- tbb-commits - lists.torproject.org

[torbutton/master] Bug 21201.2: Isolate by firstPartyDomain from OriginAttributes
by gk＠torproject.org 04 Apr '17

04 Apr '17

commit 7fffae283aaf12d745b64a95a57ee4d8c9d05457 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Sun Jan 22 22:03:34 2017 -0800 Bug 21201.2: Isolate by firstPartyDomain from OriginAttributes --- src/components/domain-isolator.js | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) diff --git a/src/components/domain-isolator.js b/src/components/domain-isolator.js index dbdca1b..a537429 100644 --- a/src/components/domain-isolator.js +++ b/src/components/domain-isolator.js @@ -29,11 +29,6 @@ let mozilla = {}; mozilla.protocolProxyService = Cc["@mozilla.org/network/protocol-proxy-service;1"] .getService(Ci.nsIProtocolProxyService); -// __mozilla.thirdPartyUtil__. -// Mozilla's Thirdy Party Utilities, for figuring out first party domain. -mozilla.thirdPartyUtil = Cc["@mozilla.org/thirdpartyutil;1"] - .getService(Ci.mozIThirdPartyUtil); - // __mozilla.registerProxyChannelFilter(filterFunction, positionIndex)__. // Registers a proxy channel filter with the Mozilla Protocol Proxy Service, // which will help to decide the proxy to be used for a given channel. @@ -133,11 +128,8 @@ tor.isolateCircuitsByDomain = function () { return aProxy; try { - let channel = aChannel.QueryInterface(Ci.nsIChannel), - firstPartyURI = mozilla.thirdPartyUtil.getFirstPartyURIFromChannel(channel, true) - .QueryInterface(Ci.nsIURI), - firstPartyDomain = mozilla.thirdPartyUtil - .getFirstPartyHostForIsolation(firstPartyURI), + let channel = aChannel.QueryInterface(Ci.nsIChannel); + firstPartyDomain = channel.loadInfo.originAttributes.firstPartyDomain, proxy = aProxy.QueryInterface(Ci.nsIProxyInfo), replacementProxy = tor.socksProxyCredentials(aProxy, firstPartyDomain); logger.eclog(3, "tor SOCKS: " + channel.URI.spec + " via " +

1 0

[torbutton/master] Bug 21267: Remove 14429 implementation for now
by gk＠torproject.org 04 Apr '17

04 Apr '17

commit 9b5a66ce7821c0cb7f6fd2fb24e7e15e81a27c51 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Sat Mar 11 16:05:00 2017 -0800 Bug 21267: Remove 14429 implementation for now --- src/chrome/content/content-sizer.js | 514 -------------------------------- src/chrome/content/torbutton.js | 2 - src/defaults/preferences/preferences.js | 1 - 3 files changed, 517 deletions(-) diff --git a/src/chrome/content/content-sizer.js b/src/chrome/content/content-sizer.js deleted file mode 100644 index bd657b8..0000000 --- a/src/chrome/content/content-sizer.js +++ /dev/null @@ -1,514 +0,0 @@ -// The purpose of this file is to ensure that window.innerWidth and window.innerHeight -// always return rounded values. - -// This file is formatted for docco.js. Later functions call earlier ones. - -/* -TODO: -* Decide on quantization amount. 100x100? 200x100? Maybe gradually increase, like 50, 100, 150, 200, 300, 500, 600, 800, etc.? -* Understand gBrowser.contentWindow.document.body.getBoundingClientRect(). Does this leak some fingerprintable information? -* Modify Tor Browser C++ code to allow precise setting of zoom? (Would allow more precise fit of content height in window.) -*/ - -/* jshint esnext: true */ - -// __quantizeBrowserSize(window, xStep, yStep)__. -// Ensures that gBrowser width and height are multiples of -// xStep and yStep. -let quantizeBrowserSize = function (window, xStep, yStep) { -"use strict"; - -// __currentDefaultZoom__. -// The settings of gBrowser.fullZoom used to quantize the content window dimensions, -// except if the user has pressed zoom+ or zoom-. Stateful. -let currentDefaultZoom = 1; - -// ## Utilities - -// Mozilla abbreviations. -let {classes: Cc, interfaces: Ci, results: Cr, Constructor: CC, utils: Cu } = Components; - -// Use Task.jsm to avoid callback hell. -Cu.import("resource://gre/modules/Task.jsm"); - -// Make the TorButton logger available. -let logger = Cc["@torproject.org/torbutton-logger;1"] - .getService(Ci.nsISupports).wrappedJSObject; - -// __torbuttonBundle__. -// Bundle of localized strings for torbutton UI. -let torbuttonBundle = Services.strings.createBundle( - "chrome://torbutton/locale/torbutton.properties"); - -// Import utility functions -let { bindPrefAndInit, getEnv, observe } = - Cu.import("resource://torbutton/modules/utils.js", {}); - -// __windowUtils(window)__. -// See nsIDOMWindowUtils on MDN. -let windowUtils = window => window.QueryInterface(Ci.nsIInterfaceRequestor) - .getInterface(Ci.nsIDOMWindowUtils); - -// __isNumber(value)__. -// Returns true iff the value is a number. -let isNumber = x => typeof x === "number"; - -// __sortBy(array, scoreFn)__. -// Returns a copy of the array, sorted from least to best -// according to scoreFn. -let sortBy = function (array, scoreFn) { - let compareFn = (a, b) => scoreFn(a) - scoreFn(b); - return array.slice().sort(compareFn); -}; - -// __isMac__. -// Constant, set to true if we are using a Mac (Darwin). -let isMac = Services.appinfo.OS === "Darwin"; - -// __isWindows__. -// Constant, set to true if we are using Windows. -let isWindows = Services.appinfo.OS === "WINNT"; - -// __isTilingWindowManager__. -// Constant, set to true if we are using a (known) tiling window -// manager in linux. -let isTilingWindowManager = (function () { - if (isMac || isWindows) return false; - let gdmSession = getEnv("GDMSESSION"); - if (!gdmSession) return false; - let gdmSessionLower = gdmSession.toLowerCase(); - return ["9wm", "alopex", "awesome", "bspwm", "catwm", "dswm", "dwm", - "echinus", "euclid-wm", "frankenwm", "herbstluftwm", "i3", - "i3wm", "ion", "larswm", "monsterwm", "musca", "notion", - "qtile", "ratpoison", "snapwm", "spectrwm", "stumpwm", - "subtle", "tinywm", "ttwm", "wingo", "wmfs", "wmii", "xmonad"] - .filter(x => x.startsWith(gdmSessionLower)).length > 0; -})(); - -// __largestMultipleLessThan(factor, max)__. -// Returns the largest number that is a multiple of factor -// and is less or equal to max. -let largestMultipleLessThan = function (factor, max) { - return Math.max(1, Math.floor(max / factor, 1)) * factor; -}; - -// ## Task.jsm helper functions - -// __sleep(timeMs)__. -// Returns a Promise that sleeps for the specified time interval, -// and returns an Event object of type "wake". -let sleep = function (timeMs) { - return new Promise(function (resolve, reject) { - window.setTimeout(function () { - resolve(new Event("wake")); - }, timeMs); - }); -}; - -// __listen(target, eventType, useCapture, timeoutMs)__. -// Listens for a single event of eventType on target. -// Returns a Promise that resolves to an Event object, if the event fires. -// If a timeout occurs, then Promise is rejected with a "Timed out" error. -let listen = function (target, eventType, useCapture, timeoutMs) { - return new Promise(function (resolve, reject) { - let listenFunction = function (event) { - target.removeEventListener(eventType, listenFunction, useCapture); - resolve(event); - }; - target.addEventListener(eventType, listenFunction, useCapture); - if (timeoutMs !== undefined && timeoutMs !== null) { - window.setTimeout(function () { - target.removeEventListener(eventType, listenFunction, useCapture); - resolve(new Event("timeout")); - }, timeoutMs); - } - }); -}; - -// __listenForTrueResize(window, timeoutMs)__. -// Task.jsm function. Call `yield listenForTrueResize(window)` to -// wait until the window changes its outer dimensions. Ignores -// resize events where window dimensions are unchanged. Returns -// the resize event object. -let listenForTrueResize = function* (window, timeoutMs) { - let [originalWidth, originalHeight] = [window.outerWidth, window.outerHeight], - event, - finishTime = timeoutMs ? Date.now() + timeoutMs : null; - do { - event = yield listen(window, "resize", true, - finishTime ? finishTime - Date.now() : undefined); - } while (event.type === "resize" && - originalWidth === window.outerWidth && - originalHeight === window.outerHeight); - return event; -}; - -// ## Window state queries - -// __trueZoom(window)__. -// Returns the true magnification of the content in the window -// object. (In contrast, the `gBrowser.fullZoom` value is only approximated -// by the display zoom.) -let trueZoom = window => windowUtils(window).screenPixelsPerCSSPixel; - -// __systemZoom__. -// On Windows, if the user sets the DPI to be 125% or 150% (instead of 100%), -// then we get an overall zoom that needs to be accounted for. -let systemZoom = trueZoom(window); - -// __canBeResized(window)__. -// Returns true iff the window is in a state that can -// be resized. Namely, not fullscreen, not maximized, -// and not running in a tiling window manager. -let canBeResized = function (window) { - // Note that window.fullScreen and (window.windowState === window.STATE_FULLSCREEN) - // sometimes disagree, so we only allow resizing when both are false. - return !isTilingWindowManager && - !window.fullScreen && - window.windowState === window.STATE_NORMAL; -}; - -// __isDocked(window)__. -// On Windows and some linux desktops, you can "dock" a window -// at the right or left, so that it is maximized only in height. -// Returns true in this case. (Note we use mozInnerScreenY instead -// of screenY to take into account title bar space sometimes left -// out of outerHeight in certain desktop environments.) -let isDocked = window => ((window.mozInnerScreenY + window.outerHeight) >= - (window.screen.availTop + window.screen.availHeight) && - (window.screenY <= window.screen.availTop)); - -// ## Window appearance - -// __marginToolTip__. -// A constant. The tooltip string shown in the margin. -let marginToolTip = torbuttonBundle.GetStringFromName("torbutton.content_sizer.margin_tooltip"); - -// __updateContainerAppearance(container, on)__. -// Get the color and position of margins correct. -let updateContainerAppearance = function (container, on) { - // Align the browser at top left, so any gray margin will be visible - // at right and bottom. Except in fullscreen, where we have black - // margins and gBrowser in top center, and when using a tiling - // window manager, when we have gray margins and gBrowser in top - // center. - container.align = on ? - (canBeResized(window) ? "start" : "center") - : ""; - container.pack = on ? "start" : ""; - container.tooltipText = on ? marginToolTip : ""; -}; - -// __updateBackground(window)__. -// Sets the margin background to black or dim gray, depending on -// whether the window is full screen. -let updateBackground = function (window) { - window.gBrowser.parentElement.style - .backgroundColor = window.fullScreen ? "Black" : "LightGray"; -}; - -// ## Window Zooming - -// __computeTargetZoom(parentWidth, parentHeight, xStep, yStep, fillHeight)__. -// Given a parent width and height for gBrowser's container, returns the -// desired zoom for the content window. -let computeTargetZoom = function (parentWidth, parentHeight, xStep, yStep, fillHeight) { - if (fillHeight) { - // Return the estimated zoom need to fill the height of the browser. - let h = largestMultipleLessThan(yStep, parentHeight); - return parentHeight / h; - } else { - // Here we attempt to find a zoom with the best fit for the window size that will - // provide a content window with appropriately quantized dimensions. - let w = largestMultipleLessThan(xStep, parentWidth), - h = largestMultipleLessThan(yStep, parentHeight), - parentAspectRatio = parentWidth / parentHeight, - possibilities = [[w, h], - [Math.min(w, w - xStep), h], - [w, Math.min(h - yStep)]], - // Find the [w, h] pair with the closest aspect ratio to the parent window. - score = ([w, h]) => Math.abs(Math.log(w / h / parentAspectRatio)), - [W, H] = sortBy(possibilities, score)[0]; - // Return the estimated zoom. - return Math.min(parentHeight / H, parentWidth / W); - } -}; - -// __updateDimensions(window, xStep, yStep)__. -// Changes the width and height of the gBrowser XUL element to be a multiple of x/yStep. -let updateDimensions = function (window, xStep, yStep) { - // Don't run if window is minimized. - if (window.windowState === window.STATE_MINIMIZED) return; - let gBrowser = window.gBrowser, - container = gBrowser.parentElement; - updateContainerAppearance(container, true); - let parentWidth = container.clientWidth, - parentHeight = container.clientHeight, - longPage = !gBrowser.contentWindow.fullScreen, - targetZoom = (canBeResized(window) && !isDocked(window)) ? - 1 : computeTargetZoom(parentWidth, - parentHeight, xStep, yStep, longPage), - zoomOffset = 1; - for (let i = 0; i < 8; ++i) { - // We set `gBrowser.fullZoom` to 99% of the needed zoom, unless - // it's `1`. That's because the "true zoom" is sometimes larger - // than fullZoom, and we need to ensure the gBrowser width and - // height do not exceed the container size. - gBrowser.fullZoom = (targetZoom === 1 ? 1 : 0.99) * targetZoom * zoomOffset; - currentDefaultZoom = gBrowser.fullZoom; - let zoom = trueZoom(gBrowser.contentWindow) / systemZoom, - targetContentWidth = largestMultipleLessThan(xStep, parentWidth / zoom), - targetContentHeight = largestMultipleLessThan(yStep, parentHeight / zoom), - targetBrowserWidth = Math.round(targetContentWidth * zoom), - targetBrowserHeight = Math.round(targetContentHeight * zoom); - // Because gBrowser is inside a vbox, width and height behave differently. It turns - // out we need to set `gBrowser.width` and `gBrowser.maxHeight`. - gBrowser.width = targetBrowserWidth; - gBrowser.maxHeight = targetBrowserHeight; - // When using Windows DPI != 100%, we can get rounding errors. We'll need - // to try again if we failed to get rounded content width x height. - // Unfortunately, this is not detectable if search bar or dev console is open. - if ((// Some weird sidebar is open, or - gBrowser.clientWidth !== gBrowser.selectedBrowser.clientWidth || - // content width is correct. - gBrowser.contentWindow.innerWidth === targetContentWidth) && - (// Search bar or dev console is open, or - gBrowser.clientHeight !== gBrowser.selectedBrowser.clientHeight || - // content height is correct. - gBrowser.contentWindow.innerHeight === targetContentHeight)) { - logger.eclog(3, - " chromeWin " + window.outerWidth + "x" + window.outerHeight + - " container " + parentWidth + "x" + parentHeight + - " gBrowser.fullZoom " + gBrowser.fullZoom + "X" + - " targetContent " + targetContentWidth + "x" + targetContentHeight + - " zoom " + zoom + "X" + - " targetBrowser " + targetBrowserWidth + "x" + targetBrowserHeight + - " gBrowser " + gBrowser.clientWidth + "x" + gBrowser.clientHeight + - " content " + gBrowser.contentWindow.innerWidth + "x" + gBrowser.contentWindow.innerHeight); - break; - } - zoomOffset *= 1.02; - } -}; - -// __resetZoomOnDomainChanges(gBrowser, on)__. -// If `on` is true, then every time a tab location changes -// to a new domain, the tab's zoom level is set back to the -// "default zoom" level. -let resetZoomOnDomainChanges = (function () { - let tabToDomainMap = new Map(), - onLocationChange = function (browser) { - let lastHost = tabToDomainMap.get(browser), - currentHost = browser && - browser.currentURI && - browser.currentURI.asciiHost; - if (lastHost !== currentHost) { - browser.fullZoom = currentDefaultZoom; - // Record the tab's current domain, so that we - // can see when it changes. - tabToDomainMap.set(browser, currentHost); - } - }, - listener = { onLocationChange : onLocationChange }; - return function (gBrowser, on) { - if (on) { - gBrowser.addTabsProgressListener(listener); - } else { - gBrowser.removeTabsProgressListener(listener); - } - }; -})(); - -// ## Window Resizing - -// __reshape(window, {left, top, width, height}, timeoutMs)__. -// Reshapes the window to rectangle {left, top, width, height} and yields -// until the window reaches its target size, or the timeout occurs. -let reshape = function* (window, {left, top, width, height}, timeoutMs) { - let finishTime = Date.now() + timeoutMs, - x = isNumber(left) ? left : window.screenX, - y = isNumber(top) ? top : window.screenY, - w = isNumber(width) ? width : window.outerWidth, - h = isNumber(height) ? height : window.outerHeight; - // Make sure we are in a new event. - yield sleep(0); - // Sometimes we get a race condition in linux when maximizing, - // so check again at the last minute that resizing is allowed. - if (!canBeResized(window)) return; - if (w !== window.outerWidth || h !== window.outerHeight) { - window.resizeTo(w, h); - } - if (x !== window.screenX || y !== window.screenY) { - window.moveTo(x, y); - } - // Yield until we have the correct screen position and size, or - // we timeout. Multiple resize events often fire in a resize. - while (x !== window.screenX || - y !== window.screenY || - w !== window.outerWidth || - h !== window.outerHeight) { - let timeLeft = finishTime - Date.now(); - if (timeLeft <= 0) break; - yield listenForTrueResize(window, timeLeft); - } -}; - -// __gaps(window)__. -// Deltas between gBrowser and its container. Returns null if there is no gap. -let gaps = function (window) { - let gBrowser = window.gBrowser, - container = gBrowser.parentElement, - deltaWidth = Math.max(0, container.clientWidth - gBrowser.clientWidth), - deltaHeight = Math.max(0, container.clientHeight - gBrowser.clientHeight); - return (deltaWidth === 0 && deltaHeight === 0) ? null - : { deltaWidth : deltaWidth, deltaHeight : deltaHeight }; -}; - -// __shrinkwrap(window)__. -// Shrinks the window so that it encloses the gBrowser with no gaps. -let shrinkwrap = function* (window) { - // Figure out what size change we need. - let currentGaps = gaps(window), - screenRightEdge = window.screen.availWidth + window.screen.availLeft, - windowRightEdge = window.screenX + window.outerWidth; - if (currentGaps) { - // Now resize to close the gaps. - yield reshape(window, - {width : (window.outerWidth - currentGaps.deltaWidth), - // Shrink in height only if we are not docked. - height : !isDocked(window) ? - (window.outerHeight - - currentGaps.deltaHeight) : null, - left : (isDocked(window) && - (windowRightEdge >= screenRightEdge)) ? - (window.screenX + currentGaps.deltaWidth) - : null }, - 500); - } -}; - -// __rebuild(window)__. -// Jog the size of the window slightly, to remind the window manager -// to redraw the window. -let rebuild = function* (window) { - let h = window.outerHeight; - yield reshape(window, {height : (h + 1)}, 300); - yield reshape(window, {height : h}, 300); -}; - -// __fixWindow(window)__. -// An async function for Task.jsm. Makes sure the window looks okay -// given the quantized browser element. -let fixWindow = function* (window) { - if (canBeResized(window)) { - yield shrinkwrap(window); - if (!isMac && !isWindows) { - // Unfortunately, on some linux desktops, - // the window resize fails if the user is still holding on - // to the drag-resize handle. Even more unfortunately, the - // only way to know that the user if finished dragging - // if we detect the mouse cursor inside the window or the - // user presses a key. - // So, after the first mousemove, or keydown event occurs, we - // rebuild the window. - let event = yield Promise.race( - [listen(window, "mousemove", true), - listen(window, "keydown", true), - listen(window, "resize", true)]); - if (event !== "resize") { - yield rebuild(window); - } - return event; - } - } -}; - -// __autoresize(window, stepMs)__. -// Automatically resize the gBrowser, and then shrink the window -// if the user has attempted to resize it. -let autoresize = function (window, stepMs, xStep, yStep) { - let stop = false; - Task.spawn(function* () { - // Fix the content dimensions once at startup, and - // keep updating the dimensions whenever the user resizes - // the window. - while (!stop) { - updateDimensions(window, xStep, yStep); - let event = yield fixWindow(window); - // Do nothing until the user starts to resize window. - if ((!event || event.type !== "resize") && !stop) { - event = yield listenForTrueResize(window); - } - if (!isTilingWindowManager) { - while (event.type !== "timeout" && !stop) { - if (!stop) { - updateDimensions(window, xStep, yStep); - event = yield listenForTrueResize(window, stepMs); - } - } - } - // The user has likely released the mouse cursor on the window's - // drag/resize handle, so loop and call fixWindow. - } - }); - return () => { stop = true; }; -}; - -// ## Main Function - -// __quantizeBrowserSizeMain(window, xStep, yStep)__. -// Ensures that gBrowser width and height are multiples of xStep and yStep, and always as -// large as possible inside the chrome window. -let quantizeBrowserSizeMain = function (window, xStep, yStep) { - let gBrowser = window.gBrowser, - container = window.gBrowser.parentElement, - fullscreenHandler = function () { - // Use setTimeout to make sure we only update dimensions after - // full screen mode is fully established. - window.setTimeout(function () { - updateDimensions(window, xStep, yStep); - updateBackground(window); - }, 0); - }, - originalMinWidth = container.minWidth, - originalMinHeight = container.minHeight, - stopAutoresizing, - activate = function (on) { - console.log("activate:", on); - // Don't let the browser shrink below a single xStep x yStep size. - container.minWidth = on ? xStep : originalMinWidth; - container.minHeight = on ? yStep : originalMinHeight; - updateContainerAppearance(container, on); - updateBackground(window); - resetZoomOnDomainChanges(gBrowser, on); - if (on) { - shrinkwrap(window); - window.addEventListener("sizemodechange", fullscreenHandler, false); - stopAutoresizing = autoresize(window, - (isMac || isWindows) ? 250 : 500, - xStep, yStep); - console.log("activated"); - } else { - if (stopAutoresizing) stopAutoresizing(); - // Ignore future resize events. - window.removeEventListener("sizemodechange", fullscreenHandler, false); - // Let gBrowser expand with its parent vbox. - gBrowser.width = ""; - gBrowser.maxHeight = ""; - console.log("deactivated"); - } - }; - let unbind = bindPrefAndInit("extensions.torbutton.resize_windows", activate); - window.addEventListener("unload", unbind, true); -}; - -// Only start quantizing once the window has become visible. -var stopObserving = observe("xul-window-visible", function () { - if (Services.wm.getMostRecentWindow("navigator:browser") === window) { - quantizeBrowserSizeMain(window, xStep, yStep); - stopObserving(); - } -}); - -// end of quantizeBrowserSize definition -}; diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index f521a6c..abf533f 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -402,8 +402,6 @@ function torbutton_init() { m_tb_control_port, m_tb_control_pass, "extensions.torbutton.display_circuit"); - quantizeBrowserSize(window, 100, 100); - torbutton_init_user_manual_links(); torbutton_log(3, 'init completed'); diff --git a/src/defaults/preferences/preferences.js b/src/defaults/preferences/preferences.js index b9ba458..68772a5 100644 --- a/src/defaults/preferences/preferences.js +++ b/src/defaults/preferences/preferences.js @@ -34,7 +34,6 @@ pref("extensions.torbutton.spoof_english",true); pref("extensions.torbutton.clear_http_auth",true); pref("extensions.torbutton.close_newnym",true); pref("extensions.torbutton.resize_new_windows",true); -pref("extensions.torbutton.resize_windows",true); pref("extensions.torbutton.startup_state", 2); // 0=non-tor, 1=tor, 2=last pref("extensions.torbutton.tor_memory_jar",false); pref("extensions.torbutton.nontor_memory_jar",false);

1 0

[torbutton/master] Bug 21201.1: Use new svg.disabled pref
by gk＠torproject.org 04 Apr '17

04 Apr '17

commit 1b7ce9f53f6a27e8684fdcda0b3be086a914d054 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Wed Jan 11 09:21:26 2017 -0800 Bug 21201.1: Use new svg.disabled pref --- src/modules/security-prefs.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/modules/security-prefs.js b/src/modules/security-prefs.js index 4a39ca8..f508b87 100644 --- a/src/modules/security-prefs.js +++ b/src/modules/security-prefs.js @@ -29,7 +29,7 @@ const kSecuritySettings = { "noscript.global" : [, false, false, false, true ], "noscript.globalHttpsWhitelist" : [, false, true, true, false], "noscript.forbidFonts" : [, true, false, false, false], - "svg.in-content.enabled" : [, false, true, true, true ], + "svg.disabled" : [, true, false, false, false], }; // The Security Settings prefs in question.

1 0

[torbutton/master] fixup! Bug 21267: Remove 14429 implementation for now
by gk＠torproject.org 04 Apr '17

04 Apr '17

commit eadfd9622fc7a15aad5200e11a35a4f558ae5743 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Apr 4 08:59:06 2017 +0000 fixup! Bug 21267: Remove 14429 implementation for now --- src/defaults/preferences/preferences.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/defaults/preferences/preferences.js b/src/defaults/preferences/preferences.js index 68772a5..f61cb89 100644 --- a/src/defaults/preferences/preferences.js +++ b/src/defaults/preferences/preferences.js @@ -25,7 +25,7 @@ pref("extensions.torbutton.prompted_language",false); // TODO: This is just part of a stopgap until #14429 gets properly implemented. // See #7255 for details. We display the warning three times to make sure the // user did not click on it by accident. -pref("extensions.torbutton.maximize_warnings_remaining", 0); +pref("extensions.torbutton.maximize_warnings_remaining", 3); // Security prefs: pref("extensions.torbutton.cookie_protections",true);

1 0

[torbutton/master] Bug 21201: Avoid accessing contentWindow inside torbutton_resizelistener.
by gk＠torproject.org 04 Apr '17

04 Apr '17

commit 0f9c8fc79b9e0c3411c2aedf18ad24b4596172a0 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Thu Feb 9 11:37:20 2017 -0500 Bug 21201: Avoid accessing contentWindow inside torbutton_resizelistener. Also, use Cc, Ci, and Cr inside torbutton_resizelistener. --- src/chrome/content/torbutton.js | 22 +++++++--------------- 1 file changed, 7 insertions(+), 15 deletions(-) diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index 44f01f9..f521a6c 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -2204,26 +2204,16 @@ var torbutton_resizelistener = { QueryInterface: function(aIID) { - if (aIID.equals(Components.interfaces.nsIWebProgressListener) || - aIID.equals(Components.interfaces.nsISupportsWeakReference) || - aIID.equals(Components.interfaces.nsISupports)) + if (aIID.equals(Ci.nsIWebProgressListener) || + aIID.equals(Ci.nsISupportsWeakReference) || + aIID.equals(Ci.nsISupports)) return this; - throw Components.results.NS_NOINTERFACE; + throw Cr.NS_NOINTERFACE; }, onLocationChange: function(aProgress, aRequest, aURI) {}, onStateChange: function(aProgress, aRequest, aFlag, aStatus) { - if (aFlag & Components.interfaces.nsIWebProgressListener.STATE_STOP) { - var progress = - Components.classes["@mozilla.org/docloaderservice;1"]. - getService(Components.interfaces.nsIWebProgress); - var win = getBrowser().contentWindow; - if (!win || typeof(win) == "undefined") { - torbutton_log(5, "No initial browser content window?"); - progress.removeProgressListener(this); - return; - } - + if (aFlag & Ci.nsIWebProgressListener.STATE_STOP) { m_tb_resize_handler = function() { if (window.windowState === 1) { if (m_tb_prefs. @@ -2301,6 +2291,8 @@ var torbutton_resizelistener = // event got fired. Thus, we have the rather klunky setTimeout() call. window.addEventListener("sizemodechange", m_tb_resize_handler, false); + let progress = Cc["@mozilla.org/docloaderservice;1"] + .getService(Ci.nsIWebProgress); progress.removeProgressListener(this); } }, // onStateChange

1 0

[tor-browser-bundle/hardened-builds] Build gn in linux-webrtc.
by gk＠torproject.org 31 Mar '17

31 Mar '17

commit 45f6ab2698d447441095e8d388fba3a3aa855f57 Author: David Fifield <david(a)bamsoftware.com> Date: Fri Sep 23 13:14:07 2016 -0700 Build gn in linux-webrtc. There is a prebuilt gn binary for linux64, but none for linux32, and anyway we prefer to build from source for reproducibility reasons. --- gitian/descriptors/linux/gitian-webrtc.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/gitian/descriptors/linux/gitian-webrtc.yml b/gitian/descriptors/linux/gitian-webrtc.yml index f18da52..85da679 100644 --- a/gitian/descriptors/linux/gitian-webrtc.yml +++ b/gitian/descriptors/linux/gitian-webrtc.yml @@ -63,6 +63,8 @@ script: | ln -sf hardened-cc c++ cd ~/build export PATH=$INSTDIR/gcc/bin:$INSTDIR/binutils/bin:$PATH + # GN needs libatomic.so.1 here. + export LD_LIBRARY_PATH=$INSTDIR/gcc/lib ARCH="" if [ $GBUILD_BITS == "64" ]; then @@ -80,6 +82,15 @@ script: | # Building webrtc tar xaf webrtc.tar.gz cd webrtc/src + + # First, build a copy of GN, rather than use the prebuilt copy in buildtools/linux64. + cd tools/gn + # __STDC_FORMAT_MACROS is needed for a definition of PRIxPTR from inttypes.h. + CXXFLAGS=-D__STDC_FORMAT_MACROS=1 LDFLAGS=-latomic ./bootstrap/bootstrap.py --no-rebuild --no-clean + cd ../.. + # This is where bootstrap.py stashes the built gn. + GN="$PWD/out_bootstrap/gn" + export GYP_CROSSCOMPILE=1 export GYP_DEFINES="OS=linux target_arch=$(if [ $GBUILD_BITS = 32 ]; then echo ia32; else echo x64; fi)" # Do not use bundled utilities.

1 0

[tor-browser-bundle/hardened-builds] Build webrtc-linux with GN instead of GYP.
by gk＠torproject.org 31 Mar '17

31 Mar '17

commit 58801dcbb5d927d6eb35a328cb63d1912434a397 Author: David Fifield <david(a)bamsoftware.com> Date: Mon Mar 20 16:20:37 2017 -0400 Build webrtc-linux with GN instead of GYP. * Bump webrtc to branch-heads/58 * Also, bumps go-webrtc and snowflake to the latest. * Removes the need to re-run ninja for FakeAudioCaptureModule since "pc_test_utils" includes it. * Update to the new default bridge --- Bundle-Data/PTConfigs/bridge_prefs.js | 2 +- .../linux/gitian-pluggable-transports.yml | 5 +- gitian/descriptors/linux/gitian-webrtc.yml | 54 +++++++++++----------- gitian/fetch-inputs.sh | 3 -- gitian/patches/webrtc-linux.patch | 25 ++++++++++ gitian/versions | 6 +-- gitian/versions.alpha | 6 +-- gitian/versions.beta | 6 +-- gitian/versions.nightly | 2 +- 9 files changed, 68 insertions(+), 41 deletions(-) diff --git a/Bundle-Data/PTConfigs/bridge_prefs.js b/Bundle-Data/PTConfigs/bridge_prefs.js index 61e2a9e..64b7f23 100644 --- a/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/Bundle-Data/PTConfigs/bridge_prefs.js @@ -37,4 +37,4 @@ pref("extensions.torlauncher.default_bridge.obfs4.20", "obfs4 85.17.30.79:443 FC pref("extensions.torlauncher.default_bridge.meek-amazon.1", "meek 0.0.2.0:2 B9E7141C594AF25699E0079C1F0146F409495296 url=https://d2zfqthxsdq309.cloudfront.net/ front=a0.awsstatic.com"); pref("extensions.torlauncher.default_bridge.meek-azure.1", "meek 0.0.2.0:3 97700DFE9F483596DDA6264C4D7DF7641E1E39CE url=https://meek.azureedge.net/ front=ajax.aspnetcdn.com"); -pref("extensions.torlauncher.default_bridge.snowflake.1", "snowflake 0.0.3.0:1 B05EC36590AC0374F0E4D36DDA77908FD59D97F3"); +pref("extensions.torlauncher.default_bridge.snowflake.1", "snowflake 0.0.3.0:1 2B280B23E1107BB62ABFC40DDCC8824814F80A72"); diff --git a/gitian/descriptors/linux/gitian-pluggable-transports.yml b/gitian/descriptors/linux/gitian-pluggable-transports.yml index 9b4a278..65b9e33 100644 --- a/gitian/descriptors/linux/gitian-pluggable-transports.yml +++ b/gitian/descriptors/linux/gitian-pluggable-transports.yml @@ -105,6 +105,8 @@ script: | ln -sf hardened-cc c++ cd ~/build export PATH=$INSTDIR/gcc/bin:$INSTDIR/binutils/bin:$PATH + # GN needs libatomic.so.1 here. + export LD_LIBRARY_PATH=$INSTDIR/gcc/lib ARCH="" if [ $GBUILD_BITS == "64" ]; then @@ -321,7 +323,8 @@ script: | # the prebuilt libwebrtc-magic.a libraries. Since we build our own # libwebrtc-magic.a with the C++11 ABI, we have to undo that setting here, # using CGO_CXXFLAGS. - CGO_CXXFLAGS=-D_GLIBCXX_USE_CXX11_ABI=1 go install github.com/keroserene/go-webrtc + # __STDC_FORMAT_MACROS is needed for a definition of PRIxPTR from inttypes.h. + CGO_CXXFLAGS="-D_GLIBCXX_USE_CXX11_ABI=1 -D__STDC_FORMAT_MACROS=1" CGO_LDFLAGS=-latomic go install github.com/keroserene/go-webrtc cd .. # Building snowflake diff --git a/gitian/descriptors/linux/gitian-webrtc.yml b/gitian/descriptors/linux/gitian-webrtc.yml index 85da679..b5226e3 100644 --- a/gitian/descriptors/linux/gitian-webrtc.yml +++ b/gitian/descriptors/linux/gitian-webrtc.yml @@ -11,12 +11,13 @@ packages: - "hardening-wrapper" - "libasound2-dev" - "libexpat1-dev" +- "libglib2.0-dev" +- "libgtk2.0-dev" - "libudev-dev" - "libx11-dev" - "libxext-dev" - "libxrandr-dev" -- "default-jre-headless" -- "default-jdk" +- "pkg-config" reference_datetime: "2000-01-01 00:00:00" remotes: - "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git" @@ -26,6 +27,7 @@ files: - "binutils-linux64-utils.zip" - "gcc-linux64-utils.zip" - "webrtc.tar.gz" +- "webrtc-linux.patch" script: | INSTDIR="$HOME/install" export REFERENCE_DATETIME @@ -82,6 +84,7 @@ script: | # Building webrtc tar xaf webrtc.tar.gz cd webrtc/src + patch -p1 < ../../webrtc-linux.patch # First, build a copy of GN, rather than use the prebuilt copy in buildtools/linux64. cd tools/gn @@ -91,32 +94,31 @@ script: | # This is where bootstrap.py stashes the built gn. GN="$PWD/out_bootstrap/gn" - export GYP_CROSSCOMPILE=1 - export GYP_DEFINES="OS=linux target_arch=$(if [ $GBUILD_BITS = 32 ]; then echo ia32; else echo x64; fi)" + export GN_ARGS="" + # For a list of all possible GN args, do "gn gen out/Release; gn args --list out/Release". + # https://chromium.googlesource.com/chromium/src/+/master/tools/gn/docs/cross… + GN_ARGS+=" target_os=\"linux\" target_cpu=\"$(if [ $GBUILD_BITS = 32 ]; then echo x86; else echo x64; fi)\"" + # Not debug. + GN_ARGS+=" is_debug=false" + # There are warnings from unused returns. + GN_ARGS+=" treat_warnings_as_errors=false" + # Build static libraries. + GN_ARGS+=" is_component_build=false" # Do not use bundled utilities. - GYP_DEFINES+=" clang=0 host_clang=0 use_sysroot=0" - GYP_DEFINES+=" linux_use_bundled_gold=0 linux_use_gold_flags=0 linux_use_bundled_binutils=0" - # Avoid some dependencies. Some of these don't seem to work fully; for - # example even with use_alsa=0 we need libasound2-dev. - GYP_DEFINES+=" use_x11=0 use_gtk=0 use_gconf=0 use_alsa=0 use_pulseaudio=0 use_libpci=0 include_internal_audio_device=0 enabled_libjingle_device_manager=0" - # examples and tests also bring in dependencies. - GYP_DEFINES+=" include_examples=0 include_tests=0" - # embedded=1 is supposed to turn of various features; see - # https://bugs.chromium.org/p/chromium/issues/detail?id=318413. - GYP_DEFINES+=" embedded=1" - GYP_DEFINES+=" werror=" - JAVA_HOME=/usr/lib/jvm/default-java webrtc/build/gyp_webrtc.py - ninja -C out/Release - # Run ninja once more, without include_tests=0, in order to build just the - # FakeAudioCaptureModule that go-webrtc uses. - GYP_DEFINES="$(echo "$GYP_DEFINES" | sed -e 's/include_tests=0//g')" - JAVA_HOME=/usr/lib/jvm/default-java webrtc/build/gyp_webrtc.py - ninja -C out/Release obj/webrtc/api/test/peerconnection_unittests.fakeaudiocapturemodule.o + GN_ARGS+=" is_clang=false use_sysroot=false" + GN_ARGS+=" gold_path=\"$INSTDIR/binutils/bin\"" + # Make extra sure we don't use bundled binutils. + rm -rf third_party/binutils/Linux_* + # Avoid some dependencies. + GN_ARGS+=" use_ozone=true use_gconf=false" + GN_ARGS+=" rtc_include_opus=false rtc_include_ilbc=false rtc_include_internal_audio_device=false rtc_include_pulse_audio=false" + # Included for "field_trial" below. Maybe "fieldtrial_testing_like_official_build" could help here? + #GN_ARGS+=" rtc_include_tests=false" + rm -rf out/Release + "$GN" gen out/Release --args="$GN_ARGS" + ninja -C out/Release webrtc field_trial metrics_default pc_test_utils # https://github.com/keroserene/go-webrtc/issues/23#issuecomment-175312648 - # dump_syms_regtest.o is actually an executable, not an object file. If not - # excluded, it results in the error: - # libwebrtc-linux-386-magic.a(dump_syms_regtest.o): unsupported ELF file type 2 - ar crs libwebrtc-magic.a $(find . -name '*.o' -not -name '*.main.o' -not -name 'dump_syms_regtest.o' | sort) + ar crs libwebrtc-magic.a $(find . -name '*.o' -not -name '*.main.o' | sort) cd ../.. # Grabbing the result diff --git a/gitian/fetch-inputs.sh b/gitian/fetch-inputs.sh index 9059336..e70eb4c 100755 --- a/gitian/fetch-inputs.sh +++ b/gitian/fetch-inputs.sh @@ -309,10 +309,7 @@ cd .. # depot_tools must have been downloaded before running this code. dir=webrtc PATH="$PATH:$PWD/depot_tools" -# GYP_CROSSCOMPILE=1 and GYP_DEFINES="use_x11=0" prevent probing for certain dependencies. # Use --no-history because the whole checkout with history is about 12 GB. -export GYP_CROSSCOMPILE=1 -export GYP_DEFINES="use_x11=0" # JAVA_HOME is needed in a hook for libjingle. The readlink line tries to find the current JRE. # default-java comes from the package default-jdk-headless. export JAVA_HOME=/usr/lib/jvm/default-java diff --git a/gitian/patches/webrtc-linux.patch b/gitian/patches/webrtc-linux.patch new file mode 100644 index 0000000..b1efb7a --- /dev/null +++ b/gitian/patches/webrtc-linux.patch @@ -0,0 +1,25 @@ +From ebc1773a92884bec7d93274b2d729ccf76050197 Mon Sep 17 00:00:00 2001 +From: David Fifield <fifield(a)eecs.berkeley.edu> +Date: Wed, 22 Mar 2017 09:53:07 -0400 +Subject: [PATCH] Disable some settings in build_overrides. + +--- + build_overrides/build.gni | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/build_overrides/build.gni b/build_overrides/build.gni +index af4924d4c..ffaafdebc 100644 +--- a/build_overrides/build.gni ++++ b/build_overrides/build.gni +@@ -14,7 +14,7 @@ mac_sdk_min_build_override = "10.11" + enable_java_templates = true + + # Some non-Chromium builds don't use Chromium's third_party/binutils. +-linux_use_bundled_binutils_override = true ++linux_use_bundled_binutils_override = false + + # Variable that can be used to support multiple build scenarios, like having + # Chromium specific targets in a client project's GN file etc. +-- +2.12.1 + diff --git a/gitian/versions b/gitian/versions index 1b88910..a1f8bff 100755 --- a/gitian/versions +++ b/gitian/versions @@ -42,9 +42,9 @@ GO_X_NET_TAG=7dbad50ab5b31073856416cdcfeb2796d682f844 OBFS4_TAG=obfs4proxy-0.0.5 NOTOFONTS_TAG=720e34851382ee3c1ef024d8dffb68ffbfb234c2 DEPOT_TOOLS_TAG=28216cd14b44716db5c83634afbdc6e90492652b -WEBRTC_TAG=f33698296719f956497d2dbff81b5080864a8804 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/52 -GO_WEBRTC_TAG=69c5ca70533142494d145b43ef2f46ca94715557 -SNOWFLAKE_TAG=6cecd31fd896eb26e64ad8bab8a9ea510ec3b21d +WEBRTC_TAG=c279861207c5b15fc51069e96595782350e0ac12 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/58 +GO_WEBRTC_TAG=ab1b64862e0c4b4182010699911c2c5818f0a101 +SNOWFLAKE_TAG=9f2e9a6ecb696149708716ca06ce842df03cf492 UNIURI_TAG=8902c56451e9b58ff940bbe5fec35d5f9c04584a GITIAN_TAG=tor-browser-builder-3.x-8 diff --git a/gitian/versions.alpha b/gitian/versions.alpha index e3352c4..145c9f9 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -48,9 +48,9 @@ OBFS4_TAG=obfs4proxy-0.0.5 NOTOFONTS_TAG=720e34851382ee3c1ef024d8dffb68ffbfb234c2 SELFRANDO_TAG=44ac0df8c0e8eb291f2d913e2dd147000bf54863 DEPOT_TOOLS_TAG=28216cd14b44716db5c83634afbdc6e90492652b -WEBRTC_TAG=f33698296719f956497d2dbff81b5080864a8804 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/52 -GO_WEBRTC_TAG=69c5ca70533142494d145b43ef2f46ca94715557 -SNOWFLAKE_TAG=6cecd31fd896eb26e64ad8bab8a9ea510ec3b21d +WEBRTC_TAG=c279861207c5b15fc51069e96595782350e0ac12 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/58 +GO_WEBRTC_TAG=ab1b64862e0c4b4182010699911c2c5818f0a101 +SNOWFLAKE_TAG=9f2e9a6ecb696149708716ca06ce842df03cf492 UNIURI_TAG=8902c56451e9b58ff940bbe5fec35d5f9c04584a GITIAN_TAG=tor-browser-builder-4-1 diff --git a/gitian/versions.beta b/gitian/versions.beta index a9c988e..65b6546 100755 --- a/gitian/versions.beta +++ b/gitian/versions.beta @@ -31,9 +31,9 @@ GOPTLIB_TAG=0.2 MEEK_TAG=0.25 NOTOFONTS_TAG=720e34851382ee3c1ef024d8dffb68ffbfb234c2 DEPOT_TOOLS_TAG=28216cd14b44716db5c83634afbdc6e90492652b -WEBRTC_TAG=f33698296719f956497d2dbff81b5080864a8804 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/52 -GO_WEBRTC_TAG=69c5ca70533142494d145b43ef2f46ca94715557 -SNOWFLAKE_TAG=6cecd31fd896eb26e64ad8bab8a9ea510ec3b21d +WEBRTC_TAG=c279861207c5b15fc51069e96595782350e0ac12 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/58 +GO_WEBRTC_TAG=ab1b64862e0c4b4182010699911c2c5818f0a101 +SNOWFLAKE_TAG=9f2e9a6ecb696149708716ca06ce842df03cf492 UNIURI_TAG=8902c56451e9b58ff940bbe5fec35d5f9c04584a GITIAN_TAG=tor-browser-builder-3.x-6 diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 042095a..5fde922 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -51,7 +51,7 @@ OBFS4_TAG=master NOTOFONTS_TAG=720e34851382ee3c1ef024d8dffb68ffbfb234c2 SELFRANDO_TAG=44ac0df8c0e8eb291f2d913e2dd147000bf54863 DEPOT_TOOLS_TAG=master -WEBRTC_TAG=f33698296719f956497d2dbff81b5080864a8804 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/52 +WEBRTC_TAG=c279861207c5b15fc51069e96595782350e0ac12 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/58 GO_WEBRTC_TAG=master SNOWFLAKE_TAG=master UNIURI_TAG=master

1 0

[tor-browser-bundle/master] Build gn in linux-webrtc.
by gk＠torproject.org 31 Mar '17

31 Mar '17

commit 38689af2a845dfa85765bf52e535c89476863378 Author: David Fifield <david(a)bamsoftware.com> Date: Fri Sep 23 13:14:07 2016 -0700 Build gn in linux-webrtc. There is a prebuilt gn binary for linux64, but none for linux32, and anyway we prefer to build from source for reproducibility reasons. --- gitian/descriptors/linux/gitian-webrtc.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/gitian/descriptors/linux/gitian-webrtc.yml b/gitian/descriptors/linux/gitian-webrtc.yml index ba654c5..cab2430 100644 --- a/gitian/descriptors/linux/gitian-webrtc.yml +++ b/gitian/descriptors/linux/gitian-webrtc.yml @@ -66,6 +66,8 @@ script: | ln -sf hardened-cc c++ cd ~/build export PATH=$INSTDIR/gcc/bin:$INSTDIR/binutils/bin:$PATH + # GN needs libatomic.so.1 here. + export LD_LIBRARY_PATH=$INSTDIR/gcc/lib ARCH="" if [ $GBUILD_BITS == "64" ]; then @@ -83,6 +85,15 @@ script: | # Building webrtc tar xaf webrtc.tar.gz cd webrtc/src + + # First, build a copy of GN, rather than use the prebuilt copy in buildtools/linux64. + cd tools/gn + # __STDC_FORMAT_MACROS is needed for a definition of PRIxPTR from inttypes.h. + CXXFLAGS=-D__STDC_FORMAT_MACROS=1 LDFLAGS=-latomic ./bootstrap/bootstrap.py --no-rebuild --no-clean + cd ../.. + # This is where bootstrap.py stashes the built gn. + GN="$PWD/out_bootstrap/gn" + export GYP_CROSSCOMPILE=1 export GYP_DEFINES="OS=linux target_arch=$(if [ $GBUILD_BITS = 32 ]; then echo ia32; else echo x64; fi)" # Do not use bundled utilities.

1 0

[tor-browser-bundle/master] Build webrtc-linux with GN instead of GYP.
by gk＠torproject.org 31 Mar '17

31 Mar '17

commit 121de1ca7cbee29f34f99753a7948c7447e38965 Author: David Fifield <david(a)bamsoftware.com> Date: Mon Mar 20 16:20:37 2017 -0400 Build webrtc-linux with GN instead of GYP. * Bump webrtc to branch-heads/58 * Also, bumps go-webrtc and snowflake to the latest. * Removes the need to re-run ninja for FakeAudioCaptureModule since "pc_test_utils" includes it. * Update to the new default bridge --- Bundle-Data/PTConfigs/bridge_prefs.js | 2 +- .../linux/gitian-pluggable-transports.yml | 5 +- gitian/descriptors/linux/gitian-webrtc.yml | 54 +++++++++++----------- gitian/fetch-inputs.sh | 3 -- gitian/patches/webrtc-linux.patch | 25 ++++++++++ gitian/versions | 6 +-- gitian/versions.alpha | 6 +-- gitian/versions.beta | 6 +-- gitian/versions.nightly | 2 +- 9 files changed, 68 insertions(+), 41 deletions(-) diff --git a/Bundle-Data/PTConfigs/bridge_prefs.js b/Bundle-Data/PTConfigs/bridge_prefs.js index 61e2a9e..64b7f23 100644 --- a/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/Bundle-Data/PTConfigs/bridge_prefs.js @@ -37,4 +37,4 @@ pref("extensions.torlauncher.default_bridge.obfs4.20", "obfs4 85.17.30.79:443 FC pref("extensions.torlauncher.default_bridge.meek-amazon.1", "meek 0.0.2.0:2 B9E7141C594AF25699E0079C1F0146F409495296 url=https://d2zfqthxsdq309.cloudfront.net/ front=a0.awsstatic.com"); pref("extensions.torlauncher.default_bridge.meek-azure.1", "meek 0.0.2.0:3 97700DFE9F483596DDA6264C4D7DF7641E1E39CE url=https://meek.azureedge.net/ front=ajax.aspnetcdn.com"); -pref("extensions.torlauncher.default_bridge.snowflake.1", "snowflake 0.0.3.0:1 B05EC36590AC0374F0E4D36DDA77908FD59D97F3"); +pref("extensions.torlauncher.default_bridge.snowflake.1", "snowflake 0.0.3.0:1 2B280B23E1107BB62ABFC40DDCC8824814F80A72"); diff --git a/gitian/descriptors/linux/gitian-pluggable-transports.yml b/gitian/descriptors/linux/gitian-pluggable-transports.yml index ecf49de..cd936d5 100644 --- a/gitian/descriptors/linux/gitian-pluggable-transports.yml +++ b/gitian/descriptors/linux/gitian-pluggable-transports.yml @@ -113,6 +113,8 @@ script: | ln -sf hardened-cc c++ cd ~/build export PATH=$INSTDIR/gcc/bin:$INSTDIR/binutils/bin:$PATH + # GN needs libatomic.so.1 here. + export LD_LIBRARY_PATH=$INSTDIR/gcc/lib ARCH="" if [ $GBUILD_BITS == "64" ]; then @@ -309,7 +311,8 @@ script: | # the prebuilt libwebrtc-magic.a libraries. Since we build our own # libwebrtc-magic.a with the C++11 ABI, we have to undo that setting here, # using CGO_CXXFLAGS. - CGO_CXXFLAGS=-D_GLIBCXX_USE_CXX11_ABI=1 go install github.com/keroserene/go-webrtc + # __STDC_FORMAT_MACROS is needed for a definition of PRIxPTR from inttypes.h. + CGO_CXXFLAGS="-D_GLIBCXX_USE_CXX11_ABI=1 -D__STDC_FORMAT_MACROS=1" CGO_LDFLAGS=-latomic go install github.com/keroserene/go-webrtc cd .. # Building snowflake diff --git a/gitian/descriptors/linux/gitian-webrtc.yml b/gitian/descriptors/linux/gitian-webrtc.yml index cab2430..0622fee 100644 --- a/gitian/descriptors/linux/gitian-webrtc.yml +++ b/gitian/descriptors/linux/gitian-webrtc.yml @@ -12,12 +12,13 @@ packages: - "hardening-wrapper" - "libasound2-dev" - "libexpat1-dev" +- "libglib2.0-dev" +- "libgtk2.0-dev" - "libudev-dev" - "libx11-dev" - "libxext-dev" - "libxrandr-dev" -- "default-jre-headless" -- "default-jdk" +- "pkg-config" reference_datetime: "2000-01-01 00:00:00" remotes: - "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git" @@ -29,6 +30,7 @@ files: - "gcc-linux32-utils.zip" - "gcc-linux64-utils.zip" - "webrtc.tar.gz" +- "webrtc-linux.patch" script: | INSTDIR="$HOME/install" export REFERENCE_DATETIME @@ -85,6 +87,7 @@ script: | # Building webrtc tar xaf webrtc.tar.gz cd webrtc/src + patch -p1 < ../../webrtc-linux.patch # First, build a copy of GN, rather than use the prebuilt copy in buildtools/linux64. cd tools/gn @@ -94,32 +97,31 @@ script: | # This is where bootstrap.py stashes the built gn. GN="$PWD/out_bootstrap/gn" - export GYP_CROSSCOMPILE=1 - export GYP_DEFINES="OS=linux target_arch=$(if [ $GBUILD_BITS = 32 ]; then echo ia32; else echo x64; fi)" + export GN_ARGS="" + # For a list of all possible GN args, do "gn gen out/Release; gn args --list out/Release". + # https://chromium.googlesource.com/chromium/src/+/master/tools/gn/docs/cross… + GN_ARGS+=" target_os=\"linux\" target_cpu=\"$(if [ $GBUILD_BITS = 32 ]; then echo x86; else echo x64; fi)\"" + # Not debug. + GN_ARGS+=" is_debug=false" + # There are warnings from unused returns. + GN_ARGS+=" treat_warnings_as_errors=false" + # Build static libraries. + GN_ARGS+=" is_component_build=false" # Do not use bundled utilities. - GYP_DEFINES+=" clang=0 host_clang=0 use_sysroot=0" - GYP_DEFINES+=" linux_use_bundled_gold=0 linux_use_gold_flags=0 linux_use_bundled_binutils=0" - # Avoid some dependencies. Some of these don't seem to work fully; for - # example even with use_alsa=0 we need libasound2-dev. - GYP_DEFINES+=" use_x11=0 use_gtk=0 use_gconf=0 use_alsa=0 use_pulseaudio=0 use_libpci=0 include_internal_audio_device=0 enabled_libjingle_device_manager=0" - # examples and tests also bring in dependencies. - GYP_DEFINES+=" include_examples=0 include_tests=0" - # embedded=1 is supposed to turn of various features; see - # https://bugs.chromium.org/p/chromium/issues/detail?id=318413. - GYP_DEFINES+=" embedded=1" - GYP_DEFINES+=" werror=" - JAVA_HOME=/usr/lib/jvm/default-java webrtc/build/gyp_webrtc.py - ninja -C out/Release - # Run ninja once more, without include_tests=0, in order to build just the - # FakeAudioCaptureModule that go-webrtc uses. - GYP_DEFINES="$(echo "$GYP_DEFINES" | sed -e 's/include_tests=0//g')" - JAVA_HOME=/usr/lib/jvm/default-java webrtc/build/gyp_webrtc.py - ninja -C out/Release obj/webrtc/api/test/peerconnection_unittests.fakeaudiocapturemodule.o + GN_ARGS+=" is_clang=false use_sysroot=false" + GN_ARGS+=" gold_path=\"$INSTDIR/binutils/bin\"" + # Make extra sure we don't use bundled binutils. + rm -rf third_party/binutils/Linux_* + # Avoid some dependencies. + GN_ARGS+=" use_ozone=true use_gconf=false" + GN_ARGS+=" rtc_include_opus=false rtc_include_ilbc=false rtc_include_internal_audio_device=false rtc_include_pulse_audio=false" + # Included for "field_trial" below. Maybe "fieldtrial_testing_like_official_build" could help here? + #GN_ARGS+=" rtc_include_tests=false" + rm -rf out/Release + "$GN" gen out/Release --args="$GN_ARGS" + ninja -C out/Release webrtc field_trial metrics_default pc_test_utils # https://github.com/keroserene/go-webrtc/issues/23#issuecomment-175312648 - # dump_syms_regtest.o is actually an executable, not an object file. If not - # excluded, it results in the error: - # libwebrtc-linux-386-magic.a(dump_syms_regtest.o): unsupported ELF file type 2 - ar crs libwebrtc-magic.a $(find . -name '*.o' -not -name '*.main.o' -not -name 'dump_syms_regtest.o' | sort) + ar crs libwebrtc-magic.a $(find . -name '*.o' -not -name '*.main.o' | sort) cd ../.. # Grabbing the result diff --git a/gitian/fetch-inputs.sh b/gitian/fetch-inputs.sh index b97a577..f141381 100755 --- a/gitian/fetch-inputs.sh +++ b/gitian/fetch-inputs.sh @@ -314,10 +314,7 @@ cd .. # depot_tools must have been downloaded before running this code. dir=webrtc PATH="$PATH:$PWD/depot_tools" -# GYP_CROSSCOMPILE=1 and GYP_DEFINES="use_x11=0" prevent probing for certain dependencies. # Use --no-history because the whole checkout with history is about 12 GB. -export GYP_CROSSCOMPILE=1 -export GYP_DEFINES="use_x11=0" # JAVA_HOME is needed in a hook for libjingle. The readlink line tries to find the current JRE. # default-java comes from the package default-jdk-headless. export JAVA_HOME=/usr/lib/jvm/default-java diff --git a/gitian/patches/webrtc-linux.patch b/gitian/patches/webrtc-linux.patch new file mode 100644 index 0000000..b1efb7a --- /dev/null +++ b/gitian/patches/webrtc-linux.patch @@ -0,0 +1,25 @@ +From ebc1773a92884bec7d93274b2d729ccf76050197 Mon Sep 17 00:00:00 2001 +From: David Fifield <fifield(a)eecs.berkeley.edu> +Date: Wed, 22 Mar 2017 09:53:07 -0400 +Subject: [PATCH] Disable some settings in build_overrides. + +--- + build_overrides/build.gni | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/build_overrides/build.gni b/build_overrides/build.gni +index af4924d4c..ffaafdebc 100644 +--- a/build_overrides/build.gni ++++ b/build_overrides/build.gni +@@ -14,7 +14,7 @@ mac_sdk_min_build_override = "10.11" + enable_java_templates = true + + # Some non-Chromium builds don't use Chromium's third_party/binutils. +-linux_use_bundled_binutils_override = true ++linux_use_bundled_binutils_override = false + + # Variable that can be used to support multiple build scenarios, like having + # Chromium specific targets in a client project's GN file etc. +-- +2.12.1 + diff --git a/gitian/versions b/gitian/versions index 91bea14..69abeb3 100755 --- a/gitian/versions +++ b/gitian/versions @@ -42,9 +42,9 @@ GO_X_NET_TAG=7dbad50ab5b31073856416cdcfeb2796d682f844 OBFS4_TAG=obfs4proxy-0.0.5 NOTOFONTS_TAG=720e34851382ee3c1ef024d8dffb68ffbfb234c2 DEPOT_TOOLS_TAG=28216cd14b44716db5c83634afbdc6e90492652b -WEBRTC_TAG=f33698296719f956497d2dbff81b5080864a8804 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/52 -GO_WEBRTC_TAG=69c5ca70533142494d145b43ef2f46ca94715557 -SNOWFLAKE_TAG=6cecd31fd896eb26e64ad8bab8a9ea510ec3b21d +WEBRTC_TAG=c279861207c5b15fc51069e96595782350e0ac12 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/58 +GO_WEBRTC_TAG=ab1b64862e0c4b4182010699911c2c5818f0a101 +SNOWFLAKE_TAG=9f2e9a6ecb696149708716ca06ce842df03cf492 UNIURI_TAG=8902c56451e9b58ff940bbe5fec35d5f9c04584a GITIAN_TAG=tor-browser-builder-4-1 diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 6c06648..3539d59 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -45,9 +45,9 @@ ERRORS_TAG=248dadf4e9068a0b3e79f02ed0a610d935de5302 GB_TAG=06cc925cce6592e922dcc4839a8b44feb384e71e SANDBOX_TAG=sandboxed-tor-browser-0.0.3 DEPOT_TOOLS_TAG=28216cd14b44716db5c83634afbdc6e90492652b -WEBRTC_TAG=f33698296719f956497d2dbff81b5080864a8804 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/52 -GO_WEBRTC_TAG=69c5ca70533142494d145b43ef2f46ca94715557 -SNOWFLAKE_TAG=6cecd31fd896eb26e64ad8bab8a9ea510ec3b21d +WEBRTC_TAG=c279861207c5b15fc51069e96595782350e0ac12 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/58 +GO_WEBRTC_TAG=ab1b64862e0c4b4182010699911c2c5818f0a101 +SNOWFLAKE_TAG=9f2e9a6ecb696149708716ca06ce842df03cf492 UNIURI_TAG=8902c56451e9b58ff940bbe5fec35d5f9c04584a GITIAN_TAG=tor-browser-builder-4-2 diff --git a/gitian/versions.beta b/gitian/versions.beta index b1342b9..d7db1fd 100755 --- a/gitian/versions.beta +++ b/gitian/versions.beta @@ -30,9 +30,9 @@ GOPTLIB_TAG=0.2 MEEK_TAG=0.25 NOTOFONTS_TAG=720e34851382ee3c1ef024d8dffb68ffbfb234c2 DEPOT_TOOLS_TAG=28216cd14b44716db5c83634afbdc6e90492652b -WEBRTC_TAG=f33698296719f956497d2dbff81b5080864a8804 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/52 -GO_WEBRTC_TAG=69c5ca70533142494d145b43ef2f46ca94715557 -SNOWFLAKE_TAG=6cecd31fd896eb26e64ad8bab8a9ea510ec3b21d +WEBRTC_TAG=c279861207c5b15fc51069e96595782350e0ac12 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/58 +GO_WEBRTC_TAG=ab1b64862e0c4b4182010699911c2c5818f0a101 +SNOWFLAKE_TAG=9f2e9a6ecb696149708716ca06ce842df03cf492 UNIURI_TAG=8902c56451e9b58ff940bbe5fec35d5f9c04584a GITIAN_TAG=tor-browser-builder-3.x-6 diff --git a/gitian/versions.nightly b/gitian/versions.nightly index b9779e2..2045034 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -52,7 +52,7 @@ ERRORS_TAG=248dadf4e9068a0b3e79f02ed0a610d935de5302 GB_TAG=06cc925cce6592e922dcc4839a8b44feb384e71e SANDBOX_TAG=master DEPOT_TOOLS_TAG=master -WEBRTC_TAG=f33698296719f956497d2dbff81b5080864a8804 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/52 +WEBRTC_TAG=c279861207c5b15fc51069e96595782350e0ac12 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/58 GO_WEBRTC_TAG=master SNOWFLAKE_TAG=master UNIURI_TAG=master

1 0

[tor-browser-build/master] README: add missing dependencies
by boklm＠torproject.org 31 Mar '17

31 Mar '17

commit 041df309831d73f69b7f2fc47b15211dda7e5e31 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri Mar 31 12:57:04 2017 +0200 README: add missing dependencies --- README | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/README b/README index 07725cf..08904fb 100644 --- a/README +++ b/README @@ -15,7 +15,7 @@ also be running. The sources of most components are downloaded using git, which needs to be installed. The sources of webrtc are downloaded using gclient, which -requires GTK+ 2.0 development files to be installed. +requires GTK+ 2.0 development files and curl to be installed. You also need a few perl modules installed: - YAML::XS @@ -27,6 +27,7 @@ You also need a few perl modules installed: - File::Temp - File::Slurp - File::Path +- File::Copy::Recursive - String::ShellQuote - Sort::Versions - Digest::SHA @@ -40,7 +41,7 @@ If you are running Debian or Ubuntu, you can install them with: libio-captureoutput-perl libfile-slurp-perl \ libstring-shellquote-perl libsort-versions-perl \ libdigest-sha-perl libdata-uuid-perl libdata-dump-perl \ - git libgtk2.0-dev + libfile-copy-recursive-perl git libgtk2.0-dev curl Starting a build

1 0

[tor-launcher/master] Bug 21546: Tor Launcher is multiprocessCompatible
by gk＠torproject.org 29 Mar '17

29 Mar '17

commit 336e7c8731296866dd67a090c010e41fcc26ef69 Author: Georg Koppen <gk(a)torproject.org> Date: Sun Mar 12 20:39:27 2017 +0000 Bug 21546: Tor Launcher is multiprocessCompatible --- src/install.rdf | 1 + 1 file changed, 1 insertion(+) diff --git a/src/install.rdf b/src/install.rdf index 493d976..881aa8a 100644 --- a/src/install.rdf +++ b/src/install.rdf @@ -8,6 +8,7 @@ <em:contributor>Pearl Crescent, LLC</em:contributor> <em:id>tor-launcher(a)torproject.org</em:id> <em:version>0.2.11.1</em:version> + <em:multiprocessCompatible>true</em:multiprocessCompatible> <em:homepageURL>https://www.torproject.org/projects/torbrowser.html</em:homepageURL> <em:updateURL>data:text/plain,</em:updateURL> <em:updateKey>-</em:updateKey>

1 0

[tor-browser-build/master] HTTPS Everywhere: Version bump - 5.2.13
by boklm＠torproject.org 26 Mar '17

26 Mar '17

commit bfc288d54a28f00e088ba9ce08bd718156d8ff2f Author: William Budington <bill(a)eff.org> Date: Sun Mar 26 07:12:49 2017 -0700 HTTPS Everywhere: Version bump - 5.2.13 --- projects/https-everywhere/config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/https-everywhere/config b/projects/https-everywhere/config index 17f9f82..7ef8568 100644 --- a/projects/https-everywhere/config +++ b/projects/https-everywhere/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 5.2.11 +version: 5.2.13 git_url: https://git.torproject.org/https-everywhere.git git_hash: '[% c("version") %]' git_submodule: 1

1 0

[tor-browser-build/master] README: Add libgtk2.0-dev to the list of dependencies
by boklm＠torproject.org 26 Mar '17

26 Mar '17

commit 29f7cffa1199dd89da17a6d7792fe7f265d05a42 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Sun Mar 26 14:45:01 2017 +0200 README: Add libgtk2.0-dev to the list of dependencies --- README | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/README b/README index f4a74e0..07725cf 100644 --- a/README +++ b/README @@ -13,7 +13,9 @@ Your user account should have access to the docker command without using sudo, so it should be in the docker group. The docker daemon should also be running. -The sources are downloaded using git which needs to be installed. +The sources of most components are downloaded using git, which needs to +be installed. The sources of webrtc are downloaded using gclient, which +requires GTK+ 2.0 development files to be installed. You also need a few perl modules installed: - YAML::XS @@ -38,7 +40,7 @@ If you are running Debian or Ubuntu, you can install them with: libio-captureoutput-perl libfile-slurp-perl \ libstring-shellquote-perl libsort-versions-perl \ libdigest-sha-perl libdata-uuid-perl libdata-dump-perl \ - git + git libgtk2.0-dev Starting a build

1 0

[tor-browser-build/master] Bug 21655: add a script to clean old built components
by boklm＠torproject.org 20 Mar '17

20 Mar '17

commit 5d046ea3c4af539e36a886ee3a7b03c07f5d7b48 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Mar 20 18:29:03 2017 +0100 Bug 21655: add a script to clean old built components --- Makefile | 5 ++- README | 10 ++++- rbm | 2 +- rbm.local.conf.example | 28 ++++++++++++ tools/clean-old | 114 +++++++++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 155 insertions(+), 4 deletions(-) diff --git a/Makefile b/Makefile index 9481537..b82309c 100644 --- a/Makefile +++ b/Makefile @@ -86,6 +86,9 @@ submodule-update: fetch: submodule-update $(rbm) fetch -clean-old: submodule-update +clean: submodule-update ./tools/clean-old +clean-dry-run: submodule-update + ./tools/clean-old --dry-run + diff --git a/README b/README index a14fb42..f4a74e0 100644 --- a/README +++ b/README @@ -171,8 +171,14 @@ file. Cleaning obsolete files and containers images --------------------------------------------- -There will be a script to clean old build files and containers that are -no longer used, but it has not been added yet. +You can run 'make clean' to clean old build files and containers that +are no longer used in current builds. Before doing that, you need to +configure the branches and build targets you are using in the +rbm.local.conf file. The cleaning script will checkout all the configured +branches to create a list of used build files, and delete the files +from the 'out' directory that are not used. If you want to see the list +of files and containers that would be removed without doing it, you can +use 'make clean-dry-run'. Multiple build directories on the same host diff --git a/rbm b/rbm index 845bb90..3f3886e 160000 --- a/rbm +++ b/rbm @@ -1 +1 @@ -Subproject commit 845bb904fb87b6c56ab789f35cd02bce32453f52 +Subproject commit 3f3886e1f210ad2853209c5aecd0951350a6f758 diff --git a/rbm.local.conf.example b/rbm.local.conf.example index 2a86647..78de08f 100644 --- a/rbm.local.conf.example +++ b/rbm.local.conf.example @@ -39,6 +39,34 @@ var: ### file. #sign_build_gpg_opts: '--local-user XXXXXXXX' + ### The clean configuration is used by the cleaning script to find the + ### branches and build targets you are using, to compute the list of + ### files that should be kept. + ### + ### If you only do alpha builds for all platforms, you can use the + ### following configuration: + #clean: + # HEAD: + # - project: release + # target: + # - alpha + # - torbrowser-all + # + ### If you are doing 'release' builds in the maint-7.0 branch and + ### 'alpha' builds in the master branch, you can use the following + ### configuration: + #clean: + # master: + # - project: release + # target: + # - alpha + # - torbrowser-all + # maint-7.0: + # - project: release + # target: + # - release + # - torbrowser-all + targets: ### testbuild is based on alpha by default. Uncomment this if you want it diff --git a/tools/clean-old b/tools/clean-old new file mode 100755 index 0000000..4d603fc --- /dev/null +++ b/tools/clean-old @@ -0,0 +1,114 @@ +#!/usr/bin/perl -w +use strict; +use IO::CaptureOutput qw(capture_exec); +use FindBin; +use lib "$FindBin::Bin/../rbm/lib"; +use RBM; +use File::Slurp qw(read_dir write_file read_file); +use Getopt::Long; + +my %options; +my @options_list = qw(dry-run! list-used-files=s project=s target=s@); +Getopt::Long::GetOptionsFromArray(\@ARGV, \%options, @options_list) || exit 1; + +sub clean_file { + my ($file, $used_files) = @_; + return if $used_files->{$file}; + if (-d $file) { + my @l = read_dir($file); + foreach my $subfile (@l) { + clean_file("$file/$subfile", $used_files); + } + @l = read_dir($file); + rmdir $file unless @l; + } else { + print "Removing file $file\n"; + unlink $file unless $options{'dry-run'}; + } +} + +sub clean_docker_images { + my ($dockerdir, $used_files) = @_; + my $imgprefix = RBM::project_config('docker-image', 'docker_image_prefix'); + my @imgs = read_dir($dockerdir); + foreach my $dockerimage (@imgs) { + next if $used_files->{"$dockerdir/$dockerimage"}; + my $img = "$imgprefix:$dockerimage"; + print "Cleaning docker image $img\n"; + next if $options{'dry-run'}; + my ($out, $err, $success) = capture_exec('docker', 'rmi', '-f', $img); + if (!$success) { + print STDERR "Error removing docker image $img:\n$err\n"; + exit 1; + } + unlink "$dockerdir/$dockerimage"; + } +} + +sub get_project_input_files { + my ($project, @targets) = @_; + print "Getting input files for $project ", join(' ', @targets), "\n"; + $RBM::config->{run}{target} = \@targets; + my $res = RBM::project_config($project, 'input_files_paths', + {error_if_undef => 1}); + return ref $res eq 'ARRAY' ? @$res : (); +} + +sub get_input_files { + my ($c) = @_; + my @files; + foreach my $p (@$c) { + my $tmp = File::Temp->new(); + my @args = ("$FindBin::Bin/$FindBin::Script", '--list-used-files', $tmp, + '--project', $p->{project}); + foreach my $target (@{$p->{target}}) { + push @args, ('--target', $target); + } + RBM::exit_error 'Error getting used files' unless system(@args) == 0; + push @files, map { chomp; $_ } read_file($tmp); + } + return @files; +} + +RBM::load_config; +RBM::load_system_config; +RBM::load_local_config; +RBM::set_default_env; + +if ($options{'list-used-files'}) { + if (!$options{project} || !$options{target}) { + RBM::exit_error 'Missing option project or target'; + } + my @files = get_project_input_files($options{project}, @{$options{target}}); + write_file($options{'list-used-files'}, join("\n", @files)); + exit 0; +} + +my $clean = RBM::project_config('clean', 'var/clean'); +if (!$clean) { + print STDERR "Clean configuration is missing. ", + "You should add it to rbm.local.conf.\n"; + exit 1; +} + +my @files = get_input_files($clean->{HEAD}) if $clean->{HEAD}; + +foreach my $branch (keys %$clean) { + next if $branch eq 'HEAD'; + print "Checking out $branch branch\n"; + RBM::exit_error("Error checking out $branch branch") + unless system('git', 'checkout', $branch) == 0; + RBM::exit_error("Error running git submodule update --init") + unless system('git', 'submodule', 'update', '--init') == 0; + push @files, get_input_files($clean->{$branch}); + RBM::exit_error('Error checking out @{-1}') + unless system('git', 'checkout', '@{-1}') == 0; + RBM::exit_error("Error running git submodule update --init") + unless system('git', 'submodule', 'update', '--init') == 0; +} +my %used_files = map { $_ => 1 } @files; +my $outdir = $RBM::config->{basedir} . '/out'; +# Don't clean docker-image files yet +$used_files{"$outdir/docker-image"} = 1; +clean_file($outdir, \%used_files); +clean_docker_images("$outdir/docker-image", \%used_files);

1 0

[rbm/master] Add the input_files_paths option
by boklm＠torproject.org 15 Mar '17

15 Mar '17

commit 3f3886e1f210ad2853209c5aecd0951350a6f758 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Mar 15 12:25:39 2017 +0100 Add the input_files_paths option --- NEWS | 2 ++ doc/rbm_config.asc | 6 ++++++ lib/RBM.pm | 23 ++++++++++++++++++++++- lib/RBM/DefaultConfig.pm | 1 + 4 files changed, 31 insertions(+), 1 deletion(-) diff --git a/NEWS b/NEWS index 5de36e0..4eac374 100644 --- a/NEWS +++ b/NEWS @@ -1,3 +1,5 @@ +- Add the input_files_paths option + - Add the ENV option - Add the build_log option diff --git a/doc/rbm_config.asc b/doc/rbm_config.asc index 48e505c..2e9b8ab 100644 --- a/doc/rbm_config.asc +++ b/doc/rbm_config.asc @@ -220,6 +220,12 @@ input_files_id:: file of type +project+, and the +filename+ and the sha256sum of the file for any other type of input file. +input_files_paths:: + The value of this option is an array of all the paths of input + files that currently exist and are used in the build of the + current project and its dependencies. This is useful when + cleaning old build files, to find which ones are still used. + timestamp:: This is the UNIX timestamp, set as modification time on files created such as the sources tarball and rpm spec file. The diff --git a/lib/RBM.pm b/lib/RBM.pm index 632a8ba..79e0670 100644 --- a/lib/RBM.pm +++ b/lib/RBM.pm @@ -731,8 +731,9 @@ sub input_files { my ($action, $project, $options, $dest_dir) = @_; my @res_copy; my %res_getfnames; + my @res_getfpaths; my $getfnames_noname = 0; - my $need_dl = 1; + my $need_dl = $action ne 'getfpaths'; my $input_files_id = ''; $options = {$options ? %$options : ()}; my $input_files = project_config($project, 'input_files', $options,); @@ -840,6 +841,25 @@ sub input_files { $input_files_id .= "\n"; next; } + if ($action eq 'getfpaths') { + push @res_getfpaths, $fname if $fname; + if ($file_gpg_id && $fname) { + my $sig_ext = $t->('sig_ext'); + $sig_ext = ref $sig_ext eq 'ARRAY' ? $sig_ext : [ $sig_ext ]; + foreach my $s (@$sig_ext) { + if (-f "$fname.$s") { + push @res_getfpaths, "$fname.$s"; + last; + } + } + } + if ($input_file->{project} && $t->('project')) { + my $r = RBM::project_step_config($t->('project'), 'input_files_paths', + {%$options, step => $t->('pkg_type'), %$input_file}); + push @res_getfpaths, @$r if @$r; + } + next; + } exit_error "Missing file $name" unless $fname; if ($t->('sha256sum') && $t->('sha256sum') ne sha256_hex(read_file($fname))) { @@ -886,6 +906,7 @@ sub input_files { return sha256_hex($input_files_id) if $action eq 'input_files_id'; return @res_copy if $action eq 'copy'; return \%res_getfnames if $action eq 'getfnames'; + return \@res_getfpaths if $action eq 'getfpaths'; } sub system_log { diff --git a/lib/RBM/DefaultConfig.pm b/lib/RBM/DefaultConfig.pm index c0764bd..cf0ed74 100644 --- a/lib/RBM/DefaultConfig.pm +++ b/lib/RBM/DefaultConfig.pm @@ -583,6 +583,7 @@ ZIP_END arch => \&get_arch, input_files_by_name => sub { RBM::input_files('getfnames', @_); }, input_files_id => sub { RBM::input_files('input_files_id', @_); }, + input_files_paths => sub { RBM::input_files('getfpaths', @_); }, steps => { srpm => 'rpm', 'deb-src' => 'deb',

1 0

[tor-browser-build/master] Add snowflake
by boklm＠torproject.org 13 Mar '17

13 Mar '17

commit 832c2ce17672d5cd1f554354902df670e6ee928a Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Mar 13 19:39:02 2017 +0100 Add snowflake Only for linux-x86_64 for now, as it fails to build on linux-i686. --- .gitignore | 1 + projects/depot_tools/build | 8 +++ projects/depot_tools/config | 5 ++ projects/gcc/config | 2 +- projects/go-webrtc/config | 53 ++++++++++++++++++++ projects/go/config | 1 + projects/snowflake/build | 38 +++++++++++++++ projects/snowflake/config | 35 ++++++++++++++ projects/tor-browser/build | 3 ++ projects/tor-browser/config | 3 ++ projects/webrtc/build | 80 ++++++++++++++++++++++++++++++ projects/webrtc/config | 115 ++++++++++++++++++++++++++++++++++++++++++++ rbm.conf | 4 ++ 13 files changed, 347 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 9b6754f..0fe0aec 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,6 @@ git_clones hg_clones +gclient out release alpha diff --git a/projects/depot_tools/build b/projects/depot_tools/build new file mode 100644 index 0000000..ac0f21b --- /dev/null +++ b/projects/depot_tools/build @@ -0,0 +1,8 @@ +#!/bin/bash +[% c("var/set_default_env") -%] +tar xf [% project %]-[% c("version") %].tar.gz +mv [% project %]-[% c("version") %] [% project %] +[% c('tar', { + tar_src => [ project ], + tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'), + }) %] diff --git a/projects/depot_tools/config b/projects/depot_tools/config new file mode 100644 index 0000000..40a6d85 --- /dev/null +++ b/projects/depot_tools/config @@ -0,0 +1,5 @@ +# vim: filetype=yaml sw=2 +version: '[% c("abbrev") %]' +git_hash: 28216cd14b44716db5c83634afbdc6e90492652b +git_url: https://chromium.googlesource.com/chromium/tools/depot_tools.git +filename: '[% project %]-[% c("version") %].tar.gz' diff --git a/projects/gcc/config b/projects/gcc/config index bf73b7d..391e453 100644 --- a/projects/gcc/config +++ b/projects/gcc/config @@ -10,7 +10,7 @@ var: - libc6-dev-i386 setup: | mkdir -p /var/tmp/dist - tar -C /var/tmp/dist -xf [% c("compiler_tarfile") %] + tar -C /var/tmp/dist -xf $rootdir/[% c("compiler_tarfile") %] export PATH="/var/tmp/dist/gcc/bin:$PATH" [% IF c("var/osname") == "linux-i686" -%] export LD_LIBRARY_PATH=/var/tmp/dist/gcc/lib32 diff --git a/projects/go-webrtc/config b/projects/go-webrtc/config new file mode 100644 index 0000000..778d3db --- /dev/null +++ b/projects/go-webrtc/config @@ -0,0 +1,53 @@ +# vim: filetype=yaml sw=2 +version: '[% c("abbrev") %]' +git_url: https://github.com/keroserene/go-webrtc.git +git_hash: 69c5ca70533142494d145b43ef2f46ca94715557 +filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' +remote_docker: 1 + +build: '[% c("projects/go/var/build_go_lib") %]' + +var: + go_lib: github.com/keroserene/go-webrtc + build_go_lib_pre: | + [% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] + [% IF c("var/linux") %] + tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/binutils') %] + export PATH="/var/tmp/dist/binutils/bin:$PATH" + [% END -%] + tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/webrtc') %] + # Replace the prebuilt webrtc library with our own one. + rm -rf include/ lib/ + cp -a /var/tmp/dist/webrtc/{include,lib} . + # The go-webrtc package sets _GLIBCXX_USE_CXX11_ABI=0 for compatibility with + # the prebuilt libwebrtc-magic.a libraries. Since we build our own + # libwebrtc-magic.a with the C++11 ABI, we have to undo that setting here, + # using CGO_CXXFLAGS. + export CGO_CXXFLAGS=-D_GLIBCXX_USE_CXX11_ABI=1 + +targets: + master: + git_hash: master + linux-x86_64: + var: + arch_deps: + - pkg-config + - libx11-dev + linux-i686: + var: + arch_deps: + - pkg-config:i386 + - libx11-dev:i386 + - lib32stdc++6 + +input_files: + - project: docker-image + - name: go + project: go + - name: webrtc + project: webrtc + - name: '[% c("var/compiler") %]' + project: '[% c("var/compiler") %]' + - name: binutils + project: binutils + enable: '[% c("var/linux") %]' diff --git a/projects/go/config b/projects/go/config index 5e55a09..870dc50 100644 --- a/projects/go/config +++ b/projects/go/config @@ -35,6 +35,7 @@ var: do patch -p1 < $p done + [% IF c("var/build_go_lib_pre"); GET c("var/build_go_lib_pre"); END; -%] [% IF c("var/go_lib_install") -%] [% FOREACH inst IN c("var/go_lib_install") %] go install [% inst %] diff --git a/projects/snowflake/build b/projects/snowflake/build new file mode 100644 index 0000000..6e08b4e --- /dev/null +++ b/projects/snowflake/build @@ -0,0 +1,38 @@ +#!/bin/bash +[% c("var/set_default_env") -%] +[% pc('go', 'var/setup', { go_tarfile => c('input_files_by_name/go') }) %] +[% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] +[% IF c("var/linux") %] + tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/binutils') %] + export PATH="/var/tmp/dist/binutils/bin:$PATH" +[% END -%] +distdir=/var/tmp/dist/[% project %] +[% IF c("var/osx") %] + PTDIR="$distdir/Contents/MacOS/Tor/PluggableTransports" + DOCSDIR="$distdir/Contents/Resources/TorBrowser/Docs/snowflake" +[% ELSE %] + PTDIR="$distdir/TorBrowser/Tor/PluggableTransports" + DOCSDIR="$distdir/TorBrowser/Docs/snowflake" +[% END %] +mkdir -p $PTDIR $DOCSDIR + +tar -C /var/tmp/dist -xf [% c('input_files_by_name/go-webrtc') %] +tar -C /var/tmp/dist -xf [% c('input_files_by_name/uniuri') %] +tar -C /var/tmp/dist -xf [% c('input_files_by_name/goptlib') %] + +mkdir -p /var/tmp/build +tar -C /var/tmp/build -xf [% project %]-[% c('version') %].tar.gz +cd /var/tmp/build/[% project %]-[% c('version') %] + +cd client +go build -ldflags '-s' +cp -a client[% IF c("var/windows") %].exe[% END %] $PTDIR/snowflake-client[% IF c("var/windows") %].exe[% END %] + +cd .. +cp -a README.md LICENSE $DOCSDIR + +cd $distdir +[% c('tar', { + tar_src => [ '.' ], + tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'), + }) %] diff --git a/projects/snowflake/config b/projects/snowflake/config new file mode 100644 index 0000000..5ba006b --- /dev/null +++ b/projects/snowflake/config @@ -0,0 +1,35 @@ +# vim: filetype=yaml sw=2 +version: '[% c("abbrev") %]' +git_url: https://git.torproject.org/pluggable-transports/snowflake.git +git_hash: 6cecd31fd896eb26e64ad8bab8a9ea510ec3b21d +filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' +remote_docker: 1 + +targets: + linux-i686: + var: + arch_deps: + - pkg-config + - libx11-dev:i386 + - lib32stdc++6 + linux-x86_64: + var: + arch_deps: + - pkg-config + - libx11-dev + +input_files: + - project: docker-image + - name: go + project: go + - name: '[% c("var/compiler") %]' + project: '[% c("var/compiler") %]' + - name: binutils + project: binutils + enable: '[% c("var/linux") %]' + - name: go-webrtc + project: go-webrtc + - name: uniuri + project: uniuri + - name: goptlib + project: goptlib diff --git a/projects/tor-browser/build b/projects/tor-browser/build index 904f1b6..814f7af 100644 --- a/projects/tor-browser/build +++ b/projects/tor-browser/build @@ -52,6 +52,9 @@ mv [% c('input_files_by_name/noscript') %] $TBDIR/$EXTSPATH/{73a6fe31-595d-460b- tar -C $TBDIR -xf [% c('input_files_by_name/obfs4') %] tar -C $TBDIR -xf [% c('input_files_by_name/meek') %] mv $TBDIR/meek-http-helper(a)bamsoftware.com.xpi $TBDIR/$MEEKPROFILEPATH/extensions/ +[% IF c("var/snowflake") %] + tar -C $TBDIR -xf [% c('input_files_by_name/snowflake') -%] +[% END -%] tar -C $TBDIR[% IF c("var/osx") %]/Contents/Resources[% END %] -xf [% c('input_files_by_name/fonts') %] diff --git a/projects/tor-browser/config b/projects/tor-browser/config index 95f444d..f2c1d72 100644 --- a/projects/tor-browser/config +++ b/projects/tor-browser/config @@ -48,6 +48,9 @@ input_files: name: meek - project: obfs4 name: obfs4 + - project: snowflake + name: snowflake + enable: '[% c("var/snowflake") %]' - filename: Bundle-Data - URL: https://addons.cdn.mozilla.net/user-media/addons/722/noscript_security_suit… name: noscript diff --git a/projects/webrtc/build b/projects/webrtc/build new file mode 100644 index 0000000..5a70fbe --- /dev/null +++ b/projects/webrtc/build @@ -0,0 +1,80 @@ +#!/bin/bash +[% c("var/set_default_env") -%] +distdir=/var/tmp/dist/[% project %] +[% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] + +mkdir -p /var/tmp/dist + +[% IF c("var/linux") %] + tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/binutils') %] + export PATH="/var/tmp/dist/binutils/bin:$PATH" +[% END -%] + +# Setting up depot_tools +# https://dev.chromium.org/developers/how-tos/install-depot-tools +tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/depot_tools') %] +export PATH="$PATH:/var/tmp/dist/depot_tools" +# Disable automatic updating. +export DEPOT_TOOLS_UPDATE=0 + +mkdir -p /var/tmp/build +tar -C /var/tmp/build -xf webrtc-sources-[% c('version') %].tar.gz + +builddir=/var/tmp/build/[% project %]/src +cd $builddir +export GYP_CROSSCOMPILE=1 +export GYP_DEFINES="OS=[% c("var/webrtc/os") %] target_arch=[% c("var/webrtc/arch") %]" +# Do not use bundled utilities. +GYP_DEFINES+=" clang=0 host_clang=0 use_sysroot=0" +GYP_DEFINES+=" linux_use_bundled_gold=0 linux_use_gold_flags=0 linux_use_bundled_binutils=0" +# Avoid some dependencies. Some of these don't seem to work fully; for +# example even with use_alsa=0 we need libasound2-dev. +GYP_DEFINES+=" use_x11=0 use_gtk=0 use_gconf=0 use_alsa=0 use_pulseaudio=0 use_libpci=0 include_internal_audio_device=0 enabled_libjingle_device_manager=0" +# examples and tests also bring in dependencies. +GYP_DEFINES+=" include_examples=0 include_tests=0" +# embedded=1 is supposed to turn of various features; see +# https://bugs.chromium.org/p/chromium/issues/detail?id=318413. +GYP_DEFINES+=" embedded=1" +GYP_DEFINES+=" werror=" +[% IF c("var/linux") -%] + export CC=gcc + export CXX=g++ +[% END -%] +[% IF c("var/linux-i686") -%] + GYP_DEFINES+=" target_arch=ia32" + export CC='gcc -m32' + export CXX='g++ -m32' + export CFLAGS=-m32 + export CXXFLAGS=-m32 + export LDFLAGS=-m32 +[% END -%] +JAVA_HOME=/usr/lib/jvm/default-java webrtc/build/gyp_webrtc.py +ninja -C out/Release +# Run ninja once more, without include_tests=0, in order to build just the +# FakeAudioCaptureModule that go-webrtc uses. +GYP_DEFINES="$(echo "$GYP_DEFINES" | sed -e 's/include_tests=0//g')" +JAVA_HOME=/usr/lib/jvm/default-java webrtc/build/gyp_webrtc.py +ninja -C out/Release obj/webrtc/api/test/peerconnection_unittests.fakeaudiocapturemodule.o +# https://github.com/keroserene/go-webrtc/issues/23#issuecomment-175312648 +# dump_syms_regtest.o is actually an executable, not an object file. If not +# excluded, it results in the error: +# libwebrtc-linux-386-magic.a(dump_syms_regtest.o): unsupported ELF file type 2 +ar crs libwebrtc-magic.a $(find . -name '*.o' -not -name '*.main.o' -not -name 'dump_syms_regtest.o' | sort) + +mkdir -p $distdir +cd $distdir +mkdir -p include lib +cp -f $builddir/libwebrtc-magic.a [% c("var/webrtc/lib_path") %] +INCLUDE_DIR="$PWD/include" +cd $builddir +for h in $(find talk/ webrtc/ -type f -name '*.h'); +do + mkdir -p "$INCLUDE_DIR/$(dirname $h)" + cp -f "$h" "$INCLUDE_DIR/$h" +done + +cd /var/tmp/dist +[% c('tar', { + tar_src => [ project ], + tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'), + }) %] diff --git a/projects/webrtc/config b/projects/webrtc/config new file mode 100644 index 0000000..52618c2 --- /dev/null +++ b/projects/webrtc/config @@ -0,0 +1,115 @@ +# vim: filetype=yaml sw=2 +version: '[% c("var/webrtc_tag") %]' +remote_docker: 1 +filename: 'webrtc-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' + +var: + webrtc_tag: f33698296719f956497d2dbff81b5080864a8804 + +input_files: + - project: docker-image + - project: webrtc + pkg_type: fetch_sources + - project: depot_tools + name: depot_tools + - name: '[% c("var/compiler") %]' + project: '[% c("var/compiler") %]' + - project: binutils + name: binutils + enable: '[% c("var/linux") %]' + +targets: + linux: + var: + webrtc: + os: linux + linux-i686: + var: + dockerbuild: "[% pc('docker-image', 'pre') %]" + sort_deps: 0 + arch_deps: + - default-jre-headless + - default-jdk + - lib32asound2-dev + - lib64expat1 + - libexpat1-dev:i386 + - libudev-dev:i386 + - libx11-dev:i386 + - libxext-dev:i386 + - libxrandr-dev:i386 + - lib32stdc++6 + - hardening-wrapper + webrtc: + arch: ia32 + lib_arch: 386 + lib_path: lib/libwebrtc-linux-386-magic.a + linux-x86_64: + var: + arch_deps: + - default-jre-headless + - default-jdk + - libasound2-dev + - libexpat1-dev + - libudev-dev + - libx11-dev + - libxext-dev + - libxrandr-dev + webrtc: + arch: x64 + lib_arch: amd64 + lib_path: lib/libwebrtc-linux-amd64-magic.a + +steps: + fetch_sources: + remote_docker: 0 + filename: 'webrtc-sources-[% c("var/webrtc_tag") %].tar.gz' + fetch_sources: | + #!/bin/bash + [% c("var/set_default_env") -%] + # WebRTC is special, having its own build system that brings in lots of Chromium dependencies. + # https://webrtc.org/native-code/development/ + tar xf [% c('input_files_by_name/depot_tools') %] + export PATH="$rootdir/depot_tools:$PATH" + # GYP_CROSSCOMPILE=1 and GYP_DEFINES="use_x11=0" prevent probing for certain dependencies. + # Use --no-history because the whole checkout with history is about 12 GB. + export GYP_CROSSCOMPILE=1 + export GYP_DEFINES="use_x11=0" + # JAVA_HOME is needed in a hook for libjingle. The readlink line tries to find the current JRE. + # default-java comes from the package default-jdk-headless. + export JAVA_HOME=/usr/lib/jvm/default-java + clone_dir='[% c("basedir") %]/gclient/webrtc' + mkdir -p "$clone_dir" + cd "$clone_dir" + if [ ! -d "src" ]; + then + # "fetch" is part of depot_tools. + #fetch --nohooks --no-history webrtc + # FIXME: To avoid the unconditional `gclient sync` in the call to fetch, + # we inline the result of a `fetch --dry-run` + gclient root + gclient config --spec 'solutions = [ + { + "managed": False, + "name": "src", + "url": "https://chromium.googlesource.com/external/webrtc.git", + "custom_deps": {}, + "deps_file": "DEPS", + "safesync_url": "", + }, + ] + ' + gclient sync --nohooks --no-history --with_branch_heads -r [% c("var/webrtc_tag") %] + cd src + git submodule foreach 'git config -f $toplevel/.git/config submodule.$name.ignore all' + git config --add remote.origin.fetch '+refs/tags/*:refs/tags/*' + git config diff.ignoreSubmodules all + cd .. + fi + # "gclient" is part of depot_tools. This download takes a long time the first time. + gclient sync --no-history --with_branch_heads -r [% c("var/webrtc_tag") %] + cd .. + tar --exclude .git -czf [% dest_dir _ '/' _ c('filename') %] webrtc + input_files: + - project: depot_tools + name: depot_tools + pkg_type: build diff --git a/rbm.conf b/rbm.conf index e5c69b0..e206193 100644 --- a/rbm.conf +++ b/rbm.conf @@ -105,6 +105,7 @@ targets: linux-x86_64: arch: x86_64 var: + linux-x86_64: 1 osname: linux-x86_64 deps: - build-essential @@ -115,9 +116,12 @@ targets: - libtool - zip - unzip + # We only build snowflake on linux-x86_64 for now + snowflake: 1 linux-i686: arch: i686 var: + linux-i686: 1 osname: linux-i686 configure_opt: '--host=i686-linux-gnu CFLAGS=-m32 CXXFLAGS=-m32 LDFLAGS=-m32' pre_pkginst: dpkg --add-architecture i386

1 0

[tor-browser-build/master] Update firefox, http-e, openssl, tor, torbutton versions
by boklm＠torproject.org 10 Mar '17

10 Mar '17

commit e040f4434ea48ad7be41d2a22f19dc58a3ac8f5b Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri Mar 10 11:44:33 2017 +0100 Update firefox, http-e, openssl, tor, torbutton versions --- projects/firefox-langpacks/config | 2 +- projects/firefox/config | 2 +- projects/https-everywhere/config | 2 +- projects/openssl/config | 10 ++-------- projects/tor/config | 2 +- projects/torbutton/config | 2 +- 6 files changed, 7 insertions(+), 13 deletions(-) diff --git a/projects/firefox-langpacks/config b/projects/firefox-langpacks/config index a645b92..dd96dcd 100644 --- a/projects/firefox-langpacks/config +++ b/projects/firefox-langpacks/config @@ -4,7 +4,7 @@ filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/buil var: ff_version: '[% pc("firefox", "var/firefox_version") %]' - ff_build: build1 + ff_build: build2 ff_arch: linux-i686 input_filename: 'dl-langpack-[% c("var/ff_arch") %]-[% c("version") %]' diff --git a/projects/firefox/config b/projects/firefox/config index 96be619..f7e89e5 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -8,7 +8,7 @@ gpg_keyring: torbutton.gpg remote_docker: 1 var: - firefox_version: 45.7.0esr + firefox_version: 45.8.0esr torbrowser_branch: 7.0 torbrowser_update_channel: alpha copyright_year: '[% exec("git show -s --format=%ci").remove("-.*") %]' diff --git a/projects/https-everywhere/config b/projects/https-everywhere/config index 557473d..17f9f82 100644 --- a/projects/https-everywhere/config +++ b/projects/https-everywhere/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 5.2.9 +version: 5.2.11 git_url: https://git.torproject.org/https-everywhere.git git_hash: '[% c("version") %]' git_submodule: 1 diff --git a/projects/openssl/config b/projects/openssl/config index 637f3d1..8490b0b 100644 --- a/projects/openssl/config +++ b/projects/openssl/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 1.0.2j +version: 1.0.2k filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' remote_docker: 1 @@ -24,15 +24,9 @@ targets: pre_pkginst: dpkg --add-architecture i386 compiler: macosx-toolchain-gcc - nightly: - version: 1.0.2k - input_files: - project: docker-image - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]' - URL: 'https://www.openssl.org/source/openssl-[% c("version") %].tar.gz' - sha256sum: e7aff292be21c259c6af26469c7a9b3ba26e9abaaffd325e3dccc9785256c431 - targets: - nightly: - sha256sum: 6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 + sha256sum: 6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 diff --git a/projects/tor/config b/projects/tor/config index 2fbbf24..55637dc 100644 --- a/projects/tor/config +++ b/projects/tor/config @@ -1,6 +1,6 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -version: 0.3.0.2-alpha +version: 0.3.0.4-rc git_hash: 'tor-[% c("version") %]' git_url: https://git.torproject.org/tor.git gpg_keyring: tor.gpg diff --git a/projects/torbutton/config b/projects/torbutton/config index 5ff51f8..fdc9208 100644 --- a/projects/torbutton/config +++ b/projects/torbutton/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 1.9.7 +version: 1.9.7.1 git_url: https://git.torproject.org/torbutton.git git_hash: '[% c("version") %]' gpg_keyring: torbutton.gpg

1 0

[tor-browser/tor-browser-45.8.0esr-6.5-2] fixup! Bug 13900: Remove 3rd party HTTP auth tokens.
by gk＠torproject.org 08 Mar '17

08 Mar '17

commit eb8f7fd0910e831d96dfdef4782e23c6c389e844 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Fri Mar 3 21:47:20 2017 -0800 fixup! Bug 13900: Remove 3rd party HTTP auth tokens. The HostPartIsTheSame() is too strict about deciding what is first party. Instead we use IsThirdPartyURI() to check if the request is from the first party. Specifically, it considers an XHR to api.twitter.com from a twitter.com top-level page to be first-party. This fixes bug 21555 and 16450. --- netwerk/protocol/http/nsHttpChannel.cpp | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp index 3a9a126..e571394 100644 --- a/netwerk/protocol/http/nsHttpChannel.cpp +++ b/netwerk/protocol/http/nsHttpChannel.cpp @@ -6558,8 +6558,12 @@ nsHttpChannel::RemoveAuthorizationHeaderIfAppropriate() nsresult rv = thirdPartySvc->GetFirstPartyURIFromChannel(this, false, getter_AddRefs(firstPartyURI)); if (NS_SUCCEEDED(rv) && firstPartyURI) { - isAuthAllowed = (mURI == firstPartyURI) - || HostPartIsTheSame(firstPartyURI); + bool isThirdParty; + rv = thirdPartySvc->IsThirdPartyURI(firstPartyURI, mURI, &isThirdParty); + if (NS_SUCCEEDED(rv)) { + // Prevent third-party requests from sending auth tokens. + isAuthAllowed = !isThirdParty; + } } else { // We failed to get the first party URI. Check the document URI so // that we can allow authentication if the request originates from the

1 0

[tor-browser/tor-browser-45.8.0esr-7.0-1] fixup! Bug 13900: Remove 3rd party HTTP auth tokens.
by gk＠torproject.org 08 Mar '17

08 Mar '17

commit 340377b882408b5de24ff69bcd76e774d9844e4c Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Fri Mar 3 21:47:20 2017 -0800 fixup! Bug 13900: Remove 3rd party HTTP auth tokens. The HostPartIsTheSame() is too strict about deciding what is first party. Instead we use IsThirdPartyURI() to check if the request is from the first party. Specifically, it considers an XHR to api.twitter.com from a twitter.com top-level page to be first-party. This fixes bug 21555 and 16450. --- netwerk/protocol/http/nsHttpChannel.cpp | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp index 3a9a126..e571394 100644 --- a/netwerk/protocol/http/nsHttpChannel.cpp +++ b/netwerk/protocol/http/nsHttpChannel.cpp @@ -6558,8 +6558,12 @@ nsHttpChannel::RemoveAuthorizationHeaderIfAppropriate() nsresult rv = thirdPartySvc->GetFirstPartyURIFromChannel(this, false, getter_AddRefs(firstPartyURI)); if (NS_SUCCEEDED(rv) && firstPartyURI) { - isAuthAllowed = (mURI == firstPartyURI) - || HostPartIsTheSame(firstPartyURI); + bool isThirdParty; + rv = thirdPartySvc->IsThirdPartyURI(firstPartyURI, mURI, &isThirdParty); + if (NS_SUCCEEDED(rv)) { + // Prevent third-party requests from sending auth tokens. + isAuthAllowed = !isThirdParty; + } } else { // We failed to get the first party URI. Check the document URI so // that we can allow authentication if the request originates from the

1 0

[tor-browser-bundle/hardened-builds] Switch nightlies to 45.8.0esr
by gk＠torproject.org 07 Mar '17

07 Mar '17

commit 3c1ae6423d866c462c27fbd85365a30dd64f2d86 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Mar 7 09:44:16 2017 +0000 Switch nightlies to 45.8.0esr --- gitian/versions.nightly | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 7f10c69..042095a 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -17,7 +17,7 @@ MULTI_LINGUAL=1 VERIFY_TAGS=0 -FIREFOX_VERSION=45.7.0esr +FIREFOX_VERSION=45.8.0esr TORBROWSER_UPDATE_CHANNEL=default @@ -61,7 +61,7 @@ GITIAN_TAG=tor-browser-builder-4 OPENSSL_VER=1.0.2k GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION -FIREFOX_LANG_BUILD=build1 +FIREFOX_LANG_BUILD=build2 BINUTILS_VER=2.24 GCC_VER=5.4.0 CLANG_VER=r247539

1 0

[tor-browser-bundle/master] Switch nightlies to 45.8.0esr
by gk＠torproject.org 07 Mar '17

07 Mar '17

commit 24fdda2e33fc1f6e82f6a09f9bd32118fa3f2fa7 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Mar 7 09:43:07 2017 +0000 Switch nightlies to 45.8.0esr --- gitian/versions.nightly | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 94b3003..b9779e2 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -17,7 +17,7 @@ MULTI_LINGUAL=1 VERIFY_TAGS=0 -FIREFOX_VERSION=45.7.0esr +FIREFOX_VERSION=45.8.0esr TORBROWSER_UPDATE_CHANNEL=default @@ -62,7 +62,7 @@ GITIAN_TAG=tor-browser-builder-4 OPENSSL_VER=1.0.2k GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION -FIREFOX_LANG_BUILD=build1 +FIREFOX_LANG_BUILD=build2 BINUTILS_VER=2.24 GCC_VER=5.1.0 CLANG_VER=r247539

1 0

[tor-browser-build/master] Update rbm to fix installation of some packages
by boklm＠torproject.org 06 Mar '17

06 Mar '17

commit dc243808466f77c44e594b02962317c16bb379e4 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Mar 6 13:41:42 2017 +0100 Update rbm to fix installation of some packages This change will cause all containers to be rebuilt. --- rbm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rbm b/rbm index 1945b67..845bb90 160000 --- a/rbm +++ b/rbm @@ -1 +1 @@ -Subproject commit 1945b67fefbcf7b834b71275e301da06232f0241 +Subproject commit 845bb904fb87b6c56ab789f35cd02bce32453f52

1 0

[rbm/master] Fix install_package on Debian
by boklm＠torproject.org 06 Mar '17

06 Mar '17

commit 845bb904fb87b6c56ab789f35cd02bce32453f52 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Mar 6 13:34:11 2017 +0100 Fix install_package on Debian dpkg -s not returning an error means that the package has a status, but its status is not always installed, so checking the exit value is not enough. We are now checking that the status is "install ok installed". --- lib/RBM/DefaultConfig.pm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/RBM/DefaultConfig.pm b/lib/RBM/DefaultConfig.pm index 2f6264e..c0764bd 100644 --- a/lib/RBM/DefaultConfig.pm +++ b/lib/RBM/DefaultConfig.pm @@ -525,7 +525,7 @@ OPT_END my $dnf = 'rpm -q [% c("pkg_name") %] > /dev/null || dnf install -y [% c("pkg_name") %]'; my $zypper = 'rpm -q [% c("pkg_name") %] > /dev/null || zypper install [% c("pkg_name") %]'; my $urpmi = 'rpm -q [% c("pkg_name") %] > /dev/null || urpmi [% c("pkg_name") %]'; - my $apt = 'dpkg -s [% c("pkg_name") %] > /dev/null 2>&1 || apt-get install -y [% c("pkg_name") %]'; + my $apt = 'dpkg -s [% c("pkg_name") %] 2> /dev/null | grep -q "^Status: install ok installed\$" || apt-get install -y [% c("pkg_name") %]'; my %install = ( Fedora => $dnf, 'Fedora-20' => $yum,

1 0

[tor-browser-bundle/maint-6.5] Fix release date bug in Changelog
by gk＠torproject.org 06 Mar '17

06 Mar '17

commit 21ddc8a6be0f6ffe4723b1eba615e99460889e64 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Mar 6 11:04:23 2017 +0000 Fix release date bug in Changelog --- Bundle-Data/Docs/ChangeLog.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 311a894..5438022 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,4 +1,4 @@ -Tor Browser 6.5.1 -- March 6 2017 +Tor Browser 6.5.1 -- March 7 2017 * All Platforms * Update Firefox to 45.8.0esr * Tor to 0.2.9.10

1 0

[tor-browser-bundle/hardened-builds] Release preparations for 7.0a2-hardened
by gk＠torproject.org 06 Mar '17

06 Mar '17

commit dcfd2efd5b155830e4d9443b9f6b69f60313e6fb Author: Georg Koppen <gk(a)torproject.org> Date: Mon Mar 6 08:12:25 2017 +0000 Release preparations for 7.0a2-hardened Version bumps, Changelog update, and update of config.yml --- Bundle-Data/Docs/ChangeLog.txt | 20 ++++++++++++++++++++ gitian/versions.alpha | 14 +++++++------- tools/update-responses/config.yml | 10 +++++----- 3 files changed, 32 insertions(+), 12 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index f349311..c192940 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,23 @@ +Tor Browser 7.0a2-hardened -- March 7 2017 + * All Platforms + * Update Firefox to 45.8.0esr + * Tor to 0.3.0.4-rc + * OpenSSL to 1.0.2k + * Update Torbutton to 1.9.7.1 + * Bug 21396: Allow leaking of resource/chrome URIs (off by default) + * Bug 21574: Add link for zh manual and create manual links dynamically + * Bug 21330: Non-usable scrollbar appears in tor browser security settings + * Bug 21324: Don't update NoScript button with timer update + * Translation updates + * Update HTTPS-Everywhere to 5.2.11 + * Bug 21514: Restore W^X JIT implementation removed from ESR45 + * Bug 21536: Remove scramblesuit bridge + * Bug 21342: Move meek-azure to the meek.azureedge.net backend and cymrubridge02 bridge + * Bug 21326: Update the "Using a system-installed Tor" section in start script + * Build system + * Bug 17034: Use our built binutils and GCC for building tor + * Code clean-up + Tor Browser 7.0a1-hardened -- January 25 2017 * All Platforms * Update Firefox to 45.7.0esr diff --git a/gitian/versions.alpha b/gitian/versions.alpha index aaacef9..e3352c4 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -14,15 +14,15 @@ DATA_OUTSIDE_APP_DIR=1 VERIFY_TAGS=1 -FIREFOX_VERSION=45.7.0esr +FIREFOX_VERSION=45.8.0esr TORBROWSER_UPDATE_CHANNEL=hardened TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-7.0-1-build1 -TOR_TAG=tor-0.3.0.2-alpha +TOR_TAG=tor-0.3.0.4-rc TORLAUNCHER_TAG=0.2.11.1 -TORBUTTON_TAG=1.9.7 -HTTPSE_TAG=5.2.9 +TORBUTTON_TAG=1.9.7.1 +HTTPSE_TAG=5.2.11 NSIS_TAG=v0.3.1 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.22-stable @@ -55,10 +55,10 @@ UNIURI_TAG=8902c56451e9b58ff940bbe5fec35d5f9c04584a GITIAN_TAG=tor-browser-builder-4-1 -OPENSSL_VER=1.0.2j +OPENSSL_VER=1.0.2k GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION -FIREFOX_LANG_BUILD=build1 +FIREFOX_LANG_BUILD=build2 BINUTILS_VER=2.24 GCC_VER=5.4.0 CLANG_VER=r247539 @@ -110,7 +110,7 @@ NOTOTCFONT_PACKAGE=NotoSansTC-Regular.otf ELFUTILS_PACKAGE=elfutils-${ELFUTILS_VER}.tar.bz2 # Hashes for packages with weak sigs or no sigs -OPENSSL_HASH=e7aff292be21c259c6af26469c7a9b3ba26e9abaaffd325e3dccc9785256c431 +OPENSSL_HASH=6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf OSXSDK_OLD_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index 21c039b..0f112a3 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -20,7 +20,7 @@ build_targets: osx32: Darwin_x86-gcc3 osx64: Darwin_x86_64-gcc3 channels: - hardened: 7.0a1-hardened + hardened: 7.0a2-hardened release: 6.0.1 versions: 6.0.1: @@ -33,11 +33,11 @@ versions: osx32: minSupportedOSVersion: 10.8 detailsURL: https://blog.torproject.org/blog/end-life-plan-tor-browser-32-bit-macs#upda… - 7.0a1-hardened: - platformVersion: 45.7.0 - detailsURL: https://blog.torproject.org/blog/tor-browser-70a1-hardened-released + 7.0a2-hardened: + platformVersion: 45.8.0 + detailsURL: https://blog.torproject.org/blog/tor-browser-70a2-hardened-released incremental_from: - - 6.5a6-hardened + - 7.0a1-hardened migrate_archs: osx32: osx64 osx32:

1 0