- tbb-commits - lists.torproject.org

[tor-browser-build/maint-10.0-desktop] Bug 40175: Update obfs4proxy's TLS certificate public key pinning
by gk＠torproject.org 08 Dec '20

08 Dec '20

commit f93f43c4501a7fd75b624928ab6b4435ba67a0df Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Mon Dec 7 20:33:53 2020 +0000 Bug 40175: Update obfs4proxy's TLS certificate public key pinning --- projects/obfs4/build | 1 + projects/obfs4/config | 1 + projects/obfs4/update_azure_hpkp.patch | 56 ++++++++++++++++++++++++++++++++++ 3 files changed, 58 insertions(+) diff --git a/projects/obfs4/build b/projects/obfs4/build index 47c7228..4840edf 100644 --- a/projects/obfs4/build +++ b/projects/obfs4/build @@ -29,6 +29,7 @@ mkdir -p "$GOPATH/src/gitlab.com/yawning" ln -sf "$PWD" "$GOPATH/src/gitlab.com/yawning/obfs4.git" cd obfs4proxy +patch -p1 < $rootdir/update_azure_hpkp.patch go build -ldflags '-s' cp -a obfs4proxy[% IF c("var/windows") %].exe[% END %] $PTDIR diff --git a/projects/obfs4/config b/projects/obfs4/config index 21bdab6..749ff43 100644 --- a/projects/obfs4/config +++ b/projects/obfs4/config @@ -39,3 +39,4 @@ input_files: - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]' enable: '[% c("var/android") %]' + - filename: update_azure_hpkp.patch diff --git a/projects/obfs4/update_azure_hpkp.patch b/projects/obfs4/update_azure_hpkp.patch new file mode 100644 index 0000000..a4324fc --- /dev/null +++ b/projects/obfs4/update_azure_hpkp.patch @@ -0,0 +1,56 @@ +From 1115c2e2eaca1a96865ae47aead9838aab45787e Mon Sep 17 00:00:00 2001 +From: Philipp Winter <phw(a)nymity.ch> +Date: Mon, 7 Dec 2020 10:23:44 -0800 +Subject: [PATCH] Update Azure's root CA certificate pins. + +Microsoft recently updated the root CA certificates that are served to +Azure clients. See the following article for more details: +https://docs.microsoft.com/en-us/azure/security/fundamentals/tls-certificate-changes + +This change broke meek-lite because none of its pins work anymore. That +means that Tor Browser users can no longer use meek-azure or moat as +both rely on meek-lite. + +This patch fixes the problem by updating the certificate pins. +--- + transports/meeklite/hpkp_lite.go | 21 ++++++++++++--------- + 1 file changed, 12 insertions(+), 9 deletions(-) + +diff --git a/transports/meeklite/hpkp_lite.go b/transports/meeklite/hpkp_lite.go +index 0ff56f9..97ac590 100644 +--- a/transports/meeklite/hpkp_lite.go ++++ b/transports/meeklite/hpkp_lite.go +@@ -103,19 +103,22 @@ func init() { + pins: make(map[string]*pinEntry), + } + +- // Pin all of Microsoft's CA intermediary certificates for the +- // Tor Browser Azure bridge. ++ // Pin all of Microsoft Azure's root CA certificates for the Tor Browser ++ // Azure bridge. + // +- // See: https://www.microsoft.com/pki/mscorp/cps/default.htm ++ // See: https://docs.microsoft.com/en-us/azure/security/fundamentals/tls-certificat… + builtinPinDB.Add( + "ajax.aspnetcdn.com", + []string{ +- "CzdPous1hY3sIkO55pUH7vklXyIHVZAl/UnprSQvpEI=", // Microsoft IT SSL SHA2 - 2018-05-07 17:03:30 +- "xjXxgkOYlag7jCtR5DreZm9b61iaIhd+J3+b2LiybIw=", // Microsoft IT TLS CA 1 - 2024-05-20 12:51:28 +- "wBdPad95AU7OgLRs0FU/E6ILO1MSCM84kJ9y0H+TT7s=", // Microsoft IT TLS CA 2 - 2024-05-20 12:51:57 +- "wUY9EOTJmS7Aj4fDVCu/KeE++mV7FgIcbn4WhMz1I2k=", // Microsoft IT TLS CA 4 - 2024-05-20 12:52:38 +- "RCbqB+W8nwjznTeP4O6VjqcwdxIgI79eBpnBKRr32gc=", // Microsoft IT TLS CA 5 - 2024-05-20 12:53:03 ++ "i7WTqTvh0OioIruIfFR4kMPnBqrS2rdiVPl/s2uC/CY=", // DigiCert Global Root G2 - 2038-01-15 12:00:00 ++ "r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E=", // DigiCert Global Root CA - 2031-11-10 00:00:00 ++ "Y9mvm0exBk1JoQ57f9Vm28jKo5lFm/woKcVxrYxu80o=", // Baltimore CyberTrust Root - 2025-05-12 23:59:00 ++ "7KDxgUAs56hlKzG00DbfJH46MLf0GlDZHsT5CwBrQ6E=", // D-TRUST Root Class 3 CA 2 2009 - 2029-11-05 08:35:58 ++ "svcpi1K/LDysTd/nLeTWgqxYlXWVmC8rYjAa9ZfGmcU=", // Microsoft RSA Root Certificate Authority 2017 - 2042-07-18 23:00:23 ++ "NfU84SZGEeAzQP434ex9TMmGxWE9ynD9BKpEVF8tryg=", // Microsoft ECC Root Certificate Authority 2017 - 2042-07-18 23:16:04 + }, +- time.Date(2024, time.May, 20, 00, 00, 00, 00, time.UTC), ++ // As of 2020-12-07, we're getting the "DigiCert Global Root CA" ++ // certificate, so our expiration time matches this certificate. ++ time.Date(2031, time.November, 20, 00, 00, 00, 00, time.UTC), + ) + } +-- +2.20.1

1 0

[tor-browser-build/master] Tag up 10.5a5 -build2
by sysrqb＠torproject.org 07 Dec '20

07 Dec '20

commit b93dd755bd9137eef16797d2fe86b8958d621d8b Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Mon Dec 7 16:00:07 2020 +0000 Tag up 10.5a5 -build2 --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 1 + rbm.conf | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 32af090..c2c6c48 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -20,6 +20,7 @@ Tor Browser 10.5a5 -- December 7 2020 * Bug 40161: Pick up Go 1.15.5 [tor-browser-build] * Bug 40163: Bug 40163: Avoid checking hash of .pom files [tor-browser-build] * Bug 40166: Update apt cache before calling pre_pkginst in container-image config [tor-browser-build] + * Bug 40171: Include all uniffi-rs artifacts into application-services [tor-browser-build] Tor Browser 10.5a4 -- November 17 2020 * All Platforms diff --git a/rbm.conf b/rbm.conf index 2176854..dfc48c8 100644 --- a/rbm.conf +++ b/rbm.conf @@ -25,7 +25,7 @@ buildconf: var: torbrowser_version: '10.5a5' - torbrowser_build: 'build1' + torbrowser_build: 'build2' torbrowser_incremental_from: - 10.5a3 project_name: tor-browser

1 0

[tor-browser-build/master] Bug 40171: Include all uniffi-rs artifacts into application-services
by sysrqb＠torproject.org 07 Dec '20

07 Dec '20

commit bec670e38487ac265a24e8d9120a3c76b0f72fc9 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Dec 7 09:57:58 2020 +0000 Bug 40171: Include all uniffi-rs artifacts into application-services --- projects/application-services/build | 4 +++- projects/application-services/config | 24 +++++++++++++++++++++--- 2 files changed, 24 insertions(+), 4 deletions(-) diff --git a/projects/application-services/build b/projects/application-services/build index 77f6e2d..f366605 100644 --- a/projects/application-services/build +++ b/projects/application-services/build @@ -21,7 +21,9 @@ cd /var/tmp/dist tar -xf $rootdir/[% c('input_files_by_name/sqlcipher-' _ arch) %] mv sqlcipher sqlcipher-[% arch %] [% END -%] -tar -xf $rootdir/[% c('input_files_by_name/uniffi-rs') %] +# We pick the armv7 flavor, but it actually does not matter which one we choose +# as `uniffi-bindgen` is a host tool. See: tor-browser-build#40171. +tar -xf $rootdir/[% c('input_files_by_name/uniffi-rs-armv7') %] export PATH=/var/tmp/dist/rust/bin:/var/tmp/dist/uniffi-rs:$PATH cd $rootdir diff --git a/projects/application-services/config b/projects/application-services/config index 5eecbad..a67a880 100644 --- a/projects/application-services/config +++ b/projects/application-services/config @@ -26,7 +26,8 @@ input_files: name: '[% c("var/compiler") %]' - project: gradle name: gradle - # We need the torbrowser-* targets for Rust, see: #40094. + # We need the torbrowser-* targets for Rust and Rust-dependent projects, see: + # #40094. - project: rust name: rust-armv7 target_prepend: @@ -43,6 +44,25 @@ input_files: name: rust-x86_64 target_prepend: - torbrowser-android-x86_64 + # `uniffi-rs` provides us with a host tool, yet we still need to include + # artifacts for all architectures to avoid unnecessary rebuilding later on. + # See: tor-browser-build#40171. + - project: uniffi-rs + name: uniffi-rs-armv7 + target_prepend: + - torbrowser-android-armv7 + - project: uniffi-rs + name: uniffi-rs-aarch64 + target_prepend: + - torbrowser-android-aarch64 + - project: uniffi-rs + name: uniffi-rs-x86 + target_prepend: + - torbrowser-android-x86 + - project: uniffi-rs + name: uniffi-rs-x86_64 + target_prepend: + - torbrowser-android-x86_64 - project: nss name: nss-armv7 target_prepend: @@ -75,8 +95,6 @@ input_files: name: sqlcipher-x86_64 target_prepend: - android-x86_64 - - name: uniffi-rs - project: uniffi-rs - name: python project: python enable: '[% !c("var/fetch_gradle_dependencies") %]'

1 0

[Git][tpo/applications/fenix] Pushed new tag tor-browser-84.0.0b2-10.5-1-build1
by Matthew Finkel 05 Dec '20

05 Dec '20

Matthew Finkel pushed new tag tor-browser-84.0.0b2-10.5-1-build1 at The Tor Project / Applications / fenix -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/fenix/-/tree/tor-browser-84.… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[tor-browser-build/master] Release preparations for 10.5a5
by sysrqb＠torproject.org 05 Dec '20

05 Dec '20

commit 203bb72e5ccb18bd5b9e8f13d244ef29dd5c94b5 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Fri Dec 4 18:23:25 2020 +0000 Release preparations for 10.5a5 Versions bump and Changelog update --- projects/https-everywhere/config | 2 +- projects/tba-translation/config | 2 +- .../tor-browser/Bundle-Data/Docs/ChangeLog.txt | 23 ++++++++++++++++++++++ projects/tor/config | 2 +- rbm.conf | 4 ++-- 5 files changed, 28 insertions(+), 5 deletions(-) diff --git a/projects/https-everywhere/config b/projects/https-everywhere/config index 90d7e41..255d36f 100644 --- a/projects/https-everywhere/config +++ b/projects/https-everywhere/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 2020.8.13 +version: 2020.11.17 git_url: https://git.torproject.org/https-everywhere.git git_hash: '[% c("version") %]' git_submodule: 1 diff --git a/projects/tba-translation/config b/projects/tba-translation/config index 245577f..2c8e70d 100644 --- a/projects/tba-translation/config +++ b/projects/tba-translation/config @@ -3,5 +3,5 @@ filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' git_url: https://git.torproject.org/translation.git # We need to bump the commit before releasing but just pointing to a branch # might cause too much rebuidling of the Firefox part. -git_hash: e20c294e6687a91abfc432c3f59e244031c35b2d +git_hash: afba80b5aa89823da93ea2d742d413e73b031c06 version: '[% c("abbrev") %]' diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index dc9ac6e..32af090 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,26 @@ +Tor Browser 10.5a5 -- December 7 2020 + * Android + * Update Fenix to 84.0.0-beta.2 + * Update HTTPS Everywhere to 2020.11.17 + * Update Tor to 0.4.5.2-alpha + * Translations update + * Bug 40159: Update snowflake to ece43cbf [tor-browser-build] + * Bug 40236: Rebase tor-browser patches to 84.0b1 [tor-browser] + * Bug 40258: Rebase tor-browser patches to 84.0b7 [tor-browser] + * Bug 40119: Rebase Fenix patches to Fenix 84 beta 2 [fenix] + * Bug 40027: Rebase android-components patches for Fenix 84 beta 2 builds [android-components] + * Build System + * Android + * Bug 40081: Build Mozilla code with --enable-rust-simd [tor-browser-build] + * Bug 40128: Allow updating Fenix allowed_addons.json [tor-browser-build] + * Bug 40140: Create own Gradle project [tor-browser-build] + * Bug 40147: Remove RANLIB workaround once we pick up 0.4.5.2-alpha [tor-browser-build] + * Bug 40155: Update toolchain for Fenix 84 [tor-browser-build] + * Bug 40156: Update Fenix and dependencies to 84.0.0-beta2 [tor-browser-build] + * Bug 40161: Pick up Go 1.15.5 [tor-browser-build] + * Bug 40163: Bug 40163: Avoid checking hash of .pom files [tor-browser-build] + * Bug 40166: Update apt cache before calling pre_pkginst in container-image config [tor-browser-build] + Tor Browser 10.5a4 -- November 17 2020 * All Platforms * Update Tor to 0.4.5.1-alpha diff --git a/projects/tor/config b/projects/tor/config index 4c68ce1..42c5a1b 100644 --- a/projects/tor/config +++ b/projects/tor/config @@ -1,6 +1,6 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -version: 0.4.5.1-alpha +version: 0.4.5.2-alpha git_hash: 'tor-[% c("version") %]' git_url: https://git.torproject.org/tor.git git_submodule: 1 diff --git a/rbm.conf b/rbm.conf index 01a717c..2176854 100644 --- a/rbm.conf +++ b/rbm.conf @@ -24,8 +24,8 @@ buildconf: git_signtag_opt: '-s' var: - torbrowser_version: '10.5a4' - torbrowser_build: 'build2' + torbrowser_version: '10.5a5' + torbrowser_build: 'build1' torbrowser_incremental_from: - 10.5a3 project_name: tor-browser

1 0

[tor-browser-build/master] Bug 40167: Update GeckoView to 84.0b7
by gk＠torproject.org 05 Dec '20

05 Dec '20

commit 3f02dab019023bd88236bd9ada8f5d775ebc0cc0 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Fri Dec 4 17:57:24 2020 +0000 Bug 40167: Update GeckoView to 84.0b7 --- projects/geckoview/config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/geckoview/config b/projects/geckoview/config index 7d01541..7ea298e 100644 --- a/projects/geckoview/config +++ b/projects/geckoview/config @@ -8,7 +8,7 @@ git_submodule: 1 gpg_keyring: torbutton.gpg var: - geckoview_version: 84.0b1 + geckoview_version: 84.0b7 torbrowser_branch: 10.5 copyright_year: '[% exec("git show -s --format=%ci").remove("-.*") %]' deps:

1 0

[tor-browser-build/master] Merge remote-tracking branch 'gitlab/merge-requests/147'
by gk＠torproject.org 05 Dec '20

05 Dec '20

commit 28d939a08cbf1ea20ad68c42d5293ca4142bced0 Merge: eb544e8 3f02dab Author: Georg Koppen <gk(a)torproject.org> Date: Fri Dec 4 21:08:33 2020 +0000 Merge remote-tracking branch 'gitlab/merge-requests/147' projects/geckoview/config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

1 0

[tor-browser-build/master] Revert "Bug 40139: Set RANLIB in macOS tor build"
by gk＠torproject.org 05 Dec '20

05 Dec '20

commit eb544e8ac5abe019ab3604f6663b1eee0e3ec4d6 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Fri Dec 4 18:24:11 2020 +0000 Revert "Bug 40139: Set RANLIB in macOS tor build" This reverts commit 09aff7d7575b41f2130995c32538188c57654b04. Bug 40147: Remove workaround for core/tor#40172 once we pick up 0.4.5.2-alpha --- projects/tor/build | 1 - 1 file changed, 1 deletion(-) diff --git a/projects/tor/build b/projects/tor/build index 84b1778..c7e9190 100644 --- a/projects/tor/build +++ b/projects/tor/build @@ -106,7 +106,6 @@ find -type f -print0 | xargs -0 [% c("var/touch") %] [% IF c("var/osx") -%] export LD_PRELOAD=[% c("var/faketime_path") %] export FAKETIME="[% USE date; GET date.format(c('timestamp'), format = '%Y-%m-%d %H:%M:%S') %]" - export RANLIB=x86_64-apple-darwin-ranlib [% END -%] make -j[% c("buildconf/num_procs") %] make install

1 0

[tor-browser-build/master] Fold in and merge Android 10.0.5 Changelog
by sysrqb＠torproject.org 04 Dec '20

04 Dec '20

commit 168880f44e8fd94850de1771140647d366183ae3 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Fri Dec 4 17:08:03 2020 +0000 Fold in and merge Android 10.0.5 Changelog --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 95d4819..dc9ac6e 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -21,11 +21,22 @@ Tor Browser 10.5a4 -- November 17 2020 * Bug 40126: Bump Node to 10.22.1 for mozilla83 [tor-browser-build] * Bug 40127: Update components for switch to mozilla83-based Fenix [tor-browser-build] -Tor Browser 10.0.5 -- November 17 2020 - * Windows + OS X + Linux - * Update Firefox to 78.5.0esr +Tor Browser 10.0.5 -- November 27 2020 + * All Platforms * Update Tor to 0.4.4.6 * Bug 40212: Add new default obfs4 bridge [tor-browser] + * Windows + OS X + Linux + * Update Firefox to 78.5.0esr + * Android + * Update Fenix to 83.1.0 + * Translations update + * Build System + * Android + * Bug 40126: Update toolchains for Fenix 83 [tor-browser-build] + * Bug 40126: Bump Node to 10.22.1 for mozilla83 [tor-browser-build] + * Bug 40127: Update GeckoView to 83, android-components to 63.0.1, and Fenix to 83.0.0b2 [tor-browser-build] + * Bug 40160: Update Fenix to 83.1.0, and android-components to 63.0.9 [tor-browser-build] + * Bug 40211: Lower required build-tools version to 29.0.2 [tor-browser] Tor Browser 10.5a3 -- November 10 2020 * All Platforms

1 0

[tor-browser-build/master] Bug 40166: Update apt cache before calling pre_pkginst in container-image config
by gk＠torproject.org 04 Dec '20

04 Dec '20

commit 404f2c584a207abcb309614f3376eb02683bf5d9 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Fri Dec 4 14:44:29 2020 +0000 Bug 40166: Update apt cache before calling pre_pkginst in container-image config Thanks to boklm for the suggestion in #23631 --- projects/container-image/config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/container-image/config b/projects/container-image/config index 3abba6c..e8f3f38 100644 --- a/projects/container-image/config +++ b/projects/container-image/config @@ -27,10 +27,10 @@ pre: | # [% c('var/container/suite') %] set -e export DEBIAN_FRONTEND=noninteractive + apt-get update -y -q [% IF pc(c('origin_project'), 'var/pre_pkginst') -%] [% pc(c('origin_project'), 'var/pre_pkginst') %] [% END -%] - apt-get update -y -q apt-get upgrade -y -q [% deps = [];

1 0