- tbb-commits - lists.torproject.org

[tor-browser-build/master] projects/release: reset HOME for gpg
by boklm＠torproject.org 17 May '17

17 May '17

commit 5f85afd771daaf9e1f6f1f8797188b5523839a1e Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed May 17 20:53:42 2017 +0200 projects/release: reset HOME for gpg If HOME is set to a temporary directory, $HOME/.gnupg cannot be used to sign the build. --- projects/release/config | 2 ++ 1 file changed, 2 insertions(+) diff --git a/projects/release/config b/projects/release/config index f6712c0..3351959 100644 --- a/projects/release/config +++ b/projects/release/config @@ -120,6 +120,8 @@ input_files: build: | #!/bin/sh [% c("var/set_default_env") -%] + # reset HOME which was changed by var/set_default_env, for gpg + [% IF ENV.HOME %]export HOME="[% ENV.HOME %]"[% END %] destdir="[% dest_dir _ '/' _ c("var/publish_dir") %]" mkdir -p "$destdir" [% IF c("var/torbrowser-windows-i686") -%]

1 0

[tor-browser-build/master] Bug 22194/20683: Integrate Selfrando into alpha Linux builds
by boklm＠torproject.org 17 May '17

17 May '17

commit 16d87451179ed55fd6422cd09988a99f5ee886b7 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu May 18 00:10:16 2017 +0200 Bug 22194/20683: Integrate Selfrando into alpha Linux builds Selfrando is a new defense against code reuse attacks developed by the Redactor and Readactor++ people. We should give it a wider testing audience by including it in the alpha series. This is currently only available for 64bit Linux builds, though. Supporting other platforms and architectures is work in progress. tor-browser-bundle.git author: Georg Koppen <gk(a)torproject.org> tor-browser-bundle.git commit: 332c5b6c16f1b0915f537a4ad5af48295f80c733 tor-browser-bundle.git commit: 8fe0e322b950efa2456502428bee66dde8b4948a tor-browser-bundle.git commit: 3e752843dfa39beec844822c9f6c3dd1f80355ea --- keyring/elfutils.gpg | Bin 0 -> 10483 bytes keyring/selfrando.gpg | Bin 0 -> 2759 bytes projects/binutils/binutils-224-gold.patch | 98 +++++++++++++++++++++ projects/binutils/build | 6 ++ projects/binutils/config | 2 + projects/elfutils/build | 23 +++++ projects/elfutils/config | 22 +++++ projects/firefox/build | 9 ++ projects/firefox/config | 4 + projects/selfrando/build | 25 ++++++ projects/selfrando/config | 23 +++++ .../tor-browser/RelativeLink/start-tor-browser | 1 + 12 files changed, 213 insertions(+) diff --git a/keyring/elfutils.gpg b/keyring/elfutils.gpg new file mode 100644 index 0000000..f1cd4b3 Binary files /dev/null and b/keyring/elfutils.gpg differ diff --git a/keyring/selfrando.gpg b/keyring/selfrando.gpg new file mode 100644 index 0000000..276955d Binary files /dev/null and b/keyring/selfrando.gpg differ diff --git a/projects/binutils/binutils-224-gold.patch b/projects/binutils/binutils-224-gold.patch new file mode 100644 index 0000000..a45e49c --- /dev/null +++ b/projects/binutils/binutils-224-gold.patch @@ -0,0 +1,98 @@ +From f984741df04cd68bb116073fdfa9405808810ab4 Mon Sep 17 00:00:00 2001 +From: Cary Coutant <ccoutant(a)google.com> +Date: Wed, 5 Feb 2014 22:59:02 -0800 +Subject: [PATCH] Fix issues with gold undefined symbol diagnostics. + +PR binutils/15435 complains that gold issues a visibility error for an +weak undefined symbol with hidden visibility. The message should be +suppressed if the symbol is a weak undef. + +An earlier patch to add an extra note about key functions when a class's +vtable symbol is undefined missed a case where the reference to the +vtable came from a shared library. This patch moves the check to a +lower-level routine that catches both cases. + +gold/ + +2014-02-05 Cary Coutant <ccoutant(a)google.com> + + * errors.cc (Errors::undefined_symbol): Move undef vtable symbol + check to here. + * target-reloc.h (is_strong_undefined): New function. + (relocate_section): Move undef vtable symbol check from here. + Check for is_strong_undefined. + +diff --git a/gold/ChangeLog b/gold/ChangeLog +index dcf7ed41f8..dd7ef72980 100644 +--- a/gold/ChangeLog ++++ b/gold/ChangeLog +@@ -1,3 +1,14 @@ ++2014-02-05 Cary Coutant <ccoutant(a)google.com> ++ ++ Fix issues with gold undefined symbol diagnostics. ++ ++ PR binutils/15435 ++ * errors.cc (Errors::undefined_symbol): Move undef vtable symbol ++ check to here. ++ * target-reloc.h (is_strong_undefined): New function. ++ (relocate_section): Move undef vtable symbol check from here. ++ Check for is_strong_undefined. ++ + 2013-11-22 Cary Coutant <ccoutant(a)google.com> + + * testsuite/Makefile.am (exception_x86_64_bnd_test): Use in-tree +diff --git a/gold/errors.cc b/gold/errors.cc +index b79764bd1d..98db0fdd86 100644 +--- a/gold/errors.cc ++++ b/gold/errors.cc +@@ -193,6 +193,11 @@ Errors::undefined_symbol(const Symbol* sym, const std::string& location) + fprintf(stderr, + _("%s: %s: undefined reference to '%s', version '%s'\n"), + location.c_str(), zmsg, sym->demangled_name().c_str(), version); ++ ++ if (sym->is_cxx_vtable()) ++ gold_info(_("%s: the vtable symbol may be undefined because " ++ "the class is missing its key function"), ++ program_name); + } + + // Issue a debugging message. +diff --git a/gold/target-reloc.h b/gold/target-reloc.h +index b544c78f37..d609bcbaa8 100644 +--- a/gold/target-reloc.h ++++ b/gold/target-reloc.h +@@ -144,6 +144,12 @@ class Default_comdat_behavior + } + }; + ++inline bool ++is_strong_undefined(const Symbol* sym) ++{ ++ return sym->is_undefined() && sym->binding() != elfcpp::STB_WEAK; ++} ++ + // Give an error for a symbol with non-default visibility which is not + // defined locally. + +@@ -411,16 +417,10 @@ relocate_section( + } + + if (issue_undefined_symbol_error(sym)) +- { +- gold_undefined_symbol_at_location(sym, relinfo, i, offset); +- if (sym->is_cxx_vtable()) +- gold_info(_("%s: the vtable symbol may be undefined because " +- "the class is missing its key function"), +- program_name); +- } ++ gold_undefined_symbol_at_location(sym, relinfo, i, offset); + else if (sym != NULL + && sym->visibility() != elfcpp::STV_DEFAULT +- && (sym->is_undefined() || sym->is_from_dynobj())) ++ && (is_strong_undefined(sym) || sym->is_from_dynobj())) + visibility_error(sym); + + if (sym != NULL && sym->has_warning()) +-- +2.11.0 + diff --git a/projects/binutils/build b/projects/binutils/build index bd949a5..baef68f 100644 --- a/projects/binutils/build +++ b/projects/binutils/build @@ -26,6 +26,12 @@ cd [% project %]-[% c("version") %] # Zeroing timestamps in PE headers reliably, see bug 12753. patch -p1 < ../peXXigen.patch [% END -%] +[% IF c("var/linux-x86_64") -%] + # We need to work around a gold linker bug in 2.24 to get selfrando working, + # see bug 20683. + # XXX: 64bits only for now :(, see #20683. + patch -p1 < $rootdir/binutils-224-gold.patch +[% END -%] ./configure --prefix=$distdir [% c('var/configure_opt') %] make -j4 make install diff --git a/projects/binutils/config b/projects/binutils/config index 0cb2088..88640f8 100644 --- a/projects/binutils/config +++ b/projects/binutils/config @@ -21,3 +21,5 @@ input_files: enable: '[% c("var/windows") %]' - filename: peXXigen.patch enable: '[% c("var/windows") %]' + - filename: binutils-224-gold.patch + enable: '[% c("var/linux-x86_64") %]' diff --git a/projects/elfutils/build b/projects/elfutils/build new file mode 100644 index 0000000..8fdd013 --- /dev/null +++ b/projects/elfutils/build @@ -0,0 +1,23 @@ +#!/bin/bash +[% c("var/set_default_env") -%] +distdir=/var/tmp/dist/[% project %] +[% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] + +mkdir -p /var/tmp/dist + +tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/binutils') %] +export PATH="/var/tmp/dist/binutils/bin:$PATH" + +mkdir -p /var/tmp/build +tar -C /var/tmp/build -xf $rootdir/[% c('input_files_by_name/elfutils') %] + +cd /var/tmp/build/[% project %]-[% c("version") %] +./configure --prefix="$distdir" +make -j4 +make install + +cd /var/tmp/dist +[% c('tar', { + tar_src => [ project ], + tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'), + }) %] diff --git a/projects/elfutils/config b/projects/elfutils/config new file mode 100644 index 0000000..2c21cf2 --- /dev/null +++ b/projects/elfutils/config @@ -0,0 +1,22 @@ +# vim: filetype=yaml sw=2 +version: '0.166' +filename: 'elfutils-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' +tag_gpg_id: 1 + +var: + container: + use_container: 1 + arch_deps: + - zlib1g-dev + +input_files: + - project: container-image + - name: elfutils + URL: 'https://sourceware.org/elfutils/ftp/[% c("version") %]/elfutils-[% c("version") %].tar.bz2' + file_gpg_id: 1 + gpg_keyring: elfutils.gpg + sig_ext: sig + - name: '[% c("var/compiler") %]' + project: '[% c("var/compiler") %]' + - project: binutils + name: binutils diff --git a/projects/firefox/build b/projects/firefox/build index f445454..afb11bb 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -27,6 +27,15 @@ mkdir -p /var/tmp/build export PATH="/var/tmp/dist/binutils/bin:$PATH" [% END -%] +[% IF c("var/linux-x86_64") -%] + # XXX: 64bits only for now :(, see #20683. + tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/selfrando') %] + # Selfrando wrapper + export PATH="/var/tmp/dist/selfrando/Tools/TorBrowser/tc-wrapper/:$PATH" + # We need to avoid the shuffling while building as this breaks compilation + export SELFRANDO_skip_shuffle= +[% END -%] + tar -C /var/tmp/build -xf [% project %]-[% c('version') %].tar.gz [% IF c("var/osx") %] diff --git a/projects/firefox/config b/projects/firefox/config index 9c807ad..1cd986f 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -71,6 +71,10 @@ input_files: - project: binutils name: binutils enable: '[% c("var/linux") %]' + - project: selfrando + name: selfrando + # XXX: 64bits only for now :(, see #20683. + enable: '[% c("var/linux-x86_64") %]' - filename: fix-info-plist.py enable: '[% c("var/osx") %]' - URL: https://people.torproject.org/~mikeperry/mirrors/sources/msvcr100.dll diff --git a/projects/selfrando/build b/projects/selfrando/build new file mode 100644 index 0000000..8bbd63e --- /dev/null +++ b/projects/selfrando/build @@ -0,0 +1,25 @@ +#!/bin/bash +[% c("var/set_default_env") -%] +distdir=/var/tmp/dist/[% project %] +[% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] + +mkdir -p /var/tmp/dist + +tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/elfutils') %] +tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/binutils') %] +export PATH="/var/tmp/dist/binutils/bin:$PATH" + +tar -C /var/tmp/dist -xf $rootdir/[% project %]-[% c("version") %].tar.gz + +cd /var/tmp/dist +mv [% project %]-[% c("version") %] [% project %] +cd [% project %] +scons -Q arch=x86_64 LIBELF_PATH="/var/tmp/dist/elfutils" FORCE_INPLACE=1 DEBUG_LEVEL=env WRITE_LAYOUTS=env LOG=console +# Fix the path where we install selfrando +sed -i 's|^SR_PATH=.*|SR_PATH=/var/tmp/dist/selfrando/out/x86_64/bin|' Tools/TorBrowser/tc-wrapper/ld + +cd /var/tmp/dist +[% c('tar', { + tar_src => [ project ], + tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'), + }) %] diff --git a/projects/selfrando/config b/projects/selfrando/config new file mode 100644 index 0000000..8b73080 --- /dev/null +++ b/projects/selfrando/config @@ -0,0 +1,23 @@ +# vim: filetype=yaml sw=2 +filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' +version: 0.2 +git_hash: 'tb-v[% c("version") %]' +git_url: https://github.com/immunant/selfrando.git +gpg_keyring: selfrando.gpg +tag_gpg_id: 1 + +var: + container: + use_container: 1 + arch_deps: + - scons + - zlib1g-dev + +input_files: + - project: container-image + - name: binutils + project: binutils + - name: elfutils + project: elfutils + - name: '[% c("var/compiler") %]' + project: '[% c("var/compiler") %]' diff --git a/projects/tor-browser/RelativeLink/start-tor-browser b/projects/tor-browser/RelativeLink/start-tor-browser index a78b367..2dd40fc 100755 --- a/projects/tor-browser/RelativeLink/start-tor-browser +++ b/projects/tor-browser/RelativeLink/start-tor-browser @@ -270,6 +270,7 @@ fi LD_LIBRARY_PATH="${HOME}/TorBrowser/Tor/" export LD_LIBRARY_PATH +export SELFRANDO_write_layout_file= function setControlPortPasswd() { local ctrlPasswd=$1

1 0

[tor-browser-bundle/master] Bumping versions of nightly components
by gk＠torproject.org 17 May '17

17 May '17

commit 3a18baaa14b4ce1837b7e71d7d623b546789db9f Author: Georg Koppen <gk(a)torproject.org> Date: Wed May 17 19:14:14 2017 +0000 Bumping versions of nightly components --- gitian/versions.nightly | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 2189139..c3a6545 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -13,11 +13,11 @@ DATA_OUTSIDE_APP_DIR=1 VERIFY_TAGS=0 -FIREFOX_VERSION=52.1.0esr +FIREFOX_VERSION=52.1.1esr TORBROWSER_UPDATE_CHANNEL=default -TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.0-2 +TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.0-1 TOR_TAG=master TORLAUNCHER_TAG=master TORBUTTON_TAG=master @@ -57,7 +57,7 @@ GITIAN_TAG=tor-browser-builder-4 OPENSSL_VER=1.0.2k GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION -FIREFOX_LANG_BUILD=build3 +FIREFOX_LANG_BUILD=build1 BINUTILS_VER=2.24 GCC_VER=5.1.0 CLANG_VER=3.8.0 @@ -80,7 +80,7 @@ ELFUTILS_VER=0.166 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 -NOSCRIPT_PACKAGE=noscript_security_suite-5.0.2-fx+sm.xpi +NOSCRIPT_PACKAGE=noscript_security_suite-5.0.4-fx+sm.xpi CCTOOLS_PACKAGE=cctools.tar.gz OSXSDK_PACKAGE=MacOSX10.7.sdk.tar.gz MSVCR100_PACKAGE=msvcr100.dll @@ -116,7 +116,7 @@ ELFUTILS_PACKAGE=elfutils-${ELFUTILS_VER}.tar.bz2 OPENSSL_HASH=6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf -NOSCRIPT_HASH=31ba7743699deefb606bcc49197d26d926f6b4e3d3526cd2f8a339f857a04fb1 +NOSCRIPT_HASH=cd8e5561bdd7331d9fdd510fb1bd1cb6460d64f351076b523d31361ff9853c76 CCTOOLS_HASH=e908fdebc2886ee5491ebfc7e7950af451b3c4e2439c2d7a923ed06ad05113e4 MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c

1 0

[tor-browser-build/master] Bug 22238: Fix use of hardened wrapper for the Linux build
by boklm＠torproject.org 17 May '17

17 May '17

commit efdf11accdd4c440b867409fb4153b969f58bcd8 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed May 17 18:15:11 2017 +0200 Bug 22238: Fix use of hardened wrapper for the Linux build ESR52 includes this commit: https://hg.mozilla.org/mozilla-central/rev/f8cf0fe7c810 which changes the compiler used from 'c++' to 'g++'. tor-browser-bundle.git commit: 48b68f84b34aef3567aeffe6932ff1e40d900f2b --- projects/gcc/config | 2 ++ 1 file changed, 2 insertions(+) diff --git a/projects/gcc/config b/projects/gcc/config index d740a93..3871455 100644 --- a/projects/gcc/config +++ b/projects/gcc/config @@ -30,8 +30,10 @@ var: cp /usr/bin/hardened-cc ./ mv gcc gcc.real mv c++ c++.real + mv g++ g++.real ln -sf hardened-cc gcc ln -sf hardened-cc c++ + ln -sf hardened-cc g++ popd targets:

1 0

[tor-browser-build/master] Changelog fixup
by boklm＠torproject.org 17 May '17

17 May '17

commit e457c3fc6fe94a5b0e624ac400a32f374b654342 Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 21:37:03 2017 +0000 Changelog fixup We actually released sandboxed-tor-browser 0.0.6 with 7.0a3 due to a last minute fix. --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index afe3999..11c178c 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -18,7 +18,7 @@ Tor Browser 7.0a3 -- April 20 2017 * Translations update * Update HTTPS-Everywhere to 5.2.14 * Update NoScript to 5.0.2 - * Update sandboxed-tor-browser to 0.0.5 + * Update sandboxed-tor-browser to 0.0.6 * Bug 21764: Use bubblewrap's `--die-with-parent` when supported * Fix e10s Web Content crash on systems with grsec kernels * Bug 21928: Force a reinstall if an existing hardened bundle is present @@ -26,6 +26,7 @@ Tor Browser 7.0a3 -- April 20 2017 * Bug 21927: Remove the ability to install/update the hardened bundle * Bug 21244: Update the MAR signing key for 7.0 * Bug 21536: Remove asn's scramblesuit bridge from Tor Browser + * Add back the old release MAR signing key * Add `prlimit64` to the firefox system call whitelist * Fix compilation with Go 1.8 * Use Config.Clone() to clone TLS configs when available

1 0

[tor-browser-build/master] Release preparations for 7.0a4
by boklm＠torproject.org 17 May '17

17 May '17

commit 18416a106aa9ba82320758a29436dd1d3b20d6f7 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed May 17 18:01:11 2017 +0200 Release preparations for 7.0a4 tor-browser-bundle.git author: 999a7afe0f50c6d6503d99ff3fab3879cd069a85 tor-browser-bundle.git commit: Georg Koppen <gk(a)torproject.org> --- projects/https-everywhere/config | 2 +- .../tor-browser/Bundle-Data/Docs/ChangeLog.txt | 43 ++++++++++++++++++++++ projects/tor-browser/config | 4 +- projects/tor-launcher/config | 2 +- projects/tor/config | 2 +- rbm.conf | 2 +- 6 files changed, 49 insertions(+), 6 deletions(-) diff --git a/projects/https-everywhere/config b/projects/https-everywhere/config index f149cac..23c4e1e 100644 --- a/projects/https-everywhere/config +++ b/projects/https-everywhere/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 5.2.14 +version: 5.2.16 git_url: https://git.torproject.org/https-everywhere.git git_hash: '[% c("version") %]' git_submodule: 1 diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 11c178c..9f00100 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,46 @@ +Tor Browser 7.0a4 -- May 15 2017 + * All Platforms + * Update Firefox to 52.1.1esr + * Update Tor to 0.3.0.6 + * Update Tor Launcher to 0.2.12.1 + * Bug 20761: Don't ignore additional SocksPorts + * Translation update + * Update HTTPS-Everywhere to 5.2.16 + * Update NoScript to 5.0.4 + * Bug 21962: Fix crash on about:addons page + * Bug 21778: Canvas prompt is not shown in Tor Browser based on ESR52 + * Bug 21569: Add first-party domain to Permissions key + * Bug 22165: Don't allow collection of local IP addresses + * Bug 13017: Work around audio fingerprinting by disabling the Web Audio API + * Bug 10286: Disable Touch API and add fingerprinting resistance as fallback + * Bug 13612: Disable Social API + * Bug 10283: Disable SpeechSynthesis API + * Bug 21675: Spoof window.navigator.hardwareConcurrency + * Bug 21792: Suppress MediaError.message + * Bug 16337: Round times exposed by Animation API to nearest 100ms + * Bug 21726: Keep Graphite support disabled + * Bug 21685: Disable remote new tab pages + * Bug 21790: Disable captive portal detection + * Bug 21686: Disable Microsoft Family Safety support + * Bug 22073: Make sure Mozilla's experiments are disabled + * Bug 21683: Disable newly added Safebrowsing capabilities + * Bug 22071: Disable Kinto-based blocklist update mechanism + * Bug 22072: Hide TLS error reporting checkbox + * Bug 20761: Don't ignore additional SocksPorts + * Bug 21340: Identify and backport new patches from Firefox + * Bug 22153: Fix broken feeds on higher security levels + * Bug 22025: Fix broken certificate error pages on higher security levels + * Bug 21710: Upgrade Go to 1.8.1 + * Mac + * Bug 21940: Don't allow privilege escalation during update + * Bug 22044: Fix broken default search engine on macOS + * Bug 21879: Use our default bookmarks on OSX + * Bug 21779: Non-admin users can't access Tor Browser on macOS + * Linux + * Bug 22041: Fix update error during update to 7.0a3 + * Bug 22238: Fix use of hardened wrapper for Firefox build + * Bug 20683: Selfrando support for 64-bit Linux systems + Tor Browser 7.0a3 -- April 20 2017 * All Platforms * Update Firefox to 52.1.0esr diff --git a/projects/tor-browser/config b/projects/tor-browser/config index 805d7b6..a2c21ed 100644 --- a/projects/tor-browser/config +++ b/projects/tor-browser/config @@ -54,9 +54,9 @@ input_files: name: snowflake enable: '[% c("var/snowflake") %]' - filename: Bundle-Data - - URL: https://addons.cdn.mozilla.net/user-media/addons/722/noscript_security_suit… + - URL: https://addons.cdn.mozilla.net/user-media/addons/722/noscript_security_suit… name: noscript - sha256sum: 31ba7743699deefb606bcc49197d26d926f6b4e3d3526cd2f8a339f857a04fb1 + sha256sum: cd8e5561bdd7331d9fdd510fb1bd1cb6460d64f351076b523d31361ff9853c76 - filename: RelativeLink enable: '[% c("var/linux") %]' - project: libdmg-hfsplus diff --git a/projects/tor-launcher/config b/projects/tor-launcher/config index 9211844..a164ef3 100644 --- a/projects/tor-launcher/config +++ b/projects/tor-launcher/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 0.2.12 +version: 0.2.12.1 git_url: https://git.torproject.org/tor-launcher.git git_hash: '[% c("version") %]' gpg_keyring: torbutton.gpg diff --git a/projects/tor/config b/projects/tor/config index c2d359c..b92fb4f 100644 --- a/projects/tor/config +++ b/projects/tor/config @@ -1,6 +1,6 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -version: 0.3.0.5-rc +version: 0.3.0.6 git_hash: 'tor-[% c("version") %]' git_url: https://git.torproject.org/tor.git gpg_keyring: tor.gpg diff --git a/rbm.conf b/rbm.conf index ce70215..6a1cc43 100644 --- a/rbm.conf +++ b/rbm.conf @@ -7,7 +7,7 @@ build_log: '[% GET ENV.RBM_LOGS_DIR ? ENV.RBM_LOGS_DIR : "logs" %]/[% project %] pkg_type: build var: - torbrowser_version: '7.0a3' + torbrowser_version: '7.0a4' project_name: tor-browser multi_lingual: 0 build_mar: 1

1 0

[tor-browser-build/master] Update firefox-langpacks build
by boklm＠torproject.org 15 May '17

15 May '17

commit abc84a40419c8d8a37d0ac1db63a860fdcc39997 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon May 15 16:51:11 2017 +0200 Update firefox-langpacks build --- projects/firefox-langpacks/config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/firefox-langpacks/config b/projects/firefox-langpacks/config index 39f04cb..a645b92 100644 --- a/projects/firefox-langpacks/config +++ b/projects/firefox-langpacks/config @@ -4,7 +4,7 @@ filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/buil var: ff_version: '[% pc("firefox", "var/firefox_version") %]' - ff_build: build3 + ff_build: build1 ff_arch: linux-i686 input_filename: 'dl-langpack-[% c("var/ff_arch") %]-[% c("version") %]'

1 0

[tor-browser-bundle/master] Add a timestamp to the log file after each invokation of make(1).
by gk＠torproject.org 15 May '17

15 May '17

commit 6a2238b2a607687b501b51a12803e0337d710d7b Author: Linus Nordberg <linus(a)torproject.org> Date: Mon May 15 16:21:50 2017 +0200 Add a timestamp to the log file after each invokation of make(1). This makes it easier to track build times. --- tools/continuous-builds/build-tbb.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/continuous-builds/build-tbb.sh b/tools/continuous-builds/build-tbb.sh index 1c1118d..1075b9c 100755 --- a/tools/continuous-builds/build-tbb.sh +++ b/tools/continuous-builds/build-tbb.sh @@ -53,6 +53,7 @@ while [ $status != done ]; do killall qemu-system-i386 qemu-system-x86_64 make $MAKE_TARGET > build-logs/build-$(date -u +%s).log && status=done printf "%s: Tried building $MAKE_TARGET %d times. Status: %s.\n" $0 $n $status | tee -a $logfile + date -u | tee -a $logfile MAKE_TARGET=build-$TARGET [ $n -ge $N ] && break done

1 0

[tor-browser-build/master] Pick up new tor-browser tag
by boklm＠torproject.org 15 May '17

15 May '17

commit 5084700b66e5c2420554cbfea9e11995b4be5ec5 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon May 15 02:03:23 2017 +0200 Pick up new tor-browser tag --- projects/firefox/config | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/projects/firefox/config b/projects/firefox/config index f5c765f..9c807ad 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -1,13 +1,13 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' filename: 'firefox-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-2-build1' +git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build2' tag_gpg_id: 1 git_url: https://git.torproject.org/tor-browser.git gpg_keyring: torbutton.gpg var: - firefox_version: 52.1.0esr + firefox_version: 52.1.1esr torbrowser_branch: 7.0 torbrowser_update_channel: alpha copyright_year: '[% exec("git show -s --format=%ci").remove("-.*") %]'

1 0

[tor-browser-bundle/master] Pick up new tor-browser tag
by gk＠torproject.org 14 May '17

14 May '17

commit 78ddfcbe48e0d08eab7019072ebae938da91c1a4 Author: Georg Koppen <gk(a)torproject.org> Date: Sun May 14 20:15:05 2017 +0000 Pick up new tor-browser tag --- gitian/versions.alpha | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gitian/versions.alpha b/gitian/versions.alpha index cdce2e8..99bc2d7 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -14,7 +14,7 @@ FIREFOX_VERSION=52.1.1esr TORBROWSER_UPDATE_CHANNEL=alpha -TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.0-1-build1 +TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.0-1-build2 TOR_TAG=tor-0.3.0.6 TORLAUNCHER_TAG=0.2.12.1 TORBUTTON_TAG=1.9.7.2

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 14 May '17

14 May '17

commit 0d5ad00985cbeb4c1f06e328145a7863fd706851 Author: Georg Koppen <gk(a)torproject.org> Date: Sun May 14 19:50:41 2017 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. This fixes bug 22254: `pref()` does not like a `;` between pref name and value. --- browser/app/profile/000-tor-browser.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 33e8f99..fb7b078 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -258,7 +258,7 @@ pref("mathml.disabled", false); pref("javascript.options.asmjs", false); // Mozilla keeps still finding critical bugs in Graphite code. Disable it for // now, see bug 21726. -pref("gfx.font_rendering.graphite.enabled"; false); +pref("gfx.font_rendering.graphite.enabled", false); // Network and performance pref("network.http.pipelining", true);

1 0

[tor-browser/tor-browser-52.1.1esr-7.0-1] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 14 May '17

14 May '17

commit 7bbd69956bd1a30051599a1dd4bf615bc40e55e8 Author: Georg Koppen <gk(a)torproject.org> Date: Sun May 14 19:50:41 2017 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. This fixes bug 22254: `pref()` does not like a `;` between pref name and value. --- browser/app/profile/000-tor-browser.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 33e8f99..fb7b078 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -258,7 +258,7 @@ pref("mathml.disabled", false); pref("javascript.options.asmjs", false); // Mozilla keeps still finding critical bugs in Graphite code. Disable it for // now, see bug 21726. -pref("gfx.font_rendering.graphite.enabled"; false); +pref("gfx.font_rendering.graphite.enabled", false); // Network and performance pref("network.http.pipelining", true);

1 0

[tor-browser-bundle/master] Release preparations for 7.0a4
by gk＠torproject.org 13 May '17

13 May '17

commit 999a7afe0f50c6d6503d99ff3fab3879cd069a85 Author: Georg Koppen <gk(a)torproject.org> Date: Sat May 13 07:36:24 2017 +0000 Release preparations for 7.0a4 Version bumps, Changelog update, and update of config.yml --- Bundle-Data/Docs/ChangeLog.txt | 43 +++++++++++++++++++++++++++++++++++++++ gitian/versions.alpha | 16 +++++++-------- tools/update-responses/config.yml | 10 ++++----- 3 files changed, 56 insertions(+), 13 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 11c178c..9f00100 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,46 @@ +Tor Browser 7.0a4 -- May 15 2017 + * All Platforms + * Update Firefox to 52.1.1esr + * Update Tor to 0.3.0.6 + * Update Tor Launcher to 0.2.12.1 + * Bug 20761: Don't ignore additional SocksPorts + * Translation update + * Update HTTPS-Everywhere to 5.2.16 + * Update NoScript to 5.0.4 + * Bug 21962: Fix crash on about:addons page + * Bug 21778: Canvas prompt is not shown in Tor Browser based on ESR52 + * Bug 21569: Add first-party domain to Permissions key + * Bug 22165: Don't allow collection of local IP addresses + * Bug 13017: Work around audio fingerprinting by disabling the Web Audio API + * Bug 10286: Disable Touch API and add fingerprinting resistance as fallback + * Bug 13612: Disable Social API + * Bug 10283: Disable SpeechSynthesis API + * Bug 21675: Spoof window.navigator.hardwareConcurrency + * Bug 21792: Suppress MediaError.message + * Bug 16337: Round times exposed by Animation API to nearest 100ms + * Bug 21726: Keep Graphite support disabled + * Bug 21685: Disable remote new tab pages + * Bug 21790: Disable captive portal detection + * Bug 21686: Disable Microsoft Family Safety support + * Bug 22073: Make sure Mozilla's experiments are disabled + * Bug 21683: Disable newly added Safebrowsing capabilities + * Bug 22071: Disable Kinto-based blocklist update mechanism + * Bug 22072: Hide TLS error reporting checkbox + * Bug 20761: Don't ignore additional SocksPorts + * Bug 21340: Identify and backport new patches from Firefox + * Bug 22153: Fix broken feeds on higher security levels + * Bug 22025: Fix broken certificate error pages on higher security levels + * Bug 21710: Upgrade Go to 1.8.1 + * Mac + * Bug 21940: Don't allow privilege escalation during update + * Bug 22044: Fix broken default search engine on macOS + * Bug 21879: Use our default bookmarks on OSX + * Bug 21779: Non-admin users can't access Tor Browser on macOS + * Linux + * Bug 22041: Fix update error during update to 7.0a3 + * Bug 22238: Fix use of hardened wrapper for Firefox build + * Bug 20683: Selfrando support for 64-bit Linux systems + Tor Browser 7.0a3 -- April 20 2017 * All Platforms * Update Firefox to 52.1.0esr diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 2179f8d..cdce2e8 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -10,15 +10,15 @@ DATA_OUTSIDE_APP_DIR=1 VERIFY_TAGS=1 -FIREFOX_VERSION=52.1.0esr +FIREFOX_VERSION=52.1.1esr TORBROWSER_UPDATE_CHANNEL=alpha -TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.0-2-build1 -TOR_TAG=tor-0.3.0.5-rc -TORLAUNCHER_TAG=0.2.12 +TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.0-1-build1 +TOR_TAG=tor-0.3.0.6 +TORLAUNCHER_TAG=0.2.12.1 TORBUTTON_TAG=1.9.7.2 -HTTPSE_TAG=5.2.14 +HTTPSE_TAG=5.2.16 NSIS_TAG=v0.3.1 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.22-stable @@ -54,7 +54,7 @@ GITIAN_TAG=tor-browser-builder-4-4 OPENSSL_VER=1.0.2k GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION -FIREFOX_LANG_BUILD=build3 +FIREFOX_LANG_BUILD=build1 BINUTILS_VER=2.24 GCC_VER=5.1.0 CLANG_VER=3.8.0 @@ -77,7 +77,7 @@ ELFUTILS_VER=0.166 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 -NOSCRIPT_PACKAGE=noscript_security_suite-5.0.2-fx+sm.xpi +NOSCRIPT_PACKAGE=noscript_security_suite-5.0.4-fx+sm.xpi CCTOOLS_PACKAGE=cctools.tar.gz OSXSDK_PACKAGE=MacOSX10.7.sdk.tar.gz MSVCR100_PACKAGE=msvcr100.dll @@ -113,7 +113,7 @@ ELFUTILS_PACKAGE=elfutils-${ELFUTILS_VER}.tar.bz2 OPENSSL_HASH=6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf -NOSCRIPT_HASH=31ba7743699deefb606bcc49197d26d926f6b4e3d3526cd2f8a339f857a04fb1 +NOSCRIPT_HASH=cd8e5561bdd7331d9fdd510fb1bd1cb6460d64f351076b523d31361ff9853c76 CCTOOLS_HASH=e908fdebc2886ee5491ebfc7e7950af451b3c4e2439c2d7a923ed06ad05113e4 MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index 78f3a2c..6a9a142 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -19,7 +19,7 @@ build_targets: osx32: Darwin_x86-gcc3 osx64: Darwin_x86_64-gcc3 channels: - alpha: 7.0a3 + alpha: 7.0a4 release: 6.0.1 versions: 6.0.1: @@ -33,11 +33,11 @@ versions: osx32: minSupportedOSVersion: 10.8 detailsURL: https://blog.torproject.org/blog/end-life-plan-tor-browser-32-bit-macs#upda… - 7.0a3: - platformVersion: 52.1.0 - detailsURL: https://blog.torproject.org/blog/tor-browser-70a3-released + 7.0a4: + platformVersion: 52.1.1 + detailsURL: https://blog.torproject.org/blog/tor-browser-70a4-released incremental_from: - - 7.0a2 + - 7.0a3 migrate_archs: osx32: osx64 migrate_langs:

1 0

[tor-browser-bundle/master] Changelog fixup
by gk＠torproject.org 12 May '17

12 May '17

commit 2c11fc5ae73266dab8e6c8de68740c809b6675c1 Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 21:37:03 2017 +0000 Changelog fixup We actually released sandboxed-tor-browser 0.0.6 with 7.0a3 due to a last minute fix. --- Bundle-Data/Docs/ChangeLog.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index afe3999..11c178c 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -18,7 +18,7 @@ Tor Browser 7.0a3 -- April 20 2017 * Translations update * Update HTTPS-Everywhere to 5.2.14 * Update NoScript to 5.0.2 - * Update sandboxed-tor-browser to 0.0.5 + * Update sandboxed-tor-browser to 0.0.6 * Bug 21764: Use bubblewrap's `--die-with-parent` when supported * Fix e10s Web Content crash on systems with grsec kernels * Bug 21928: Force a reinstall if an existing hardened bundle is present @@ -26,6 +26,7 @@ Tor Browser 7.0a3 -- April 20 2017 * Bug 21927: Remove the ability to install/update the hardened bundle * Bug 21244: Update the MAR signing key for 7.0 * Bug 21536: Remove asn's scramblesuit bridge from Tor Browser + * Add back the old release MAR signing key * Add `prlimit64` to the firefox system call whitelist * Fix compilation with Go 1.8 * Use Config.Clone() to clone TLS configs when available

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! Bug #4234: Use the Firefox Update Process for Tor Browser.
by gk＠torproject.org 12 May '17

12 May '17

commit d5211d99de2f37fc3e21329fd32fe80bcc663d37 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Thu May 11 15:37:54 2017 -0400 fixup! Bug #4234: Use the Firefox Update Process for Tor Browser. Disable the updater's OSX privilege elevation feature. If the user does not have write permission to the .app directory, they will be prompted to download a new copy of the browser. Fixes bug 21940. As defense-in-depth measures, we also removed the code that is used by Firefox to launch an OSX process with administrator privileges as well as the extra copy of the updater executable that was located under TorBrowser.app/Contents/Library/LaunchServices/. --- browser/app/Makefile.in | 3 +++ browser/installer/package-manifest.in | 2 ++ toolkit/mozapps/update/nsUpdateService.js | 10 ++++++++++ toolkit/mozapps/update/updater/launchchild_osx.mm | 2 ++ toolkit/mozapps/update/updater/updater.cpp | 10 ++++++++++ toolkit/xre/MacLaunchHelper.h | 2 ++ toolkit/xre/MacLaunchHelper.mm | 2 ++ toolkit/xre/nsUpdateDriver.cpp | 4 ++++ 8 files changed, 35 insertions(+) diff --git a/browser/app/Makefile.in b/browser/app/Makefile.in index 1fe7676..1fbdc1e 100644 --- a/browser/app/Makefile.in +++ b/browser/app/Makefile.in @@ -86,9 +86,12 @@ tools repackage:: $(DIST)/bin/$(MOZ_APP_NAME) $(RM) $(dist_dest)/Contents/MacOS/$(MOZ_APP_NAME) rsync -aL $(DIST)/bin/$(MOZ_APP_NAME) $(dist_dest)/Contents/MacOS cp -RL $(DIST)/branding/firefox.icns $(dist_dest)/Contents/Resources/firefox.icns + cp -RL $(DIST)/branding/document.icns $(dist_dest)/Contents/Resources/document.icns +ifndef TOR_BROWSER_UPDATE $(MKDIR) -p $(dist_dest)/Contents/Library/LaunchServices mv -f $(dist_dest)/Contents/MacOS/updater.app/Contents/MacOS/org.mozilla.updater $(dist_dest)/Contents/Library/LaunchServices ln -s ../../../../Library/LaunchServices/org.mozilla.updater $(dist_dest)/Contents/MacOS/updater.app/Contents/MacOS/org.mozilla.updater +endif printf APPLTORB > $(dist_dest)/Contents/PkgInfo endif diff --git a/browser/installer/package-manifest.in b/browser/installer/package-manifest.in index 8192f93..43c89a9 100644 --- a/browser/installer/package-manifest.in +++ b/browser/installer/package-manifest.in @@ -35,7 +35,9 @@ #ifdef XP_MACOSX ; Mac bundle stuff @APPNAME@/Contents/Info.plist +#ifndef TOR_BROWSER_UPDATE @APPNAME@/Contents/Library/LaunchServices +#endif @APPNAME@/Contents/PkgInfo @RESPATH@/firefox.icns @RESPATH@/document.icns diff --git a/toolkit/mozapps/update/nsUpdateService.js b/toolkit/mozapps/update/nsUpdateService.js index 8abc55a..59c36e8 100644 --- a/toolkit/mozapps/update/nsUpdateService.js +++ b/toolkit/mozapps/update/nsUpdateService.js @@ -378,6 +378,11 @@ function areDirectoryEntriesWriteable(aDir) { * @return true if elevation is required, false otherwise */ function getElevationRequired() { +#if defined(TOR_BROWSER_UPDATE) + // To avoid potential security holes associated with running the updater + // process with elevated privileges, Tor Browser does not support elevation. + return false; +#else if (AppConstants.platform != "macosx") { return false; } @@ -401,6 +406,7 @@ function getElevationRequired() { LOG("getElevationRequired - able to write to application bundle, elevation " + "not required"); return false; +#endif } /** @@ -1203,6 +1209,9 @@ function handleUpdateFailure(update, errorCode) { cancelations++; Services.prefs.setIntPref(PREF_APP_UPDATE_CANCELATIONS, cancelations); if (AppConstants.platform == "macosx") { +#if defined(TOR_BROWSER_UPDATE) + cleanupActiveUpdate(); +#else let osxCancelations = getPref("getIntPref", PREF_APP_UPDATE_CANCELATIONS_OSX, 0); osxCancelations++; @@ -1219,6 +1228,7 @@ function handleUpdateFailure(update, errorCode) { writeStatusFile(getUpdatesDir(), update.state = STATE_PENDING_ELEVATE); } +#endif update.statusText = gUpdateBundle.GetStringFromName("elevationFailure"); update.QueryInterface(Ci.nsIWritablePropertyBag); update.setProperty("patchingFailed", "elevationFailure"); diff --git a/toolkit/mozapps/update/updater/launchchild_osx.mm b/toolkit/mozapps/update/updater/launchchild_osx.mm index 97e31b9..749cb1f 100644 --- a/toolkit/mozapps/update/updater/launchchild_osx.mm +++ b/toolkit/mozapps/update/updater/launchchild_osx.mm @@ -284,6 +284,7 @@ bool ObtainUpdaterArguments(int* argc, char*** argv) @end +#ifndef TOR_BROWSER_UPDATE bool ServeElevatedUpdate(int argc, const char** argv) { MacAutoreleasePool pool; @@ -300,6 +301,7 @@ bool ServeElevatedUpdate(int argc, const char** argv) [updater release]; return didSucceed; } +#endif bool IsOwnedByGroupAdmin(const char* aAppBundle) { diff --git a/toolkit/mozapps/update/updater/updater.cpp b/toolkit/mozapps/update/updater/updater.cpp index 1bc4867..bf4a4bb 100644 --- a/toolkit/mozapps/update/updater/updater.cpp +++ b/toolkit/mozapps/update/updater/updater.cpp @@ -83,7 +83,9 @@ bool IsRecursivelyWritable(const char* aPath); void LaunchChild(int argc, const char** argv); void LaunchMacPostProcess(const char* aAppBundle); bool ObtainUpdaterArguments(int* argc, char*** argv); +#ifndef TOR_BROWSER_UPDATE bool ServeElevatedUpdate(int argc, const char** argv); +#endif void SetGroupOwnershipAndPermissions(const char* aAppBundle); struct UpdateServerThreadArgs { @@ -2913,11 +2915,15 @@ UpdateThreadFunc(void *param) static void ServeElevatedUpdateThreadFunc(void* param) { +#ifdef TOR_BROWSER_UPDATE + WriteStatusFile(ELEVATION_CANCELED); +#else UpdateServerThreadArgs* threadArgs = (UpdateServerThreadArgs*)param; gSucceeded = ServeElevatedUpdate(threadArgs->argc, threadArgs->argv); if (!gSucceeded) { WriteStatusFile(ELEVATION_CANCELED); } +#endif QuitProgressUI(); } @@ -2986,7 +2992,11 @@ int NS_main(int argc, NS_tchar **argv) #ifdef XP_MACOSX bool isElevated = +#ifdef TOR_BROWSER_UPDATE + false; +#else strstr(argv[0], "/Library/PrivilegedHelperTools/org.mozilla.updater") != 0; +#endif if (isElevated) { if (!ObtainUpdaterArguments(&argc, &argv)) { // Won't actually get here because ObtainUpdaterArguments will terminate diff --git a/toolkit/xre/MacLaunchHelper.h b/toolkit/xre/MacLaunchHelper.h index 08035c5..46e1570 100644 --- a/toolkit/xre/MacLaunchHelper.h +++ b/toolkit/xre/MacLaunchHelper.h @@ -17,7 +17,9 @@ extern "C" { * pid of the terminated process to confirm that it executed successfully. */ void LaunchChildMac(int aArgc, char** aArgv, pid_t* aPid = 0); +#ifndef TOR_BROWSER_UPDATE bool LaunchElevatedUpdate(int aArgc, char** aArgv, pid_t* aPid = 0); +#endif } #endif diff --git a/toolkit/xre/MacLaunchHelper.mm b/toolkit/xre/MacLaunchHelper.mm index 0dadb8d..84e28a4 100644 --- a/toolkit/xre/MacLaunchHelper.mm +++ b/toolkit/xre/MacLaunchHelper.mm @@ -43,6 +43,7 @@ void LaunchChildMac(int aArgc, char** aArgv, pid_t* aPid) } } +#ifndef TOR_BROWSER_UPDATE BOOL InstallPrivilegedHelper() { AuthorizationRef authRef = NULL; @@ -135,3 +136,4 @@ bool LaunchElevatedUpdate(int aArgc, char** aArgv, pid_t* aPid) } return didSucceed; } +#endif diff --git a/toolkit/xre/nsUpdateDriver.cpp b/toolkit/xre/nsUpdateDriver.cpp index 3abbf7f..b87c84e 100644 --- a/toolkit/xre/nsUpdateDriver.cpp +++ b/toolkit/xre/nsUpdateDriver.cpp @@ -1114,6 +1114,7 @@ ApplyUpdate(nsIFile *greDir, nsIFile *updateDir, nsIFile *statusFile, #ifdef DEBUG dump_argv("ApplyUpdate after SetupMacCommandLine", argv, argc); #endif +#ifndef TOR_BROWSER_UPDATE // We need to detect whether elevation is required for this update. This can // occur when an admin user installs the application, but another admin // user attempts to update (see bug 394984). @@ -1124,12 +1125,15 @@ ApplyUpdate(nsIFile *greDir, nsIFile *updateDir, nsIFile *statusFile, } exit(0); } else { +#endif if (restart) { LaunchChildMac(argc, argv); exit(0); } LaunchChildMac(argc, argv, outpid); +#ifndef TOR_BROWSER_UPDATE } +#endif #else *outpid = PR_CreateProcess(updaterPath.get(), argv, nullptr, nullptr); if (restart) {

1 0

[tor-launcher/master] Release preparations for 0.2.12.1
by gk＠torproject.org 12 May '17

12 May '17

commit 7bf517510843337823373fe53c2b7a9ebcd7f1e0 Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 19:12:46 2017 +0000 Release preparations for 0.2.12.1 Version bump --- src/install.rdf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/install.rdf b/src/install.rdf index ae89a4c..c0a6e20 100644 --- a/src/install.rdf +++ b/src/install.rdf @@ -7,7 +7,7 @@ <em:creator>The Tor Project, Inc.</em:creator> <em:contributor>Pearl Crescent, LLC</em:contributor> <em:id>tor-launcher(a)torproject.org</em:id> - <em:version>0.2.12</em:version> + <em:version>0.2.12.1</em:version> <em:multiprocessCompatible>true</em:multiprocessCompatible> <em:homepageURL>https://www.torproject.org/projects/torbrowser.html</em:homepageURL> <em:updateURL>data:text/plain,</em:updateURL>

1 0

[tor-launcher/master] Translation update
by gk＠torproject.org 12 May '17

12 May '17

commit f8edca4204b8d99508d660b64ef9af7270231f42 Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 19:09:22 2017 +0000 Translation update --- src/chrome/locale/sv/network-settings.dtd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/chrome/locale/sv/network-settings.dtd b/src/chrome/locale/sv/network-settings.dtd index 5975310..0648ead 100644 --- a/src/chrome/locale/sv/network-settings.dtd +++ b/src/chrome/locale/sv/network-settings.dtd @@ -2,7 +2,7 @@  <!ENTITY torlauncher.localePicker.title "Språk i Tor-webbläsare"> -<!ENTITY torlauncher.localePicker.prompt "Vänligen välj ett språk."> +<!ENTITY torlauncher.localePicker.prompt "Välj ett språk.">

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 12 May '17

12 May '17

commit e6b28367e061f9b6912c3b150383255bdff0ef5c Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 18:51:56 2017 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. We disable the newly added safebrowsing capabilities, see bug 21683. --- browser/app/profile/000-tor-browser.js | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 05899cc..33e8f99 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -71,6 +71,17 @@ pref("geo.wifi.uri", ""); pref("browser.search.suggest.enabled", false); pref("browser.safebrowsing.enabled", false); pref("browser.safebrowsing.malware.enabled", false); +pref("browser.safebrowsing.phishing.enabled", false); +pref("browser.safebrowsing.downloads.enabled", false); +pref("browser.safebrowsing.downloads.remote.enabled", false); +pref("browser.safebrowsing.blockedURIs.enabled", false); +pref("browser.safebrowsing.downloads.remote.url", ""); +pref("browser.safebrowsing.provider.google.updateURL", ""); +pref("browser.safebrowsing.provider.google.gethashURL", ""); +pref("browser.safebrowsing.provider.google4.updateURL", ""); +pref("browser.safebrowsing.provider.google4.gethashURL", ""); +pref("browser.safebrowsing.provider.mozilla.updateURL", ""); +pref("browser.safebrowsing.provider.mozilla.gethashURL", ""); pref("browser.download.manager.scanWhenDone", false); // prevents AV remote reporting of downloads pref("extensions.ui.lastCategory", "addons://list/extension"); pref("datareporting.healthreport.service.enabled", false); // Yes, all three of these must be set

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] Revert "fixup! TB3: Tor Browser's official .mozconfigs."
by gk＠torproject.org 12 May '17

12 May '17

commit c474e8a83bff73cff6a26aac945e110bc44846a0 Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 17:55:31 2017 +0000 Revert "fixup! TB3: Tor Browser's official .mozconfigs." This reverts commit b51157dc9a520a693c2fb27ab3213e3bdf1cb5f1. --- .mozconfig | 1 - .mozconfig-asan | 1 - 2 files changed, 2 deletions(-) diff --git a/.mozconfig b/.mozconfig index 4398849..cde5b49 100755 --- a/.mozconfig +++ b/.mozconfig @@ -27,4 +27,3 @@ ac_add_options --disable-webrtc ac_add_options --disable-eme #ac_add_options --disable-ctypes ac_add_options --enable-jemalloc=4 -ac_add_options --enable-pie diff --git a/.mozconfig-asan b/.mozconfig-asan index 87e5008..096bcc6 100644 --- a/.mozconfig-asan +++ b/.mozconfig-asan @@ -41,4 +41,3 @@ ac_add_options --disable-crashreporter ac_add_options --disable-webrtc #ac_add_options --disable-ctypes ac_add_options --disable-eme -ac_add_options --enable-pie

1 0

[tor-browser-bundle/master] Bug 22238: Fix use of hardened wrapper for the Linux build
by gk＠torproject.org 12 May '17

12 May '17

commit 48b68f84b34aef3567aeffe6932ff1e40d900f2b Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri May 12 18:14:24 2017 +0200 Bug 22238: Fix use of hardened wrapper for the Linux build ESR52 includes this commit: https://hg.mozilla.org/mozilla-central/rev/f8cf0fe7c810 which changes the compiler used from 'c++' to 'g++'. --- gitian/descriptors/linux/gitian-firefox.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index db4f232..a3bc37f 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -79,8 +79,10 @@ script: | cp /usr/bin/hardened-cc ./ mv gcc gcc.real mv c++ c++.real + mv g++ g++.real ln -sf hardened-cc gcc ln -sf hardened-cc c++ + ln -sf hardened-cc g++ cd ~/build export PATH=$INSTDIR/gcc/bin:$INSTDIR/binutils/bin:$PATH ARCH=""

1 0

[tor-browser-build/master] Bug 22153: Fix broken feeds on higher security levels
by boklm＠torproject.org 12 May '17

12 May '17

commit 6a5f359bd20050f5af00551488eb0933731ce651 Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 14:21:04 2017 +0000 Bug 22153: Fix broken feeds on higher security levels We need to allow JavaScript on feed pages explicitly. Otherwise are those pages broken on higher security levels. --- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/projects/tor-browser/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js b/projects/tor-browser/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js index 2ad9731..53c1a25 100644 --- a/projects/tor-browser/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/projects/tor-browser/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false); diff --git a/projects/tor-browser/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js b/projects/tor-browser/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js index 2ad9731..53c1a25 100644 --- a/projects/tor-browser/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/projects/tor-browser/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false); diff --git a/projects/tor-browser/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js b/projects/tor-browser/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js index 2ad9731..53c1a25 100644 --- a/projects/tor-browser/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/projects/tor-browser/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false);

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 12 May '17

12 May '17

commit 9b5324a8bb68e1e8e10d113e087db24aee712fe4 Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 12:49:08 2017 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. Mozilla still finds critical bugs in Graphite, let#s keep it disabled for now. Fixes bug 21726. --- browser/app/profile/000-tor-browser.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 9483702..05899cc 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -245,6 +245,9 @@ pref("mathml.disabled", false); // Until we address at least the linkability concerns in #19417 let's disable // asmjs. pref("javascript.options.asmjs", false); +// Mozilla keeps still finding critical bugs in Graphite code. Disable it for +// now, see bug 21726. +pref("gfx.font_rendering.graphite.enabled"; false); // Network and performance pref("network.http.pipelining", true);

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] Bug 22165: Block DoListAddresses when resisting fingerprinting
by gk＠torproject.org 12 May '17

12 May '17

commit 2c50abdbdd215f7a84211ce70d8c75a0a6f97187 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Thu May 11 13:58:24 2017 -0700 Bug 22165: Block DoListAddresses when resisting fingerprinting --- netwerk/base/NetworkInfoServiceCocoa.cpp | 6 ++++++ netwerk/base/NetworkInfoServiceLinux.cpp | 6 ++++++ netwerk/base/NetworkInfoServiceWindows.cpp | 6 ++++++ 3 files changed, 18 insertions(+) diff --git a/netwerk/base/NetworkInfoServiceCocoa.cpp b/netwerk/base/NetworkInfoServiceCocoa.cpp index 937c726..c2d8e2c 100644 --- a/netwerk/base/NetworkInfoServiceCocoa.cpp +++ b/netwerk/base/NetworkInfoServiceCocoa.cpp @@ -17,6 +17,8 @@ #include "NetworkInfoServiceImpl.h" +#include "nsContentUtils.h" + namespace mozilla { namespace net { @@ -26,6 +28,10 @@ ListInterfaceAddresses(int aFd, const char* aIface, AddrMapType& aAddrMap); nsresult DoListAddresses(AddrMapType& aAddrMap) { + if (nsContentUtils::ShouldResistFingerprinting()) { + return NS_ERROR_FAILURE; + } + int fd = socket(AF_INET, SOCK_DGRAM, 0); if (fd < 0) { return NS_ERROR_FAILURE; diff --git a/netwerk/base/NetworkInfoServiceLinux.cpp b/netwerk/base/NetworkInfoServiceLinux.cpp index 96627cf..6f72e9c 100644 --- a/netwerk/base/NetworkInfoServiceLinux.cpp +++ b/netwerk/base/NetworkInfoServiceLinux.cpp @@ -17,6 +17,8 @@ #include "NetworkInfoServiceImpl.h" +#include "nsContentUtils.h" + namespace mozilla { namespace net { @@ -26,6 +28,10 @@ ListInterfaceAddresses(int aFd, const char* aIface, AddrMapType& aAddrMap); nsresult DoListAddresses(AddrMapType& aAddrMap) { + if (nsContentUtils::ShouldResistFingerprinting()) { + return NS_ERROR_FAILURE; + } + int fd = socket(AF_INET, SOCK_DGRAM, 0); if (fd < 0) { return NS_ERROR_FAILURE; diff --git a/netwerk/base/NetworkInfoServiceWindows.cpp b/netwerk/base/NetworkInfoServiceWindows.cpp index 2a9448e..9e01d81 100644 --- a/netwerk/base/NetworkInfoServiceWindows.cpp +++ b/netwerk/base/NetworkInfoServiceWindows.cpp @@ -12,12 +12,18 @@ #include "NetworkInfoServiceImpl.h" +#include "nsContentUtils.h" + namespace mozilla { namespace net { nsresult DoListAddresses(AddrMapType& aAddrMap) { + if (nsContentUtils::ShouldResistFingerprinting()) { + return NS_ERROR_FAILURE; + } + UniquePtr<MIB_IPADDRTABLE> ipAddrTable; DWORD size = sizeof(MIB_IPADDRTABLE);

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 12 May '17

12 May '17

commit 38e1a1966adbbcb5a15edbf300f33f5de8d7aae6 Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 15:11:46 2017 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. The old blocklist update system is still running. Thus, no need to contact the new, on Kinto based system in addition. Fixes bug 22071. --- browser/app/profile/000-tor-browser.js | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 73cb896..9483702 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -29,6 +29,10 @@ pref("extensions.hotfix.id", ""); // Bug 16837: Disable hotfix updates as they m pref("app.update.staging.enabled", false); #endif +// No need to contact the Kinto-based blocklist system in addition to the old +// one which is still used, see bug 22071. +pref("services.blocklist.update_enabled", false); + // Disable "Slow startup" warnings and associated disk history // (bug #13346) pref("browser.slowStartup.notificationDisabled", true);

1 0

[tor-browser-bundle/master] Bug 22153: Fix broken feeds on higher security levels
by gk＠torproject.org 12 May '17

12 May '17

commit f367c1dca399a1b15e3da8e098c1de2d7fd36c72 Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 14:21:04 2017 +0000 Bug 22153: Fix broken feeds on higher security levels We need to allow JavaScript on feed pages explicitly. Otherwise are those pages broken on higher security levels. --- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js index 2ad9731..53c1a25 100644 --- a/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false); diff --git a/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js index 2ad9731..53c1a25 100644 --- a/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false); diff --git a/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js index 2ad9731..53c1a25 100644 --- a/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false);

1 0