- tbb-commits - lists.torproject.org

[torbutton/master] Bug 19757: Support on-disk storage of v3 client auth keys
by sysrqb＠torproject.org 21 Feb '20

21 Feb '20

commit dc1871601fad289645696bb8138e8b14c46dd60a Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Wed Jan 15 08:24:27 2020 -0500 Bug 19757: Support on-disk storage of v3 client auth keys Add onionAuthViewKeys() and onionAuthRemove() Tor controller functions. --- modules/tor-control-port.js | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/modules/tor-control-port.js b/modules/tor-control-port.js index 815df473..2b0849e9 100644 --- a/modules/tor-control-port.js +++ b/modules/tor-control-port.js @@ -580,6 +580,26 @@ info.getConf = function (aControlSocket, key) { // A namespace for functions related to tor's ONION_CLIENT_AUTH_* commands. let onionAuth = {}; +onionAuth.keyInfoStringsFromMessage = utils.extractor(/^250-CLIENT\s+(.+)$/gmi); + +onionAuth.keyInfoObjectsFromMessage = function(message) { + let keyInfoStrings = onionAuth.keyInfoStringsFromMessage(message); + return keyInfoStrings.map(infoStr => utils.listMapData(infoStr, + ["hsAddress", "typeAndKey"])); +} + +// __onionAuth.viewKeys()__. +// Sends a ONION_CLIENT_AUTH_VIEW command to retrieve the list of private keys. +// Returns a promise that is fulfilled with an array of key info objects which +// contain the following properties: +// hsAddress +// typeAndKey +// Flags (e.g., "Permanent") +onionAuth.viewKeys = function (aControlSocket) { + let cmd = "onion_client_auth_view"; + return aControlSocket.sendCommand(cmd).then(onionAuth.keyInfoObjectsFromMessage); +}; + // __onionAuth.add(controlSocket, hsAddress, b64PrivateKey, isPermanent)__. // Sends a ONION_CLIENT_AUTH_ADD command to add a private key to the // Tor configuration. @@ -600,6 +620,19 @@ onionAuth.add = function (aControlSocket, hsAddress, b64PrivateKey, return aControlSocket.sendCommand(cmd); }; +// __onionAuth.remove(controlSocket, hsAddress)__. +// Sends a ONION_CLIENT_AUTH_REMOVE command to remove a private key from the +// Tor configuration. +onionAuth.remove = function (aControlSocket, hsAddress) { + if (!utils.isString(hsAddress)) { + return utils.rejectPromise("hsAddress argument should be a string"); + } + + let cmd = `onion_client_auth_remove ${hsAddress}`; + return aControlSocket.sendCommand(cmd); +}; + + // ## event // Handlers for events @@ -655,9 +688,12 @@ tor.controller = function (ipcFile, host, port, password, onError) { isOpen = true; return { getInfo : key => info.getInfo(socket, key), getConf : key => info.getConf(socket, key), + onionAuthViewKeys : () => onionAuth.viewKeys(socket), onionAuthAdd : (hsAddress, b64PrivateKey, isPermanent) => onionAuth.add(socket, hsAddress, b64PrivateKey, isPermanent), + onionAuthRemove : (hsAddress) => + onionAuth.remove(socket, hsAddress), watchEvent : (type, filter, onData) => event.watchEvent(socket, type, filter, onData), isOpen : () => isOpen,

1 0

[tor-browser-build/master] Merge remote-tracking branch 'sisbellgh/bug-31130i'
by sysrqb＠torproject.org 20 Feb '20

20 Feb '20

commit 3f341196fba76654999faa42139c5fa46882b527 Merge: ffc6f84 1961708 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Thu Feb 20 21:24:55 2020 +0000 Merge remote-tracking branch 'sisbellgh/bug-31130i' projects/debootstrap-image/config | 17 +++++++++-------- projects/firefox/build | 1 + projects/firefox/config | 5 ----- projects/https-everywhere/config | 1 + projects/tor-android-service/config | 6 ------ projects/tor-browser/build.android | 2 +- projects/tor-browser/config | 1 - projects/tor-onion-proxy-library/config | 6 ------ rbm.conf | 13 ++++++++++++- 9 files changed, 24 insertions(+), 28 deletions(-)

1 0

[tor-browser-build/master] Bug 31130: Use Debian 10 for our Android container images
by sysrqb＠torproject.org 20 Feb '20

20 Feb '20

commit 196170812a1c8c0c3f05bf298aaefca8cde277e3 Author: sisbell <shane.isbell(a)gmail.com> Date: Tue Oct 22 10:21:32 2019 -0700 Bug 31130: Use Debian 10 for our Android container images --- projects/debootstrap-image/config | 17 +++++++++-------- projects/firefox/build | 1 + projects/firefox/config | 5 ----- projects/https-everywhere/config | 1 + projects/tor-android-service/config | 6 ------ projects/tor-browser/build.android | 2 +- projects/tor-browser/config | 1 - projects/tor-onion-proxy-library/config | 6 ------ rbm.conf | 13 ++++++++++++- 9 files changed, 24 insertions(+), 28 deletions(-) diff --git a/projects/debootstrap-image/config b/projects/debootstrap-image/config index a50cbf1..f7b9e57 100644 --- a/projects/debootstrap-image/config +++ b/projects/debootstrap-image/config @@ -4,7 +4,7 @@ version: 2 pkg_type: build var: - ubuntu_version: 18.04.1 + ubuntu_version: 19.10 container: use_container: 1 @@ -15,8 +15,6 @@ pre: | #!/bin/sh set -e export DEBIAN_FRONTEND=noninteractive - # Bug 29158: install fixed packages for apt vulnerability (CVE-2019-3462) - dpkg -i ./apt_1.6.6ubuntu0.1_amd64.deb ./libapt-pkg5.0_1.6.6ubuntu0.1_amd64.deb apt-get update -y -q apt-get install -y -q debian-archive-keyring ubuntu-keyring debootstrap debootstrap --arch=[% c("var/container/arch") %] [% c("var/container/debootstrap_opt") %] [% c("var/container/suite") %] base-image [% c("var/container/debootstrap_mirror") %] @@ -65,14 +63,17 @@ targets: suite: stretch arch: amd64 + buster-amd64: + var: + minimal_apt_version: 1.8.2 + container: + suite: buster + arch: amd64 + input_files: - URL: 'http://cdimage.ubuntu.com/ubuntu-base/releases/[% c("var/ubuntu_version") %]/release/ubuntu-base-[% c("var/ubuntu_version") %]-base-amd64.tar.gz' filename: 'container-image_ubuntu-base-[% c("var/ubuntu_version") %]-base-amd64.tar.gz' - sha256sum: ed76e649f65548a80b361b68011085ec4dde7bb762d667657acbef87765e1a12 - - URL: http://security.ubuntu.com/ubuntu/pool/main/a/apt/apt_1.6.6ubuntu0.1_amd64.… - sha256sum: df210f9e30cf9deba5fbe815203af854e5e77bdbbe0b96d0d1c0da46a6a8dd0a - - URL: http://security.ubuntu.com/ubuntu/pool/main/a/apt/libapt-pkg5.0_1.6.6ubuntu… - sha256sum: 0a05a97b1e9b8d52ee8df040a14c5fabdebbb2c2235ac495db29df34f4c8cec3 + sha256sum: eedcb1dc0ccc86b59eb1f89960c322a2ba3ed3e0323a20a1da8bcc0e6f100f4f - URL: '[% c("var/apt_packages_baseurl") %]/[% c("var/apt_package_filename") %]' sha256sum: '[% c("var/apt_package_sha256sum") %]' enable: '[% c("var/apt_package_filename") %]' diff --git a/projects/firefox/build b/projects/firefox/build index c334854..800a0c4 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -57,6 +57,7 @@ mv -f $rootdir/[% c('input_files_by_name/mozconfig') %] .mozconfig [% END -%] [% IF c("var/android") %] + export JAVA_HOME=/usr/lib/jvm/java-1.8.0-openjdk-amd64 gradle_repo=/var/tmp/dist/gradle-dependencies export GRADLE_MAVEN_REPOSITORIES="file://$gradle_repo" export GRADLE_FLAGS="--no-daemon --offline" diff --git a/projects/firefox/config b/projects/firefox/config index d9b9edb..45a33a0 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -54,11 +54,6 @@ targets: var: branding_directory: '[% IF c("var/android") %]mobile/android[% ELSE %]browser[% END %]/branding/nightly' - android: - var: - arch_deps: - - openjdk-8-jdk - linux: var: post_pkginst: | diff --git a/projects/https-everywhere/config b/projects/https-everywhere/config index 1bc6f98..c66d7fe 100644 --- a/projects/https-everywhere/config +++ b/projects/https-everywhere/config @@ -27,6 +27,7 @@ var: - rsync - zip - unzip + pre_pkginst: '' input_files: - project: container-image diff --git a/projects/tor-android-service/config b/projects/tor-android-service/config index ca68d7b..c2994b7 100644 --- a/projects/tor-android-service/config +++ b/projects/tor-android-service/config @@ -13,12 +13,6 @@ var: # this should be updated when the list of gradle dependencies is changed gradle_dependencies_version: 3 -targets: - android: - var: - arch_deps: - - openjdk-8-jdk - input_files: - project: container-image - name: '[% c("var/compiler") %]' diff --git a/projects/tor-browser/build.android b/projects/tor-browser/build.android index f8f3a8d..751db11 100644 --- a/projects/tor-browser/build.android +++ b/projects/tor-browser/build.android @@ -55,4 +55,4 @@ cd tmp }) %] # Sign a QA build. This apk is not a debug version and doesn't contain a debug flag in the manifest -java -jar /usr/share/apksigner/apksigner.jar sign --verbose --min-sdk-version [% c("var/android_min_api") %] --ks $rootdir/android-qa.keystore --out $qa_apk --in $apk --ks-key-alias androidqakey --key-pass pass:android --ks-pass pass:android +java -jar /usr/lib/android-sdk/build-tools/debian/apksigner.jar sign --verbose --min-sdk-version [% c("var/android_min_api") %] --ks $rootdir/android-qa.keystore --out $qa_apk --in $apk --ks-key-alias androidqakey --key-pass pass:android --ks-pass pass:android diff --git a/projects/tor-browser/config b/projects/tor-browser/config index 7fd61a9..eaacff7 100644 --- a/projects/tor-browser/config +++ b/projects/tor-browser/config @@ -46,7 +46,6 @@ targets: build: '[% INCLUDE build.android %]' var: arch_deps: - - openjdk-8-jdk - apksigner input_files: diff --git a/projects/tor-onion-proxy-library/config b/projects/tor-onion-proxy-library/config index d76949d..c682078 100644 --- a/projects/tor-onion-proxy-library/config +++ b/projects/tor-onion-proxy-library/config @@ -15,12 +15,6 @@ var: # this should be updated when the list of gradle dependencies is changed gradle_dependencies_version: 3 -targets: - android: - var: - arch_deps: - - openjdk-8-jdk - input_files: - project: container-image - name: '[% c("var/compiler") %]' diff --git a/rbm.conf b/rbm.conf index 32da3c6..f5f35c1 100644 --- a/rbm.conf +++ b/rbm.conf @@ -236,7 +236,7 @@ targets: CC: '$ANDROID_NDK_HOME/[% c("var/toolchain_arch") %]/bin/clang' CXX: '$ANDROID_NDK_HOME/[% c("var/toolchain_arch") %]/bin/clang++' container: - suite: stretch + suite: buster arch: amd64 deps: - build-essential @@ -245,7 +245,18 @@ targets: - libtool - zip - unzip + - libtinfo5 + pre_pkginst: | + SNAPSHOT_VERSION=20191201T212855Z + OPENJDK_URL=https://snapshot.debian.org/archive/debian/$SNAPSHOT_VERSION/po… + JDK_VERSION=8u232-b09-1~deb9u1_amd64 + apt-get install -y -q wget ca-certificates-java + wget $OPENJDK_URL/openjdk-8-jdk-headless_$JDK_VERSION.deb + wget $OPENJDK_URL/openjdk-8-jre-headless_$JDK_VERSION.deb + echo 92b4f8fb77d793a86e0b03b3b0750592b40a26a5d75956d10dd984a7b3aad4c9 openjdk-8-jdk-headless_$JDK_VERSION.deb | sha256sum -c + echo 84bf52b6cce20ead08b0d5b9fd9b81b4aa3da385ca951b313fe11d5cb1aa4d17 openjdk-8-jre-headless_$JDK_VERSION.deb | sha256sum -c + dpkg -i ./openjdk-8-jre-headless_$JDK_VERSION.deb ./openjdk-8-jdk-headless_$JDK_VERSION.deb torbrowser-linux-x86_64: - linux-x86_64 - linux

1 0

[tor-browser/tor-browser-68.5.0esr-9.5-1] Bug 32493: Disable MOZ_SERVICES_HEALTHREPORT
by sysrqb＠torproject.org 19 Feb '20

19 Feb '20

commit 6046d1d582804594a57d132280376b8027d1ed83 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Jan 30 14:32:13 2020 +0100 Bug 32493: Disable MOZ_SERVICES_HEALTHREPORT --- browser/moz.configure | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/browser/moz.configure b/browser/moz.configure index f0f0f07e23f3..f03184d48651 100644 --- a/browser/moz.configure +++ b/browser/moz.configure @@ -5,7 +5,7 @@ # file, You can obtain one at http://mozilla.org/MPL/2.0/. imply_option('MOZ_PLACES', True) -imply_option('MOZ_SERVICES_HEALTHREPORT', True) +imply_option('MOZ_SERVICES_HEALTHREPORT', False) imply_option('MOZ_SERVICES_SYNC', True) imply_option('MOZ_DEDICATED_PROFILES', False) imply_option('MOZ_BLOCK_PROFILE_DOWNGRADE', False)

1 0

[tor-browser/tor-browser-68.5.0esr-9.5-1] Bug 32658: Create a new MAR signing key
by sysrqb＠torproject.org 19 Feb '20

19 Feb '20

commit 0f42a8ed2229c1ad5da15803eeebd2f849ffdb21 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Jan 17 12:54:31 2020 +0000 Bug 32658: Create a new MAR signing key It's time for our rotation again: Move the backup key in the front position and add a new backup key. --- toolkit/mozapps/update/updater/release_primary.der | Bin 1229 -> 1229 bytes toolkit/mozapps/update/updater/release_secondary.der | Bin 1229 -> 1229 bytes 2 files changed, 0 insertions(+), 0 deletions(-) diff --git a/toolkit/mozapps/update/updater/release_primary.der b/toolkit/mozapps/update/updater/release_primary.der index ec74f89dc807..0103a171de88 100644 Binary files a/toolkit/mozapps/update/updater/release_primary.der and b/toolkit/mozapps/update/updater/release_primary.der differ diff --git a/toolkit/mozapps/update/updater/release_secondary.der b/toolkit/mozapps/update/updater/release_secondary.der index 0103a171de88..fcee3944e9b7 100644 Binary files a/toolkit/mozapps/update/updater/release_secondary.der and b/toolkit/mozapps/update/updater/release_secondary.der differ

1 0

[tor-browser-build/master] Bug 33283: Pick up RBM caching logic
by sysrqb＠torproject.org 19 Feb '20

19 Feb '20

commit ffc6f844dbbf1985f5d10bd8dab2b15d9c8c2e75 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Wed Feb 19 17:50:41 2020 +0000 Bug 33283: Pick up RBM caching logic --- rbm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rbm b/rbm index 94fce31..e4f12ab 160000 --- a/rbm +++ b/rbm @@ -1 +1 @@ -Subproject commit 94fce31e54d3fd491cdb3e3b9401919c0e841360 +Subproject commit e4f12abe9ed81050994b5345c21b988005259396

1 0

[rbm/master] Bug 33283: Add caching for the exec template function
by sysrqb＠torproject.org 19 Feb '20

19 Feb '20

commit ce6b9136fc9e006536b34844946d67aa92cc0c21 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Feb 12 11:16:22 2020 +0100 Bug 33283: Add caching for the exec template function --- lib/RBM.pm | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/lib/RBM.pm b/lib/RBM.pm index 4db951a..f419c24 100644 --- a/lib/RBM.pm +++ b/lib/RBM.pm @@ -475,10 +475,14 @@ sub run_script { sub execute { my ($project, $cmd, $options) = @_; + CORE::state %cache; + my $res_name; my $old_cwd = getcwd; if (project_config($project, 'git_url', $options)) { my $git_hash = project_config($project, 'git_hash', $options) || exit_error "No git_hash specified for project $project"; + $res_name = "git-$git_hash-$cmd"; + return $cache{$res_name} if exists $cache{$res_name}; git_clone_fetch_chdir($project, $options); my ($stdout, $stderr, $success, $exit_code) = capture_exec('git', 'checkout', $git_hash); @@ -494,6 +498,8 @@ sub execute { } elsif (project_config($project, 'hg_url', $options)) { my $hg_hash = project_config($project, 'hg_hash', $options) || exit_error "No hg_hash specified for project $project"; + $res_name = "hg-$hg_hash-$cmd"; + return $cache{$res_name} if exists $cache{$res_name}; hg_clone_fetch_chdir($project, $options); my ($stdout, $stderr, $success, $exit_code) = capture_exec('hg', 'update', '-C', $hg_hash); @@ -503,7 +509,8 @@ sub execute { = run_script($project, $cmd, \&capture_exec); chdir($old_cwd); chomp $stdout; - return $success ? $stdout : undef; + $cache{$res_name} = $success ? $stdout : undef; + return $cache{$res_name}; } sub gpg_id {

1 0

[rbm/master] Bug 33283: Avoid computing sha256sum of files multiple times
by sysrqb＠torproject.org 19 Feb '20

19 Feb '20

commit e4f12abe9ed81050994b5345c21b988005259396 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Feb 12 16:09:00 2020 +0100 Bug 33283: Avoid computing sha256sum of files multiple times Instead, use the sha256file functon, which keeps the sha256sum of files to avoid computing it twice. The function can now take a HASH as a second argument, which can contain the key remove_cache indicating that the sha256sum of a file should be cleared: we use this when we find that a file has the wrong checksum and needs to be downloaded again. --- lib/RBM.pm | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/lib/RBM.pm b/lib/RBM.pm index f419c24..375648f 100644 --- a/lib/RBM.pm +++ b/lib/RBM.pm @@ -610,6 +610,11 @@ sub maketar { sub sha256file { CORE::state %res; my $f = rbm_path(shift); + my $opt = shift; + if (ref $opt eq 'HASH' && $opt->{remove_cache}) { + delete $res{$f}; + return; + } return $res{$f} if exists $res{$f}; return $res{$f} = -f $f ? sha256_hex(path($f)->slurp_raw) : ''; } @@ -724,7 +729,8 @@ sub input_file_need_dl { return undef if $action eq 'getfpaths'; if ($fname && $input_file->{sha256sum} - && $t->('sha256sum') ne sha256_hex(path($fname)->slurp_raw)) { + && $t->('sha256sum') ne sha256file($fname)) { + sha256file($fname, { remove_cache => 1 }); $fname = undef; } if ($action eq 'input_files_id') { @@ -928,7 +934,7 @@ sub input_files { } exit_error "Missing file $name" unless $fname; if ($t->('sha256sum') - && $t->('sha256sum') ne sha256_hex(path($fname)->slurp_raw)) { + && $t->('sha256sum') ne sha256file($fname)) { exit_error "Can't have sha256sum on directory: $fname" if -d $fname; exit_error "Wrong sha256sum for $fname.\n" . "Expected sha256sum: " . $t->('sha256sum');

1 0

[tor-browser-build/master] Bug 33380: Add *.json to sha256sums-unsigned-build.txt
by sysrqb＠torproject.org 19 Feb '20

19 Feb '20

commit 19497b09ae5f68768a1d2690249b51b6fca89b41 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Feb 19 12:51:44 2020 +0100 Bug 33380: Add *.json to sha256sums-unsigned-build.txt --- projects/release/build | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/release/build b/projects/release/build index c1badd6..c859828 100644 --- a/projects/release/build +++ b/projects/release/build @@ -46,7 +46,7 @@ RewriteRule ^sha256sums.txt.asc$ sha256sums-unsigned-build.txt.asc RewriteRule ^sha256sums.incrementals.txt$ sha256sums-unsigned-build.incrementals.txt RewriteRule ^sha256sums.incrementals.txt.asc$ sha256sums-unsigned-build.incrementals.txt.asc EOF -sha256sum $(ls -1 *.exe *.tar.xz *.dmg *.mar *.zip *.tar.gz *.apk | grep -v '\.incremental\.mar$' | sort) > sha256sums-unsigned-build.txt +sha256sum $(ls -1 *.exe *.tar.xz *.dmg *.mar *.zip *.tar.gz *.apk *.json | grep -v '\.incremental\.mar$' | sort) > sha256sums-unsigned-build.txt [% IF c("var/sign_build") -%] gpg -abs [% c("var/sign_build_gpg_opts") %] sha256sums-unsigned-build.txt [% END -%]

1 0

[tor-browser-build/master] Small typos in 9.5a5 changelog
by sysrqb＠torproject.org 14 Feb '20

14 Feb '20

commit 0e2585be3ab2a4dc5b533c87d8745b0bf4a75bc4 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Fri Feb 14 16:28:35 2020 +0000 Small typos in 9.5a5 changelog --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 16acbbf..72bb219 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -14,11 +14,11 @@ Tor Browser 9.5a5 -- February 12 2020 * Android * Bug 30767: Custom obfs4 bridge does not work on Tor Browser for Android * Windows + OS X + Linux - * Update Tor to 0.4.3.1-alpha + * Update Tor to 0.4.3.2-alpha * Update Tor Launcher to 0.2.21.1 * Translations update * Bug 30237: Add v3 onion services client authentication prompt - * Bug 32870: Update version of pion-webrtc + * Bug 32870: Update version of pion-webrtc * Bug 32767: Remove Disconnect search * Bug 30237: Add v3 onion services client authentication prompt * Build System

1 0