- tbb-commits - lists.torproject.org

[Git][tpo/applications/tor-browser-build] Pushed new tag mb-16.0a8-build1
by Pier Angelo Vendrame (＠pierov) 01 Jul '26

01 Jul '26

Pier Angelo Vendrame pushed new tag mb-16.0a8-build1 at The Tor Project / Applications / tor-browser-build -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/tree/mb-… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser-build] Pushed new tag tbb-16.0a8-build1
by Pier Angelo Vendrame (＠pierov) 01 Jul '26

01 Jul '26

Pier Angelo Vendrame pushed new tag tbb-16.0a8-build1 at The Tor Project / Applications / tor-browser-build -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/tree/tbb… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41811&41812: Prepare Tor&Mullvad Browser 16.0a8 (bumps).
by Pier Angelo Vendrame (＠pierov) 01 Jul '26

01 Jul '26

Pier Angelo Vendrame pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 0ae43031 by Pier Angelo Vendrame at 2026-07-01T10:43:32+02:00 Bug 41811&41812: Prepare Tor&Mullvad Browser 16.0a8 (bumps). Bumped some tags and updated the changelogs. - - - - - 7 changed files: - projects/browser/Bundle-Data/Docs-MB/ChangeLog.txt - projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt - projects/browser/config - projects/firefox/config - projects/tor/config - projects/translation/config - rbm.conf Changes: ===================================== projects/browser/Bundle-Data/Docs-MB/ChangeLog.txt ===================================== @@ -1,7 +1,7 @@ -Mullvad Browser 16.0a8 - June 25 2026 +Mullvad Browser 16.0a8 - July 01 2026 * All Platforms * Updated Firefox to 152.0a1 - * Updated NoScript to 13.6.24.90101984 + * Updated NoScript to 13.6.25.90301984 * Bug 44528: Make sure desktop IP Protection is disabled on desktop [tor-browser] * Bug 44795: Revert BB 27604 patch as not needed anymore [tor-browser] * Bug 44857: Drop `browser.display.use_system_colors` from our preference list [tor-browser] @@ -16,7 +16,7 @@ Mullvad Browser 16.0a8 - June 25 2026 * Bug 45043: Re-add missing changes to settings after 151/152 rebase [tor-browser] * Bug 45047: Cross-site oracle via worklet rejection error in Safer Mode [tor-browser] * Bug 45072: Disable XSLT already for 16.0 [tor-browser] - * Bug 41821: Update gpg subkeys for boklm [tor-browser-build] + * Bug 45083: Error in about:preferences due to ipprotection missing [tor-browser] * Windows * Bug 552: ABI::Windows::Graphics::Capture::IID_IGraphicsCaptureSession2 is used again in wgc_capture_session.cc [mullvad-browser] * macOS @@ -28,6 +28,8 @@ Mullvad Browser 16.0a8 - June 25 2026 * Bug 41802: Remove the tor daemon requirement for signing [tor-browser-build] * Bug 41809: Update toolchains for Firefox 152 [tor-browser-build] * Bug 41813: Disable build artifacts in `make generate_gradle_dependencies_list-geckoview` [tor-browser-build] + * Bug 41821: Update gpg subkeys for boklm [tor-browser-build] + * Bug 41823: Add versions information to the toolchain list update [tor-browser-build] * Bug 41827: Update morgan's keychain with renewed key [tor-browser-build] Mullvad Browser 16.0a7 - June 03 2026 ===================================== projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt ===================================== @@ -1,7 +1,7 @@ -Tor Browser 16.0a8 - June 25 2026 +Tor Browser 16.0a8 - July 01 2026 * All Platforms - * Updated Tor to 0.4.9.10 - * Updated NoScript to 13.6.24.90101984 + * Updated NoScript to 13.6.25.90301984 + * Updated Tor to 0.4.9.11 * Updated OpenSSL to 3.5.7 * Bug 44857: Drop `browser.display.use_system_colors` from our preference list [tor-browser] * Bug 44896: Review Mozilla 2030929: Remove unused pref privacy.partition.network_state [tor-browser] @@ -9,7 +9,6 @@ Tor Browser 16.0a8 - June 25 2026 * Bug 45019: ReportBrokenSite startup error in 152 [tor-browser] * Bug 45047: Cross-site oracle via worklet rejection error in Safer Mode [tor-browser] * Bug 45072: Disable XSLT already for 16.0 [tor-browser] - * Bug 41821: Update gpg subkeys for boklm [tor-browser-build] * Windows + macOS + Linux * Updated Firefox to 152.0a1 * Bug 44528: Make sure desktop IP Protection is disabled on desktop [tor-browser] @@ -22,6 +21,7 @@ Tor Browser 16.0a8 - June 25 2026 * Bug 45017: Wrong letterboxing background in 152 [tor-browser] * Bug 45037: Potential runtime errors in the search service when changing JS status [tor-browser] * Bug 45043: Re-add missing changes to settings after 151/152 rebase [tor-browser] + * Bug 45083: Error in about:preferences due to ipprotection missing [tor-browser] * macOS * Bug 44728: Bundled fonts are broken on macOS when the GPU process is enabled [tor-browser] * Linux @@ -32,16 +32,22 @@ Tor Browser 16.0a8 - June 25 2026 * Bug 44091: Add frequent regions to tor connection assist for android [tor-browser] * Bug 44175: Remove all default browser functionality (Android) [tor-browser] * Bug 44769: TBA crash screen has firefox asset as well as a "Send crash report" button [tor-browser] + * Bug 45052: Initialise Tor modules on android in the same order as desktop [tor-browser] * Build System * All Platforms * Bug 41802: Remove the tor daemon requirement for signing [tor-browser-build] * Bug 41809: Update toolchains for Firefox 152 [tor-browser-build] * Bug 41813: Disable build artifacts in `make generate_gradle_dependencies_list-geckoview` [tor-browser-build] + * Bug 41821: Update gpg subkeys for boklm [tor-browser-build] + * Bug 41823: Add versions information to the toolchain list update [tor-browser-build] * Bug 41827: Update morgan's keychain with renewed key [tor-browser-build] * Windows + Linux + Android * Updated Go to 1.26.4 * Windows * Bug 41810: Define GetAddrInfoExCancel on mingw [tor-browser-build] + * Android + * Bug 45086: Compress omni.ja with xz on Android [tor-browser] + * Bug 41830: Update the browser project to change omni.ja.xz [tor-browser-build] Tor Browser 16.0a7 - June 03 2026 * All Platforms ===================================== projects/browser/config ===================================== @@ -87,9 +87,9 @@ input_files: enable: '[% !c("var/android") %]' - filename: dmg-root enable: '[% c("var/macos") %]' - - URL: https://dist.torproject.org/torbrowser/noscript/noscript-13.6.24.90101984.x… + - URL: https://dist.torproject.org/torbrowser/noscript/noscript-13.6.25.90301984.x… name: noscript - sha256sum: 58df96b190024a33785e5af2281994be65c380674049adeaa2318c11add099ee + sha256sum: 1449e39c15bf00493c274697486fc5f520124d52901fcae696c05083b2c7e921 - URL: https://addons.mozilla.org/firefox/downloads/file/4814095/ublock_origin-1.7… name: ublock-origin sha256sum: 47f788a1fc2c014830b30bb0ef9588615701b98c5265fb19b8cf4ba779849feb ===================================== projects/firefox/config ===================================== @@ -114,7 +114,6 @@ targets: updater_url: 'https://cdn.mullvad.net/browser/update_responses/update_1/' mar_id_prefix: 'mullvadbrowser-mullvad' nightly_updates_publish_dir_prefix: mullvadbrowser- - browser_build: 2 linux-x86_64: var: arch_deps: ===================================== projects/tor/config ===================================== @@ -1,6 +1,6 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.[% c("compress_tar") %]' -version: 0.4.9.10 +version: 0.4.9.11 git_hash: 'tor-[% c("version") %]' git_url: https://gitlab.torproject.org/tpo/core/tor.git git_submodule: 1 ===================================== projects/translation/config ===================================== @@ -12,13 +12,13 @@ compress_tar: 'gz' steps: base-browser: base-browser: '[% INCLUDE build %]' - git_hash: 4432a9ab5c10ba53dc1d3ec9329a73a44446ac4c + git_hash: f214fa73196b8b4ecfd2141ff373ddcbb5edf6b8 targets: nightly: git_hash: 'base-browser' tor-browser: tor-browser: '[% INCLUDE build %]' - git_hash: 565e67ca7ebbf7d1b478bff1a9c6c779023f5211 + git_hash: f1579ea805d3d1af56d394893d26561a2945824c targets: nightly: git_hash: 'tor-browser' @@ -32,7 +32,7 @@ steps: fenix: '[% INCLUDE build %]' # We need to bump the commit before releasing but just pointing to a branch # might cause too much rebuidling of the Firefox part. - git_hash: 41c4edad95ca1dca84f3c8d127956545518e00da + git_hash: 925fa40ece33f0c66b11c41b856fc71a1f8bf25c compress_tar: 'zst' targets: nightly: ===================================== rbm.conf ===================================== @@ -85,7 +85,7 @@ var: torbrowser_build: 'build1' # This should be the date of when the build is started. For the build # to be reproducible, browser_release_date should always be in the past. - browser_release_date: '2026/06/25 10:00:00' + browser_release_date: '2026/07/01 08:30:00' browser_release_date_timestamp: '[% USE date; date.format(c("var/browser_release_date"), "%s") %]' browser_default_channel: alpha browser_platforms: View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/0… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/0… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/mullvad-browser] Pushed new tag mullvad-browser-152.0a1-16.0-2-build3
by Pier Angelo Vendrame (＠pierov) 01 Jul '26

01 Jul '26

Pier Angelo Vendrame pushed new tag mullvad-browser-152.0a1-16.0-2-build3 at The Tor Project / Applications / Mullvad Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/tree/mullv… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser] Pushed new tag tor-browser-152.0a1-16.0-2-build3
by Pier Angelo Vendrame (＠pierov) 01 Jul '26

01 Jul '26

Pier Angelo Vendrame pushed new tag tor-browser-152.0a1-16.0-2-build3 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/tor-brows… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41830: Use omni.ja.xz on Android.
by Pier Angelo Vendrame (＠pierov) 01 Jul '26

01 Jul '26

Pier Angelo Vendrame pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 67b08c8d by Pier Angelo Vendrame at 2026-06-30T15:50:00+02:00 Bug 41830: Use omni.ja.xz on Android. As a workaround to keep our APK size within the Play Store threshold we decided to compress omni.ja with xz (tor-browser#45086). This commit adapts tor-browser-build scripts to that change. - - - - - 2 changed files: - projects/browser/build.android - projects/geckoview/gradle-dependencies-list.txt Changes: ===================================== projects/browser/build.android ===================================== @@ -52,7 +52,8 @@ function generate_apk { $rootdir/sort-baseline.py --apk $apk $sorted_baseline_apk mv $sorted_baseline_apk $apk - unzip -j "$apk" assets/omni.ja + unzip -j "$apk" assets/omni.ja.xz + xz -d omni.ja.xz mkdir omni pushd omni unzip ../omni.ja @@ -72,9 +73,12 @@ function generate_apk { # Be sure to change any `rm` with the appropriate command, shall this change. [% c('zip', { zip_src => [ '.' ], - zip_args => '-0 ../assets/omni.ja', + zip_args => '-0 ../omni.ja', }) %] popd + sha256sum omni.ja | awk '{ print $1 }' > assets/omni.ja.sha256 + xz -9e omni.ja + mv omni.ja.xz assets/ mkdir apk pushd apk @@ -101,7 +105,6 @@ function generate_apk { # Clean up rm -rf omni - rm omni.ja rm -rf apk rm repacked.apk rm $aligned_apk ===================================== projects/geckoview/gradle-dependencies-list.txt ===================================== @@ -1365,6 +1365,8 @@ cc8caa4101a35d0cf0433a63e8ad38911a4c848073fcc94f43ae0251f33e4daf | https://plugi 10d6bd66abb088eca5be360ff72550c96154d2676efedd74af31c450017c3909 | https://plugins.gradle.org/m2/org/gradle/kotlin/gradle-kotlin-dsl-plugins/6… abe9f3960fa7359722a8752e61bfc496761e15d14735e4c6422079707606abbe | https://plugins.gradle.org/m2/org/gradle/kotlin/gradle-kotlin-dsl-plugins/6… 2dd836cc09712cdaddfeefc680d2ea66eb43d8dc63386bd595265813497f472d | https://plugins.gradle.org/m2/org/gradle/kotlin/kotlin-dsl/org.gradle.kotli… +937b44d869c059c39f07ae194d8cd6219f5aebf2200ef9707f0b50b7837da281 | https://plugins.gradle.org/m2/org/tukaani/xz/1.12/xz-1.12.pom +3e158a87bd73d8afb4b6e8239c013b7d049c48563f45860ce99cd2e448cf4a6b | https://plugins.gradle.org/m2/org/tukaani/xz/1.12/xz-1.12.jar 243a64470fda0e86a6fddeb0af4c7aa9426ce84e68cbfe18d75ee5da4b7e0b92 | https://repo.maven.apache.org/maven2/com/almworks/sqlite4java/sqlite4java/1… 139552c586a57bf6d98f87d6b7e23fef4db53cf74097be962f7868e3606c79d2 | https://repo.maven.apache.org/maven2/com/almworks/sqlite4java/sqlite4java/1… 348924b116b7b251113af50c1bf1b57c0df7c89b8f56406c1ff1be2d5b469fbd | https://repo.maven.apache.org/maven2/com/autonomousapps/antlr/4.13.2.0/antl… View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/6… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/6… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser][tor-browser-152.0a1-16.0-2] BB 45086: Make nsZipCursor::Copy return mBuf also when copying a stored file.
by Pier Angelo Vendrame (＠pierov) 01 Jul '26

01 Jul '26

Pier Angelo Vendrame pushed to branch tor-browser-152.0a1-16.0-2 at The Tor Project / Applications / Tor Browser Commits: 6da2dea2 by Pier Angelo Vendrame at 2026-07-01T08:45:26+02:00 BB 45086: Make nsZipCursor::Copy return mBuf also when copying a stored file. - - - - - 1 changed file: - modules/libjar/nsZipArchive.cpp Changes: ===================================== modules/libjar/nsZipArchive.cpp ===================================== @@ -1198,6 +1198,7 @@ uint8_t* nsZipCursor::ReadOrCopy(uint32_t* aBytesRead, bool aCopy) { } else { *aBytesRead = mZs.avail_in > mBufSize ? mBufSize : mZs.avail_in; memcpy(mBuf, mZs.next_in, *aBytesRead); + buf = mBuf; mZs.avail_in -= *aBytesRead; mZs.next_in += *aBytesRead; } View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/6da2dea… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/6da2dea… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser][tor-browser-152.0a1-16.0-2] 2 commits: BB 45086: Replace omni.ja URI parsing in GetApkURI with a direct JNI call
by Pier Angelo Vendrame (＠pierov) 01 Jul '26

01 Jul '26

Pier Angelo Vendrame pushed to branch tor-browser-152.0a1-16.0-2 at The Tor Project / Applications / Tor Browser Commits: 5c903fac by Pier Angelo Vendrame at 2026-07-01T08:31:43+02:00 BB 45086: Replace omni.ja URI parsing in GetApkURI with a direct JNI call - - - - - 63c810a9 by Beatriz Rizental at 2026-07-01T08:31:43+02:00 TB 45086: [android] Repack omni.ja file with LZMA - - - - - 16 changed files: - mobile/android/fenix/app/build.gradle - mobile/android/geckoview/build.gradle - + mobile/android/geckoview/omnijar_repack.sh - mobile/android/geckoview/src/main/java/org/mozilla/gecko/GeckoAppShell.java - mobile/android/geckoview/src/main/java/org/mozilla/gecko/GeckoThread.java - + mobile/android/geckoview/src/main/java/org/mozilla/gecko/util/XzExtractor.java - + mobile/android/geckoview/src/test/assets/empty-hash.sha256 - + mobile/android/geckoview/src/test/assets/empty-hash.xz - + mobile/android/geckoview/src/test/assets/no-hash.xz - + mobile/android/geckoview/src/test/assets/test.sha256 - + mobile/android/geckoview/src/test/assets/test.xz - + mobile/android/geckoview/src/test/java/org/mozilla/gecko/util/XzExtractorTest.java - mobile/android/gradle/with_gecko_binaries.gradle - netwerk/protocol/res/nsResProtocolHandler.cpp - python/mozbuild/mozbuild/action/fat_aar.py - python/mozbuild/mozpack/packager/unpack.py Changes: ===================================== mobile/android/fenix/app/build.gradle ===================================== @@ -197,7 +197,7 @@ android { // manifest.template.json is converted to manifest.json at build time. // No need to package the template in the APK. - ignoreAssetsPattern = "manifest.template.json" + ignoreAssetsPattern = "manifest.template.json:omni.ja" } testOptions { ===================================== mobile/android/geckoview/build.gradle ===================================== @@ -82,10 +82,20 @@ android { buildConfigField 'boolean', 'MOZ_ANDROID_CONTENT_SERVICE_ISOLATED_PROCESS', mozconfig.substs.MOZ_ANDROID_CONTENT_SERVICE_ISOLATED_PROCESS ? 'true' : 'false'; } + aaptOptions { + noCompress 'xz' + } + lintOptions { abortOnError = false } + testOptions { + unitTests { + includeAndroidResources = true + } + } + sourceSets { main { java { @@ -194,6 +204,7 @@ dependencies { implementation libs.androidx.lifecycle.common implementation libs.androidx.lifecycle.process implementation libs.play.services.fido + implementation "org.tukaani:xz:1.12" implementation "org.yaml:snakeyaml:2.2" if (mozconfig.substs.MOZ_ANDROID_HLS_SUPPORT) { ===================================== mobile/android/geckoview/omnijar_repack.sh ===================================== @@ -0,0 +1,12 @@ +#!/bin/sh +# Repack a .ja (ZIP) stored uncompressed, compress with XZ, write SHA-256 sidecar. +# Usage: omnijar_repack.sh <src> <dst-file> <dst-tag> +set -e +src="$1" dst_file="$2" dst_tag="$3" +tmp=$(mktemp -d) +trap 'rm -rf "$tmp"' EXIT +cp "$src" "$tmp/omni.ja" +# Repack all entries as ZIP_STORED (strip per-entry deflate) +( cd "$tmp" && unzip -q omni.ja -d unpacked && cd unpacked && zip -q -0 -r ../repacked.ja . ) +xz -9e -k -c "$tmp/repacked.ja" > "$dst_file" +sha256sum -b "$tmp/repacked.ja" | awk '{print $1}' > "$dst_tag" ===================================== mobile/android/geckoview/src/main/java/org/mozilla/gecko/GeckoAppShell.java ===================================== @@ -1761,6 +1761,11 @@ public class GeckoAppShell { return id == 0 ? info.nonLocalizedLabel.toString() : context.getString(id); } + @WrapForJNI + public static String getApkPath() { + return getApplicationContext().getPackageResourcePath(); + } + @WrapForJNI(calledFrom = "gecko") private static int getMemoryUsage(final String stateName) { final Debug.MemoryInfo memInfo = new Debug.MemoryInfo(); ===================================== mobile/android/geckoview/src/main/java/org/mozilla/gecko/GeckoThread.java ===================================== @@ -19,6 +19,8 @@ import android.util.Log; import androidx.annotation.NonNull; import androidx.annotation.Nullable; import androidx.annotation.UiThread; +import java.io.File; +import java.io.IOException; import java.util.ArrayList; import java.util.Arrays; import java.util.LinkedList; @@ -31,6 +33,7 @@ import org.mozilla.gecko.annotation.WrapForJNI; import org.mozilla.gecko.mozglue.GeckoLoader; import org.mozilla.gecko.process.MemoryController; import org.mozilla.gecko.util.GeckoBundle; +import org.mozilla.gecko.util.XzExtractor; import org.mozilla.gecko.util.ThreadUtils; import org.mozilla.geckoview.BuildConfig; import org.mozilla.geckoview.GeckoResult; @@ -329,6 +332,15 @@ public class GeckoThread extends Thread { loadGeckoLibs(context); } + private static File extractOmnijar(final Context context) throws IOException { + return new XzExtractor( + context, + "omni.ja", + context.getNoBackupFilesDir(), + "omni.ja") + .extract(); + } + private String[] getMainProcessArgs() { final Context context = GeckoAppShell.getApplicationContext(); final ArrayList<String> args = new ArrayList<>(); @@ -337,8 +349,13 @@ public class GeckoThread extends Thread { args.add(context.getPackageName()); if (!mInitInfo.xpcshell) { - args.add("-greomni"); - args.add(context.getPackageResourcePath()); + try { + args.add("-greomni"); + String greomni = extractOmnijar(context).getAbsolutePath(); + args.add(greomni); + } catch (final IOException e) { + throw new RuntimeException("Failed to extract omnijar", e); + } } if (mInitInfo.args != null) { ===================================== mobile/android/geckoview/src/main/java/org/mozilla/gecko/util/XzExtractor.java ===================================== @@ -0,0 +1,75 @@ +package org.mozilla.gecko.util; + +import android.content.Context; +import android.content.res.AssetManager; +import android.util.Log; +import java.io.BufferedReader; +import java.io.File; +import java.io.IOException; +import java.io.InputStream; +import java.io.InputStreamReader; +import java.nio.charset.StandardCharsets; +import java.nio.file.Files; +import java.nio.file.StandardCopyOption; +import org.tukaani.xz.XZInputStream; + +public class XzExtractor { + private static final String TAG = "XzExtractor"; + private final Context mContext; + private final String mSource; + private String mSourceHash; + private final File mTarget; + private final File mTargetHash; + + public XzExtractor(Context context, String source, File targetDir, String destination) { + mContext = context; + mSource = source; + mTarget = new File(targetDir, destination); + mTargetHash = new File(targetDir, destination + ".sha256"); + } + + public File extract() throws IOException { + Log.d(TAG, "Extracting " + mSource + " -> " + mTarget.getAbsolutePath()); + readSourceTag(); + if (checkExisting()) { + Log.d(TAG, mSource + ": up to date, skipping extraction"); + } else { + Log.d(TAG, mSource + ": extracting from assets"); + extractFromAssets(); + Log.d(TAG, mSource + ": extraction complete"); + } + return mTarget; + } + + private void readSourceTag() throws IOException { + // We use sha256 because we need a unique deterministic string + // to verify if current resources are up to date or need to be + // re-extracted. THIS IS NOT AN INTEGRITY CHECK. + final String asset = mSource + ".sha256"; + final Context context = mContext; + try (InputStream in = context.getAssets().open(asset, AssetManager.ACCESS_BUFFER); + BufferedReader reader = new BufferedReader(new InputStreamReader(in, StandardCharsets.UTF_8))) { + mSourceHash = reader.readLine(); + } + if (mSourceHash == null || mSourceHash.isEmpty()) { + throw new IOException(asset + " is empty"); + } + } + + private boolean checkExisting() throws IOException { + if (!mTarget.exists() || !mTargetHash.exists()) { + return false; + } + String destHash = new String(Files.readAllBytes(mTargetHash.toPath()), StandardCharsets.UTF_8).trim(); + return destHash.equals(mSourceHash); + } + + private void extractFromAssets() throws IOException { + final Context context = mContext; + try (InputStream assetIn = context.getAssets().open(mSource + ".xz"); + XZInputStream xzIn = new XZInputStream(assetIn)) { + Files.copy(xzIn, mTarget.toPath(), StandardCopyOption.REPLACE_EXISTING); + } + Files.write(mTargetHash.toPath(), mSourceHash.getBytes(StandardCharsets.UTF_8)); + } +} ===================================== mobile/android/geckoview/src/test/assets/empty-hash.sha256 ===================================== ===================================== mobile/android/geckoview/src/test/assets/empty-hash.xz ===================================== Binary files /dev/null and b/mobile/android/geckoview/src/test/assets/empty-hash.xz differ ===================================== mobile/android/geckoview/src/test/assets/no-hash.xz ===================================== Binary files /dev/null and b/mobile/android/geckoview/src/test/assets/no-hash.xz differ ===================================== mobile/android/geckoview/src/test/assets/test.sha256 ===================================== @@ -0,0 +1 @@ +d05557c2592a0b2f4d5553ff10a810168755dd98adfabae60fc055273819fd06 ===================================== mobile/android/geckoview/src/test/assets/test.xz ===================================== Binary files /dev/null and b/mobile/android/geckoview/src/test/assets/test.xz differ ===================================== mobile/android/geckoview/src/test/java/org/mozilla/gecko/util/XzExtractorTest.java ===================================== @@ -0,0 +1,112 @@ +package org.mozilla.gecko.util; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertThrows; +import static org.junit.Assert.assertTrue; + +import android.content.Context; +import android.test.suitebuilder.annotation.SmallTest; +import java.io.File; +import java.io.IOException; +import java.nio.charset.StandardCharsets; +import java.nio.file.Files; +import org.junit.After; +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.robolectric.RobolectricTestRunner; +import org.robolectric.RuntimeEnvironment; + +(a)RunWith(RobolectricTestRunner.class) +@SmallTest +public class XzExtractorTest { + private Context mContext; + private File mTargetDir; + + private String mTestFileContents = "#!/bin/sh\necho hello world"; + + @Before + public void setUp() throws IOException { + mContext = RuntimeEnvironment.getApplication(); + mTargetDir = Files.createTempDirectory("xz-extractor-test").toFile(); + } + + @After + public void tearDown() { + deleteRecursively(mTargetDir); + } + + @Test + public void freshExtraction() throws IOException, InterruptedException { + XzExtractor extractor = new XzExtractor(mContext, "test", mTargetDir, "test"); + File extracted = extractor.extract(); + + assertTrue(extracted.exists()); + assertTrue(new File(mTargetDir, "test.sha256").exists()); + } + + @Test + public void upToDateSkipsExtraction() throws IOException { + XzExtractor extractor = new XzExtractor(mContext, "test", mTargetDir, "test"); + File extracted = extractor.extract(); + assertEquals( + mTestFileContents, + new String(Files.readAllBytes(extracted.toPath()), StandardCharsets.UTF_8).trim()); + + Files.write(extracted.toPath(), "tampered".getBytes(StandardCharsets.UTF_8)); + extractor.extract(); + + assertEquals( + "tampered", + new String(Files.readAllBytes(extracted.toPath()), StandardCharsets.UTF_8)); + } + + @Test + public void staleHashTriggersReExtraction() throws IOException, InterruptedException { + XzExtractor extractor = new XzExtractor(mContext, "test", mTargetDir, "test"); + File extracted = extractor.extract(); + File hashFile = new File(mTargetDir, "test.sha256"); + + assertEquals( + mTestFileContents, + new String(Files.readAllBytes(extracted.toPath()), StandardCharsets.UTF_8).trim()); + + Files.write(hashFile.toPath(), "new-hash".getBytes(StandardCharsets.UTF_8)); + Files.write(extracted.toPath(), "tampered".getBytes(StandardCharsets.UTF_8)); + + extractor.extract(); + assertEquals( + mTestFileContents, + new String(Files.readAllBytes(extracted.toPath()), StandardCharsets.UTF_8).trim()); + } + + @Test + public void missingAssetThrows() { + XzExtractor extractor = new XzExtractor(mContext, "nonexistent", mTargetDir, "test"); + assertThrows(IOException.class, extractor::extract); + } + + @Test + public void missingHashFileThrows() { + XzExtractor extractor = new XzExtractor(mContext, "no-hash", mTargetDir, "test"); + assertThrows(IOException.class, extractor::extract); + } + + @Test + public void emptyHashFileThrows() { + XzExtractor extractor = new XzExtractor(mContext, "empty-hash", mTargetDir, "test"); + assertThrows(IOException.class, extractor::extract); + } + + private void deleteRecursively(final File file) { + if (file.isDirectory()) { + final File[] children = file.listFiles(); + if (children != null) { + for (final File child : children) { + deleteRecursively(child); + } + } + } + file.delete(); + } +} ===================================== mobile/android/gradle/with_gecko_binaries.gradle ===================================== @@ -23,10 +23,27 @@ ext.configureVariantWithGeckoBinaries = { variant -> // the moz.build system and should never be re-entrant in this way. def assetGenTask = tasks.findByName("generate${variant.name.capitalize()}Assets") def jniLibFoldersTask = tasks.findByName("merge${variant.name.capitalize()}JniLibFolders") + + def omnijarName = "omni.ja" + def assetsDir = "${topobjdir}/dist/geckoview/assets" + def compressOmnijarTask = tasks.register("compressOmnijar${variant.name.capitalize()}", Exec) { + inputs.file("${assetsDir}/${omnijarName}") + outputs.files( + "${assetsDir}/${omnijarName}.xz", + "${assetsDir}/${omnijarName}.sha256" + ) + commandLine "sh", + "${topsrcdir}/mobile/android/geckoview/omnijar_repack.sh", + "${assetsDir}/${omnijarName}", + "${assetsDir}/${omnijarName}.xz", + "${assetsDir}/${omnijarName}.sha256" + } + if (!mozconfig.substs.MOZILLA_OFFICIAL && !mozconfig.substs.ENABLE_MOZSEARCH_PLUGIN) { - assetGenTask.dependsOn rootProject.machStagePackage + compressOmnijarTask.configure { dependsOn rootProject.machStagePackage } jniLibFoldersTask.dependsOn rootProject.machStagePackage } + assetGenTask.dependsOn compressOmnijarTask } } ===================================== netwerk/protocol/res/nsResProtocolHandler.cpp ===================================== @@ -14,6 +14,10 @@ #include "mozilla/Omnijar.h" +#ifdef MOZ_WIDGET_ANDROID +# include "mozilla/java/GeckoAppShellWrappers.h" +#endif + using mozilla::LogLevel; using mozilla::dom::ContentParent; @@ -68,29 +72,12 @@ nsresult nsResProtocolHandler::Init() { #ifdef ANDROID nsresult nsResProtocolHandler::GetApkURI(nsACString& aResult) { - nsCString::const_iterator start, iter; - mGREURI.BeginReading(start); - mGREURI.EndReading(iter); - nsCString::const_iterator start_iter = start; - - // This is like jar:jar:file://path/to/apk/base.apk!/path/to/omni.ja!/ - bool found = FindInReadable("!/"_ns, start_iter, iter); - NS_ENSURE_TRUE(found, NS_ERROR_UNEXPECTED); - - // like jar:jar:file://path/to/apk/base.apk!/ - const nsDependentCSubstring& withoutPath = Substring(start, iter); - NS_ENSURE_TRUE(withoutPath.Length() >= 4, NS_ERROR_UNEXPECTED); - - // Let's make sure we're removing what we expect to remove - NS_ENSURE_TRUE(Substring(withoutPath, 0, 4).EqualsLiteral("jar:"), - NS_ERROR_UNEXPECTED); - - // like jar:file://path/to/apk/base.apk!/ - aResult = ToNewCString(Substring(withoutPath, 4)); - - // Remove the trailing / - NS_ENSURE_TRUE(aResult.Length() >= 1, NS_ERROR_UNEXPECTED); - aResult.Truncate(aResult.Length() - 1); + mozilla::jni::String::LocalRef path = + mozilla::java::GeckoAppShell::GetApkPath(); + if (!path) { + return NS_ERROR_UNEXPECTED; + } + aResult = "jar:file://"_ns + path->ToCString() + "!"_ns; return NS_OK; } #endif ===================================== python/mozbuild/mozbuild/action/fat_aar.py ===================================== @@ -90,7 +90,7 @@ def fat_aar(distdir, zip_paths, no_process=False, no_compatibility_check=False): jar_finder = JarFinder( aar_file.file.filename, JarReader(fileobj=aar_file.open()) ) - for path, fileobj in UnpackFinder(jar_finder): + for path, fileobj in UnpackFinder(jar_finder, omnijar_name="assets/omni.ja.xz"): # Native libraries go straight through. if mozpath.match(path, "jni/**"): copier.add(path, fileobj) @@ -130,6 +130,7 @@ def fat_aar(distdir, zip_paths, no_process=False, no_compatibility_check=False): "**/*.ftl", "**/*.dtd", "**/*.properties", + "assets/omni.ja.sha256", } not_allowed = OrderedDict() ===================================== python/mozbuild/mozpack/packager/unpack.py ===================================== @@ -3,6 +3,7 @@ # file, You can obtain one at http://mozilla.org/MPL/2.0/. import codecs +import lzma from urllib.parse import urlparse import mozpack.path as mozpath @@ -143,7 +144,11 @@ class UnpackFinder(BaseFinder): Return a JarReader for the given BaseFile instance, keeping a log of the preloaded entries it has. """ - jar = JarReader(fileobj=file.open()) + if path.endswith(".xz"): + f = lzma.open(file.open()) + else: + f = file.open() + jar = JarReader(fileobj=f) self.compressed = max(self.compressed, jar.compression) if jar.last_preloaded: jarlog = list(jar.entries.keys()) @@ -158,8 +163,17 @@ class UnpackFinder(BaseFinder): """ Return whether the given BaseFile looks like a ZIP/Jar. """ + + def check_header(header): + return len(header) == 8 and (header[0:2] == b"PK" or header[4:6] == b"PK") + header = file.open().read(8) - return len(header) == 8 and (header[0:2] == b"PK" or header[4:6] == b"PK") + if check_header(header): + return True + if header[0:6] == b"\xfd7zXZ\x00": + with lzma.open(file.open()) as f: + return check_header(f.read(8)) + return False def _unjarize(self, entry, relpath): """ View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/5b410a… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/5b410a… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41828: Prepare Tor VPN 1.8.0Beta
by Dan Ballard (＠dan) 29 Jun '26

29 Jun '26

Dan Ballard pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 5eb923ad by Nicolas Vigier at 2026-06-25T17:06:38+02:00 Bug 41828: Prepare Tor VPN 1.8.0Beta - - - - - 1 changed file: - rbm.conf Changes: ===================================== rbm.conf ===================================== @@ -341,9 +341,9 @@ targets: torvpn: var: tor-vpn: 1 - torbrowser_version: '1.7.0Beta' + torbrowser_version: '1.8.0Beta' torbrowser_build: 'build1' - browser_release_date: '2026/05/18 10:00:00' + browser_release_date: '2026/06/25 10:00:00' project-name: tor-vpn projectname: torvpn Project_Name: 'Tor VPN' View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/5… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/5… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser][tor-browser-153.0a1-16.0-1] fixup! Firefox preference overrides.
by Pier Angelo Vendrame (＠pierov) 29 Jun '26

29 Jun '26

Pier Angelo Vendrame pushed to branch tor-browser-153.0a1-16.0-1 at The Tor Project / Applications / Tor Browser Commits: 5d6c80ab by Pier Angelo Vendrame at 2026-06-29T15:03:39+02:00 fixup! Firefox preference overrides. BB 45072: Disable XSLT. XSLT eventually is going to be disabled in all major browsers. While Mozilla has not started the process yet, it makes sense for us to do it, since XSLT has been a source of security bugs and fingerprinting vectors in the past. - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -476,6 +476,9 @@ pref("dom.push.enabled", false); // See tor-browser#18801. pref("dom.push.serverURL", ""); +// tor-browser#45072: Disable XSLT even before Mozilla does it for Firefox. +pref("dom.xslt.enabled", false); + // Fingerprinting // tor-browser#41797: For release builds, lock RFP // tor-browser#42125: Set (and lock in release) also exempted domains. View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/5d6c80a… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/5d6c80a… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0