- tbb-commits - lists.torproject.org

[tor-browser-bundle/hardened-builds] Release preparations for 6.5a2-hardened
by gk＠torproject.org 01 Aug '16

01 Aug '16

commit 4daeed06ac415ba19617cebfb41b5fe7d26c1fcd Author: Georg Koppen <gk(a)torproject.org> Date: Mon Aug 1 09:44:41 2016 +0000 Release preparations for 6.5a2-hardened Changelog update, versions bumps, config.yml update --- Bundle-Data/Docs/ChangeLog.txt | 33 +++++++++++++++++++++++++++++++++ gitian/versions.alpha | 14 +++++++------- tools/update-responses/config.yml | 12 ++++++------ 3 files changed, 46 insertions(+), 13 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 40a36c9..2cdc4b7 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,36 @@ +Tor Browser 6.5a2-hardened -- August 3 + * All Platforms + * Update Firefox to 45.3.0esr + * Update Tor to tor-0.2.8.5-rc + * Update Torbutton to 1.9.6.1 + * Bug 19689: Use proper parent window for plugin prompt + * Bug 19206: Avoid SOCKS auth and NEWNYM collisions when sharing a tor client + * Bug 19417: Disable asm.js (but add code to clear on New Identity if enabled) + * Bug 19273: Improve external app launch handling and associated warnings + * Bug 8725: Block addon resource and url fingerprinting with nsIContentPolicy + * Update HTTPS-Everywhere to 5.2.1 + * Update NoScript to 2.9.0.12 + * Bug 17406: Include Selfrando into our hardened builds + * Bug 19417: Disable asmjs for now + * Bug 19715: Disable the meek-google pluggable transport option + * Bug 19714: Remove mercurius4 obfs4 bridge + * Bug 19585: Fix regression test for keyboard layout fingerprinting + * Bug 19515: Tor Browser is crashing in graphics code + * Bug 18513: Favicon requests can bypass New Identity + * Bug 19273: Write C++ patch for external app launch handling + * Bug 16998: Isolate preconnect requests to URL bar domain + * Bug 18923: Add script to run all Tor Browser regression tests + * Bug 19478: Prevent millisecond resolution leaks in File API + * Bug 19401: Fix broken PDF download button + * Bug 19411: Don't show update icon if a partial update failed + * Bug 19400: Back out GCC bug workaround to avoid asmjs crash + * Bug 19735: Switch default search engine to DuckDuckGo + * Bug 19276: Disable Xrender due to possible performance regressions + * Bug 19725: Remove old updater files left on disk after upgrade to 6.x + * Build System + * All Platforms + * Bug 19703: Upgrade Go to 1.6.3 + Tor Browser 6.5a1-hardened -- June 8 * All Platforms * Update Firefox to 45.2.0esr diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 29595cc..dba74e7 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -14,15 +14,15 @@ DATA_OUTSIDE_APP_DIR=1 VERIFY_TAGS=1 -FIREFOX_VERSION=45.2.0esr +FIREFOX_VERSION=45.3.0esr TORBROWSER_UPDATE_CHANNEL=hardened TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-6.5-1-build1 -TOR_TAG=tor-0.2.8.3-alpha +TOR_TAG=tor-0.2.8.5-rc TORLAUNCHER_TAG=0.2.8.5 -TORBUTTON_TAG=1.9.6 -HTTPSE_TAG=5.1.9 +TORBUTTON_TAG=1.9.6.1 +HTTPSE_TAG=5.2.1 NSIS_TAG=v0.3.1 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.22-stable @@ -51,7 +51,7 @@ GITIAN_TAG=tor-browser-builder-4-1 OPENSSL_VER=1.0.1t GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION -FIREFOX_LANG_BUILD=build2 +FIREFOX_LANG_BUILD=build1 BINUTILS_VER=2.24 GCC_VER=5.2.0 CLANG_VER=r247539 @@ -72,7 +72,7 @@ NSIS_VER=2.51 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 -NOSCRIPT_PACKAGE=noscript_security_suite-2.9.0.11-fn+sm+fx.xpi +NOSCRIPT_PACKAGE=noscript_security_suite-2.9.0.12-fx+fn+sm.xpi TOOLCHAIN4_OLD_PACKAGE=multiarch-darwin11-cctools127.2-gcc42-5666.3-llvmgcc42-2336.1-Linux-120724.tar.xz CCTOOLS_PACKAGE=cctools.tar.gz OSXSDK_PACKAGE=MacOSX10.7.sdk.tar.gz @@ -106,7 +106,7 @@ GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf OSXSDK_OLD_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc TOOLCHAIN4_OLD_HASH=65c1b2d302358a6b95a26c6828a66908a199276193bb0b268f2dcc1a997731e9 -NOSCRIPT_HASH=fdd965a69188ac651b08a7d3ada54821a89db10a4685aa73ba59edc0b8243390 +NOSCRIPT_HASH=3fa641dcb60455c950cef0c15effa8ca060b3b05405f46f55cbdb922929027e7 CCTOOLS_HASH=e908fdebc2886ee5491ebfc7e7950af451b3c4e2439c2d7a923ed06ad05113e4 MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index 179f882..8eaeae6 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -12,7 +12,7 @@ build_targets: osx32: Darwin_x86-gcc3 osx64: Darwin_x86_64-gcc3 channels: - hardened: 6.5a1-hardened + hardened: 6.5a2-hardened release: 6.0.1 versions: 6.0.1: @@ -26,12 +26,12 @@ versions: osx32: minSupportedOSVersion: 10.8 detailsURL: https://blog.torproject.org/blog/end-life-plan-tor-browser-32-bit-macs#upda… - 6.5a1-hardened: - platformVersion: 45.2.0 - detailsURL: https://blog.torproject.org/blog/tor-browser-65a1-hardened-released - download_url: https://cdn.torproject.org/aus1/torbrowser/6.5a1-hardened + 6.5a2-hardened: + platformVersion: 45.3.0 + detailsURL: https://blog.torproject.org/blog/tor-browser-65a2-hardened-released + download_url: https://cdn.torproject.org/aus1/torbrowser/6.5a2-hardened incremental_from: - - 6.0a5-hardened + - 6.5a1-hardened migrate_archs: osx32: osx64 osx32:

1 0

[tor-browser-bundle/hardened-builds] Bug 19737: Allow git tag signatures made using an expired key
by gk＠torproject.org 01 Aug '16

01 Aug '16

commit c6458e49f9dd51708e22c84f26195c50d0ff2d0b Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Jul 27 22:53:19 2016 +0200 Bug 19737: Allow git tag signatures made using an expired key We are adding a gitian/git-gpg-wrapper script which validates signatures made using an expired key. To do that, we use gpgv rather than gpg, and any EXPKEYSIG line from the gpg `--status-fd` output is replaced by a GOODSIG line. --- gitian/git-gpg-wrapper | 13 +++++++++++++ gitian/verify-tags.sh | 3 ++- 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/gitian/git-gpg-wrapper b/gitian/git-gpg-wrapper new file mode 100644 index 0000000..f137d6d --- /dev/null +++ b/gitian/git-gpg-wrapper @@ -0,0 +1,13 @@ +#!/bin/bash +# This wrapper script is used by git to verify signatures made using +# an expired key. +# https://bugs.torproject.org/19737 +set -e +if [ $# -eq 4 ] && [ "$1" = '--status-fd=1' ] \ + && [ "$2" = '--verify' ] +then + gpgv "$1" "$3" "$4" | sed 's/^\[GNUPG:\] EXPKEYSIG /\[GNUPG:\] GOODSIG /' + exit ${PIPESTATUS[0]} +else + exec gpg "$@" +fi diff --git a/gitian/verify-tags.sh b/gitian/verify-tags.sh index 5908801..8277fca 100755 --- a/gitian/verify-tags.sh +++ b/gitian/verify-tags.sh @@ -37,10 +37,11 @@ verify_git() { local gpghome=$(mktemp -d) echo "rm -rf '$gpghome'" >> "$CLEANUP" - GNUPGHOME="$gpghome" gpg --import "$keyring" + GNUPGHOME="$gpghome" gpg --no-default-keyring --keyring trustedkeys.gpg --import "$keyring" pushd . cd "$dir" + git config --local gpg.program "$WRAPPER_DIR/git-gpg-wrapper" if ! GNUPGHOME="$gpghome" git tag -v "$tag"; then echo >&2 "$dir: verification of tag $tag against $keyring failed!" exit 1

1 0

[tor-browser-bundle/master] Update Chaneglog and tor-browser version
by gk＠torproject.org 30 Jul '16

30 Jul '16

commit 8eca2970d9b1b3b4d071f4cb837e16d7637e83b9 Author: Georg Koppen <gk(a)torproject.org> Date: Sat Jul 30 11:56:37 2016 +0000 Update Chaneglog and tor-browser version --- Bundle-Data/Docs/ChangeLog.txt | 2 ++ gitian/versions.alpha | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 0f089ec..eb79991 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -26,8 +26,10 @@ Tor Browser 6.5a2 -- August 3 * Bug 19735: Switch default search engine to DuckDuckGo * Windows * Bug 19348: Adapt to more than one build target on Windows (fixes updates) + * Bug 19725: Remove old updater files left on disk after upgrade to 6.x * Linux * Bug 19276: Disable Xrender due to possible performance regressions + * Bug 19725: Remove old updater files left on disk after upgrade to 6.x * OS X * Bug 19269: Icon doesn't appear in Applications folder or Dock * Android diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 031a839..4be792f 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -14,7 +14,7 @@ FIREFOX_VERSION=45.3.0esr TORBROWSER_UPDATE_CHANNEL=alpha -TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-6.5-1-build1 +TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-6.5-1-build2 TOR_TAG=tor-0.2.8.5-rc TORLAUNCHER_TAG=0.2.9.3 TORBUTTON_TAG=1.9.6.1

1 0

[tor-browser/tor-browser-45.3.0esr-6.5-1] fixup! Bug #4234: Use the Firefox Update Process for Tor Browser.
by gk＠torproject.org 30 Jul '16

30 Jul '16

commit e0f6ebcc0f63602d59bb1b954029d1950a3e58a5 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue Jul 26 10:40:24 2016 -0400 fixup! Bug #4234: Use the Firefox Update Process for Tor Browser. When updating from an earlier version to Tor Browser 6.0 or later, old update info files are left behind on Linux and Windows. Remove them. This fixes bug 19725. --- toolkit/mozapps/update/nsUpdateService.js | 40 +++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) diff --git a/toolkit/mozapps/update/nsUpdateService.js b/toolkit/mozapps/update/nsUpdateService.js index 4495210..b9b91fc 100644 --- a/toolkit/mozapps/update/nsUpdateService.js +++ b/toolkit/mozapps/update/nsUpdateService.js @@ -1946,6 +1946,10 @@ UpdateService.prototype = { * notify the user of install success. */ _postUpdateProcessing: function AUS__postUpdateProcessing() { +#if defined(TOR_BROWSER_UPDATE) && !defined(XP_MACOSX) + this._removeOrphanedTorBrowserFiles(); +#endif + if (!this.canCheckForUpdates) { LOG("UpdateService:_postUpdateProcessing - unable to check for " + "updates... returning early"); @@ -2113,6 +2117,42 @@ UpdateService.prototype = { cleanUpMozUpdaterDirs(); }, +#if defined(TOR_BROWSER_UPDATE) && !defined(XP_MACOSX) + /** + * When updating from an earlier version to Tor Browser 6.0 or later, old + * update info files are left behind on Linux and Windows. Remove them. + */ + _removeOrphanedTorBrowserFiles: function AUS__removeOrphanedTorBrowserFiles() { + try { + let oldUpdateInfoDir = getAppBaseDir(); // aka the Browser directory. + +#ifdef XP_WIN + // On Windows, the updater files were stored under + // Browser/TorBrowser/Data/Browser/Caches/firefox/ + oldUpdateInfoDir.appendRelativePath( + "TorBrowser\\Data\\Browser\\Caches\\firefox"); +#endif + + // Remove the updates directory. + let updatesDir = oldUpdateInfoDir.clone(); + updatesDir.append("updates"); + if (updatesDir.exists() && updatesDir.isDirectory()) { + updatesDir.remove(true); + } + + // Remove files: active-update.xml and updates.xml + let filesToRemove = [ "active-update.xml", "updates.xml" ]; + filesToRemove.forEach(function(aFileName) { + let f = oldUpdateInfoDir.clone(); + f.append(aFileName); + if (f.exists()) { + f.remove(false); + } + }); + } catch (e) {} + }, +#endif + /** * Register an observer when the network comes online, so we can short-circuit * the app.update.interval when there isn't connectivity

1 0

[tor-browser-bundle/hardened-builds] Bug 19703: Upgrade Go to 1.6.3.
by gk＠torproject.org 30 Jul '16

30 Jul '16

commit 645f3ea6c81aef0b8d1ef25ae2d9ebe30d7669a6 Author: David Fifield <david(a)bamsoftware.com> Date: Thu Jul 21 16:15:19 2016 -0700 Bug 19703: Upgrade Go to 1.6.3. --- gitian/versions | 4 ++-- gitian/versions.alpha | 4 ++-- gitian/versions.beta | 4 ++-- gitian/versions.nightly | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/gitian/versions b/gitian/versions index d45eca0..22b52ff 100755 --- a/gitian/versions +++ b/gitian/versions @@ -58,7 +58,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 # We need a Go 1.4 to bootstrap later versions; see https://golang.org/doc/install/source#go14 GO14_VER=1.4.3 -GO_VER=1.6.2 +GO_VER=1.6.3 NSIS_VER=2.51 ## File names for the source packages @@ -110,7 +110,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 -GO_HASH=787b0b750d037016a30c6ed05a8a70a91b2e9db4bd9b1a2453aa502a63f1bccc +GO_HASH=6326aeed5f86cf18f16d6dc831405614f855e2d416a91fd3fdc334f772345b00 NSIS_HASH=43d4c9209847e35eb6e2c7cd5a7586e1445374c056c2c7899e40a080e17a1be7 NSIS_DEBIAN_HASH=1dee6957b4a4b8dfe69bcf28bc7f301a13b96b3fa5a394e36c8926ae781e774a GCC_HASH=b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 81f8a47..29595cc 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -66,7 +66,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 # We need a Go 1.4 to bootstrap later versions; see https://golang.org/doc/install/source#go14 GO14_VER=1.4.3 -GO_VER=1.6.2 +GO_VER=1.6.3 NSIS_VER=2.51 ## File names for the source packages @@ -118,7 +118,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 -GO_HASH=787b0b750d037016a30c6ed05a8a70a91b2e9db4bd9b1a2453aa502a63f1bccc +GO_HASH=6326aeed5f86cf18f16d6dc831405614f855e2d416a91fd3fdc334f772345b00 NSIS_HASH=43d4c9209847e35eb6e2c7cd5a7586e1445374c056c2c7899e40a080e17a1be7 NSIS_DEBIAN_HASH=1dee6957b4a4b8dfe69bcf28bc7f301a13b96b3fa5a394e36c8926ae781e774a GCC_HASH=5f835b04b5f7dd4f4d2dc96190ec1621b8d89f2dc6f638f9f8bc1b1014ba8cad diff --git a/gitian/versions.beta b/gitian/versions.beta index 7a305a1..92761a4 100755 --- a/gitian/versions.beta +++ b/gitian/versions.beta @@ -51,7 +51,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 # We need a Go 1.4 to bootstrap later versions; see https://golang.org/doc/install/source#go14 GO14_VER=1.4.3 -GO_VER=1.6.2 +GO_VER=1.6.3 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz @@ -102,7 +102,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 -GO_HASH=787b0b750d037016a30c6ed05a8a70a91b2e9db4bd9b1a2453aa502a63f1bccc +GO_HASH=6326aeed5f86cf18f16d6dc831405614f855e2d416a91fd3fdc334f772345b00 STIXMATHFONT_HASH=e3b0f712e2644438eee2d0dcd2b10b2d54f1b972039de95b2f8e800bae1adbd8 NOTOEMOJIFONT_HASH=415dc6290378574135b64c808dc640c1df7531973290c4970c51fdeb849cb0c5 NOTOJPFONT_HASH=3e8146c4ce0945f255cb9dbc12b392380af80bd117e0a60eae555c99c7e618da diff --git a/gitian/versions.nightly b/gitian/versions.nightly index c6dad5b..dead59c 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -70,7 +70,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 # We need a Go 1.4 to bootstrap later versions; see https://golang.org/doc/install/source#go14 GO14_VER=1.4.3 -GO_VER=1.6.2 +GO_VER=1.6.3 NSIS_VER=2.51 ELFUTILS_VER=0.160 @@ -124,7 +124,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 -GO_HASH=787b0b750d037016a30c6ed05a8a70a91b2e9db4bd9b1a2453aa502a63f1bccc +GO_HASH=6326aeed5f86cf18f16d6dc831405614f855e2d416a91fd3fdc334f772345b00 NSIS_HASH=43d4c9209847e35eb6e2c7cd5a7586e1445374c056c2c7899e40a080e17a1be7 NSIS_DEBIAN_HASH=1dee6957b4a4b8dfe69bcf28bc7f301a13b96b3fa5a394e36c8926ae781e774a GCC_HASH=5f835b04b5f7dd4f4d2dc96190ec1621b8d89f2dc6f638f9f8bc1b1014ba8cad

1 0

[tor-browser-bundle/master] Update Changelog (for Go update)
by gk＠torproject.org 30 Jul '16

30 Jul '16

commit 081e1be4fe08bce70a1a2874e7832493c5360f20 Author: Georg Koppen <gk(a)torproject.org> Date: Sat Jul 30 11:45:39 2016 +0000 Update Changelog (for Go update) --- Bundle-Data/Docs/ChangeLog.txt | 3 +++ 1 file changed, 3 insertions(+) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 264f839..0f089ec 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -32,6 +32,9 @@ Tor Browser 6.5a2 -- August 3 * Bug 19269: Icon doesn't appear in Applications folder or Dock * Android * Bug 19484: Avoid compilation error when MOZ_UPDATER is not defined + * Build System + * All Platforms + * Bug 19703: Upgrade Go to 1.6.3 Tor Browser 6.0.2 -- June 21 * All Platforms

1 0

[tor-browser-bundle/master] Bug 19703: Upgrade Go to 1.6.3.
by gk＠torproject.org 30 Jul '16

30 Jul '16

commit 1aa712a555e0ec9ff7a121f2d7429b4783bcf2ad Author: David Fifield <david(a)bamsoftware.com> Date: Thu Jul 21 16:15:19 2016 -0700 Bug 19703: Upgrade Go to 1.6.3. --- gitian/versions | 4 ++-- gitian/versions.alpha | 4 ++-- gitian/versions.beta | 4 ++-- gitian/versions.nightly | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/gitian/versions b/gitian/versions index 96e684a..c3fdb32 100755 --- a/gitian/versions +++ b/gitian/versions @@ -62,7 +62,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 # We need a Go 1.4 to bootstrap later versions; see https://golang.org/doc/install/source#go14 GO14_VER=1.4.3 -GO_VER=1.6.2 +GO_VER=1.6.3 NSIS_VER=2.51 ## File names for the source packages @@ -114,7 +114,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 -GO_HASH=787b0b750d037016a30c6ed05a8a70a91b2e9db4bd9b1a2453aa502a63f1bccc +GO_HASH=6326aeed5f86cf18f16d6dc831405614f855e2d416a91fd3fdc334f772345b00 NSIS_HASH=43d4c9209847e35eb6e2c7cd5a7586e1445374c056c2c7899e40a080e17a1be7 NSIS_DEBIAN_HASH=1dee6957b4a4b8dfe69bcf28bc7f301a13b96b3fa5a394e36c8926ae781e774a GCC_HASH=b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 14b68dc..031a839 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -62,7 +62,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 # We need a Go 1.4 to bootstrap later versions; see https://golang.org/doc/install/source#go14 GO14_VER=1.4.3 -GO_VER=1.6.2 +GO_VER=1.6.3 NSIS_VER=2.51 ## File names for the source packages @@ -114,7 +114,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 -GO_HASH=787b0b750d037016a30c6ed05a8a70a91b2e9db4bd9b1a2453aa502a63f1bccc +GO_HASH=6326aeed5f86cf18f16d6dc831405614f855e2d416a91fd3fdc334f772345b00 NSIS_HASH=43d4c9209847e35eb6e2c7cd5a7586e1445374c056c2c7899e40a080e17a1be7 NSIS_DEBIAN_HASH=1dee6957b4a4b8dfe69bcf28bc7f301a13b96b3fa5a394e36c8926ae781e774a GCC_HASH=b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad diff --git a/gitian/versions.beta b/gitian/versions.beta index 3a1d893..89003ff 100755 --- a/gitian/versions.beta +++ b/gitian/versions.beta @@ -49,7 +49,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 # We need a Go 1.4 to bootstrap later versions; see https://golang.org/doc/install/source#go14 GO14_VER=1.4.3 -GO_VER=1.6.2 +GO_VER=1.6.3 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz @@ -96,7 +96,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 -GO_HASH=787b0b750d037016a30c6ed05a8a70a91b2e9db4bd9b1a2453aa502a63f1bccc +GO_HASH=6326aeed5f86cf18f16d6dc831405614f855e2d416a91fd3fdc334f772345b00 STIXMATHFONT_HASH=e3b0f712e2644438eee2d0dcd2b10b2d54f1b972039de95b2f8e800bae1adbd8 NOTOEMOJIFONT_HASH=415dc6290378574135b64c808dc640c1df7531973290c4970c51fdeb849cb0c5 NOTOJPFONT_HASH=3e8146c4ce0945f255cb9dbc12b392380af80bd117e0a60eae555c99c7e618da diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 88394c6..7d66421 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -69,7 +69,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 # We need a Go 1.4 to bootstrap later versions; see https://golang.org/doc/install/source#go14 GO14_VER=1.4.3 -GO_VER=1.6.2 +GO_VER=1.6.3 NSIS_VER=2.51 ## File names for the source packages @@ -121,7 +121,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 -GO_HASH=787b0b750d037016a30c6ed05a8a70a91b2e9db4bd9b1a2453aa502a63f1bccc +GO_HASH=6326aeed5f86cf18f16d6dc831405614f855e2d416a91fd3fdc334f772345b00 NSIS_HASH=43d4c9209847e35eb6e2c7cd5a7586e1445374c056c2c7899e40a080e17a1be7 NSIS_DEBIAN_HASH=1dee6957b4a4b8dfe69bcf28bc7f301a13b96b3fa5a394e36c8926ae781e774a GCC_HASH=b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad

1 0

[tor-browser-bundle/master] Release preparations for 6.5a2
by gk＠torproject.org 30 Jul '16

30 Jul '16

commit 14379e81b51d6aecf3b27c20c471990f4a1dc08f Author: Georg Koppen <gk(a)torproject.org> Date: Sat Jul 30 11:15:10 2016 +0000 Release preparations for 6.5a2 Version bumps; changelog update; config.yml update --- Bundle-Data/Docs/ChangeLog.txt | 35 +++++++++++++++++++++++++++++++++++ gitian/versions.alpha | 14 +++++++------- tools/update-responses/config.yml | 12 ++++++------ 3 files changed, 48 insertions(+), 13 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index ae5529d..264f839 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,38 @@ +Tor Browser 6.5a2 -- August 3 + * All Platforms + * Update Firefox to 45.3.0esr + * Update Tor to tor-0.2.8.5-rc + * Update Torbutton to 1.9.6.1 + * Bug 19689: Use proper parent window for plugin prompt + * Bug 19206: Avoid SOCKS auth and NEWNYM collisions when sharing a tor client + * Bug 19417: Disable asm.js (but add code to clear on New Identity if enabled) + * Bug 19273: Improve external app launch handling and associated warnings + * Bug 8725: Block addon resource and url fingerprinting with nsIContentPolicy + * Update HTTPS-Everywhere to 5.2.1 + * Update NoScript to 2.9.0.12 + * Bug 19417: Disable asmjs for now + * Bug 19715: Disable the meek-google pluggable transport option + * Bug 19714: Remove mercurius4 obfs4 bridge + * Bug 19585: Fix regression test for keyboard layout fingerprinting + * Bug 19515: Tor Browser is crashing in graphics code + * Bug 18513: Favicon requests can bypass New Identity + * Bug 19273: Write C++ patch for external app launch handling + * Bug 16998: Isolate preconnect requests to URL bar domain + * Bug 18923: Add script to run all Tor Browser regression tests + * Bug 19478: Prevent millisecond resolution leaks in File API + * Bug 19401: Fix broken PDF download button + * Bug 19411: Don't show update icon if a partial update failed + * Bug 19400: Back out GCC bug workaround to avoid asmjs crash + * Bug 19735: Switch default search engine to DuckDuckGo + * Windows + * Bug 19348: Adapt to more than one build target on Windows (fixes updates) + * Linux + * Bug 19276: Disable Xrender due to possible performance regressions + * OS X + * Bug 19269: Icon doesn't appear in Applications folder or Dock + * Android + * Bug 19484: Avoid compilation error when MOZ_UPDATER is not defined + Tor Browser 6.0.2 -- June 21 * All Platforms * Update Torbutton to 1.9.5.5 diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 39b3c98..14b68dc 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -10,15 +10,15 @@ DATA_OUTSIDE_APP_DIR=1 VERIFY_TAGS=1 -FIREFOX_VERSION=45.2.0esr +FIREFOX_VERSION=45.3.0esr TORBROWSER_UPDATE_CHANNEL=alpha TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-6.5-1-build1 -TOR_TAG=tor-0.2.8.3-alpha +TOR_TAG=tor-0.2.8.5-rc TORLAUNCHER_TAG=0.2.9.3 -TORBUTTON_TAG=1.9.6 -HTTPSE_TAG=5.1.9 +TORBUTTON_TAG=1.9.6.1 +HTTPSE_TAG=5.2.1 NSIS_TAG=v0.3.1 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.22-stable @@ -47,7 +47,7 @@ GITIAN_TAG=tor-browser-builder-4-1 OPENSSL_VER=1.0.1t GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION -FIREFOX_LANG_BUILD=build2 +FIREFOX_LANG_BUILD=build1 BINUTILS_VER=2.24 GCC_VER=5.1.0 CLANG_VER=r247539 @@ -68,7 +68,7 @@ NSIS_VER=2.51 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 -NOSCRIPT_PACKAGE=noscript_security_suite-2.9.0.11-fn+sm+fx.xpi +NOSCRIPT_PACKAGE=noscript_security_suite-2.9.0.12-fx+fn+sm.xpi TOOLCHAIN4_OLD_PACKAGE=multiarch-darwin11-cctools127.2-gcc42-5666.3-llvmgcc42-2336.1-Linux-120724.tar.xz CCTOOLS_PACKAGE=cctools.tar.gz OSXSDK_PACKAGE=MacOSX10.7.sdk.tar.gz @@ -102,7 +102,7 @@ GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf OSXSDK_OLD_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc TOOLCHAIN4_OLD_HASH=65c1b2d302358a6b95a26c6828a66908a199276193bb0b268f2dcc1a997731e9 -NOSCRIPT_HASH=fdd965a69188ac651b08a7d3ada54821a89db10a4685aa73ba59edc0b8243390 +NOSCRIPT_HASH=3fa641dcb60455c950cef0c15effa8ca060b3b05405f46f55cbdb922929027e7 CCTOOLS_HASH=e908fdebc2886ee5491ebfc7e7950af451b3c4e2439c2d7a923ed06ad05113e4 MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index 0425afc..7b92a72 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -12,7 +12,7 @@ build_targets: osx32: Darwin_x86-gcc3 osx64: Darwin_x86_64-gcc3 channels: - alpha: 6.5a1 + alpha: 6.5a2 release: 6.0.1 versions: 6.0.1: @@ -27,12 +27,12 @@ versions: osx32: minSupportedOSVersion: 10.8 detailsURL: https://blog.torproject.org/blog/end-life-plan-tor-browser-32-bit-macs#upda… - 6.5a1: - platformVersion: 45.2.0 - detailsURL: https://blog.torproject.org/blog/tor-browser-65a1-released - download_url: https://cdn.torproject.org/aus1/torbrowser/6.5a1 + 6.5a2: + platformVersion: 45.3.0 + detailsURL: https://blog.torproject.org/blog/tor-browser-65a2-released + download_url: https://cdn.torproject.org/aus1/torbrowser/6.5a2 incremental_from: - - 6.0a5 + - 6.5a1 migrate_archs: osx32: osx64 osx32:

1 0

[tor-browser-bundle/master] Making the git-gpg-wrapper executable
by gk＠torproject.org 30 Jul '16

30 Jul '16

commit 771b1ad79107ad15ea26c2b41da7267dc2e8fb56 Author: Georg Koppen <gk(a)torproject.org> Date: Sat Jul 30 10:00:11 2016 +0000 Making the git-gpg-wrapper executable --- gitian/git-gpg-wrapper | 0 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/gitian/git-gpg-wrapper b/gitian/git-gpg-wrapper old mode 100644 new mode 100755

1 0

[tor-browser-bundle/master] Update gk's key
by gk＠torproject.org 30 Jul '16

30 Jul '16

commit 638d79fccb2e49ad871616e3cc339ff031df524c Author: Georg Koppen <gk(a)torproject.org> Date: Sat Jul 30 09:29:24 2016 +0000 Update gk's key --- gitian/gpg/gk.gpg | Bin 33866 -> 72418 bytes gitian/gpg/torbutton.gpg | Bin 55562 -> 94114 bytes 2 files changed, 0 insertions(+), 0 deletions(-) diff --git a/gitian/gpg/gk.gpg b/gitian/gpg/gk.gpg index ad731ca..2f78b14 100644 Binary files a/gitian/gpg/gk.gpg and b/gitian/gpg/gk.gpg differ diff --git a/gitian/gpg/torbutton.gpg b/gitian/gpg/torbutton.gpg index e4a03dd..da40f76 100644 Binary files a/gitian/gpg/torbutton.gpg and b/gitian/gpg/torbutton.gpg differ

1 0

[tor-browser-bundle/master] Bug 19737: Allow git tag signatures made using an expired key
by gk＠torproject.org 30 Jul '16

30 Jul '16

commit 7923b2184b46d4f9b861db256f28e00ee47d390d Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Jul 27 22:53:19 2016 +0200 Bug 19737: Allow git tag signatures made using an expired key We are adding a gitian/git-gpg-wrapper script which validates signatures made using an expired key. To do that, we use gpgv rather than gpg, and any EXPKEYSIG line from the gpg `--status-fd` output is replaced by a GOODSIG line. --- gitian/git-gpg-wrapper | 13 +++++++++++++ gitian/verify-tags.sh | 3 ++- 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/gitian/git-gpg-wrapper b/gitian/git-gpg-wrapper new file mode 100644 index 0000000..f137d6d --- /dev/null +++ b/gitian/git-gpg-wrapper @@ -0,0 +1,13 @@ +#!/bin/bash +# This wrapper script is used by git to verify signatures made using +# an expired key. +# https://bugs.torproject.org/19737 +set -e +if [ $# -eq 4 ] && [ "$1" = '--status-fd=1' ] \ + && [ "$2" = '--verify' ] +then + gpgv "$1" "$3" "$4" | sed 's/^\[GNUPG:\] EXPKEYSIG /\[GNUPG:\] GOODSIG /' + exit ${PIPESTATUS[0]} +else + exec gpg "$@" +fi diff --git a/gitian/verify-tags.sh b/gitian/verify-tags.sh index 7d92e36..baea827 100755 --- a/gitian/verify-tags.sh +++ b/gitian/verify-tags.sh @@ -37,10 +37,11 @@ verify_git() { local gpghome=$(mktemp -d) echo "rm -rf '$gpghome'" >> "$CLEANUP" - GNUPGHOME="$gpghome" gpg --import "$keyring" + GNUPGHOME="$gpghome" gpg --no-default-keyring --keyring trustedkeys.gpg --import "$keyring" pushd . cd "$dir" + git config --local gpg.program "$WRAPPER_DIR/git-gpg-wrapper" if ! GNUPGHOME="$gpghome" git tag -v "$tag"; then echo >&2 "$dir: verification of tag $tag against $keyring failed!" exit 1

1 0

[tor-browser/tor-browser-45.2.0esr-6.5-1] fixup! fixup! Regression tests for "Omnibox: Add DDG, Startpage, Disconnect, Youtube, Twitter; remove Amazon, eBay, bing"
by gk＠torproject.org 30 Jul '16

30 Jul '16

commit 83f53ee4897f6047c0c691d86833c6960311768e Author: Georg Koppen <gk(a)torproject.org> Date: Sat Jul 30 10:36:40 2016 +0000 fixup! fixup! Regression tests for "Omnibox: Add DDG, Startpage, Disconnect, Youtube, Twitter; remove Amazon, eBay, bing" Fixup typo. --- tbb-tests/browser_tor_omnibox.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tbb-tests/browser_tor_omnibox.js b/tbb-tests/browser_tor_omnibox.js index 082dd84..e18b2a8 100644 --- a/tbb-tests/browser_tor_omnibox.js +++ b/tbb-tests/browser_tor_omnibox.js @@ -8,7 +8,7 @@ function test() { engineIDs = browserSearchService.getEngines().map(e => e.identifier); // Check that we have the correct engines installed, in the right order. - is(engineIDs[0], "ddg", "Default search engine is disconnect"); + is(engineIDs[0], "ddg", "Default search engine is duckduckgo"); is(engineIDs[1], "youtube", "Secondary search engine is youtube"); is(engineIDs[2], "google", "Google is third search engine"); }

1 0

[tor-browser-bundle/maint-6.0] Making the git-gpg-wrapper executable
by gk＠torproject.org 30 Jul '16

30 Jul '16

commit 89a0db3a46be3c97b82c11fa85d66e97ee406971 Author: Georg Koppen <gk(a)torproject.org> Date: Sat Jul 30 10:00:11 2016 +0000 Making the git-gpg-wrapper executable --- gitian/git-gpg-wrapper | 0 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/gitian/git-gpg-wrapper b/gitian/git-gpg-wrapper old mode 100644 new mode 100755

1 0

[tor-browser-bundle/maint-6.0] Update gk's key
by gk＠torproject.org 30 Jul '16

30 Jul '16

commit f40aa39010ca734f40e2888604d7a631aa31f5f5 Author: Georg Koppen <gk(a)torproject.org> Date: Sat Jul 30 09:29:24 2016 +0000 Update gk's key --- gitian/gpg/gk.gpg | Bin 33866 -> 72418 bytes gitian/gpg/torbutton.gpg | Bin 55562 -> 94114 bytes 2 files changed, 0 insertions(+), 0 deletions(-) diff --git a/gitian/gpg/gk.gpg b/gitian/gpg/gk.gpg index ad731ca..2f78b14 100644 Binary files a/gitian/gpg/gk.gpg and b/gitian/gpg/gk.gpg differ diff --git a/gitian/gpg/torbutton.gpg b/gitian/gpg/torbutton.gpg index e4a03dd..da40f76 100644 Binary files a/gitian/gpg/torbutton.gpg and b/gitian/gpg/torbutton.gpg differ

1 0

[tor-browser-bundle/maint-6.0] Version bumps; Changelog update
by gk＠torproject.org 30 Jul '16

30 Jul '16

commit 12dcde3326c98fea5bce7a017269492620cd11ca Author: Georg Koppen <gk(a)torproject.org> Date: Sat Jul 30 11:21:59 2016 +0200 Version bumps; Changelog update --- Bundle-Data/Docs/ChangeLog.txt | 1 + gitian/versions | 12 ++++++------ 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 2abd47e..c4a255d 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -5,6 +5,7 @@ Tor Browser 6.0.3 -- August 2 * Bug 19417: Disable asmjs for now * Bug 19689: Use proper parent window for plugin prompt * Update HTTPS-Everywhere to 5.2.1 + * Update NoScript to 2.9.0.12 * Bug 19417: Disable asmjs for now * Bug 19715: Disable the meek-google pluggable transport option * Bug 19714: Remove mercurius4 obfs4 bridge diff --git a/gitian/versions b/gitian/versions index c46c735..f6d8648 100755 --- a/gitian/versions +++ b/gitian/versions @@ -10,14 +10,14 @@ DATA_OUTSIDE_APP_DIR=1 VERIFY_TAGS=1 -FIREFOX_VERSION=45.2.0esr +FIREFOX_VERSION=45.3.0esr TORBROWSER_UPDATE_CHANNEL=release -TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-6.0-1-build2 +TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-6.0-1-build1 TOR_TAG=tor-0.2.7.6 TORLAUNCHER_TAG=0.2.9.3 -TORBUTTON_TAG=1.9.5.5 +TORBUTTON_TAG=1.9.5.6 HTTPSE_TAG=5.2.1 NSIS_TAG=v0.3.1 ZLIB_TAG=v1.2.8 @@ -47,7 +47,7 @@ GITIAN_TAG=tor-browser-builder-4-1 OPENSSL_VER=1.0.1t GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION -FIREFOX_LANG_BUILD=build2 +FIREFOX_LANG_BUILD=build1 BINUTILS_VER=2.24 GCC_VER=5.1.0 CLANG_VER=r247539 @@ -66,7 +66,7 @@ NSIS_VER=2.51 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 -NOSCRIPT_PACKAGE=noscript_security_suite-2.9.0.11-fn+sm+fx.xpi +NOSCRIPT_PACKAGE=noscript_security_suite-2.9.0.12-fx+fn+sm.xpi TOOLCHAIN4_OLD_PACKAGE=multiarch-darwin11-cctools127.2-gcc42-5666.3-llvmgcc42-2336.1-Linux-120724.tar.xz CCTOOLS_PACKAGE=cctools.tar.gz OSXSDK_PACKAGE=MacOSX10.7.sdk.tar.gz @@ -99,7 +99,7 @@ GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf OSXSDK_OLD_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc TOOLCHAIN4_OLD_HASH=65c1b2d302358a6b95a26c6828a66908a199276193bb0b268f2dcc1a997731e9 -NOSCRIPT_HASH=fdd965a69188ac651b08a7d3ada54821a89db10a4685aa73ba59edc0b8243390 +NOSCRIPT_HASH=3fa641dcb60455c950cef0c15effa8ca060b3b05405f46f55cbdb922929027e7 CCTOOLS_HASH=e908fdebc2886ee5491ebfc7e7950af451b3c4e2439c2d7a923ed06ad05113e4 MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c

1 0

[tor-browser-bundle/maint-6.0] Bug 19737: Allow git tag signatures made using an expired key
by gk＠torproject.org 30 Jul '16

30 Jul '16

commit adcf907e1d54de5b9fcca736ca28b69d70c738fb Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Jul 27 22:53:19 2016 +0200 Bug 19737: Allow git tag signatures made using an expired key We are adding a gitian/git-gpg-wrapper script which validates signatures made using an expired key. To do that, we use gpgv rather than gpg, and any EXPKEYSIG line from the gpg `--status-fd` output is replaced by a GOODSIG line. --- gitian/git-gpg-wrapper | 13 +++++++++++++ gitian/verify-tags.sh | 3 ++- 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/gitian/git-gpg-wrapper b/gitian/git-gpg-wrapper new file mode 100644 index 0000000..f137d6d --- /dev/null +++ b/gitian/git-gpg-wrapper @@ -0,0 +1,13 @@ +#!/bin/bash +# This wrapper script is used by git to verify signatures made using +# an expired key. +# https://bugs.torproject.org/19737 +set -e +if [ $# -eq 4 ] && [ "$1" = '--status-fd=1' ] \ + && [ "$2" = '--verify' ] +then + gpgv "$1" "$3" "$4" | sed 's/^\[GNUPG:\] EXPKEYSIG /\[GNUPG:\] GOODSIG /' + exit ${PIPESTATUS[0]} +else + exec gpg "$@" +fi diff --git a/gitian/verify-tags.sh b/gitian/verify-tags.sh index a966626..e006fb0 100755 --- a/gitian/verify-tags.sh +++ b/gitian/verify-tags.sh @@ -37,10 +37,11 @@ verify_git() { local gpghome=$(mktemp -d) echo "rm -rf '$gpghome'" >> "$CLEANUP" - GNUPGHOME="$gpghome" gpg --import "$keyring" + GNUPGHOME="$gpghome" gpg --no-default-keyring --keyring trustedkeys.gpg --import "$keyring" pushd . cd "$dir" + git config --local gpg.program "$WRAPPER_DIR/git-gpg-wrapper" if ! GNUPGHOME="$gpghome" git tag -v "$tag"; then echo >&2 "$dir: verification of tag $tag against $keyring failed!" exit 1

1 0

[tor-browser/tor-browser-45.2.0esr-6.5-1] fixup! Regression tests for "Omnibox: Add DDG, Startpage, Disconnect, Youtube, Twitter; remove Amazon, eBay, bing"
by mikeperry＠torproject.org 29 Jul '16

29 Jul '16

commit 146ae4cc141f702785f896ff8c90bdfa0ab90b60 Author: difw <something@something> Date: Fri Jul 29 09:32:22 2016 -0700 fixup! Regression tests for "Omnibox: Add DDG, Startpage, Disconnect, Youtube, Twitter; remove Amazon, eBay, bing" Update tests. --- tbb-tests/browser_tor_omnibox.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tbb-tests/browser_tor_omnibox.js b/tbb-tests/browser_tor_omnibox.js index 8648551..082dd84 100644 --- a/tbb-tests/browser_tor_omnibox.js +++ b/tbb-tests/browser_tor_omnibox.js @@ -8,7 +8,7 @@ function test() { engineIDs = browserSearchService.getEngines().map(e => e.identifier); // Check that we have the correct engines installed, in the right order. - is(engineIDs[0], "disconnect", "Default search engine is disconnect"); + is(engineIDs[0], "ddg", "Default search engine is disconnect"); is(engineIDs[1], "youtube", "Secondary search engine is youtube"); is(engineIDs[2], "google", "Google is third search engine"); }

1 0

[tor-browser/tor-browser-45.2.0esr-6.5-1] fixup! Omnibox: Add DDG, Startpage, Disconnect, Youtube, Twitter; remove Amazon, eBay, bing
by mikeperry＠torproject.org 29 Jul '16

29 Jul '16

commit 59a087921cc38432f6829c3bccf3ba23fe184c63 Author: difw <something@something> Date: Thu Jul 28 12:15:05 2016 -0700 fixup! Omnibox: Add DDG, Startpage, Disconnect, Youtube, Twitter; remove Amazon, eBay, bing Switch Default to DuckDuckGo HTTPS. Add .onion. --- browser/app/profile/000-tor-browser.js | 4 ++-- browser/locales/en-US/searchplugins/ddg-onion.xml | 11 +++++++++++ browser/locales/en-US/searchplugins/ddg.xml | 4 ++-- browser/locales/en-US/searchplugins/list.txt | 1 + 4 files changed, 16 insertions(+), 4 deletions(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index c60b341..a5c0e7f 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -268,7 +268,7 @@ pref("browser.uiCustomization.state", "{\"placements\":{\"PanelUI-contents\":[\" // Putting the search engine prefs into this file to fix #11236. // Default search engine -pref("browser.search.defaultenginename", "Disconnect"); +pref("browser.search.defaultenginename", "DuckDuckGo"); // Make sure we use the same search engine regardless of locale pref("browser.search.geoSpecificDefaults", false); @@ -276,7 +276,7 @@ pref("browser.search.geoSpecificDefaults", false); // Somewhat surprisingly we get some random behavior if we specify more than // two search engines as below. See // https://bugzilla.mozilla.org/show_bug.cgi?id=1126722 for details. -pref("browser.search.order.extra.1", "Disconnect"); +pref("browser.search.order.extra.1", "DuckDuckGo"); pref("browser.search.order.extra.2", "YouTube"); // Hacks/workarounds: Direct2D seems to crash w/ lots of video cards w/ MinGW? diff --git a/browser/locales/en-US/searchplugins/ddg-onion.xml b/browser/locales/en-US/searchplugins/ddg-onion.xml new file mode 100644 index 0000000..009da7e --- /dev/null +++ b/browser/locales/en-US/searchplugins/ddg-onion.xml @@ -0,0 +1,11 @@ +<SearchPlugin xmlns="http://www.mozilla.org/2006/browser/search/"> +<ShortName>DuckDuckGoOnion</ShortName> +<Description>Duck Duck Go Onion</Description> +<InputEncoding>UTF-8</InputEncoding> +<Image height="16" width="16">data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAMAAAAoLQ9TAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JgAAgIQAAPoAAACA6AAAdTAAAOpgAAA6mAAAF3CculE8AAAB8lBMVEUAAADkRQzjPwPjQQXkRQ3iPwTiQQXgPQPeQgrcOwPVNgDVNQDWOgbTMwDRMgDQMwDSMwDRNwTQLgDRJgDSJwDSLgDSNwTjOgDiOADjOQDkPADhQAXzs5v+/fv////0vKbiRQvgPQHpdUr85NzuknPdKgDcIwDnZzj2w7HqeU/gPQLsimb/+PftjWn97Obpb0LdJQDeLQDtjmvsi2jgSBDnbULgOQD/39HgLQDeMgDpeFLgSBH0v670uqbaJQD2qImWvP/G1Ob5+/3u//+fvvXyp47dMwDaLwD0u6v0v6/aNQDiXi/aKQD3qozU7/8gSY2vvtg0ZK/OqLDaKQHYKgLgWTfaNADZMgDZMADZLADzqpD7//+xwdz//9H/5Bn/7Bn//ADofADYMADYMQDZOgPXLgDiZDj//97/0AD3tQDvlgHZOgbXLATXMADWMgDfXjLVLQD///z+0AD/3Rn/yRnwnQDcVjbVMQDyv67wuKTSJwDRHQD+8O/tg3/iQQDwhAHnawHWMADvtKfyva7XQxHga0bQGQD2vbH/u8LXIQCmPQzja07XQxLliGn99fPkcVHvhnGZ5VguvUU5wktBwCcAgxzydVv/8/XmiGngdlL+ysi3+I8LtCE80V6P3YmX4sDleljSNQLzr6D7sKPXNQTSIwAEAbMrAAAAF3RSTlMARqSkRvPz80PTpKRG3fPe3hio9/eoGP50jNsAAAABYktHRB5yCiArAAAAyElEQVQYGQXBvUqCYRiA4fu2V9Tn+UQddI3aCpxaOoU6iU4gcqqpoYbALXBuCuoYmttamq JDiEoh4YP+MOi6BNCh+uYKEGiOVNCXXxA2XDVV/UyfKbRCXTLQWAxbP2vt8Ue/uYDvfim91615sb2um6rqtrr/NFb1cUf1Ybd06areU6lSlYpK79jzK1SyJOkfhOl8JGEcqV5zoKrTRqO6yUzIzNu46ijdM1VV9bhuUJ/nZURExLRzUiPQm3kKXHi4BAEGOmOi78A/L1QoU/VHoTsAAAAldEVYdGRhdGU6Y3JlYXRlADIwMTQtMDEtMTlUMjA6MDE6MTEtMDU6MDAuET6cAAAAJXRFWHRkYXRlOm1vZGlmeQAyMDE0LTAxLTE5VDIwOjAxOjExLTA1OjAwX0yGIAAAAABJRU5ErkJggg==</Image> +<Url type="text/html" method="POST" template="http://3g2upl4pq6kufc4m.onion/html/"> + <Param name="q" value="{searchTerms}"/> +</Url> +<SearchForm>http://3g2upl4pq6kufc4m.onion/html/</SearchForm> +</SearchPlugin> + diff --git a/browser/locales/en-US/searchplugins/ddg.xml b/browser/locales/en-US/searchplugins/ddg.xml index d82cdbd..aceb0ac 100644 --- a/browser/locales/en-US/searchplugins/ddg.xml +++ b/browser/locales/en-US/searchplugins/ddg.xml @@ -22,9 +22,9 @@ AScg7HAnIOz2JyDs/ycg7P8nIOz/JyDs/ycg7P8nIOz/JyDs9icg7HAnIOwBAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAJyDsJicg7IAnIOyzJyDs5icg7OYnIOyzJyDsgCcg7CYAAAAAAAAAAAAAAAAA AAAA+B8AAPAPAADAAwAAwAMAAIABAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABAACAAQAAwAMAAMAD AADwDwAA+B8AAA==</Image> -<Url type="text/html" method="POST" template="http://3g2upl4pq6kufc4m.onion/html/"> +<Url type="text/html" method="POST" template="https://duckduckgo.com/"> <Param name="q" value="{searchTerms}"/> </Url> -<SearchForm>http://3g2upl4pq6kufc4m.onion/html/</SearchForm> +<SearchForm>https://duckduckgo.com/</SearchForm> </SearchPlugin> diff --git a/browser/locales/en-US/searchplugins/list.txt b/browser/locales/en-US/searchplugins/list.txt index 71b6c0f..0b4f1fb 100644 --- a/browser/locales/en-US/searchplugins/list.txt +++ b/browser/locales/en-US/searchplugins/list.txt @@ -2,6 +2,7 @@ disconnect youtube twitter wikipedia +ddg-onion startpage yahoo google

1 0

[torbutton/master] Release preparations for 1.9.6.1
by mikeperry＠torproject.org 29 Jul '16

29 Jul '16

commit e403cd883db74649eed86aed0edaf3d101d07fbb Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Thu Jul 28 17:03:03 2016 -0700 Release preparations for 1.9.6.1 CHANGELOG update, version bump --- src/CHANGELOG | 7 +++++++ src/install.rdf | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/src/CHANGELOG b/src/CHANGELOG index e62bafd..cd5ce27 100644 --- a/src/CHANGELOG +++ b/src/CHANGELOG @@ -1,3 +1,10 @@ +1.9.6.1 + * Bug 19206: Avoid SOCKS auth and NEWNYM collisions when sharing a tor client + * Bug 19417: Disable asm.js (but add code to clear on New Identity if enabled) + * Bug 19689: Plugin usage prompt is parented to wrong window + * Bug 19273: Improve external app launch handling and associated warnings + * Bug 8725: Block addon resource and url fingerprinting with nsIContentPolicy + 1.9.6 * Bug 18743: Pref to hide 'Sign in to Sync' button in hamburger menu * Bug 18905: Hide unusable items from help menu diff --git a/src/install.rdf b/src/install.rdf index db269d5..e33fdb9 100644 --- a/src/install.rdf +++ b/src/install.rdf @@ -6,7 +6,7 @@ <em:name>Torbutton</em:name> <em:creator>Mike Perry</em:creator> <em:id>torbutton(a)torproject.org</em:id> - <em:version>1.9.6</em:version> + <em:version>1.9.6.1</em:version> <em:homepageURL>https://www.torproject.org/projects/torbrowser.html.en</em:homepageURL> <em:optionsURL>chrome://torbutton/content/preferences.xul</em:optionsURL> <em:iconURL>chrome://torbutton/skin/tor.png</em:iconURL>

1 0

[torbutton/master] Bug 8725: Block `resource://` based fingerprinting with nsIContentPolicy.
by mikeperry＠torproject.org 28 Jul '16

28 Jul '16

commit 3bff5aaea6e1a732ff908527f67d1784ecf23c57 Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Fri Jun 17 01:25:09 2016 +0000 Bug 8725: Block `resource://` based fingerprinting with nsIContentPolicy. Based on ResourceFilter: A direct workaround for https://bugzil.la/863246 https://notabug.org/desktopd/no-resource-uri-leak/src/master/src/resource-f… --- src/chrome.manifest | 4 ++++ src/components/content-policy.js | 48 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 52 insertions(+) diff --git a/src/chrome.manifest b/src/chrome.manifest index e85a205..340ed27 100644 --- a/src/chrome.manifest +++ b/src/chrome.manifest @@ -170,6 +170,10 @@ category profile-after-change CookieJarSelector @torproject.org/cookie-jar-selec component {65be2be0-ceb4-44c2-91a5-9c75c53430bf} components/torRefSpoofer.js contract @torproject.org/torRefSpoofer;1 {65be2be0-ceb4-44c2-91a5-9c75c53430bf} +component {4c03be7d-492f-990e-f0da-f3689e564898} components/content-policy.js +contract @torproject.org/content-policy;1 {4c03be7d-492f-990e-f0da-f3689e564898} +category content-policy ContentPolicy @torproject.org/content-policy;1 + category profile-after-change RefSpoofer @torproject.org/torRefSpoofer;1 category profile-after-change StartupObserver @torproject.org/startup-observer;1 category profile-after-change DomainIsolator @torproject.org/domain-isolator;1 diff --git a/src/components/content-policy.js b/src/components/content-policy.js new file mode 100644 index 0000000..b4b33a7 --- /dev/null +++ b/src/components/content-policy.js @@ -0,0 +1,48 @@ +/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this file, + * You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* + * Based on ResourceFilter: A direct workaround for https://bugzil.la/863246 + * https://notabug.org/desktopd/no-resource-uri-leak/src/master/src/resource-f… + */ + +const Ci = Components.interfaces, Cu = Components.utils; + +// Import XPCOMUtils object. +Cu.import("resource://gre/modules/XPCOMUtils.jsm"); + +function ContentPolicy() {} + +ContentPolicy.prototype = { + classDescription: "ContentPolicy", + classID: Components.ID("{4c03be7d-492f-990e-f0da-f3689e564898}"), + contractID: "@torproject.org/content-policy;1", + QueryInterface: XPCOMUtils.generateQI([Ci.nsIContentPolicy]), + + _xpcom_categories: [{category: "content-policy"}], + + shouldLoad: function(aContentType, aContentLocation, aRequestOrigin, aContext, aMimeTypeGuess, aExtra) { + // Accept if no content URI or scheme is not a resource. + if (!aContentLocation || !aContentLocation.schemeIs('resource')) + return Ci.nsIContentPolicy.ACCEPT; + + // Accept if no origin URI, or if the origin URI scheme is chrome/resource. + if (!aRequestOrigin || aRequestOrigin.schemeIs('resource') || aRequestOrigin.schemeIs('chrome')) + return Ci.nsIContentPolicy.ACCEPT; + + // Accept if resource directly loaded into a tab. + if (Ci.nsIContentPolicy.TYPE_DOCUMENT === aContentType) + return Ci.nsIContentPolicy.ACCEPT; + + return Ci.nsIContentPolicy.REJECT_REQUEST; + }, + + shouldProcess: function(aContentType, aContentLocation, aRequestOrigin, aContext, aMimeType, aExtra) { + return Ci.nsIContentPolicy.ACCEPT; + }, +}; + +// Firefox >= 4.0 (Old versions are extremely irrelevant). +var NSGetFactory = XPCOMUtils.generateNSGetFactory([ContentPolicy]);

1 0

[torbutton/master] Bug 8725: Consistently deny redirects to browser/addon internal URLs.
by mikeperry＠torproject.org 28 Jul '16

28 Jul '16

commit fa67687df5fc72c0b6085d9941331277d32319f3 Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Sat Jul 16 03:37:27 2016 +0000 Bug 8725: Consistently deny redirects to browser/addon internal URLs. The browser's behavior is different depending on if a given internal resource is available or not, regardless of the fact that the actual body will not load due to the various safeguards and checks. This normalizes the behavior by denying all redirects destined for URLs with proscribed browser internal schemes (`resource`, `about`, `chrome`). --- src/components/content-policy.js | 41 +++++++++++++++++++++++++++++++++++++--- 1 file changed, 38 insertions(+), 3 deletions(-) diff --git a/src/components/content-policy.js b/src/components/content-policy.js index c6c8aa9..e025ecd 100644 --- a/src/components/content-policy.js +++ b/src/components/content-policy.js @@ -8,7 +8,7 @@ * https://notabug.org/desktopd/no-resource-uri-leak/src/master/src/resource-f… */ -const Ci = Components.interfaces, Cu = Components.utils; +const Cc = Components.classes, Ci = Components.interfaces, Cu = Components.utils; // Import XPCOMUtils object. Cu.import("resource://gre/modules/XPCOMUtils.jsm"); @@ -21,8 +21,6 @@ ContentPolicy.prototype = { contractID: "@torproject.org/content-policy;1", QueryInterface: XPCOMUtils.generateQI([Ci.nsIContentPolicy]), - _xpcom_categories: [{category: "content-policy"}], - shouldLoad: function(aContentType, aContentLocation, aRequestOrigin, aContext, aMimeTypeGuess, aExtra) { // Accept if no content URI or scheme is not a resource/chrome. if (!aContentLocation || !(aContentLocation.schemeIs('resource') || aContentLocation.schemeIs('chrome'))) @@ -44,5 +42,42 @@ ContentPolicy.prototype = { }, }; +// Install a HTTP response handler to check for redirects to URLs with schemes +// that should be internal to the browser. There's various safeguards and +// checks that cause the body to be unavailable, but the `onLoad()` behavior +// is inconsistent, which results in leaking information about the specific +// user agent instance (eg: what addons are installed). +var requestObserver = { + ioService: Cc["@mozilla.org/network/io-service;1"].getService(Ci.nsIIOService), + observerService: Cc["@mozilla.org/observer-service;1"].getService(Ci.nsIObserverService), + + start: function() { + this.observerService.addObserver(this, "http-on-examine-response", false); + }, + + observe: function(aSubject, aTopic, aData) { + let aChannel = aSubject.QueryInterface(Ci.nsIHttpChannel); + let aStatus = aChannel.responseStatus; + + // If this is a redirect... + // + // Note: Technically `304 Not Modifed` isn't a redirect, but receiving that + // to the proscribed schemes is nonsensical. + if (aStatus >= 300 && aStatus < 400) { + let location = aChannel.getResponseHeader("Location"); + let aUri = this.ioService.newURI(location, null, null); + + // And it's redirecting into the browser or addon's internal URLs... + if (aUri.schemeIs("resource") || aUri.schemeIs("chrome") || aUri.schemeIs("about")) { + // Cancel the request. + aSubject.cancel(Components.results.NS_BINDING_ABORTED); + } + } + }, +}; + // Firefox >= 4.0 (Old versions are extremely irrelevant). var NSGetFactory = XPCOMUtils.generateNSGetFactory([ContentPolicy]); + +// Register the request observer to handle redirects. +requestObserver.start();

1 0

[torbutton/master] Merge remote-tracking branch 'yawning/bug8725_take3'
by mikeperry＠torproject.org 28 Jul '16

28 Jul '16

commit 3b8e1a3508c7cb15d15c93149acab81ea8c51d9a Merge: 7dd7101 fa67687 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Thu Jul 28 15:06:21 2016 -0700 Merge remote-tracking branch 'yawning/bug8725_take3' src/chrome.manifest | 4 ++ src/components/content-policy.js | 83 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 87 insertions(+)

1 0

[torbutton/master] Bug 8725: Block `chrome://` based fingerprinting with nsIContentPolicy.
by mikeperry＠torproject.org 28 Jul '16

28 Jul '16

commit ace11cd8020aaf0136ee58aa074666f10c14abb9 Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Fri Jun 17 01:27:14 2016 +0000 Bug 8725: Block `chrome://` based fingerprinting with nsIContentPolicy. Most addons do not set `contentaccessible=yes`, however behavior should be consistent even if such addons are installed. This does not affect any of the standard addons shipped with Tor Browser, but will break user installed addons that depend on actually being able to access `chrome://` URLs in this manner. --- src/components/content-policy.js | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/components/content-policy.js b/src/components/content-policy.js index b4b33a7..c6c8aa9 100644 --- a/src/components/content-policy.js +++ b/src/components/content-policy.js @@ -24,12 +24,12 @@ ContentPolicy.prototype = { _xpcom_categories: [{category: "content-policy"}], shouldLoad: function(aContentType, aContentLocation, aRequestOrigin, aContext, aMimeTypeGuess, aExtra) { - // Accept if no content URI or scheme is not a resource. - if (!aContentLocation || !aContentLocation.schemeIs('resource')) + // Accept if no content URI or scheme is not a resource/chrome. + if (!aContentLocation || !(aContentLocation.schemeIs('resource') || aContentLocation.schemeIs('chrome'))) return Ci.nsIContentPolicy.ACCEPT; - // Accept if no origin URI, or if the origin URI scheme is chrome/resource. - if (!aRequestOrigin || aRequestOrigin.schemeIs('resource') || aRequestOrigin.schemeIs('chrome')) + // Accept if no origin URI or if origin scheme is chrome/resource/about. + if (!aRequestOrigin || aRequestOrigin.schemeIs('resource') || aRequestOrigin.schemeIs('chrome') || aRequestOrigin.schemeIs('about')) return Ci.nsIContentPolicy.ACCEPT; // Accept if resource directly loaded into a tab.

1 0

[tor-browser-bundle/maint-6.0] Release preparations for 6.0.3
by gk＠torproject.org 22 Jul '16

22 Jul '16

commit 033fe948a692f545d50132ebe2046704be5dff7d Author: Georg Koppen <gk(a)torproject.org> Date: Fri Jul 22 16:40:03 2016 +0000 Release preparations for 6.0.3 --- Bundle-Data/Docs/ChangeLog.txt | 18 ++++++++++++++++++ gitian/versions | 2 +- tools/update-responses/config.yml | 13 ++++++------- 3 files changed, 25 insertions(+), 8 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 6325c23..2abd47e 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,21 @@ +Tor Browser 6.0.3 -- August 2 + * All Platforms + * Update Firefox to 45.3.0esr + * Update Torbutton to 1.9.5.6 + * Bug 19417: Disable asmjs for now + * Bug 19689: Use proper parent window for plugin prompt + * Update HTTPS-Everywhere to 5.2.1 + * Bug 19417: Disable asmjs for now + * Bug 19715: Disable the meek-google pluggable transport option + * Bug 19714: Remove mercurius4 obfs4 bridge + * Bug 19585: Fix regression test for keyboard layout fingerprinting + * Bug 19515: Tor Browser is crashing in graphics code + * Bug 18513: Favicon requests can bypass New Identity + * OS X + * Bug 19269: Icon doesn't appear in Applications folder or Dock + * Android + * Bug 19484: Avoid compilation error when MOZ_UPDATER is not defined + Tor Browser 6.0.2 -- June 21 * All Platforms * Update Torbutton to 1.9.5.5 diff --git a/gitian/versions b/gitian/versions index 6e54edd..c46c735 100755 --- a/gitian/versions +++ b/gitian/versions @@ -18,7 +18,7 @@ TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-6.0-1-build2 TOR_TAG=tor-0.2.7.6 TORLAUNCHER_TAG=0.2.9.3 TORBUTTON_TAG=1.9.5.5 -HTTPSE_TAG=5.1.9 +HTTPSE_TAG=5.2.1 NSIS_TAG=v0.3.1 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.22-stable diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index 4e89b8a..16843df 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -13,15 +13,14 @@ build_targets: osx64: Darwin_x86_64-gcc3 channels: alpha: 6.0a5 - release: 6.0.2 + release: 6.0.3 versions: - 6.0.2: - platformVersion: 45.2.0 - detailsURL: https://blog.torproject.org/blog/tor-browser-602-released - download_url: https://cdn.torproject.org/aus1/torbrowser/6.0.2 + 6.0.3: + platformVersion: 45.3.0 + detailsURL: https://blog.torproject.org/blog/tor-browser-603-released + download_url: https://cdn.torproject.org/aus1/torbrowser/6.0.3 incremental_from: - - 6.0 - - 6.0.1 + - 6.0.2 migrate_archs: osx32: osx64 osx32:

1 0

[torbutton/maint-1.9.5] Release preparations for 1.9.5.6
by gk＠torproject.org 22 Jul '16

22 Jul '16

commit 7b983fe74fca4bc29d68e0a4ed3c2eeae2ba1113 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Jul 22 14:33:41 2016 +0000 Release preparations for 1.9.5.6 --- src/CHANGELOG | 4 ++++ src/install.rdf | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/src/CHANGELOG b/src/CHANGELOG index 77ba290..28cff54 100644 --- a/src/CHANGELOG +++ b/src/CHANGELOG @@ -1,3 +1,7 @@ +1.9.5.6 + * Bug 19417: Disable asmjs for now + * Bug 19689: Use proper parent windows for plugin prompt + 1.9.5.5 * Bug 19417: Clear asmjscache diff --git a/src/install.rdf b/src/install.rdf index ac45b1d..9098991 100644 --- a/src/install.rdf +++ b/src/install.rdf @@ -6,7 +6,7 @@ <em:name>Torbutton</em:name> <em:creator>Mike Perry</em:creator> <em:id>torbutton(a)torproject.org</em:id> - <em:version>1.9.5.5</em:version> + <em:version>1.9.5.6</em:version> <em:homepageURL>https://www.torproject.org/projects/torbrowser.html.en</em:homepageURL> <em:optionsURL>chrome://torbutton/content/preferences.xul</em:optionsURL> <em:iconURL>chrome://torbutton/skin/tor.png</em:iconURL>

1 0