- tbb-commits - lists.torproject.org

[tor-browser-build/maint-10.0-desktop] Tor Browser 10.0.7 release preparations
by gk＠torproject.org 09 Dec '20

09 Dec '20

commit 206e4c50c73d7fce303d55ebd2723c6dd9337301 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Tue Dec 8 23:33:08 2020 +0000 Tor Browser 10.0.7 release preparations Version bumps and Changelog update --- projects/firefox/config | 2 +- projects/https-everywhere/config | 2 +- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 13 +++++++++++++ rbm.conf | 5 +++-- 4 files changed, 18 insertions(+), 4 deletions(-) diff --git a/projects/firefox/config b/projects/firefox/config index 4479b40..750ae24 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -8,7 +8,7 @@ git_submodule: 1 gpg_keyring: torbutton.gpg var: - firefox_platform_version: 78.5.0 + firefox_platform_version: 78.6.0 firefox_version: '[% c("var/firefox_platform_version") %]esr' torbrowser_branch: 10.0 branding_directory: 'browser/branding/alpha' diff --git a/projects/https-everywhere/config b/projects/https-everywhere/config index 90d7e41..255d36f 100644 --- a/projects/https-everywhere/config +++ b/projects/https-everywhere/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 2020.8.13 +version: 2020.11.17 git_url: https://git.torproject.org/https-everywhere.git git_hash: '[% c("version") %]' git_submodule: 1 diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index d5027f4..9a019e5 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,16 @@ +Tor Browser 10.0.7 -- December 15 2020 + * Windows + OS X + Linux + * Update Firefox to 78.6.0esr + * Update HTTPS Everywhere to 2020.11.17 + * Bug 40166: Disable security.certerrors.mitm.auto_enable_enterprise_roots [tor-browser] + * Bug 40176: Update openssl to 1.1.1i [tor-browser-build] + * Linux + * Bug 40226: Crash on Fedora Workstation Rawhide GNOME [tor-browser] + * Build System + * Windows + OS X + Linux + * Bug 40139: Pick up rbm commit for bug 40008 [tor-browser-build] + * Bug 40161: Update Go compiler to 1.14.13 [tor-browser-build] + Tor Browser 10.0.6 -- December 8 2020 * Windows + OS X + Linux * Bug 40175: Update obfs4proxy's TLS certificate public key pinning [tor-browser-build] diff --git a/rbm.conf b/rbm.conf index 9e1db9a..3e49c09 100644 --- a/rbm.conf +++ b/rbm.conf @@ -24,10 +24,11 @@ buildconf: git_signtag_opt: '-s' var: - torbrowser_version: '10.0.6' - torbrowser_build: 'build2' + torbrowser_version: '10.0.7' + torbrowser_build: 'build1' torbrowser_incremental_from: - 10.0.5 + - 10.0.6 project_name: tor-browser multi_lingual: 0 build_mar: 1

1 0

[tor-browser-build/master] Merge remote-tracking branch 'gitlab/merge-requests/122'
by gk＠torproject.org 09 Dec '20

09 Dec '20

commit 92dae3e36b9d9e2118101ffcd96463debc44b650 Merge: 89ce275 672e63d Author: Georg Koppen <gk(a)torproject.org> Date: Wed Dec 9 13:16:39 2020 +0000 Merge remote-tracking branch 'gitlab/merge-requests/122' tools/signing/nightly/config.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

1 0

[tor-browser-build/master] Bug 40148: Do nightly mar signing on tbb-nightlies-master.tpo
by gk＠torproject.org 09 Dec '20

09 Dec '20

commit 672e63d1f56e3aca5485af74659c8b8fffbfc114 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Nov 12 19:01:56 2020 +0100 Bug 40148: Do nightly mar signing on tbb-nightlies-master.tpo Adapt the configuration of the nightly signing script to rsync the mar files to a local directory. --- tools/signing/nightly/config.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/signing/nightly/config.yml b/tools/signing/nightly/config.yml index 36743a4..d80e1ab 100644 --- a/tools/signing/nightly/config.yml +++ b/tools/signing/nightly/config.yml @@ -14,5 +14,5 @@ publish_dirs: nss_db_dir: nssdb nss_certname: nightly-marsigner gpg_keyring: keyring/torbrowser-nightly.gpg -rsync_dest: nightly-publish:nightly-updates/ -post_rsync_cmd: ssh nightly-publish-static-update true +rsync_dest: /srv/tbb-nightlies-master.torproject.org/htdocs/nightly-updates/ +post_rsync_cmd: static-update-component nightlies.tbb.torproject.org

1 0

[tor-browser-build/master] fixup! Bug 40166: Update apt cache before calling pre_pkginst in container-image config
by gk＠torproject.org 09 Dec '20

09 Dec '20

commit 89ce2757e57357aef59d3c9a598b742b7d6b0f1c Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Mon Dec 7 23:50:58 2020 +0000 fixup! Bug 40166: Update apt cache before calling pre_pkginst in container-image config Bug 40169: Update apt package cache after calling pre_pkginst, too The creation of some project containers require an updated apt cache before executing pre_pkginst, while others require updating the apt cache after executing pre_pkginst. --- projects/container-image/config | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/projects/container-image/config b/projects/container-image/config index e8f3f38..7520b8e 100644 --- a/projects/container-image/config +++ b/projects/container-image/config @@ -27,9 +27,14 @@ pre: | # [% c('var/container/suite') %] set -e export DEBIAN_FRONTEND=noninteractive + # Update the package cache so the container installs the most recent + # version of required packages. apt-get update -y -q [% IF pc(c('origin_project'), 'var/pre_pkginst') -%] [% pc(c('origin_project'), 'var/pre_pkginst') %] + # Update the package cache again because `pre_pkginst` may change the + # package manager configuration. + apt-get update -y -q [% END -%] apt-get upgrade -y -q [%

1 0

[tor-browser-spec/master] Update Fenix84 net audit
by sysrqb＠torproject.org 08 Dec '20

08 Dec '20

commit d68aa868ef206168b44c639ac83ddae6274070fc Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Tue Dec 8 23:06:41 2020 +0000 Update Fenix84 net audit --- audits/FF84_NETWORK_AUDIT | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/audits/FF84_NETWORK_AUDIT b/audits/FF84_NETWORK_AUDIT index 039dd96..a4c6ee0 100644 --- a/audits/FF84_NETWORK_AUDIT +++ b/audits/FF84_NETWORK_AUDIT @@ -1,4 +1,4 @@ -`git diff 1cb2c4893850a5b0a246f821a6390c07064c1227 9e429e392ec8446ff0f078f991d6332a307bc98f` +`git diff 1cb2c4893850a5b0a246f821a6390c07064c1227 11898884c81cd84cfaec46dffe1dbf42517e8301` and then go over all the changes containing the below mentioned potentially dangerous calls and features. Grep the diff for the following strings and examine surrounding usage. @@ -33,6 +33,13 @@ TRR (DNS Trusted Recursive Resolver) # Bug 1673590: # - Still protected by https://bugzil.la/1636411 +# Bug 1674088: +# - Increase TRR max failures and add new pref +# |network.trr.retry-timeout-ms| + +# Bug 1677806 +# - Set network.dns.dns_query_single_label to false + Direct Paths to DNS resolution: nsDNSService::Resolve @@ -139,14 +146,14 @@ End: 6a234c2b1e1972f11e585551d4cf2e40e84bf16f # v67.0.0 ============ Android Components Portion ============= Start: 0a2993d44aae3d877bb97cee925096f83af01b3a # v63.0.8 -End: 614386935ec94cac531eb8cb061409e9a8410d09 # v67.0.3 +End: 89973898761d54c7512bb74ea2c3489fca07bf8e # v67.0.10 # FF84: Zero new usage found of known proxy-bypass APIs (using `java_audit.sh`) ============ Fenix Portion ============= Start: 5441935698f4d9e3606f3d6baf892f6e0106a2f6 # v83.1.0-rc.1 -End: 670e61b2b97d4f8066497e79178729c5802fe428 # v84.0.0-beta.2 +End: 8b4b9bde5f2dab9fec1631fbfc70d4e2c3b2d24e # v84.1.0-rc.1 # FF84: Zero new usage found of known proxy-bypass APIs (using `java_audit.sh`)

1 0

[tor-browser-build/maint-10.0-android] Bug 40139: Pick up rbm commit for bug 40008
by sysrqb＠torproject.org 08 Dec '20

08 Dec '20

commit 35e166b3fa2bba66355e6ccbad79de50cd92b20d Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Wed Oct 28 22:08:13 2020 +0000 Bug 40139: Pick up rbm commit for bug 40008 --- rbm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rbm b/rbm index a32239d..15c8476 160000 --- a/rbm +++ b/rbm @@ -1 +1 @@ -Subproject commit a32239ddb1f465115cb4a8bb9f4b853c149506f3 +Subproject commit 15c84760ebe3f2677d1212aa00ef6f7485446a69

1 0

[tor-browser-build/maint-10.0-desktop] Bug 40139: Pick up rbm commit for bug 40008
by sysrqb＠torproject.org 08 Dec '20

08 Dec '20

commit 84f086a26c83449131c0ba4d5cc371d9a55c8fe1 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Wed Oct 28 22:08:13 2020 +0000 Bug 40139: Pick up rbm commit for bug 40008 --- rbm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rbm b/rbm index a32239d..15c8476 160000 --- a/rbm +++ b/rbm @@ -1 +1 @@ -Subproject commit a32239ddb1f465115cb4a8bb9f4b853c149506f3 +Subproject commit 15c84760ebe3f2677d1212aa00ef6f7485446a69

1 0

[tor-browser/tor-browser-78.5.0esr-10.0-1] Bug 40166: Disable security.certerrors.mitm.auto_enable_enterprise_roots
by sysrqb＠torproject.org 08 Dec '20

08 Dec '20

commit 9cc097d454330ca53808b4a90bf3677c4f8a6f2d Author: Alex Catarineu <acat(a)torproject.org> Date: Fri Oct 9 12:55:35 2020 +0200 Bug 40166: Disable security.certerrors.mitm.auto_enable_enterprise_roots --- browser/app/profile/000-tor-browser.js | 3 +++ browser/components/BrowserGlue.jsm | 14 ++++++++++++++ 2 files changed, 17 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 6bc759bdf30b..5c65eff70fc0 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -323,6 +323,9 @@ pref("security.enterprise_roots.enabled", false); // Don't ping Mozilla for MitM detection, see bug 32321 pref("security.certerrors.mitm.priming.enabled", false); +// Don't automatically enable enterprise roots, see bug 40166 +pref("security.certerrors.mitm.auto_enable_enterprise_roots", false); + // Disable the language pack signing check for now on macOS, see #31942 #ifdef XP_MACOSX pref("extensions.langpacks.signatures.required", false); diff --git a/browser/components/BrowserGlue.jsm b/browser/components/BrowserGlue.jsm index 057a2121533c..3750230a250b 100644 --- a/browser/components/BrowserGlue.jsm +++ b/browser/components/BrowserGlue.jsm @@ -1319,6 +1319,20 @@ BrowserGlue.prototype = { // handle any UI migration this._migrateUI(); + // Clear possibly auto enabled enterprise_roots prefs (see bug 40166) + if ( + !Services.prefs.getBoolPref( + "security.certerrors.mitm.auto_enable_enterprise_roots" + ) && + Services.prefs.getBoolPref( + "security.enterprise_roots.auto-enabled", + false + ) + ) { + Services.prefs.clearUserPref("security.enterprise_roots.enabled"); + Services.prefs.clearUserPref("security.enterprise_roots.auto-enabled"); + } + if (!Services.prefs.prefHasUserValue(PREF_PDFJS_ISDEFAULT_CACHE_STATE)) { PdfJs.checkIsDefault(this._isNewProfile); }

1 0

[tor-browser-build/maint-10.0-android] Tag -build2
by sysrqb＠torproject.org 08 Dec '20

08 Dec '20

commit f2cff2bdabd356bdbd7f7c8183937678955df09f Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Mon Dec 7 22:36:24 2020 +0000 Tag -build2 --- projects/obfs4/build | 2 +- rbm.conf | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/projects/obfs4/build b/projects/obfs4/build index 4840edf..c0437fc 100644 --- a/projects/obfs4/build +++ b/projects/obfs4/build @@ -24,12 +24,12 @@ tar -C /var/tmp/dist -xf [% c('input_files_by_name/goxtext') %] mkdir -p /var/tmp/build tar -C /var/tmp/build -xf [% project %]-[% c('version') %].tar.gz cd /var/tmp/build/[% project %]-[% c('version') %] +patch -p1 < $rootdir/update_azure_hpkp.patch mkdir -p "$GOPATH/src/gitlab.com/yawning" ln -sf "$PWD" "$GOPATH/src/gitlab.com/yawning/obfs4.git" cd obfs4proxy -patch -p1 < $rootdir/update_azure_hpkp.patch go build -ldflags '-s' cp -a obfs4proxy[% IF c("var/windows") %].exe[% END %] $PTDIR diff --git a/rbm.conf b/rbm.conf index 4300256..bb2982e 100644 --- a/rbm.conf +++ b/rbm.conf @@ -25,7 +25,7 @@ buildconf: var: torbrowser_version: '10.0.6' - torbrowser_build: 'build1' + torbrowser_build: 'build2' torbrowser_incremental_from: - 10.5a1 project_name: tor-browser

1 0

[tor-browser-build/maint-10.0-desktop] Tag -build2
by sysrqb＠torproject.org 07 Dec '20

07 Dec '20

commit 956ddcebd5f193aef83e1762c2e89c1b57d2e8c7 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Mon Dec 7 22:36:24 2020 +0000 Tag -build2 --- projects/obfs4/build | 2 +- rbm.conf | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/projects/obfs4/build b/projects/obfs4/build index 4840edf..c0437fc 100644 --- a/projects/obfs4/build +++ b/projects/obfs4/build @@ -24,12 +24,12 @@ tar -C /var/tmp/dist -xf [% c('input_files_by_name/goxtext') %] mkdir -p /var/tmp/build tar -C /var/tmp/build -xf [% project %]-[% c('version') %].tar.gz cd /var/tmp/build/[% project %]-[% c('version') %] +patch -p1 < $rootdir/update_azure_hpkp.patch mkdir -p "$GOPATH/src/gitlab.com/yawning" ln -sf "$PWD" "$GOPATH/src/gitlab.com/yawning/obfs4.git" cd obfs4proxy -patch -p1 < $rootdir/update_azure_hpkp.patch go build -ldflags '-s' cp -a obfs4proxy[% IF c("var/windows") %].exe[% END %] $PTDIR diff --git a/rbm.conf b/rbm.conf index a549fc4..9e1db9a 100644 --- a/rbm.conf +++ b/rbm.conf @@ -25,7 +25,7 @@ buildconf: var: torbrowser_version: '10.0.6' - torbrowser_build: 'build1' + torbrowser_build: 'build2' torbrowser_incremental_from: - 10.0.5 project_name: tor-browser

1 0