- tbb-commits - lists.torproject.org

[tor-browser/tor-browser-45.1.0esr-6.0-1] fixup! Regression tests for #5856: Do not expose physical screen info via window & window.screen.
by gk＠torproject.org 13 May '16

13 May '16

commit ec74b173f8a00e59aa42e0cf32e65ec2266cb477 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Sun May 8 23:33:39 2016 -0700 fixup! Regression tests for #5856: Do not expose physical screen info via window & window.screen. --- tbb-tests/test_tor_bug5856.html | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tbb-tests/test_tor_bug5856.html b/tbb-tests/test_tor_bug5856.html index 2eae453..7a9ab6f 100644 --- a/tbb-tests/test_tor_bug5856.html +++ b/tbb-tests/test_tor_bug5856.html @@ -27,7 +27,10 @@ https://trac.torproject.org/projects/tor/ticket/5856 ["window.screen.availLeft", 0], ["window.screen.availTop", 0], ["window.screen.width", "window.innerWidth"], - ["window.screen.height", "window.innerHeight"] + ["window.screen.height", "window.innerHeight"], + ["window.screen.orientation.type", "'landscape-primary'"], + ["window.screen.orientation.angle", 0], + ["window.screen.mozOrientation", "'landscape-primary'"], ]; pairs.map(checkPair);

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] Bug 18958: Spoof screen.orientation values
by gk＠torproject.org 13 May '16

13 May '16

commit a086a5d0070821b1c4dfd2492bdc993c91353a2b Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Sun May 8 22:23:42 2016 -0700 Bug 18958: Spoof screen.orientation values Make sure that screen.orientation.angle -> 0 and screen.orientation.type -> "landscape-primary" Also refactors screen.mozOrientation. --- dom/base/ScreenOrientation.cpp | 29 +++++++++++++++++++++++++++-- dom/base/ScreenOrientation.h | 2 ++ dom/base/nsGlobalWindow.cpp | 7 ++++--- dom/base/nsScreen.cpp | 38 ++++++++++++++++++++------------------ 4 files changed, 53 insertions(+), 23 deletions(-) diff --git a/dom/base/ScreenOrientation.cpp b/dom/base/ScreenOrientation.cpp index 868a1d5..fdea67a 100644 --- a/dom/base/ScreenOrientation.cpp +++ b/dom/base/ScreenOrientation.cpp @@ -15,6 +15,7 @@ #include "mozilla/Preferences.h" #include "mozilla/dom/Promise.h" +#include "nsContentUtils.h" using namespace mozilla; using namespace mozilla::dom; @@ -403,18 +404,23 @@ ScreenOrientation::UnlockDeviceOrientation() OrientationType ScreenOrientation::DeviceType() const { - return mType; + return ShouldResistFingerprinting() ? OrientationType::Landscape_primary + : mType; } uint16_t ScreenOrientation::DeviceAngle() const { - return mAngle; + return ShouldResistFingerprinting() ? 0 : mAngle; } OrientationType ScreenOrientation::GetType(ErrorResult& aRv) const { + if (ShouldResistFingerprinting()) { + return OrientationType::Landscape_primary; + } + nsIDocument* doc = GetResponsibleDocument(); if (!doc) { aRv.Throw(NS_ERROR_UNEXPECTED); @@ -427,6 +433,10 @@ ScreenOrientation::GetType(ErrorResult& aRv) const uint16_t ScreenOrientation::GetAngle(ErrorResult& aRv) const { + if (ShouldResistFingerprinting()) { + return 0; + } + nsIDocument* doc = GetResponsibleDocument(); if (!doc) { aRv.Throw(NS_ERROR_UNEXPECTED); @@ -489,6 +499,10 @@ ScreenOrientation::GetResponsibleDocument() const void ScreenOrientation::Notify(const hal::ScreenConfiguration& aConfiguration) { + if (ShouldResistFingerprinting()) { + return; + } + nsIDocument* doc = GetResponsibleDocument(); if (!doc) { return; @@ -564,6 +578,17 @@ ScreenOrientation::WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto) return ScreenOrientationBinding::Wrap(aCx, this, aGivenProto); } +bool +ScreenOrientation::ShouldResistFingerprinting() const +{ + bool resist = false; + nsCOMPtr<nsPIDOMWindow> owner = GetOwner(); + if (owner) { + resist = nsContentUtils::ShouldResistFingerprinting(owner->GetDocShell()); + } + return resist; +} + NS_IMPL_ISUPPORTS(ScreenOrientation::VisibleEventListener, nsIDOMEventListener) NS_IMETHODIMP diff --git a/dom/base/ScreenOrientation.h b/dom/base/ScreenOrientation.h index afb5e77..a6e51c7 100644 --- a/dom/base/ScreenOrientation.h +++ b/dom/base/ScreenOrientation.h @@ -102,6 +102,8 @@ private: void DispatchChangeEvent(); + bool ShouldResistFingerprinting() const; + LockPermission GetLockOrientationPermission(bool aCheckSandbox) const; // Gets the responsible document as defined in the spec. diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp index ed42538..6dc06b1 100644 --- a/dom/base/nsGlobalWindow.cpp +++ b/dom/base/nsGlobalWindow.cpp @@ -12820,8 +12820,8 @@ void nsGlobalWindow::EnableOrientationChangeListener() { MOZ_ASSERT(IsInnerWindow()); - - if (!mOrientationChangeObserver) { + if (!nsContentUtils::ShouldResistFingerprinting(mDocShell) + && !mOrientationChangeObserver) { mOrientationChangeObserver = new WindowOrientationObserver(this); } @@ -13671,7 +13671,8 @@ nsGlobalWindow::IsModalContentWindow(JSContext* aCx, JSObject* aGlobal) int16_t nsGlobalWindow::Orientation() const { - return WindowOrientationObserver::OrientationAngle(); + return nsContentUtils::ShouldResistFingerprinting(mDocShell) ? + 0 : WindowOrientationObserver::OrientationAngle(); } #endif diff --git a/dom/base/nsScreen.cpp b/dom/base/nsScreen.cpp index ad1642b..49c12eb 100644 --- a/dom/base/nsScreen.cpp +++ b/dom/base/nsScreen.cpp @@ -166,25 +166,21 @@ nsScreen::Orientation() const void nsScreen::GetMozOrientation(nsString& aOrientation) const { - if (ShouldResistFingerprinting()) { + switch (mScreenOrientation->DeviceType()) { + case OrientationType::Portrait_primary: + aOrientation.AssignLiteral("portrait-primary"); + break; + case OrientationType::Portrait_secondary: + aOrientation.AssignLiteral("portrait-secondary"); + break; + case OrientationType::Landscape_primary: aOrientation.AssignLiteral("landscape-primary"); - } else { - switch (mScreenOrientation->DeviceType()) { - case OrientationType::Portrait_primary: - aOrientation.AssignLiteral("portrait-primary"); - break; - case OrientationType::Portrait_secondary: - aOrientation.AssignLiteral("portrait-secondary"); - break; - case OrientationType::Landscape_primary: - aOrientation.AssignLiteral("landscape-primary"); - break; - case OrientationType::Landscape_secondary: - aOrientation.AssignLiteral("landscape-secondary"); - break; - default: - MOZ_CRASH("Unacceptable screen orientation type."); - } + break; + case OrientationType::Landscape_secondary: + aOrientation.AssignLiteral("landscape-secondary"); + break; + default: + MOZ_CRASH("Unacceptable screen orientation type."); } } @@ -236,6 +232,9 @@ bool nsScreen::MozLockOrientation(const Sequence<nsString>& aOrientations, ErrorResult& aRv) { + if (ShouldResistFingerprinting()) { + return false; + } ScreenOrientationInternal orientation = eScreenOrientation_None; for (uint32_t i = 0; i < aOrientations.Length(); ++i) { @@ -283,6 +282,9 @@ nsScreen::MozLockOrientation(const Sequence<nsString>& aOrientations, void nsScreen::MozUnlockOrientation() { + if (ShouldResistFingerprinting()) { + return; + } UpdateDocShellOrientationLock(GetOwner(), eScreenOrientation_None); mScreenOrientation->UnlockDeviceOrientation(); }

1 0

[tor-browser-bundle/hardened-builds] Bug 17406: Include SelfRando support in our nightlies
by gk＠torproject.org 13 May '16

13 May '16

commit 138470ca7ce810f62761af8c3989654ec4a611fa Author: Georg Koppen <gk(a)torproject.org> Date: Thu May 12 20:25:02 2016 +0000 Bug 17406: Include SelfRando support in our nightlies SelfRando is a new defense against code reuse attacks developed by the Radactor and Readactor++ people. We should give it a wider testing audience by including it in the nightly. --- RelativeLink/start-tor-browser | 3 + gitian/descriptors/linux/gitian-firefox.yml | 7 + gitian/descriptors/linux/gitian-utils.yml | 38 +++- gitian/fetch-inputs.sh | 4 +- gitian/gpg/ELFUTILS.gpg | Bin 0 -> 10483 bytes gitian/mkbundle-linux.sh | 9 +- gitian/patches/libfaketime-asan.patch | 268 ++++++++++++++++++++++++++-- gitian/verify-tags.sh | 3 +- gitian/versions.nightly | 4 + 9 files changed, 313 insertions(+), 23 deletions(-) diff --git a/RelativeLink/start-tor-browser b/RelativeLink/start-tor-browser index 2e7805d..19c5cfc 100755 --- a/RelativeLink/start-tor-browser +++ b/RelativeLink/start-tor-browser @@ -270,6 +270,9 @@ fi LD_LIBRARY_PATH="${HOME}/TorBrowser/Tor/" export LD_LIBRARY_PATH +export SELFRANDO_write_layout_file= +export NSS_DISABLE_HW_AES=1 + # We need to disable LSan which is enabled by default now. Otherwise we'll get # a crash during shutdown: https://bugs.torproject.org/10599#comment:59 ASAN_OPTIONS="detect_leaks=0" diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index e24a740..22686b7 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -29,12 +29,15 @@ remotes: "dir": "tor-browser" - "url": "https://github.com/wolfcw/libfaketime" "dir": "faketime" +- "url": "https://github.com/immunant/selfrando.git" + "dir": "selfrando" files: - "binutils-linux64-utils.zip" - "gcc-linux64-utils.zip" - "re-dzip.sh" - "dzip.sh" - "versions" +- "self-rando-utils.zip" script: | source versions INSTDIR="$HOME/install" @@ -49,6 +52,7 @@ script: | export DEB_BUILD_HARDENING_FORMAT=1 export DEB_BUILD_HARDENING_PIE=1 # + unzip -d $INSTDIR self-rando-utils.zip # Preparing Binutils and GCC for Tor Browser unzip -d $INSTDIR binutils-linux$GBUILD_BITS-utils.zip # Make sure gold is used with the hardening wrapper for full RELRO, see @@ -96,6 +100,9 @@ script: | # that feature it would hang sometimes for unknown but to libfaketime related # reasons. export LD_PRELOAD="" + # Self-Rando wrapper + export PATH="$HOME/build/selfrando/Tools/TorBrowser/tc-wrapper/:$PATH" + export SELFRANDO_skip_shuffle= make -f client.mk configure CONFIGURE_ARGS="--with-tor-browser-version=${TORBROWSER_VERSION} --enable-update-channel=${TORBROWSER_UPDATE_CHANNEL} --enable-bundled-fonts" # We need libfaketime for all the timestamps e.g. written into the libraries. # BUT we need to exclude |make build| from it. Otherwise the build fails close diff --git a/gitian/descriptors/linux/gitian-utils.yml b/gitian/descriptors/linux/gitian-utils.yml index 72ead1b..15b26f4 100644 --- a/gitian/descriptors/linux/gitian-utils.yml +++ b/gitian/descriptors/linux/gitian-utils.yml @@ -24,10 +24,14 @@ packages: - "libssl-dev" # Needed for binutils (64bit) as we are building with PIE enabled. - "libstdc++6-4.7-pic" +# Needed for Selfrando +- "scons" reference_datetime: "2000-01-01 00:00:00" remotes: - "url": "https://github.com/libevent/libevent.git" "dir": "libevent" +- "url": "https://github.com/immunant/selfrando.git" + "dir": "selfrando" files: - "binutils.tar.bz2" - "gcc.tar.bz2" @@ -36,6 +40,7 @@ files: - "versions" - "dzip.sh" - "libfaketime-asan.patch" +- "elfutils.tar.bz2" script: | INSTDIR="$HOME/install" source versions @@ -56,11 +61,8 @@ script: | # The libstdc++ shipped by default is non-PIC which breaks the binutils build # if we build with DEB_BUILD_HARDENING_PIE=1. We need to install a PIC one AND # make sure it gets used before the non-PIC one would. - if [ $GBUILD_BITS == "64" ]; - then - ln -s /usr/lib/gcc/x86_64-linux-gnu/4.7/libstdc++_pic.a libstdc++.a - export LDFLAGS="-L/home/debian -lstdc++" - fi + ln -s /usr/lib/gcc/x86_64-linux-gnu/4.7/libstdc++_pic.a libstdc++.a + export LDFLAGS="-L/home/debian -lstdc++" cd binutils* # We want to use gold as the linker in our toolchain mainly as it is way # faster when linking Tor Browser code (especially libxul). But apart from @@ -90,6 +92,31 @@ script: | cd .. export DEB_BUILD_HARDENING_FORMAT=1 + OPATH="$PATH" + OLD_LIBRARY_PATH="$LD_LIBRARY_PATH" + export PATH="$INSTDIR/binutils/bin:$INSTDIR/gcc/bin:$PATH" + export LD_LIBRARY_PATH="$INSTDIR/gcc/lib64/:$LD_LIBRARY_PATH" + + # Building Elfutils + tar xjf elfutils.tar.bz2 + cd elfutils*/ + ./configure --prefix=$INSTDIR/elfutils + make $MAKEOPTS + make install + cd .. + + # Building Selfrando + cd selfrando + scons -Q arch=x86_64 ADDN_CCFLAGS="-include $(ls $HOME/build/elfutils-*/libelf/elf.h) -I $INSTDIR/elfutils/include -fno-reorder-functions" ADDN_LINKFLAGS="-L $INSTDIR/elfutils/lib" + mkdir -p $INSTDIR/self-rando + cp sconsRelease/x86_64/bin/* $INSTDIR/self-rando/ + cd .. + + PATH="$OPATH" + unset OPATH + LD_LIBRARY_PATH="$OLD_LIBRARY_PATH" + unset OLD_LIBRARY_PATH + # Building Libevent cd libevent ./autogen.sh @@ -134,4 +161,5 @@ script: | ~/build/dzip.sh openssl-$OPENSSL_VER-linux$GBUILD_BITS-utils.zip openssl ~/build/dzip.sh libevent-${LIBEVENT_TAG#release-}-linux$GBUILD_BITS-utils.zip libevent ~/build/dzip.sh gmp-$GMP_VER-linux$GBUILD_BITS-utils.zip gmp + ~/build/dzip.sh self-rando-utils.zip self-rando cp *utils.zip $OUTDIR/ diff --git a/gitian/fetch-inputs.sh b/gitian/fetch-inputs.sh index 027a47e..4f63374 100755 --- a/gitian/fetch-inputs.sh +++ b/gitian/fetch-inputs.sh @@ -112,7 +112,7 @@ update_git() { ############################################################################## # Get+verify sigs that exist -for i in OPENSSL BINUTILS GCC PYCRYPTO PYTHON_MSI GMP +for i in OPENSSL BINUTILS GCC PYCRYPTO PYTHON_MSI GMP ELFUTILS do PACKAGE="${i}_PACKAGE" URL="${i}_URL" @@ -236,6 +236,7 @@ ln -sf "$SETUPTOOLS_PACKAGE" setuptools.tar.gz ln -sf "$GMP_PACKAGE" gmp.tar.bz2 ln -sf "$PARSLEY_PACKAGE" parsley.tar.gz ln -sf "$GO_PACKAGE" go.tar.gz +ln -sf "$ELFUTILS_PACKAGE" elfutils.tar.bz2 # Fetch latest gitian-builder itself # XXX - this is broken if a non-standard inputs dir is selected using the command line flag. @@ -273,6 +274,7 @@ goxcrypto https://go.googlesource.com/crypto $GO_X_CRYPTO_TAG goxnet https://go.googlesource.com/net $GO_X_NET_TAG obfs4 https://git.torproject.org/pluggable-transports/obfs4.git $OBFS4_TAG noto-fonts https://github.com/googlei18n/noto-fonts $NOTOFONTS_TAG +selfrando https://github.com/immunant/selfrando.git $SELFRANDO_TAG EOF # HTTPS-Everywhere is special, too. We need to initialize the git submodules and diff --git a/gitian/gpg/ELFUTILS.gpg b/gitian/gpg/ELFUTILS.gpg new file mode 100644 index 0000000..f1cd4b3 Binary files /dev/null and b/gitian/gpg/ELFUTILS.gpg differ diff --git a/gitian/mkbundle-linux.sh b/gitian/mkbundle-linux.sh index a1674dd..48aac24 100755 --- a/gitian/mkbundle-linux.sh +++ b/gitian/mkbundle-linux.sh @@ -35,7 +35,7 @@ fi if [ -z "$VM_MEMORY" ]; then - export VM_MEMORY=4000 + export VM_MEMORY=6000 fi ./make-vms.sh @@ -104,13 +104,14 @@ if [ ! -f inputs/binutils-$BINUTILS_VER-linux64-utils.zip -o \ ! -f inputs/gcc-$GCC_VER-linux64-utils.zip -o \ ! -f inputs/openssl-$OPENSSL_VER-linux64-utils.zip -o \ ! -f inputs/libevent-${LIBEVENT_TAG_ORIG#release-}-linux64-utils.zip -o \ - ! -f inputs/gmp-$GMP_VER-linux64-utils.zip ]; + ! -f inputs/gmp-$GMP_VER-linux64-utils.zip -o \ + ! -f inputs/self-rando-utils.zip ]; then echo echo "****** Starting Utilities Component of Linux Bundle (1/5 for Linux) ******" echo - ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit libevent=$LIBEVENT_TAG $DESCRIPTOR_DIR/linux/gitian-utils.yml + ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit libevent=$LIBEVENT_TAG,selfrando=$SELFRANDO_TAG $DESCRIPTOR_DIR/linux/gitian-utils.yml if [ $? -ne 0 ]; then #mv var/build.log ./utils-fail-linux.log.`date +%Y%m%d%H%M%S` @@ -169,7 +170,7 @@ then echo "****** Starting TorBrowser Component of Linux Bundle (3/5 for Linux) ******" echo - ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit tor-browser=$TORBROWSER_TAG,faketime=$FAKETIME_TAG $DESCRIPTOR_DIR/linux/gitian-firefox.yml + ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit tor-browser=$TORBROWSER_TAG,faketime=$FAKETIME_TAG,selfrando=$SELFRANDO_TAG $DESCRIPTOR_DIR/linux/gitian-firefox.yml if [ $? -ne 0 ]; then #mv var/build.log ./firefox-fail-linux.log.`date +%Y%m%d%H%M%S` diff --git a/gitian/patches/libfaketime-asan.patch b/gitian/patches/libfaketime-asan.patch index 5346eae..ff3e62b 100644 --- a/gitian/patches/libfaketime-asan.patch +++ b/gitian/patches/libfaketime-asan.patch @@ -1,12 +1,3 @@ -From 0ef83e9a0631e25e62e1dbc483108742fc125304 Mon Sep 17 00:00:00 2001 -From: Georg Koppen <gk(a)torproject.org> -Date: Mon, 14 Sep 2015 14:27:36 +0000 -Subject: [PATCH] No dying anymore - ---- - libsanitizer/asan/asan_linux.cc | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - diff --git a/libsanitizer/asan/asan_linux.cc b/libsanitizer/asan/asan_linux.cc index c504168..1d1a6dd 100644 --- a/libsanitizer/asan/asan_linux.cc @@ -23,6 +14,259 @@ index c504168..1d1a6dd 100644 } } --- -1.7.10.4 - +diff --git a/libsanitizer/sanitizer_common/SelfRandoAddressTranslator.h b/libsanitizer/sanitizer_common/SelfRandoAddressTranslator.h +new file mode 100644 +index 0000000..5f13870 +--- /dev/null ++++ b/libsanitizer/sanitizer_common/SelfRandoAddressTranslator.h +@@ -0,0 +1,155 @@ ++// ++// Created by tf on 10/12/2015. ++// ++ ++#pragma once ++#include "sanitizer_internal_defs.h" ++#include "sanitizer_libc.h" ++#include "sanitizer_common.h" ++ ++#define PROT_READ 0x1 /* Page can be read. */ ++#define PROT_WRITE 0x2 /* Page can be written. */ ++#define PROT_EXEC 0x4 /* Page can be executed. */ ++#define PROT_NONE 0x0 /* Page can not be accessed. */ ++#define MAP_SHARED 0x01 /* Share changes. */ ++ ++namespace __sanitizer { ++ class SelfRandoAddressTranslator { ++ struct __attribute__((__packed__)) FunctionRecord { ++ void *undiv_addr; ++ void *div_addr; ++ u32 size; ++ }; ++ ++ struct __attribute__((__packed__)) LibraryRecord { ++ u32 version; ++ u32 seed; ++ void *file_base; ++ void *mem_base; ++ void *size; ++ ++ private: ++ char _name; ++ ++ public: ++ inline char *name() { return &_name; } ++ ++ inline FunctionRecord *function_records() { ++ return (FunctionRecord *) (&_name + internal_strlen(&_name) + 1); ++ } ++ ++ u8 *record_end() { ++ FunctionRecord *fr = function_records(); ++ while (fr->undiv_addr) { ++ fr++; ++ } ++ return (u8 *) fr + sizeof(void *); ++ } ++ }; ++ ++ // 16K loaded modules should be enough for everyone. ++ LibraryRecord* library_records_idx[1<<14]; ++ int library_records_idx_size; ++ u8 *library_records_end; ++ void add_library_record(LibraryRecord* lr); ++ ++ void read_layout_file(); ++ u8 *record_end(int i); ++ ++ public: ++ SelfRandoAddressTranslator(); ++ ++ uptr convertAddress(uptr original_address); ++ }; ++ ++ ++ ++ ++ SelfRandoAddressTranslator::SelfRandoAddressTranslator() { ++ Printf("SRAT init\n"); ++ read_layout_file(); ++ } ++ ++ void SelfRandoAddressTranslator::add_library_record(LibraryRecord* lr) { ++ library_records_idx_size++; ++ CHECK(library_records_idx_size <= 1<<14); ++ library_records_idx[library_records_idx_size - 1] = lr; ++ } ++ ++ u8* SelfRandoAddressTranslator::record_end(int i) { ++ if (i < library_records_idx_size - 1) { ++ return (u8 *) library_records_idx[i + 1] - sizeof(void *); ++ } else { ++ return library_records_end - sizeof(void*); ++ } ++ } ++ ++ void SelfRandoAddressTranslator::read_layout_file() { ++ uptr pid = internal_getpid(); ++ char filename[32]; ++ internal_snprintf(filename, 32, "/tmp/%d.mlf", pid); ++ ++ u8 buf[200]; // Current size of struct stat: 144 ++ if(0 != internal_stat(filename, &buf)) { ++ Printf("SRAT warning: cannot find Memory Layout File. Stack trace will be probably wrong.\n"); ++ return; ++ } ++ ++ uptr fd = OpenFile(filename, /*write*/ false); ++ uptr size = *(uptr*) (buf+48); ++ CHECK_NE(fd, -1); ++ u8 *f = (u8 *) internal_mmap(0, size, PROT_READ, MAP_SHARED, (int) fd, 0); ++ CHECK_NE(f, 0); ++ library_records_end = f + size; ++ ++ u8 *p = f; ++ while (p < library_records_end) { ++ LibraryRecord *lr = (LibraryRecord *) p; ++ add_library_record(lr); ++ CHECK_EQ(lr->version, 0x00000101); ++ p = lr->record_end(); ++ } ++ ++ } ++ ++ uptr SelfRandoAddressTranslator::convertAddress(uptr p) { ++// Printf("conv %p", p); ++ for (int i = 0; i < library_records_idx_size; ++i) { ++ LibraryRecord *lr = library_records_idx[i]; ++ ++ if (p > (uptr) lr->mem_base && p < (uptr) lr->mem_base + (uptr) lr->size) { ++ // found the correct library ++ ++ FunctionRecord *function_records = lr->function_records(); ++ ++ int a = 0; ++ int b = (int) ((FunctionRecord *) record_end(i) - function_records); ++// Printf(" (lib=>%s< a=%d b=%d)", lr->name(), a, b); ++ CHECK_EQ((u8 *) (function_records + b), record_end(i)); ++ ++ while (b - a > 1) { // bisection ++ int c = a + (b - a) / 2; ++ FunctionRecord *fr = &function_records[c]; ++ ++ if ((uptr) fr->div_addr > p) { // too high ++ b = c; ++ } else if ((uptr) fr->div_addr + (uptr) fr->size < p) { // too low ++ a = c; ++ } else { // found ++ b = c + 1; ++ a = c; ++ } ++ } ++ FunctionRecord *fr = &function_records[a]; ++ CHECK((uptr) fr->div_addr < p && p < (uptr) fr->div_addr + (uptr) fr->size); ++ ++ p = (p - (uptr) fr->div_addr + (uptr) fr->undiv_addr); ++ ++ break; ++ } ++ } ++ ++// Printf(" => %p\n", p); ++ return p; ++ } ++} +\ No newline at end of file +diff --git a/libsanitizer/sanitizer_common/sanitizer_symbolizer_posix_libcdep.cc b/libsanitizer/sanitizer_common/sanitizer_symbolizer_posix_libcdep.cc +index 5cc21d3..393a494 100644 +--- a/libsanitizer/sanitizer_common/sanitizer_symbolizer_posix_libcdep.cc ++++ b/libsanitizer/sanitizer_common/sanitizer_symbolizer_posix_libcdep.cc +@@ -21,6 +21,7 @@ + #include "sanitizer_procmaps.h" + #include "sanitizer_symbolizer.h" + #include "sanitizer_symbolizer_libbacktrace.h" ++#include "SelfRandoAddressTranslator.h" + + #include <errno.h> + #include <stdlib.h> +@@ -512,7 +513,7 @@ class POSIXSymbolizer : public Symbolizer { + internal_symbolizer_(internal_symbolizer), + libbacktrace_symbolizer_(libbacktrace_symbolizer) {} + +- uptr SymbolizePC(uptr addr, AddressInfo *frames, uptr max_frames) { ++ virtual uptr SymbolizePC(uptr addr, AddressInfo *frames, uptr max_frames) { + BlockingMutexLock l(&mu_); + if (max_frames == 0) + return 0; +@@ -580,7 +581,7 @@ class POSIXSymbolizer : public Symbolizer { + return frame_id; + } + +- bool SymbolizeData(uptr addr, DataInfo *info) { ++ virtual bool SymbolizeData(uptr addr, DataInfo *info) { + BlockingMutexLock l(&mu_); + LoadedModule *module = FindModuleForAddress(addr); + if (module == 0) +@@ -606,7 +607,7 @@ class POSIXSymbolizer : public Symbolizer { + return true; + } + +- bool GetModuleNameAndOffsetForPC(uptr pc, const char **module_name, ++ virtual bool GetModuleNameAndOffsetForPC(uptr pc, const char **module_name, + uptr *module_address) { + BlockingMutexLock l(&mu_); + return FindModuleNameAndOffsetForAddress(pc, module_name, module_address); +@@ -720,9 +721,40 @@ class POSIXSymbolizer : public Symbolizer { + LibbacktraceSymbolizer *libbacktrace_symbolizer_; // Leaked. + }; + ++ ++ class SelfRandoPOSIXSymbolizer : public POSIXSymbolizer { ++ SelfRandoAddressTranslator translator; ++ ++ public: ++ SelfRandoPOSIXSymbolizer(ExternalSymbolizerInterface *external_symbolizer, ++ InternalSymbolizer *internal_symbolizer, ++ LibbacktraceSymbolizer *libbacktrace_symbolizer) ++ : POSIXSymbolizer(external_symbolizer, internal_symbolizer, libbacktrace_symbolizer), ++ translator() { } ++ ++ ++ private: ++ virtual uptr SymbolizePC(uptr addr, AddressInfo *frames, uptr max_frames) override { ++ uptr conv_addr = translator.convertAddress(addr); ++ uptr res = POSIXSymbolizer::SymbolizePC(conv_addr, frames, max_frames); ++ if (res == 1) frames->address = addr; ++ return res; ++ } ++ ++ virtual bool SymbolizeData(uptr addr, DataInfo *info) override { ++ addr = translator.convertAddress(addr); ++ return POSIXSymbolizer::SymbolizeData(addr, info); ++ } ++ ++ virtual bool GetModuleNameAndOffsetForPC(uptr pc, const char **module_name, uptr *module_address) override { ++ pc = translator.convertAddress(pc); ++ return POSIXSymbolizer::GetModuleNameAndOffsetForPC(pc, module_name, module_address); ++ }; ++ }; ++ + Symbolizer *Symbolizer::PlatformInit() { + if (!common_flags()->symbolize) { +- return new(symbolizer_allocator_) POSIXSymbolizer(0, 0, 0); ++ return new(symbolizer_allocator_) SelfRandoPOSIXSymbolizer(0, 0, 0); + } + InternalSymbolizer* internal_symbolizer = + InternalSymbolizer::get(&symbolizer_allocator_); +@@ -754,10 +786,11 @@ Symbolizer *Symbolizer::PlatformInit() { + } + } + +- return new(symbolizer_allocator_) POSIXSymbolizer( ++ return new(symbolizer_allocator_) SelfRandoPOSIXSymbolizer( + external_symbolizer, internal_symbolizer, libbacktrace_symbolizer); + } + ++ + } // namespace __sanitizer + + #endif // SANITIZER_POSIX diff --git a/gitian/verify-tags.sh b/gitian/verify-tags.sh index 46cb01a..5268f85 100755 --- a/gitian/verify-tags.sh +++ b/gitian/verify-tags.sh @@ -118,10 +118,11 @@ siphash $GOSIPHASH_TAG goxcrypto $GO_X_CRYPTO_TAG goxnet $GO_X_NET_TAG noto-fonts $NOTOFONTS_TAG +selfrando $SELFRANDO_TAG EOF # Verify signatures on signed packages -for i in OPENSSL BINUTILS GCC PYCRYPTO PYTHON_MSI GMP +for i in OPENSSL BINUTILS GCC PYCRYPTO PYTHON_MSI GMP ELFUTILS do PACKAGE="${i}_PACKAGE" URL="${i}_URL" diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 088625b..9ff7e8f 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -48,6 +48,7 @@ GO_X_CRYPTO_TAG=master GO_X_NET_TAG=master OBFS4_TAG=master NOTOFONTS_TAG=720e34851382ee3c1ef024d8dffb68ffbfb234c2 +SELFRANDO_TAG=8e49e7aa664625d8e4793579864231b151589d0f GITIAN_TAG=tor-browser-builder-4 @@ -69,6 +70,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 GO_VER=1.4.2 NSIS_VER=2.51 +ELFUTILS_VER=0.160 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz @@ -99,6 +101,7 @@ NOTOJPFONT_PACKAGE=NotoSansJP-Regular.otf NOTOKRFONT_PACKAGE=NotoSansKR-Regular.otf NOTOSCFONT_PACKAGE=NotoSansSC-Regular.otf NOTOTCFONT_PACKAGE=NotoSansTC-Regular.otf +ELFUTILS_PACKAGE=elfutils-${ELFUTILS_VER}.tar.bz2 # Hashes for packages with weak sigs or no sigs OPENSSL_HASH=e7e81d82f3cd538ab0cdba494006d44aab9dd96b7f6233ce9971fb7c7916d511 @@ -157,3 +160,4 @@ NOTOJPFONT_URL=${NOTOCJKBASE_URL}/${NOTOJPFONT_PACKAGE} NOTOKRFONT_URL=${NOTOCJKBASE_URL}/${NOTOKRFONT_PACKAGE} NOTOSCFONT_URL=${NOTOCJKBASE_URL}/${NOTOSCFONT_PACKAGE} NOTOTCFONT_URL=${NOTOCJKBASE_URL}/${NOTOTCFONT_PACKAGE} +ELFUTILS_URL=https://fedorahosted.org/releases/e/l/elfutils/${ELFUTILS_VER}/${ELFUTILS_PACKAGE}

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] Bug 18995: Regression test to ensure CacheStorage is disabled in private browsing
by gk＠torproject.org 12 May '16

12 May '16

commit cea5f1efcd9590885127a0763432143aca01524c Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Tue May 10 16:51:08 2016 -0700 Bug 18995: Regression test to ensure CacheStorage is disabled in private browsing --- tbb-tests/browser.ini | 5 ++++ tbb-tests/browser_tor_bug18995.js | 50 +++++++++++++++++++++++++++++++++++++++ tbb-tests/bug18995.html | 31 ++++++++++++++++++++++++ tbb-tests/worker_bug_18995.html | 26 ++++++++++++++++++++ tbb-tests/worker_bug_18995.js | 8 +++++++ 5 files changed, 120 insertions(+) diff --git a/tbb-tests/browser.ini b/tbb-tests/browser.ini index f481660..9b6c47b 100644 --- a/tbb-tests/browser.ini +++ b/tbb-tests/browser.ini @@ -1,5 +1,10 @@ [DEFAULT] +support-files = + bug18995.html + worker_bug_18995.js + worker_bug_18995.html +[browser_tor_bug18995.js] [browser_tor_bug2950.js] [browser_tor_omnibox.js] [browser_tor_TB4.js] diff --git a/tbb-tests/browser_tor_bug18995.js b/tbb-tests/browser_tor_bug18995.js new file mode 100644 index 0000000..1f1801b --- /dev/null +++ b/tbb-tests/browser_tor_bug18995.js @@ -0,0 +1,50 @@ +// __browser_tor_bug18995.js__. +// In this test, we open a private browsing window, and load pages +// that test whether we can call `caches.open("test")` + +// Helper function. +// Returns a promise that is fulfilled when the first event of eventype +// arrives from the target. +let listen = function (target, eventType, useCapture) { + return new Promise(function (resolve, reject) { + let listenFunction = function (event) { + target.removeEventListener(eventType, listenFunction, useCapture); + resolve(event); + }; + target.addEventListener(eventType, listenFunction, useCapture); + }); +}; + +// The main test +add_task(function* () { + // First open the private browsing window + let privateWin = yield BrowserTestUtils.openNewBrowserWindow({private: true}); + let privateBrowser = privateWin.gBrowser.selectedBrowser; + + // We have two pages: (1) access CacheStorage in content page + // (2) access CacheStorage in worker + let testURIs = ["http://mochi.test:8888/browser/tbb-tests/bug18995.html", + "http://mochi.test:8888/browser/tbb-tests/worker_bug_18995.html"]; + for (let testURI of testURIs) { + // Load the test page + privateBrowser.loadURI(testURI); + // Wait for it too fully load + yield BrowserTestUtils.browserLoaded(privateBrowser); + // Get the <div id="result"/> in the content page + let resultDiv = privateBrowser.contentDocument.getElementById("result"); + // Send an event to the content page indicating we are ready to receive. + resultDiv.dispatchEvent(new Event("ready")); + // Wait for a signal from the content page that a result is ready. + yield listen(resultDiv, "result", false); + // Read the result from the result <div> + let resultValue = resultDiv.innerHTML; + // Print out the result + info("received: " + resultValue); + // If we are in PBM, then the promise returned by caches.open(...) + // is supposed to arrive at a rejection with a SecurityError. + ok(resultValue.contains("SecurityError"), + "CacheStorage should fail in private browsing mode"); + } + // Close the browser window because we are done testing. + yield BrowserTestUtils.closeWindow(privateWin); +}); diff --git a/tbb-tests/bug18995.html b/tbb-tests/bug18995.html new file mode 100644 index 0000000..445a26ab --- /dev/null +++ b/tbb-tests/bug18995.html @@ -0,0 +1,31 @@ +<!DOCTYPE html> +<html> + <head> + <meta charset="utf-8" /> + <title>Bug 18995 test</title> + </head> + <body> + <div id="result"></div> + <script type="application/javascript"> + let resultDiv = document.getElementById("result"); + // Wait for a signal from chrome to start. + resultDiv.addEventListener("ready", function () { + let resultEvent = new Event("result"); + // Test caches.open(...) + caches.open("test1").then(function (value) { + // We are not supposed to succeed, but if we do, + // post the result to resultDiv. + resultDiv.innerHTML = value.toString(); + // Notify chrome that the result is available. + resultDiv.dispatchEvent(resultEvent); + }, function (reason) { + // We should arrive here to fail. Post the result + // to resultDiv. + resultDiv.innerHTML = reason.toString(); + // Notify chrome that the result is available. + resultDiv.dispatchEvent(resultEvent); + }); + }); + </script> + </body> +</html> diff --git a/tbb-tests/worker_bug_18995.html b/tbb-tests/worker_bug_18995.html new file mode 100644 index 0000000..d9be95c --- /dev/null +++ b/tbb-tests/worker_bug_18995.html @@ -0,0 +1,26 @@ +<!DOCTYPE html> +<html> + <head> + <meta charset="utf-8" /> + <title>Bug 18995 test</title> + </head> + <body> + <div id="result"></div> + <script type="application/javascript"> + let resultDiv = document.getElementById("result"); + // Wait for a signal from chrome to start. + resultDiv.addEventListener("ready", function() { + // Run the test worker. + let worker = new Worker("worker_bug_18995.js"); + // Wait for a message from the worker, which should contain + // the result or the error from the caches.open(...) call. + worker.addEventListener("message", function (msg) { + // Put the result in our resultDiv. + resultDiv.innerHTML = msg.data; + // Notify chrome that the result is ready. + resultDiv.dispatchEvent(new Event("result")); + }); + }); + </script> + </body> +</html> diff --git a/tbb-tests/worker_bug_18995.js b/tbb-tests/worker_bug_18995.js new file mode 100644 index 0000000..11641e1 --- /dev/null +++ b/tbb-tests/worker_bug_18995.js @@ -0,0 +1,8 @@ +// Attempt to open a cache +caches.open("test2").then(function (value) { + // This is not supposed to happen. + self.postMessage(value.toString()); +}, function (reason) { + // We are supposed to fail. + self.postMessage(reason.toString()); +});

1 0

[tor-browser-bundle/hardened-builds] Bug 18915: Use our search plugins in localized builds
by gk＠torproject.org 12 May '16

12 May '16

commit 467796a7b7901fc22f26716860ed6ed8d4102416 Author: Georg Koppen <gk(a)torproject.org> Date: Wed May 11 19:37:29 2016 +0000 Bug 18915: Use our search plugins in localized builds We are preparing the language packs we ship for using our search engines in the order we want. This is necessary due to https://bugzilla.mozilla.org/show_bug.cgi?id=1162569. --- gitian/descriptors/linux/gitian-bundle.yml | 19 +++++++++++++ gitian/descriptors/mac/gitian-bundle.yml | 19 +++++++++++++ gitian/descriptors/windows/gitian-bundle.yml | 40 +++++++++++++++++++++------- 3 files changed, 68 insertions(+), 10 deletions(-) diff --git a/gitian/descriptors/linux/gitian-bundle.yml b/gitian/descriptors/linux/gitian-bundle.yml index b9bf0f9..eca8d0f 100644 --- a/gitian/descriptors/linux/gitian-bundle.yml +++ b/gitian/descriptors/linux/gitian-bundle.yml @@ -184,6 +184,10 @@ script: | cp -a ${TB_STAGE_DIR} ${PKG_DIR} # pushd ${PKG_DIR}/Browser/browser/ + # For the proper search engines in our language packs + unzip omni.ja chrome/en-US/locale/browser/searchplugins* + mv chrome/en-US/locale/browser/searchplugins ~/build + rm -rf chrome unzip omni.ja defaults/preferences/000-tor-browser.js cp defaults/preferences/000-tor-browser.js ~/build/ # Set the locale of the bundle. @@ -194,6 +198,21 @@ script: | # unzip linux-langpacks.zip LINUX_LOCALES="$BUNDLE_LOCALES $BUNDLE_LOCALES_LINUX" + # Prepare our language packs for using the proper search engines. See bug + # 18915 for more details. + for LANG in $LINUX_LOCALES + do + xpi=linux-langpacks/$LANG.xpi + unzip -d prep_$LANG $xpi + search_plugins_path=prep_$LANG/browser/chrome/$LANG/locale/browser + rm -rf $search_plugins_path/searchplugins + cp -rf ~/build/searchplugins $search_plugins_path + rm $xpi + cd prep_$LANG + zip -r9 ../$xpi * + cd .. + rm -rf prep_$LANG + done # If we are building a multi-lingual package, add all of the language packs. if [ "z$MULTI_LINGUAL" = "z1" ]; then pushd linux-langpacks diff --git a/gitian/descriptors/mac/gitian-bundle.yml b/gitian/descriptors/mac/gitian-bundle.yml index 0199cca..e046b57 100644 --- a/gitian/descriptors/mac/gitian-bundle.yml +++ b/gitian/descriptors/mac/gitian-bundle.yml @@ -184,6 +184,10 @@ script: | cd .. # pushd $TORBROWSER_NAME.app/Contents/Resources/browser/ + # For the proper search engines in our language packs + unzip omni.ja chrome/en-US/locale/browser/searchplugins* + mv chrome/en-US/locale/browser/searchplugins ~/build + rm -rf chrome unzip omni.ja defaults/preferences/000-tor-browser.js cp defaults/preferences/000-tor-browser.js ~/build/ # Set the locale of the bundle. @@ -203,6 +207,21 @@ script: | unzip mac-langpacks.zip MAC_LOCALES="$BUNDLE_LOCALES $BUNDLE_LOCALES_MAC" + # Prepare our language packs for using the proper search engines. See bug + # 18915 for more details. + for LANG in $MAC_LOCALES + do + xpi=mac-langpacks/$LANG.xpi + unzip -d prep_$LANG $xpi + search_plugins_path=prep_$LANG/browser/chrome/$LANG/locale/browser + rm -rf $search_plugins_path/searchplugins + cp -rf ~/build/searchplugins $search_plugins_path + rm $xpi + cd prep_$LANG + zip -r9 ../$xpi * + cd .. + rm -rf prep_$LANG + done PKG_LOCALE="en-US" # If we are building a multi-lingual package, add all of the language packs # and use "ALL" in the package name and as the locale for update purposes. diff --git a/gitian/descriptors/windows/gitian-bundle.yml b/gitian/descriptors/windows/gitian-bundle.yml index 51565bf..5473bf3 100644 --- a/gitian/descriptors/windows/gitian-bundle.yml +++ b/gitian/descriptors/windows/gitian-bundle.yml @@ -152,8 +152,38 @@ script: | cp ../versions "Tor Browser"/Browser/TorBrowser/Docs/sources/ cp ../bundle.inputs "Tor Browser"/Browser/TorBrowser/Docs/sources/ + # + pushd "Tor Browser"/Browser/browser/ + # For the proper search engines in our language packs + unzip omni.ja chrome/en-US/locale/browser/searchplugins* + mv chrome/en-US/locale/browser/searchplugins ~/build + rm -rf chrome + unzip omni.ja defaults/preferences/000-tor-browser.js + cp defaults/preferences/000-tor-browser.js ~/build/ + # Set the locale bundle. + echo "pref(\"general.useragent.locale\", \"en-US\");" >> defaults/preferences/000-tor-browser.js + zip -Xm omni.ja defaults/preferences/000-tor-browser.js + rm -rf defaults + popd + # + unzip ../win32-langpacks.zip WIN32_LOCALES="$BUNDLE_LOCALES $BUNDLE_LOCALES_WIN32" + # Prepare our language packs for using the proper search engines. See bug + # 18915 for more details. + for LANG in $WIN32_LOCALES + do + xpi=win32-langpacks/$LANG.xpi + unzip -d prep_$LANG $xpi + search_plugins_path=prep_$LANG/browser/chrome/$LANG/locale/browser + rm -rf $search_plugins_path/searchplugins + cp -rf ~/build/searchplugins $search_plugins_path + rm $xpi + cd prep_$LANG + zip -r9 ../$xpi * + cd .. + rm -rf prep_$LANG + done PKG_LOCALE="en-US" # If we are building a multi-lingual package, add all of the language packs # and use "ALL" in the package name and as the locale for update purposes. @@ -175,16 +205,6 @@ script: | popd fi - # - pushd "Tor Browser"/Browser/browser/ - unzip omni.ja defaults/preferences/000-tor-browser.js - cp defaults/preferences/000-tor-browser.js ~/build/ - # Set the locale bundle. - echo "pref(\"general.useragent.locale\", \"en-US\");" >> defaults/preferences/000-tor-browser.js - zip -Xm omni.ja defaults/preferences/000-tor-browser.js - rm -rf defaults - popd - # # Recreate precomplete file (needs to be accurate for full MAR updates). pushd "Tor Browser"/Browser/ rm -f precomplete

1 0

[tor-browser-bundle/master] Bug 18915: Use our search plugins in localized builds
by gk＠torproject.org 12 May '16

12 May '16

commit 94c6a1c73291f8f456249d9719de57ff002fe6fe Author: Georg Koppen <gk(a)torproject.org> Date: Wed May 11 19:37:29 2016 +0000 Bug 18915: Use our search plugins in localized builds We are preparing the language packs we ship for using our search engines in the order we want. This is necessary due to https://bugzilla.mozilla.org/show_bug.cgi?id=1162569. --- gitian/descriptors/linux/gitian-bundle.yml | 19 +++++++++++++ gitian/descriptors/mac/gitian-bundle.yml | 19 +++++++++++++ gitian/descriptors/windows/gitian-bundle.yml | 40 +++++++++++++++++++++------- 3 files changed, 68 insertions(+), 10 deletions(-) diff --git a/gitian/descriptors/linux/gitian-bundle.yml b/gitian/descriptors/linux/gitian-bundle.yml index d5aaec4..39ad811 100644 --- a/gitian/descriptors/linux/gitian-bundle.yml +++ b/gitian/descriptors/linux/gitian-bundle.yml @@ -194,6 +194,10 @@ script: | cp -a ${TB_STAGE_DIR} ${PKG_DIR} # pushd ${PKG_DIR}/Browser/browser/ + # For the proper search engines in our language packs + unzip omni.ja chrome/en-US/locale/browser/searchplugins* + mv chrome/en-US/locale/browser/searchplugins ~/build + rm -rf chrome unzip omni.ja defaults/preferences/000-tor-browser.js cp defaults/preferences/000-tor-browser.js ~/build/ # Set the locale of the bundle. @@ -204,6 +208,21 @@ script: | # unzip linux-langpacks.zip LINUX_LOCALES="$BUNDLE_LOCALES $BUNDLE_LOCALES_LINUX" + # Prepare our language packs for using the proper search engines. See bug + # 18915 for more details. + for LANG in $LINUX_LOCALES + do + xpi=linux-langpacks/$LANG.xpi + unzip -d prep_$LANG $xpi + search_plugins_path=prep_$LANG/browser/chrome/$LANG/locale/browser + rm -rf $search_plugins_path/searchplugins + cp -rf ~/build/searchplugins $search_plugins_path + rm $xpi + cd prep_$LANG + zip -r9 ../$xpi * + cd .. + rm -rf prep_$LANG + done # If we are building a multi-lingual package, add all of the language packs. if [ "z$MULTI_LINGUAL" = "z1" ]; then pushd linux-langpacks diff --git a/gitian/descriptors/mac/gitian-bundle.yml b/gitian/descriptors/mac/gitian-bundle.yml index 00cd4d1..ff17520 100644 --- a/gitian/descriptors/mac/gitian-bundle.yml +++ b/gitian/descriptors/mac/gitian-bundle.yml @@ -213,6 +213,10 @@ script: | cd .. # pushd $TORBROWSER_NAME.app/Contents/Resources/browser/ + # For the proper search engines in our language packs + unzip omni.ja chrome/en-US/locale/browser/searchplugins* + mv chrome/en-US/locale/browser/searchplugins ~/build + rm -rf chrome unzip omni.ja defaults/preferences/000-tor-browser.js cp defaults/preferences/000-tor-browser.js ~/build/ if [ "z$DATA_OUTSIDE_APP_DIR" = "z1" ]; then @@ -245,6 +249,21 @@ script: | unzip mac-langpacks.zip MAC_LOCALES="$BUNDLE_LOCALES $BUNDLE_LOCALES_MAC" + # Prepare our language packs for using the proper search engines. See bug + # 18915 for more details. + for LANG in $MAC_LOCALES + do + xpi=mac-langpacks/$LANG.xpi + unzip -d prep_$LANG $xpi + search_plugins_path=prep_$LANG/browser/chrome/$LANG/locale/browser + rm -rf $search_plugins_path/searchplugins + cp -rf ~/build/searchplugins $search_plugins_path + rm $xpi + cd prep_$LANG + zip -r9 ../$xpi * + cd .. + rm -rf prep_$LANG + done PKG_LOCALE="en-US" # If we are building a multi-lingual package, add all of the language packs # and use "ALL" in the package name and as the locale for update purposes. diff --git a/gitian/descriptors/windows/gitian-bundle.yml b/gitian/descriptors/windows/gitian-bundle.yml index 4fe4bb6..da65142 100644 --- a/gitian/descriptors/windows/gitian-bundle.yml +++ b/gitian/descriptors/windows/gitian-bundle.yml @@ -161,8 +161,38 @@ script: | cp ../versions "Tor Browser"/Browser/TorBrowser/Docs/sources/ cp ../bundle.inputs "Tor Browser"/Browser/TorBrowser/Docs/sources/ + # + pushd "Tor Browser"/Browser/browser/ + # For the proper search engines in our language packs + unzip omni.ja chrome/en-US/locale/browser/searchplugins* + mv chrome/en-US/locale/browser/searchplugins ~/build + rm -rf chrome + unzip omni.ja defaults/preferences/000-tor-browser.js + cp defaults/preferences/000-tor-browser.js ~/build/ + # Set the locale bundle. + echo "pref(\"general.useragent.locale\", \"en-US\");" >> defaults/preferences/000-tor-browser.js + zip -Xm omni.ja defaults/preferences/000-tor-browser.js + rm -rf defaults + popd + # + unzip ../win32-langpacks.zip WIN32_LOCALES="$BUNDLE_LOCALES $BUNDLE_LOCALES_WIN32" + # Prepare our language packs for using the proper search engines. See bug + # 18915 for more details. + for LANG in $WIN32_LOCALES + do + xpi=win32-langpacks/$LANG.xpi + unzip -d prep_$LANG $xpi + search_plugins_path=prep_$LANG/browser/chrome/$LANG/locale/browser + rm -rf $search_plugins_path/searchplugins + cp -rf ~/build/searchplugins $search_plugins_path + rm $xpi + cd prep_$LANG + zip -r9 ../$xpi * + cd .. + rm -rf prep_$LANG + done PKG_LOCALE="en-US" # If we are building a multi-lingual package, add all of the language packs # and use "ALL" in the package name and as the locale for update purposes. @@ -184,16 +214,6 @@ script: | popd fi - # - pushd "Tor Browser"/Browser/browser/ - unzip omni.ja defaults/preferences/000-tor-browser.js - cp defaults/preferences/000-tor-browser.js ~/build/ - # Set the locale bundle. - echo "pref(\"general.useragent.locale\", \"en-US\");" >> defaults/preferences/000-tor-browser.js - zip -Xm omni.ja defaults/preferences/000-tor-browser.js - rm -rf defaults - popd - # # Recreate precomplete file (needs to be accurate for full MAR updates). pushd "Tor Browser"/Browser/ rm -f precomplete

1 0

[tor-browser-bundle/hardened-builds] Bug 18976: Remove some FTE bridges
by gk＠torproject.org 12 May '16

12 May '16

commit 076028da65ee8d4785b65f818e7f8c19bf9e3f0b Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 9 07:53:06 2016 +0000 Bug 18976: Remove some FTE bridges --- Bundle-Data/PTConfigs/bridge_prefs.js | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/Bundle-Data/PTConfigs/bridge_prefs.js b/Bundle-Data/PTConfigs/bridge_prefs.js index 390d7a5..379f256 100644 --- a/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/Bundle-Data/PTConfigs/bridge_prefs.js @@ -8,15 +8,10 @@ pref("extensions.torlauncher.default_bridge.obfs3.3", "obfs3 169.229.59.75:46328 pref("extensions.torlauncher.default_bridge.obfs3.4", "obfs3 109.105.109.163:38980 1E05F577A0EC0213F971D81BF4D86A9E4E8229ED"); pref("extensions.torlauncher.default_bridge.obfs3.5", "obfs3 109.105.109.163:47779 4C331FA9B3D1D6D8FB0D8FBBF0C259C360D97E6A"); -pref("extensions.torlauncher.default_bridge.fte.1", "fte 192.240.101.106:80 FDC5BA65D93B6BCA5EBDF8EF8E4FA936B7F1F8E5"); -pref("extensions.torlauncher.default_bridge.fte.2", "fte 50.7.176.114:80 2BD466989944867075E872310EBAD65BC88C8AEF"); -pref("extensions.torlauncher.default_bridge.fte.3", "fte 131.252.210.150:8080 0E858AC201BF0F3FA3C462F64844CBFFC7297A42"); -pref("extensions.torlauncher.default_bridge.fte.4", "fte 128.105.214.161:8080 1E326AAFB3FCB515015250D8FCCC8E37F91A153B"); -pref("extensions.torlauncher.default_bridge.fte.5", "fte 128.105.214.162:8080 FC562097E1951DCC41B7D7F324D88157119BB56D"); -pref("extensions.torlauncher.default_bridge.fte.6", "fte 128.105.214.163:8080 A17A40775FBD2CA1184BF80BFC330A77ECF9D0E9"); - -pref("extensions.torlauncher.default_bridge.fte-ipv6.1", "fte [2001:49f0:d002:1::2]:80 FDC5BA65D93B6BCA5EBDF8EF8E4FA936B7F1F8E5"); -pref("extensions.torlauncher.default_bridge.fte-ipv6.2", "fte [2001:49f0:d00a:1::c]:80 2BD466989944867075E872310EBAD65BC88C8AEF"); +pref("extensions.torlauncher.default_bridge.fte.1", "fte 131.252.210.150:8080 0E858AC201BF0F3FA3C462F64844CBFFC7297A42"); +pref("extensions.torlauncher.default_bridge.fte.2", "fte 128.105.214.161:8080 1E326AAFB3FCB515015250D8FCCC8E37F91A153B"); +pref("extensions.torlauncher.default_bridge.fte.3", "fte 128.105.214.162:8080 FC562097E1951DCC41B7D7F324D88157119BB56D"); +pref("extensions.torlauncher.default_bridge.fte.4", "fte 128.105.214.163:8080 A17A40775FBD2CA1184BF80BFC330A77ECF9D0E9"); pref("extensions.torlauncher.default_bridge.scramblesuit.1", "scramblesuit 83.212.101.3:443 A09D536DD1752D542E1FBB3C9CE4449D51298239 password=XTCXLG2JAMJKZW2POLBAOWOQETQSMASH");

1 0

[tor-browser-bundle/master] Bug 18976: Remove some FTE bridges
by gk＠torproject.org 12 May '16

12 May '16

commit bd2d6d501e88599a86b7a55a23f1731c0ec6ed74 Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 9 07:53:06 2016 +0000 Bug 18976: Remove some FTE bridges --- Bundle-Data/PTConfigs/bridge_prefs.js | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/Bundle-Data/PTConfigs/bridge_prefs.js b/Bundle-Data/PTConfigs/bridge_prefs.js index 390d7a5..379f256 100644 --- a/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/Bundle-Data/PTConfigs/bridge_prefs.js @@ -8,15 +8,10 @@ pref("extensions.torlauncher.default_bridge.obfs3.3", "obfs3 169.229.59.75:46328 pref("extensions.torlauncher.default_bridge.obfs3.4", "obfs3 109.105.109.163:38980 1E05F577A0EC0213F971D81BF4D86A9E4E8229ED"); pref("extensions.torlauncher.default_bridge.obfs3.5", "obfs3 109.105.109.163:47779 4C331FA9B3D1D6D8FB0D8FBBF0C259C360D97E6A"); -pref("extensions.torlauncher.default_bridge.fte.1", "fte 192.240.101.106:80 FDC5BA65D93B6BCA5EBDF8EF8E4FA936B7F1F8E5"); -pref("extensions.torlauncher.default_bridge.fte.2", "fte 50.7.176.114:80 2BD466989944867075E872310EBAD65BC88C8AEF"); -pref("extensions.torlauncher.default_bridge.fte.3", "fte 131.252.210.150:8080 0E858AC201BF0F3FA3C462F64844CBFFC7297A42"); -pref("extensions.torlauncher.default_bridge.fte.4", "fte 128.105.214.161:8080 1E326AAFB3FCB515015250D8FCCC8E37F91A153B"); -pref("extensions.torlauncher.default_bridge.fte.5", "fte 128.105.214.162:8080 FC562097E1951DCC41B7D7F324D88157119BB56D"); -pref("extensions.torlauncher.default_bridge.fte.6", "fte 128.105.214.163:8080 A17A40775FBD2CA1184BF80BFC330A77ECF9D0E9"); - -pref("extensions.torlauncher.default_bridge.fte-ipv6.1", "fte [2001:49f0:d002:1::2]:80 FDC5BA65D93B6BCA5EBDF8EF8E4FA936B7F1F8E5"); -pref("extensions.torlauncher.default_bridge.fte-ipv6.2", "fte [2001:49f0:d00a:1::c]:80 2BD466989944867075E872310EBAD65BC88C8AEF"); +pref("extensions.torlauncher.default_bridge.fte.1", "fte 131.252.210.150:8080 0E858AC201BF0F3FA3C462F64844CBFFC7297A42"); +pref("extensions.torlauncher.default_bridge.fte.2", "fte 128.105.214.161:8080 1E326AAFB3FCB515015250D8FCCC8E37F91A153B"); +pref("extensions.torlauncher.default_bridge.fte.3", "fte 128.105.214.162:8080 FC562097E1951DCC41B7D7F324D88157119BB56D"); +pref("extensions.torlauncher.default_bridge.fte.4", "fte 128.105.214.163:8080 A17A40775FBD2CA1184BF80BFC330A77ECF9D0E9"); pref("extensions.torlauncher.default_bridge.scramblesuit.1", "scramblesuit 83.212.101.3:443 A09D536DD1752D542E1FBB3C9CE4449D51298239 password=XTCXLG2JAMJKZW2POLBAOWOQETQSMASH");

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] fixup! Bug 13252 - Do not store data in the app bundle
by gk＠torproject.org 10 May '16

10 May '16

commit d4f5d1c3704007cadaf6a37f3b8330f4e1930828 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Mon May 2 17:54:39 2016 -0400 fixup! Bug 13252 - Do not store data in the app bundle Ignore the XRE_PROFILE_PATH environment variable during the restart that occurs immediately after updating from a version of Tor Browser that uses an embedded profile (fixes bug 18928). --- toolkit/xre/nsAppRunner.cpp | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/toolkit/xre/nsAppRunner.cpp b/toolkit/xre/nsAppRunner.cpp index 20be296..67bb2d3 100644 --- a/toolkit/xre/nsAppRunner.cpp +++ b/toolkit/xre/nsAppRunner.cpp @@ -2756,6 +2756,29 @@ SelectProfile(nsIProfileLock* *aResult, nsIToolkitProfileService* aProfileSvc, } nsCOMPtr<nsIFile> lf = GetFileFromEnv("XRE_PROFILE_PATH"); +#ifdef TOR_BROWSER_DATA_OUTSIDE_APP_DIR + // If we are transitioning away from an embedded profile, ignore the + // XRE_PROFILE_PATH value if it matches the old default profile location. + // This ensures that a new default profile will be created immediately + // after applying an update and that our migration code will then be + // executed. + if (lf) { + nsCOMPtr<nsIFile> oldTorProfileDir; + nsresult rv = GetAppRootDir(aAppDir, getter_AddRefs(oldTorProfileDir)); + NS_ENSURE_SUCCESS(rv, rv); + rv = oldTorProfileDir->AppendRelativeNativePath( + NS_LITERAL_CSTRING("TorBrowser" XPCOM_FILE_PATH_SEPARATOR + "Data" XPCOM_FILE_PATH_SEPARATOR + "Browser" XPCOM_FILE_PATH_SEPARATOR "profile.default")); + NS_ENSURE_SUCCESS(rv, rv); + bool isOldProfile = false; + rv = lf->Equals(oldTorProfileDir, &isOldProfile); + NS_ENSURE_SUCCESS(rv, rv); + if (isOldProfile) + lf = nullptr; // Ignore this XRE_PROFILE_PATH value. + } +#endif + if (lf) { nsCOMPtr<nsIFile> localDir = GetFileFromEnv("XRE_PROFILE_LOCAL_PATH");

1 0

[torbutton/master] Bug 18980: Remove obsolete toolbar button code
by gk＠torproject.org 09 May '16

09 May '16

commit 1e3a5db79447d742bffa5aa773a813f3e379fac9 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Thu May 5 21:45:29 2016 -0700 Bug 18980: Remove obsolete toolbar button code --- src/chrome/content/torbutton.js | 36 ++++++++---------------------------- 1 file changed, 8 insertions(+), 28 deletions(-) diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index 03a3b56..a8a4ce6 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -7,13 +7,6 @@ // TODO: Double-check there are no strange exploits to defeat: // http://kb.mozillazine.org/Links_to_local_pages_don%27t_work -// TODO: Remove the following HUDService loading code once TBB-ESR24 has -// been retired. -if (!window.hasOwnProperty("HUDService")) { - XPCOMUtils.defineLazyModuleGetter(this, "HUDService", - "resource:///modules/HUDService.jsm"); -} - XPCOMUtils.defineLazyModuleGetter(this, "ConsoleServiceListener", "resource://gre/modules/devtools/WebConsoleUtils.jsm"); XPCOMUtils.defineLazyModuleGetter(this, "WebConsoleUtils", @@ -610,27 +603,14 @@ function torbutton_init() { if (!m_tb_prefs.getBoolPref("extensions.torbutton.inserted_button")) { torbutton_log(3, 'Adding button'); try { - if (CustomizableUI) { - // ESR31-style toolbar is handled by the existing compiled-in pref. - // We also need to prevent first-run toolbar reorg (#13378), so we - // reset this toolbar state on first-run. - try { - m_tb_prefs.clearUserPref("browser.uiCustomization.state"); - } catch(e) {} - CustomizableUI.reset(); - CustomizableUI.undoReset(); - } else { - // ESR24-style toolbar - // TODO: Remove this branch once TBB-ESR24 has been retired. - var toolbutton = torbutton_get_button_from_toolbox(); - var navbar = document.getElementById("nav-bar"); - // XXX: Will probably fail on fennec. Also explicitly forbidden - // by MDC style guides (for good reason). Fix later.. - var urlbar = document.getElementById("urlbar-container"); - navbar.insertBefore(toolbutton, urlbar); - navbar.setAttribute("currentset", navbar.currentSet); - document.persist("nav-bar", "currentset"); - } + // ESR31-style toolbar is handled by the existing compiled-in pref. + // We also need to prevent first-run toolbar reorg (#13378), so we + // reset this toolbar state on first-run. + try { + m_tb_prefs.clearUserPref("browser.uiCustomization.state"); + } catch(e) {} + CustomizableUI.reset(); + CustomizableUI.undoReset(); torbutton_log(3, 'Button added'); m_tb_prefs.setBoolPref("extensions.torbutton.inserted_button", true); } catch(e) {

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] fixup! Bug #13670.1: Isolate favicon requests by first party
by gk＠torproject.org 05 May '16

05 May '16

commit ac739a883c7960eda72ce71e82e8b3f704381c4d Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Tue Apr 26 13:33:46 2016 -0700 fixup! Bug #13670.1: Isolate favicon requests by first party This fixes the isolation issues on the Page Info dialog (both video and audio related). See bug 18703 for more details. --- browser/base/content/content.js | 1 + browser/base/content/pageinfo/pageInfo.js | 7 ++++++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/browser/base/content/content.js b/browser/base/content/content.js index 55f579f..ee456df 100644 --- a/browser/base/content/content.js +++ b/browser/base/content/content.js @@ -972,6 +972,7 @@ var PageInfoListener = { catch (exception) { } windowInfo.hostName = hostName; + windowInfo.firstParty = window.top.location.href; return windowInfo; }, diff --git a/browser/base/content/pageinfo/pageInfo.js b/browser/base/content/pageinfo/pageInfo.js index 3683b06..beff551 100644 --- a/browser/base/content/pageinfo/pageInfo.js +++ b/browser/base/content/pageinfo/pageInfo.js @@ -152,6 +152,7 @@ pageInfoTreeView.prototype = { // mmm, yummy. global variables. var gDocInfo = null; var gImageElement = null; +var gFirstParty = null; // column number to help using the data array const COL_IMAGE_ADDRESS = 0; @@ -378,6 +379,8 @@ function loadPageInfo(frameOuterWindowID, imageElement) gImageElement = pageInfoData.imageInfo; + gFirstParty = windowInfo.firstParty; + var titleFormat = windowInfo.isTopWindow ? "pageInfo.page.title" : "pageInfo.frame.title"; document.title = gBundle.getFormattedString(titleFormat, [docInfo.location]); @@ -881,7 +884,7 @@ function makePreview(row) var newImage = new Image; newImage.id = "thepreviewimage"; // Ensure "Media" items are fetched over the first-party domain. - newImage.setAttribute("firstparty", gWindow.top.document.location); + newImage.setAttribute("firstparty", gFirstParty); var physWidth = 0, physHeight = 0; var width = 0, height = 0; @@ -929,6 +932,7 @@ function makePreview(row) else if (item.HTMLVideoElement && isProtocolAllowed) { newImage = document.createElementNS("http://www.w3.org/1999/xhtml", "video"); newImage.id = "thepreviewimage"; + newImage.setAttribute("firstparty", gFirstParty); newImage.src = url; newImage.controls = true; width = physWidth = item.videoWidth; @@ -940,6 +944,7 @@ function makePreview(row) else if (item.HTMLAudioElement && isProtocolAllowed) { newImage = new Audio; newImage.id = "thepreviewimage"; + newImage.setAttribute("firstparty", gFirstParty); newImage.src = url; newImage.controls = true; isAudio = true;

1 0

[torbutton/master] Bug 18905: Hide unusable items from help menu
by gk＠torproject.org 04 May '16

04 May '16

commit b72f495c9593bb7df8fab34b642325c22e4e7393 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Tue Apr 26 15:59:36 2016 -0700 Bug 18905: Hide unusable items from help menu --- src/chrome.manifest | 3 +++ src/chrome/content/menu-overlay.xul | 18 ++++++++++++++++++ 2 files changed, 21 insertions(+) diff --git a/src/chrome.manifest b/src/chrome.manifest index 30aa2ff..e85a205 100644 --- a/src/chrome.manifest +++ b/src/chrome.manifest @@ -12,6 +12,9 @@ override chrome://branding/locale/brand.dtd chrome://torbutton/locale/brand.dtd override chrome://branding/locale/brand.properties chrome://torbutton/locale/brand.properties overlay chrome://browser/content/aboutDialog.xul chrome://torbutton/content/aboutDialog.xul +# UI customization +overlay chrome://browser/content/baseMenuOverlay.xul chrome://torbutton/content/menu-overlay.xul + # Strings for the about:tbupdate page override chrome://browser/locale/aboutTBUpdate.dtd chrome://torbutton/locale/aboutTBUpdate.dtd diff --git a/src/chrome/content/menu-overlay.xul b/src/chrome/content/menu-overlay.xul new file mode 100644 index 0000000..ceadf85 --- /dev/null +++ b/src/chrome/content/menu-overlay.xul @@ -0,0 +1,18 @@ +<?xml version="1.0" encoding="UTF-8"?>  + + +<overlay id="torbutton-menu-overlay" + xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"> + <menupopup id="menu_HelpPopup"> + <menuitem id="menu_openHelp" removeelement="true"/> + <menuitem id="menu_openTour" removeelement="true"/> + <menuitem id="healthReport" removeelement="true"/> + <menuitem id="feedbackPage" removeelement="true"/> + <menuitem id="helpSafeMode" removeelement="true"/> + <menuitem id="menu_HelpPopup_reportPhishingtoolmenu" removeelement="true"/> + <menuitem id="menu_HelpPopup_reportPhishingErrortoolmenu" removeelement="true"/> +  + <box id="menu_HelpPopup_reportPhishingtoolmenu"/> + <box id="menu_HelpPopup_reportPhishingErrortoolmenu"/> + </menupopup> +</overlay>

1 0

[tor-browser-bundle/master] Folding in changelogs
by gk＠torproject.org 04 May '16

04 May '16

commit 5bf62ce8d5e4bbeec5eace152ae90cc36657f836 Author: Georg Koppen <gk(a)torproject.org> Date: Tue May 3 19:28:59 2016 +0000 Folding in changelogs --- Bundle-Data/Docs/ChangeLog.txt | 55 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 5ea56f1..b96cb79 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,48 @@ +Tor Browser 6.0a5-hardened -- April 28 2016 + * All Platforms + * Update Firefox to 45.1.0esr + * Update Tor to 0.2.8.2-alpha + * Update Torbutton to 1.9.5.3 + * Bug 18466: Make Torbutton compatible with Firefox ESR 45 + * Translation updates + * Update Tor Launcher to 0.2.8.4 + * Bug 13252: Do not store data in the application bundle + * Bug 10534: Don't advertise the help desk directly anymore + * Translation updates + * Update HTTPS-Everywhere to 5.1.6 + * Update NoScript to 2.9.0.11 + * Update meek to 0.22 (tag 0.22-18371-2) + * Bug 18371: Symlinks are incompatible with Gatekeeper signing + * Bug 15197 and child tickets: Rebase Tor Browser patches to ESR 45 + * Bug 18900: Fix broken updater on Linux + * Bug 18042: Disable SHA1 certificate support + * Bug 18821: Disable libmdns support for desktop and mobile + * Bug 18848: Disable additional welcome URL shown on first start + * Bug 14970: Exempt our extensions from signing requirement + * Bug 16328: Disable MediaDevices.enumerateDevices + * Bug 16673: Disable HTTP Alternative-Services + * Bug 17167: Disable Mozilla's tracking protection + * Bug 18603: Disable performance-based WebGL fingerprinting option + * Bug 18738: Disable Selfsupport and Unified Telemetry + * Bug 18799: Disable Network Tickler + * Bug 18800: Remove DNS lookup in lockfile code + * Bug 18801: Disable dom.push preferences + * Bug 18802: Remove the JS-based Flash VM (Shumway) + * Bug 18863: Disable MozTCPSocket explicitly + * Bug 15640: Place Canvas MediaStream behind site permission + * Bug 16326: Verify cache isolation for Request and Fetch APIs + * Bug 18741: Fix OCSP and favicon isolation for ESR 45 + * Bug 16998: Disable <link rel="preconnect"> for now + * Bug 17506: Reenable building hardened Tor Browser with startup cache + * Bug 18898: Exempt the meek extension from the signing requirement as well + * Bug 18899: Don't copy Torbutton, TorLauncher, etc. into meek profile + * Bug 18890: Test importScripts() for cache and network isolation + * Bug 18726: Add new default obfs4 bridge (GreenBelt) + * Build System + * Bug 16224: Don't use BUILD_HOSTNAME anymore in Firefox builds + * Bug 18699: Stripping fails due to obsolete Browser/components directory + * Bug 18698: Include libgconf2-dev for our Linux builds + Tor Browser 6.0a5 -- April 28 2016 * All Platforms * Update Firefox to 45.1.0esr @@ -58,6 +103,16 @@ Tor Browser 6.0a5 -- April 28 2016 * Bug 18699: Stripping fails due to obsolete Browser/components directory * Bug 18698: Include libgconf2-dev for our Linux builds +Tor Browser 5.5.5 -- April 26 2016 + * All Platforms + * Update Firefox to 38.8.0esr + * Update Tor Launcher to 0.2.7.9 + * Bug 10534: Don't advertise the help desk directly anymore + * Translation updates + * Update HTTPS-Everywhere to 5.1.6 + * Update NoScript to 2.9.0.11 + * Bug 18726: Add new default obfs4 bridge (GreenBelt) + Tor Browser 6.0a4-hardened -- March 17 2016 * All Platforms * Update Firefox to 38.7.1esr

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] fixup! Bug #4234: Use the Firefox Update Process for Tor Browser.
by gk＠torproject.org 04 May '16

04 May '16

commit e51823989e0f57328f6b710e599ed3b564ac0c37 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Mon May 2 16:28:10 2016 -0400 fixup! Bug #4234: Use the Firefox Update Process for Tor Browser. Avoid special handling and use of "add-if" for unpacked add-ons that are located under distribution/extensions (fixes bug #18951). --- tools/update-packaging/common.sh | 36 +++++++----------------------------- 1 file changed, 7 insertions(+), 29 deletions(-) diff --git a/tools/update-packaging/common.sh b/tools/update-packaging/common.sh index 5af9e27..96bfa43 100755 --- a/tools/update-packaging/common.sh +++ b/tools/update-packaging/common.sh @@ -66,22 +66,10 @@ make_add_instruction() { forced= fi - is_extension=$(echo "$f" | grep -c 'distribution/extensions/.*/') - if [ $is_extension = "1" ]; then - # Use the subdirectory of the extensions folder as the file to test - # before performing this add instruction. - testdir=$(echo "$f" | sed 's/$.*distribution\/extensions\/[^\/]*$\/.*/\1/') - verbose_notice " add-if \"$testdir\" \"$f\"" - echo "add-if \"$testdir\" \"$f\"" >> "$filev2" - if [ ! "$filev3" = "" ]; then - echo "add-if \"$testdir\" \"$f\"" >> "$filev3" - fi - else - verbose_notice " add \"$f\"$forced" - echo "add \"$f\"" >> "$filev2" - if [ ! "$filev3" = "" ]; then - echo "add \"$f\"" >> "$filev3" - fi + verbose_notice " add \"$f\"$forced" + echo "add \"$f\"" >> "$filev2" + if [ ! "$filev3" = "" ]; then + echo "add \"$f\"" >> "$filev3" fi } @@ -132,19 +120,9 @@ make_patch_instruction() { filev2="$2" filev3="$3" - is_extension=$(echo "$f" | grep -c 'distribution/extensions/.*/') - if [ $is_extension = "1" ]; then - # Use the subdirectory of the extensions folder as the file to test - # before performing this add instruction. - testdir=$(echo "$f" | sed 's/$.*distribution\/extensions\/[^\/]*$\/.*/\1/') - verbose_notice " patch-if \"$testdir\" \"$f.patch\" \"$f\"" - echo "patch-if \"$testdir\" \"$f.patch\" \"$f\"" >> "$filev2" - echo "patch-if \"$testdir\" \"$f.patch\" \"$f\"" >> "$filev3" - else - verbose_notice " patch \"$f.patch\" \"$f\"" - echo "patch \"$f.patch\" \"$f\"" >> "$filev2" - echo "patch \"$f.patch\" \"$f\"" >> "$filev3" - fi + verbose_notice " patch \"$f.patch\" \"$f\"" + echo "patch \"$f.patch\" \"$f\"" >> "$filev2" + echo "patch \"$f.patch\" \"$f\"" >> "$filev3" } append_remove_instructions() {

1 0

[tor-browser-bundle/master] Remove references to unused packages in versions.beta
by gk＠torproject.org 29 Apr '16

29 Apr '16

commit 2949186d010368417599854304030951ad9d870c Author: Georg Koppen <gk(a)torproject.org> Date: Fri Apr 29 08:42:10 2016 +0000 Remove references to unused packages in versions.beta --- gitian/versions.beta | 5 ----- 1 file changed, 5 deletions(-) diff --git a/gitian/versions.beta b/gitian/versions.beta index 9df153b..87680b7 100755 --- a/gitian/versions.beta +++ b/gitian/versions.beta @@ -22,7 +22,6 @@ LIBEVENT_TAG=release-2.0.21-stable MINGW_REV=6184 PYPTLIB_TAG=pyptlib-0.0.6 OBFSPROXY_TAG=obfsproxy-0.2.12 -FLASHPROXY_TAG=1.6 LIBFTE_TAG=58734a5aec563600fa8d82fb48ea9d6b8e26556c # tag 0.1.0 FTEPROXY_TAG=597f8378f6f4f3de570b8e1064c2e4cb8d67fbd0 # tag 0.2.19 LIBDMG_TAG=dfd5e5cc3dc1191e37d3c3a6118975afdd1d7014 @@ -45,7 +44,6 @@ ARGPARSE_VER=1.2.1 PYYAML_VER=3.11 ZOPEINTERFACE_VER=4.0.5 TWISTED_VER=13.2.0 -M2CRYPTO_VER=0.21.1 PY2EXE_VER=0.6.9 SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 @@ -67,7 +65,6 @@ ARGPARSE_PACKAGE=argparse-${ARGPARSE_VER}.tar.gz PYYAML_PACKAGE=PyYAML-${PYYAML_VER}.tar.gz ZOPEINTERFACE_PACKAGE=zope.interface-${ZOPEINTERFACE_VER}.zip TWISTED_PACKAGE=Twisted-${TWISTED_VER}.tar.bz2 -M2CRYPTO_PACKAGE=M2Crypto-${M2CRYPTO_VER}.tar.gz PY2EXE_PACKAGE=py2exe-${PY2EXE_VER}.win32-py2.7.exe SETUPTOOLS_PACKAGE=setuptools-${SETUPTOOLS_VER}.tar.gz PARSLEY_PACKAGE=Parsley-${PARSLEY_VER}.tar.gz @@ -92,7 +89,6 @@ ARGPARSE_HASH=ddaf4b0a618335a32b6664d4ae038a1de8fbada3b25033f9021510ed2b3941a4 PYYAML_HASH=c36c938a872e5ff494938b33b14aaa156cb439ec67548fcab3535bb78b0846e8 ZOPEINTERFACE_HASH=1a7c84716bbd9981915b64a81d8a3f076a5934a8c8df4224655469b3564940cc TWISTED_HASH=095175638c019ac7c0604f4c291724a16ff1acd062e181b01293bf4dcbc62cf3 -M2CRYPTO_HASH=25b94498505c2d800ee465db0cc1aff097b1615adc3ac042a1c85ceca264fc0a PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 @@ -119,7 +115,6 @@ PYYAML_URL=https://pypi.python.org/packages/source/P/PyYAML/${PYYAML_PACKAG… ZOPEINTERFACE_URL=https://pypi.python.org/packages/source/z/zope.interface/… TWISTED_URL=https://pypi.python.org/packages/source/T/Twisted/${TWISTED_PAC… # TWISTED_URL=https://twistedmatrix.com/Releases/Twisted/$(echo ${TWISTED_VER} | awk -F. '{print $1"."$2}')/${TWISTED_PACKAGE} -M2CRYPTO_URL=https://pypi.python.org/packages/source/M/M2Crypto/${M2CRYPTO_PACKAGE} PY2EXE_URL=http://softlayer-dal.dl.sourceforge.net/project/py2exe/py2exe/${… SETUPTOOLS_URL=https://pypi.python.org/packages/source/s/setuptools/${SETUP… PARSLEY_URL=https://pypi.python.org/packages/source/P/Parsley/${PARSLEY_PAC…

1 0

[tor-browser-bundle/master] Bug 18919: Remove unused gpg keys.
by gk＠torproject.org 29 Apr '16

29 Apr '16

commit 124cfb4ed86f38ddbcab81722f76a4bb4eed3424 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Apr 23 09:06:59 2016 -0700 Bug 18919: Remove unused gpg keys. Unused since ac9da1d5965169f91973d57737fcd20e06351b08: LXML PYTHON Unused since 969136e13861c1cc6d983a66a82736a1fae971c3: M2CRYPTO flashproxy --- gitian/gpg/LXML.gpg | Bin 1450 -> 0 bytes gitian/gpg/M2CRYPTO.gpg | Bin 2441 -> 0 bytes gitian/gpg/PYTHON.gpg | Bin 4446 -> 0 bytes gitian/gpg/flashproxy.gpg | Bin 5876 -> 0 bytes 4 files changed, 0 insertions(+), 0 deletions(-) diff --git a/gitian/gpg/LXML.gpg b/gitian/gpg/LXML.gpg deleted file mode 100644 index fd5f415..0000000 Binary files a/gitian/gpg/LXML.gpg and /dev/null differ diff --git a/gitian/gpg/M2CRYPTO.gpg b/gitian/gpg/M2CRYPTO.gpg deleted file mode 100644 index d6d889a..0000000 Binary files a/gitian/gpg/M2CRYPTO.gpg and /dev/null differ diff --git a/gitian/gpg/PYTHON.gpg b/gitian/gpg/PYTHON.gpg deleted file mode 100644 index 0b32223..0000000 Binary files a/gitian/gpg/PYTHON.gpg and /dev/null differ diff --git a/gitian/gpg/flashproxy.gpg b/gitian/gpg/flashproxy.gpg deleted file mode 100644 index f3b543f..0000000 Binary files a/gitian/gpg/flashproxy.gpg and /dev/null differ

1 0

[tor-browser-bundle/master] Bug 18919: Remove swig dependencies and wine-wrapper.
by gk＠torproject.org 29 Apr '16

29 Apr '16

commit 4f80e41c593e5680bfe31fcb421d04fc7d875c89 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Apr 23 09:30:15 2016 -0700 Bug 18919: Remove swig dependencies and wine-wrapper. swig was only needed as a dependency of M2crypto, which was removed in 969136e13861c1cc6d983a66a82736a1fae971c3. --- gitian/build-helpers/wine-wrappers/setup.py | 2 +- gitian/build-helpers/wine-wrappers/swig.py | 33 ---------------------- .../linux/gitian-pluggable-transports.yml | 2 -- .../mac/gitian-pluggable-transports.yml | 2 -- .../windows/gitian-pluggable-transports.yml | 2 +- 5 files changed, 2 insertions(+), 39 deletions(-) diff --git a/gitian/build-helpers/wine-wrappers/setup.py b/gitian/build-helpers/wine-wrappers/setup.py index 77a9526..f80f2c0 100644 --- a/gitian/build-helpers/wine-wrappers/setup.py +++ b/gitian/build-helpers/wine-wrappers/setup.py @@ -1,7 +1,7 @@ from distutils.core import setup import py2exe setup( - console=["gcc.py", "g++.py", "dllwrap.py", "swig.py"], + console=["gcc.py", "g++.py", "dllwrap.py"], zipfile=None, options={"py2exe": {"bundle_files": 1, "compressed": True}} ) diff --git a/gitian/build-helpers/wine-wrappers/swig.py b/gitian/build-helpers/wine-wrappers/swig.py deleted file mode 100755 index 45941f4..0000000 --- a/gitian/build-helpers/wine-wrappers/swig.py +++ /dev/null @@ -1,33 +0,0 @@ -#!/usr/bin/env python - -# A wrapper for swig that converts Windows paths to Unix paths, so that swig can -# be called by Python distutils. - -import os -import subprocess -import sys - -import common - -args = ["/usr/bin/swig"] -sys.argv.pop(0) -while sys.argv: - a = sys.argv.pop(0) - if not a.startswith("-"): - args.append(common.winepath(a)) - continue - if a in ("-I",): - args.append(a) - args.append(common.winepath(sys.argv.pop(0))) - continue - o = common.search_startswith(a, ("-I",)) - if o is not None: - path = a[len(o):] - args.append("%s%s" % (o, common.winepath(path))) - continue - args.append(a) -p = common.popen_faketime(args, stderr=subprocess.PIPE) -stderr = p.stderr.read() -sys.stderr.write(stderr) -if " Error: " in stderr: - sys.exit(1) diff --git a/gitian/descriptors/linux/gitian-pluggable-transports.yml b/gitian/descriptors/linux/gitian-pluggable-transports.yml index cecc390..38ae561 100644 --- a/gitian/descriptors/linux/gitian-pluggable-transports.yml +++ b/gitian/descriptors/linux/gitian-pluggable-transports.yml @@ -11,8 +11,6 @@ packages: - "unzip" - "python-setuptools" - "python-dev" -# Needed by M2Crypto -- "swig" - "zip" - "hardening-wrapper" reference_datetime: "2000-01-01 00:00:00" diff --git a/gitian/descriptors/mac/gitian-pluggable-transports.yml b/gitian/descriptors/mac/gitian-pluggable-transports.yml index 6b1a99e..fbf38c2 100644 --- a/gitian/descriptors/mac/gitian-pluggable-transports.yml +++ b/gitian/descriptors/mac/gitian-pluggable-transports.yml @@ -10,8 +10,6 @@ packages: - "unzip" - "python-setuptools" - "python-dev" -# Needed by M2Crypto -- "swig" - "zip" reference_datetime: "2000-01-01 00:00:00" remotes: diff --git a/gitian/descriptors/windows/gitian-pluggable-transports.yml b/gitian/descriptors/windows/gitian-pluggable-transports.yml index 9c1642d..f073fd1 100644 --- a/gitian/descriptors/windows/gitian-pluggable-transports.yml +++ b/gitian/descriptors/windows/gitian-pluggable-transports.yml @@ -136,7 +136,7 @@ script: | mkdir -p build/bdist.win32/winexe/bundle-2.7/ cp -a $INSTDIR/python/python27.dll build/bdist.win32/winexe/bundle-2.7/ LD_PRELOAD= $INSTPYTHON setup.py py2exe - cp -a dist/gcc.exe dist/g++.exe dist/dllwrap.exe dist/swig.exe $WINEROOT/windows/ + cp -a dist/gcc.exe dist/g++.exe dist/dllwrap.exe $WINEROOT/windows/ cd .. # Building go

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 29 Apr '16

29 Apr '16

commit d592a0e41881c06e6d93c4f272ea7e4f3ea6e9bb Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Tue Apr 26 16:46:38 2016 -0700 fixup! TB4: Tor Browser's Firefox preference overrides. Disable Pocket feature (bug 18886) --- browser/app/profile/000-tor-browser.js | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index b2beff5..bd24118 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -97,6 +97,10 @@ pref("browser.search.geoip.url", ""); pref("browser.fixup.alternate.enabled", false); // Bug #16783: Prevent .onion fixups // Make sure there is no Tracking Protection active in Tor Browser, see: #17898. pref("privacy.trackingprotection.pbmode.enabled", false); +// Disable the Pocket extension (Bug #18886) +pref("browser.pocket.enabled", false); +pref("browser.pocket.api", ""); +pref("browser.pocket.site", ""); // Fingerprinting pref("webgl.min_capability_mode", true);

1 0

[tor-browser-bundle/hardened-builds] Preparations for -build4
by gk＠torproject.org 27 Apr '16

27 Apr '16

commit 52d518cc8c89b2934190838fbe3075e686e05b97 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Apr 26 21:28:04 2016 +0000 Preparations for -build4 --- Bundle-Data/Docs/ChangeLog.txt | 6 +++++- gitian/versions.alpha | 2 +- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 49a49e5..35d0e9d 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,4 +1,4 @@ -Tor Browser 6.0a5-hardened -- April 27 2016 +Tor Browser 6.0a5-hardened -- April 28 2016 * All Platforms * Update Firefox to 45.1.0esr * Update Tor to 0.2.8.2-alpha @@ -14,6 +14,7 @@ Tor Browser 6.0a5-hardened -- April 27 2016 * Update meek to 0.22 (tag 0.22-18371-2) * Bug 18371: Symlinks are incompatible with Gatekeeper signing * Bug 15197 and child tickets: Rebase Tor Browser patches to ESR 45 + * Bug 18900: Fix broken updater on Linux * Bug 18042: Disable SHA1 certificate support * Bug 18821: Disable libmdns support for desktop and mobile * Bug 18848: Disable additional welcome URL shown on first start @@ -33,6 +34,9 @@ Tor Browser 6.0a5-hardened -- April 27 2016 * Bug 18741: Fix OCSP and favicon isolation for ESR 45 * Bug 16998: Disable <link rel="preconnect"> for now * Bug 17506: Reenable building hardened Tor Browser with startup cache + * Bug 18898: Exempt the meek extension from the signing requirement as well + * Bug 18899: Don't copy Torbutton, TorLauncher, etc. into meek profile + * Bug 18890: Test importScripts() for cache and network isolation * Bug 18726: Add new default obfs4 bridge (GreenBelt) * Build System * Bug 16224: Don't use BUILD_HOSTNAME anymore in Firefox builds diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 2a8e10f..b9239dc 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -18,7 +18,7 @@ FIREFOX_VERSION=45.1.0esr TORBROWSER_UPDATE_CHANNEL=hardened -TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-6.0-1-build2 +TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-6.0-1-build3 TOR_TAG=tor-0.2.8.2-alpha TORLAUNCHER_TAG=0.2.8.4 TORBUTTON_TAG=1.9.5.3

1 0

[tor-browser-bundle/master] Using tor-browser-45.1.0esr-6.0-1-build3
by gk＠torproject.org 27 Apr '16

27 Apr '16

commit 127c4835c3ff00db224b4e38e51d0bf3ef322a9b Author: Georg Koppen <gk(a)torproject.org> Date: Tue Apr 26 21:15:07 2016 +0000 Using tor-browser-45.1.0esr-6.0-1-build3 --- gitian/versions.alpha | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 8752e76..f2023f0 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -14,7 +14,7 @@ FIREFOX_VERSION=45.1.0esr TORBROWSER_UPDATE_CHANNEL=alpha -TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-6.0-1-build2 +TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-6.0-1-build3 TOR_TAG=tor-0.2.8.2-alpha TORLAUNCHER_TAG=0.2.9.1 TORBUTTON_TAG=1.9.5.3

1 0

[tor-browser-bundle/master] Update changelog for -build4
by gk＠torproject.org 27 Apr '16

27 Apr '16

commit 91ee3ab05a1a2775acd680bb3dd75b8eb2797890 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Apr 26 20:41:06 2016 +0000 Update changelog for -build4 --- Bundle-Data/Docs/ChangeLog.txt | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 4d27e9e..5ea56f1 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,4 +1,4 @@ -Tor Browser 6.0a5 -- April 27 2016 +Tor Browser 6.0a5 -- April 28 2016 * All Platforms * Update Firefox to 45.1.0esr * Update Tor to 0.2.8.2-alpha @@ -14,6 +14,7 @@ Tor Browser 6.0a5 -- April 27 2016 * Update meek to 0.22 (tag 0.22-18371-2) * Bug 18371: Symlinks are incompatible with Gatekeeper signing * Bug 15197 and child tickets: Rebase Tor Browser patches to ESR 45 + * Bug 18900: Fix broken updater on Linux * Bug 18042: Disable SHA1 certificate support * Bug 18821: Disable libmdns support for desktop and mobile * Bug 18848: Disable additional welcome URL shown on first start @@ -32,6 +33,9 @@ Tor Browser 6.0a5 -- April 27 2016 * Bug 16326: Verify cache isolation for Request and Fetch APIs * Bug 18741: Fix OCSP and favicon isolation for ESR 45 * Bug 16998: Disable <link rel="preconnect"> for now + * Bug 18898: Exempt the meek extension from the signing requirement as well + * Bug 18899: Don't copy Torbutton, TorLauncher, etc. into meek profile + * Bug 18890: Test importScripts() for cache and network isolation * Bug 18726: Add new default obfs4 bridge (GreenBelt) * Windows * Bug 13419: Support ICU in Windows builds

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] fixup! Bug 14970: Don't block our unsigned extensions
by gk＠torproject.org 27 Apr '16

27 Apr '16

commit f46c63ff6856251faf39e20a040ee104fa113176 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Apr 26 19:55:31 2016 +0000 fixup! Bug 14970: Don't block our unsigned extensions --- toolkit/mozapps/extensions/internal/XPIProvider.jsm | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/toolkit/mozapps/extensions/internal/XPIProvider.jsm b/toolkit/mozapps/extensions/internal/XPIProvider.jsm index 3056201..94c33ea 100644 --- a/toolkit/mozapps/extensions/internal/XPIProvider.jsm +++ b/toolkit/mozapps/extensions/internal/XPIProvider.jsm @@ -683,12 +683,13 @@ function isUsableAddon(aAddon) { return false; } // Temporary and system add-ons do not require signing. Neither do Torbutton - // nor TorLauncher nor EFF's HTTPS-Everywhere. + // nor TorLauncher nor EFF's HTTPS-Everywhere nor meek. if ((aAddon._installLocation.name != KEY_APP_SYSTEM_DEFAULTS && aAddon._installLocation.name != KEY_APP_TEMPORARY) && aAddon.id != "torbutton(a)torproject.org" && aAddon.id != "tor-launcher(a)torproject.org" && aAddon.id != "https-everywhere-eff(a)eff.org" && + aAddon.id != "meek-http-helper(a)bamsoftware.com" && mustSign(aAddon.type)) { if (aAddon.signedState <= AddonManager.SIGNEDSTATE_MISSING) return false; @@ -3289,12 +3290,13 @@ this.XPIProvider = { continue; } - // Make sure Torbutton, TorLauncher and EFF's HTTPS-Everywhere are still - // working after an update. + // Make sure Torbutton, TorLauncher, EFF's HTTPS-Everywhere and meek + // are still working after an update. if (mustSign(addon.type) && addon.id != "torbutton(a)torproject.org" && addon.id != "tor-launcher(a)torproject.org" && addon.id != "https-everywhere-eff(a)eff.org" && + addon.id != "meek-http-helper(a)bamsoftware.com" && addon.signedState <= AddonManager.SIGNEDSTATE_MISSING) { logger.warn("Refusing to install staged add-on " + id + " with signed state " + addon.signedState); seenFiles.push(stageDirEntry.leafName);

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] Bug 18900: updater doesn't work on Linux (cannot find libraries)
by gk＠torproject.org 27 Apr '16

27 Apr '16

commit 82cfa7c8786c1ad1421666365bd71f3594861328 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue Apr 26 14:25:35 2016 -0400 Bug 18900: updater doesn't work on Linux (cannot find libraries) Revert "Bug 1159090 - Only append library path for updater if it is a unique value. r=rstrong" This reverts commit 5c4fcaf37f8e479b5d3c46a21b8a48ad1fe567d8. --- toolkit/xre/nsUpdateDriver.cpp | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/toolkit/xre/nsUpdateDriver.cpp b/toolkit/xre/nsUpdateDriver.cpp index 0c7b6b0..d256f2a 100644 --- a/toolkit/xre/nsUpdateDriver.cpp +++ b/toolkit/xre/nsUpdateDriver.cpp @@ -488,20 +488,20 @@ CopyUpdaterIntoUpdateDir(nsIFile *greDir, nsIFile *appDir, nsIFile *updateDir, static void AppendToLibPath(const char *pathToAppend) { + char *s = nullptr; char *pathValue = getenv(LD_LIBRARY_PATH_ENVVAR_NAME); if (nullptr == pathValue || '\0' == *pathValue) { - char *s = PR_smprintf("%s=%s", LD_LIBRARY_PATH_ENVVAR_NAME, pathToAppend); - PR_SetEnv(s); - } else if (!strstr(pathValue, pathToAppend)) { - char *s = PR_smprintf("%s=%s" PATH_SEPARATOR "%s", + s = PR_smprintf("%s=%s", LD_LIBRARY_PATH_ENVVAR_NAME, pathToAppend); + } else { + s = PR_smprintf("%s=%s" PATH_SEPARATOR "%s", LD_LIBRARY_PATH_ENVVAR_NAME, pathToAppend, pathValue); - PR_SetEnv(s); } // The memory used by PR_SetEnv is not copied to the environment on all // platform, it can be used by reference directly. So we purposely do not // call PR_smprintf_free on s. Subsequent calls to PR_SetEnv will free // the old memory first. + PR_SetEnv(s); } #endif

1 0

[tor-browser-bundle/hardened-builds] Bug 18899: meek profile gets all extensions
by gk＠torproject.org 27 Apr '16

27 Apr '16

commit 210aa37e48b1bc27f6925f8a4be5d7f47551803e Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue Apr 26 15:11:06 2016 -0400 Bug 18899: meek profile gets all extensions Set extensions.installDistroAddons = false in the meek-http-helper browser profile so that Tor Launcher, Torbutton, etc. are not copied into that profile. --- Bundle-Data/PTConfigs/meek-http-helper-user.js | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/Bundle-Data/PTConfigs/meek-http-helper-user.js b/Bundle-Data/PTConfigs/meek-http-helper-user.js index de2355c..820335d 100644 --- a/Bundle-Data/PTConfigs/meek-http-helper-user.js +++ b/Bundle-Data/PTConfigs/meek-http-helper-user.js @@ -40,3 +40,7 @@ user_pref("network.proxy.socks_port", 9); user_pref("network.proxy.socks_remote_dns", true); user_pref("extensions.enabledAddons", "meek-http-helper@bamsoftware.com:1.0"); + +// Ensure that distribution extensions (e.g., Tor Launcher) are not copied +// into the meek-http-helper profile. +user_pref("extensions.installDistroAddons", false);

1 0

[tor-browser-bundle/master] Bug 18899: meek profile gets all extensions
by gk＠torproject.org 27 Apr '16

27 Apr '16

commit 3b226118fadf42623032b423e41d6803e05901c1 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue Apr 26 15:11:06 2016 -0400 Bug 18899: meek profile gets all extensions Set extensions.installDistroAddons = false in the meek-http-helper browser profile so that Tor Launcher, Torbutton, etc. are not copied into that profile. --- Bundle-Data/PTConfigs/meek-http-helper-user.js | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/Bundle-Data/PTConfigs/meek-http-helper-user.js b/Bundle-Data/PTConfigs/meek-http-helper-user.js index de2355c..820335d 100644 --- a/Bundle-Data/PTConfigs/meek-http-helper-user.js +++ b/Bundle-Data/PTConfigs/meek-http-helper-user.js @@ -40,3 +40,7 @@ user_pref("network.proxy.socks_port", 9); user_pref("network.proxy.socks_remote_dns", true); user_pref("extensions.enabledAddons", "meek-http-helper@bamsoftware.com:1.0"); + +// Ensure that distribution extensions (e.g., Tor Launcher) are not copied +// into the meek-http-helper profile. +user_pref("extensions.installDistroAddons", false);

1 0