- tbb-commits - lists.torproject.org

[tor-browser-bundle/hardened-builds] Build gn in linux-webrtc.
by gk＠torproject.org 31 Mar '17

31 Mar '17

commit 45f6ab2698d447441095e8d388fba3a3aa855f57 Author: David Fifield <david(a)bamsoftware.com> Date: Fri Sep 23 13:14:07 2016 -0700 Build gn in linux-webrtc. There is a prebuilt gn binary for linux64, but none for linux32, and anyway we prefer to build from source for reproducibility reasons. --- gitian/descriptors/linux/gitian-webrtc.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/gitian/descriptors/linux/gitian-webrtc.yml b/gitian/descriptors/linux/gitian-webrtc.yml index f18da52..85da679 100644 --- a/gitian/descriptors/linux/gitian-webrtc.yml +++ b/gitian/descriptors/linux/gitian-webrtc.yml @@ -63,6 +63,8 @@ script: | ln -sf hardened-cc c++ cd ~/build export PATH=$INSTDIR/gcc/bin:$INSTDIR/binutils/bin:$PATH + # GN needs libatomic.so.1 here. + export LD_LIBRARY_PATH=$INSTDIR/gcc/lib ARCH="" if [ $GBUILD_BITS == "64" ]; then @@ -80,6 +82,15 @@ script: | # Building webrtc tar xaf webrtc.tar.gz cd webrtc/src + + # First, build a copy of GN, rather than use the prebuilt copy in buildtools/linux64. + cd tools/gn + # __STDC_FORMAT_MACROS is needed for a definition of PRIxPTR from inttypes.h. + CXXFLAGS=-D__STDC_FORMAT_MACROS=1 LDFLAGS=-latomic ./bootstrap/bootstrap.py --no-rebuild --no-clean + cd ../.. + # This is where bootstrap.py stashes the built gn. + GN="$PWD/out_bootstrap/gn" + export GYP_CROSSCOMPILE=1 export GYP_DEFINES="OS=linux target_arch=$(if [ $GBUILD_BITS = 32 ]; then echo ia32; else echo x64; fi)" # Do not use bundled utilities.

1 0

[tor-browser-bundle/master] Build webrtc-linux with GN instead of GYP.
by gk＠torproject.org 31 Mar '17

31 Mar '17

commit 121de1ca7cbee29f34f99753a7948c7447e38965 Author: David Fifield <david(a)bamsoftware.com> Date: Mon Mar 20 16:20:37 2017 -0400 Build webrtc-linux with GN instead of GYP. * Bump webrtc to branch-heads/58 * Also, bumps go-webrtc and snowflake to the latest. * Removes the need to re-run ninja for FakeAudioCaptureModule since "pc_test_utils" includes it. * Update to the new default bridge --- Bundle-Data/PTConfigs/bridge_prefs.js | 2 +- .../linux/gitian-pluggable-transports.yml | 5 +- gitian/descriptors/linux/gitian-webrtc.yml | 54 +++++++++++----------- gitian/fetch-inputs.sh | 3 -- gitian/patches/webrtc-linux.patch | 25 ++++++++++ gitian/versions | 6 +-- gitian/versions.alpha | 6 +-- gitian/versions.beta | 6 +-- gitian/versions.nightly | 2 +- 9 files changed, 68 insertions(+), 41 deletions(-) diff --git a/Bundle-Data/PTConfigs/bridge_prefs.js b/Bundle-Data/PTConfigs/bridge_prefs.js index 61e2a9e..64b7f23 100644 --- a/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/Bundle-Data/PTConfigs/bridge_prefs.js @@ -37,4 +37,4 @@ pref("extensions.torlauncher.default_bridge.obfs4.20", "obfs4 85.17.30.79:443 FC pref("extensions.torlauncher.default_bridge.meek-amazon.1", "meek 0.0.2.0:2 B9E7141C594AF25699E0079C1F0146F409495296 url=https://d2zfqthxsdq309.cloudfront.net/ front=a0.awsstatic.com"); pref("extensions.torlauncher.default_bridge.meek-azure.1", "meek 0.0.2.0:3 97700DFE9F483596DDA6264C4D7DF7641E1E39CE url=https://meek.azureedge.net/ front=ajax.aspnetcdn.com"); -pref("extensions.torlauncher.default_bridge.snowflake.1", "snowflake 0.0.3.0:1 B05EC36590AC0374F0E4D36DDA77908FD59D97F3"); +pref("extensions.torlauncher.default_bridge.snowflake.1", "snowflake 0.0.3.0:1 2B280B23E1107BB62ABFC40DDCC8824814F80A72"); diff --git a/gitian/descriptors/linux/gitian-pluggable-transports.yml b/gitian/descriptors/linux/gitian-pluggable-transports.yml index ecf49de..cd936d5 100644 --- a/gitian/descriptors/linux/gitian-pluggable-transports.yml +++ b/gitian/descriptors/linux/gitian-pluggable-transports.yml @@ -113,6 +113,8 @@ script: | ln -sf hardened-cc c++ cd ~/build export PATH=$INSTDIR/gcc/bin:$INSTDIR/binutils/bin:$PATH + # GN needs libatomic.so.1 here. + export LD_LIBRARY_PATH=$INSTDIR/gcc/lib ARCH="" if [ $GBUILD_BITS == "64" ]; then @@ -309,7 +311,8 @@ script: | # the prebuilt libwebrtc-magic.a libraries. Since we build our own # libwebrtc-magic.a with the C++11 ABI, we have to undo that setting here, # using CGO_CXXFLAGS. - CGO_CXXFLAGS=-D_GLIBCXX_USE_CXX11_ABI=1 go install github.com/keroserene/go-webrtc + # __STDC_FORMAT_MACROS is needed for a definition of PRIxPTR from inttypes.h. + CGO_CXXFLAGS="-D_GLIBCXX_USE_CXX11_ABI=1 -D__STDC_FORMAT_MACROS=1" CGO_LDFLAGS=-latomic go install github.com/keroserene/go-webrtc cd .. # Building snowflake diff --git a/gitian/descriptors/linux/gitian-webrtc.yml b/gitian/descriptors/linux/gitian-webrtc.yml index cab2430..0622fee 100644 --- a/gitian/descriptors/linux/gitian-webrtc.yml +++ b/gitian/descriptors/linux/gitian-webrtc.yml @@ -12,12 +12,13 @@ packages: - "hardening-wrapper" - "libasound2-dev" - "libexpat1-dev" +- "libglib2.0-dev" +- "libgtk2.0-dev" - "libudev-dev" - "libx11-dev" - "libxext-dev" - "libxrandr-dev" -- "default-jre-headless" -- "default-jdk" +- "pkg-config" reference_datetime: "2000-01-01 00:00:00" remotes: - "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git" @@ -29,6 +30,7 @@ files: - "gcc-linux32-utils.zip" - "gcc-linux64-utils.zip" - "webrtc.tar.gz" +- "webrtc-linux.patch" script: | INSTDIR="$HOME/install" export REFERENCE_DATETIME @@ -85,6 +87,7 @@ script: | # Building webrtc tar xaf webrtc.tar.gz cd webrtc/src + patch -p1 < ../../webrtc-linux.patch # First, build a copy of GN, rather than use the prebuilt copy in buildtools/linux64. cd tools/gn @@ -94,32 +97,31 @@ script: | # This is where bootstrap.py stashes the built gn. GN="$PWD/out_bootstrap/gn" - export GYP_CROSSCOMPILE=1 - export GYP_DEFINES="OS=linux target_arch=$(if [ $GBUILD_BITS = 32 ]; then echo ia32; else echo x64; fi)" + export GN_ARGS="" + # For a list of all possible GN args, do "gn gen out/Release; gn args --list out/Release". + # https://chromium.googlesource.com/chromium/src/+/master/tools/gn/docs/cross… + GN_ARGS+=" target_os=\"linux\" target_cpu=\"$(if [ $GBUILD_BITS = 32 ]; then echo x86; else echo x64; fi)\"" + # Not debug. + GN_ARGS+=" is_debug=false" + # There are warnings from unused returns. + GN_ARGS+=" treat_warnings_as_errors=false" + # Build static libraries. + GN_ARGS+=" is_component_build=false" # Do not use bundled utilities. - GYP_DEFINES+=" clang=0 host_clang=0 use_sysroot=0" - GYP_DEFINES+=" linux_use_bundled_gold=0 linux_use_gold_flags=0 linux_use_bundled_binutils=0" - # Avoid some dependencies. Some of these don't seem to work fully; for - # example even with use_alsa=0 we need libasound2-dev. - GYP_DEFINES+=" use_x11=0 use_gtk=0 use_gconf=0 use_alsa=0 use_pulseaudio=0 use_libpci=0 include_internal_audio_device=0 enabled_libjingle_device_manager=0" - # examples and tests also bring in dependencies. - GYP_DEFINES+=" include_examples=0 include_tests=0" - # embedded=1 is supposed to turn of various features; see - # https://bugs.chromium.org/p/chromium/issues/detail?id=318413. - GYP_DEFINES+=" embedded=1" - GYP_DEFINES+=" werror=" - JAVA_HOME=/usr/lib/jvm/default-java webrtc/build/gyp_webrtc.py - ninja -C out/Release - # Run ninja once more, without include_tests=0, in order to build just the - # FakeAudioCaptureModule that go-webrtc uses. - GYP_DEFINES="$(echo "$GYP_DEFINES" | sed -e 's/include_tests=0//g')" - JAVA_HOME=/usr/lib/jvm/default-java webrtc/build/gyp_webrtc.py - ninja -C out/Release obj/webrtc/api/test/peerconnection_unittests.fakeaudiocapturemodule.o + GN_ARGS+=" is_clang=false use_sysroot=false" + GN_ARGS+=" gold_path=\"$INSTDIR/binutils/bin\"" + # Make extra sure we don't use bundled binutils. + rm -rf third_party/binutils/Linux_* + # Avoid some dependencies. + GN_ARGS+=" use_ozone=true use_gconf=false" + GN_ARGS+=" rtc_include_opus=false rtc_include_ilbc=false rtc_include_internal_audio_device=false rtc_include_pulse_audio=false" + # Included for "field_trial" below. Maybe "fieldtrial_testing_like_official_build" could help here? + #GN_ARGS+=" rtc_include_tests=false" + rm -rf out/Release + "$GN" gen out/Release --args="$GN_ARGS" + ninja -C out/Release webrtc field_trial metrics_default pc_test_utils # https://github.com/keroserene/go-webrtc/issues/23#issuecomment-175312648 - # dump_syms_regtest.o is actually an executable, not an object file. If not - # excluded, it results in the error: - # libwebrtc-linux-386-magic.a(dump_syms_regtest.o): unsupported ELF file type 2 - ar crs libwebrtc-magic.a $(find . -name '*.o' -not -name '*.main.o' -not -name 'dump_syms_regtest.o' | sort) + ar crs libwebrtc-magic.a $(find . -name '*.o' -not -name '*.main.o' | sort) cd ../.. # Grabbing the result diff --git a/gitian/fetch-inputs.sh b/gitian/fetch-inputs.sh index b97a577..f141381 100755 --- a/gitian/fetch-inputs.sh +++ b/gitian/fetch-inputs.sh @@ -314,10 +314,7 @@ cd .. # depot_tools must have been downloaded before running this code. dir=webrtc PATH="$PATH:$PWD/depot_tools" -# GYP_CROSSCOMPILE=1 and GYP_DEFINES="use_x11=0" prevent probing for certain dependencies. # Use --no-history because the whole checkout with history is about 12 GB. -export GYP_CROSSCOMPILE=1 -export GYP_DEFINES="use_x11=0" # JAVA_HOME is needed in a hook for libjingle. The readlink line tries to find the current JRE. # default-java comes from the package default-jdk-headless. export JAVA_HOME=/usr/lib/jvm/default-java diff --git a/gitian/patches/webrtc-linux.patch b/gitian/patches/webrtc-linux.patch new file mode 100644 index 0000000..b1efb7a --- /dev/null +++ b/gitian/patches/webrtc-linux.patch @@ -0,0 +1,25 @@ +From ebc1773a92884bec7d93274b2d729ccf76050197 Mon Sep 17 00:00:00 2001 +From: David Fifield <fifield(a)eecs.berkeley.edu> +Date: Wed, 22 Mar 2017 09:53:07 -0400 +Subject: [PATCH] Disable some settings in build_overrides. + +--- + build_overrides/build.gni | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/build_overrides/build.gni b/build_overrides/build.gni +index af4924d4c..ffaafdebc 100644 +--- a/build_overrides/build.gni ++++ b/build_overrides/build.gni +@@ -14,7 +14,7 @@ mac_sdk_min_build_override = "10.11" + enable_java_templates = true + + # Some non-Chromium builds don't use Chromium's third_party/binutils. +-linux_use_bundled_binutils_override = true ++linux_use_bundled_binutils_override = false + + # Variable that can be used to support multiple build scenarios, like having + # Chromium specific targets in a client project's GN file etc. +-- +2.12.1 + diff --git a/gitian/versions b/gitian/versions index 91bea14..69abeb3 100755 --- a/gitian/versions +++ b/gitian/versions @@ -42,9 +42,9 @@ GO_X_NET_TAG=7dbad50ab5b31073856416cdcfeb2796d682f844 OBFS4_TAG=obfs4proxy-0.0.5 NOTOFONTS_TAG=720e34851382ee3c1ef024d8dffb68ffbfb234c2 DEPOT_TOOLS_TAG=28216cd14b44716db5c83634afbdc6e90492652b -WEBRTC_TAG=f33698296719f956497d2dbff81b5080864a8804 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/52 -GO_WEBRTC_TAG=69c5ca70533142494d145b43ef2f46ca94715557 -SNOWFLAKE_TAG=6cecd31fd896eb26e64ad8bab8a9ea510ec3b21d +WEBRTC_TAG=c279861207c5b15fc51069e96595782350e0ac12 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/58 +GO_WEBRTC_TAG=ab1b64862e0c4b4182010699911c2c5818f0a101 +SNOWFLAKE_TAG=9f2e9a6ecb696149708716ca06ce842df03cf492 UNIURI_TAG=8902c56451e9b58ff940bbe5fec35d5f9c04584a GITIAN_TAG=tor-browser-builder-4-1 diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 6c06648..3539d59 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -45,9 +45,9 @@ ERRORS_TAG=248dadf4e9068a0b3e79f02ed0a610d935de5302 GB_TAG=06cc925cce6592e922dcc4839a8b44feb384e71e SANDBOX_TAG=sandboxed-tor-browser-0.0.3 DEPOT_TOOLS_TAG=28216cd14b44716db5c83634afbdc6e90492652b -WEBRTC_TAG=f33698296719f956497d2dbff81b5080864a8804 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/52 -GO_WEBRTC_TAG=69c5ca70533142494d145b43ef2f46ca94715557 -SNOWFLAKE_TAG=6cecd31fd896eb26e64ad8bab8a9ea510ec3b21d +WEBRTC_TAG=c279861207c5b15fc51069e96595782350e0ac12 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/58 +GO_WEBRTC_TAG=ab1b64862e0c4b4182010699911c2c5818f0a101 +SNOWFLAKE_TAG=9f2e9a6ecb696149708716ca06ce842df03cf492 UNIURI_TAG=8902c56451e9b58ff940bbe5fec35d5f9c04584a GITIAN_TAG=tor-browser-builder-4-2 diff --git a/gitian/versions.beta b/gitian/versions.beta index b1342b9..d7db1fd 100755 --- a/gitian/versions.beta +++ b/gitian/versions.beta @@ -30,9 +30,9 @@ GOPTLIB_TAG=0.2 MEEK_TAG=0.25 NOTOFONTS_TAG=720e34851382ee3c1ef024d8dffb68ffbfb234c2 DEPOT_TOOLS_TAG=28216cd14b44716db5c83634afbdc6e90492652b -WEBRTC_TAG=f33698296719f956497d2dbff81b5080864a8804 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/52 -GO_WEBRTC_TAG=69c5ca70533142494d145b43ef2f46ca94715557 -SNOWFLAKE_TAG=6cecd31fd896eb26e64ad8bab8a9ea510ec3b21d +WEBRTC_TAG=c279861207c5b15fc51069e96595782350e0ac12 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/58 +GO_WEBRTC_TAG=ab1b64862e0c4b4182010699911c2c5818f0a101 +SNOWFLAKE_TAG=9f2e9a6ecb696149708716ca06ce842df03cf492 UNIURI_TAG=8902c56451e9b58ff940bbe5fec35d5f9c04584a GITIAN_TAG=tor-browser-builder-3.x-6 diff --git a/gitian/versions.nightly b/gitian/versions.nightly index b9779e2..2045034 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -52,7 +52,7 @@ ERRORS_TAG=248dadf4e9068a0b3e79f02ed0a610d935de5302 GB_TAG=06cc925cce6592e922dcc4839a8b44feb384e71e SANDBOX_TAG=master DEPOT_TOOLS_TAG=master -WEBRTC_TAG=f33698296719f956497d2dbff81b5080864a8804 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/52 +WEBRTC_TAG=c279861207c5b15fc51069e96595782350e0ac12 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/58 GO_WEBRTC_TAG=master SNOWFLAKE_TAG=master UNIURI_TAG=master

1 0

[tor-browser-bundle/master] Build gn in linux-webrtc.
by gk＠torproject.org 31 Mar '17

31 Mar '17

commit 38689af2a845dfa85765bf52e535c89476863378 Author: David Fifield <david(a)bamsoftware.com> Date: Fri Sep 23 13:14:07 2016 -0700 Build gn in linux-webrtc. There is a prebuilt gn binary for linux64, but none for linux32, and anyway we prefer to build from source for reproducibility reasons. --- gitian/descriptors/linux/gitian-webrtc.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/gitian/descriptors/linux/gitian-webrtc.yml b/gitian/descriptors/linux/gitian-webrtc.yml index ba654c5..cab2430 100644 --- a/gitian/descriptors/linux/gitian-webrtc.yml +++ b/gitian/descriptors/linux/gitian-webrtc.yml @@ -66,6 +66,8 @@ script: | ln -sf hardened-cc c++ cd ~/build export PATH=$INSTDIR/gcc/bin:$INSTDIR/binutils/bin:$PATH + # GN needs libatomic.so.1 here. + export LD_LIBRARY_PATH=$INSTDIR/gcc/lib ARCH="" if [ $GBUILD_BITS == "64" ]; then @@ -83,6 +85,15 @@ script: | # Building webrtc tar xaf webrtc.tar.gz cd webrtc/src + + # First, build a copy of GN, rather than use the prebuilt copy in buildtools/linux64. + cd tools/gn + # __STDC_FORMAT_MACROS is needed for a definition of PRIxPTR from inttypes.h. + CXXFLAGS=-D__STDC_FORMAT_MACROS=1 LDFLAGS=-latomic ./bootstrap/bootstrap.py --no-rebuild --no-clean + cd ../.. + # This is where bootstrap.py stashes the built gn. + GN="$PWD/out_bootstrap/gn" + export GYP_CROSSCOMPILE=1 export GYP_DEFINES="OS=linux target_arch=$(if [ $GBUILD_BITS = 32 ]; then echo ia32; else echo x64; fi)" # Do not use bundled utilities.

1 0

[tor-browser-build/master] README: add missing dependencies
by boklm＠torproject.org 31 Mar '17

31 Mar '17

commit 041df309831d73f69b7f2fc47b15211dda7e5e31 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri Mar 31 12:57:04 2017 +0200 README: add missing dependencies --- README | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/README b/README index 07725cf..08904fb 100644 --- a/README +++ b/README @@ -15,7 +15,7 @@ also be running. The sources of most components are downloaded using git, which needs to be installed. The sources of webrtc are downloaded using gclient, which -requires GTK+ 2.0 development files to be installed. +requires GTK+ 2.0 development files and curl to be installed. You also need a few perl modules installed: - YAML::XS @@ -27,6 +27,7 @@ You also need a few perl modules installed: - File::Temp - File::Slurp - File::Path +- File::Copy::Recursive - String::ShellQuote - Sort::Versions - Digest::SHA @@ -40,7 +41,7 @@ If you are running Debian or Ubuntu, you can install them with: libio-captureoutput-perl libfile-slurp-perl \ libstring-shellquote-perl libsort-versions-perl \ libdigest-sha-perl libdata-uuid-perl libdata-dump-perl \ - git libgtk2.0-dev + libfile-copy-recursive-perl git libgtk2.0-dev curl Starting a build

1 0

[tor-launcher/master] Bug 21546: Tor Launcher is multiprocessCompatible
by gk＠torproject.org 29 Mar '17

29 Mar '17

commit 336e7c8731296866dd67a090c010e41fcc26ef69 Author: Georg Koppen <gk(a)torproject.org> Date: Sun Mar 12 20:39:27 2017 +0000 Bug 21546: Tor Launcher is multiprocessCompatible --- src/install.rdf | 1 + 1 file changed, 1 insertion(+) diff --git a/src/install.rdf b/src/install.rdf index 493d976..881aa8a 100644 --- a/src/install.rdf +++ b/src/install.rdf @@ -8,6 +8,7 @@ <em:contributor>Pearl Crescent, LLC</em:contributor> <em:id>tor-launcher(a)torproject.org</em:id> <em:version>0.2.11.1</em:version> + <em:multiprocessCompatible>true</em:multiprocessCompatible> <em:homepageURL>https://www.torproject.org/projects/torbrowser.html</em:homepageURL> <em:updateURL>data:text/plain,</em:updateURL> <em:updateKey>-</em:updateKey>

1 0

[tor-browser-build/master] HTTPS Everywhere: Version bump - 5.2.13
by boklm＠torproject.org 26 Mar '17

26 Mar '17

commit bfc288d54a28f00e088ba9ce08bd718156d8ff2f Author: William Budington <bill(a)eff.org> Date: Sun Mar 26 07:12:49 2017 -0700 HTTPS Everywhere: Version bump - 5.2.13 --- projects/https-everywhere/config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/https-everywhere/config b/projects/https-everywhere/config index 17f9f82..7ef8568 100644 --- a/projects/https-everywhere/config +++ b/projects/https-everywhere/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 5.2.11 +version: 5.2.13 git_url: https://git.torproject.org/https-everywhere.git git_hash: '[% c("version") %]' git_submodule: 1

1 0

[tor-browser-build/master] README: Add libgtk2.0-dev to the list of dependencies
by boklm＠torproject.org 26 Mar '17

26 Mar '17

commit 29f7cffa1199dd89da17a6d7792fe7f265d05a42 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Sun Mar 26 14:45:01 2017 +0200 README: Add libgtk2.0-dev to the list of dependencies --- README | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/README b/README index f4a74e0..07725cf 100644 --- a/README +++ b/README @@ -13,7 +13,9 @@ Your user account should have access to the docker command without using sudo, so it should be in the docker group. The docker daemon should also be running. -The sources are downloaded using git which needs to be installed. +The sources of most components are downloaded using git, which needs to +be installed. The sources of webrtc are downloaded using gclient, which +requires GTK+ 2.0 development files to be installed. You also need a few perl modules installed: - YAML::XS @@ -38,7 +40,7 @@ If you are running Debian or Ubuntu, you can install them with: libio-captureoutput-perl libfile-slurp-perl \ libstring-shellquote-perl libsort-versions-perl \ libdigest-sha-perl libdata-uuid-perl libdata-dump-perl \ - git + git libgtk2.0-dev Starting a build

1 0

[tor-browser-build/master] Bug 21655: add a script to clean old built components
by boklm＠torproject.org 20 Mar '17

20 Mar '17

commit 5d046ea3c4af539e36a886ee3a7b03c07f5d7b48 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Mar 20 18:29:03 2017 +0100 Bug 21655: add a script to clean old built components --- Makefile | 5 ++- README | 10 ++++- rbm | 2 +- rbm.local.conf.example | 28 ++++++++++++ tools/clean-old | 114 +++++++++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 155 insertions(+), 4 deletions(-) diff --git a/Makefile b/Makefile index 9481537..b82309c 100644 --- a/Makefile +++ b/Makefile @@ -86,6 +86,9 @@ submodule-update: fetch: submodule-update $(rbm) fetch -clean-old: submodule-update +clean: submodule-update ./tools/clean-old +clean-dry-run: submodule-update + ./tools/clean-old --dry-run + diff --git a/README b/README index a14fb42..f4a74e0 100644 --- a/README +++ b/README @@ -171,8 +171,14 @@ file. Cleaning obsolete files and containers images --------------------------------------------- -There will be a script to clean old build files and containers that are -no longer used, but it has not been added yet. +You can run 'make clean' to clean old build files and containers that +are no longer used in current builds. Before doing that, you need to +configure the branches and build targets you are using in the +rbm.local.conf file. The cleaning script will checkout all the configured +branches to create a list of used build files, and delete the files +from the 'out' directory that are not used. If you want to see the list +of files and containers that would be removed without doing it, you can +use 'make clean-dry-run'. Multiple build directories on the same host diff --git a/rbm b/rbm index 845bb90..3f3886e 160000 --- a/rbm +++ b/rbm @@ -1 +1 @@ -Subproject commit 845bb904fb87b6c56ab789f35cd02bce32453f52 +Subproject commit 3f3886e1f210ad2853209c5aecd0951350a6f758 diff --git a/rbm.local.conf.example b/rbm.local.conf.example index 2a86647..78de08f 100644 --- a/rbm.local.conf.example +++ b/rbm.local.conf.example @@ -39,6 +39,34 @@ var: ### file. #sign_build_gpg_opts: '--local-user XXXXXXXX' + ### The clean configuration is used by the cleaning script to find the + ### branches and build targets you are using, to compute the list of + ### files that should be kept. + ### + ### If you only do alpha builds for all platforms, you can use the + ### following configuration: + #clean: + # HEAD: + # - project: release + # target: + # - alpha + # - torbrowser-all + # + ### If you are doing 'release' builds in the maint-7.0 branch and + ### 'alpha' builds in the master branch, you can use the following + ### configuration: + #clean: + # master: + # - project: release + # target: + # - alpha + # - torbrowser-all + # maint-7.0: + # - project: release + # target: + # - release + # - torbrowser-all + targets: ### testbuild is based on alpha by default. Uncomment this if you want it diff --git a/tools/clean-old b/tools/clean-old new file mode 100755 index 0000000..4d603fc --- /dev/null +++ b/tools/clean-old @@ -0,0 +1,114 @@ +#!/usr/bin/perl -w +use strict; +use IO::CaptureOutput qw(capture_exec); +use FindBin; +use lib "$FindBin::Bin/../rbm/lib"; +use RBM; +use File::Slurp qw(read_dir write_file read_file); +use Getopt::Long; + +my %options; +my @options_list = qw(dry-run! list-used-files=s project=s target=s@); +Getopt::Long::GetOptionsFromArray(\@ARGV, \%options, @options_list) || exit 1; + +sub clean_file { + my ($file, $used_files) = @_; + return if $used_files->{$file}; + if (-d $file) { + my @l = read_dir($file); + foreach my $subfile (@l) { + clean_file("$file/$subfile", $used_files); + } + @l = read_dir($file); + rmdir $file unless @l; + } else { + print "Removing file $file\n"; + unlink $file unless $options{'dry-run'}; + } +} + +sub clean_docker_images { + my ($dockerdir, $used_files) = @_; + my $imgprefix = RBM::project_config('docker-image', 'docker_image_prefix'); + my @imgs = read_dir($dockerdir); + foreach my $dockerimage (@imgs) { + next if $used_files->{"$dockerdir/$dockerimage"}; + my $img = "$imgprefix:$dockerimage"; + print "Cleaning docker image $img\n"; + next if $options{'dry-run'}; + my ($out, $err, $success) = capture_exec('docker', 'rmi', '-f', $img); + if (!$success) { + print STDERR "Error removing docker image $img:\n$err\n"; + exit 1; + } + unlink "$dockerdir/$dockerimage"; + } +} + +sub get_project_input_files { + my ($project, @targets) = @_; + print "Getting input files for $project ", join(' ', @targets), "\n"; + $RBM::config->{run}{target} = \@targets; + my $res = RBM::project_config($project, 'input_files_paths', + {error_if_undef => 1}); + return ref $res eq 'ARRAY' ? @$res : (); +} + +sub get_input_files { + my ($c) = @_; + my @files; + foreach my $p (@$c) { + my $tmp = File::Temp->new(); + my @args = ("$FindBin::Bin/$FindBin::Script", '--list-used-files', $tmp, + '--project', $p->{project}); + foreach my $target (@{$p->{target}}) { + push @args, ('--target', $target); + } + RBM::exit_error 'Error getting used files' unless system(@args) == 0; + push @files, map { chomp; $_ } read_file($tmp); + } + return @files; +} + +RBM::load_config; +RBM::load_system_config; +RBM::load_local_config; +RBM::set_default_env; + +if ($options{'list-used-files'}) { + if (!$options{project} || !$options{target}) { + RBM::exit_error 'Missing option project or target'; + } + my @files = get_project_input_files($options{project}, @{$options{target}}); + write_file($options{'list-used-files'}, join("\n", @files)); + exit 0; +} + +my $clean = RBM::project_config('clean', 'var/clean'); +if (!$clean) { + print STDERR "Clean configuration is missing. ", + "You should add it to rbm.local.conf.\n"; + exit 1; +} + +my @files = get_input_files($clean->{HEAD}) if $clean->{HEAD}; + +foreach my $branch (keys %$clean) { + next if $branch eq 'HEAD'; + print "Checking out $branch branch\n"; + RBM::exit_error("Error checking out $branch branch") + unless system('git', 'checkout', $branch) == 0; + RBM::exit_error("Error running git submodule update --init") + unless system('git', 'submodule', 'update', '--init') == 0; + push @files, get_input_files($clean->{$branch}); + RBM::exit_error('Error checking out @{-1}') + unless system('git', 'checkout', '@{-1}') == 0; + RBM::exit_error("Error running git submodule update --init") + unless system('git', 'submodule', 'update', '--init') == 0; +} +my %used_files = map { $_ => 1 } @files; +my $outdir = $RBM::config->{basedir} . '/out'; +# Don't clean docker-image files yet +$used_files{"$outdir/docker-image"} = 1; +clean_file($outdir, \%used_files); +clean_docker_images("$outdir/docker-image", \%used_files);

1 0

[rbm/master] Add the input_files_paths option
by boklm＠torproject.org 15 Mar '17

15 Mar '17

commit 3f3886e1f210ad2853209c5aecd0951350a6f758 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Mar 15 12:25:39 2017 +0100 Add the input_files_paths option --- NEWS | 2 ++ doc/rbm_config.asc | 6 ++++++ lib/RBM.pm | 23 ++++++++++++++++++++++- lib/RBM/DefaultConfig.pm | 1 + 4 files changed, 31 insertions(+), 1 deletion(-) diff --git a/NEWS b/NEWS index 5de36e0..4eac374 100644 --- a/NEWS +++ b/NEWS @@ -1,3 +1,5 @@ +- Add the input_files_paths option + - Add the ENV option - Add the build_log option diff --git a/doc/rbm_config.asc b/doc/rbm_config.asc index 48e505c..2e9b8ab 100644 --- a/doc/rbm_config.asc +++ b/doc/rbm_config.asc @@ -220,6 +220,12 @@ input_files_id:: file of type +project+, and the +filename+ and the sha256sum of the file for any other type of input file. +input_files_paths:: + The value of this option is an array of all the paths of input + files that currently exist and are used in the build of the + current project and its dependencies. This is useful when + cleaning old build files, to find which ones are still used. + timestamp:: This is the UNIX timestamp, set as modification time on files created such as the sources tarball and rpm spec file. The diff --git a/lib/RBM.pm b/lib/RBM.pm index 632a8ba..79e0670 100644 --- a/lib/RBM.pm +++ b/lib/RBM.pm @@ -731,8 +731,9 @@ sub input_files { my ($action, $project, $options, $dest_dir) = @_; my @res_copy; my %res_getfnames; + my @res_getfpaths; my $getfnames_noname = 0; - my $need_dl = 1; + my $need_dl = $action ne 'getfpaths'; my $input_files_id = ''; $options = {$options ? %$options : ()}; my $input_files = project_config($project, 'input_files', $options,); @@ -840,6 +841,25 @@ sub input_files { $input_files_id .= "\n"; next; } + if ($action eq 'getfpaths') { + push @res_getfpaths, $fname if $fname; + if ($file_gpg_id && $fname) { + my $sig_ext = $t->('sig_ext'); + $sig_ext = ref $sig_ext eq 'ARRAY' ? $sig_ext : [ $sig_ext ]; + foreach my $s (@$sig_ext) { + if (-f "$fname.$s") { + push @res_getfpaths, "$fname.$s"; + last; + } + } + } + if ($input_file->{project} && $t->('project')) { + my $r = RBM::project_step_config($t->('project'), 'input_files_paths', + {%$options, step => $t->('pkg_type'), %$input_file}); + push @res_getfpaths, @$r if @$r; + } + next; + } exit_error "Missing file $name" unless $fname; if ($t->('sha256sum') && $t->('sha256sum') ne sha256_hex(read_file($fname))) { @@ -886,6 +906,7 @@ sub input_files { return sha256_hex($input_files_id) if $action eq 'input_files_id'; return @res_copy if $action eq 'copy'; return \%res_getfnames if $action eq 'getfnames'; + return \@res_getfpaths if $action eq 'getfpaths'; } sub system_log { diff --git a/lib/RBM/DefaultConfig.pm b/lib/RBM/DefaultConfig.pm index c0764bd..cf0ed74 100644 --- a/lib/RBM/DefaultConfig.pm +++ b/lib/RBM/DefaultConfig.pm @@ -583,6 +583,7 @@ ZIP_END arch => \&get_arch, input_files_by_name => sub { RBM::input_files('getfnames', @_); }, input_files_id => sub { RBM::input_files('input_files_id', @_); }, + input_files_paths => sub { RBM::input_files('getfpaths', @_); }, steps => { srpm => 'rpm', 'deb-src' => 'deb',

1 0

[tor-browser-build/master] Add snowflake
by boklm＠torproject.org 13 Mar '17

13 Mar '17

commit 832c2ce17672d5cd1f554354902df670e6ee928a Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Mar 13 19:39:02 2017 +0100 Add snowflake Only for linux-x86_64 for now, as it fails to build on linux-i686. --- .gitignore | 1 + projects/depot_tools/build | 8 +++ projects/depot_tools/config | 5 ++ projects/gcc/config | 2 +- projects/go-webrtc/config | 53 ++++++++++++++++++++ projects/go/config | 1 + projects/snowflake/build | 38 +++++++++++++++ projects/snowflake/config | 35 ++++++++++++++ projects/tor-browser/build | 3 ++ projects/tor-browser/config | 3 ++ projects/webrtc/build | 80 ++++++++++++++++++++++++++++++ projects/webrtc/config | 115 ++++++++++++++++++++++++++++++++++++++++++++ rbm.conf | 4 ++ 13 files changed, 347 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 9b6754f..0fe0aec 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,6 @@ git_clones hg_clones +gclient out release alpha diff --git a/projects/depot_tools/build b/projects/depot_tools/build new file mode 100644 index 0000000..ac0f21b --- /dev/null +++ b/projects/depot_tools/build @@ -0,0 +1,8 @@ +#!/bin/bash +[% c("var/set_default_env") -%] +tar xf [% project %]-[% c("version") %].tar.gz +mv [% project %]-[% c("version") %] [% project %] +[% c('tar', { + tar_src => [ project ], + tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'), + }) %] diff --git a/projects/depot_tools/config b/projects/depot_tools/config new file mode 100644 index 0000000..40a6d85 --- /dev/null +++ b/projects/depot_tools/config @@ -0,0 +1,5 @@ +# vim: filetype=yaml sw=2 +version: '[% c("abbrev") %]' +git_hash: 28216cd14b44716db5c83634afbdc6e90492652b +git_url: https://chromium.googlesource.com/chromium/tools/depot_tools.git +filename: '[% project %]-[% c("version") %].tar.gz' diff --git a/projects/gcc/config b/projects/gcc/config index bf73b7d..391e453 100644 --- a/projects/gcc/config +++ b/projects/gcc/config @@ -10,7 +10,7 @@ var: - libc6-dev-i386 setup: | mkdir -p /var/tmp/dist - tar -C /var/tmp/dist -xf [% c("compiler_tarfile") %] + tar -C /var/tmp/dist -xf $rootdir/[% c("compiler_tarfile") %] export PATH="/var/tmp/dist/gcc/bin:$PATH" [% IF c("var/osname") == "linux-i686" -%] export LD_LIBRARY_PATH=/var/tmp/dist/gcc/lib32 diff --git a/projects/go-webrtc/config b/projects/go-webrtc/config new file mode 100644 index 0000000..778d3db --- /dev/null +++ b/projects/go-webrtc/config @@ -0,0 +1,53 @@ +# vim: filetype=yaml sw=2 +version: '[% c("abbrev") %]' +git_url: https://github.com/keroserene/go-webrtc.git +git_hash: 69c5ca70533142494d145b43ef2f46ca94715557 +filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' +remote_docker: 1 + +build: '[% c("projects/go/var/build_go_lib") %]' + +var: + go_lib: github.com/keroserene/go-webrtc + build_go_lib_pre: | + [% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] + [% IF c("var/linux") %] + tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/binutils') %] + export PATH="/var/tmp/dist/binutils/bin:$PATH" + [% END -%] + tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/webrtc') %] + # Replace the prebuilt webrtc library with our own one. + rm -rf include/ lib/ + cp -a /var/tmp/dist/webrtc/{include,lib} . + # The go-webrtc package sets _GLIBCXX_USE_CXX11_ABI=0 for compatibility with + # the prebuilt libwebrtc-magic.a libraries. Since we build our own + # libwebrtc-magic.a with the C++11 ABI, we have to undo that setting here, + # using CGO_CXXFLAGS. + export CGO_CXXFLAGS=-D_GLIBCXX_USE_CXX11_ABI=1 + +targets: + master: + git_hash: master + linux-x86_64: + var: + arch_deps: + - pkg-config + - libx11-dev + linux-i686: + var: + arch_deps: + - pkg-config:i386 + - libx11-dev:i386 + - lib32stdc++6 + +input_files: + - project: docker-image + - name: go + project: go + - name: webrtc + project: webrtc + - name: '[% c("var/compiler") %]' + project: '[% c("var/compiler") %]' + - name: binutils + project: binutils + enable: '[% c("var/linux") %]' diff --git a/projects/go/config b/projects/go/config index 5e55a09..870dc50 100644 --- a/projects/go/config +++ b/projects/go/config @@ -35,6 +35,7 @@ var: do patch -p1 < $p done + [% IF c("var/build_go_lib_pre"); GET c("var/build_go_lib_pre"); END; -%] [% IF c("var/go_lib_install") -%] [% FOREACH inst IN c("var/go_lib_install") %] go install [% inst %] diff --git a/projects/snowflake/build b/projects/snowflake/build new file mode 100644 index 0000000..6e08b4e --- /dev/null +++ b/projects/snowflake/build @@ -0,0 +1,38 @@ +#!/bin/bash +[% c("var/set_default_env") -%] +[% pc('go', 'var/setup', { go_tarfile => c('input_files_by_name/go') }) %] +[% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] +[% IF c("var/linux") %] + tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/binutils') %] + export PATH="/var/tmp/dist/binutils/bin:$PATH" +[% END -%] +distdir=/var/tmp/dist/[% project %] +[% IF c("var/osx") %] + PTDIR="$distdir/Contents/MacOS/Tor/PluggableTransports" + DOCSDIR="$distdir/Contents/Resources/TorBrowser/Docs/snowflake" +[% ELSE %] + PTDIR="$distdir/TorBrowser/Tor/PluggableTransports" + DOCSDIR="$distdir/TorBrowser/Docs/snowflake" +[% END %] +mkdir -p $PTDIR $DOCSDIR + +tar -C /var/tmp/dist -xf [% c('input_files_by_name/go-webrtc') %] +tar -C /var/tmp/dist -xf [% c('input_files_by_name/uniuri') %] +tar -C /var/tmp/dist -xf [% c('input_files_by_name/goptlib') %] + +mkdir -p /var/tmp/build +tar -C /var/tmp/build -xf [% project %]-[% c('version') %].tar.gz +cd /var/tmp/build/[% project %]-[% c('version') %] + +cd client +go build -ldflags '-s' +cp -a client[% IF c("var/windows") %].exe[% END %] $PTDIR/snowflake-client[% IF c("var/windows") %].exe[% END %] + +cd .. +cp -a README.md LICENSE $DOCSDIR + +cd $distdir +[% c('tar', { + tar_src => [ '.' ], + tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'), + }) %] diff --git a/projects/snowflake/config b/projects/snowflake/config new file mode 100644 index 0000000..5ba006b --- /dev/null +++ b/projects/snowflake/config @@ -0,0 +1,35 @@ +# vim: filetype=yaml sw=2 +version: '[% c("abbrev") %]' +git_url: https://git.torproject.org/pluggable-transports/snowflake.git +git_hash: 6cecd31fd896eb26e64ad8bab8a9ea510ec3b21d +filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' +remote_docker: 1 + +targets: + linux-i686: + var: + arch_deps: + - pkg-config + - libx11-dev:i386 + - lib32stdc++6 + linux-x86_64: + var: + arch_deps: + - pkg-config + - libx11-dev + +input_files: + - project: docker-image + - name: go + project: go + - name: '[% c("var/compiler") %]' + project: '[% c("var/compiler") %]' + - name: binutils + project: binutils + enable: '[% c("var/linux") %]' + - name: go-webrtc + project: go-webrtc + - name: uniuri + project: uniuri + - name: goptlib + project: goptlib diff --git a/projects/tor-browser/build b/projects/tor-browser/build index 904f1b6..814f7af 100644 --- a/projects/tor-browser/build +++ b/projects/tor-browser/build @@ -52,6 +52,9 @@ mv [% c('input_files_by_name/noscript') %] $TBDIR/$EXTSPATH/{73a6fe31-595d-460b- tar -C $TBDIR -xf [% c('input_files_by_name/obfs4') %] tar -C $TBDIR -xf [% c('input_files_by_name/meek') %] mv $TBDIR/meek-http-helper(a)bamsoftware.com.xpi $TBDIR/$MEEKPROFILEPATH/extensions/ +[% IF c("var/snowflake") %] + tar -C $TBDIR -xf [% c('input_files_by_name/snowflake') -%] +[% END -%] tar -C $TBDIR[% IF c("var/osx") %]/Contents/Resources[% END %] -xf [% c('input_files_by_name/fonts') %] diff --git a/projects/tor-browser/config b/projects/tor-browser/config index 95f444d..f2c1d72 100644 --- a/projects/tor-browser/config +++ b/projects/tor-browser/config @@ -48,6 +48,9 @@ input_files: name: meek - project: obfs4 name: obfs4 + - project: snowflake + name: snowflake + enable: '[% c("var/snowflake") %]' - filename: Bundle-Data - URL: https://addons.cdn.mozilla.net/user-media/addons/722/noscript_security_suit… name: noscript diff --git a/projects/webrtc/build b/projects/webrtc/build new file mode 100644 index 0000000..5a70fbe --- /dev/null +++ b/projects/webrtc/build @@ -0,0 +1,80 @@ +#!/bin/bash +[% c("var/set_default_env") -%] +distdir=/var/tmp/dist/[% project %] +[% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] + +mkdir -p /var/tmp/dist + +[% IF c("var/linux") %] + tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/binutils') %] + export PATH="/var/tmp/dist/binutils/bin:$PATH" +[% END -%] + +# Setting up depot_tools +# https://dev.chromium.org/developers/how-tos/install-depot-tools +tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/depot_tools') %] +export PATH="$PATH:/var/tmp/dist/depot_tools" +# Disable automatic updating. +export DEPOT_TOOLS_UPDATE=0 + +mkdir -p /var/tmp/build +tar -C /var/tmp/build -xf webrtc-sources-[% c('version') %].tar.gz + +builddir=/var/tmp/build/[% project %]/src +cd $builddir +export GYP_CROSSCOMPILE=1 +export GYP_DEFINES="OS=[% c("var/webrtc/os") %] target_arch=[% c("var/webrtc/arch") %]" +# Do not use bundled utilities. +GYP_DEFINES+=" clang=0 host_clang=0 use_sysroot=0" +GYP_DEFINES+=" linux_use_bundled_gold=0 linux_use_gold_flags=0 linux_use_bundled_binutils=0" +# Avoid some dependencies. Some of these don't seem to work fully; for +# example even with use_alsa=0 we need libasound2-dev. +GYP_DEFINES+=" use_x11=0 use_gtk=0 use_gconf=0 use_alsa=0 use_pulseaudio=0 use_libpci=0 include_internal_audio_device=0 enabled_libjingle_device_manager=0" +# examples and tests also bring in dependencies. +GYP_DEFINES+=" include_examples=0 include_tests=0" +# embedded=1 is supposed to turn of various features; see +# https://bugs.chromium.org/p/chromium/issues/detail?id=318413. +GYP_DEFINES+=" embedded=1" +GYP_DEFINES+=" werror=" +[% IF c("var/linux") -%] + export CC=gcc + export CXX=g++ +[% END -%] +[% IF c("var/linux-i686") -%] + GYP_DEFINES+=" target_arch=ia32" + export CC='gcc -m32' + export CXX='g++ -m32' + export CFLAGS=-m32 + export CXXFLAGS=-m32 + export LDFLAGS=-m32 +[% END -%] +JAVA_HOME=/usr/lib/jvm/default-java webrtc/build/gyp_webrtc.py +ninja -C out/Release +# Run ninja once more, without include_tests=0, in order to build just the +# FakeAudioCaptureModule that go-webrtc uses. +GYP_DEFINES="$(echo "$GYP_DEFINES" | sed -e 's/include_tests=0//g')" +JAVA_HOME=/usr/lib/jvm/default-java webrtc/build/gyp_webrtc.py +ninja -C out/Release obj/webrtc/api/test/peerconnection_unittests.fakeaudiocapturemodule.o +# https://github.com/keroserene/go-webrtc/issues/23#issuecomment-175312648 +# dump_syms_regtest.o is actually an executable, not an object file. If not +# excluded, it results in the error: +# libwebrtc-linux-386-magic.a(dump_syms_regtest.o): unsupported ELF file type 2 +ar crs libwebrtc-magic.a $(find . -name '*.o' -not -name '*.main.o' -not -name 'dump_syms_regtest.o' | sort) + +mkdir -p $distdir +cd $distdir +mkdir -p include lib +cp -f $builddir/libwebrtc-magic.a [% c("var/webrtc/lib_path") %] +INCLUDE_DIR="$PWD/include" +cd $builddir +for h in $(find talk/ webrtc/ -type f -name '*.h'); +do + mkdir -p "$INCLUDE_DIR/$(dirname $h)" + cp -f "$h" "$INCLUDE_DIR/$h" +done + +cd /var/tmp/dist +[% c('tar', { + tar_src => [ project ], + tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'), + }) %] diff --git a/projects/webrtc/config b/projects/webrtc/config new file mode 100644 index 0000000..52618c2 --- /dev/null +++ b/projects/webrtc/config @@ -0,0 +1,115 @@ +# vim: filetype=yaml sw=2 +version: '[% c("var/webrtc_tag") %]' +remote_docker: 1 +filename: 'webrtc-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' + +var: + webrtc_tag: f33698296719f956497d2dbff81b5080864a8804 + +input_files: + - project: docker-image + - project: webrtc + pkg_type: fetch_sources + - project: depot_tools + name: depot_tools + - name: '[% c("var/compiler") %]' + project: '[% c("var/compiler") %]' + - project: binutils + name: binutils + enable: '[% c("var/linux") %]' + +targets: + linux: + var: + webrtc: + os: linux + linux-i686: + var: + dockerbuild: "[% pc('docker-image', 'pre') %]" + sort_deps: 0 + arch_deps: + - default-jre-headless + - default-jdk + - lib32asound2-dev + - lib64expat1 + - libexpat1-dev:i386 + - libudev-dev:i386 + - libx11-dev:i386 + - libxext-dev:i386 + - libxrandr-dev:i386 + - lib32stdc++6 + - hardening-wrapper + webrtc: + arch: ia32 + lib_arch: 386 + lib_path: lib/libwebrtc-linux-386-magic.a + linux-x86_64: + var: + arch_deps: + - default-jre-headless + - default-jdk + - libasound2-dev + - libexpat1-dev + - libudev-dev + - libx11-dev + - libxext-dev + - libxrandr-dev + webrtc: + arch: x64 + lib_arch: amd64 + lib_path: lib/libwebrtc-linux-amd64-magic.a + +steps: + fetch_sources: + remote_docker: 0 + filename: 'webrtc-sources-[% c("var/webrtc_tag") %].tar.gz' + fetch_sources: | + #!/bin/bash + [% c("var/set_default_env") -%] + # WebRTC is special, having its own build system that brings in lots of Chromium dependencies. + # https://webrtc.org/native-code/development/ + tar xf [% c('input_files_by_name/depot_tools') %] + export PATH="$rootdir/depot_tools:$PATH" + # GYP_CROSSCOMPILE=1 and GYP_DEFINES="use_x11=0" prevent probing for certain dependencies. + # Use --no-history because the whole checkout with history is about 12 GB. + export GYP_CROSSCOMPILE=1 + export GYP_DEFINES="use_x11=0" + # JAVA_HOME is needed in a hook for libjingle. The readlink line tries to find the current JRE. + # default-java comes from the package default-jdk-headless. + export JAVA_HOME=/usr/lib/jvm/default-java + clone_dir='[% c("basedir") %]/gclient/webrtc' + mkdir -p "$clone_dir" + cd "$clone_dir" + if [ ! -d "src" ]; + then + # "fetch" is part of depot_tools. + #fetch --nohooks --no-history webrtc + # FIXME: To avoid the unconditional `gclient sync` in the call to fetch, + # we inline the result of a `fetch --dry-run` + gclient root + gclient config --spec 'solutions = [ + { + "managed": False, + "name": "src", + "url": "https://chromium.googlesource.com/external/webrtc.git", + "custom_deps": {}, + "deps_file": "DEPS", + "safesync_url": "", + }, + ] + ' + gclient sync --nohooks --no-history --with_branch_heads -r [% c("var/webrtc_tag") %] + cd src + git submodule foreach 'git config -f $toplevel/.git/config submodule.$name.ignore all' + git config --add remote.origin.fetch '+refs/tags/*:refs/tags/*' + git config diff.ignoreSubmodules all + cd .. + fi + # "gclient" is part of depot_tools. This download takes a long time the first time. + gclient sync --no-history --with_branch_heads -r [% c("var/webrtc_tag") %] + cd .. + tar --exclude .git -czf [% dest_dir _ '/' _ c('filename') %] webrtc + input_files: + - project: depot_tools + name: depot_tools + pkg_type: build diff --git a/rbm.conf b/rbm.conf index e5c69b0..e206193 100644 --- a/rbm.conf +++ b/rbm.conf @@ -105,6 +105,7 @@ targets: linux-x86_64: arch: x86_64 var: + linux-x86_64: 1 osname: linux-x86_64 deps: - build-essential @@ -115,9 +116,12 @@ targets: - libtool - zip - unzip + # We only build snowflake on linux-x86_64 for now + snowflake: 1 linux-i686: arch: i686 var: + linux-i686: 1 osname: linux-i686 configure_opt: '--host=i686-linux-gnu CFLAGS=-m32 CXXFLAGS=-m32 LDFLAGS=-m32' pre_pkginst: dpkg --add-architecture i386

1 0

[tor-browser-build/master] Update firefox, http-e, openssl, tor, torbutton versions
by boklm＠torproject.org 10 Mar '17

10 Mar '17

commit e040f4434ea48ad7be41d2a22f19dc58a3ac8f5b Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri Mar 10 11:44:33 2017 +0100 Update firefox, http-e, openssl, tor, torbutton versions --- projects/firefox-langpacks/config | 2 +- projects/firefox/config | 2 +- projects/https-everywhere/config | 2 +- projects/openssl/config | 10 ++-------- projects/tor/config | 2 +- projects/torbutton/config | 2 +- 6 files changed, 7 insertions(+), 13 deletions(-) diff --git a/projects/firefox-langpacks/config b/projects/firefox-langpacks/config index a645b92..dd96dcd 100644 --- a/projects/firefox-langpacks/config +++ b/projects/firefox-langpacks/config @@ -4,7 +4,7 @@ filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/buil var: ff_version: '[% pc("firefox", "var/firefox_version") %]' - ff_build: build1 + ff_build: build2 ff_arch: linux-i686 input_filename: 'dl-langpack-[% c("var/ff_arch") %]-[% c("version") %]' diff --git a/projects/firefox/config b/projects/firefox/config index 96be619..f7e89e5 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -8,7 +8,7 @@ gpg_keyring: torbutton.gpg remote_docker: 1 var: - firefox_version: 45.7.0esr + firefox_version: 45.8.0esr torbrowser_branch: 7.0 torbrowser_update_channel: alpha copyright_year: '[% exec("git show -s --format=%ci").remove("-.*") %]' diff --git a/projects/https-everywhere/config b/projects/https-everywhere/config index 557473d..17f9f82 100644 --- a/projects/https-everywhere/config +++ b/projects/https-everywhere/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 5.2.9 +version: 5.2.11 git_url: https://git.torproject.org/https-everywhere.git git_hash: '[% c("version") %]' git_submodule: 1 diff --git a/projects/openssl/config b/projects/openssl/config index 637f3d1..8490b0b 100644 --- a/projects/openssl/config +++ b/projects/openssl/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 1.0.2j +version: 1.0.2k filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' remote_docker: 1 @@ -24,15 +24,9 @@ targets: pre_pkginst: dpkg --add-architecture i386 compiler: macosx-toolchain-gcc - nightly: - version: 1.0.2k - input_files: - project: docker-image - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]' - URL: 'https://www.openssl.org/source/openssl-[% c("version") %].tar.gz' - sha256sum: e7aff292be21c259c6af26469c7a9b3ba26e9abaaffd325e3dccc9785256c431 - targets: - nightly: - sha256sum: 6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 + sha256sum: 6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 diff --git a/projects/tor/config b/projects/tor/config index 2fbbf24..55637dc 100644 --- a/projects/tor/config +++ b/projects/tor/config @@ -1,6 +1,6 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -version: 0.3.0.2-alpha +version: 0.3.0.4-rc git_hash: 'tor-[% c("version") %]' git_url: https://git.torproject.org/tor.git gpg_keyring: tor.gpg diff --git a/projects/torbutton/config b/projects/torbutton/config index 5ff51f8..fdc9208 100644 --- a/projects/torbutton/config +++ b/projects/torbutton/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 1.9.7 +version: 1.9.7.1 git_url: https://git.torproject.org/torbutton.git git_hash: '[% c("version") %]' gpg_keyring: torbutton.gpg

1 0

[tor-browser/tor-browser-45.8.0esr-6.5-2] fixup! Bug 13900: Remove 3rd party HTTP auth tokens.
by gk＠torproject.org 08 Mar '17

08 Mar '17

commit eb8f7fd0910e831d96dfdef4782e23c6c389e844 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Fri Mar 3 21:47:20 2017 -0800 fixup! Bug 13900: Remove 3rd party HTTP auth tokens. The HostPartIsTheSame() is too strict about deciding what is first party. Instead we use IsThirdPartyURI() to check if the request is from the first party. Specifically, it considers an XHR to api.twitter.com from a twitter.com top-level page to be first-party. This fixes bug 21555 and 16450. --- netwerk/protocol/http/nsHttpChannel.cpp | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp index 3a9a126..e571394 100644 --- a/netwerk/protocol/http/nsHttpChannel.cpp +++ b/netwerk/protocol/http/nsHttpChannel.cpp @@ -6558,8 +6558,12 @@ nsHttpChannel::RemoveAuthorizationHeaderIfAppropriate() nsresult rv = thirdPartySvc->GetFirstPartyURIFromChannel(this, false, getter_AddRefs(firstPartyURI)); if (NS_SUCCEEDED(rv) && firstPartyURI) { - isAuthAllowed = (mURI == firstPartyURI) - || HostPartIsTheSame(firstPartyURI); + bool isThirdParty; + rv = thirdPartySvc->IsThirdPartyURI(firstPartyURI, mURI, &isThirdParty); + if (NS_SUCCEEDED(rv)) { + // Prevent third-party requests from sending auth tokens. + isAuthAllowed = !isThirdParty; + } } else { // We failed to get the first party URI. Check the document URI so // that we can allow authentication if the request originates from the

1 0

[tor-browser/tor-browser-45.8.0esr-7.0-1] fixup! Bug 13900: Remove 3rd party HTTP auth tokens.
by gk＠torproject.org 08 Mar '17

08 Mar '17

commit 340377b882408b5de24ff69bcd76e774d9844e4c Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Fri Mar 3 21:47:20 2017 -0800 fixup! Bug 13900: Remove 3rd party HTTP auth tokens. The HostPartIsTheSame() is too strict about deciding what is first party. Instead we use IsThirdPartyURI() to check if the request is from the first party. Specifically, it considers an XHR to api.twitter.com from a twitter.com top-level page to be first-party. This fixes bug 21555 and 16450. --- netwerk/protocol/http/nsHttpChannel.cpp | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp index 3a9a126..e571394 100644 --- a/netwerk/protocol/http/nsHttpChannel.cpp +++ b/netwerk/protocol/http/nsHttpChannel.cpp @@ -6558,8 +6558,12 @@ nsHttpChannel::RemoveAuthorizationHeaderIfAppropriate() nsresult rv = thirdPartySvc->GetFirstPartyURIFromChannel(this, false, getter_AddRefs(firstPartyURI)); if (NS_SUCCEEDED(rv) && firstPartyURI) { - isAuthAllowed = (mURI == firstPartyURI) - || HostPartIsTheSame(firstPartyURI); + bool isThirdParty; + rv = thirdPartySvc->IsThirdPartyURI(firstPartyURI, mURI, &isThirdParty); + if (NS_SUCCEEDED(rv)) { + // Prevent third-party requests from sending auth tokens. + isAuthAllowed = !isThirdParty; + } } else { // We failed to get the first party URI. Check the document URI so // that we can allow authentication if the request originates from the

1 0

[tor-browser-bundle/hardened-builds] Switch nightlies to 45.8.0esr
by gk＠torproject.org 07 Mar '17

07 Mar '17

commit 3c1ae6423d866c462c27fbd85365a30dd64f2d86 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Mar 7 09:44:16 2017 +0000 Switch nightlies to 45.8.0esr --- gitian/versions.nightly | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 7f10c69..042095a 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -17,7 +17,7 @@ MULTI_LINGUAL=1 VERIFY_TAGS=0 -FIREFOX_VERSION=45.7.0esr +FIREFOX_VERSION=45.8.0esr TORBROWSER_UPDATE_CHANNEL=default @@ -61,7 +61,7 @@ GITIAN_TAG=tor-browser-builder-4 OPENSSL_VER=1.0.2k GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION -FIREFOX_LANG_BUILD=build1 +FIREFOX_LANG_BUILD=build2 BINUTILS_VER=2.24 GCC_VER=5.4.0 CLANG_VER=r247539

1 0

[tor-browser-bundle/master] Switch nightlies to 45.8.0esr
by gk＠torproject.org 07 Mar '17

07 Mar '17

commit 24fdda2e33fc1f6e82f6a09f9bd32118fa3f2fa7 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Mar 7 09:43:07 2017 +0000 Switch nightlies to 45.8.0esr --- gitian/versions.nightly | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 94b3003..b9779e2 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -17,7 +17,7 @@ MULTI_LINGUAL=1 VERIFY_TAGS=0 -FIREFOX_VERSION=45.7.0esr +FIREFOX_VERSION=45.8.0esr TORBROWSER_UPDATE_CHANNEL=default @@ -62,7 +62,7 @@ GITIAN_TAG=tor-browser-builder-4 OPENSSL_VER=1.0.2k GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION -FIREFOX_LANG_BUILD=build1 +FIREFOX_LANG_BUILD=build2 BINUTILS_VER=2.24 GCC_VER=5.1.0 CLANG_VER=r247539

1 0

[tor-browser-build/master] Update rbm to fix installation of some packages
by boklm＠torproject.org 06 Mar '17

06 Mar '17

commit dc243808466f77c44e594b02962317c16bb379e4 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Mar 6 13:41:42 2017 +0100 Update rbm to fix installation of some packages This change will cause all containers to be rebuilt. --- rbm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rbm b/rbm index 1945b67..845bb90 160000 --- a/rbm +++ b/rbm @@ -1 +1 @@ -Subproject commit 1945b67fefbcf7b834b71275e301da06232f0241 +Subproject commit 845bb904fb87b6c56ab789f35cd02bce32453f52

1 0

[rbm/master] Fix install_package on Debian
by boklm＠torproject.org 06 Mar '17

06 Mar '17

commit 845bb904fb87b6c56ab789f35cd02bce32453f52 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Mar 6 13:34:11 2017 +0100 Fix install_package on Debian dpkg -s not returning an error means that the package has a status, but its status is not always installed, so checking the exit value is not enough. We are now checking that the status is "install ok installed". --- lib/RBM/DefaultConfig.pm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/RBM/DefaultConfig.pm b/lib/RBM/DefaultConfig.pm index 2f6264e..c0764bd 100644 --- a/lib/RBM/DefaultConfig.pm +++ b/lib/RBM/DefaultConfig.pm @@ -525,7 +525,7 @@ OPT_END my $dnf = 'rpm -q [% c("pkg_name") %] > /dev/null || dnf install -y [% c("pkg_name") %]'; my $zypper = 'rpm -q [% c("pkg_name") %] > /dev/null || zypper install [% c("pkg_name") %]'; my $urpmi = 'rpm -q [% c("pkg_name") %] > /dev/null || urpmi [% c("pkg_name") %]'; - my $apt = 'dpkg -s [% c("pkg_name") %] > /dev/null 2>&1 || apt-get install -y [% c("pkg_name") %]'; + my $apt = 'dpkg -s [% c("pkg_name") %] 2> /dev/null | grep -q "^Status: install ok installed\$" || apt-get install -y [% c("pkg_name") %]'; my %install = ( Fedora => $dnf, 'Fedora-20' => $yum,

1 0

[tor-browser-bundle/maint-6.5] Fix release date bug in Changelog
by gk＠torproject.org 06 Mar '17

06 Mar '17

commit 21ddc8a6be0f6ffe4723b1eba615e99460889e64 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Mar 6 11:04:23 2017 +0000 Fix release date bug in Changelog --- Bundle-Data/Docs/ChangeLog.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 311a894..5438022 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,4 +1,4 @@ -Tor Browser 6.5.1 -- March 6 2017 +Tor Browser 6.5.1 -- March 7 2017 * All Platforms * Update Firefox to 45.8.0esr * Tor to 0.2.9.10

1 0

[tor-browser-bundle/hardened-builds] Release preparations for 7.0a2-hardened
by gk＠torproject.org 06 Mar '17

06 Mar '17

commit dcfd2efd5b155830e4d9443b9f6b69f60313e6fb Author: Georg Koppen <gk(a)torproject.org> Date: Mon Mar 6 08:12:25 2017 +0000 Release preparations for 7.0a2-hardened Version bumps, Changelog update, and update of config.yml --- Bundle-Data/Docs/ChangeLog.txt | 20 ++++++++++++++++++++ gitian/versions.alpha | 14 +++++++------- tools/update-responses/config.yml | 10 +++++----- 3 files changed, 32 insertions(+), 12 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index f349311..c192940 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,23 @@ +Tor Browser 7.0a2-hardened -- March 7 2017 + * All Platforms + * Update Firefox to 45.8.0esr + * Tor to 0.3.0.4-rc + * OpenSSL to 1.0.2k + * Update Torbutton to 1.9.7.1 + * Bug 21396: Allow leaking of resource/chrome URIs (off by default) + * Bug 21574: Add link for zh manual and create manual links dynamically + * Bug 21330: Non-usable scrollbar appears in tor browser security settings + * Bug 21324: Don't update NoScript button with timer update + * Translation updates + * Update HTTPS-Everywhere to 5.2.11 + * Bug 21514: Restore W^X JIT implementation removed from ESR45 + * Bug 21536: Remove scramblesuit bridge + * Bug 21342: Move meek-azure to the meek.azureedge.net backend and cymrubridge02 bridge + * Bug 21326: Update the "Using a system-installed Tor" section in start script + * Build system + * Bug 17034: Use our built binutils and GCC for building tor + * Code clean-up + Tor Browser 7.0a1-hardened -- January 25 2017 * All Platforms * Update Firefox to 45.7.0esr diff --git a/gitian/versions.alpha b/gitian/versions.alpha index aaacef9..e3352c4 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -14,15 +14,15 @@ DATA_OUTSIDE_APP_DIR=1 VERIFY_TAGS=1 -FIREFOX_VERSION=45.7.0esr +FIREFOX_VERSION=45.8.0esr TORBROWSER_UPDATE_CHANNEL=hardened TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.0-1-build1 -TOR_TAG=tor-0.3.0.2-alpha +TOR_TAG=tor-0.3.0.4-rc TORLAUNCHER_TAG=0.2.11.1 -TORBUTTON_TAG=1.9.7 -HTTPSE_TAG=5.2.9 +TORBUTTON_TAG=1.9.7.1 +HTTPSE_TAG=5.2.11 NSIS_TAG=v0.3.1 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.22-stable @@ -55,10 +55,10 @@ UNIURI_TAG=8902c56451e9b58ff940bbe5fec35d5f9c04584a GITIAN_TAG=tor-browser-builder-4-1 -OPENSSL_VER=1.0.2j +OPENSSL_VER=1.0.2k GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION -FIREFOX_LANG_BUILD=build1 +FIREFOX_LANG_BUILD=build2 BINUTILS_VER=2.24 GCC_VER=5.4.0 CLANG_VER=r247539 @@ -110,7 +110,7 @@ NOTOTCFONT_PACKAGE=NotoSansTC-Regular.otf ELFUTILS_PACKAGE=elfutils-${ELFUTILS_VER}.tar.bz2 # Hashes for packages with weak sigs or no sigs -OPENSSL_HASH=e7aff292be21c259c6af26469c7a9b3ba26e9abaaffd325e3dccc9785256c431 +OPENSSL_HASH=6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf OSXSDK_OLD_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index 21c039b..0f112a3 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -20,7 +20,7 @@ build_targets: osx32: Darwin_x86-gcc3 osx64: Darwin_x86_64-gcc3 channels: - hardened: 7.0a1-hardened + hardened: 7.0a2-hardened release: 6.0.1 versions: 6.0.1: @@ -33,11 +33,11 @@ versions: osx32: minSupportedOSVersion: 10.8 detailsURL: https://blog.torproject.org/blog/end-life-plan-tor-browser-32-bit-macs#upda… - 7.0a1-hardened: - platformVersion: 45.7.0 - detailsURL: https://blog.torproject.org/blog/tor-browser-70a1-hardened-released + 7.0a2-hardened: + platformVersion: 45.8.0 + detailsURL: https://blog.torproject.org/blog/tor-browser-70a2-hardened-released incremental_from: - - 6.5a6-hardened + - 7.0a1-hardened migrate_archs: osx32: osx64 osx32:

1 0

[tor-browser-build/master] binutils: add the --enable-plugins configure flag
by boklm＠torproject.org 05 Mar '17

05 Mar '17

commit 375e3655ba9855a11aea1a78f7861f7843db81d6 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Sun Mar 5 18:33:27 2017 +0100 binutils: add the --enable-plugins configure flag --- projects/binutils/config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/binutils/config b/projects/binutils/config index c1e67df..2975f14 100644 --- a/projects/binutils/config +++ b/projects/binutils/config @@ -3,7 +3,7 @@ version: 2.24 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' remote_docker: 1 var: - configure_opt: '--disable-multilib --enable-gold --enable-deterministic-archives' + configure_opt: '--disable-multilib --enable-gold --enable-deterministic-archives --enable-plugins' targets: windows-i686:

1 0

[tor-browser-build/master] firefox: correctly extract binutils
by boklm＠torproject.org 05 Mar '17

05 Mar '17

commit b4e028b87ff81ea12e22f1e1d59025419c911f65 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Sun Mar 5 18:34:23 2017 +0100 firefox: correctly extract binutils --- projects/firefox/build | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/projects/firefox/build b/projects/firefox/build index 453f6b3..496c215 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -17,7 +17,8 @@ distdir=/var/tmp/dist/[% project %] mkdir -p /var/tmp/build [% IF c("var/linux") %] -tar xf $rootdir/[% c('input_files_by_name/binutils') %] +mkdir -p /var/tmp/dist +tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/binutils') %] export PATH="/var/tmp/dist/binutils/bin:$PATH" [% END -%]

1 0

[tor-browser-build/master] Bug 21605: Switch to tpo repo for sandboxed tor browser
by boklm＠torproject.org 05 Mar '17

05 Mar '17

commit d7d65fa096b65eb5b0748658f05bbb31736bedca Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Mar 2 13:52:49 2017 +0100 Bug 21605: Switch to tpo repo for sandboxed tor browser --- projects/sandbox/config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/sandbox/config b/projects/sandbox/config index 54fe4df..44faca9 100644 --- a/projects/sandbox/config +++ b/projects/sandbox/config @@ -1,6 +1,6 @@ # vim: filetype=yaml sw=2 version: 0.0.3 -git_url: https://git.schwanenlied.me/yawning/sandboxed-tor-browser +git_url: https://git.torproject.org/tor-browser/sandboxed-tor-browser git_hash: 'sandboxed-tor-browser-[% c("version") %]' tag_gpg_id: 1 gpg_keyring: obfs4.gpg

1 0

[tor-browser-build/master] Set TZ and LC_ALL when starting rbm
by boklm＠torproject.org 05 Mar '17

05 Mar '17

commit 51493b7b17da9d4941600f54842d0e1ddb33cf31 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Sun Mar 5 18:20:38 2017 +0100 Set TZ and LC_ALL when starting rbm --- rbm | 2 +- rbm.conf | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/rbm b/rbm index b3ca063..1945b67 160000 --- a/rbm +++ b/rbm @@ -1 +1 @@ -Subproject commit b3ca063713f0d25a66f76c829d750ac977a25207 +Subproject commit 1945b67fefbcf7b834b71275e301da06232f0241 diff --git a/rbm.conf b/rbm.conf index b137595..b2fb21a 100644 --- a/rbm.conf +++ b/rbm.conf @@ -200,3 +200,7 @@ gpg_wrapper: | else exec [% c('gpg_bin') %] [% c('gpg_args') %] --with-fingerprint [% gpg_kr %] "$@" fi + +ENV: + TZ: UTC + LC_ALL: C

1 0

[tor-browser-build/master] Add var/set_default_env and use it in all build scripts
by boklm＠torproject.org 05 Mar '17

05 Mar '17

commit 73c030f1c8a7283d8343ad6ab7401ce4b6ada0ab Author: Nicolas Vigier <boklm(a)torproject.org> Date: Sun Mar 5 18:28:04 2017 +0100 Add var/set_default_env and use it in all build scripts --- projects/binutils/build | 5 ++--- projects/clang/build | 2 +- projects/cmake/build | 3 +-- projects/firefox-langpacks/build | 2 +- projects/firefox/build | 9 +-------- projects/fonts/build | 3 +-- projects/gcc/build | 2 +- projects/gmp/build | 3 +-- projects/go/build | 3 +-- projects/go/config | 3 +-- projects/https-everywhere/build | 4 ++-- projects/libdmg-hfsplus/build | 4 ++-- projects/libevent/build | 3 +-- projects/llvm/build | 3 +-- projects/macosx-toolchain-gcc/build | 3 +-- projects/macosx-toolchain/build | 5 ++--- projects/meek/build | 3 +-- projects/mingw-w64/build | 5 ++--- projects/nsis/build | 5 ++--- projects/obfs4/build | 3 +-- projects/openssl/build | 3 +-- projects/release/config | 3 +-- projects/sandbox/build | 3 +-- projects/tbb-windows-installer/build | 2 +- projects/tor-browser/build | 6 +----- projects/tor-launcher/build | 4 ++-- projects/tor/build | 6 +----- projects/torbutton/build | 4 ++-- projects/zlib/build | 6 +----- rbm.conf | 10 ++++++++++ 30 files changed, 47 insertions(+), 73 deletions(-) diff --git a/projects/binutils/build b/projects/binutils/build index cdd01a6..e3064cf 100644 --- a/projects/binutils/build +++ b/projects/binutils/build @@ -1,6 +1,5 @@ -#!/bin/sh -set -e -rootdir=$(pwd) +#!/bin/bash +[% c("var/set_default_env") -%] distdir=/var/tmp/dist/binutils [% IF c("var/linux") %] # Config options for hardening-wrapper diff --git a/projects/clang/build b/projects/clang/build index 380ca1c..ac0f21b 100644 --- a/projects/clang/build +++ b/projects/clang/build @@ -1,5 +1,5 @@ #!/bin/bash -set -e +[% c("var/set_default_env") -%] tar xf [% project %]-[% c("version") %].tar.gz mv [% project %]-[% c("version") %] [% project %] [% c('tar', { diff --git a/projects/cmake/build b/projects/cmake/build index d59522a..dd5017a 100644 --- a/projects/cmake/build +++ b/projects/cmake/build @@ -1,6 +1,5 @@ #!/bin/bash -set -e -rootdir=$(pwd) +[% c("var/set_default_env") -%] distdir=/var/tmp/dist/[% project %] mkdir -p /var/tmp/build tar -C /var/tmp/build -xf [% project %]-[% c('version') %].tar.gz diff --git a/projects/firefox-langpacks/build b/projects/firefox-langpacks/build index 82e5452..9ac07cb 100644 --- a/projects/firefox-langpacks/build +++ b/projects/firefox-langpacks/build @@ -1,5 +1,5 @@ #!/bin/bash -set -e +[% c("var/set_default_env") -%] [% FOREACH lang = c('var/locales') %] [% SET lang = tmpl(lang) %] diff --git a/projects/firefox/build b/projects/firefox/build index 7610510..453f6b3 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -1,6 +1,5 @@ #!/bin/bash -set -e -rootdir=$(pwd) +[% c("var/set_default_env") -%] [% IF c("var/windows") -%] mkdir -p /var/tmp/dist tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/gcc') %] @@ -17,12 +16,6 @@ rootdir=$(pwd) distdir=/var/tmp/dist/[% project %] mkdir -p /var/tmp/build -export SHELL=/bin/bash -export HOME=$rootdir -export TZ=UTC -export LC_ALL=C -umask 0022 - [% IF c("var/linux") %] tar xf $rootdir/[% c('input_files_by_name/binutils') %] export PATH="/var/tmp/dist/binutils/bin:$PATH" diff --git a/projects/fonts/build b/projects/fonts/build index 4984c3b..e645c31 100644 --- a/projects/fonts/build +++ b/projects/fonts/build @@ -1,6 +1,5 @@ #!/bin/bash -set -e -rootdir=$(pwd) +[% c("var/set_default_env") -%] distdir=/var/tmp/dist/fonts mkdir -p $distdir tar xf [% project %]-[% c("version") %].tar.gz diff --git a/projects/gcc/build b/projects/gcc/build index 03cfcbd..1c24af7 100644 --- a/projects/gcc/build +++ b/projects/gcc/build @@ -1,5 +1,5 @@ #!/bin/sh -set -e +[% c("var/set_default_env") -%] distdir=/var/tmp/dist/[% project %] mkdir /var/tmp/build tar -C /var/tmp/build -xf [% project %]-[% c("version") %].tar.bz2 diff --git a/projects/gmp/build b/projects/gmp/build index d7b3b14..34173d6 100644 --- a/projects/gmp/build +++ b/projects/gmp/build @@ -1,6 +1,5 @@ #!/bin/bash -set -e -rootdir=$(pwd) +[% c("var/set_default_env") -%] [% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] distdir=/var/tmp/dist/[% project %] mkdir -p /var/tmp/build diff --git a/projects/go/build b/projects/go/build index 2efd928..72117f6 100644 --- a/projects/go/build +++ b/projects/go/build @@ -1,6 +1,5 @@ #!/bin/bash -set -e -rootdir=$(pwd) +[% c("var/set_default_env") -%] distdir=/var/tmp/dist/[% project %] mkdir -p /var/tmp/dist diff --git a/projects/go/config b/projects/go/config index 9341f98..5e55a09 100644 --- a/projects/go/config +++ b/projects/go/config @@ -20,8 +20,7 @@ var: # a list of install targets. build_go_lib: | #!/bin/bash - set -e - rootdir=$(pwd) + [% c("var/set_default_env") -%] [% pc('go', 'var/setup', { go_tarfile => c('input_files_by_name/go') }) %] distdir=/var/tmp/dist/[% project %] mkdir -p /var/tmp/build diff --git a/projects/https-everywhere/build b/projects/https-everywhere/build index 6e49e7b..71b2a21 100644 --- a/projects/https-everywhere/build +++ b/projects/https-everywhere/build @@ -1,5 +1,5 @@ -#!/bin/sh -set -e +#!/bin/bash +[% c("var/set_default_env") -%] tar xf [% project %]-[% c('version') %].tar.gz cd [% project %]-[% c('version') %] # patch makexpi.sh because we don't have a git repository diff --git a/projects/libdmg-hfsplus/build b/projects/libdmg-hfsplus/build index 2903150..47a5e43 100644 --- a/projects/libdmg-hfsplus/build +++ b/projects/libdmg-hfsplus/build @@ -1,5 +1,5 @@ -#!/bin/sh -set -e +#!/bin/bash +[% c("var/set_default_env") -%] distdir=$(pwd)/dist mkdir -p $distdir/[% project %] tar xf [% project %]-[% c('version') %].tar.gz diff --git a/projects/libevent/build b/projects/libevent/build index 8aa85fc..2bed816 100644 --- a/projects/libevent/build +++ b/projects/libevent/build @@ -1,6 +1,5 @@ #!/bin/bash -set -e -rootdir=$(pwd) +[% c("var/set_default_env") -%] [% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] distdir=/var/tmp/dist/[% project %] mkdir -p /var/tmp/build diff --git a/projects/llvm/build b/projects/llvm/build index bdf7576..3773cfd 100644 --- a/projects/llvm/build +++ b/projects/llvm/build @@ -1,6 +1,5 @@ #!/bin/bash -set -e -rootdir=$(pwd) +[% c("var/set_default_env") -%] distdir=/var/tmp/dist/[% project %] mkdir -p /var/tmp/dist tar -C /var/tmp/dist -xf [% c('input_files_by_name/cmake') %] diff --git a/projects/macosx-toolchain-gcc/build b/projects/macosx-toolchain-gcc/build index 778194d..4a8f0db 100644 --- a/projects/macosx-toolchain-gcc/build +++ b/projects/macosx-toolchain-gcc/build @@ -1,6 +1,5 @@ #!/bin/bash -set -e -rootdir=$(pwd) +[% c("var/set_default_env") -%] destdir='[% dest_dir _ '/' _ c('filename') %]' mkdir -p "$destdir" mv -f [% c('input_files_by_name/SDK') %] "$destdir"/apple-uni-sdk.deb diff --git a/projects/macosx-toolchain/build b/projects/macosx-toolchain/build index b263940..b718023 100644 --- a/projects/macosx-toolchain/build +++ b/projects/macosx-toolchain/build @@ -1,6 +1,5 @@ -#!/bin/sh -set -e -rootdir=$(pwd) +#!/bin/bash +[% c("var/set_default_env") -%] distdir="/var/tmp/dist/[% project %]" mkdir -p "$distdir" tar xzf [% c('input_files_by_name/SDK') %] diff --git a/projects/meek/build b/projects/meek/build index 283066a..8d1beb7 100644 --- a/projects/meek/build +++ b/projects/meek/build @@ -1,6 +1,5 @@ #!/bin/bash -set -e -rootdir=$(pwd) +[% c("var/set_default_env") -%] [% pc('go', 'var/setup', { go_tarfile => c('input_files_by_name/go') }) %] distdir=/var/tmp/dist/[% project %] [% IF c("var/osx") %] diff --git a/projects/mingw-w64/build b/projects/mingw-w64/build index 39361e7..42ee716 100644 --- a/projects/mingw-w64/build +++ b/projects/mingw-w64/build @@ -1,6 +1,5 @@ -#!/bin/sh -set -e -rootdir=$(pwd) +#!/bin/bash +[% c("var/set_default_env") -%] distdir=/var/tmp/dist/[% project %] mkdir /var/tmp/build diff --git a/projects/nsis/build b/projects/nsis/build index 48f1cb1..af19dd7 100755 --- a/projects/nsis/build +++ b/projects/nsis/build @@ -1,6 +1,5 @@ -#!/bin/sh -set -e -rootdir=$(pwd) +#!/bin/bash +[% c("var/set_default_env") -%] [% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] # remove hardening wrappers rm -Rf /var/tmp/dist/mingw-w64/helpers diff --git a/projects/obfs4/build b/projects/obfs4/build index ff313e9..61ef481 100644 --- a/projects/obfs4/build +++ b/projects/obfs4/build @@ -1,6 +1,5 @@ #!/bin/bash -set -e -rootdir=$(pwd) +[% c("var/set_default_env") -%] [% pc('go', 'var/setup', { go_tarfile => c('input_files_by_name/go') }) %] distdir=/var/tmp/dist/[% project %] [% IF c("var/osx") %] diff --git a/projects/openssl/build b/projects/openssl/build index acd7bbb..3a5365e 100644 --- a/projects/openssl/build +++ b/projects/openssl/build @@ -1,6 +1,5 @@ #!/bin/bash -set -e -rootdir=$(pwd) +[% c("var/set_default_env") -%] [% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] distdir=/var/tmp/dist/[% project %] mkdir -p /var/tmp/build diff --git a/projects/release/config b/projects/release/config index e2b2eb9..f6712c0 100644 --- a/projects/release/config +++ b/projects/release/config @@ -119,8 +119,7 @@ input_files: build: | #!/bin/sh - set -e - export LC_ALL=C + [% c("var/set_default_env") -%] destdir="[% dest_dir _ '/' _ c("var/publish_dir") %]" mkdir -p "$destdir" [% IF c("var/torbrowser-windows-i686") -%] diff --git a/projects/sandbox/build b/projects/sandbox/build index 28b5a48..8a3edb3 100644 --- a/projects/sandbox/build +++ b/projects/sandbox/build @@ -1,6 +1,5 @@ #!/bin/bash -set -e -rootdir=$(pwd) +[% c("var/set_default_env") -%] [% pc('go', 'var/setup', { go_tarfile => c('input_files_by_name/go') }) %] distdir=/var/tmp/dist/[% project %] mkdir -p $distdir diff --git a/projects/tbb-windows-installer/build b/projects/tbb-windows-installer/build index 380ca1c..ac0f21b 100644 --- a/projects/tbb-windows-installer/build +++ b/projects/tbb-windows-installer/build @@ -1,5 +1,5 @@ #!/bin/bash -set -e +[% c("var/set_default_env") -%] tar xf [% project %]-[% c("version") %].tar.gz mv [% project %]-[% c("version") %] [% project %] [% c('tar', { diff --git a/projects/tor-browser/build b/projects/tor-browser/build index 4eeb350..904f1b6 100644 --- a/projects/tor-browser/build +++ b/projects/tor-browser/build @@ -1,11 +1,7 @@ #!/bin/bash -set -e -rootdir=$(pwd) +[% c("var/set_default_env") -%] distdir=/var/tmp/dist/[% project %] -export TZ=UTC -export LC_ALL=C export TORBROWSER_VERSION='[% c("version") %]' -umask 0022 mkdir -p $distdir diff --git a/projects/tor-launcher/build b/projects/tor-launcher/build index 69e01b3..90c5268 100644 --- a/projects/tor-launcher/build +++ b/projects/tor-launcher/build @@ -1,5 +1,5 @@ -#!/bin/sh -set -e +#!/bin/bash +[% c("var/set_default_env") -%] tar xvf [% project %]-[% c('version') %].tar.gz cd [% project %]-[% c('version') %] make package diff --git a/projects/tor/build b/projects/tor/build index f0b57f1..c56cddc 100644 --- a/projects/tor/build +++ b/projects/tor/build @@ -1,9 +1,5 @@ #!/bin/bash -set -e -rootdir=$(pwd) -export TZ=UTC -export LC_ALL=C -umask 0022 +[% c("var/set_default_env") -%] [% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] distdir=/var/tmp/dist/[% project %] mkdir -p /var/tmp/build diff --git a/projects/torbutton/build b/projects/torbutton/build index b7a7262..38136c4 100644 --- a/projects/torbutton/build +++ b/projects/torbutton/build @@ -1,5 +1,5 @@ -#!/bin/sh -set -e +#!/bin/bash +[% c("var/set_default_env") -%] tar xvf [% project %]-[% c('version') %].tar.gz cd [% project %]-[% c('version') %] mkdir -p pkg diff --git a/projects/zlib/build b/projects/zlib/build index fdcfbfb..4031ef5 100644 --- a/projects/zlib/build +++ b/projects/zlib/build @@ -1,9 +1,5 @@ #!/bin/bash -set -e -rootdir=$(pwd) -export TZ=UTC -export LC_ALL=C -umask 0022 +[% c("var/set_default_env") -%] [% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] distdir=/var/tmp/dist/[% project %] mkdir -p /var/tmp/build diff --git a/rbm.conf b/rbm.conf index b2fb21a..e5c69b0 100644 --- a/rbm.conf +++ b/rbm.conf @@ -67,6 +67,16 @@ var: mv -f -- "$rezip_tmpdir/new.zip" [% c("rezip_file") %] rm -Rf "$rezip_tmpdir" + set_default_env: | + set -e + [% FOREACH env = c('ENV') -%] + export [% env.key %]="[% env.value %]" + [% END -%] + rootdir=$(pwd) + export SHELL=/bin/bash + export HOME=$rootdir + umask 0022 + targets: notarget: linux-x86_64 noint:

1 0

[tor-browser-build/master] Bug 21536: Remove scramblesuit bridge
by boklm＠torproject.org 05 Mar '17

05 Mar '17

commit 51ab48b05f1ab9ea1c60b45e42c9db682c167166 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Feb 23 13:46:14 2017 +0000 Bug 21536: Remove scramblesuit bridge --- projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js | 2 -- 1 file changed, 2 deletions(-) diff --git a/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js b/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js index c56d316..61e2a9e 100644 --- a/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js @@ -13,8 +13,6 @@ pref("extensions.torlauncher.default_bridge.fte.2", "fte 128.105.214.161:8080 1E pref("extensions.torlauncher.default_bridge.fte.3", "fte 128.105.214.162:8080 FC562097E1951DCC41B7D7F324D88157119BB56D"); pref("extensions.torlauncher.default_bridge.fte.4", "fte 128.105.214.163:8080 A17A40775FBD2CA1184BF80BFC330A77ECF9D0E9"); -pref("extensions.torlauncher.default_bridge.scramblesuit.1", "scramblesuit 83.212.101.3:443 A09D536DD1752D542E1FBB3C9CE4449D51298239 password=XTCXLG2JAMJKZW2POLBAOWOQETQSMASH"); - pref("extensions.torlauncher.default_bridge.obfs4.1", "obfs4 154.35.22.10:15937 8FB9F4319E89E5C6223052AA525A192AFBC85D55 cert=GGGS1TX4R81m3r0HBl79wKy1OtPPNR2CZUIrHjkRg65Vc2VR8fOyo64f9kmT1UAFG7j0HQ iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.2", "obfs4 198.245.60.50:443 752CF7825B3B9EA6A98C83AC41F7099D67007EA5 cert=xpmQtKUqQ/6v5X7ijgYE/f03+l2/EuQ1dexjyUhh16wQlu/cpXUGalmhDIlhuiQPNEKmKw iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.3", "obfs4 192.99.11.54:443 7B126FAB960E5AC6A629C729434FF84FB5074EC2 cert=VW5f8+IBUWpPFxF+rsiVy2wXkyTQG7vEd+rHeN2jV5LIDNu8wMNEOqZXPwHdwMVEBdqXEw iat-mode=0");

1 0