- tbb-commits - lists.torproject.org

[Git][tpo/applications/tor-browser-build][main] Add CDN77 meek bridge
by morgan (＠morgan) 19 Dec '24

19 Dec '24

morgan pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 8c56c218 by meskio at 2024-12-18T19:42:13+01:00 Add CDN77 meek bridge Azure might stop supporting Domain Fronting from Januar 15, let's add a second meek bridge so there is an alternative to it when it gets blocked. * Related: https://gitlab.torproject.org/tpo/anti-censorship/team/-/issues/155 - - - - - 1 changed file: - projects/tor-expert-bundle/pt_config.json Changes: ===================================== projects/tor-expert-bundle/pt_config.json ===================================== @@ -7,7 +7,8 @@ }, "bridges" : { "meek-azure" : [ - "meek_lite 192.0.2.18:80 BE776A53492E1E044A26F17306E1BC46A55A1625 url=https://meek.azureedge.net/ front=ajax.aspnetcdn.com" + "meek_lite 192.0.2.18:80 BE776A53492E1E044A26F17306E1BC46A55A1625 url=https://meek.azureedge.net/ front=ajax.aspnetcdn.com", + "meek_lite 192.0.2.20:80 url=https://1603026938.rsc.cdn77.org front=www.phpmyadmin.net utls=HelloRandomizedALPN" ], "obfs4" : [ "obfs4 192.95.36.142:443 CDF2E852BF539B82BD10E27E9115A31734E378C2 cert=qUVQ0srL1JI/vO6V6m/24anYXiJD3QP2HgzUKQtQ7GRqqUvs7P+tG43RtAqdhLOALP7DJQ iat-mode=1", View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/8… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/8… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-128.5.0esr-14.5-1] Bug 1910593 - Don't prefetch HTTPS RR if proxyDNS is enabled, r=necko-reviewers,valentin
by Pier Angelo Vendrame (＠pierov) 18 Dec '24

18 Dec '24

Pier Angelo Vendrame pushed to branch mullvad-browser-128.5.0esr-14.5-1 at The Tor Project / Applications / Mullvad Browser Commits: c1966f06 by Kershaw Chang at 2024-12-17T12:40:47+01:00 Bug 1910593 - Don't prefetch HTTPS RR if proxyDNS is enabled, r=necko-reviewers,valentin Differential Revision: https://phabricator.services.mozilla.com/D219528 - - - - - 15 changed files: - dom/chrome-webidl/NetDashboard.webidl - netwerk/base/Dashboard.cpp - netwerk/base/DashboardTypes.h - netwerk/dns/nsHostResolver.cpp - netwerk/protocol/http/nsHttp.cpp - netwerk/protocol/http/nsHttp.h - netwerk/protocol/http/nsHttpChannel.cpp - netwerk/protocol/http/nsHttpChannel.h - netwerk/protocol/http/nsHttpConnectionInfo.h - netwerk/protocol/http/nsHttpConnectionMgr.cpp - netwerk/protocol/http/nsHttpHandler.cpp - netwerk/protocol/http/nsHttpHandler.h - + netwerk/test/unit/test_proxyDNS_leak.js - netwerk/test/unit/xpcshell.toml - toolkit/content/aboutNetworking.js Changes: ===================================== dom/chrome-webidl/NetDashboard.webidl ===================================== @@ -68,6 +68,7 @@ dictionary DnsCacheEntry { boolean trr = false; DOMString originAttributesSuffix = ""; DOMString flags = ""; + unsigned short type = 0; }; [GenerateConversionToJS] ===================================== netwerk/base/Dashboard.cpp ===================================== @@ -906,10 +906,13 @@ nsresult Dashboard::GetDNSCacheEntries(DnsData* dnsData) { CopyASCIItoUTF16(dnsData->mData[i].hostaddr[j], *addr); } - if (dnsData->mData[i].family == PR_AF_INET6) { - entry.mFamily.AssignLiteral(u"ipv6"); - } else { - entry.mFamily.AssignLiteral(u"ipv4"); + entry.mType = dnsData->mData[i].resolveType; + if (entry.mType == nsIDNSService::RESOLVE_TYPE_DEFAULT) { + if (dnsData->mData[i].family == PR_AF_INET6) { + entry.mFamily.AssignLiteral(u"ipv6"); + } else { + entry.mFamily.AssignLiteral(u"ipv4"); + } } entry.mOriginAttributesSuffix = ===================================== netwerk/base/DashboardTypes.h ===================================== @@ -35,12 +35,12 @@ struct DnsAndConnectSockets { struct DNSCacheEntries { nsCString hostname; nsTArray<nsCString> hostaddr; - uint16_t family; - int64_t expiration; - nsCString netInterface; - bool TRR; + uint16_t family{0}; + int64_t expiration{0}; + bool TRR{false}; nsCString originAttributesSuffix; nsCString flags; + uint16_t resolveType{0}; }; struct HttpConnInfo { @@ -99,8 +99,10 @@ struct ParamTraits<mozilla::net::DNSCacheEntries> { WriteParam(aWriter, aParam.hostaddr); WriteParam(aWriter, aParam.family); WriteParam(aWriter, aParam.expiration); - WriteParam(aWriter, aParam.netInterface); WriteParam(aWriter, aParam.TRR); + WriteParam(aWriter, aParam.originAttributesSuffix); + WriteParam(aWriter, aParam.flags); + WriteParam(aWriter, aParam.resolveType); } static bool Read(MessageReader* aReader, paramType* aResult) { @@ -108,8 +110,10 @@ struct ParamTraits<mozilla::net::DNSCacheEntries> { ReadParam(aReader, &aResult->hostaddr) && ReadParam(aReader, &aResult->family) && ReadParam(aReader, &aResult->expiration) && - ReadParam(aReader, &aResult->netInterface) && - ReadParam(aReader, &aResult->TRR); + ReadParam(aReader, &aResult->TRR) && + ReadParam(aReader, &aResult->originAttributesSuffix) && + ReadParam(aReader, &aResult->flags) && + ReadParam(aReader, &aResult->resolveType); } }; ===================================== netwerk/dns/nsHostResolver.cpp ===================================== @@ -1999,20 +1999,13 @@ void nsHostResolver::GetDNSCacheEntries(nsTArray<DNSCacheEntries>* args) { continue; } - // For now we only show A/AAAA records. - if (!rec->IsAddrRecord()) { - continue; - } - - RefPtr<AddrHostRecord> addrRec = do_QueryObject(rec); - MOZ_ASSERT(addrRec); - if (!addrRec || !addrRec->addr_info) { - continue; - } - DNSCacheEntries info; + info.resolveType = rec->type; info.hostname = rec->host; info.family = rec->af; + if (rec->mValidEnd.IsNull()) { + continue; + } info.expiration = (int64_t)(rec->mValidEnd - TimeStamp::NowLoRes()).ToSeconds(); if (info.expiration <= 0) { @@ -2020,7 +2013,12 @@ void nsHostResolver::GetDNSCacheEntries(nsTArray<DNSCacheEntries>* args) { continue; } - { + info.originAttributesSuffix = recordEntry.GetKey().originSuffix; + info.flags = nsPrintfCString("%u|0x%x|%u|%d|%s", rec->type, rec->flags, + rec->af, rec->pb, rec->mTrrServer.get()); + + RefPtr<AddrHostRecord> addrRec = do_QueryObject(rec); + if (addrRec && addrRec->addr_info) { MutexAutoLock lock(addrRec->addr_info_lock); for (const auto& addr : addrRec->addr_info->Addresses()) { char buf[kIPv6CStrBufSize]; @@ -2031,10 +2029,6 @@ void nsHostResolver::GetDNSCacheEntries(nsTArray<DNSCacheEntries>* args) { info.TRR = addrRec->addr_info->IsTRR(); } - info.originAttributesSuffix = recordEntry.GetKey().originSuffix; - info.flags = nsPrintfCString("%u|0x%x|%u|%d|%s", rec->type, rec->flags, - rec->af, rec->pb, rec->mTrrServer.get()); - args->AppendElement(std::move(info)); } } ===================================== netwerk/protocol/http/nsHttp.cpp ===================================== @@ -35,6 +35,8 @@ namespace mozilla { namespace net { +extern const char kProxyType_SOCKS[]; + const uint32_t kHttp3VersionCount = 5; const nsCString kHttp3Versions[] = {"h3-29"_ns, "h3-30"_ns, "h3-31"_ns, "h3-32"_ns, "h3"_ns}; @@ -1165,5 +1167,19 @@ void DisallowHTTPSRR(uint32_t& aCaps) { aCaps = (aCaps | NS_HTTP_DISALLOW_HTTPS_RR) & ~NS_HTTP_FORCE_WAIT_HTTP_RR; } +ProxyDNSStrategy GetProxyDNSStrategyHelper(const char* aType, uint32_t aFlag) { + if (!aType) { + return ProxyDNSStrategy::ORIGIN; + } + + if (!(aFlag & nsIProxyInfo::TRANSPARENT_PROXY_RESOLVES_HOST)) { + if (aType == kProxyType_SOCKS) { + return ProxyDNSStrategy::ORIGIN; + } + } + + return ProxyDNSStrategy::PROXY; +} + } // namespace net } // namespace mozilla ===================================== netwerk/protocol/http/nsHttp.h ===================================== @@ -527,6 +527,16 @@ bool PossibleZeroRTTRetryError(nsresult aReason); void DisallowHTTPSRR(uint32_t& aCaps); +enum class ProxyDNSStrategy : uint8_t { + // To resolve the origin of the end server we are connecting + // to. + ORIGIN = 1 << 0, + // To resolve the host name of the proxy. + PROXY = 1 << 1 +}; + +ProxyDNSStrategy GetProxyDNSStrategyHelper(const char* aType, uint32_t aFlag); + } // namespace net } // namespace mozilla ===================================== netwerk/protocol/http/nsHttpChannel.cpp ===================================== @@ -762,6 +762,10 @@ nsresult nsHttpChannel::MaybeUseHTTPSRRForUpgrade(bool aShouldUpgrade, } auto shouldSkipUpgradeWithHTTPSRR = [&]() -> bool { + if (mCaps & NS_HTTP_DISALLOW_HTTPS_RR) { + return true; + } + // Skip using HTTPS RR to upgrade when this is not a top-level load and the // loading principal is http. if ((mLoadInfo->GetExternalContentPolicyType() != @@ -784,6 +788,11 @@ nsresult nsHttpChannel::MaybeUseHTTPSRRForUpgrade(bool aShouldUpgrade, return true; } + auto dnsStrategy = GetProxyDNSStrategy(); + if (dnsStrategy != ProxyDNSStrategy::ORIGIN) { + return true; + } + nsAutoCString uriHost; mURI->GetAsciiHost(uriHost); @@ -808,11 +817,6 @@ nsresult nsHttpChannel::MaybeUseHTTPSRRForUpgrade(bool aShouldUpgrade, return ContinueOnBeforeConnect(hasHTTPSRR, aStatus, hasHTTPSRR); } - auto dnsStrategy = GetProxyDNSStrategy(); - if (!(dnsStrategy & DNS_PREFETCH_ORIGIN)) { - return ContinueOnBeforeConnect(aShouldUpgrade, aStatus); - } - LOG(("nsHttpChannel::MaybeUseHTTPSRRForUpgrade [%p] wait for HTTPS RR", this)); @@ -1218,13 +1222,13 @@ void nsHttpChannel::SpeculativeConnect() { NS_NewNotificationCallbacksAggregation(mCallbacks, mLoadGroup, getter_AddRefs(callbacks)); if (!callbacks) return; - - Unused << gHttpHandler->SpeculativeConnect( + bool httpsRRAllowed = !(mCaps & NS_HTTP_DISALLOW_HTTPS_RR); + Unused << gHttpHandler->MaybeSpeculativeConnectWithHTTPSRR( mConnectionInfo, callbacks, mCaps & (NS_HTTP_DISALLOW_SPDY | NS_HTTP_TRR_MODE_MASK | NS_HTTP_DISABLE_IPV4 | NS_HTTP_DISABLE_IPV6 | NS_HTTP_DISALLOW_HTTP3 | NS_HTTP_REFRESH_DNS), - gHttpHandler->EchConfigEnabled()); + gHttpHandler->EchConfigEnabled() && httpsRRAllowed); } void nsHttpChannel::DoNotifyListenerCleanup() { @@ -6538,27 +6542,16 @@ nsHttpChannel::GetOrCreateChannelClassifier() { return classifier.forget(); } -uint16_t nsHttpChannel::GetProxyDNSStrategy() { - // This function currently only supports returning DNS_PREFETCH_ORIGIN. - // Support for the rest of the DNS_* flags will be added later. - - if (!mProxyInfo) { - return DNS_PREFETCH_ORIGIN; +ProxyDNSStrategy nsHttpChannel::GetProxyDNSStrategy() { + // When network_dns_force_use_https_rr is true, return DNS_PREFETCH_ORIGIN. + // This ensures that we always perform HTTPS RR query. + nsCOMPtr<nsProxyInfo> proxyInfo(static_cast<nsProxyInfo*>(mProxyInfo.get())); + if (!proxyInfo || StaticPrefs::network_dns_force_use_https_rr()) { + return ProxyDNSStrategy::ORIGIN; } - uint32_t flags = 0; - nsAutoCString type; - mProxyInfo->GetFlags(&flags); - mProxyInfo->GetType(type); - // If the proxy is not to perform name resolution itself. - if (!(flags & nsIProxyInfo::TRANSPARENT_PROXY_RESOLVES_HOST)) { - if (type.EqualsLiteral("socks")) { - return DNS_PREFETCH_ORIGIN; - } - } - - return 0; + return GetProxyDNSStrategyHelper(proxyInfo->Type(), proxyInfo->Flags()); } // BeginConnect() SHOULD NOT call AsyncAbort(). AsyncAbort will be called by @@ -6744,11 +6737,13 @@ nsresult nsHttpChannel::BeginConnect() { } bool trrEnabled = false; + auto dnsStrategy = GetProxyDNSStrategy(); bool httpsRRAllowed = !LoadBeConservative() && !(mCaps & NS_HTTP_BE_CONSERVATIVE) && !(mLoadInfo->TriggeringPrincipal()->IsSystemPrincipal() && mLoadInfo->GetExternalContentPolicyType() != ExtContentPolicy::TYPE_DOCUMENT) && + dnsStrategy == ProxyDNSStrategy::ORIGIN && !mConnectionInfo->UsingConnect() && canUseHTTPSRRonNetwork(trrEnabled) && StaticPrefs::network_dns_use_https_rr_as_altsvc(); if (!httpsRRAllowed) { @@ -6859,16 +6854,7 @@ nsresult nsHttpChannel::BeginConnect() { ReEvaluateReferrerAfterTrackingStatusIsKnown(); } - rv = MaybeStartDNSPrefetch(); - if (NS_FAILED(rv)) { - auto dnsStrategy = GetProxyDNSStrategy(); - if (dnsStrategy & DNS_BLOCK_ON_ORIGIN_RESOLVE) { - // TODO: Should this be fatal? - return rv; - } - // Otherwise this shouldn't be fatal. - return NS_OK; - } + MaybeStartDNSPrefetch(); rv = CallOrWaitForResume( [](nsHttpChannel* self) { return self->PrepareToConnect(); }); @@ -6888,7 +6874,7 @@ nsresult nsHttpChannel::BeginConnect() { return NS_OK; } -nsresult nsHttpChannel::MaybeStartDNSPrefetch() { +void nsHttpChannel::MaybeStartDNSPrefetch() { // Start a DNS lookup very early in case the real open is queued the DNS can // happen in parallel. Do not do so in the presence of an HTTP proxy as // all lookups other than for the proxy itself are done by the proxy. @@ -6904,7 +6890,7 @@ nsresult nsHttpChannel::MaybeStartDNSPrefetch() { // timing we used. if ((mLoadFlags & (LOAD_NO_NETWORK_IO | LOAD_ONLY_FROM_CACHE)) || LoadAuthRedirectedChannel()) { - return NS_OK; + return; } auto dnsStrategy = GetProxyDNSStrategy(); @@ -6912,10 +6898,10 @@ nsresult nsHttpChannel::MaybeStartDNSPrefetch() { LOG( ("nsHttpChannel::MaybeStartDNSPrefetch [this=%p, strategy=%u] " "prefetching%s\n", - this, dnsStrategy, + this, static_cast<uint32_t>(dnsStrategy), mCaps & NS_HTTP_REFRESH_DNS ? ", refresh requested" : "")); - if (dnsStrategy & DNS_PREFETCH_ORIGIN) { + if (dnsStrategy == ProxyDNSStrategy::ORIGIN) { OriginAttributes originAttributes; StoragePrincipalHelper::GetOriginAttributesForNetworkState( this, originAttributes); @@ -6927,20 +6913,8 @@ nsresult nsHttpChannel::MaybeStartDNSPrefetch() { if (mCaps & NS_HTTP_REFRESH_DNS) { dnsFlags |= nsIDNSService::RESOLVE_BYPASS_CACHE; } - nsresult rv = mDNSPrefetch->PrefetchHigh(dnsFlags); - if (dnsStrategy & DNS_BLOCK_ON_ORIGIN_RESOLVE) { - LOG((" blocking on prefetching origin")); - - if (NS_WARN_IF(NS_FAILED(rv))) { - LOG((" lookup failed with 0x%08" PRIx32 ", aborting request", - static_cast<uint32_t>(rv))); - return rv; - } - - // Resolved in OnLookupComplete. - mDNSBlockingThenable = mDNSBlockingPromise.Ensure(__func__); - } + Unused << mDNSPrefetch->PrefetchHigh(dnsFlags); bool unused; if (StaticPrefs::network_dns_use_https_rr_as_altsvc() && !mHTTPSSVCRecord && @@ -6960,8 +6934,6 @@ nsresult nsHttpChannel::MaybeStartDNSPrefetch() { }); } } - - return NS_OK; } NS_IMETHODIMP ===================================== netwerk/protocol/http/nsHttpChannel.h ===================================== @@ -303,23 +303,11 @@ class nsHttpChannel final : public HttpBaseChannel, // Connections will only be established in this function. // (including DNS prefetch and speculative connection.) void MaybeResolveProxyAndBeginConnect(); - nsresult MaybeStartDNSPrefetch(); - - // Tells the channel to resolve the origin of the end server we are connecting - // to. - static uint16_t const DNS_PREFETCH_ORIGIN = 1 << 0; - // Tells the channel to resolve the host name of the proxy. - static uint16_t const DNS_PREFETCH_PROXY = 1 << 1; - // Will be set if the current channel uses an HTTP/HTTPS proxy. - static uint16_t const DNS_PROXY_IS_HTTP = 1 << 2; - // Tells the channel to wait for the result of the origin server resolution - // before any connection attempts are made. - static uint16_t const DNS_BLOCK_ON_ORIGIN_RESOLVE = 1 << 3; + void MaybeStartDNSPrefetch(); // Based on the proxy configuration determine the strategy for resolving the // end server host name. - // Returns a combination of the above flags. - uint16_t GetProxyDNSStrategy(); + ProxyDNSStrategy GetProxyDNSStrategy(); // We might synchronously or asynchronously call BeginConnect, // which includes DNS prefetch and speculative connection, according to ===================================== netwerk/protocol/http/nsHttpConnectionInfo.h ===================================== @@ -127,6 +127,13 @@ class nsHttpConnectionInfo final : public ARefBase { const char* ProxyPassword() const { return mProxyInfo ? mProxyInfo->Password().get() : nullptr; } + uint32_t ProxyFlag() const { + uint32_t flags = 0; + if (mProxyInfo) { + mProxyInfo->GetFlags(&flags); + } + return flags; + } const nsCString& ProxyAuthorizationHeader() const { return mProxyInfo ? mProxyInfo->ProxyAuthorizationHeader() : EmptyCString(); ===================================== netwerk/protocol/http/nsHttpConnectionMgr.cpp ===================================== @@ -3573,9 +3573,15 @@ void nsHttpConnectionMgr::DoSpeculativeConnectionInternal( return; } - if (aFetchHTTPSRR && NS_SUCCEEDED(aTrans->FetchHTTPSRR())) { - // nsHttpConnectionMgr::DoSpeculativeConnection will be called again when - // HTTPS RR is available. + ProxyDNSStrategy strategy = GetProxyDNSStrategyHelper( + aEnt->mConnInfo->ProxyType(), aEnt->mConnInfo->ProxyFlag()); + // Speculative connections can be triggered by non-Necko consumers, + // so add an extra check to ensure HTTPS RR isn't fetched when a proxy is + // used. + if (aFetchHTTPSRR && strategy == ProxyDNSStrategy::ORIGIN && + NS_SUCCEEDED(aTrans->FetchHTTPSRR())) { + // nsHttpConnectionMgr::DoSpeculativeConnection will be called again + // when HTTPS RR is available. return; } ===================================== netwerk/protocol/http/nsHttpHandler.cpp ===================================== @@ -2388,7 +2388,9 @@ nsresult nsHttpHandler::SpeculativeConnectInternal( } } - return SpeculativeConnect(ci, aCallbacks); + // When ech is enabled, always do speculative connect with HTTPS RR. + return MaybeSpeculativeConnectWithHTTPSRR(ci, aCallbacks, 0, + EchConfigEnabled()); } NS_IMETHODIMP ===================================== netwerk/protocol/http/nsHttpHandler.h ===================================== @@ -296,14 +296,13 @@ class nsHttpHandler final : public nsIHttpProtocolHandler, return mConnMgr->GetSocketThreadTarget(target); } - [[nodiscard]] nsresult SpeculativeConnect(nsHttpConnectionInfo* ci, - nsIInterfaceRequestor* callbacks, - uint32_t caps = 0, - bool aFetchHTTPSRR = false) { + [[nodiscard]] nsresult MaybeSpeculativeConnectWithHTTPSRR( + nsHttpConnectionInfo* ci, nsIInterfaceRequestor* callbacks, uint32_t caps, + bool aFetchHTTPSRR) { TickleWifi(callbacks); RefPtr<nsHttpConnectionInfo> clone = ci->Clone(); return mConnMgr->SpeculativeConnect(clone, callbacks, caps, nullptr, - aFetchHTTPSRR | EchConfigEnabled()); + aFetchHTTPSRR); } [[nodiscard]] nsresult SpeculativeConnect(nsHttpConnectionInfo* ci, ===================================== netwerk/test/unit/test_proxyDNS_leak.js ===================================== @@ -0,0 +1,111 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +// Test when socks proxy is registered, we don't try to resolve HTTPS record. +// Steps: +// 1. Use addHTTPSRecordOverride to add an override for service.com. +// 2. Add a proxy filter to use socks proxy. +// 3. Create a request to load service.com. +// 4. See if the HTTPS record is in DNS cache entries. + +"use strict"; + +const gDashboard = Cc["@mozilla.org/network/dashboard;1"].getService( + Ci.nsIDashboard +); +const pps = Cc["@mozilla.org/network/protocol-proxy-service;1"].getService(); + +add_task(async function setup() { + Services.prefs.setBoolPref("network.dns.native_https_query", true); + Services.prefs.setBoolPref("network.dns.native_https_query_win10", true); + const override = Cc["@mozilla.org/network/native-dns-override;1"].getService( + Ci.nsINativeDNSResolverOverride + ); + + let rawBuffer = [ + 0, 0, 128, 0, 0, 0, 0, 1, 0, 0, 0, 0, 7, 115, 101, 114, 118, 105, 99, 101, + 3, 99, 111, 109, 0, 0, 65, 0, 1, 0, 0, 0, 55, 0, 13, 0, 1, 0, 0, 1, 0, 6, 2, + 104, 50, 2, 104, 51, + ]; + override.addHTTPSRecordOverride("service.com", rawBuffer, rawBuffer.length); + override.addIPOverride("service.com", "127.0.0.1"); + registerCleanupFunction(() => { + Services.prefs.clearUserPref("network.dns.native_https_query"); + Services.prefs.clearUserPref("network.dns.native_https_query_win10"); + Services.prefs.clearUserPref("network.dns.localDomains"); + override.clearOverrides(); + }); +}); + +function makeChan(uri) { + let chan = NetUtil.newChannel({ + uri, + loadUsingSystemPrincipal: true, + contentPolicyType: Ci.nsIContentPolicy.TYPE_DOCUMENT, + }).QueryInterface(Ci.nsIHttpChannel); + chan.loadFlags = Ci.nsIChannel.LOAD_INITIAL_DOCUMENT_URI; + return chan; +} + +function channelOpenPromise(chan, flags) { + return new Promise(resolve => { + function finish(req, buffer) { + resolve([req, buffer]); + } + chan.asyncOpen(new ChannelListener(finish, null, flags)); + }); +} + +async function isRecordFound(hostname) { + return new Promise(resolve => { + gDashboard.requestDNSInfo(function (data) { + let found = false; + for (let i = 0; i < data.entries.length; i++) { + if ( + data.entries[i].hostname == hostname && + data.entries[i].type == Ci.nsIDNSService.RESOLVE_TYPE_HTTPSSVC + ) { + found = true; + break; + } + } + resolve(found); + }); + }); +} + +async function do_test_with_proxy_filter(filter) { + pps.registerFilter(filter, 10); + + let chan = makeChan(`https://service.com/`); + await channelOpenPromise(chan, CL_EXPECT_LATE_FAILURE | CL_ALLOW_UNKNOWN_CL); + + let found = await isRecordFound("service.com"); + pps.unregisterFilter(filter); + + return found; +} + +add_task(async function test_proxyDNS_do_leak() { + let filter = new NodeProxyFilter("socks", "localhost", 443, 0); + + let res = await do_test_with_proxy_filter(filter); + + Assert.ok(res, "Should find a DNS entry"); +}); + +add_task(async function test_proxyDNS_dont_leak() { + Services.dns.clearCache(false); + + let filter = new NodeProxyFilter( + "socks", + "localhost", + 443, + Ci.nsIProxyInfo.TRANSPARENT_PROXY_RESOLVES_HOST + ); + + let res = await do_test_with_proxy_filter(filter); + + Assert.ok(!res, "Should not find a DNS entry"); +}); ===================================== netwerk/test/unit/xpcshell.toml ===================================== @@ -983,6 +983,12 @@ run-sequentially = "node server exceptions dont replay well" ["test_proxy_pac.js"] +["test_proxyDNS_leak.js"] +skip-if = [ + "os == 'android'", + "socketprocess_networking", +] + ["test_proxyconnect.js"] skip-if = [ "tsan", ===================================== toolkit/content/aboutNetworking.js ===================================== @@ -116,6 +116,11 @@ function displayDns(data) { new_cont.setAttribute("id", "dns_content"); for (let i = 0; i < data.entries.length; i++) { + // TODO: Will be supported in bug 1889387. + if (data.entries[i].type != Ci.nsIDNSService.RESOLVE_TYPE_DEFAULT) { + continue; + } + let row = document.createElement("tr"); row.appendChild(col(data.entries[i].hostname)); row.appendChild(col(data.entries[i].family)); View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/c19… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/c19… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser] Pushed new tag FIREFOX_NIGHTLY_134_END
by Pier Angelo Vendrame (＠pierov) 17 Dec '24

17 Dec '24

Pier Angelo Vendrame pushed new tag FIREFOX_NIGHTLY_134_END at The Tor Project / Applications / Mullvad Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/tree/FIREF… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser] Pushed new tag FIREFOX_NIGHTLY_134_END
by Pier Angelo Vendrame (＠pierov) 17 Dec '24

17 Dec '24

Pier Angelo Vendrame pushed new tag FIREFOX_NIGHTLY_134_END at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/FIREFOX_N… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser] Pushed new tag FIREFOX_NIGHTLY_133_END
by Pier Angelo Vendrame (＠pierov) 17 Dec '24

17 Dec '24

Pier Angelo Vendrame pushed new tag FIREFOX_NIGHTLY_133_END at The Tor Project / Applications / Mullvad Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/tree/FIREF… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser] Pushed new tag FIREFOX_NIGHTLY_133_END
by Pier Angelo Vendrame (＠pierov) 17 Dec '24

17 Dec '24

Pier Angelo Vendrame pushed new tag FIREFOX_NIGHTLY_133_END at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/FIREFOX_N… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser] Pushed new tag FIREFOX_NIGHTLY_132_END
by Pier Angelo Vendrame (＠pierov) 17 Dec '24

17 Dec '24

Pier Angelo Vendrame pushed new tag FIREFOX_NIGHTLY_132_END at The Tor Project / Applications / Mullvad Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/tree/FIREF… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser] Pushed new tag FIREFOX_NIGHTLY_132_END
by Pier Angelo Vendrame (＠pierov) 17 Dec '24

17 Dec '24

Pier Angelo Vendrame pushed new tag FIREFOX_NIGHTLY_132_END at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/FIREFOX_N… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser] Pushed new tag FIREFOX_NIGHTLY_131_END
by Pier Angelo Vendrame (＠pierov) 17 Dec '24

17 Dec '24

Pier Angelo Vendrame pushed new tag FIREFOX_NIGHTLY_131_END at The Tor Project / Applications / Mullvad Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/tree/FIREF… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser] Pushed new tag FIREFOX_NIGHTLY_131_END
by Pier Angelo Vendrame (＠pierov) 17 Dec '24

17 Dec '24

Pier Angelo Vendrame pushed new tag FIREFOX_NIGHTLY_131_END at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/FIREFOX_N… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser] Pushed new tag FIREFOX_NIGHTLY_130_END
by Pier Angelo Vendrame (＠pierov) 17 Dec '24

17 Dec '24

Pier Angelo Vendrame pushed new tag FIREFOX_NIGHTLY_130_END at The Tor Project / Applications / Mullvad Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/tree/FIREF… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser] Pushed new tag FIREFOX_NIGHTLY_129_END
by Pier Angelo Vendrame (＠pierov) 17 Dec '24

17 Dec '24

Pier Angelo Vendrame pushed new tag FIREFOX_NIGHTLY_129_END at The Tor Project / Applications / Mullvad Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/tree/FIREF… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser] Pushed new tag FIREFOX_NIGHTLY_130_END
by Pier Angelo Vendrame (＠pierov) 17 Dec '24

17 Dec '24

Pier Angelo Vendrame pushed new tag FIREFOX_NIGHTLY_130_END at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/FIREFOX_N… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser] Pushed new tag FIREFOX_NIGHTLY_129_END
by Pier Angelo Vendrame (＠pierov) 17 Dec '24

17 Dec '24

Pier Angelo Vendrame pushed new tag FIREFOX_NIGHTLY_129_END at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/FIREFOX_N… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][base-browser-128.5.0esr-14.5-1] 2 commits: fixup! Bug 43140: Tighten up fonts on Linux.
by Pier Angelo Vendrame (＠pierov) 16 Dec '24

16 Dec '24

Pier Angelo Vendrame pushed to branch base-browser-128.5.0esr-14.5-1 at The Tor Project / Applications / Tor Browser Commits: 107f6329 by Pier Angelo Vendrame at 2024-12-16T19:28:28+01:00 fixup! Bug 43140: Tighten up fonts on Linux. Bug 43330: Move the previous fix earlier in the startup. - - - - - 491be80b by Pier Angelo Vendrame at 2024-12-16T19:28:29+01:00 Bug 43322: Customize the font visibility lists. Customize the lists of fonts to assign base visibility to in base browser and derivatives. Also, rename the files with the upstream lists, to make sure we do not use them by mistake. - - - - - 10 changed files: - gfx/thebes/StandardFonts-linux.inc → gfx/thebes/StandardFonts-linux-upstream.inc - + gfx/thebes/StandardFonts-macos-bb.inc - gfx/thebes/StandardFonts-macos.inc → gfx/thebes/StandardFonts-macos-upstream.inc - + gfx/thebes/StandardFonts-win10-bb.inc - gfx/thebes/StandardFonts-win10.inc → gfx/thebes/StandardFonts-win10-upstream.inc - gfx/thebes/gfxDWriteFontList.cpp - gfx/thebes/gfxFcPlatformFontList.cpp - gfx/thebes/gfxGDIFontList.cpp - gfx/thebes/gfxMacPlatformFontList.mm - toolkit/xre/nsXREDirProvider.cpp Changes: ===================================== gfx/thebes/StandardFonts-linux.inc → gfx/thebes/StandardFonts-linux-upstream.inc ===================================== ===================================== gfx/thebes/StandardFonts-macos-bb.inc ===================================== @@ -0,0 +1,33 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +static const char* kBaseFonts[] = { + "Apple Color Emoji", + "AppleGothic", + "Arial", + "Arial Black", + "Arial Narrow", + "Courier", + "Courier New", + "Geneva", + "Georgia", + "Heiti TC", + "Helvetica", + "Helvetica Neue", + "Hiragino Kaku Gothic ProN", + "Kailasa", + "Lucida Grande", + "Menlo", + "Monaco", + "PingFang HK", + "PingFang SC", + "PingFang TC", + "Songti SC", + "Songti TC", + "Tahoma", + "Thonburi", + "Times", + "Times New Roman", + "Verdana", +}; ===================================== gfx/thebes/StandardFonts-macos.inc → gfx/thebes/StandardFonts-macos-upstream.inc ===================================== ===================================== gfx/thebes/StandardFonts-win10-bb.inc ===================================== @@ -0,0 +1,90 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +static const char* kBaseFonts[] = { + "Arial", + "Cambria Math", + "Consolas", + "Courier New", + "Georgia", + "Lucida Console", + "Malgun Gothic", + "Microsoft Himalaya", + "Microsoft JhengHei", + "Microsoft YaHei", + "MS Gothic", + "MS PGothic", + "MV Boli", + "Segoe UI", + "SimSun", + "Sylfaen", + "Tahoma", + "Times New Roman", + "Verdana", +}; + +struct FontSubstitute { + const char* substituteName; + const char* actualFontName; +}; + +static const FontSubstitute kFontSubstitutes[] = { + // Common substitutions + {"Arabic Transparent", "Arial"}, + {"Arabic Transparent Bold", "Arial Bold"}, + {"Arial Baltic", "Arial"}, + {"Arial CE", "Arial"}, + {"Arial CYR", "Arial"}, + {"Arial Greek", "Arial"}, + {"Arial TUR", "Arial"}, + {"Courier New Baltic", "Courier New"}, + {"Courier New CE", "Courier New"}, + {"Courier New CYR", "Courier New"}, + {"Courier New Greek", "Courier New"}, + {"Courier New TUR", "Courier New"}, + {"Helv", "MS Sans Serif"}, + {"Helvetica", "Arial"}, + {"MS Shell Dlg 2", "Tahoma"}, + {"Tahoma Armenian", "Tahoma"}, + {"Times", "Times New Roman"}, + {"Times New Roman Baltic", "Times New Roman"}, + {"Times New Roman CE", "Times New Roman"}, + {"Times New Roman CYR", "Times New Roman"}, + {"Times New Roman Greek", "Times New Roman"}, + {"Times New Roman TUR", "Times New Roman"}, + {"Tms Rmn", "MS Serif"}, + // Common, except Japanese (which uses MS UI Gothic, instead) + {"MS Shell Dlg", "Microsoft Sans Serif"}, + // Arabic + {"Arial (Arabic)", "Arial"}, + {"Courier New (Arabic)", "Courier New"}, + {"Times New Roman (Arabic)", "Times New Roman"}, + // Cyrillic + Greek + {"Courier", "Courier New"}, + // Greek + {"Fixedsys Greek", "Fixedsys"}, + {"MS Serif Greek", "MS Serif"}, + {"MS Sans Serif Greek", "MS Sans Serif"}, + {"Small Fonts Greek", "Small Fonts"}, + {"System Greek", "System"}, + // Hebrew + {"Arial (Hebrew)", "Arial"}, + {"Courier New (Hebrew)", "Courier New"}, + {"David Transparent", "David"}, + {"Fixed Miriam Transparent", "Miriam Fixed"}, + {"Miriam Transparent", "Miriam"}, + {"Rod Transparent", "Rod"}, + {"Times New Roman (Hebrew)", "Times New Roman"}, + // Japanese + {"標準明朝", "ＭＳ明朝"}, + {"標準ゴシック", "ＭＳゴシック"}, + {"ゴシック", "ＭＳゴシック"}, + {"ｺﾞｼｯｸ", "ＭＳゴシック"}, + {"ｸｰﾘｴ", "Courier"}, + {"ﾀｲﾑｽﾞﾛﾏﾝ", "Times New Roman"}, + {"ﾍﾙﾍﾞﾁｶ", "Arial"}, + // Simplified Chinese + {"FangSong_GB2312", "FangSong"}, + {"KaiTi_GB2312", "KaiTi"}, +}; ===================================== gfx/thebes/StandardFonts-win10.inc → gfx/thebes/StandardFonts-win10-upstream.inc ===================================== @@ -200,68 +200,3 @@ static const char* kLangPackFonts[] = { // "Rockwell Nova", // Pan-European Supplemental Fonts - EXCLUDED // "Verdana Pro", // Pan-European Supplemental Fonts - EXCLUDED }; - -struct FontSubstitute { - const char *substituteName; - const char *actualFontName; -}; - -static const FontSubstitute kFontSubstitutes[] = { - // Common substitutions - {"Arabic Transparent", "Arial"}, - {"Arabic Transparent Bold", "Arial Bold"}, - {"Arial Baltic", "Arial"}, - {"Arial CE", "Arial"}, - {"Arial CYR", "Arial"}, - {"Arial Greek", "Arial"}, - {"Arial TUR", "Arial"}, - {"Courier New Baltic", "Courier New"}, - {"Courier New CE", "Courier New"}, - {"Courier New CYR", "Courier New"}, - {"Courier New Greek", "Courier New"}, - {"Courier New TUR", "Courier New"}, - {"Helv", "MS Sans Serif"}, - {"Helvetica", "Arial"}, - {"MS Shell Dlg 2", "Tahoma"}, - {"Tahoma Armenian", "Tahoma"}, - {"Times", "Times New Roman"}, - {"Times New Roman Baltic", "Times New Roman"}, - {"Times New Roman CE", "Times New Roman"}, - {"Times New Roman CYR", "Times New Roman"}, - {"Times New Roman Greek", "Times New Roman"}, - {"Times New Roman TUR", "Times New Roman"}, - {"Tms Rmn", "MS Serif"}, - // Common, except Japanese (which uses MS UI Gothic, instead) - {"MS Shell Dlg", "Microsoft Sans Serif"}, - // Arabic - {"Arial (Arabic)", "Arial"}, - {"Courier New (Arabic)", "Courier New"}, - {"Times New Roman (Arabic)", "Times New Roman"}, - // Cyrillic + Greek - {"Courier", "Courier New"}, - // Greek - {"Fixedsys Greek", "Fixedsys"}, - {"MS Serif Greek", "MS Serif"}, - {"MS Sans Serif Greek", "MS Sans Serif"}, - {"Small Fonts Greek", "Small Fonts"}, - {"System Greek", "System"}, - // Hebrew - {"Arial (Hebrew)", "Arial"}, - {"Courier New (Hebrew)", "Courier New"}, - {"David Transparent", "David"}, - {"Fixed Miriam Transparent", "Miriam Fixed"}, - {"Miriam Transparent", "Miriam"}, - {"Rod Transparent", "Rod"}, - {"Times New Roman (Hebrew)", "Times New Roman"}, - // Japanese - {"標準明朝", "ＭＳ明朝"}, - {"標準ゴシック", "ＭＳゴシック"}, - {"ゴシック", "ＭＳゴシック"}, - {"ｺﾞｼｯｸ", "ＭＳゴシック"}, - {"ｸｰﾘｴ", "Courier"}, - {"ﾀｲﾑｽﾞﾛﾏﾝ", "Times New Roman"}, - {"ﾍﾙﾍﾞﾁｶ", "Arial"}, - // Simplified Chinese - {"FangSong_GB2312", "FangSong"}, - {"KaiTi_GB2312", "KaiTi"}, -}; ===================================== gfx/thebes/gfxDWriteFontList.cpp ===================================== @@ -32,7 +32,7 @@ #include "harfbuzz/hb.h" -#include "StandardFonts-win10.inc" +#include "StandardFonts-win10-bb.inc" using namespace mozilla; using namespace mozilla::gfx; @@ -910,7 +910,9 @@ void gfxDWriteFontEntry::AddSizeOfIncludingThis(MallocSizeOf aMallocSizeOf, gfxDWriteFontList::gfxDWriteFontList() : mForceGDIClassicMaxFontSize(0.0) { CheckFamilyList(kBaseFonts); +#ifndef BASE_BROWSER_VERSION CheckFamilyList(kLangPackFonts); +#endif } // bug 602792 - CJK systems default to large CJK fonts which cause excessive @@ -1153,9 +1155,11 @@ FontVisibility gfxDWriteFontList::GetVisibilityForFamily( if (FamilyInList(aName, kBaseFonts)) { return FontVisibility::Base; } +#ifndef BASE_BROWSER_VERSION if (FamilyInList(aName, kLangPackFonts)) { return FontVisibility::LangPack; } +#endif return FontVisibility::User; } @@ -1164,8 +1168,10 @@ gfxDWriteFontList::GetFilteredPlatformFontLists() { nsTArray<std::pair<const char**, uint32_t>> fontLists; fontLists.AppendElement(std::make_pair(kBaseFonts, ArrayLength(kBaseFonts))); +#ifndef BASE_BROWSER_VERSION fontLists.AppendElement( std::make_pair(kLangPackFonts, ArrayLength(kLangPackFonts))); +#endif return fontLists; } ===================================== gfx/thebes/gfxFcPlatformFontList.cpp ===================================== @@ -32,7 +32,9 @@ #include "nsCharSeparatedTokenizer.h" #include "nsXULAppAPI.h" #include "SharedFontList-impl.h" -#include "StandardFonts-linux.inc" +#ifndef BASE_BROWSER_VERSION +# include "StandardFonts-linux.inc" +#endif #include "mozilla/intl/Locale.h" #include "mozilla/gfx/HelpersCairo.h" @@ -1352,45 +1354,20 @@ bool gfxFontconfigFont::ShouldHintMetrics() const { return !GetStyle()->printerFont; } -static nsresult SetFontconfigConfigFile() { - nsCOMPtr<nsIProperties> dirSvc( - do_GetService("@mozilla.org/file/directory_service;1")); - NS_ENSURE_TRUE(dirSvc, NS_ERROR_NOT_AVAILABLE); - nsCOMPtr<nsIFile> appFile, confDir; - nsresult rv = dirSvc->Get(XRE_EXECUTABLE_FILE, NS_GET_IID(nsIFile), - getter_AddRefs(appFile)); - NS_ENSURE_SUCCESS(rv, rv); - rv = appFile->GetParent(getter_AddRefs(confDir)); - NS_ENSURE_SUCCESS(rv, rv); - rv = confDir->AppendNative("fonts"_ns); - NS_ENSURE_SUCCESS(rv, rv); - - nsAutoCString confPath; - rv = confDir->GetNativePath(confPath); - NS_ENSURE_SUCCESS(rv, rv); - if (NS_WARN_IF(setenv("FONTCONFIG_PATH", confPath.BeginReading(), 1) != 0 || - setenv("FONTCONFIG_FILE", "fonts.conf", 1) != 0)) { - return NS_ERROR_FAILURE; - } - return NS_OK; -} - gfxFcPlatformFontList::gfxFcPlatformFontList() : mLocalNames(64), mGenericMappings(32), mFcSubstituteCache(64), mLastConfig(nullptr), mAlwaysUseFontconfigGenerics(true) { - if (NS_FAILED(SetFontconfigConfigFile())) { - NS_WARNING("Failed to set the fontconfig config file!"); - } - +#ifndef BASE_BROWSER_VERSION CheckFamilyList(kBaseFonts_Ubuntu_22_04); CheckFamilyList(kLangFonts_Ubuntu_22_04); CheckFamilyList(kBaseFonts_Ubuntu_20_04); CheckFamilyList(kLangFonts_Ubuntu_20_04); CheckFamilyList(kBaseFonts_Fedora_39); CheckFamilyList(kBaseFonts_Fedora_38); +#endif mLastConfig = FcConfigGetCurrent(); if (XRE_IsParentProcess()) { // if the rescan interval is set, start the timer @@ -1704,11 +1681,14 @@ using Device = nsIGfxInfo::FontVisibilityDeviceDetermination; static Device sFontVisibilityDevice = Device::Unassigned; void AssignFontVisibilityDevice() { + sFontVisibilityDevice = Device::Linux_Unknown; +#ifndef BASE_BROWSER_VERSION if (sFontVisibilityDevice == Device::Unassigned) { nsCOMPtr<nsIGfxInfo> gfxInfo = components::GfxInfo::Service(); NS_ENSURE_SUCCESS_VOID( gfxInfo->GetFontVisibilityDetermination(&sFontVisibilityDevice)); } +#endif } // Per family array of faces. @@ -2029,6 +2009,7 @@ FontVisibility gfxFcPlatformFontList::GetVisibilityForFamily( AssignFontVisibilityDevice(); switch (sFontVisibilityDevice) { +#ifndef BASE_BROWSER_VERSION case Device::Linux_Ubuntu_any: case Device::Linux_Ubuntu_22: if (FamilyInList(aName, kBaseFonts_Ubuntu_22_04)) { @@ -2068,7 +2049,7 @@ FontVisibility gfxFcPlatformFontList::GetVisibilityForFamily( return FontVisibility::Base; } return FontVisibility::User; - +#endif default: // We don't know how to categorize fonts on this system return FontVisibility::Unknown; @@ -2081,6 +2062,7 @@ gfxFcPlatformFontList::GetFilteredPlatformFontLists() { nsTArray<std::pair<const char**, uint32_t>> fontLists; +#ifndef BASE_BROWSER_VERSION switch (sFontVisibilityDevice) { case Device::Linux_Ubuntu_any: case Device::Linux_Ubuntu_22: @@ -2114,6 +2096,7 @@ gfxFcPlatformFontList::GetFilteredPlatformFontLists() { // We don't know how to categorize fonts on this system break; } +#endif return fontLists; } ===================================== gfx/thebes/gfxGDIFontList.cpp ===================================== @@ -33,7 +33,7 @@ #include "nsContentUtils.h" -#include "StandardFonts-win10.inc" +#include "StandardFonts-win10-bb.inc" #include <usp10.h> ===================================== gfx/thebes/gfxMacPlatformFontList.mm ===================================== @@ -46,7 +46,7 @@ #include <time.h> #include <dlfcn.h> -#include "StandardFonts-macos.inc" +#include "StandardFonts-macos-bb.inc" using namespace mozilla; using namespace mozilla::gfx; @@ -153,7 +153,9 @@ void gfxSingleFaceMacFontFamily::ReadOtherFamilyNames( gfxMacPlatformFontList::gfxMacPlatformFontList() : CoreTextFontList() { CheckFamilyList(kBaseFonts); +#ifndef BASE_BROWSER_VERSION CheckFamilyList(kBaseFonts_13_Higher); +#endif // cache this in a static variable so that gfxMacFontFamily objects // don't have to repeatedly look it up @@ -188,10 +190,12 @@ FontVisibility gfxMacPlatformFontList::GetVisibilityForFamily( if (FamilyInList(aName, kBaseFonts)) { return FontVisibility::Base; } +#ifndef BASE_BROWSER_VERSION if (GetFontVisibilityDevice() == Device::MacOS_13_plus && FamilyInList(aName, kBaseFonts_13_Higher)) { return FontVisibility::Base; } +#endif #ifdef MOZ_BUNDLED_FONTS if (mBundledFamilies.Contains(aName)) { return FontVisibility::Base; @@ -206,10 +210,12 @@ gfxMacPlatformFontList::GetFilteredPlatformFontLists() { fontLists.AppendElement(std::make_pair(kBaseFonts, std::size(kBaseFonts))); +#ifndef BASE_BROWSER_VERSION if (GetFontVisibilityDevice() == Device::MacOS_13_plus) { fontLists.AppendElement( std::make_pair(kBaseFonts_13_Higher, std::size(kBaseFonts_13_Higher))); } +#endif return fontLists; } ===================================== toolkit/xre/nsXREDirProvider.cpp ===================================== @@ -742,6 +742,25 @@ void nsXREDirProvider::FinishInitializingUserPrefs() { } } +#ifdef MOZ_WIDGET_GTK +static nsresult SetFontconfigConfigFile(nsCOMPtr<nsIFile> appDir) { + NS_ENSURE_TRUE(appDir, NS_ERROR_NULL_POINTER); + nsCOMPtr<nsIFile> confDir; + nsresult rv = appDir->Clone(getter_AddRefs(confDir)); + NS_ENSURE_SUCCESS(rv, rv); + rv = confDir->AppendNative("fonts"_ns); + NS_ENSURE_SUCCESS(rv, rv); + nsAutoCString confPath; + rv = confDir->GetNativePath(confPath); + NS_ENSURE_SUCCESS(rv, rv); + if (NS_WARN_IF(setenv("FONTCONFIG_PATH", confPath.BeginReading(), 1) != 0 || + setenv("FONTCONFIG_FILE", "fonts.conf", 1) != 0)) { + return NS_ERROR_FAILURE; + } + return NS_OK; +} +#endif + NS_IMETHODIMP nsXREDirProvider::DoStartup() { nsresult rv; @@ -760,6 +779,13 @@ nsXREDirProvider::DoStartup() { */ MOZ_ASSERT(mPrefsInitialized); +#ifdef MOZ_WIDGET_GTK + // FontConfig might be initialized by GTK/Pango, so we need to define its + // config variables before doing anything. + rv = SetFontconfigConfigFile(mGREDir); + NS_ENSURE_SUCCESS(rv, rv); +#endif + bool safeModeNecessary = false; nsCOMPtr<nsIAppStartup> appStartup( mozilla::components::AppStartup::Service()); View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/fa621b… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/fa621b… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-128.5.0esr-14.5-1] 2 commits: fixup! Bug 43140: Tighten up fonts on Linux.
by Pier Angelo Vendrame (＠pierov) 16 Dec '24

16 Dec '24

Pier Angelo Vendrame pushed to branch mullvad-browser-128.5.0esr-14.5-1 at The Tor Project / Applications / Mullvad Browser Commits: 334a5ddd by Pier Angelo Vendrame at 2024-12-16T19:28:03+01:00 fixup! Bug 43140: Tighten up fonts on Linux. Bug 43330: Move the previous fix earlier in the startup. - - - - - 3b5a4ebe by Pier Angelo Vendrame at 2024-12-16T19:28:09+01:00 Bug 43322: Customize the font visibility lists. Customize the lists of fonts to assign base visibility to in base browser and derivatives. Also, rename the files with the upstream lists, to make sure we do not use them by mistake. - - - - - 10 changed files: - gfx/thebes/StandardFonts-linux.inc → gfx/thebes/StandardFonts-linux-upstream.inc - + gfx/thebes/StandardFonts-macos-bb.inc - gfx/thebes/StandardFonts-macos.inc → gfx/thebes/StandardFonts-macos-upstream.inc - + gfx/thebes/StandardFonts-win10-bb.inc - gfx/thebes/StandardFonts-win10.inc → gfx/thebes/StandardFonts-win10-upstream.inc - gfx/thebes/gfxDWriteFontList.cpp - gfx/thebes/gfxFcPlatformFontList.cpp - gfx/thebes/gfxGDIFontList.cpp - gfx/thebes/gfxMacPlatformFontList.mm - toolkit/xre/nsXREDirProvider.cpp Changes: ===================================== gfx/thebes/StandardFonts-linux.inc → gfx/thebes/StandardFonts-linux-upstream.inc ===================================== ===================================== gfx/thebes/StandardFonts-macos-bb.inc ===================================== @@ -0,0 +1,33 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +static const char* kBaseFonts[] = { + "Apple Color Emoji", + "AppleGothic", + "Arial", + "Arial Black", + "Arial Narrow", + "Courier", + "Courier New", + "Geneva", + "Georgia", + "Heiti TC", + "Helvetica", + "Helvetica Neue", + "Hiragino Kaku Gothic ProN", + "Kailasa", + "Lucida Grande", + "Menlo", + "Monaco", + "PingFang HK", + "PingFang SC", + "PingFang TC", + "Songti SC", + "Songti TC", + "Tahoma", + "Thonburi", + "Times", + "Times New Roman", + "Verdana", +}; ===================================== gfx/thebes/StandardFonts-macos.inc → gfx/thebes/StandardFonts-macos-upstream.inc ===================================== ===================================== gfx/thebes/StandardFonts-win10-bb.inc ===================================== @@ -0,0 +1,90 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +static const char* kBaseFonts[] = { + "Arial", + "Cambria Math", + "Consolas", + "Courier New", + "Georgia", + "Lucida Console", + "Malgun Gothic", + "Microsoft Himalaya", + "Microsoft JhengHei", + "Microsoft YaHei", + "MS Gothic", + "MS PGothic", + "MV Boli", + "Segoe UI", + "SimSun", + "Sylfaen", + "Tahoma", + "Times New Roman", + "Verdana", +}; + +struct FontSubstitute { + const char* substituteName; + const char* actualFontName; +}; + +static const FontSubstitute kFontSubstitutes[] = { + // Common substitutions + {"Arabic Transparent", "Arial"}, + {"Arabic Transparent Bold", "Arial Bold"}, + {"Arial Baltic", "Arial"}, + {"Arial CE", "Arial"}, + {"Arial CYR", "Arial"}, + {"Arial Greek", "Arial"}, + {"Arial TUR", "Arial"}, + {"Courier New Baltic", "Courier New"}, + {"Courier New CE", "Courier New"}, + {"Courier New CYR", "Courier New"}, + {"Courier New Greek", "Courier New"}, + {"Courier New TUR", "Courier New"}, + {"Helv", "MS Sans Serif"}, + {"Helvetica", "Arial"}, + {"MS Shell Dlg 2", "Tahoma"}, + {"Tahoma Armenian", "Tahoma"}, + {"Times", "Times New Roman"}, + {"Times New Roman Baltic", "Times New Roman"}, + {"Times New Roman CE", "Times New Roman"}, + {"Times New Roman CYR", "Times New Roman"}, + {"Times New Roman Greek", "Times New Roman"}, + {"Times New Roman TUR", "Times New Roman"}, + {"Tms Rmn", "MS Serif"}, + // Common, except Japanese (which uses MS UI Gothic, instead) + {"MS Shell Dlg", "Microsoft Sans Serif"}, + // Arabic + {"Arial (Arabic)", "Arial"}, + {"Courier New (Arabic)", "Courier New"}, + {"Times New Roman (Arabic)", "Times New Roman"}, + // Cyrillic + Greek + {"Courier", "Courier New"}, + // Greek + {"Fixedsys Greek", "Fixedsys"}, + {"MS Serif Greek", "MS Serif"}, + {"MS Sans Serif Greek", "MS Sans Serif"}, + {"Small Fonts Greek", "Small Fonts"}, + {"System Greek", "System"}, + // Hebrew + {"Arial (Hebrew)", "Arial"}, + {"Courier New (Hebrew)", "Courier New"}, + {"David Transparent", "David"}, + {"Fixed Miriam Transparent", "Miriam Fixed"}, + {"Miriam Transparent", "Miriam"}, + {"Rod Transparent", "Rod"}, + {"Times New Roman (Hebrew)", "Times New Roman"}, + // Japanese + {"標準明朝", "ＭＳ明朝"}, + {"標準ゴシック", "ＭＳゴシック"}, + {"ゴシック", "ＭＳゴシック"}, + {"ｺﾞｼｯｸ", "ＭＳゴシック"}, + {"ｸｰﾘｴ", "Courier"}, + {"ﾀｲﾑｽﾞﾛﾏﾝ", "Times New Roman"}, + {"ﾍﾙﾍﾞﾁｶ", "Arial"}, + // Simplified Chinese + {"FangSong_GB2312", "FangSong"}, + {"KaiTi_GB2312", "KaiTi"}, +}; ===================================== gfx/thebes/StandardFonts-win10.inc → gfx/thebes/StandardFonts-win10-upstream.inc ===================================== @@ -200,68 +200,3 @@ static const char* kLangPackFonts[] = { // "Rockwell Nova", // Pan-European Supplemental Fonts - EXCLUDED // "Verdana Pro", // Pan-European Supplemental Fonts - EXCLUDED }; - -struct FontSubstitute { - const char *substituteName; - const char *actualFontName; -}; - -static const FontSubstitute kFontSubstitutes[] = { - // Common substitutions - {"Arabic Transparent", "Arial"}, - {"Arabic Transparent Bold", "Arial Bold"}, - {"Arial Baltic", "Arial"}, - {"Arial CE", "Arial"}, - {"Arial CYR", "Arial"}, - {"Arial Greek", "Arial"}, - {"Arial TUR", "Arial"}, - {"Courier New Baltic", "Courier New"}, - {"Courier New CE", "Courier New"}, - {"Courier New CYR", "Courier New"}, - {"Courier New Greek", "Courier New"}, - {"Courier New TUR", "Courier New"}, - {"Helv", "MS Sans Serif"}, - {"Helvetica", "Arial"}, - {"MS Shell Dlg 2", "Tahoma"}, - {"Tahoma Armenian", "Tahoma"}, - {"Times", "Times New Roman"}, - {"Times New Roman Baltic", "Times New Roman"}, - {"Times New Roman CE", "Times New Roman"}, - {"Times New Roman CYR", "Times New Roman"}, - {"Times New Roman Greek", "Times New Roman"}, - {"Times New Roman TUR", "Times New Roman"}, - {"Tms Rmn", "MS Serif"}, - // Common, except Japanese (which uses MS UI Gothic, instead) - {"MS Shell Dlg", "Microsoft Sans Serif"}, - // Arabic - {"Arial (Arabic)", "Arial"}, - {"Courier New (Arabic)", "Courier New"}, - {"Times New Roman (Arabic)", "Times New Roman"}, - // Cyrillic + Greek - {"Courier", "Courier New"}, - // Greek - {"Fixedsys Greek", "Fixedsys"}, - {"MS Serif Greek", "MS Serif"}, - {"MS Sans Serif Greek", "MS Sans Serif"}, - {"Small Fonts Greek", "Small Fonts"}, - {"System Greek", "System"}, - // Hebrew - {"Arial (Hebrew)", "Arial"}, - {"Courier New (Hebrew)", "Courier New"}, - {"David Transparent", "David"}, - {"Fixed Miriam Transparent", "Miriam Fixed"}, - {"Miriam Transparent", "Miriam"}, - {"Rod Transparent", "Rod"}, - {"Times New Roman (Hebrew)", "Times New Roman"}, - // Japanese - {"標準明朝", "ＭＳ明朝"}, - {"標準ゴシック", "ＭＳゴシック"}, - {"ゴシック", "ＭＳゴシック"}, - {"ｺﾞｼｯｸ", "ＭＳゴシック"}, - {"ｸｰﾘｴ", "Courier"}, - {"ﾀｲﾑｽﾞﾛﾏﾝ", "Times New Roman"}, - {"ﾍﾙﾍﾞﾁｶ", "Arial"}, - // Simplified Chinese - {"FangSong_GB2312", "FangSong"}, - {"KaiTi_GB2312", "KaiTi"}, -}; ===================================== gfx/thebes/gfxDWriteFontList.cpp ===================================== @@ -32,7 +32,7 @@ #include "harfbuzz/hb.h" -#include "StandardFonts-win10.inc" +#include "StandardFonts-win10-bb.inc" using namespace mozilla; using namespace mozilla::gfx; @@ -910,7 +910,9 @@ void gfxDWriteFontEntry::AddSizeOfIncludingThis(MallocSizeOf aMallocSizeOf, gfxDWriteFontList::gfxDWriteFontList() : mForceGDIClassicMaxFontSize(0.0) { CheckFamilyList(kBaseFonts); +#ifndef BASE_BROWSER_VERSION CheckFamilyList(kLangPackFonts); +#endif } // bug 602792 - CJK systems default to large CJK fonts which cause excessive @@ -1153,9 +1155,11 @@ FontVisibility gfxDWriteFontList::GetVisibilityForFamily( if (FamilyInList(aName, kBaseFonts)) { return FontVisibility::Base; } +#ifndef BASE_BROWSER_VERSION if (FamilyInList(aName, kLangPackFonts)) { return FontVisibility::LangPack; } +#endif return FontVisibility::User; } @@ -1164,8 +1168,10 @@ gfxDWriteFontList::GetFilteredPlatformFontLists() { nsTArray<std::pair<const char**, uint32_t>> fontLists; fontLists.AppendElement(std::make_pair(kBaseFonts, ArrayLength(kBaseFonts))); +#ifndef BASE_BROWSER_VERSION fontLists.AppendElement( std::make_pair(kLangPackFonts, ArrayLength(kLangPackFonts))); +#endif return fontLists; } ===================================== gfx/thebes/gfxFcPlatformFontList.cpp ===================================== @@ -32,7 +32,9 @@ #include "nsCharSeparatedTokenizer.h" #include "nsXULAppAPI.h" #include "SharedFontList-impl.h" -#include "StandardFonts-linux.inc" +#ifndef BASE_BROWSER_VERSION +# include "StandardFonts-linux.inc" +#endif #include "mozilla/intl/Locale.h" #include "mozilla/gfx/HelpersCairo.h" @@ -1352,45 +1354,20 @@ bool gfxFontconfigFont::ShouldHintMetrics() const { return !GetStyle()->printerFont; } -static nsresult SetFontconfigConfigFile() { - nsCOMPtr<nsIProperties> dirSvc( - do_GetService("@mozilla.org/file/directory_service;1")); - NS_ENSURE_TRUE(dirSvc, NS_ERROR_NOT_AVAILABLE); - nsCOMPtr<nsIFile> appFile, confDir; - nsresult rv = dirSvc->Get(XRE_EXECUTABLE_FILE, NS_GET_IID(nsIFile), - getter_AddRefs(appFile)); - NS_ENSURE_SUCCESS(rv, rv); - rv = appFile->GetParent(getter_AddRefs(confDir)); - NS_ENSURE_SUCCESS(rv, rv); - rv = confDir->AppendNative("fonts"_ns); - NS_ENSURE_SUCCESS(rv, rv); - - nsAutoCString confPath; - rv = confDir->GetNativePath(confPath); - NS_ENSURE_SUCCESS(rv, rv); - if (NS_WARN_IF(setenv("FONTCONFIG_PATH", confPath.BeginReading(), 1) != 0 || - setenv("FONTCONFIG_FILE", "fonts.conf", 1) != 0)) { - return NS_ERROR_FAILURE; - } - return NS_OK; -} - gfxFcPlatformFontList::gfxFcPlatformFontList() : mLocalNames(64), mGenericMappings(32), mFcSubstituteCache(64), mLastConfig(nullptr), mAlwaysUseFontconfigGenerics(true) { - if (NS_FAILED(SetFontconfigConfigFile())) { - NS_WARNING("Failed to set the fontconfig config file!"); - } - +#ifndef BASE_BROWSER_VERSION CheckFamilyList(kBaseFonts_Ubuntu_22_04); CheckFamilyList(kLangFonts_Ubuntu_22_04); CheckFamilyList(kBaseFonts_Ubuntu_20_04); CheckFamilyList(kLangFonts_Ubuntu_20_04); CheckFamilyList(kBaseFonts_Fedora_39); CheckFamilyList(kBaseFonts_Fedora_38); +#endif mLastConfig = FcConfigGetCurrent(); if (XRE_IsParentProcess()) { // if the rescan interval is set, start the timer @@ -1704,11 +1681,14 @@ using Device = nsIGfxInfo::FontVisibilityDeviceDetermination; static Device sFontVisibilityDevice = Device::Unassigned; void AssignFontVisibilityDevice() { + sFontVisibilityDevice = Device::Linux_Unknown; +#ifndef BASE_BROWSER_VERSION if (sFontVisibilityDevice == Device::Unassigned) { nsCOMPtr<nsIGfxInfo> gfxInfo = components::GfxInfo::Service(); NS_ENSURE_SUCCESS_VOID( gfxInfo->GetFontVisibilityDetermination(&sFontVisibilityDevice)); } +#endif } // Per family array of faces. @@ -2029,6 +2009,7 @@ FontVisibility gfxFcPlatformFontList::GetVisibilityForFamily( AssignFontVisibilityDevice(); switch (sFontVisibilityDevice) { +#ifndef BASE_BROWSER_VERSION case Device::Linux_Ubuntu_any: case Device::Linux_Ubuntu_22: if (FamilyInList(aName, kBaseFonts_Ubuntu_22_04)) { @@ -2068,7 +2049,7 @@ FontVisibility gfxFcPlatformFontList::GetVisibilityForFamily( return FontVisibility::Base; } return FontVisibility::User; - +#endif default: // We don't know how to categorize fonts on this system return FontVisibility::Unknown; @@ -2081,6 +2062,7 @@ gfxFcPlatformFontList::GetFilteredPlatformFontLists() { nsTArray<std::pair<const char**, uint32_t>> fontLists; +#ifndef BASE_BROWSER_VERSION switch (sFontVisibilityDevice) { case Device::Linux_Ubuntu_any: case Device::Linux_Ubuntu_22: @@ -2114,6 +2096,7 @@ gfxFcPlatformFontList::GetFilteredPlatformFontLists() { // We don't know how to categorize fonts on this system break; } +#endif return fontLists; } ===================================== gfx/thebes/gfxGDIFontList.cpp ===================================== @@ -33,7 +33,7 @@ #include "nsContentUtils.h" -#include "StandardFonts-win10.inc" +#include "StandardFonts-win10-bb.inc" #include <usp10.h> ===================================== gfx/thebes/gfxMacPlatformFontList.mm ===================================== @@ -46,7 +46,7 @@ #include <time.h> #include <dlfcn.h> -#include "StandardFonts-macos.inc" +#include "StandardFonts-macos-bb.inc" using namespace mozilla; using namespace mozilla::gfx; @@ -153,7 +153,9 @@ void gfxSingleFaceMacFontFamily::ReadOtherFamilyNames( gfxMacPlatformFontList::gfxMacPlatformFontList() : CoreTextFontList() { CheckFamilyList(kBaseFonts); +#ifndef BASE_BROWSER_VERSION CheckFamilyList(kBaseFonts_13_Higher); +#endif // cache this in a static variable so that gfxMacFontFamily objects // don't have to repeatedly look it up @@ -188,10 +190,12 @@ FontVisibility gfxMacPlatformFontList::GetVisibilityForFamily( if (FamilyInList(aName, kBaseFonts)) { return FontVisibility::Base; } +#ifndef BASE_BROWSER_VERSION if (GetFontVisibilityDevice() == Device::MacOS_13_plus && FamilyInList(aName, kBaseFonts_13_Higher)) { return FontVisibility::Base; } +#endif #ifdef MOZ_BUNDLED_FONTS if (mBundledFamilies.Contains(aName)) { return FontVisibility::Base; @@ -206,10 +210,12 @@ gfxMacPlatformFontList::GetFilteredPlatformFontLists() { fontLists.AppendElement(std::make_pair(kBaseFonts, std::size(kBaseFonts))); +#ifndef BASE_BROWSER_VERSION if (GetFontVisibilityDevice() == Device::MacOS_13_plus) { fontLists.AppendElement( std::make_pair(kBaseFonts_13_Higher, std::size(kBaseFonts_13_Higher))); } +#endif return fontLists; } ===================================== toolkit/xre/nsXREDirProvider.cpp ===================================== @@ -742,6 +742,25 @@ void nsXREDirProvider::FinishInitializingUserPrefs() { } } +#ifdef MOZ_WIDGET_GTK +static nsresult SetFontconfigConfigFile(nsCOMPtr<nsIFile> appDir) { + NS_ENSURE_TRUE(appDir, NS_ERROR_NULL_POINTER); + nsCOMPtr<nsIFile> confDir; + nsresult rv = appDir->Clone(getter_AddRefs(confDir)); + NS_ENSURE_SUCCESS(rv, rv); + rv = confDir->AppendNative("fonts"_ns); + NS_ENSURE_SUCCESS(rv, rv); + nsAutoCString confPath; + rv = confDir->GetNativePath(confPath); + NS_ENSURE_SUCCESS(rv, rv); + if (NS_WARN_IF(setenv("FONTCONFIG_PATH", confPath.BeginReading(), 1) != 0 || + setenv("FONTCONFIG_FILE", "fonts.conf", 1) != 0)) { + return NS_ERROR_FAILURE; + } + return NS_OK; +} +#endif + NS_IMETHODIMP nsXREDirProvider::DoStartup() { nsresult rv; @@ -760,6 +779,13 @@ nsXREDirProvider::DoStartup() { */ MOZ_ASSERT(mPrefsInitialized); +#ifdef MOZ_WIDGET_GTK + // FontConfig might be initialized by GTK/Pango, so we need to define its + // config variables before doing anything. + rv = SetFontconfigConfigFile(mGREDir); + NS_ENSURE_SUCCESS(rv, rv); +#endif + bool safeModeNecessary = false; nsCOMPtr<nsIAppStartup> appStartup( mozilla::components::AppStartup::Service()); View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/compare/bd… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/compare/bd… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-128.5.0esr-14.5-1] 2 commits: fixup! Bug 43140: Tighten up fonts on Linux.
by Pier Angelo Vendrame (＠pierov) 16 Dec '24

16 Dec '24

Pier Angelo Vendrame pushed to branch tor-browser-128.5.0esr-14.5-1 at The Tor Project / Applications / Tor Browser Commits: aaf57ee1 by Pier Angelo Vendrame at 2024-12-16T18:52:26+01:00 fixup! Bug 43140: Tighten up fonts on Linux. Bug 43330: Move the previous fix earlier in the startup. - - - - - 5333f638 by Pier Angelo Vendrame at 2024-12-16T18:52:28+01:00 Bug 43322: Customize the font visibility lists. Customize the lists of fonts to assign base visibility to in base browser and derivatives. Also, rename the files with the upstream lists, to make sure we do not use them by mistake. - - - - - 10 changed files: - gfx/thebes/StandardFonts-linux.inc → gfx/thebes/StandardFonts-linux-upstream.inc - + gfx/thebes/StandardFonts-macos-bb.inc - gfx/thebes/StandardFonts-macos.inc → gfx/thebes/StandardFonts-macos-upstream.inc - + gfx/thebes/StandardFonts-win10-bb.inc - gfx/thebes/StandardFonts-win10.inc → gfx/thebes/StandardFonts-win10-upstream.inc - gfx/thebes/gfxDWriteFontList.cpp - gfx/thebes/gfxFcPlatformFontList.cpp - gfx/thebes/gfxGDIFontList.cpp - gfx/thebes/gfxMacPlatformFontList.mm - toolkit/xre/nsXREDirProvider.cpp Changes: ===================================== gfx/thebes/StandardFonts-linux.inc → gfx/thebes/StandardFonts-linux-upstream.inc ===================================== ===================================== gfx/thebes/StandardFonts-macos-bb.inc ===================================== @@ -0,0 +1,33 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +static const char* kBaseFonts[] = { + "Apple Color Emoji", + "AppleGothic", + "Arial", + "Arial Black", + "Arial Narrow", + "Courier", + "Courier New", + "Geneva", + "Georgia", + "Heiti TC", + "Helvetica", + "Helvetica Neue", + "Hiragino Kaku Gothic ProN", + "Kailasa", + "Lucida Grande", + "Menlo", + "Monaco", + "PingFang HK", + "PingFang SC", + "PingFang TC", + "Songti SC", + "Songti TC", + "Tahoma", + "Thonburi", + "Times", + "Times New Roman", + "Verdana", +}; ===================================== gfx/thebes/StandardFonts-macos.inc → gfx/thebes/StandardFonts-macos-upstream.inc ===================================== ===================================== gfx/thebes/StandardFonts-win10-bb.inc ===================================== @@ -0,0 +1,90 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +static const char* kBaseFonts[] = { + "Arial", + "Cambria Math", + "Consolas", + "Courier New", + "Georgia", + "Lucida Console", + "Malgun Gothic", + "Microsoft Himalaya", + "Microsoft JhengHei", + "Microsoft YaHei", + "MS Gothic", + "MS PGothic", + "MV Boli", + "Segoe UI", + "SimSun", + "Sylfaen", + "Tahoma", + "Times New Roman", + "Verdana", +}; + +struct FontSubstitute { + const char* substituteName; + const char* actualFontName; +}; + +static const FontSubstitute kFontSubstitutes[] = { + // Common substitutions + {"Arabic Transparent", "Arial"}, + {"Arabic Transparent Bold", "Arial Bold"}, + {"Arial Baltic", "Arial"}, + {"Arial CE", "Arial"}, + {"Arial CYR", "Arial"}, + {"Arial Greek", "Arial"}, + {"Arial TUR", "Arial"}, + {"Courier New Baltic", "Courier New"}, + {"Courier New CE", "Courier New"}, + {"Courier New CYR", "Courier New"}, + {"Courier New Greek", "Courier New"}, + {"Courier New TUR", "Courier New"}, + {"Helv", "MS Sans Serif"}, + {"Helvetica", "Arial"}, + {"MS Shell Dlg 2", "Tahoma"}, + {"Tahoma Armenian", "Tahoma"}, + {"Times", "Times New Roman"}, + {"Times New Roman Baltic", "Times New Roman"}, + {"Times New Roman CE", "Times New Roman"}, + {"Times New Roman CYR", "Times New Roman"}, + {"Times New Roman Greek", "Times New Roman"}, + {"Times New Roman TUR", "Times New Roman"}, + {"Tms Rmn", "MS Serif"}, + // Common, except Japanese (which uses MS UI Gothic, instead) + {"MS Shell Dlg", "Microsoft Sans Serif"}, + // Arabic + {"Arial (Arabic)", "Arial"}, + {"Courier New (Arabic)", "Courier New"}, + {"Times New Roman (Arabic)", "Times New Roman"}, + // Cyrillic + Greek + {"Courier", "Courier New"}, + // Greek + {"Fixedsys Greek", "Fixedsys"}, + {"MS Serif Greek", "MS Serif"}, + {"MS Sans Serif Greek", "MS Sans Serif"}, + {"Small Fonts Greek", "Small Fonts"}, + {"System Greek", "System"}, + // Hebrew + {"Arial (Hebrew)", "Arial"}, + {"Courier New (Hebrew)", "Courier New"}, + {"David Transparent", "David"}, + {"Fixed Miriam Transparent", "Miriam Fixed"}, + {"Miriam Transparent", "Miriam"}, + {"Rod Transparent", "Rod"}, + {"Times New Roman (Hebrew)", "Times New Roman"}, + // Japanese + {"標準明朝", "ＭＳ明朝"}, + {"標準ゴシック", "ＭＳゴシック"}, + {"ゴシック", "ＭＳゴシック"}, + {"ｺﾞｼｯｸ", "ＭＳゴシック"}, + {"ｸｰﾘｴ", "Courier"}, + {"ﾀｲﾑｽﾞﾛﾏﾝ", "Times New Roman"}, + {"ﾍﾙﾍﾞﾁｶ", "Arial"}, + // Simplified Chinese + {"FangSong_GB2312", "FangSong"}, + {"KaiTi_GB2312", "KaiTi"}, +}; ===================================== gfx/thebes/StandardFonts-win10.inc → gfx/thebes/StandardFonts-win10-upstream.inc ===================================== @@ -200,68 +200,3 @@ static const char* kLangPackFonts[] = { // "Rockwell Nova", // Pan-European Supplemental Fonts - EXCLUDED // "Verdana Pro", // Pan-European Supplemental Fonts - EXCLUDED }; - -struct FontSubstitute { - const char *substituteName; - const char *actualFontName; -}; - -static const FontSubstitute kFontSubstitutes[] = { - // Common substitutions - {"Arabic Transparent", "Arial"}, - {"Arabic Transparent Bold", "Arial Bold"}, - {"Arial Baltic", "Arial"}, - {"Arial CE", "Arial"}, - {"Arial CYR", "Arial"}, - {"Arial Greek", "Arial"}, - {"Arial TUR", "Arial"}, - {"Courier New Baltic", "Courier New"}, - {"Courier New CE", "Courier New"}, - {"Courier New CYR", "Courier New"}, - {"Courier New Greek", "Courier New"}, - {"Courier New TUR", "Courier New"}, - {"Helv", "MS Sans Serif"}, - {"Helvetica", "Arial"}, - {"MS Shell Dlg 2", "Tahoma"}, - {"Tahoma Armenian", "Tahoma"}, - {"Times", "Times New Roman"}, - {"Times New Roman Baltic", "Times New Roman"}, - {"Times New Roman CE", "Times New Roman"}, - {"Times New Roman CYR", "Times New Roman"}, - {"Times New Roman Greek", "Times New Roman"}, - {"Times New Roman TUR", "Times New Roman"}, - {"Tms Rmn", "MS Serif"}, - // Common, except Japanese (which uses MS UI Gothic, instead) - {"MS Shell Dlg", "Microsoft Sans Serif"}, - // Arabic - {"Arial (Arabic)", "Arial"}, - {"Courier New (Arabic)", "Courier New"}, - {"Times New Roman (Arabic)", "Times New Roman"}, - // Cyrillic + Greek - {"Courier", "Courier New"}, - // Greek - {"Fixedsys Greek", "Fixedsys"}, - {"MS Serif Greek", "MS Serif"}, - {"MS Sans Serif Greek", "MS Sans Serif"}, - {"Small Fonts Greek", "Small Fonts"}, - {"System Greek", "System"}, - // Hebrew - {"Arial (Hebrew)", "Arial"}, - {"Courier New (Hebrew)", "Courier New"}, - {"David Transparent", "David"}, - {"Fixed Miriam Transparent", "Miriam Fixed"}, - {"Miriam Transparent", "Miriam"}, - {"Rod Transparent", "Rod"}, - {"Times New Roman (Hebrew)", "Times New Roman"}, - // Japanese - {"標準明朝", "ＭＳ明朝"}, - {"標準ゴシック", "ＭＳゴシック"}, - {"ゴシック", "ＭＳゴシック"}, - {"ｺﾞｼｯｸ", "ＭＳゴシック"}, - {"ｸｰﾘｴ", "Courier"}, - {"ﾀｲﾑｽﾞﾛﾏﾝ", "Times New Roman"}, - {"ﾍﾙﾍﾞﾁｶ", "Arial"}, - // Simplified Chinese - {"FangSong_GB2312", "FangSong"}, - {"KaiTi_GB2312", "KaiTi"}, -}; ===================================== gfx/thebes/gfxDWriteFontList.cpp ===================================== @@ -32,7 +32,7 @@ #include "harfbuzz/hb.h" -#include "StandardFonts-win10.inc" +#include "StandardFonts-win10-bb.inc" using namespace mozilla; using namespace mozilla::gfx; @@ -910,7 +910,9 @@ void gfxDWriteFontEntry::AddSizeOfIncludingThis(MallocSizeOf aMallocSizeOf, gfxDWriteFontList::gfxDWriteFontList() : mForceGDIClassicMaxFontSize(0.0) { CheckFamilyList(kBaseFonts); +#ifndef BASE_BROWSER_VERSION CheckFamilyList(kLangPackFonts); +#endif } // bug 602792 - CJK systems default to large CJK fonts which cause excessive @@ -1153,9 +1155,11 @@ FontVisibility gfxDWriteFontList::GetVisibilityForFamily( if (FamilyInList(aName, kBaseFonts)) { return FontVisibility::Base; } +#ifndef BASE_BROWSER_VERSION if (FamilyInList(aName, kLangPackFonts)) { return FontVisibility::LangPack; } +#endif return FontVisibility::User; } @@ -1164,8 +1168,10 @@ gfxDWriteFontList::GetFilteredPlatformFontLists() { nsTArray<std::pair<const char**, uint32_t>> fontLists; fontLists.AppendElement(std::make_pair(kBaseFonts, ArrayLength(kBaseFonts))); +#ifndef BASE_BROWSER_VERSION fontLists.AppendElement( std::make_pair(kLangPackFonts, ArrayLength(kLangPackFonts))); +#endif return fontLists; } ===================================== gfx/thebes/gfxFcPlatformFontList.cpp ===================================== @@ -32,7 +32,9 @@ #include "nsCharSeparatedTokenizer.h" #include "nsXULAppAPI.h" #include "SharedFontList-impl.h" -#include "StandardFonts-linux.inc" +#ifndef BASE_BROWSER_VERSION +# include "StandardFonts-linux.inc" +#endif #include "mozilla/intl/Locale.h" #include "mozilla/gfx/HelpersCairo.h" @@ -1352,45 +1354,20 @@ bool gfxFontconfigFont::ShouldHintMetrics() const { return !GetStyle()->printerFont; } -static nsresult SetFontconfigConfigFile() { - nsCOMPtr<nsIProperties> dirSvc( - do_GetService("@mozilla.org/file/directory_service;1")); - NS_ENSURE_TRUE(dirSvc, NS_ERROR_NOT_AVAILABLE); - nsCOMPtr<nsIFile> appFile, confDir; - nsresult rv = dirSvc->Get(XRE_EXECUTABLE_FILE, NS_GET_IID(nsIFile), - getter_AddRefs(appFile)); - NS_ENSURE_SUCCESS(rv, rv); - rv = appFile->GetParent(getter_AddRefs(confDir)); - NS_ENSURE_SUCCESS(rv, rv); - rv = confDir->AppendNative("fonts"_ns); - NS_ENSURE_SUCCESS(rv, rv); - - nsAutoCString confPath; - rv = confDir->GetNativePath(confPath); - NS_ENSURE_SUCCESS(rv, rv); - if (NS_WARN_IF(setenv("FONTCONFIG_PATH", confPath.BeginReading(), 1) != 0 || - setenv("FONTCONFIG_FILE", "fonts.conf", 1) != 0)) { - return NS_ERROR_FAILURE; - } - return NS_OK; -} - gfxFcPlatformFontList::gfxFcPlatformFontList() : mLocalNames(64), mGenericMappings(32), mFcSubstituteCache(64), mLastConfig(nullptr), mAlwaysUseFontconfigGenerics(true) { - if (NS_FAILED(SetFontconfigConfigFile())) { - NS_WARNING("Failed to set the fontconfig config file!"); - } - +#ifndef BASE_BROWSER_VERSION CheckFamilyList(kBaseFonts_Ubuntu_22_04); CheckFamilyList(kLangFonts_Ubuntu_22_04); CheckFamilyList(kBaseFonts_Ubuntu_20_04); CheckFamilyList(kLangFonts_Ubuntu_20_04); CheckFamilyList(kBaseFonts_Fedora_39); CheckFamilyList(kBaseFonts_Fedora_38); +#endif mLastConfig = FcConfigGetCurrent(); if (XRE_IsParentProcess()) { // if the rescan interval is set, start the timer @@ -1704,11 +1681,14 @@ using Device = nsIGfxInfo::FontVisibilityDeviceDetermination; static Device sFontVisibilityDevice = Device::Unassigned; void AssignFontVisibilityDevice() { + sFontVisibilityDevice = Device::Linux_Unknown; +#ifndef BASE_BROWSER_VERSION if (sFontVisibilityDevice == Device::Unassigned) { nsCOMPtr<nsIGfxInfo> gfxInfo = components::GfxInfo::Service(); NS_ENSURE_SUCCESS_VOID( gfxInfo->GetFontVisibilityDetermination(&sFontVisibilityDevice)); } +#endif } // Per family array of faces. @@ -2029,6 +2009,7 @@ FontVisibility gfxFcPlatformFontList::GetVisibilityForFamily( AssignFontVisibilityDevice(); switch (sFontVisibilityDevice) { +#ifndef BASE_BROWSER_VERSION case Device::Linux_Ubuntu_any: case Device::Linux_Ubuntu_22: if (FamilyInList(aName, kBaseFonts_Ubuntu_22_04)) { @@ -2068,7 +2049,7 @@ FontVisibility gfxFcPlatformFontList::GetVisibilityForFamily( return FontVisibility::Base; } return FontVisibility::User; - +#endif default: // We don't know how to categorize fonts on this system return FontVisibility::Unknown; @@ -2081,6 +2062,7 @@ gfxFcPlatformFontList::GetFilteredPlatformFontLists() { nsTArray<std::pair<const char**, uint32_t>> fontLists; +#ifndef BASE_BROWSER_VERSION switch (sFontVisibilityDevice) { case Device::Linux_Ubuntu_any: case Device::Linux_Ubuntu_22: @@ -2114,6 +2096,7 @@ gfxFcPlatformFontList::GetFilteredPlatformFontLists() { // We don't know how to categorize fonts on this system break; } +#endif return fontLists; } ===================================== gfx/thebes/gfxGDIFontList.cpp ===================================== @@ -33,7 +33,7 @@ #include "nsContentUtils.h" -#include "StandardFonts-win10.inc" +#include "StandardFonts-win10-bb.inc" #include <usp10.h> ===================================== gfx/thebes/gfxMacPlatformFontList.mm ===================================== @@ -46,7 +46,7 @@ #include <time.h> #include <dlfcn.h> -#include "StandardFonts-macos.inc" +#include "StandardFonts-macos-bb.inc" using namespace mozilla; using namespace mozilla::gfx; @@ -153,7 +153,9 @@ void gfxSingleFaceMacFontFamily::ReadOtherFamilyNames( gfxMacPlatformFontList::gfxMacPlatformFontList() : CoreTextFontList() { CheckFamilyList(kBaseFonts); +#ifndef BASE_BROWSER_VERSION CheckFamilyList(kBaseFonts_13_Higher); +#endif // cache this in a static variable so that gfxMacFontFamily objects // don't have to repeatedly look it up @@ -188,10 +190,12 @@ FontVisibility gfxMacPlatformFontList::GetVisibilityForFamily( if (FamilyInList(aName, kBaseFonts)) { return FontVisibility::Base; } +#ifndef BASE_BROWSER_VERSION if (GetFontVisibilityDevice() == Device::MacOS_13_plus && FamilyInList(aName, kBaseFonts_13_Higher)) { return FontVisibility::Base; } +#endif #ifdef MOZ_BUNDLED_FONTS if (mBundledFamilies.Contains(aName)) { return FontVisibility::Base; @@ -206,10 +210,12 @@ gfxMacPlatformFontList::GetFilteredPlatformFontLists() { fontLists.AppendElement(std::make_pair(kBaseFonts, std::size(kBaseFonts))); +#ifndef BASE_BROWSER_VERSION if (GetFontVisibilityDevice() == Device::MacOS_13_plus) { fontLists.AppendElement( std::make_pair(kBaseFonts_13_Higher, std::size(kBaseFonts_13_Higher))); } +#endif return fontLists; } ===================================== toolkit/xre/nsXREDirProvider.cpp ===================================== @@ -744,6 +744,25 @@ void nsXREDirProvider::FinishInitializingUserPrefs() { } } +#ifdef MOZ_WIDGET_GTK +static nsresult SetFontconfigConfigFile(nsCOMPtr<nsIFile> appDir) { + NS_ENSURE_TRUE(appDir, NS_ERROR_NULL_POINTER); + nsCOMPtr<nsIFile> confDir; + nsresult rv = appDir->Clone(getter_AddRefs(confDir)); + NS_ENSURE_SUCCESS(rv, rv); + rv = confDir->AppendNative("fonts"_ns); + NS_ENSURE_SUCCESS(rv, rv); + nsAutoCString confPath; + rv = confDir->GetNativePath(confPath); + NS_ENSURE_SUCCESS(rv, rv); + if (NS_WARN_IF(setenv("FONTCONFIG_PATH", confPath.BeginReading(), 1) != 0 || + setenv("FONTCONFIG_FILE", "fonts.conf", 1) != 0)) { + return NS_ERROR_FAILURE; + } + return NS_OK; +} +#endif + NS_IMETHODIMP nsXREDirProvider::DoStartup() { nsresult rv; @@ -762,6 +781,13 @@ nsXREDirProvider::DoStartup() { */ MOZ_ASSERT(mPrefsInitialized); +#ifdef MOZ_WIDGET_GTK + // FontConfig might be initialized by GTK/Pango, so we need to define its + // config variables before doing anything. + rv = SetFontconfigConfigFile(mGREDir); + NS_ENSURE_SUCCESS(rv, rv); +#endif + bool safeModeNecessary = false; nsCOMPtr<nsIAppStartup> appStartup( mozilla::components::AppStartup::Service()); View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/7f8c1d… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/7f8c1d… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-128.5.0esr-14.5-1] fixup! Firefox preference overrides.
by Pier Angelo Vendrame (＠pierov) 16 Dec '24

16 Dec '24

Pier Angelo Vendrame pushed to branch mullvad-browser-128.5.0esr-14.5-1 at The Tor Project / Applications / Mullvad Browser Commits: bd3fbfef by Pier Angelo Vendrame at 2024-12-16T18:25:32+01:00 fixup! Firefox preference overrides. BB 43366: Do not use system accent color in inputs. We did not manage to write a reliable proof of concept for fingerprinting this, but I managed to get the color once (with Firefox on Android, which is the worse case, as the system offers to use colors from the wallpaper). - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -463,6 +463,9 @@ pref("pdfjs.disabled", false, locked); #endif // Bug 40057: Ensure system colors are not used for CSS4 colors pref("browser.display.use_system_colors", false); +// tor-browser#43366: do not use system accent color in inputs. +// See also https://bugzilla.mozilla.org/show_bug.cgi?id=1861362. +pref("widget.non-native-theme.use-theme-accent", false); // tor-browser#41943: defense-in-depth, but do not lock anymore (enabled in Firefox 119, http://bugzil.la/1851162) pref("javascript.options.spectre.disable_for_isolated_content", false); View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/bd3… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/bd3… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][base-browser-128.5.0esr-14.5-1] fixup! Firefox preference overrides.
by Pier Angelo Vendrame (＠pierov) 16 Dec '24

16 Dec '24

Pier Angelo Vendrame pushed to branch base-browser-128.5.0esr-14.5-1 at The Tor Project / Applications / Tor Browser Commits: fa621bc7 by Pier Angelo Vendrame at 2024-12-16T18:23:54+01:00 fixup! Firefox preference overrides. BB 43366: Do not use system accent color in inputs. We did not manage to write a reliable proof of concept for fingerprinting this, but I managed to get the color once (with Firefox on Android, which is the worse case, as the system offers to use colors from the wallpaper). - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -463,6 +463,9 @@ pref("pdfjs.disabled", false, locked); #endif // Bug 40057: Ensure system colors are not used for CSS4 colors pref("browser.display.use_system_colors", false); +// tor-browser#43366: do not use system accent color in inputs. +// See also https://bugzilla.mozilla.org/show_bug.cgi?id=1861362. +pref("widget.non-native-theme.use-theme-accent", false); // tor-browser#41943: defense-in-depth, but do not lock anymore (enabled in Firefox 119, http://bugzil.la/1851162) pref("javascript.options.spectre.disable_for_isolated_content", false); View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/fa621bc… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/fa621bc… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-128.5.0esr-14.5-1] fixup! Firefox preference overrides.
by Pier Angelo Vendrame (＠pierov) 16 Dec '24

16 Dec '24

Pier Angelo Vendrame pushed to branch tor-browser-128.5.0esr-14.5-1 at The Tor Project / Applications / Tor Browser Commits: 7f8c1d43 by Pier Angelo Vendrame at 2024-12-16T18:18:53+01:00 fixup! Firefox preference overrides. BB 43366: Do not use system accent color in inputs. We did not manage to write a reliable proof of concept for fingerprinting this, but I managed to get the color once (with Firefox on Android, which is the worse case, as the system offers to use colors from the wallpaper). - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -463,6 +463,9 @@ pref("pdfjs.disabled", false, locked); #endif // Bug 40057: Ensure system colors are not used for CSS4 colors pref("browser.display.use_system_colors", false); +// tor-browser#43366: do not use system accent color in inputs. +// See also https://bugzilla.mozilla.org/show_bug.cgi?id=1861362. +pref("widget.non-native-theme.use-theme-accent", false); // tor-browser#41943: defense-in-depth, but do not lock anymore (enabled in Firefox 119, http://bugzil.la/1851162) pref("javascript.options.spectre.disable_for_isolated_content", false); View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/7f8c1d4… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/7f8c1d4… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-128.5.0esr-14.5-1] fixup! Bug 40701: Add security warning when downloading a file
by morgan (＠morgan) 16 Dec '24

16 Dec '24

morgan pushed to branch tor-browser-128.5.0esr-14.5-1 at The Tor Project / Applications / Tor Browser Commits: 00d7026f by Henry Wilkes at 2024-12-16T11:27:38+00:00 fixup! Bug 40701: Add security warning when downloading a file Bug 43312: Ensure download panel warning uses the same width as the mozilla downloads list. We stop setting a `width` on the download panel because this can conflict with the default width set for the mozilla downloads list, set by localisers. Instead, we use the same width for our Tor Browser warning message using a wrapper element. We also ensure that the wrapper element has `min-width: 100%` for scenarios where the localiser width is less than the min-width of the ancestor panel. - - - - - 2 changed files: - browser/components/downloads/content/downloads.css - browser/components/downloads/content/downloadsPanel.inc.xhtml Changes: ===================================== browser/components/downloads/content/downloads.css ===================================== @@ -92,15 +92,19 @@ #downloadsPanel-mainView { min-width: 37em; padding: 0.62em; - /* If we don't set a width, #downloadsPanelTorWarning will request - * its max-content width. */ - width: 37em; } #downloadsPanelTorWarning { margin-block-end: var(--arrowpanel-menuitem-padding-block); } +#downloadsPanelTorWarningWrapper { + /* The wrapper element has its `width` attribute set by mozilla localisers. + * We want to ensure the element occupies the available width when the + * localiser width is smaller. See tor-browser#43312. */ + min-width: 100%; +} + #downloadsHistory, #downloadsFooterButtons { margin: 0; ===================================== browser/components/downloads/content/downloadsPanel.inc.xhtml ===================================== @@ -104,8 +104,25 @@ disablekeynav="true"> <panelview id="downloadsPanel-mainView"> - <html:moz-message-bar id="downloadsPanelTorWarning"> - </html:moz-message-bar> +  + <html:div + id="downloadsPanelTorWarningWrapper" + data-l10n-id="downloads-panel-items" + data-l10n-attrs="style" + > + <html:moz-message-bar id="downloadsPanelTorWarning"> + </html:moz-message-bar> + </html:div> <vbox class="panel-view-body-unscrollable"> <richlistbox id="downloadsListBox" data-l10n-id="downloads-panel-items" View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/00d7026… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/00d7026… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][maint-14.0] Bug 41311: Remove apparmor profile if abi 4.0 is not present
by morgan (＠morgan) 16 Dec '24

16 Dec '24

morgan pushed to branch maint-14.0 at The Tor Project / Applications / tor-browser-build Commits: 36c06687 by Nicolas Vigier at 2024-12-16T12:54:30+00:00 Bug 41311: Remove apparmor profile if abi 4.0 is not present When abi 4.0 file not available, loading the apparmor profile is failing. But the profile is only useful on Ubuntu 24.04 (and later), where the abi 4.0 file is present. We're doing something similar to: https://github.com/CollaboraOnline/online/commit/5f7b37c7412c3e1d81d9c50a0f… - - - - - 2 changed files: - projects/linux-packages/config - + projects/linux-packages/debian/postinst.in Changes: ===================================== projects/linux-packages/config ===================================== @@ -171,6 +171,10 @@ input_files: content: "[% INCLUDE 'debian/docs.in' %]" refresh_input: 1 enable: '[% c("var/build_deb_pkg") %]' + - filename: debian/postinst + content: "[% INCLUDE 'debian/postinst.in' %]" + refresh_input: 1 + enable: '[% c("var/build_deb_pkg") %]' - filename: debian/rules content: "[% INCLUDE 'debian/rules.in' %]" refresh_input: 1 ===================================== projects/linux-packages/debian/postinst.in ===================================== @@ -0,0 +1,12 @@ +#!/bin/sh + +set -e + +case "$1" in + install|upgrade|configure) + # If abi 4.0 is not present, then remove the apparmor profile config + if [ ! -e /etc/apparmor.d/abi/4.0 ]; then + rm -f /etc/apparmor.d/[% c("var/system_pkg/pkg_name") %] + fi + ;; +esac View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/3… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/3… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41311: Remove apparmor profile if abi 4.0 is not present
by morgan (＠morgan) 16 Dec '24

16 Dec '24

morgan pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: ee82c7f8 by Nicolas Vigier at 2024-12-12T12:13:31+01:00 Bug 41311: Remove apparmor profile if abi 4.0 is not present When abi 4.0 file not available, loading the apparmor profile is failing. But the profile is only useful on Ubuntu 24.04 (and later), where the abi 4.0 file is present. We're doing something similar to: https://github.com/CollaboraOnline/online/commit/5f7b37c7412c3e1d81d9c50a0f… - - - - - 2 changed files: - projects/linux-packages/config - + projects/linux-packages/debian/postinst.in Changes: ===================================== projects/linux-packages/config ===================================== @@ -201,6 +201,10 @@ input_files: content: "[% INCLUDE 'debian/docs.in' %]" refresh_input: 1 enable: '[% c("var/build_deb_pkg") %]' + - filename: debian/postinst + content: "[% INCLUDE 'debian/postinst.in' %]" + refresh_input: 1 + enable: '[% c("var/build_deb_pkg") %]' - filename: debian/rules content: "[% INCLUDE 'debian/rules.in' %]" refresh_input: 1 ===================================== projects/linux-packages/debian/postinst.in ===================================== @@ -0,0 +1,12 @@ +#!/bin/sh + +set -e + +case "$1" in + install|upgrade|configure) + # If abi 4.0 is not present, then remove the apparmor profile config + if [ ! -e /etc/apparmor.d/abi/4.0 ]; then + rm -f /etc/apparmor.d/[% c("var/system_pkg/pkg_name") %] + fi + ;; +esac View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/e… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/e… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41317: Add the linux-aarch64 target to linux-packages
by boklm (＠boklm) 14 Dec '24

14 Dec '24

boklm pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 4c9640b6 by NoisyCoil at 2024-12-12T12:03:29+01:00 Bug 41317: Add the linux-aarch64 target to linux-packages Also fixing #41335 (linux-package project is not getting the channel target in testbuilds). Co-authored-by: Nicolas Vigier <boklm(a)torproject.org> - - - - - 6 changed files: - projects/linux-packages/build - projects/linux-packages/config - projects/linux-packages/debian/control.in - projects/linux-packages/rpm-package.spec - projects/release/build - projects/release/config Changes: ===================================== projects/linux-packages/build ===================================== @@ -57,6 +57,11 @@ umask 0022 $rootdir/[% c('input_files_by_name/linux-i686') %]/[% c("var/project-name") %]-linux-i686-[% c("version") %].tar.xz \ i386 [% END -%] + [% IF c("var/browser-linux-aarch64") -%] + extract_src_tar \ + $rootdir/[% c('input_files_by_name/linux-aarch64') %]/[% c("var/project-name") %]-linux-aarch64-[% c("version") %].tar.xz \ + arm64 + [% END -%] dpkg-buildpackage --unsigned-source --unsigned-changes --build=source [% FOREACH deb_arch = c("var_p/system_pkg/deb_archs") -%] @@ -92,6 +97,10 @@ EOF cp -a $rootdir/[% c('input_files_by_name/linux-i686') %]/[% c("var/project-name") %]-linux-i686-[% c("version") %].tar.xz \ SOURCES/[% c("var/system_pkg/pkg_name") %]-linux-i386-[% c("var/system_pkg/pkg_version") %].tar.xz [% END -%] + [% IF c("var/browser-linux-aarch64") -%] + cp -a $rootdir/[% c('input_files_by_name/linux-aarch64') %]/[% c("var/project-name") %]-linux-aarch64-[% c("version") %].tar.xz \ + SOURCES/[% c("var/system_pkg/pkg_name") %]-linux-aarch64-[% c("var/system_pkg/pkg_version") %].tar.xz + [% END -%] rpmdir=$(pwd) [% IF c("var/browser-linux-x86_64") -%] rpmbuild --define "_topdir $rpmdir" -v -bb SPECS/[% c("var/system_pkg/pkg_name") %].spec @@ -99,6 +108,9 @@ EOF [% IF c("var/browser-linux-i686") -%] rpmbuild --define "_topdir $rpmdir" --target i686-redhat-linux -v -bb SPECS/[% c("var/system_pkg/pkg_name") %].spec [% END -%] + [% IF c("var/browser-linux-aarch64") -%] + rpmbuild --define "_topdir $rpmdir" --target aarch64-redhat-linux -v -bb SPECS/[% c("var/system_pkg/pkg_name") %].spec + [% END -%] mv RPMS/*/*.rpm "$OUTDIR/" [% END %] ===================================== projects/linux-packages/config ===================================== @@ -19,6 +19,7 @@ var: deb_archs_list: - '[% IF c("var/browser-linux-x86_64") %]amd64[% END %]' - '[% IF c("var/browser-linux-i686") %]i386[% END %]' + - '[% IF c("var/browser-linux-aarch64") %]arm64[% END %]' targets: @@ -28,7 +29,7 @@ targets: build_deb_pkg: 1 pre_pkginst: | dpkg --add-architecture i386 - # some :i386 packages fail to install when /var/lib/dpkg/available + # some foreign-arch packages fail to install when /var/lib/dpkg/available # does not exist, so create it as an empty file echo > /var/lib/dpkg/available arch_deps: @@ -58,6 +59,31 @@ targets: - libpulse-dev:i386 - libx11-xcb-dev:i386 - libxt-dev:i386 + deb-arm64: + var: + build_deb_pkg: 1 + pre_pkginst: | + dpkg --add-architecture arm64 + # some foreign-arch packages fail to install when /var/lib/dpkg/available + # does not exist, so create it as an empty file + echo > /var/lib/dpkg/available + arch_deps: + # Packages needed to build the deb package + - dpkg-dev + - debhelper + - dh-exec + - dh-apparmor + # Packages needed to generate dependencies for the deb package + - linux-libc-dev:arm64 + - libasound2-dev:arm64 + - libfontconfig1-dev:arm64 + - libfreetype6-dev:arm64 + - libgconf2-dev:arm64 + - libgtk-3-dev:arm64 + - libpango1.0-dev:arm64 + - libpulse-dev:arm64 + - libx11-xcb-dev:arm64 + - libxt-dev:arm64 rpm: var: @@ -72,18 +98,15 @@ targets: container: suite: bookworm - browser-all: - - browser-linux-x86_64 - - browser-linux-i686 - - browser-all-desktop: browser-all - browser-linux-x86_64: var: browser-linux-x86_64: 1 browser-linux-i686: var: browser-linux-i686: '[% c("var/browser_type") != "mullvadbrowser" %]' + browser-linux-aarch64: + var: + browser-linux-aarch64: 1 torbrowser: var: @@ -139,6 +162,13 @@ input_files: - '[% c("var/build_target") %]' - '[% c("var/browser_type") %]-linux-i686' + - name: linux-aarch64 + project: browser + enable: '[% c("var/browser-linux-aarch64") %]' + target: + - '[% c("var/build_target") %]' + - '[% c("var/browser_type") %]-linux-aarch64' + - filename: Makefile content: "[% INCLUDE 'Makefile.in' %]" refresh_input: 1 ===================================== projects/linux-packages/debian/control.in ===================================== @@ -5,7 +5,7 @@ Section: web Build-Depends: debhelper (>= 9), dh-apparmor Package: [% c("var/system_pkg/pkg_name") %] -Architecture: [% c("var_p/system_pkg/deb_archs").join(" ") %] +Architecture: amd64 i386 arm64 Depends: ${shlibs:Depends}, Description: [% c('var/display_name') %] [% c("var/system_pkg/pkg_description") %] ===================================== projects/linux-packages/rpm-package.spec ===================================== @@ -21,6 +21,7 @@ %global privlibs %{privlibs}|libxul %global __provides_exclude ^(%{privlibs})\\.so %global __requires_exclude ^(%{privlibs})\\.so +%global __strip true Summary: [% c("var/display_name") %] Name: [% c("var/system_pkg/pkg_name") %] @@ -36,6 +37,9 @@ Source2: %{name}-linux-x86_64-%{version}.tar.xz [% IF c("var/browser-linux-i686") -%] Source3: %{name}-linux-i386-%{version}.tar.xz [% END -%] +[% IF c("var/browser-linux-aarch64") -%] +Source4: %{name}-linux-aarch64-%{version}.tar.xz +[% END -%] %description [% c("var/system_pkg/pkg_description") %] ===================================== projects/release/build ===================================== @@ -40,8 +40,13 @@ mkdir -p "$destdir" [% IF c("var/browser-linux-aarch64") -%] mv [% c('input_files_by_name/linux-aarch64') %]/* "$destdir"/ [% END -%] -[% IF c("var/linux-packages") -%] - mv [% c('input_files_by_name/deb-packages') %]/* "$destdir"/ +[% IF c("var/linux-packages") || c("var/linux-packages-aarch64") -%] + [% IF c("var/linux-packages") -%] + mv [% c('input_files_by_name/deb-packages') %]/* "$destdir"/ + [% END -%] + [% IF c("var/linux-packages-aarch64") -%] + mv [% c('input_files_by_name/deb-packages-aarch64') %]/* "$destdir"/ + [% END -%] mv [% c('input_files_by_name/rpm-packages') %]/* "$destdir"/ [% END -%] [% IF c("var/browser-src") -%] ===================================== projects/release/config ===================================== @@ -63,7 +63,7 @@ targets: browser-linux-aarch64: var: browser-linux-aarch64: '[% ! c("var/browser-all-target") || c("var/testbuild") || c("var/nightly") %]' - linux-packages: 0 + linux-packages-aarch64: '[% (! c("var/browser-all-target") || c("var/testbuild") || c("var/nightly")) && (c("var/mullvad-browser") || c("var/tor-browser-linux-packages")) %]' browser-windows-i686: var: browser-windows-i686: '[% c("var/browser_type") != "mullvadbrowser" %]' @@ -210,20 +210,40 @@ input_files: - name: deb-packages project: linux-packages enable: '[% c("var/linux-packages") %]' - # Add linux-x86_64 targets for container config - target_prepend: + # Add $browser_type-linux-x86_64 target for container config + target: + - '[% IF c("var/testbuild") %]testbuild[% END %]' + - '[% c("var/build_target") %]' + - '[% IF c("var/browser-linux-i686") %]browser-linux-i686[% END %]' + - '[% IF c("var/browser-linux-x86_64") %]browser-linux-x86_64[% END %]' - deb - - linux-x86_64 - - linux + - '[% c("var/browser_type") %]-linux-x86_64' + + # linux-aarch64 requires a separate container because of multi-arch + # conflicts between amd64 and arm64 + - name: deb-packages-aarch64 + project: linux-packages + enable: '[% c("var/linux-packages-aarch64") %]' + # Add $browser_type-linux-x86_64 target for container config + target: + - '[% IF c("var/testbuild") %]testbuild[% END %]' + - '[% c("var/build_target") %]' + - browser-linux-aarch64 + - deb-arm64 + - '[% c("var/browser_type") %]-linux-x86_64' - name: rpm-packages project: linux-packages - enable: '[% c("var/linux-packages") %]' - # Add linux-x86_64 targets for container config - target_prepend: + enable: '[% c("var/linux-packages") || c("var/linux-packages-aarch64") %]' + # Add $browser_type-linux-x86_64 target for container config + target: + - '[% IF c("var/testbuild") %]testbuild[% END %]' + - '[% c("var/build_target") %]' + - '[% IF c("var/browser-linux-i686") %]browser-linux-i686[% END %]' + - '[% IF c("var/browser-linux-x86_64") %]browser-linux-x86_64[% END %]' + - '[% IF c("var/linux-packages-aarch64") %]browser-linux-aarch64[% END %]' - rpm - - linux-x86_64 - - linux + - '[% c("var/browser_type") %]-linux-x86_64' - name: windows-i686 project: browser View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/4… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/4… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-128.5.0esr-14.5-1] 4 commits: fixup! Add CI for Base Browser
by Pier Angelo Vendrame (＠pierov) 12 Dec '24

12 Dec '24

Pier Angelo Vendrame pushed to branch tor-browser-128.5.0esr-14.5-1 at The Tor Project / Applications / Tor Browser Commits: 67cfb4f1 by Beatriz Rizental at 2024-12-11T20:00:05+01:00 fixup! Add CI for Base Browser Small refactor of file organization. - - - - - 94bb2ef1 by Beatriz Rizental at 2024-12-11T20:00:06+01:00 fixup! Add CI for Tor Browser Small refactor of file organization. - - - - - 19a0c991 by Beatriz Rizental at 2024-12-12T05:00:14+01:00 fixup! Add CI for Tor Browser Multi-platform startup test for nightly builds. This commit is desktop only. - - - - - 7dc11c34 by Beatriz Rizental at 2024-12-12T05:00:15+01:00 fixup! Add CI for Tor Browser Disable Windows and MacOS startup tests. These can only be enabled once we have Windows and MacOS runners available. Relates to: https://gitlab.torproject.org/tpo/tpa/team/-/issues/41829 - - - - - 11 changed files: - .gitlab-ci.yml - .gitlab/ci/scripts/helpers.py → .gitlab/ci/jobs/lint/helpers.py - .gitlab/ci/lint.yml → .gitlab/ci/jobs/lint/lint.yml - + .gitlab/ci/jobs/startup-test/startup-test.py - + .gitlab/ci/jobs/startup-test/startup-test.yml - .gitlab/ci/update-containers.yml → .gitlab/ci/jobs/update-containers.yml - .gitlab/ci/update-translations.yml → .gitlab/ci/jobs/update-translations.yml - + .gitlab/ci/mixins.yml - testing/mozbase/mozinstall/mozinstall/mozinstall.py - testing/mozbase/setup_development.py - testing/mozharness/scripts/does_it_crash.py Changes: ===================================== .gitlab-ci.yml ===================================== @@ -1,6 +1,7 @@ stages: - update-container-images - lint + - startup-test - update-translations variables: @@ -8,6 +9,8 @@ variables: LOCAL_REPO_PATH: /srv/apps-repos/tor-browser.git include: - - local: '.gitlab/ci/lint.yml' - - local: '.gitlab/ci/update-containers.yml' - - local: '.gitlab/ci/update-translations.yml' + - local: '.gitlab/ci/mixins.yml' + - local: '.gitlab/ci/jobs/lint/lint.yml' + - local: '.gitlab/ci/jobs/startup-test/startup-test.yml' + - local: '.gitlab/ci/jobs/update-containers.yml' + - local: '.gitlab/ci/jobs/update-translations.yml' ===================================== .gitlab/ci/scripts/helpers.py → .gitlab/ci/jobs/lint/helpers.py ===================================== ===================================== .gitlab/ci/lint.yml → .gitlab/ci/jobs/lint/lint.yml ===================================== @@ -1,11 +1,10 @@ .base: + extends: .with-local-repo-bash stage: lint image: $IMAGE_PATH interruptible: true variables: MOZBUILD_STATE_PATH: "$CI_PROJECT_DIR/.cache/mozbuild" - # A copy of the repository already is available in the runner. - GIT_STRATEGY: "none" cache: paths: - node_modules @@ -17,24 +16,11 @@ tags: # Run these jobs in the browser dedicated runners. - firefox - before_script: - - git init - - git remote add local "$LOCAL_REPO_PATH" - - git fetch --depth 500 local - - git remote add origin "$CI_REPOSITORY_URL" - - | - if [ -z "${CI_COMMIT_BRANCH:-$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME}" ]; then - echo "No branch specified. Stopping the pipeline." - exit 1 - fi - - echo "Fetching from remote branch ${CI_COMMIT_BRANCH:-$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME}" - - git fetch origin "${CI_COMMIT_BRANCH:-$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME}" - - git checkout origin/${CI_COMMIT_BRANCH:-$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME} eslint: extends: .base script: - - .gitlab/ci/scripts/helpers.py --get-changed-files | xargs -d '\n' ./mach lint -l eslint + - .gitlab/ci/jobs/lint/helpers.py --get-changed-files | xargs -d '\n' ./mach lint -l eslint rules: - if: $CI_PIPELINE_SOURCE == 'merge_request_event' changes: @@ -63,7 +49,7 @@ eslint: stylelint: extends: .base script: - - .gitlab/ci/scripts/helpers.py --get-changed-files | xargs -d '\n' ./mach lint -l stylelint + - .gitlab/ci/jobs/lint/helpers.py --get-changed-files | xargs -d '\n' ./mach lint -l stylelint rules: - if: $CI_PIPELINE_SOURCE == 'merge_request_event' changes: @@ -81,7 +67,7 @@ stylelint: py-black: extends: .base script: - - .gitlab/ci/scripts/helpers.py --get-changed-files | xargs -d '\n' ./mach lint -l black + - .gitlab/ci/jobs/lint/helpers.py --get-changed-files | xargs -d '\n' ./mach lint -l black rules: - if: $CI_PIPELINE_SOURCE == 'merge_request_event' changes: @@ -100,7 +86,7 @@ py-black: py-ruff: extends: .base script: - - .gitlab/ci/scripts/helpers.py --get-changed-files | xargs -d '\n' ./mach lint -l ruff + - .gitlab/ci/jobs/lint/helpers.py --get-changed-files | xargs -d '\n' ./mach lint -l ruff rules: - if: $CI_PIPELINE_SOURCE == 'merge_request_event' changes: @@ -119,7 +105,7 @@ py-ruff: yaml: extends: .base script: - - .gitlab/ci/scripts/helpers.py --get-changed-files | xargs -d '\n' ./mach lint -l yaml + - .gitlab/ci/jobs/lint/helpers.py --get-changed-files | xargs -d '\n' ./mach lint -l yaml rules: - if: $CI_PIPELINE_SOURCE == 'merge_request_event' changes: @@ -134,7 +120,7 @@ yaml: shellcheck: extends: .base script: - - .gitlab/ci/scripts/helpers.py --get-changed-files | xargs -d '\n' ./mach lint -l shellcheck + - .gitlab/ci/jobs/lint/helpers.py --get-changed-files | xargs -d '\n' ./mach lint -l shellcheck rules: - if: $CI_PIPELINE_SOURCE == 'merge_request_event' changes: @@ -149,7 +135,7 @@ clang-format: extends: .base script: - ./mach configure --without-wasm-sandboxed-libraries --with-base-browser-version=0.0.0 - - .gitlab/ci/scripts/helpers.py --get-changed-files | xargs -d '\n' ./mach lint -l clang-format + - .gitlab/ci/jobs/lint/helpers.py --get-changed-files | xargs -d '\n' ./mach lint -l clang-format rules: - if: $CI_PIPELINE_SOURCE == 'merge_request_event' changes: @@ -168,7 +154,7 @@ clang-format: rustfmt: extends: .base script: - - .gitlab/ci/scripts/helpers.py --get-changed-files | xargs -d '\n' ./mach lint -l rustfmt + - .gitlab/ci/jobs/lint/helpers.py --get-changed-files | xargs -d '\n' ./mach lint -l rustfmt rules: - if: $CI_PIPELINE_SOURCE == 'merge_request_event' changes: @@ -182,7 +168,7 @@ rustfmt: fluent-lint: extends: .base script: - - .gitlab/ci/scripts/helpers.py --get-changed-files | xargs -d '\n' ./mach lint -l fluent-lint + - .gitlab/ci/jobs/lint/helpers.py --get-changed-files | xargs -d '\n' ./mach lint -l fluent-lint rules: - if: $CI_PIPELINE_SOURCE == 'merge_request_event' changes: @@ -197,7 +183,7 @@ fluent-lint: localization: extends: .base script: - - .gitlab/ci/scripts/helpers.py --get-changed-files | xargs -d '\n' ./mach lint -l l10n + - .gitlab/ci/jobs/lint/helpers.py --get-changed-files | xargs -d '\n' ./mach lint -l l10n rules: - if: $CI_PIPELINE_SOURCE == 'merge_request_event' changes: @@ -214,7 +200,7 @@ localization: mingw-capitalization: extends: .base script: - - .gitlab/ci/scripts/helpers.py --get-changed-files | xargs -d '\n' ./mach lint -l mingw-capitalization + - .gitlab/ci/jobs/lint/helpers.py --get-changed-files | xargs -d '\n' ./mach lint -l mingw-capitalization rules: - if: $CI_PIPELINE_SOURCE == 'merge_request_event' changes: @@ -231,7 +217,7 @@ mingw-capitalization: mscom-init: extends: .base script: - - .gitlab/ci/scripts/helpers.py --get-changed-files | xargs -d '\n' ./mach lint -l mscom-init + - .gitlab/ci/jobs/lint/helpers.py --get-changed-files | xargs -d '\n' ./mach lint -l mscom-init rules: - if: $CI_PIPELINE_SOURCE == 'merge_request_event' changes: @@ -248,7 +234,7 @@ mscom-init: file-whitespace: extends: .base script: - - .gitlab/ci/scripts/helpers.py --get-changed-files | xargs -d '\n' ./mach lint -l file-whitespace + - .gitlab/ci/jobs/lint/helpers.py --get-changed-files | xargs -d '\n' ./mach lint -l file-whitespace rules: - if: $CI_PIPELINE_SOURCE == 'merge_request_event' changes: @@ -278,7 +264,7 @@ file-whitespace: test-manifest: extends: .base script: - - .gitlab/ci/scripts/helpers.py --get-changed-files | xargs -d '\n' ./mach lint -l test-manifest-alpha -l test-manifest-disable -l test-manifest-skip-if + - .gitlab/ci/jobs/lint/helpers.py --get-changed-files | xargs -d '\n' ./mach lint -l test-manifest-alpha -l test-manifest-disable -l test-manifest-skip-if rules: - if: $CI_PIPELINE_SOURCE == 'merge_request_event' changes: @@ -293,7 +279,7 @@ test-manifest: trojan-source: extends: .base script: - - .gitlab/ci/scripts/helpers.py --get-changed-files | xargs -d '\n' ./mach lint -l trojan-source + - .gitlab/ci/jobs/lint/helpers.py --get-changed-files | xargs -d '\n' ./mach lint -l trojan-source rules: - if: $CI_PIPELINE_SOURCE == 'merge_request_event' changes: ===================================== .gitlab/ci/jobs/startup-test/startup-test.py ===================================== @@ -0,0 +1,101 @@ +#!/usr/bin/env python3 + +import argparse +import subprocess +from datetime import datetime, timedelta + +PLATFORM_TO_ARCH = { + "linux": ["x86_64", "i686"], + "macos": ["x86_64", "aarch64"], + "windows": ["x86_64", "i686"], +} + + +class DynamicArchAction(argparse.Action): + def __call__(self, parser, namespace, values, option_string=None): + platform = getattr(namespace, "platform", None) + if not platform: + raise argparse.ArgumentError( + self, "The --platform argument must be provided before --arch." + ) + + valid_archs = PLATFORM_TO_ARCH.get(platform, []) + if values not in valid_archs: + raise argparse.ArgumentError( + self, + f"Invalid architecture '{values}' for platform '{platform}'. " + f"Valid options are: {', '.join(valid_archs)}", + ) + setattr(namespace, self.dest, values) + + +parser = argparse.ArgumentParser( + description="Downloads and executes yesterday's build of Tor or Mullvad browser nightly." +) + +parser.add_argument( + "--platform", + required=True, + help="Specify the platform (linux, macos or windows). Must be provided before --arch.", + choices=PLATFORM_TO_ARCH.keys(), +) +parser.add_argument( + "--arch", + required=True, + help="Specify the architecture (validated dynamically based on --platform).", + action=DynamicArchAction, +) +parser.add_argument( + "--browser", + required=True, + choices=["tor", "mullvad"], + help="Specify the browser (tor or mullvad)", +) + +args = parser.parse_args() +arch = f"-{args.arch}" +extra = "" + +if args.platform == "linux": + archive_extension = "tar.xz" + binary = f"Browser/start-{args.browser}-browser" +elif args.platform == "macos": + archive_extension = "dmg" + # The URL doesn't include the architecture for MacOS, + # because it's a universal build. + arch = "" + if args.browser == "tor": + binary = "Contents/MacOS/firefox" + else: + binary = "Contents/MacOS/mullvadbrowser" +elif args.platform == "windows": + archive_extension = "exe" + + if args.browser == "tor": + extra = "-portable" + binary = "Browser/firefox.exe" + else: + binary = "mullvadbrowser.exe" + +yesterday = (datetime.now() - timedelta(days=1)).strftime("%Y.%m.%d") + +download_url_base = ( + "https://nightlies.tbb.torproject.org/nightly-builds/tor-browser-builds" +) +if args.browser == "tor": + download_url = f"{download_url_base}/tbb-nightly.{yesterday}/nightly-{args.platform}{arch}/{args.browser}-browser-{args.platform}{arch}{extra}-tbb-nightly.{yesterday}.{archive_extension}" +else: + download_url = f"{download_url_base}/tbb-nightly.{yesterday}/mullvadbrowser-nightly-{args.platform}{arch}/{args.browser}-browser-{args.platform}{arch}-tbb-nightly.{yesterday}.{archive_extension}" + +subprocess.run( + [ + "python3", + "testing/mozharness/scripts/does_it_crash.py", + "--run-for", + "30", + "--thing-url", + download_url, + "--thing-to-run", + binary, + ] +) ===================================== .gitlab/ci/jobs/startup-test/startup-test.yml ===================================== @@ -0,0 +1,51 @@ +# startup-test-windows: +# extends: .with-local-repo-pwsh +# variables: +# LOCAL_REPO_PATH: "C:\\Users\\windoes\\tor-browser.git" +# stage: startup-test +# interruptible: true +# parallel: +# matrix: +# - BROWSER: ["tor", "mullvad"] +# tags: +# - x86-win11 +# script: +# - ./mach python testing/mozbase/setup_development.py +# - ./mach python .gitlab/ci/jobs/startup-test/startup-test.py --platform windows --arch x86_64 --browser tor +# rules: +# - if: $CI_PIPELINE_SOURCE == "schedule" + +# startup-test-macos: +# extends: .with-local-repo-bash +# variables: +# LOCAL_REPO_PATH: "/Users/gitlab-runner/tor-browser.git" +# stage: startup-test +# interruptible: true +# parallel: +# matrix: +# - BROWSER: ["tor", "mullvad"] +# tags: +# - x86-macos +# script: +# - ./mach python testing/mozbase/setup_development.py +# - ./mach python .gitlab/ci/jobs/startup-test/startup-test.py --platform macos --arch x86_64 --browser tor +# rules: +# - if: $CI_PIPELINE_SOURCE == "schedule" + +startup-test-linux: + extends: .with-local-repo-bash + image: $IMAGE_PATH + stage: startup-test + interruptible: true + parallel: + matrix: + - BROWSER: ["tor", "mullvad"] + tags: + - firefox + script: + - Xvfb :99 -screen 0 1400x900x24 & + - export DISPLAY=:99 + - ./mach python testing/mozbase/setup_development.py + - ./mach python .gitlab/ci/jobs/startup-test/startup-test.py --platform linux --arch x86_64 --browser tor + rules: + - if: $CI_PIPELINE_SOURCE == "schedule" ===================================== .gitlab/ci/update-containers.yml → .gitlab/ci/jobs/update-containers.yml ===================================== ===================================== .gitlab/ci/update-translations.yml → .gitlab/ci/jobs/update-translations.yml ===================================== ===================================== .gitlab/ci/mixins.yml ===================================== @@ -0,0 +1,37 @@ +.with-local-repo-bash: + variables: + GIT_STRATEGY: "none" + before_script: + - git init + - git remote add local "$LOCAL_REPO_PATH" + - git fetch --depth 500 local + - git remote add origin "$CI_REPOSITORY_URL" + - | + if [ -z "${CI_COMMIT_BRANCH:-$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME}" ]; then + echo "No branch specified. Stopping the pipeline." + exit 1 + fi + - echo "Fetching from remote branch ${CI_COMMIT_BRANCH:-$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME}" + - git fetch origin "${CI_COMMIT_BRANCH:-$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME}" + - git checkout origin/${CI_COMMIT_BRANCH:-$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME} + +.with-local-repo-pwsh: + variables: + GIT_STRATEGY: "none" + before_script: + - git init + - git remote add local $env:LOCAL_REPO_PATH + - git fetch --depth 500 local + - git remote add origin $env:CI_REPOSITORY_URL + - | + $branchName = $env:CI_COMMIT_BRANCH + if ([string]::IsNullOrEmpty($branchName)) { + $branchName = $env:CI_MERGE_REQUEST_SOURCE_BRANCH_NAME + } + if ([string]::IsNullOrEmpty($branchName)) { + Write-Output "No branch specified. Stopping the pipeline." + exit 1 + } + - Write-Output "Fetching from remote branch $branchName" + - git fetch origin $branchName + - git checkout origin/$branchName ===================================== testing/mozbase/mozinstall/mozinstall/mozinstall.py ===================================== @@ -352,7 +352,8 @@ def _install_exe(src, dest): # possibly gets around UAC in vista (still need to run as administrator) os.environ["__compat_layer"] = "RunAsInvoker" - cmd = '"%s" /extractdir=%s' % (src, os.path.realpath(dest)) + cmd = '"%s" /S /D=%s' % (src, os.path.realpath(dest)) + # cmd = '"%s" /extractdir=%s' % (src, os.path.realpath(dest)) subprocess.check_call(cmd) ===================================== testing/mozbase/setup_development.py ===================================== @@ -267,23 +267,28 @@ def main(args=sys.argv[1:]): os.environ.get("PATH", "").strip(os.path.pathsep), ) + current_file_path = os.path.abspath(__file__) + topobjdir = os.path.dirname(os.path.dirname(os.path.dirname(current_file_path))) + mach = str(os.path.join(topobjdir, "mach")) + # install non-mozbase dependencies # these need to be installed separately and the --no-deps flag # subsequently used due to a bug in setuptools; see # https://bugzilla.mozilla.org/show_bug.cgi?id=759836 pypi_deps = dict([(i, j) for i, j in alldeps.items() if i not in unrolled]) for package, version in pypi_deps.items(): - # easy_install should be available since we rely on setuptools - call(["easy_install", version]) + # Originally, Mozilla used easy_install here. + # That tool is deprecated, therefore we swich to pip. + call([sys.executable, mach, "python", "-m", "pip", "install", version]) # install packages required for unit testing for package in test_packages: - call(["easy_install", package]) + call([sys.executable, mach, "python", "-m", "pip", "install", package]) # install extra non-mozbase packages if desired if options.extra: for package in extra_packages: - call(["easy_install", package]) + call([sys.executable, mach, "python", "-m", "pip", "install", package]) if __name__ == "__main__": ===================================== testing/mozharness/scripts/does_it_crash.py ===================================== @@ -112,6 +112,13 @@ class DoesItCrash(BaseScript): for retry in range(3): if is_win: proc.send_signal(signal.CTRL_BREAK_EVENT) + + # Manually kill all processes we spawned, + # not sure why this is required, but without it we hang forever. + process_name = self.config["thing_to_run"].split("/")[-1] + subprocess.run( + ["taskkill", "/T", "/F", "/IM", process_name], check=True + ) else: os.killpg(proc.pid, signal.SIGKILL) try: View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/653c14… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/653c14… You're receiving this email because of your account on gitlab.torproject.org.

1 0