4.3 + container: + use_container: 1 setup: | mkdir -p /var/tmp/dist @@ -69,7 +70,7 @@ targets: GOARCH: 386 input_files: - - project: docker-image + - project: container-image - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]' enable: '[% c("var/windows") || c("var/osx") %]' diff --git a/projects/goerrors/config b/projects/goerrors/config index 4451f7b..3c11fab 100644 --- a/projects/goerrors/config +++ b/projects/goerrors/config @@ -3,14 +3,15 @@ version: '[% c("abbrev") %]' git_url: https://github.com/pkg/errors git_hash: 248dadf4e9068a0b3e79f02ed0a610d935de5302 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 build: '[% c("projects/go/var/build_go_lib") %]' var: + container: + use_container: 1 go_lib: github.com/pkg/errors input_files: - - project: docker-image + - project: container-image - name: go project: go diff --git a/projects/gogb/config b/projects/gogb/config index a358819..dcf30f6 100644 --- a/projects/gogb/config +++ b/projects/gogb/config @@ -3,18 +3,19 @@ version: '[% c("abbrev") %]' git_url: https://github.com/constabulary/gb git_hash: 06cc925cce6592e922dcc4839a8b44feb384e71e filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 build: '[% c("projects/go/var/build_go_lib") %]' var: + container: + use_container: 1 go_lib: github.com/constabulary/gb go_lib_install: github.com/constabulary/gb/cmd/gb go_lib_deps: - goerrors input_files: - - project: docker-image + - project: container-image - name: go project: go - name: goerrors diff --git a/projects/goptlib/config b/projects/goptlib/config index dd520ec..c083763 100644 --- a/projects/goptlib/config +++ b/projects/goptlib/config @@ -5,14 +5,15 @@ git_hash: '[% c("version") %]' tag_gpg_id: 1 gpg_keyring: goptlib.gpg filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 build: '[% c("projects/go/var/build_go_lib") %]' var: + container: + use_container: 1 go_lib: git.torproject.org/pluggable-transports/goptlib.git input_files: - - project: docker-image + - project: container-image - name: go project: go diff --git a/projects/goxcrypto/config b/projects/goxcrypto/config index 8362f28..b51b578 100644 --- a/projects/goxcrypto/config +++ b/projects/goxcrypto/config @@ -3,11 +3,12 @@ version: '[% c("abbrev") %]' git_url: https://go.googlesource.com/crypto git_hash: 4ed45ec682102c643324fae5dff8dab085b6c300 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 build: '[% c("projects/go/var/build_go_lib") %]' var: + container: + use_container: 1 go_lib: golang.org/x/crypto go_lib_install: - golang.org/x/crypto/curve25519 @@ -19,6 +20,6 @@ targets: git_hash: master input_files: - - project: docker-image + - project: container-image - name: go project: go diff --git a/projects/goxnet/config b/projects/goxnet/config index 507f997..ec368a2 100644 --- a/projects/goxnet/config +++ b/projects/goxnet/config @@ -3,11 +3,12 @@ version: '[% c("abbrev") %]' git_url: https://go.googlesource.com/net git_hash: 7dbad50ab5b31073856416cdcfeb2796d682f844 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 build: '[% c("projects/go/var/build_go_lib") %]' var: + container: + use_container: 1 go_lib: golang.org/x/net go_lib_install: - golang.org/x/net/proxy @@ -17,6 +18,6 @@ targets: git_hash: master input_files: - - project: docker-image + - project: container-image - name: go project: go diff --git a/projects/https-everywhere/config b/projects/https-everywhere/config index 3e5100e..f149cac 100644 --- a/projects/https-everywhere/config +++ b/projects/https-everywhere/config @@ -6,9 +6,11 @@ git_submodule: 1 gpg_keyring: https-everywhere.gpg tag_gpg_id: 1 filename: "[% project %]-[% c('version') %]-[% c('var/build_id') %].xpi" -remote_docker: 1 -distribution: Debian-7.11 var: + container: + use_container: 1 + suite: wheezy + arch: amd64 deps: - git - python @@ -19,8 +21,9 @@ var: - rsync - zip - unzip + input_files: - - project: docker-image + - project: container-image targets: nightly: diff --git a/projects/libdmg-hfsplus/config b/projects/libdmg-hfsplus/config index 9071078..67e8287 100644 --- a/projects/libdmg-hfsplus/config +++ b/projects/libdmg-hfsplus/config @@ -3,13 +3,14 @@ version: '[% c("abbrev") %]' git_url: https://github.com/vasi/libdmg-hfsplus git_hash: dfd5e5cc3dc1191e37d3c3a6118975afdd1d7014 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 var: + container: + use_container: 1 deps: - build-essential - cmake - zlib1g-dev - libbz2-dev input_files: + - project: container-image - filename: libdmg.patch - - project: docker-image diff --git a/projects/libevent/config b/projects/libevent/config index 15ada11..46cbb7e 100644 --- a/projects/libevent/config +++ b/projects/libevent/config @@ -5,7 +5,10 @@ git_hash: 'release-[% c("version") %]-stable' tag_gpg_id: 1 gpg_keyring: libevent.gpg filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 + +var: + container: + use_container: 1 targets: osx-x86_64: @@ -14,6 +17,6 @@ targets: - faketime input_files: - - project: docker-image + - project: container-image - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]' diff --git a/projects/llvm/config b/projects/llvm/config index 81f7aaa..f0a803b 100644 --- a/projects/llvm/config +++ b/projects/llvm/config @@ -1,10 +1,13 @@ # vim: filetype=yaml sw=2 version: 3.8.0 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 + +var: + container: + use_container: 1 input_files: - - project: docker-image + - project: container-image - project: cmake name: cmake - URL: 'http://releases.llvm.org/[% c("version") %]/llvm-[% c("version") %].src.tar.xz' diff --git a/projects/macosx-toolchain/config b/projects/macosx-toolchain/config index b237e4d..55fb554 100644 --- a/projects/macosx-toolchain/config +++ b/projects/macosx-toolchain/config @@ -1,8 +1,9 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' version: 10.7-1 -remote_docker: 1 var: + container: + use_container: 1 setup: | mkdir -p /var/tmp/dist tar -C /var/tmp/dist -xf [% c("compiler_tarfile") %] @@ -15,6 +16,7 @@ var: export LDFLAGS="[% c('var/LDFLAGS') %]" input_files: + - project: container-image - name: llvm project: llvm - name: cctools @@ -23,4 +25,3 @@ input_files: - name: SDK URL: https://people.torproject.org/~mikeperry/mirrors/sources/MacOSX10.7.sdk.tar… sha256sum: da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf - - project: docker-image diff --git a/projects/meek/config b/projects/meek/config index 84ed2bd..46f4ec9 100644 --- a/projects/meek/config +++ b/projects/meek/config @@ -5,10 +5,12 @@ git_hash: '[% c("version") %]' tag_gpg_id: 1 gpg_keyring: meek.gpg filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 +var: + container: + use_container: 1 input_files: - - project: docker-image + - project: container-image - name: go project: go - name: goptlib diff --git a/projects/mingw-w64/config b/projects/mingw-w64/config index 060857c..21d498a 100644 --- a/projects/mingw-w64/config +++ b/projects/mingw-w64/config @@ -3,8 +3,9 @@ filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' git_url: http://git.code.sf.net/p/mingw-w64/mingw-w64 git_hash: 98e5b4930a717eafddd8ca0f0dfeb7c57c6b026a version: '[% c("abbrev") %]' -remote_docker: 1 var: + container: + use_container: 1 gcc_version: 5.1.0 deps: - automake @@ -17,6 +18,7 @@ var: export PATH="/var/tmp/dist/mingw-w64/helpers:/var/tmp/dist/mingw-w64/bin:$PATH" export gcclibs=/var/tmp/dist/mingw-w64/gcclibs input_files: + - project: container-image - URL: 'https://ftp.gnu.org/gnu/gcc/gcc-[% c("var/gcc_version") %]/gcc-[% c("var/gcc_version") %].tar.bz2' sha256sum: b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad - name: binutils @@ -24,4 +26,3 @@ input_files: - filename: i686-w64-mingw32-g++ - filename: i686-w64-mingw32-gcc - filename: i686-w64-mingw32-ld - - project: docker-image diff --git a/projects/nsis/config b/projects/nsis/config index 6729101..2812a22 100644 --- a/projects/nsis/config +++ b/projects/nsis/config @@ -1,8 +1,9 @@ # vim: filetype=yaml sw=2 version: 2.51 filename: 'nsis-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 var: + container: + use_container: 1 deps: - build-essential - libmpc-dev @@ -12,6 +13,7 @@ var: - xsltproc input_files: + - project: container-image - filename: 'nsis-[% c("version") %].tar.bz2' URL: 'http://downloads.sourceforge.net/nsis/nsis-[% c("version") %]-src.tar.bz2' sha256sum: 43d4c9209847e35eb6e2c7cd5a7586e1445374c056c2c7899e40a080e17a1be7 @@ -21,4 +23,3 @@ input_files: - filename: nsis-missing-unistd-include.patch - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]' - - project: docker-image diff --git a/projects/obfs4/config b/projects/obfs4/config index 952b054..44db79d 100644 --- a/projects/obfs4/config +++ b/projects/obfs4/config @@ -5,7 +5,10 @@ git_hash: 'obfs4proxy-[% c("version") %]' tag_gpg_id: 1 gpg_keyring: obfs4.gpg filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 + +var: + container: + use_container: 1 targets: nightly: @@ -13,7 +16,7 @@ targets: tag_gpg_id: 0 input_files: - - project: docker-image + - project: container-image - name: go project: go - name: goptlib diff --git a/projects/openssl/config b/projects/openssl/config index 1a2e4dd..8b4ea4f 100644 --- a/projects/openssl/config +++ b/projects/openssl/config @@ -1,7 +1,10 @@ # vim: filetype=yaml sw=2 version: 1.0.2k filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 + +var: + container: + use_container: 1 targets: linux-x86_64: @@ -18,7 +21,7 @@ targets: configure_opts: --cross-compile-prefix=x86_64-apple-darwin10- darwin64-x86_64-cc enable-ec_nistp_64_gcc_128 input_files: - - project: docker-image + - project: container-image - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]' - URL: 'https://www.openssl.org/source/openssl-[% c("version") %].tar.gz' diff --git a/projects/sandbox/config b/projects/sandbox/config index 218a276..3970322 100644 --- a/projects/sandbox/config +++ b/projects/sandbox/config @@ -5,10 +5,12 @@ git_hash: 'sandboxed-tor-browser-[% c("version") %]' tag_gpg_id: 1 gpg_keyring: obfs4.gpg filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 -distribution: Debian-8.7 var: + container: + use_container: 1 + suite: jessie + arch: amd64 deps: - libx11-dev - pkg-config @@ -22,7 +24,7 @@ targets: tag_gpg_id: 0 input_files: - - project: docker-image + - project: container-image - name: go project: go - name: gogb diff --git a/projects/siphash/config b/projects/siphash/config index 0f3f4b5..b2cb2a9 100644 --- a/projects/siphash/config +++ b/projects/siphash/config @@ -3,14 +3,15 @@ version: '[% c("abbrev") %]' git_url: https://github.com/dchest/siphash.git git_hash: 42ba037e748c9062a75e0924705c43b893edefcd filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 build: '[% c("projects/go/var/build_go_lib") %]' var: + container: + use_container: 1 go_lib: github.com/dchest/siphash input_files: - - project: docker-image + - project: container-image - name: go project: go diff --git a/projects/snowflake/config b/projects/snowflake/config index 3233ba4..212e86c 100644 --- a/projects/snowflake/config +++ b/projects/snowflake/config @@ -3,7 +3,10 @@ version: '[% c("abbrev") %]' git_url: https://git.torproject.org/pluggable-transports/snowflake.git git_hash: 9f2e9a6ecb696149708716ca06ce842df03cf492 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 + +var: + container: + use_container: 1 targets: linux-i686: @@ -19,7 +22,7 @@ targets: - libx11-dev input_files: - - project: docker-image + - project: container-image - name: go project: go - name: '[% c("var/compiler") %]' diff --git a/projects/tor-browser/config b/projects/tor-browser/config index 87cc6b2..c4c2521 100644 --- a/projects/tor-browser/config +++ b/projects/tor-browser/config @@ -1,9 +1,10 @@ # vim: filetype=yaml sw=2 version: '[% c("var/torbrowser_version") %]' filename: 'tor-browser-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -remote_docker: 1 var: + container: + use_container: 1 ddmg: '[% INCLUDE ddmg.sh %]' targets: @@ -24,12 +25,13 @@ targets: - bzip2 - faketime windows-i686: - distribution: Ubuntu-14.10 var: mar_osname: win32 + container: + suite: utopic input_files: - - project: docker-image + - project: container-image - project: firefox name: firefox - project: tor diff --git a/projects/tor-launcher/config b/projects/tor-launcher/config index 70f8acd..9211844 100644 --- a/projects/tor-launcher/config +++ b/projects/tor-launcher/config @@ -5,9 +5,11 @@ git_hash: '[% c("version") %]' gpg_keyring: torbutton.gpg tag_gpg_id: 1 filename: "[% project %]-[% c('version') %]-[% c('var/build_id') %].xpi" -remote_docker: 1 +var: + container: + use_container: 1 input_files: - - project: docker-image + - project: container-image targets: nightly: diff --git a/projects/tor/config b/projects/tor/config index c8940dd..a9da811 100644 --- a/projects/tor/config +++ b/projects/tor/config @@ -5,9 +5,10 @@ git_hash: 'tor-[% c("version") %]' git_url: https://git.torproject.org/tor.git gpg_keyring: tor.gpg tag_gpg_id: 1 -remote_docker: 1 var: + container: + use_container: 1 deps: - build-essential - automake @@ -50,6 +51,7 @@ targets: flag_mwindows: '' input_files: + - project: container-image - name: openssl project: openssl - name: libevent @@ -59,4 +61,3 @@ input_files: enable: '[% c("var/windows") %]' - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]' - - project: docker-image diff --git a/projects/torbutton/config b/projects/torbutton/config index b60e217..41d4d69 100644 --- a/projects/torbutton/config +++ b/projects/torbutton/config @@ -5,9 +5,11 @@ git_hash: '[% c("version") %]' gpg_keyring: torbutton.gpg tag_gpg_id: 1 filename: "[% project %]-[% c('version') %]-[% c('var/build_id') %].xpi" -remote_docker: 1 +var: + container: + use_container: 1 input_files: - - project: docker-image + - project: container-image targets: nightly: diff --git a/projects/uniuri/config b/projects/uniuri/config index 62fa8ef..e4c7294 100644 --- a/projects/uniuri/config +++ b/projects/uniuri/config @@ -3,11 +3,12 @@ version: '[% c("abbrev") %]' git_url: https://github.com/dchest/uniuri git_hash: 8902c56451e9b58ff940bbe5fec35d5f9c04584a filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 build: '[% c("projects/go/var/build_go_lib") %]' var: + container: + use_container: 1 go_lib: github.com/dchest/uniuri targets: @@ -15,6 +16,6 @@ targets: git_hash: master input_files: - - project: docker-image + - project: container-image - name: go project: go diff --git a/projects/webrtc/config b/projects/webrtc/config index bfd38c9..d46d821 100644 --- a/projects/webrtc/config +++ b/projects/webrtc/config @@ -1,13 +1,14 @@ # vim: filetype=yaml sw=2 version: '[% c("var/webrtc_tag") %]' -remote_docker: 1 filename: 'webrtc-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' var: + container: + use_container: 1 webrtc_tag: c279861207c5b15fc51069e96595782350e0ac12 input_files: - - project: docker-image + - project: container-image - project: webrtc pkg_type: fetch_sources - project: depot_tools @@ -27,7 +28,6 @@ targets: os: linux linux-i686: var: - dockerbuild: "[% pc('docker-image', 'pre') %]" sort_deps: 0 arch_deps: - lib32asound2-dev @@ -65,7 +65,9 @@ targets: steps: fetch_sources: - remote_docker: 0 + var: + container: + use_container: 0 filename: 'webrtc-sources-[% c("var/webrtc_tag") %].tar.gz' fetch_sources: | #!/bin/bash diff --git a/projects/yasm/config b/projects/yasm/config index 3d8a28a..12d009b 100644 --- a/projects/yasm/config +++ b/projects/yasm/config @@ -1,10 +1,12 @@ # vim: filetype=yaml sw=2 version: 1.2.0 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' -remote_docker: 1 +var: + container: + use_container: 1 input_files: - - project: docker-image + - project: container-image - URL: 'https://www.tortall.net/projects/yasm/releases/yasm-[% c("version") %].tar.gz' name: yasm sha256sum: 768ffab457b90a20a6d895c39749adb547c1b7cb5c108e84b151a838a23ccf31 diff --git a/projects/zlib/config b/projects/zlib/config index 5219559..3ad562c 100644 --- a/projects/zlib/config +++ b/projects/zlib/config @@ -5,9 +5,12 @@ git_hash: 'v[% c("version") %]' git_url: https://github.com/madler/zlib.git gpg_keyring: zlib.gpg tag_gpg_id: 1 -remote_docker: 1 + +var: + container: + use_container: 1 input_files: + - project: container-image - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]' - - project: docker-image diff --git a/rbm b/rbm index 3f3886e..106e9b0 160000 --- a/rbm +++ b/rbm @@ -1 +1 @@ -Subproject commit 3f3886e1f210ad2853209c5aecd0951350a6f758 +Subproject commit 106e9b05aeff6309e241a3c9bae1781e0d551e7a diff --git a/rbm.conf b/rbm.conf index 651acfa..722c85a 100644 --- a/rbm.conf +++ b/rbm.conf @@ -20,12 +20,16 @@ var: build_id_txt: | [% c("version") %] [% IF c("git_hash") || c("hg_hash"); GET c("abbrev"); END; %] - [% IF c("remote_docker") -%] - [% c("distribution") %] + [% IF c("var/container/use_container") -%] + [% c("var/container/suite") %] + [% c("var/container/arch") %] [% END -%] input_files: [% c("input_files_id") %] build: [% c("build", { filename => 'f', output_dir => '/out' }) %] + container: + dir: '[% c("tmp_dir") %]/rbm-containers/[% sha256(c("build_id")) %]' + user: rbm input_files_list: | [% FOREACH file IN c("input_files_by_name").keys.sort -%] [% c("input_files_by_name/" _ file) %] @@ -136,19 +140,23 @@ targets: - zip - unzip linux: - distribution: Debian-7.11 var: linux: 1 compiler: gcc + container: + suite: wheezy + arch: amd64 torbrowser-windows-i686: - windows-i686 windows-i686: - distribution: Ubuntu-12.04 arch: i686 var: windows: 1 osname: windows-i686 + container: + suite: precise + arch: amd64 configure_opt: '--host=i686-w64-mingw32 CFLAGS="[% c("var/CFLAGS") %]" LDFLAGS="[% c("var/LDFLAGS") %]"' CFLAGS: '[% c("var/flag_mwindows") %] -fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security' LDFLAGS: '[% c("var/flag_mwindows") %] -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$gcclibs' @@ -167,11 +175,13 @@ targets: torbrowser-osx-x86_64: - osx-x86_64 osx-x86_64: - distribution: Debian-8.7 arch: x86_64 var: osx: 1 osname: osx-x86_64 + container: + suite: jessie + arch: amd64 compiler: 'macosx-toolchain' configure_opt: '--host=x86_64-apple-darwin10 CC="x86_64-apple-darwin10-clang [% c("var/FLAGS") %]" CXX="x86_64-apple-darwin10-clang++ [% c("var/FLAGS") %]"' FLAGS: "-target x86_64-apple-darwin10 -mlinker-version=136 -B $cctoolsdir -isysroot $sysrootdir" @@ -195,9 +205,6 @@ targets: build_id: 1 -docker_image: '[% pc("docker-image", "docker_save_image") %]' -docker_image_prefix: '[% GET c("var/project_name") ? c("var/project_name") : "rbm-build" %]_[% GET ENV.RBM_BUILDNAME ? ENV.RBM_BUILDNAME : ENV.USER ? ENV.USER : c("uid") %]' - # change the default gpg_wrapper to allow git tag signed using an # expired key. # https://bugs.torproject.org/19737 @@ -218,6 +225,76 @@ gpg_wrapper: | exec [% c('gpg_bin') %] [% c('gpg_args') %] --with-fingerprint [% gpg_kr %] "$@" fi +remote_start: '[% IF c("var/container/use_container") %][% c("runc/remote_start") %][% END %]' +remote_exec: '[% IF c("var/container/use_container") %][% c("runc/remote_exec") %][% END %]' +remote_put: '[% IF c("var/container/use_container") %][% c("runc/remote_put") %][% END %]' +remote_get: '[% IF c("var/container/use_container") %][% c("runc/remote_get") %][% END %]' +remote_finish: '[% IF c("var/container/use_container") %][% c("runc/remote_finish") %][% END %]' + +runc: + remote_start: | + #!/bin/sh + set -e + if [ $(ls -1 '[% c("remote_srcdir", { error_if_undef => 1 }) %]/container-image_'* | wc -l) -ne 1 ] + then + echo "Can't find container image in input files" >&2 + ls -l '[% c("remote_srcdir") %]' >&2 + exit 1 + fi + mkdir -p '[% c("var/container/dir") %]'/rootfs/rbm + sudo tar -C '[% c("var/container/dir") %]'/rootfs -xf $(ls -1 '[% c("remote_srcdir", { error_if_undef => 1 }) %]/container-image_'*) + cat > '[% c("var/container/dir") %]'/config.json << EOF + [% INCLUDE 'runc-config.json' %] + EOF + [% SET user = c("var/container/user") -%] + [% c("remote_exec", { exec_as_root => 1, exec_cmd => 'id ' _ user + _ ' >/dev/null 2>&1 || adduser -m ' _ user _ ' || useradd -m ' _ user }) %] + + remote_exec: | + #!/bin/sh + set -e + mkdir -p '[% c("var/container/dir", { error_if_undef => 1 }) %]'/rootfs/rbm + echo '#!/bin/sh' > '[% c("var/container/dir") %]'/rootfs/rbm/cmd + echo [% shell_quote(c('exec_cmd')) %] >> '[% c("var/container/dir") %]'/rootfs/rbm/cmd + echo '#!/bin/sh' > '[% c("var/container/dir") %]'/rootfs/rbm/run + [% IF c('exec_as_root'); SET user = 'root'; ELSE; SET user = c("var/container/user", { error_if_undef => 1 }); END; %] + echo 'su - [% user %] -c /rbm/cmd' >> '[% c("var/container/dir") %]'/rootfs/rbm/run + chmod +x '[% c("var/container/dir") %]'/rootfs/rbm/cmd + chmod +x '[% c("var/container/dir") %]'/rootfs/rbm/run + sudo runc start -b '[% c("var/container/dir") %]' rbm-[% sha256(c("build_id", { error_if_undef => 1 })) %] + + remote_put: | + #!/bin/sh + set -e + [% + SET src = shell_quote(c('put_src', { error_if_undef => 1 })); + SET dst = shell_quote(c('put_dst', { error_if_undef => 1 })); + -%] + sudo mkdir -p '[% c("var/container/dir") %]'/rootfs/[% dst %] + sudo cp -aP [% src %] '[% c("var/container/dir") %]'/rootfs/[% dst %] + [% c("remote_exec", { exec_as_root => 1, exec_cmd => 'chown -R ' _ c("var/container/user") _ ' ' _ dst }) %] + + remote_get: | + #!/bin/sh + set -e + [% + SET src = shell_quote(c('get_src', { error_if_undef => 1 })); + SET dst = shell_quote(c('get_dst', { error_if_undef => 1 })); + -%] + mkdir -p [% dst %] + srcdir='[% c("var/container/dir", { error_if_undef => 1 }) %]'/rootfs/[% src %] + if [ $(ls -1 "$srcdir"/* 2> /dev/null | wc -l) -gt 0 ] + then + sudo chown $(whoami) "$srcdir"/* + sudo mv -f "$srcdir"/* [% dst %]/ + fi + + remote_finish: | + #!/bin/sh + set -e + sudo rm -Rf '[% c("var/container/dir", { error_if_undef => 1 }) %]'/rootfs '[% c("var/container/dir", { error_if_undef => 1 }) %]'/config.json + rmdir '[% c("var/container/dir") %]' + ENV: TZ: UTC LC_ALL: C diff --git a/rbm.local.conf.example b/rbm.local.conf.example index 78de08f..203ce5f 100644 --- a/rbm.local.conf.example +++ b/rbm.local.conf.example @@ -16,12 +16,6 @@ ### this. #debug: 0 -### If you are doing multiple builds in different directories on the -### same host, you should define docker_image_prefix with a different -### value for each build directory, so that the different builds don't -### use the same docker image names. -#docker_image_prefix: tor-browser_XXXXX - ### The build_log option defines in which file the build logs of each ### component are stored. If you set it to '-' the logs are output on ### stdout and stderr. diff --git a/tools/clean-old b/tools/clean-old index 4d603fc..c7d9e0c 100755 --- a/tools/clean-old +++ b/tools/clean-old @@ -27,24 +27,6 @@ sub clean_file { } } -sub clean_docker_images { - my ($dockerdir, $used_files) = @_; - my $imgprefix = RBM::project_config('docker-image', 'docker_image_prefix'); - my @imgs = read_dir($dockerdir); - foreach my $dockerimage (@imgs) { - next if $used_files->{"$dockerdir/$dockerimage"}; - my $img = "$imgprefix:$dockerimage"; - print "Cleaning docker image $img\n"; - next if $options{'dry-run'}; - my ($out, $err, $success) = capture_exec('docker', 'rmi', '-f', $img); - if (!$success) { - print STDERR "Error removing docker image $img:\n$err\n"; - exit 1; - } - unlink "$dockerdir/$dockerimage"; - } -} - sub get_project_input_files { my ($project, @targets) = @_; print "Getting input files for $project ", join(' ', @targets), "\n"; @@ -108,7 +90,4 @@ foreach my $branch (keys %$clean) { } my %used_files = map { $_ => 1 } @files; my $outdir = $RBM::config->{basedir} . '/out'; -# Don't clean docker-image files yet -$used_files{"$outdir/docker-image"} = 1; clean_file($outdir, \%used_files); -clean_docker_images("$outdir/docker-image", \%used_files);

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] Bug 21792: Suppress MediaError.message when privacy.resistFingerprinting = true
by gk＠torproject.org 03 May '17

03 May '17

commit 58d186df19450f9aef0423c71e78f6eaa17679f8 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Thu Apr 27 15:00:14 2017 -0700 Bug 21792: Suppress MediaError.message when privacy.resistFingerprinting = true --- dom/html/MediaError.cpp | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/dom/html/MediaError.cpp b/dom/html/MediaError.cpp index 83b9ffc..fae0981 100644 --- a/dom/html/MediaError.cpp +++ b/dom/html/MediaError.cpp @@ -7,6 +7,7 @@ #include "mozilla/dom/MediaError.h" #include "nsDOMClassInfoID.h" #include "mozilla/dom/MediaErrorBinding.h" +#include "nsContentUtils.h" namespace mozilla { namespace dom { @@ -31,7 +32,12 @@ MediaError::MediaError(HTMLMediaElement* aParent, uint16_t aCode, void MediaError::GetMessage(nsAString& aResult) const { - CopyUTF8toUTF16(mMessage, aResult); + if (nsContentUtils::IsCallerChrome() || + !nsContentUtils::ShouldResistFingerprinting()) { + CopyUTF8toUTF16(mMessage, aResult); + } else { + aResult.Truncate(); + } } JSObject*

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 02 May '17

02 May '17

commit 29b3b7af8e3b9528204ae49a396af80b3e4c4d61 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Wed Apr 26 15:38:30 2017 -0700 fixup! TB4: Tor Browser's Firefox preference overrides. We fix bug 21675 by pretending every user has just one core available. --- browser/app/profile/000-tor-browser.js | 1 + 1 file changed, 1 insertion(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 0715a01..27cfe53 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -151,6 +151,7 @@ pref("reader.parse-on-load.enabled", false); pref("privacy.use_utc_timezone", true); pref("media.webspeech.synth.enabled", false); // Bug 10283: Disable SpeechSynthesis API pref("dom.webaudio.enabled", false); // Bug 13017: Disable Web Audio API +pref("dom.maxHardwareConcurrency", 1); // Bug 21675: Spoof single-core cpu // Third party stuff pref("network.cookie.cookieBehavior", 1);

1 0

[tor-browser-bundle/master] Fold in stable changelog
by gk＠torproject.org 02 May '17

02 May '17

commit a89f99a8b8700a04af9f795f4d2115fb1dd3eabb Author: Georg Koppen <gk(a)torproject.org> Date: Tue May 2 09:04:21 2017 +0000 Fold in stable changelog --- Bundle-Data/Docs/ChangeLog.txt | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index b2ee463..afe3999 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -83,6 +83,18 @@ Tor Browser 7.0a3 -- April 20 2017 * Bug 21960: Linux bundles based on ESR 52 are not reproducible anymore * Bug 21629: Fix broken ASan builds when switching to ESR 52 +Tor Browser 6.5.2 -- April 19 2017 + * All Platforms + * Update Firefox to 45.9.0esr + * Update HTTPS-Everywhere to 5.2.14 + * Update NoScript to 5.0.2 + * Bug 21555+16450: Don't remove Authorization header on subdomains (e.g. Twitter) + * Bug 19316: Make sure our Windows updates can deal with the SSE2 requirement + * Bug 21917: Add new obfs4 bridges + * Bug 21918: Move meek-amazon to d2cly7j4zqgua7.cloudfront.net backend + * Windows + * Bug 21795: Fix Tor Browser crashing on github.com + Tor Browser 7.0a2-hardened -- March 7 2017 * All Platforms * Update Firefox to 45.8.0esr

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! Bug #4234: Use the Firefox Update Process for Tor Browser.
by gk＠torproject.org 02 May '17

02 May '17

commit d70009f425f9da6a74413b286ef768ba97c899cd Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue Apr 25 11:34:07 2017 -0400 fixup! Bug #4234: Use the Firefox Update Process for Tor Browser. Bug 22041: libmozsandbox.so error after upgrading to 7.0a3 Fix a problem with unstaged updates on Linux and OSX where the original files were not restored after a partial update failed to apply due to changes the user made within their installation. This would leave the browser in a state where it had a mix of old files and new (patched) files, which can cause the browser to not be able to start, and therefore not be able to fallback to a complete update. --- toolkit/mozapps/update/updater/updater.cpp | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/toolkit/mozapps/update/updater/updater.cpp b/toolkit/mozapps/update/updater/updater.cpp index 988cf55..1bc4867 100644 --- a/toolkit/mozapps/update/updater/updater.cpp +++ b/toolkit/mozapps/update/updater/updater.cpp @@ -1037,9 +1037,10 @@ static int backup_restore(const NS_tchar *path, const NS_tchar *relPath) bool isLink = false; #ifndef XP_WIN struct stat linkInfo; - int rv = lstat(path, &linkInfo); - if (!rv) { - LOG(("backup_restore: cannot get info for backup file: " LOG_S, relBackup)); + int rv = lstat(backup, &linkInfo); + if (rv) { + LOG(("backup_restore: cannot get info for backup file: " LOG_S ", err: %d", + relBackup, errno)); return OK; } isLink = S_ISLNK(linkInfo.st_mode);

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 02 May '17

02 May '17

commit ff923c1609c6bc4d9dd3a8b60f684d7c410a7399 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Fri Apr 28 11:20:24 2017 -0700 fixup! TB4: Tor Browser's Firefox preference overrides. We work around bug 13017 by disabling the Web Audio API for now. --- browser/app/profile/000-tor-browser.js | 1 + 1 file changed, 1 insertion(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 9ca4149..0715a01 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -150,6 +150,7 @@ pref("browser.reader.detectedFirstArticle", true); pref("reader.parse-on-load.enabled", false); pref("privacy.use_utc_timezone", true); pref("media.webspeech.synth.enabled", false); // Bug 10283: Disable SpeechSynthesis API +pref("dom.webaudio.enabled", false); // Bug 13017: Disable Web Audio API // Third party stuff pref("network.cookie.cookieBehavior", 1);

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] Bug 1274020 - Tests that shows the Cache Web API is separated by origin attributes. r=baku
by gk＠torproject.org 27 Apr '17

27 Apr '17

commit 3da33fc90ce348fbc594d5aa45e85d8a4f08e539 Author: Jonathan Hao <jhao(a)mozilla.com> Date: Tue Dec 13 11:44:59 2016 +0800 Bug 1274020 - Tests that shows the Cache Web API is separated by origin attributes. r=baku --HG-- extra : rebase_source : 8964090126795ed45650e76c4f9e02b2e60f62cf --- .../originattributes/test/browser/browser.ini | 1 + .../originattributes/test/browser/browser_cacheAPI.js | 18 ++++++++++++++++++ .../components/originattributes/test/browser/head.js | 7 +++++-- 3 files changed, 24 insertions(+), 2 deletions(-) diff --git a/browser/components/originattributes/test/browser/browser.ini b/browser/components/originattributes/test/browser/browser.ini index 121dd0c..911d42f 100644 --- a/browser/components/originattributes/test/browser/browser.ini +++ b/browser/components/originattributes/test/browser/browser.ini @@ -68,3 +68,4 @@ support-files = [browser_sharedworker.js] [browser_httpauth.js] [browser_clientAuth.js] +[browser_cacheAPI.js] diff --git a/browser/components/originattributes/test/browser/browser_cacheAPI.js b/browser/components/originattributes/test/browser/browser_cacheAPI.js new file mode 100644 index 0000000..87dcfe5 --- /dev/null +++ b/browser/components/originattributes/test/browser/browser_cacheAPI.js @@ -0,0 +1,18 @@ +const requestURL = "https://test1.example.com"; + +function getResult(aBrowser) { + return ContentTask.spawn(aBrowser, requestURL, function* (url) { + let cache = yield content.caches.open("TEST_CACHE"); + let response = yield cache.match(url); + if (response) { + return response.statusText; + } + let result = Math.random().toString(); + response = new content.Response("", { statusText: result }); + yield cache.put(url, response); + return result; + }); +} + +IsolationTestTools.runTests("https://test2.example.com", getResult, null, null, + false, /* aUseHttps */ true); diff --git a/browser/components/originattributes/test/browser/head.js b/browser/components/originattributes/test/browser/head.js index 96559a1..7835ccf 100644 --- a/browser/components/originattributes/test/browser/head.js +++ b/browser/components/originattributes/test/browser/head.js @@ -279,7 +279,7 @@ this.IsolationTestTools = { * An optional boolean to ensure we get results before the next tab is opened. */ runTests(aURL, aGetResultFuncs, aCompareResultFunc, aBeforeFunc, - aGetResultImmediately) { + aGetResultImmediately, aUseHttps) { let pageURL; let firstFrameSetting; let secondFrameSetting; @@ -301,7 +301,10 @@ this.IsolationTestTools = { aGetResultFuncs = [aGetResultFuncs]; } - let tabSettings = [ + let tabSettings = aUseHttps ? [ + { firstPartyDomain: "https://example.com", userContextId: 1}, + { firstPartyDomain: "https://example.org", userContextId: 2} + ] : [ { firstPartyDomain: "http://example.com", userContextId: 1}, { firstPartyDomain: "http://example.org", userContextId: 2} ];

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] Bug 1282655 - Test if site permissions are universal across origin attributes. r=tanvi
by gk＠torproject.org 27 Apr '17

27 Apr '17

commit 59cba8d0681caf53c46cd3718e34c9a49f9c5921 Author: Jonathan Hao <jhao(a)mozilla.com> Date: Mon Dec 26 22:38:00 2016 -0500 Bug 1282655 - Test if site permissions are universal across origin attributes. r=tanvi --HG-- extra : rebase_source : 6155960b626c29092c96ea7fbc605cc0b637d918 --- .../originattributes/test/browser/browser.ini | 1 + .../test/browser/browser_permissions.js | 44 ++++++++++++++++++++++ 2 files changed, 45 insertions(+) diff --git a/browser/components/originattributes/test/browser/browser.ini b/browser/components/originattributes/test/browser/browser.ini index 911d42f..d503e9e 100644 --- a/browser/components/originattributes/test/browser/browser.ini +++ b/browser/components/originattributes/test/browser/browser.ini @@ -69,3 +69,4 @@ support-files = [browser_httpauth.js] [browser_clientAuth.js] [browser_cacheAPI.js] +[browser_permissions.js] diff --git a/browser/components/originattributes/test/browser/browser_permissions.js b/browser/components/originattributes/test/browser/browser_permissions.js new file mode 100644 index 0000000..fd3220b --- /dev/null +++ b/browser/components/originattributes/test/browser/browser_permissions.js @@ -0,0 +1,44 @@ +/** + * Bug 1282655 - Test if site permissions are universal across origin attributes. + * + * This test is testing the cookie "permission" for a specific URI. + */ + +const TEST_PAGE = "http://example.net"; +const uri = Services.io.newURI(TEST_PAGE, null, null); + +function disableCookies() { + Services.cookies.removeAll(); + Services.perms.add(uri, "cookie", Services.perms.DENY_ACTION); +} + +function ensureCookieNotSet(aBrowser) { + ContentTask.spawn(aBrowser, null, function*() { + content.document.cookie = "key=value"; + is(content.document.cookie, "", "Setting/reading cookies should be disabled" + + " for this domain for all origin attribute combinations."); + }); +} + +IsolationTestTools.runTests(TEST_PAGE, ensureCookieNotSet, () => true, + disableCookies); + +function enableCookies() { + Services.cookies.removeAll(); + Services.perms.add(uri, "cookie", Services.perms.ALLOW_ACTION); +} + +function ensureCookieSet(aBrowser) { + ContentTask.spawn(aBrowser, null, function() { + content.document.cookie = "key=value"; + is(content.document.cookie, "key=value", "Setting/reading cookies should be" + + " enabled for this domain for all origin attribute combinations."); + }); +} + +IsolationTestTools.runTests(TEST_PAGE, ensureCookieSet, () => true, + enableCookies); + +registerCleanupFunction(() => { + Services.cookies.removeAll(); +});

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] Bug 1315602 - Remove the assertion of FirstPartyDomain should be empty in HTTP redirect. r=smaug
by gk＠torproject.org 27 Apr '17

27 Apr '17

commit efd86213b996d351757498968481962eb610c06c Author: Yoshi Huang <allstars.chh(a)mozilla.com> Date: Mon Nov 7 14:59:05 2016 +0800 Bug 1315602 - Remove the assertion of FirstPartyDomain should be empty in HTTP redirect. r=smaug --- .../originattributes/test/browser/browser.ini | 6 ++ .../test/browser/browser_firstPartyIsolation.js | 105 +++++++++++++++++++++ ...st_firstParty_http_redirect_to_same_domain.html | 9 ++ ...arty_http_redirect_to_same_domain.html^headers^ | 2 + .../originattributes/test/browser/test_form.html | 14 +++ .../originattributes/test/browser/window2.html | 11 +++ .../originattributes/test/browser/window3.html | 11 +++ .../test/browser/window_redirect.html | 12 +++ netwerk/protocol/http/HttpBaseChannel.cpp | 2 - 9 files changed, 170 insertions(+), 2 deletions(-) diff --git a/browser/components/originattributes/test/browser/browser.ini b/browser/components/originattributes/test/browser/browser.ini index 61f6743..121dd0c 100644 --- a/browser/components/originattributes/test/browser/browser.ini +++ b/browser/components/originattributes/test/browser/browser.ini @@ -44,9 +44,15 @@ support-files = test_firstParty_html_redirect.html test_firstParty_http_redirect.html test_firstParty_http_redirect.html^headers^ + test_firstParty_http_redirect_to_same_domain.html + test_firstParty_http_redirect_to_same_domain.html^headers^ test_firstParty_iframe_http_redirect.html test_firstParty_postMessage.html + test_form.html window.html + window2.html + window3.html + window_redirect.html worker_blobify.js worker_deblobify.js diff --git a/browser/components/originattributes/test/browser/browser_firstPartyIsolation.js b/browser/components/originattributes/test/browser/browser_firstPartyIsolation.js index ddda6af..53fa858 100644 --- a/browser/components/originattributes/test/browser/browser_firstPartyIsolation.js +++ b/browser/components/originattributes/test/browser/browser_firstPartyIsolation.js @@ -172,3 +172,108 @@ add_task(function* openWindow_test() { yield BrowserTestUtils.closeWindow(win); }); +/** + * When the web page calls window.open, the top-level docshell in the new + * created window will have firstPartyDomain set. + */ +add_task(function* window_open_redirect_test() { + Services.prefs.setIntPref("browser.link.open_newwindow", 2); + registerCleanupFunction(function() { + Services.prefs.clearUserPref("browser.link.open_newwindow"); + }); + + let tab = gBrowser.addTab(BASE_URL + "window_redirect.html"); + let win = yield BrowserTestUtils.waitForNewWindow(); + yield BrowserTestUtils.browserLoaded(win.gBrowser.selectedBrowser); + + yield ContentTask.spawn(win.gBrowser.selectedBrowser, { firstPartyDomain: "mochi.test" }, function* (attrs) { + Assert.equal(docShell.getOriginAttributes().firstPartyDomain, attrs.firstPartyDomain, + "window.open() should have firstPartyDomain attribute"); + Assert.equal(content.document.nodePrincipal.originAttributes.firstPartyDomain, + attrs.firstPartyDomain, "The document should have firstPartyDomain"); + }); + + gBrowser.removeTab(tab); + yield BrowserTestUtils.closeWindow(win); +}); + +/** + * When the web page calls window.open, the top-level docshell in the new + * created window will inherit the firstPartyDomain attribute. + * However the top-level document will override the firstPartyDomain if the + * document is from another domain. + */ +add_task(function* window_open_iframe_test() { + Services.prefs.setIntPref("browser.link.open_newwindow", 2); + registerCleanupFunction(function() { + Services.prefs.clearUserPref("browser.link.open_newwindow"); + }); + + let tab = gBrowser.addTab(BASE_URL + "window2.html"); + let win = yield BrowserTestUtils.waitForNewWindow(); + yield BrowserTestUtils.browserLoaded(win.gBrowser.selectedBrowser, true); + + yield ContentTask.spawn(win.gBrowser.selectedBrowser, { firstPartyDomain: "mochi.test" }, function* (attrs) { + Assert.equal(docShell.getOriginAttributes().firstPartyDomain, attrs.firstPartyDomain, + "window.open() should have firstPartyDomain attribute"); + + // The document is http://example.com/browser/browser/components/originattributes/test/browser… + // so the firstPartyDomain will be overriden to 'example.com'. + Assert.equal(content.document.nodePrincipal.originAttributes.firstPartyDomain, + "example.com", "The document should have firstPartyDomain"); + + let iframe = content.document.getElementById("iframe1"); + Assert.equal(iframe.frameLoader.docShell.getOriginAttributes().firstPartyDomain, + "example.com", "iframe's docshell should have firstPartyDomain"); + Assert.equal(iframe.contentDocument.nodePrincipal.originAttributes.firstPartyDomain, + "example.com", "iframe should have firstPartyDomain"); + }); + + gBrowser.removeTab(tab); + yield BrowserTestUtils.closeWindow(win); +}); + +/** + * Test for the loadInfo->TriggeringPrincipal is the document itself. + */ +add_task(function* form_test() { + let tab = gBrowser.addTab(BASE_URL + "test_form.html"); + yield BrowserTestUtils.browserLoaded(tab.linkedBrowser); + + yield ContentTask.spawn(tab.linkedBrowser, { firstPartyDomain: "mochi.test" }, function* (attrs) { + Assert.equal(content.document.nodePrincipal.originAttributes.firstPartyDomain, + attrs.firstPartyDomain, "The document should have firstPartyDomain"); + + let submit = content.document.getElementById("submit"); + submit.click(); + }); + + gBrowser.removeTab(tab); +}); + +/** + * Another test for loadInfo->TriggeringPrincipal in the window.open case. + */ +add_task(function* window_open_form_test() { + Services.prefs.setIntPref("browser.link.open_newwindow", 2); + registerCleanupFunction(function() { + Services.prefs.clearUserPref("browser.link.open_newwindow"); + }); + + let tab = gBrowser.addTab(BASE_URL + "window3.html"); + let win = yield BrowserTestUtils.waitForNewWindow(); + yield BrowserTestUtils.browserLoaded(win.gBrowser.selectedBrowser, true); + + yield ContentTask.spawn(win.gBrowser.selectedBrowser, { firstPartyDomain: "mochi.test" }, function* (attrs) { + Assert.equal(docShell.getOriginAttributes().firstPartyDomain, attrs.firstPartyDomain, + "window.open() should have firstPartyDomain attribute"); + Assert.equal(content.document.nodePrincipal.originAttributes.firstPartyDomain, + "example.com", "The document should have firstPartyDomain"); + + let submit = content.document.getElementById("submit"); + submit.click(); + }); + + gBrowser.removeTab(tab); + yield BrowserTestUtils.closeWindow(win); +}); diff --git a/browser/components/originattributes/test/browser/test_firstParty_http_redirect_to_same_domain.html b/browser/components/originattributes/test/browser/test_firstParty_http_redirect_to_same_domain.html new file mode 100644 index 0000000..7b794a0 --- /dev/null +++ b/browser/components/originattributes/test/browser/test_firstParty_http_redirect_to_same_domain.html @@ -0,0 +1,9 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"/> + <title>Test for Bug 1260931</title> +</head> +<body> +</body> +</html> diff --git a/browser/components/originattributes/test/browser/test_firstParty_http_redirect_to_same_domain.html^headers^ b/browser/components/originattributes/test/browser/test_firstParty_http_redirect_to_same_domain.html^headers^ new file mode 100644 index 0000000..e4af8ed --- /dev/null +++ b/browser/components/originattributes/test/browser/test_firstParty_http_redirect_to_same_domain.html^headers^ @@ -0,0 +1,2 @@ +HTTP 302 Found +Location: http://mochi.test:8888/browser/browser/components/originattributes/test/bro… diff --git a/browser/components/originattributes/test/browser/test_form.html b/browser/components/originattributes/test/browser/test_form.html new file mode 100644 index 0000000..db1b900 --- /dev/null +++ b/browser/components/originattributes/test/browser/test_form.html @@ -0,0 +1,14 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test for Bug 1260931</title> +</head> +<body> +<form action="test_firstParty_http_redirect_to_same_domain.html" method="POST"> + First name: <input type="text" name="fname"><br> + Last name: <input type="text" name="lname"><br> + <input type="submit" id="submit" value="Submit"> +</form> +</body> +</html> diff --git a/browser/components/originattributes/test/browser/window2.html b/browser/components/originattributes/test/browser/window2.html new file mode 100644 index 0000000..3c5a7fb --- /dev/null +++ b/browser/components/originattributes/test/browser/window2.html @@ -0,0 +1,11 @@ +<html> + <head> + <meta charset="utf8"> + <title>Page creating a popup</title> + </head> + <body> + <script type="text/javascript"> + var w = window.open("http://example.com/browser/browser/components/originattributes/test/browser…", "test"); + </script> + </body> +</html> diff --git a/browser/components/originattributes/test/browser/window3.html b/browser/components/originattributes/test/browser/window3.html new file mode 100644 index 0000000..168ced6 --- /dev/null +++ b/browser/components/originattributes/test/browser/window3.html @@ -0,0 +1,11 @@ +<html> + <head> + <meta charset="utf8"> + <title>Page creating a popup</title> + </head> + <body> + <script type="text/javascript"> + var w = window.open("http://example.com/browser/browser/components/originattributes/test/browser…", "test"); + </script> + </body> +</html> diff --git a/browser/components/originattributes/test/browser/window_redirect.html b/browser/components/originattributes/test/browser/window_redirect.html new file mode 100644 index 0000000..b51cdf4 --- /dev/null +++ b/browser/components/originattributes/test/browser/window_redirect.html @@ -0,0 +1,12 @@ +<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"> +<html> + <head> + <meta charset="utf8"> + <title>Page creating a popup</title> + </head> + <body> + <script type="text/javascript"> + var w = window.open('test_firstParty_http_redirect_to_same_domain.html', "test"); + </script> + </body> +</html> diff --git a/netwerk/protocol/http/HttpBaseChannel.cpp b/netwerk/protocol/http/HttpBaseChannel.cpp index d2bc0cc..e0f7ede 100644 --- a/netwerk/protocol/http/HttpBaseChannel.cpp +++ b/netwerk/protocol/http/HttpBaseChannel.cpp @@ -3034,8 +3034,6 @@ HttpBaseChannel::SetupReplacementChannel(nsIURI *newURI, if (loadContext) { loadContext->GetOriginAttributes(docShellAttrs); } - MOZ_ASSERT(docShellAttrs.mFirstPartyDomain.IsEmpty(), - "top-level docshell shouldn't have firstPartyDomain attribute."); NeckoOriginAttributes attrs = newLoadInfo->GetOriginAttributes();

1 0

[rbm/master] Remove useless comma
by boklm＠torproject.org 27 Apr '17

27 Apr '17

commit 0bf69095d566885d3daa23fd51dae28a02d84590 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Apr 27 12:29:03 2017 +0200 Remove useless comma --- lib/RBM.pm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/RBM.pm b/lib/RBM.pm index 3fa8d35..50332d7 100644 --- a/lib/RBM.pm +++ b/lib/RBM.pm @@ -745,7 +745,7 @@ sub input_files { my $need_dl = $action ne 'getfpaths'; my $input_files_id = ''; $options = {$options ? %$options : ()}; - my $input_files = project_config($project, 'input_files', $options,); + my $input_files = project_config($project, 'input_files', $options); goto RETURN_RES unless $input_files; my $proj_dir = path(project_config($project, 'projects_dir', $options)); my $src_dir = "$proj_dir/$project";

1 0

[rbm/master] Add process_template_opt subroutine
by boklm＠torproject.org 27 Apr '17

27 Apr '17

commit 36d9a7357740ba9d7b939738b199f7ec11ce80b2 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Apr 27 12:19:57 2017 +0200 Add process_template_opt subroutine In the few places where we are using process_template directly, the $options is ignored. We fix that by adding a process_template_opt subroutine which applies the $options. --- lib/RBM.pm | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/lib/RBM.pm b/lib/RBM.pm index 57a6161..3fa8d35 100644 --- a/lib/RBM.pm +++ b/lib/RBM.pm @@ -587,6 +587,15 @@ sub sha256file { return $res{$f} = -f $f ? sha256_hex(scalar read_file($f)) : ''; } +sub process_template_opt { + my ($project, $tmpl, $opt, $dest_dir) = @_; + my $save_opt = $config->{opt}; + $config->{opt} = {%{$config->{opt}}, %$opt} if $opt; + my $res = process_template($project, $tmpl, $dest_dir); + $config->{opt} = $save_opt; + return $res; +} + sub process_template { my ($project, $tmpl, $dest_dir) = @_; return undef unless defined $tmpl; @@ -745,7 +754,7 @@ sub input_files { foreach my $input_file (@$input_files) { if (!ref $input_file) { $input_file = project_config($project, - process_template($project, $input_file), $options); + process_template_opt($project, $input_file, $options), $options); } next unless $input_file; my $t = sub { @@ -757,8 +766,8 @@ sub input_files { next; } if ($input_file->{target} && ! $input_file->{_target_processed}) { - $input_file->{target} = process_template($project, - $input_file->{target}); + $input_file->{target} = process_template_opt($project, + $input_file->{target}, $options); $input_file->{_target_processed} = 1; } if ($action eq 'getfnames') {

1 0

[rbm/master] Avoid modifying $input_files
by boklm＠torproject.org 27 Apr '17

27 Apr '17

commit 106e9b05aeff6309e241a3c9bae1781e0d551e7a Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Apr 27 12:30:25 2017 +0200 Avoid modifying $input_files If an input_file contains a 'target' value we process it as a template and modify it. However we should not do that as a project (and its input files) can be used multiple times with different contexts in the same build. Instead we should make a copy of the $input_file before we modify it. --- lib/RBM.pm | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/lib/RBM.pm b/lib/RBM.pm index 50332d7..6825050 100644 --- a/lib/RBM.pm +++ b/lib/RBM.pm @@ -751,7 +751,8 @@ sub input_files { my $src_dir = "$proj_dir/$project"; my $old_cwd = getcwd; chdir $src_dir || exit_error "cannot chdir to $src_dir"; - foreach my $input_file (@$input_files) { + foreach my $input_file_alias (@$input_files) { + my $input_file = $input_file_alias; if (!ref $input_file) { $input_file = project_config($project, process_template_opt($project, $input_file, $options), $options); @@ -765,10 +766,10 @@ sub input_files { if ($input_file->{enable} && !$t->('enable')) { next; } - if ($input_file->{target} && ! $input_file->{_target_processed}) { + if ($input_file->{target}) { + $input_file = { %$input_file }; $input_file->{target} = process_template_opt($project, $input_file->{target}, $options); - $input_file->{_target_processed} = 1; } if ($action eq 'getfnames') { my $getfnames_name;

1 0

[rbm/master] Fix how we set origin_project in input_files
by boklm＠torproject.org 27 Apr '17

27 Apr '17

commit 1a2a9d99ee058d5ca9d4e0f524cbb4eb771762e7 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Apr 27 12:14:12 2017 +0200 Fix how we set origin_project in input_files --- lib/RBM.pm | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/lib/RBM.pm b/lib/RBM.pm index c92ae65..57a6161 100644 --- a/lib/RBM.pm +++ b/lib/RBM.pm @@ -761,7 +761,6 @@ sub input_files { $input_file->{target}); $input_file->{_target_processed} = 1; } - $options->{origin_project} = $project; if ($action eq 'getfnames') { my $getfnames_name; if ($input_file->{name}) { @@ -773,7 +772,10 @@ sub input_files { $res_getfnames{$getfnames_name} = sub { my ($project, $options) = @_; $options //= {}; - $options->{origin_project} = $project; + if ($input_file->{project}) { + $options = {%$options}; + $options->{origin_project} = $project; + } my $t = sub { RBM::project_config($project, $_[0], { %$options, %$input_file }) }; @@ -791,6 +793,7 @@ sub input_files { if ($input_file->{project}) { $proj_out_dir = path(project_step_config($t->('project'), 'output_dir', { %$options, step => $t->('pkg_type'), + origin_project => $project, output_dir => undef, %$input_file })); } else { $proj_out_dir = path(project_config($project, 'output_dir', @@ -802,7 +805,8 @@ sub input_files { $url ? basename($url) : undef; $name //= project_step_config($t->('project'), 'filename', - {%$options, step => $t->('pkg_type'), %$input_file}) + {%$options, step => $t->('pkg_type'), + origin_project => $project, %$input_file}) if $input_file->{project}; exit_error("Missing filename:\n" . pp($input_file)) unless $name; my ($fname) = file_in_dir($name, $src_dir, $proj_out_dir); @@ -827,7 +831,8 @@ sub input_files { my $run_save = $config->{run}; $config->{run} = { target => $input_file->{target} }; $config->{run}{target} //= $run_save->{target}; - build_pkg($p, {%$options, %$input_file, output_dir => $proj_out_dir}); + build_pkg($p, {%$options, origin_project => $project, %$input_file, + output_dir => $proj_out_dir}); $config->{run} = $run_save; print "Finished build of project $p - $name\n"; } else {

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! Bug 12827: Create preference to disable SVG.
by gk＠torproject.org 26 Apr '17

26 Apr '17

commit 2d386f0b0ce34aaf97b814da1867bb94a93b62a2 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Wed Apr 19 16:29:59 2017 -0400 fixup! Bug 12827: Create preference to disable SVG. If the top window's URI is not available, check for the system principal to determine if SVGs may be used. This fixes bug 21962. --- layout/svg/nsSVGUtils.cpp | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/layout/svg/nsSVGUtils.cpp b/layout/svg/nsSVGUtils.cpp index 1217e92..98dd287e 100644 --- a/layout/svg/nsSVGUtils.cpp +++ b/layout/svg/nsSVGUtils.cpp @@ -114,6 +114,7 @@ NS_SVGEnabledForChannel(nsIChannel *aChannel) #ifdef DEBUG_SVG_ENABLE nsAutoCString topDocSpec; // Set if approved via a whitelisted top doc. + bool checkedSystemPrincipal = false; #endif bool isSVGAllowed = false; @@ -152,6 +153,18 @@ NS_SVGEnabledForChannel(nsIChannel *aChannel) if (isSVGAllowed) topDocURI->GetSpec(topDocSpec); #endif + } else { + // Unable to retrieve the top window's URI. Fallback to checking + // the system principal (see bug 21962). +#ifdef DEBUG_SVG_ENABLE + checkedSystemPrincipal = true; +#endif + nsCOMPtr<nsIScriptObjectPrincipal> scriptObjPrin = + do_QueryInterface(topWin); + if (scriptObjPrin) { + isSVGAllowed = nsContentUtils::IsSystemPrincipal( + scriptObjPrin->GetPrincipal()); + } } } } @@ -166,7 +179,10 @@ NS_SVGEnabledForChannel(nsIChannel *aChannel) if (uri) uri->GetSpec(spec); - if (topDocSpec.IsEmpty()) { + if (checkedSystemPrincipal) { + printf("NS_SVGEnabledForChannel for %s: %s (via system principal check)\n", + spec.get(), isSVGAllowed ? "YES" : "NO"); + } else if (topDocSpec.IsEmpty()) { printf("NS_SVGEnabledForChannel for %s: %s\n", spec.get(), isSVGAllowed ? "YES" : "NO"); } else {

1 0

[rbm/master] Give access to input files in remote_start
by boklm＠torproject.org 25 Apr '17

25 Apr '17

commit 4ba70051b24eb0cf71f3d57f66a1c604d7d1125d Author: Nicolas Vigier <boklm(a)torproject.org> Date: Tue Apr 25 22:17:17 2017 +0200 Give access to input files in remote_start --- doc/rbm_remote.asc | 4 +++- lib/RBM.pm | 5 ++++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/doc/rbm_remote.asc b/doc/rbm_remote.asc index 8888696..479062a 100644 --- a/doc/rbm_remote.asc +++ b/doc/rbm_remote.asc @@ -44,7 +44,9 @@ remote_get:: remote_start:: the template of a command that will start the remote host before we can access it. This can be useful for instance if you need - to start a VM, or fetch a container. + to start a VM, or fetch a container. If access to an input file is + needed, the +remote_srcdir+ option is pointing to a temporary + directory containing the input files. remote_finish:: the template of a command that will stop the remote host after diff --git a/lib/RBM.pm b/lib/RBM.pm index 79e0670..c92ae65 100644 --- a/lib/RBM.pm +++ b/lib/RBM.pm @@ -949,7 +949,10 @@ sub build_run { my @scripts = ('pre', $script_name, 'post'); my %scripts_root = ( pre => 1, post => 1); if (project_config($project, "remote_exec", $options)) { - my $cmd = project_config($project, "remote_start", $options); + my $cmd = project_config($project, "remote_start", { + %$options, + remote_srcdir => $srcdir, + }); if ($cmd) { my ($stdout, $stderr, $success, $exit_code) = run_script($project, $cmd, \&capture_exec);

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! Bug 6253: Add canvas image extraction prompt.
by gk＠torproject.org 25 Apr '17

25 Apr '17

commit 1182bee9789a632f374f0a6d3ed90f21af1e37c5 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue Apr 25 11:52:26 2017 -0400 fixup! Bug 6253: Add canvas image extraction prompt. Bug 21778: Canvas prompt not showing in Tor Browser based in ESR52 When running in multiprocess mode, use IPC to relay the canvas-permissions-prompt observer notification to the chrome (parent) process. --- browser/base/content/browser.js | 23 +++++++++++++++++++---- dom/canvas/CanvasUtils.cpp | 17 ++++++++++++++--- dom/ipc/PBrowser.ipdl | 8 ++++++++ dom/ipc/TabParent.cpp | 12 ++++++++++++ dom/ipc/TabParent.h | 1 + 5 files changed, 54 insertions(+), 7 deletions(-) diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js index 686805fb..83aca07 100755 --- a/browser/base/content/browser.js +++ b/browser/base/content/browser.js @@ -6302,20 +6302,35 @@ var CanvasPermissionPromptHelper = { Services.obs.removeObserver(this, this._permissionsPrompt, false); }, - // aSubject is an nsIDOMWindow. + // aSubject is an nsIBrowser (e10s) or an nsIDOMWindow (non-e10s). // aData is an URL string. observe: function CanvasPermissionPromptHelper_observe(aSubject, aTopic, aData) { if (aTopic != this._permissionsPrompt) { - throw new Error("Unexpected topic"); + throw new Error("Unexpected topic"); } + + let browser; + try { + browser = aSubject.QueryInterface(Ci.nsIBrowser); + } catch (e) {} + + if (!browser) { + try { + let contentWindow = aSubject.QueryInterface(Ci.nsIDOMWindow); + browser = gBrowser.getBrowserForContentWindow(contentWindow); + } catch (e) {} + + if (!browser) { + throw new Error("No browser"); + } + } + if (!aData) { throw new Error("Missing URL"); } var uri = makeURI(aData); - var contentWindow = aSubject.QueryInterface(Ci.nsIDOMWindow); - var browser = gBrowser.getBrowserForContentWindow(contentWindow); if (gBrowser.selectedBrowser !== browser) { // Must belong to some other window. return; diff --git a/dom/canvas/CanvasUtils.cpp b/dom/canvas/CanvasUtils.cpp index bd5c44d..dceccfd 100644 --- a/dom/canvas/CanvasUtils.cpp +++ b/dom/canvas/CanvasUtils.cpp @@ -15,6 +15,7 @@ #include "nsICanvasRenderingContextInternal.h" #include "nsIHTMLCollection.h" #include "mozilla/dom/HTMLCanvasElement.h" +#include "mozilla/dom/TabChild.h" #include "nsIPrincipal.h" #include "nsGfxCIID.h" @@ -144,9 +145,19 @@ bool IsImageExtractionAllowed(nsIDocument *aDocument, JSContext *aCx) nsContentUtils::LogMessageToConsole(message.get()); // Prompt the user (asynchronous). - nsCOMPtr<nsIObserverService> obs = mozilla::services::GetObserverService(); - obs->NotifyObservers(win, TOPIC_CANVAS_PERMISSIONS_PROMPT, - NS_ConvertUTF8toUTF16(topLevelDocURISpec).get()); + if (XRE_IsContentProcess()) { + TabChild* tabChild = TabChild::GetFrom(win); + if (tabChild) { + tabChild->SendShowCanvasPermissionPrompt(topLevelDocURISpec); + } + } else { + nsCOMPtr<nsIObserverService> obs = + mozilla::services::GetObserverService(); + if (obs) { + obs->NotifyObservers(win, TOPIC_CANVAS_PERMISSIONS_PROMPT, + NS_ConvertUTF8toUTF16(topLevelDocURISpec).get()); + } + } // We don't extract the image for now -- user may override at prompt. return false; diff --git a/dom/ipc/PBrowser.ipdl b/dom/ipc/PBrowser.ipdl index 249657c..cc4c4dc 100644 --- a/dom/ipc/PBrowser.ipdl +++ b/dom/ipc/PBrowser.ipdl @@ -619,6 +619,14 @@ parent: */ async RequestCrossBrowserNavigation(uint32_t aGlobalIndex); + /** + * This function is used to notify the parent that it should display a + * canvas permission prompt. + * + * @param aFirstPartyURI first party of the tab that is requesting access. + */ + async ShowCanvasPermissionPrompt(nsCString aFirstPartyURI); + child: /** * Notify the remote browser that it has been Show()n on this diff --git a/dom/ipc/TabParent.cpp b/dom/ipc/TabParent.cpp index 0df4c12..ff1b41a 100644 --- a/dom/ipc/TabParent.cpp +++ b/dom/ipc/TabParent.cpp @@ -3277,6 +3277,18 @@ TabParent::RecvRequestCrossBrowserNavigation(const uint32_t& aGlobalIndex) return NS_SUCCEEDED(frameLoader->RequestGroupedHistoryNavigation(aGlobalIndex)); } +bool +TabParent::RecvShowCanvasPermissionPrompt(const nsCString& firstPartyURI) +{ + nsCOMPtr<nsIBrowser> browser = do_QueryInterface(mFrameElement); + NS_ENSURE_TRUE(browser, false); + nsCOMPtr<nsIObserverService> os = services::GetObserverService(); + NS_ENSURE_TRUE(os, false); + nsresult rv = os->NotifyObservers(browser, "canvas-permissions-prompt", + NS_ConvertUTF8toUTF16(firstPartyURI).get()); + return NS_SUCCEEDED(rv); +} + NS_IMETHODIMP FakeChannel::OnAuthAvailable(nsISupports *aContext, nsIAuthInformation *aAuthInfo) { diff --git a/dom/ipc/TabParent.h b/dom/ipc/TabParent.h index 43afb05..b8022e1 100644 --- a/dom/ipc/TabParent.h +++ b/dom/ipc/TabParent.h @@ -633,6 +633,7 @@ protected: virtual bool RecvNotifySessionHistoryChange(const uint32_t& aCount) override; virtual bool RecvRequestCrossBrowserNavigation(const uint32_t& aGlobalIndex) override; + virtual bool RecvShowCanvasPermissionPrompt(const nsCString& firstPartyURI) override; ContentCacheInParent mContentCache;

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 25 Apr '17

25 Apr '17

commit 6133397c142c1c58ec7da8aabd5a952a01d6fc6b Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Mon Apr 24 10:35:08 2017 -0700 fixup! TB4: Tor Browser's Firefox preference overrides. Fixes bug 10283 and disables the SpeechSynthesis API. --- browser/app/profile/000-tor-browser.js | 1 + 1 file changed, 1 insertion(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 305666a..9ca4149 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -149,6 +149,7 @@ pref("ui.use_standins_for_native_colors", true); // https://bugzilla.mozilla.org pref("browser.reader.detectedFirstArticle", true); pref("reader.parse-on-load.enabled", false); pref("privacy.use_utc_timezone", true); +pref("media.webspeech.synth.enabled", false); // Bug 10283: Disable SpeechSynthesis API // Third party stuff pref("network.cookie.cookieBehavior", 1);

1 0

[tor-browser-build/master] Update ChangeLog
by boklm＠torproject.org 23 Apr '17

23 Apr '17

commit b9fc5fc4a562ea8c5d7fdb797fd3c1ea6f6b413e Author: Nicolas Vigier <boklm(a)torproject.org> Date: Sun Apr 23 23:37:40 2017 +0200 Update ChangeLog --- .../tor-browser/Bundle-Data/Docs/ChangeLog.txt | 291 +++++++++++++++++++++ 1 file changed, 291 insertions(+) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 92b638d..b2ee463 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,294 @@ +Tor Browser 7.0a3 -- April 20 2017 + * All Platforms + * Update Firefox to 52.1.0esr + * Tor to 0.3.0.5-rc + * Update Torbutton to 1.9.7.2 + * Bug 21865: Update our JIT preferences in the security slider + * Bug 21747: Make 'New Tor Circuit for this Site' work in ESR52 + * Bug 21745: Fix handling of catch-all circuit + * Bug 21547: Fix circuit display under e10s + * Bug 21268: e10s compatibility for New Identity + * Bug 21267: Remove window resize implementation for now + * Bug 21201: Make Torbutton multiprocess compatible + * Translations update + * Update Tor Launcher to 0.2.12 + * Bug 21920: Don't show locale selection dialog + * Bug 21546: Mark Tor Launcher as multiprocess compatible + * Bug 21264: Add a README file + * Translations update + * Update HTTPS-Everywhere to 5.2.14 + * Update NoScript to 5.0.2 + * Update sandboxed-tor-browser to 0.0.5 + * Bug 21764: Use bubblewrap's `--die-with-parent` when supported + * Fix e10s Web Content crash on systems with grsec kernels + * Bug 21928: Force a reinstall if an existing hardened bundle is present + * Bug 21929: Remove hardened/ASAN related code + * Bug 21927: Remove the ability to install/update the hardened bundle + * Bug 21244: Update the MAR signing key for 7.0 + * Bug 21536: Remove asn's scramblesuit bridge from Tor Browser + * Add `prlimit64` to the firefox system call whitelist + * Fix compilation with Go 1.8 + * Use Config.Clone() to clone TLS configs when available + * Update Go to 1.7.5 (bug 21709) + * Bug 21555+16450: Don't remove Authorization header on subdomains (e.g. Twitter) + * Bug 21887: Fix broken error pages on higher security levels + * Bug 21876: Enable e10s by default on all supported platforms + * Bug 21876: Always use esr policies for e10s + * Bug 20905: Fix resizing issues after moving to a direct Firefox patch + * Bug 21875: Modal dialogs are maximized in ESR52 nightly builds + * Bug 21885: SVG is not disabled in Tor Browser based on ESR52 + * Bug 17334: Hide Referer when leaving a .onion domain (improved patch) + * Bug 3246: Double-key cookies + * Bug 8842: Fix XML parsing error + * Bug 16886: 16886: "Add-on compatibility check dialog" contains Firefox logo + * Bug 19192: Untrust Blue Coat CA + * Bug 19955: Avoid confusing warning that favicon load request got cancelled + * Bug 20005: Backport fixes for memory leaks investigation + * Bug 20755: ltn.com.tw is broken in Tor Browser + * Bug 21896: Commenting on website is broken due to CAPTCHA not being displayed + * Bug 20680: Rebase Tor Browser patches to 52 ESR + * Bug 21917: Add new obfs4 bridges + * Bug 21918: Move meek-amazon to d2cly7j4zqgua7.cloudfront.net backend + * Windows + * Bug 21795: Fix Tor Browser crashing on github.com + * Bug 12426: Make use of HeapEnableTerminationOnCorruption + * Bug 19316: Make sure our Windows updates can deal with the SSE2 requirement + * Bug 21868: Fix build bustage with FIREFOX_52_0_2esr_RELEASE for Windows + * OS X + * Bug 21723: Fix inconsistent generation of MOZ_MACBUNDLE_ID + * Bug 21724: Make Firefox and Tor Browser distinct macOS apps + * Bug 21931: Backport OSX SetupMacCommandLine updater fixes + * Bug 15910: Don't download GMPs via the local fallback + * Linux + * Bug 21907: Fix runtime error on CentOS 6 + * Bug 21748: Fix broken Snowflake build and update bridge details + * Bug 21954: Snowflake breaks the 7.0a3 build + * Bug 15910: Don't download GMPs via the local fallback + * Build system + * Windows + * Bug 21837: Fix reproducibility of accessibility code for Windows + * Bug 21240: Create patches to fix mingw-w64 compilation of Firefox ESR 52 + * Bug 21904: Bump mingw-w64 commit to help with sandbox compilation + * Bug 18831: Use own Yasm for Firefox cross-compilation + * OS X + * Bug 21328: Updating to clang 3.8.0 + * Bug 21754: Remove old GCC toolchain and macOS SDK + * Bug 19783: Remove unused macOS helper scripts + * Bug 10369: Don't use old GCC toolchain anymore for utils + * Bug 21753: Replace our old GCC toolchain in PT descriptor + * Bug 18530: ESR52 based Tor Browser only runs on macOS 10.9+ + * Linux + * Bug 21930: NSS libraries are missing from mar-tools archive + * Bug 21239: Adapt Linux Firefox descriptor to ESR52 (use GTK2) + * Bug 21960: Linux bundles based on ESR 52 are not reproducible anymore + * Bug 21629: Fix broken ASan builds when switching to ESR 52 + +Tor Browser 7.0a2-hardened -- March 7 2017 + * All Platforms + * Update Firefox to 45.8.0esr + * Tor to 0.3.0.4-rc + * OpenSSL to 1.0.2k + * Update Torbutton to 1.9.7.1 + * Bug 21396: Allow leaking of resource/chrome URIs (off by default) + * Bug 21574: Add link for zh manual and create manual links dynamically + * Bug 21330: Non-usable scrollbar appears in tor browser security settings + * Bug 21324: Don't update NoScript button with timer update + * Translation updates + * Update HTTPS-Everywhere to 5.2.11 + * Bug 21514: Restore W^X JIT implementation removed from ESR45 + * Bug 21536: Remove scramblesuit bridge + * Bug 21342: Move meek-azure to the meek.azureedge.net backend and cymrubridge02 bridge + * Bug 21326: Update the "Using a system-installed Tor" section in start script + * Build system + * Bug 17034: Use our built binutils and GCC for building tor + * Code clean-up + +Tor Browser 7.0a2 -- March 7 2017 + * All Platforms + * Update Firefox to 45.8.0esr + * Tor to 0.3.0.4-rc + * OpenSSL to 1.0.2k + * Update Torbutton to 1.9.7.1 + * Bug 21396: Allow leaking of resource/chrome URIs (off by default) + * Bug 21574: Add link for zh manual and create manual links dynamically + * Bug 21330: Non-usable scrollbar appears in tor browser security settings + * Bug 21324: Don't update NoScript button with timer update + * Translation updates + * Update HTTPS-Everywhere to 5.2.11 + * Bug 21514: Restore W^X JIT implementation removed from ESR45 + * Bug 21536: Remove scramblesuit bridge + * Bug 21342: Move meek-azure to the meek.azureedge.net backend and cymrubridge02 bridge + * Bug 21348: Make snowflake only available on Linux for now + * Linux + * Bug 21326: Update the "Using a system-installed Tor" section in start script + * Build system + * OS X + * Bug 21343: Remove unused FTE related parts for macOS + * Linux + * Bug 17034: Use our built binutils and GCC for building tor + * Clean-up + +Tor Browser 6.5.1 -- March 7 2017 + * All Platforms + * Update Firefox to 45.8.0esr + * Tor to 0.2.9.10 + * OpenSSL to 1.0.2k + * Update Torbutton to 1.9.6.14 + * Bug 21396: Allow leaking of resource/chrome URIs (off by default) + * Bug 21574: Add link for zh manual and create manual links dynamically + * Bug 21330: Non-usable scrollbar appears in tor browser security settings + * Translation updates + * Update HTTPS-Everywhere to 5.2.11 + * Bug 21514: Restore W^X JIT implementation removed from ESR45 + * Bug 21536: Remove scramblesuit bridge + * Bug 21342: Move meek-azure to the meek.azureedge.net backend and cymrubridge02 bridge + * Linux + * Bug 21326: Update the "Using a system-installed Tor" section in start script + +Tor Browser 7.0a1-hardened -- January 25 2017 + * All Platforms + * Update Firefox to 45.7.0esr + * Tor to 0.3.0.2-alpha + * Update Torbutton to 1.9.7 + * Bug 19898: Use DuckDuckGo on about:tor + * Bug 21091: Hide the update check menu entry when running under the sandbox + * Bug 21243: Add links to es, fr, and pt Tor Browser manual + * Bug 21194: Show snowflake in the circuit display + * Bug 21131: Remove 2016 donation banner + * Translation updates + * Update HTTPS-Everywhere to 5.2.9 + * Update NoScript to 2.9.5.3 + * Bug 20471: Allow javascript: links from HTTPS first party pages + * Bug 20651: DuckDuckGo does not work with JavaScript disabled + * Bug 20589: Add new MAR signing key + * Bug 20735: Add snowflake pluggable transport to alpha Linux builds + * Build system + * All platforms + * Bug 20927: Upgrade Go to 1.7.4 + +Tor Browser 7.0a1 -- January 25 2017 + * All Platforms + * Update Firefox to 45.7.0esr + * Tor to 0.3.0.2-alpha + * Update Torbutton to 1.9.7 + * Bug 19898: Use DuckDuckGo on about:tor + * Bug 21091: Hide the update check menu entry when running under the sandbox + * Bug 21243: Add links to es, fr, and pt Tor Browser manual + * Bug 21194: Show snowflake in the circuit display + * Bug 21131: Remove 2016 donation banner + * Translation updates + * Update HTTPS-Everywhere to 5.2.9 + * Update NoScript to 2.9.5.3 + * Bug 20471: Allow javascript: links from HTTPS first party pages + * Bug 20651: DuckDuckGo does not work with JavaScript disabled + * Bug 20589: Add new MAR signing key + * Windows + * Bug 20981: On Windows, check TZ for timezone first + * OS X + * Bug 20989: Browser sandbox profile is too restrictive on OSX 10.12.2 + * Linux + * Update sandboxed-tor-browser to 0.0.3 + * Bug 20735: Add snowflake pluggable transport to alpha Linux builds + * Build system + * All platforms + * Bug 20927: Upgrade Go to 1.7.4 + * Linux + * Bug 21103: Update descriptors for sandboxed-tor-browser 0.0.3 + +Tor Browser 6.5 -- January 24 2017 + * All Platforms + * Update Firefox to 45.7.0esr + * Tor to 0.2.9.9 + * OpenSSL to 1.0.2j + * Update Torbutton to 1.9.6.12 + * Bug 16622: Timezone spoofing moved to tor-browser.git + * Bug 17334: Move referrer spoofing for .onion domains into tor-browser.git + * Bug 8725: Block addon resource and url fingerprinting with nsIContentPolicy + * Bug 20701: Allow the directory listing stylesheet in the content policy + * Bug 19837: Whitelist internal URLs that Firefox requires for media + * Bug 19206: Avoid SOCKS auth and NEWNYM collisions when sharing a tor client + * Bug 19273: Improve external app launch handling and associated warnings + * Bug 15852: Remove/synchronize Torbutton SOCKS pref logic + * Bug 19733: GETINFO response parser doesn't handle AF_UNIX entries + IPv6 + * Bug 17767: Make "JavaScript disabled" more visible in Security Slider + * Bug 20556: Use pt-BR strings from now on + * Bug 20614: Add links to Tor Browser User Manual + * Bug 20414: Fix non-rendering arrow on OS X + * Bug 20728: Fix bad preferences.xul dimensions + * Bug 19898: Use DuckDuckGo on about:tor + * Bug 21091: Hide the update check menu entry when running under the sandbox + * Bug 19459: Move resizing code to tor-browser.git + * Bug 20264: Change security slider to 3 options + * Bug 20347: Enhance security slider's custom mode + * Bug 20123: Disable remote jar on all security levels + * Bug 20244: Move privacy checkboxes to about:preferences#privacy + * Bug 17546: Add tooltips to explain our privacy checkboxes + * Bug 17904: Allow security settings dialog to resize + * Bug 18093: Remove 'Restore Defaults' button + * Bug 20373: Prevent redundant dialogs opening + * Bug 20318: Remove helpdesk link from about:tor + * Bug 21243: Add links for pt, es, and fr Tor Browser manuals + * Bug 20753: Remove obsolete StartPage locale strings + * Bug 21131: Remove 2016 donation banner + * Bug 18980: Remove obsolete toolbar button code + * Bug 18238: Remove unused Torbutton code and strings + * Bug 20388+20399+20394: Code clean-up + * Translation updates + * Update Tor Launcher to 0.2.10.3 + * Bug 19568: Set CurProcD for Thunderbird/Instantbird + * Bug 19432: Remove special handling for Instantbird/Thunderbird + * Translation updates + * Update HTTPS-Everywhere to 5.2.9 + * Update NoScript to 2.9.5.3 + * Bug 16622: Spoof timezone with Firefox patch + * Bug 17334: Spoof referrer when leaving a .onion domain + * Bug 19273: Write C++ patch for external app launch handling + * Bug 19459: Size new windows to 1000x1000 or nearest 200x100 (Firefox patch) + * Bug 12523: Mark JIT pages as non-writable + * Bug 20123: Always block remote jar files + * Bug 19193: Reduce timing precision for AudioContext, HTMLMediaElement, and MediaStream + * Bug 19164: Remove support for SHA-1 HPKP pins + * Bug 19186: KeyboardEvents are only rounding to 100ms + * Bug 16998: Isolate preconnect requests to URL bar domain + * Bug 19478: Prevent millisecond resolution leaks in File API + * Bug 20471: Allow javascript: links from HTTPS first party pages + * Bug 20244: Move privacy checkboxes to about:preferences#privacy + * Bug 20707: Fix broken preferences tab in non-en-US alpha bundles + * Bug 20709: Fix wrong update URL in alpha bundles + * Bug 19481: Point the update URL to aus1.torproject.org + * Bug 20556: Start using pt-BR instead of pt-PT for Portuguese + * Bug 20442: Backport fix for local path disclosure after drag and drop + * Bug 20160: Backport fix for broken MP3-playback + * Bug 20043: Isolate SharedWorker script requests to first party + * Bug 18923: Add script to run all Tor Browser regression tests + * Bug 20651: DuckDuckGo does not work with JavaScript disabled + * Bug 19336+19835: Enhance about:tbupdate page + * Bug 20399+15852: Code clean-up + * Windows + * Bug 20981: On Windows, check TZ for timezone first + * Bug 18175: Maximizing window and restarting leads to non-rounded window size + * Bug 13437: Rounded inner window accidentally grows to non-rounded size + * OS X + * Bug 20590: Badly resized window due to security slider notification bar on OS X + * Bug 20439: Make the build PIE on OSX + * Linux + * Bug 20691: Updater breaks if unix domain sockets are used + * Bug 15953: Weird resizing dance on Tor Browser startup + * Build system + * All platforms + * Bug 20927: Upgrade Go to 1.7.4 + * Bug 20583: Make the downloads.json file reproducible + * Bug 20133: Don't apply OpenSSL patch anymore + * Bug 19528: Set MOZ_BUILD_DATE based on Firefox version + * Bug 18291: Remove some uses of libfaketime + * Bug 18845: Make zip and tar helpers generate reproducible archives + * OS X + * Bug 20258: Make OS X Tor archive reproducible again + * Bug 20184: Make OS X builds reproducible (use clang for compiling tor) + * Bug 19856: Make OS X builds reproducible (getting libfaketime back) + * Bug 19410: Fix incremental updates by taking signatures into account + * Bug 20210: In dmg2mar, extract old mar file to copy permissions to the new one + Tor Browser 6.5a6-hardened -- December 14 2016 * All Platforms * Update Firefox to 45.6.0esr

1 0

[tor-browser-build/master] Update webrtc, go-webrtc and snowflake
by boklm＠torproject.org 23 Apr '17

23 Apr '17

commit cebffc5e3931f7f921068f44214ff19a0350bf11 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Sun Apr 23 23:29:41 2017 +0200 Update webrtc, go-webrtc and snowflake tor-browser-bundle.git commit: 38689af2a845dfa85765bf52e535c89476863378 tor-browser-bundle.git commit: 121de1ca7cbee29f34f99753a7948c7447e38965 tor-browser-bundle.git commit: e9b16e19134655aa16a8840e09093e01692138d5 --- projects/go-webrtc/config | 6 ++- projects/snowflake/config | 2 +- .../Bundle-Data/PTConfigs/bridge_prefs.js | 2 +- projects/webrtc/build | 58 +++++++++++++--------- projects/webrtc/config | 17 ++++--- projects/webrtc/webrtc-linux.patch | 25 ++++++++++ 6 files changed, 75 insertions(+), 35 deletions(-) diff --git a/projects/go-webrtc/config b/projects/go-webrtc/config index 778d3db..3a1a9d4 100644 --- a/projects/go-webrtc/config +++ b/projects/go-webrtc/config @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' git_url: https://github.com/keroserene/go-webrtc.git -git_hash: 69c5ca70533142494d145b43ef2f46ca94715557 +git_hash: ab1b64862e0c4b4182010699911c2c5818f0a101 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' remote_docker: 1 @@ -23,7 +23,9 @@ var: # the prebuilt libwebrtc-magic.a libraries. Since we build our own # libwebrtc-magic.a with the C++11 ABI, we have to undo that setting here, # using CGO_CXXFLAGS. - export CGO_CXXFLAGS=-D_GLIBCXX_USE_CXX11_ABI=1 + # __STDC_FORMAT_MACROS is needed for a definition of PRIxPTR from inttypes.h. + export CGO_CXXFLAGS="-D_GLIBCXX_USE_CXX11_ABI=1 -D__STDC_FORMAT_MACROS=1" + export CGO_LDFLAGS=-latomic targets: master: diff --git a/projects/snowflake/config b/projects/snowflake/config index 5ba006b..3233ba4 100644 --- a/projects/snowflake/config +++ b/projects/snowflake/config @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' git_url: https://git.torproject.org/pluggable-transports/snowflake.git -git_hash: 6cecd31fd896eb26e64ad8bab8a9ea510ec3b21d +git_hash: 9f2e9a6ecb696149708716ca06ce842df03cf492 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' remote_docker: 1 diff --git a/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js b/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js index bcf3a19..922e181 100644 --- a/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js @@ -39,4 +39,4 @@ pref("extensions.torlauncher.default_bridge.obfs4.21", "obfs4 38.229.1.78:80 C8C pref("extensions.torlauncher.default_bridge.meek-amazon.1", "meek 0.0.2.0:2 B9E7141C594AF25699E0079C1F0146F409495296 url=https://d2zfqthxsdq309.cloudfront.net/ front=a0.awsstatic.com"); pref("extensions.torlauncher.default_bridge.meek-azure.1", "meek 0.0.2.0:3 97700DFE9F483596DDA6264C4D7DF7641E1E39CE url=https://meek.azureedge.net/ front=ajax.aspnetcdn.com"); -pref("extensions.torlauncher.default_bridge.snowflake.1", "snowflake 0.0.3.0:1 B05EC36590AC0374F0E4D36DDA77908FD59D97F3"); +pref("extensions.torlauncher.default_bridge.snowflake.1", "snowflake 0.0.3.0:1 2B280B23E1107BB62ABFC40DDCC8824814F80A72"); diff --git a/projects/webrtc/build b/projects/webrtc/build index 5a70fbe..3ae7ed0 100644 --- a/projects/webrtc/build +++ b/projects/webrtc/build @@ -22,20 +22,17 @@ tar -C /var/tmp/build -xf webrtc-sources-[% c('version') %].tar.gz builddir=/var/tmp/build/[% project %]/src cd $builddir -export GYP_CROSSCOMPILE=1 -export GYP_DEFINES="OS=[% c("var/webrtc/os") %] target_arch=[% c("var/webrtc/arch") %]" -# Do not use bundled utilities. -GYP_DEFINES+=" clang=0 host_clang=0 use_sysroot=0" -GYP_DEFINES+=" linux_use_bundled_gold=0 linux_use_gold_flags=0 linux_use_bundled_binutils=0" -# Avoid some dependencies. Some of these don't seem to work fully; for -# example even with use_alsa=0 we need libasound2-dev. -GYP_DEFINES+=" use_x11=0 use_gtk=0 use_gconf=0 use_alsa=0 use_pulseaudio=0 use_libpci=0 include_internal_audio_device=0 enabled_libjingle_device_manager=0" -# examples and tests also bring in dependencies. -GYP_DEFINES+=" include_examples=0 include_tests=0" -# embedded=1 is supposed to turn of various features; see -# https://bugs.chromium.org/p/chromium/issues/detail?id=318413. -GYP_DEFINES+=" embedded=1" -GYP_DEFINES+=" werror=" + +patch -p1 < $rootdir/webrtc-linux.patch + +# First, build a copy of GN, rather than use the prebuilt copy in buildtools/linux64. +cd tools/gn +# __STDC_FORMAT_MACROS is needed for a definition of PRIxPTR from inttypes.h. +CXXFLAGS=-D__STDC_FORMAT_MACROS=1 LDFLAGS=-latomic ./bootstrap/bootstrap.py --no-rebuild --no-clean +cd ../.. +# This is where bootstrap.py stashes the built gn. +GN="$PWD/out_bootstrap/gn" + [% IF c("var/linux") -%] export CC=gcc export CXX=g++ @@ -48,16 +45,31 @@ GYP_DEFINES+=" werror=" export CXXFLAGS=-m32 export LDFLAGS=-m32 [% END -%] -JAVA_HOME=/usr/lib/jvm/default-java webrtc/build/gyp_webrtc.py -ninja -C out/Release -# Run ninja once more, without include_tests=0, in order to build just the -# FakeAudioCaptureModule that go-webrtc uses. -GYP_DEFINES="$(echo "$GYP_DEFINES" | sed -e 's/include_tests=0//g')" -JAVA_HOME=/usr/lib/jvm/default-java webrtc/build/gyp_webrtc.py -ninja -C out/Release obj/webrtc/api/test/peerconnection_unittests.fakeaudiocapturemodule.o + +export GN_ARGS="" +# For a list of all possible GN args, do "gn gen out/Release; gn args --list out/Release". +# https://chromium.googlesource.com/chromium/src/+/master/tools/gn/docs/cross… +GN_ARGS+=" target_os=\"linux\" target_cpu=\"[% IF c("var/linux-i686") %]x86[% ELSE %]x64[% END %]\"" +# Not debug. +GN_ARGS+=" is_debug=false" +# There are warnings from unused returns. +GN_ARGS+=" treat_warnings_as_errors=false" +# Build static libraries. +GN_ARGS+=" is_component_build=false" +# Do not use bundled utilities. +GN_ARGS+=" is_clang=false use_sysroot=false" +GN_ARGS+=" gold_path=\"$INSTDIR/binutils/bin\"" +# Make extra sure we don't use bundled binutils. +rm -rf third_party/binutils/Linux_* +# Avoid some dependencies. +GN_ARGS+=" use_ozone=true use_gconf=false" +GN_ARGS+=" rtc_include_opus=false rtc_include_ilbc=false rtc_include_internal_audio_device=false rtc_include_pulse_audio=false" +# Included for "field_trial" below. Maybe "fieldtrial_testing_like_official_build" could help here? +#GN_ARGS+=" rtc_include_tests=false" +rm -rf out/Release +"$GN" gen out/Release --args="$GN_ARGS" +ninja -C out/Release webrtc field_trial metrics_default pc_test_utils # https://github.com/keroserene/go-webrtc/issues/23#issuecomment-175312648 -# dump_syms_regtest.o is actually an executable, not an object file. If not -# excluded, it results in the error: # libwebrtc-linux-386-magic.a(dump_syms_regtest.o): unsupported ELF file type 2 ar crs libwebrtc-magic.a $(find . -name '*.o' -not -name '*.main.o' -not -name 'dump_syms_regtest.o' | sort) diff --git a/projects/webrtc/config b/projects/webrtc/config index 52618c2..bfd38c9 100644 --- a/projects/webrtc/config +++ b/projects/webrtc/config @@ -4,7 +4,7 @@ remote_docker: 1 filename: 'webrtc-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' var: - webrtc_tag: f33698296719f956497d2dbff81b5080864a8804 + webrtc_tag: c279861207c5b15fc51069e96595782350e0ac12 input_files: - project: docker-image @@ -17,6 +17,8 @@ input_files: - project: binutils name: binutils enable: '[% c("var/linux") %]' + - filename: webrtc-linux.patch + enable: '[% c("var/linux") %]' targets: linux: @@ -28,16 +30,17 @@ targets: dockerbuild: "[% pc('docker-image', 'pre') %]" sort_deps: 0 arch_deps: - - default-jre-headless - - default-jdk - lib32asound2-dev - lib64expat1 - libexpat1-dev:i386 + - libglib2.0-dev:i386 + - libgtk2.0-dev:i386 - libudev-dev:i386 - libx11-dev:i386 - libxext-dev:i386 - libxrandr-dev:i386 - lib32stdc++6 + - pkg-config - hardening-wrapper webrtc: arch: ia32 @@ -46,14 +49,15 @@ targets: linux-x86_64: var: arch_deps: - - default-jre-headless - - default-jdk - libasound2-dev - libexpat1-dev + - libglib2.0-dev + - libgtk2.0-dev - libudev-dev - libx11-dev - libxext-dev - libxrandr-dev + - pkg-config webrtc: arch: x64 lib_arch: amd64 @@ -70,10 +74,7 @@ steps: # https://webrtc.org/native-code/development/ tar xf [% c('input_files_by_name/depot_tools') %] export PATH="$rootdir/depot_tools:$PATH" - # GYP_CROSSCOMPILE=1 and GYP_DEFINES="use_x11=0" prevent probing for certain dependencies. # Use --no-history because the whole checkout with history is about 12 GB. - export GYP_CROSSCOMPILE=1 - export GYP_DEFINES="use_x11=0" # JAVA_HOME is needed in a hook for libjingle. The readlink line tries to find the current JRE. # default-java comes from the package default-jdk-headless. export JAVA_HOME=/usr/lib/jvm/default-java diff --git a/projects/webrtc/webrtc-linux.patch b/projects/webrtc/webrtc-linux.patch new file mode 100644 index 0000000..b1efb7a --- /dev/null +++ b/projects/webrtc/webrtc-linux.patch @@ -0,0 +1,25 @@ +From ebc1773a92884bec7d93274b2d729ccf76050197 Mon Sep 17 00:00:00 2001 +From: David Fifield <fifield(a)eecs.berkeley.edu> +Date: Wed, 22 Mar 2017 09:53:07 -0400 +Subject: [PATCH] Disable some settings in build_overrides. + +--- + build_overrides/build.gni | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/build_overrides/build.gni b/build_overrides/build.gni +index af4924d4c..ffaafdebc 100644 +--- a/build_overrides/build.gni ++++ b/build_overrides/build.gni +@@ -14,7 +14,7 @@ mac_sdk_min_build_override = "10.11" + enable_java_templates = true + + # Some non-Chromium builds don't use Chromium's third_party/binutils. +-linux_use_bundled_binutils_override = true ++linux_use_bundled_binutils_override = false + + # Variable that can be used to support multiple build scenarios, like having + # Chromium specific targets in a client project's GN file etc. +-- +2.12.1 +

1 0

[tor-browser-build/master] Bug 21918: Move meek-amazon to the d2cly7j4zqgua7.cloudfront.net backend.
by boklm＠torproject.org 23 Apr '17

23 Apr '17

commit abfa8f3f04988154da35154924d8b43c04550b92 Author: David Fifield <david(a)bamsoftware.com> Date: Mon Jan 23 17:48:50 2017 -0800 Bug 21918: Move meek-amazon to the d2cly7j4zqgua7.cloudfront.net backend. Still using the same TorLandMeek bridge. --- projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js b/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js index 922e181..fea436d 100644 --- a/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js @@ -36,7 +36,7 @@ pref("extensions.torlauncher.default_bridge.obfs4.20", "obfs4 85.17.30.79:443 FC pref("extensions.torlauncher.default_bridge.obfs4.21", "obfs4 38.229.1.78:80 C8CBDB2464FC9804A69531437BCF2BE31FDD2EE4 cert=Hmyfd2ev46gGY7NoVxA9ngrPF2zCZtzskRTzoWXbxNkzeVnGFPWmrTtILRyqCTjHR+s9dg iat-mode=1"); /**/pref/**/(/**/"extensions.torlauncher.default_bridge.obfs4.22"/**/, /**/"obfs4 38.229.33.83:80 0BAC39417268B96B9F514E7F63FA6FBA1A788955 cert=VwEFpk9F/UN9JED7XpG1XOjm/O8ZCXK80oPecgWnNDZDv5pdkhq1OpbAH0wNqOT6H6BmRQ iat-mode=1"); -pref("extensions.torlauncher.default_bridge.meek-amazon.1", "meek 0.0.2.0:2 B9E7141C594AF25699E0079C1F0146F409495296 url=https://d2zfqthxsdq309.cloudfront.net/ front=a0.awsstatic.com"); +pref("extensions.torlauncher.default_bridge.meek-amazon.1", "meek 0.0.2.0:2 B9E7141C594AF25699E0079C1F0146F409495296 url=https://d2cly7j4zqgua7.cloudfront.net/ front=a0.awsstatic.com"); pref("extensions.torlauncher.default_bridge.meek-azure.1", "meek 0.0.2.0:3 97700DFE9F483596DDA6264C4D7DF7641E1E39CE url=https://meek.azureedge.net/ front=ajax.aspnetcdn.com"); pref("extensions.torlauncher.default_bridge.snowflake.1", "snowflake 0.0.3.0:1 2B280B23E1107BB62ABFC40DDCC8824814F80A72");

1 0

[tor-browser-build/master] Bug 22025: Fix broken certificate error pages on higher security levels
by boklm＠torproject.org 23 Apr '17

23 Apr '17

commit 899fe6b89d2e5a2bdc46aa50db61c96fbf01927a Author: Georg Koppen <gk(a)torproject.org> Date: Fri Apr 21 06:51:11 2017 +0000 Bug 22025: Fix broken certificate error pages on higher security levels We need to allow JavaScript on `about:certerror` pages explicitly. Otherwise are those pages broken on higher security levels. --- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/projects/tor-browser/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js b/projects/tor-browser/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js index 09f3f8e..2ad9731 100644 --- a/projects/tor-browser/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/projects/tor-browser/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false); diff --git a/projects/tor-browser/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js b/projects/tor-browser/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js index 09f3f8e..2ad9731 100644 --- a/projects/tor-browser/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/projects/tor-browser/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false); diff --git a/projects/tor-browser/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js b/projects/tor-browser/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js index 09f3f8e..2ad9731 100644 --- a/projects/tor-browser/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/projects/tor-browser/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false);

1 0

[tor-browser-bundle/master] Bug 21710: Upgrade Go to 1.8.1.
by gk＠torproject.org 21 Apr '17

21 Apr '17

commit 9d546f20ae711e7df9c574d9bdfccf34ddf1b650 Author: David Fifield <david(a)bamsoftware.com> Date: Mon Mar 13 17:19:30 2017 -0700 Bug 21710: Upgrade Go to 1.8.1. Remove workaround for fixed upstream bug, GitHub #17732 (__MAC_OS_X_VERSION_MAX_ALLOWED). I wasn't able to remove the cc-for-target workaround for GitHub #15457 (CC_FOR_TARGET). Even though according to https://github.com/golang/go/issues/15457 it has been been fixed, make.bash still seems to lose all but the first argument of CC_FOR_TARGET somewhere. --- gitian/descriptors/mac/gitian-pluggable-transports.yml | 3 --- gitian/versions | 4 ++-- gitian/versions.alpha | 4 ++-- gitian/versions.beta | 4 ++-- gitian/versions.nightly | 4 ++-- 5 files changed, 8 insertions(+), 11 deletions(-) diff --git a/gitian/descriptors/mac/gitian-pluggable-transports.yml b/gitian/descriptors/mac/gitian-pluggable-transports.yml index c430bb8..75ad899 100644 --- a/gitian/descriptors/mac/gitian-pluggable-transports.yml +++ b/gitian/descriptors/mac/gitian-pluggable-transports.yml @@ -93,9 +93,6 @@ script: | export GOARCH=amd64 tar xvf go.tar.gz cd go/src - # Remove a preprocessor directive that causes problems when building with the 10.7 SDK. - # https://github.com/golang/go/issues/17732 - sed -i -e '/^#cgo CFLAGS:/s/-D__MAC_OS_X_VERSION_MAX_ALLOWED=1060//' crypto/x509/root_cgo_darwin.go CGO_ENABLED=1 CC_FOR_TARGET="$CC_FOR_TARGET" CC= CFLAGS= LDFLAGS= ./make.bash cd ../.. export PATH="$PATH:$PWD/go/bin" diff --git a/gitian/versions b/gitian/versions index e64baa4..8cb2278 100755 --- a/gitian/versions +++ b/gitian/versions @@ -65,7 +65,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 # We need a Go 1.4 to bootstrap later versions; see https://golang.org/doc/install/source#go14 GO14_VER=1.4.3 -GO_VER=1.7.5 +GO_VER=1.8.1 NSIS_VER=2.51 YASM_VER=1.2.0 @@ -119,7 +119,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 -GO_HASH=4e834513a2079f8cbbd357502cccaac9507fd00a1efe672375798858ff291815 +GO_HASH=33daf4c03f86120fdfdc66bddf6bfff4661c7ca11c5da473e537f4d69b470e57 NSIS_HASH=43d4c9209847e35eb6e2c7cd5a7586e1445374c056c2c7899e40a080e17a1be7 NSIS_DEBIAN_HASH=1dee6957b4a4b8dfe69bcf28bc7f301a13b96b3fa5a394e36c8926ae781e774a GCC_HASH=b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad diff --git a/gitian/versions.alpha b/gitian/versions.alpha index d1ea48b..adb9dbf 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -68,7 +68,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 # We need a Go 1.4 to bootstrap later versions; see https://golang.org/doc/install/source#go14 GO14_VER=1.4.3 -GO_VER=1.7.5 +GO_VER=1.8.1 NSIS_VER=2.51 YASM_VER=1.2.0 @@ -122,7 +122,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 -GO_HASH=4e834513a2079f8cbbd357502cccaac9507fd00a1efe672375798858ff291815 +GO_HASH=33daf4c03f86120fdfdc66bddf6bfff4661c7ca11c5da473e537f4d69b470e57 NSIS_HASH=43d4c9209847e35eb6e2c7cd5a7586e1445374c056c2c7899e40a080e17a1be7 NSIS_DEBIAN_HASH=1dee6957b4a4b8dfe69bcf28bc7f301a13b96b3fa5a394e36c8926ae781e774a GCC_HASH=b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad diff --git a/gitian/versions.beta b/gitian/versions.beta index ed7c124..7d843c7 100755 --- a/gitian/versions.beta +++ b/gitian/versions.beta @@ -54,7 +54,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 # We need a Go 1.4 to bootstrap later versions; see https://golang.org/doc/install/source#go14 GO14_VER=1.4.3 -GO_VER=1.7.5 +GO_VER=1.8.1 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz @@ -99,7 +99,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 -GO_HASH=4e834513a2079f8cbbd357502cccaac9507fd00a1efe672375798858ff291815 +GO_HASH=33daf4c03f86120fdfdc66bddf6bfff4661c7ca11c5da473e537f4d69b470e57 STIXMATHFONT_HASH=e3b0f712e2644438eee2d0dcd2b10b2d54f1b972039de95b2f8e800bae1adbd8 NOTOEMOJIFONT_HASH=415dc6290378574135b64c808dc640c1df7531973290c4970c51fdeb849cb0c5 NOTOJPFONT_HASH=3e8146c4ce0945f255cb9dbc12b392380af80bd117e0a60eae555c99c7e618da diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 9142915..4e1618c 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -75,7 +75,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 # We need a Go 1.4 to bootstrap later versions; see https://golang.org/doc/install/source#go14 GO14_VER=1.4.3 -GO_VER=1.7.5 +GO_VER=1.8.1 NSIS_VER=2.51 YASM_VER=1.2.0 @@ -129,7 +129,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 -GO_HASH=4e834513a2079f8cbbd357502cccaac9507fd00a1efe672375798858ff291815 +GO_HASH=33daf4c03f86120fdfdc66bddf6bfff4661c7ca11c5da473e537f4d69b470e57 NSIS_HASH=43d4c9209847e35eb6e2c7cd5a7586e1445374c056c2c7899e40a080e17a1be7 NSIS_DEBIAN_HASH=1dee6957b4a4b8dfe69bcf28bc7f301a13b96b3fa5a394e36c8926ae781e774a GCC_HASH=b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad

1 0

[tor-browser-bundle/master] Bug 22025: Fix broken certificate error pages on higher security levels
by gk＠torproject.org 21 Apr '17

21 Apr '17

commit bf51814f82a93a2f26322a3eea7e31ef061edc6d Author: Georg Koppen <gk(a)torproject.org> Date: Fri Apr 21 06:51:11 2017 +0000 Bug 22025: Fix broken certificate error pages on higher security levels We need to allow JavaScript on `about:certerror` pages explicitly. Otherwise are those pages broken on higher security levels. --- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js index 09f3f8e..2ad9731 100644 --- a/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false); diff --git a/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js index 09f3f8e..2ad9731 100644 --- a/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false); diff --git a/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js index 09f3f8e..2ad9731 100644 --- a/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false);

1 0

[tor-browser-bundle/master] Bump tor-browser branch for nightly builds
by gk＠torproject.org 21 Apr '17

21 Apr '17

commit 5eb70e227d1111080e63b32d24e39b572410237c Author: Georg Koppen <gk(a)torproject.org> Date: Fri Apr 21 08:17:49 2017 +0000 Bump tor-browser branch for nightly builds --- gitian/versions.nightly | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 360f1ba..9142915 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -17,7 +17,7 @@ MULTI_LINGUAL=1 VERIFY_TAGS=0 -FIREFOX_VERSION=52.0.2esr +FIREFOX_VERSION=52.1.0esr TORBROWSER_UPDATE_CHANNEL=default @@ -60,7 +60,7 @@ GITIAN_TAG=tor-browser-builder-4 OPENSSL_VER=1.0.2k GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION -FIREFOX_LANG_BUILD=build1 +FIREFOX_LANG_BUILD=build3 BINUTILS_VER=2.24 GCC_VER=5.1.0 CLANG_VER=3.8.0

1 0

[tor-browser-build/master] Pick up build3 from Mozilla and bug fixes
by boklm＠torproject.org 20 Apr '17

20 Apr '17

commit da2bb257968d238a538ebc6ddfb7da2e35041985 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Apr 20 09:47:04 2017 +0200 Pick up build3 from Mozilla and bug fixes tor-browser-bundle.git commit: 421091532d3536893e715f62cab9055cd822b95a --- projects/firefox-langpacks/config | 2 +- projects/firefox/config | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/projects/firefox-langpacks/config b/projects/firefox-langpacks/config index a645b92..39f04cb 100644 --- a/projects/firefox-langpacks/config +++ b/projects/firefox-langpacks/config @@ -4,7 +4,7 @@ filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/buil var: ff_version: '[% pc("firefox", "var/firefox_version") %]' - ff_build: build1 + ff_build: build3 ff_arch: linux-i686 input_filename: 'dl-langpack-[% c("var/ff_arch") %]-[% c("version") %]' diff --git a/projects/firefox/config b/projects/firefox/config index 14c1cd5..2c74e4b 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' filename: 'firefox-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build2' +git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-2-build1' tag_gpg_id: 1 git_url: https://git.torproject.org/tor-browser.git gpg_keyring: torbutton.gpg

1 0