- tbb-commits - lists.torproject.org

[tor-browser/tor-browser-60.6.1esr-8.5-2] Revert "Bug 30388: Disable nocertdb pref for armagadd-on 2.0 cert inclusion if needed"
by gk＠torproject.org 06 May '19

06 May '19

commit 41d319a845bcd8f6f918e371f70a86e632d3c6e4 Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 6 20:37:56 2019 +0000 Revert "Bug 30388: Disable nocertdb pref for armagadd-on 2.0 cert inclusion if needed" This reverts commit 1ca734a5a94048a925ea455ff3a5ee780f1653cc. --- toolkit/mozapps/extensions/internal/XPIProvider.jsm | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/toolkit/mozapps/extensions/internal/XPIProvider.jsm b/toolkit/mozapps/extensions/internal/XPIProvider.jsm index 3aa0e41b625f..6cffc02d90ba 100644 --- a/toolkit/mozapps/extensions/internal/XPIProvider.jsm +++ b/toolkit/mozapps/extensions/internal/XPIProvider.jsm @@ -1824,13 +1824,6 @@ function addMissingIntermediateCertificate() { } logger.debug("hotfix for addon signing cert has not been applied; applying"); - // temporarily disable nocertb so we can write cert - const PREF_NOCERTDB = "security.nocertdb"; - let userNocertdb = Services.prefs.getBoolPref(PREF_NOCERTDB, true); - if (userNocertdb) { - Services.prefs.setBoolPref(PREF_NOCERTDB, false); - } - try { let certDB = Cc["@mozilla.org/security/x509certdb;1"].getService(Ci.nsIX509CertDB); certDB.addCertFromBase64(MISSING_INTERMEDIATE_CERTIFICATE, ",,"); @@ -1838,11 +1831,6 @@ function addMissingIntermediateCertificate() { } catch (e) { logger.error("failed to add new intermediate certificate:", e); return; - } finally { - // revert nocertdb pref to original value (even if exception thrown) - if (userNocertdb) { - Services.prefs.setBoolPref(PREF_NOCERTDB, true); - } } Services.prefs.setBoolPref(PREF_SIGNER_HOTFIXED, true);

1 0

[tor-browser/tor-browser-60.6.1esr-8.5-2] Bug 30388: Set security.nocertdb to false for now
by gk＠torproject.org 06 May '19

06 May '19

commit e849f24b13ba8fd058c43510eac861db2037ff74 Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 6 09:17:41 2019 +0000 Bug 30388: Set security.nocertdb to false for now --- browser/app/profile/000-tor-browser.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index c810c18a84a1..b6fcff155af8 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -48,7 +48,7 @@ pref("browser.cache.offline.enable", false); pref("permissions.memory_only", true); pref("network.cookie.lifetimePolicy", 2); pref("browser.download.manager.retention", 1); -pref("security.nocertdb", true); +pref("security.nocertdb", false); // Disk activity: TBB Directory Isolation pref("browser.download.useDownloadDir", false);

1 0

[tor-browser-build/maint-8.0] Update Changelog and bump Torbutton version
by gk＠torproject.org 06 May '19

06 May '19

commit da99fd25b9543af42ca7519554ed64ff1e56b3f6 Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 6 10:00:04 2019 +0000 Update Changelog and bump Torbutton version --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 4 +++- projects/torbutton/config | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 3c9ffb6..2d6a6c5 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,7 +1,9 @@ Tor Browser 8.0.9 -- May 7 2019 * All platforms + * Update Torbutton to 2.0.13 + * Bug 30388: Make sure the updated intermediate certificate keeps working * Backport fixes for bug 1549010 and bug 1549061 - * Bug 30388: NoScript and all user-installed add-ons got deactivated + * Bug 30388: Make sure the updated intermediate certificate keeps working * Update NoScript to 10.6.1 * Bug 29872: XSS popup with DuckDuckGo search on about:tor diff --git a/projects/torbutton/config b/projects/torbutton/config index 0d66ae0..7354339 100644 --- a/projects/torbutton/config +++ b/projects/torbutton/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 2.0.11 +version: 2.0.13 git_url: https://git.torproject.org/torbutton.git git_hash: '[% c("version") %]' gpg_keyring: torbutton.gpg

1 0

[torbutton/maint-2.0] Release preparations for 2.0.13
by gk＠torproject.org 06 May '19

06 May '19

commit 2b495c489fa9cbffc20794b45c4017659d2256b0 Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 6 09:55:50 2019 +0000 Release preparations for 2.0.13 Skip 2.0.12 as the version number in the CHANGELOG file was wrong. --- src/CHANGELOG | 2 +- src/install.rdf | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/CHANGELOG b/src/CHANGELOG index 159a6c6d..83d09b53 100644 --- a/src/CHANGELOG +++ b/src/CHANGELOG @@ -1,4 +1,4 @@ -2.0.11 +2.0.13 * Bug 30388: Make sure the updated intermediate certificate is working 2.0.11 diff --git a/src/install.rdf b/src/install.rdf index df31f08f..db5a3fc2 100644 --- a/src/install.rdf +++ b/src/install.rdf @@ -6,7 +6,7 @@ <em:name>Torbutton</em:name> <em:creator>Mike Perry</em:creator> <em:id>torbutton(a)torproject.org</em:id> - <em:version>2.0.12</em:version> + <em:version>2.0.13</em:version> <em:multiprocessCompatible>true</em:multiprocessCompatible> <em:homepageURL>https://www.torproject.org/projects/torbrowser.html.en</em:homepageURL> <em:iconURL>chrome://torbutton/skin/tor.png</em:iconURL>

1 0

[torbutton/maint-2.0] Bug 30388: Don't touch security.nocertdb for now
by gk＠torproject.org 06 May '19

06 May '19

commit 2b7e1bda855b74feb3a1e44d637d14572696e514 Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 6 09:48:18 2019 +0000 Bug 30388: Don't touch security.nocertdb for now --- src/chrome/content/torbutton.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index 9f6ba898..67fde99b 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -1489,7 +1489,8 @@ function torbutton_update_disk_prefs() { m_tb_prefs.setBoolPref("browser.cache.disk.enable", !mode); m_tb_prefs.setBoolPref("places.history.enabled", !mode); - m_tb_prefs.setBoolPref("security.nocertdb", mode); + // Don't touch that pref for now, see: #30388. + //m_tb_prefs.setBoolPref("security.nocertdb", mode); // No way to clear this beast during New Identity. Leave it off. //m_tb_prefs.setBoolPref("dom.indexedDB.enabled", !mode);

1 0

[torbutton/maint-2.0] Release prep for 2.0.12
by gk＠torproject.org 06 May '19

06 May '19

commit 4f9f2f9914765f543c0319db19be3dba4545d891 Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 6 09:51:06 2019 +0000 Release prep for 2.0.12 Version bump, Changelog update --- src/CHANGELOG | 3 +++ src/install.rdf | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/src/CHANGELOG b/src/CHANGELOG index b8d462ac..159a6c6d 100644 --- a/src/CHANGELOG +++ b/src/CHANGELOG @@ -1,4 +1,7 @@ 2.0.11 + * Bug 30388: Make sure the updated intermediate certificate is working + +2.0.11 * Bug 29021: Tell NoScript it is running within Tor Browser 2.0.10 diff --git a/src/install.rdf b/src/install.rdf index 1aa768b4..df31f08f 100644 --- a/src/install.rdf +++ b/src/install.rdf @@ -6,7 +6,7 @@ <em:name>Torbutton</em:name> <em:creator>Mike Perry</em:creator> <em:id>torbutton(a)torproject.org</em:id> - <em:version>2.0.11</em:version> + <em:version>2.0.12</em:version> <em:multiprocessCompatible>true</em:multiprocessCompatible> <em:homepageURL>https://www.torproject.org/projects/torbrowser.html.en</em:homepageURL> <em:iconURL>chrome://torbutton/skin/tor.png</em:iconURL>

1 0

[tor-browser-build/maint-8.0] Picking up a better fix for #30388
by gk＠torproject.org 06 May '19

06 May '19

commit f723463880ffab1c5f7f38185e3d3276c610f9fc Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 6 09:44:42 2019 +0000 Picking up a better fix for #30388 --- projects/firefox/config | 2 +- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 2 +- rbm.conf | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/projects/firefox/config b/projects/firefox/config index 2d0712e..ef6c3d6 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' filename: 'firefox-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build2' +git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build3' tag_gpg_id: 1 git_url: https://git.torproject.org/tor-browser.git gpg_keyring: torbutton.gpg diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 197b951..3c9ffb6 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,4 +1,4 @@ -Tor Browser 8.0.9 -- May 6 2019 +Tor Browser 8.0.9 -- May 7 2019 * All platforms * Backport fixes for bug 1549010 and bug 1549061 * Bug 30388: NoScript and all user-installed add-ons got deactivated diff --git a/rbm.conf b/rbm.conf index f46ece9..421bb57 100644 --- a/rbm.conf +++ b/rbm.conf @@ -16,7 +16,7 @@ buildconf: var: torbrowser_version: '8.0.9' - torbrowser_build: 'build1' + torbrowser_build: 'build2' torbrowser_incremental_from: - 8.0.8 project_name: tor-browser

1 0

[tor-browser/tor-browser-60.6.1esr-8.0-1] Bug 30388: Set security.nocertdb to false for now
by gk＠torproject.org 06 May '19

06 May '19

commit 24a43ea1332c6a2ca2bc7a952ddf04af669d0517 Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 6 09:17:41 2019 +0000 Bug 30388: Set security.nocertdb to false for now --- browser/app/profile/000-tor-browser.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 8f74748f2072..e96493a5fb57 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -47,7 +47,7 @@ pref("browser.cache.offline.enable", false); pref("permissions.memory_only", true); pref("network.cookie.lifetimePolicy", 2); pref("browser.download.manager.retention", 1); -pref("security.nocertdb", true); +pref("security.nocertdb", false); // Disk activity: TBB Directory Isolation pref("browser.download.useDownloadDir", false);

1 0

[tor-browser/tor-browser-60.6.1esr-8.0-1] Revert "Bug 30388: Disable nocertdb pref for armagadd-on 2.0 cert inclusion if needed"
by gk＠torproject.org 06 May '19

06 May '19

commit dbf8e349d5813a918b3adc4229b0813a72778138 Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 6 09:13:32 2019 +0000 Revert "Bug 30388: Disable nocertdb pref for armagadd-on 2.0 cert inclusion if needed" This reverts commit edf18e747ca8949a877f9c41575ce679ce99eb77. --- toolkit/mozapps/extensions/internal/XPIProvider.jsm | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/toolkit/mozapps/extensions/internal/XPIProvider.jsm b/toolkit/mozapps/extensions/internal/XPIProvider.jsm index 2c6691d40c2a..10b21d5cb5fd 100644 --- a/toolkit/mozapps/extensions/internal/XPIProvider.jsm +++ b/toolkit/mozapps/extensions/internal/XPIProvider.jsm @@ -1814,13 +1814,6 @@ function addMissingIntermediateCertificate() { } logger.debug("hotfix for addon signing cert has not been applied; applying"); - // temporarily disable nocertb so we can write cert - const PREF_NOCERTDB = "security.nocertdb"; - let userNocertdb = Services.prefs.getBoolPref(PREF_NOCERTDB, true); - if (userNocertdb) { - Services.prefs.setBoolPref(PREF_NOCERTDB, false); - } - try { let certDB = Cc["@mozilla.org/security/x509certdb;1"].getService(Ci.nsIX509CertDB); certDB.addCertFromBase64(MISSING_INTERMEDIATE_CERTIFICATE, ",,"); @@ -1828,11 +1821,6 @@ function addMissingIntermediateCertificate() { } catch (e) { logger.error("failed to add new intermediate certificate:", e); return; - } finally { - // revert nocertdb pref to original value (even if exception thrown) - if (userNocertdb) { - Services.prefs.setBoolPref(PREF_NOCERTDB, true); - } } Services.prefs.setBoolPref(PREF_SIGNER_HOTFIXED, true);

1 0

[tor-browser/tor-browser-60.6.1esr-8.5-1] Bug 1549061 - Add intermediate certificate [ESR60] r=kmag a=tomprince CLOSED TREE
by gk＠torproject.org 06 May '19

06 May '19

commit 178fcbbe24f543a15b165bdc680a5083247e87a3 Author: Mark Goodwin <mgoodwin(a)mozilla.com> Date: Sat May 4 16:58:30 2019 +0000 Bug 1549061 - Add intermediate certificate [ESR60] r=kmag a=tomprince CLOSED TREE This patch relies on a schema bump in a previous commit Differential Revision: https://phabricator.services.mozilla.com/D29947 --HG-- extra : source : bfd165fd51ec90777db01c21e3b727328a5ea1a3 --- .../mozapps/extensions/internal/XPIProvider.jsm | 28 ++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/toolkit/mozapps/extensions/internal/XPIProvider.jsm b/toolkit/mozapps/extensions/internal/XPIProvider.jsm index 8079f3460e0a..6cffc02d90ba 100644 --- a/toolkit/mozapps/extensions/internal/XPIProvider.jsm +++ b/toolkit/mozapps/extensions/internal/XPIProvider.jsm @@ -1813,6 +1813,29 @@ var XPIStates = { }, }; +// https://bugzilla.mozilla.org/show_bug.cgi?id=1548973 +const MISSING_INTERMEDIATE_CERTIFICATE = "MIIHLTCCBRWgAwIBAgIDEAAIMA0GCSqGSIb3DQEBDAUAMH0xCzAJBgNVBAYTAlVTMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMS8wLQYDVQQLEyZNb3ppbGxhIEFNTyBQcm9kdWN0aW9uIFNpZ25pbmcgU2VydmljZTEfMB0GA1UEAxMWcm9vdC1jYS1wcm9kdWN0aW9uLWFtbzAeFw0xNTA0MDQwMDAwMDBaFw0yNTA0MDQwMDAwMDBaMIGnMQswCQYDVQQGEwJVUzEcMBoGA1UEChMTTW96aWxsYSBDb3Jwb3JhdGlvbjEvMC0GA1UECxMmTW96aWxsYSBBTU8gUHJvZHVjdGlvbiBTaWduaW5nIFNlcnZpY2UxJjAkBgNVBAMTHXNpZ25pbmdjYTEuYWRkb25zLm1vemlsbGEub3JnMSEwHwYJKoZIhvcNAQkBFhJmb3hzZWNAbW96aWxsYS5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC/qluiiI+wO6qGA4vH7cHvWvXpdju9JnvbwnrbYmxhtUpfS68LbdjGGtv7RP6F1XhHT4MU3v4GuMulH0E4Wfalm8evsb3tBJRMJPICJX5UCLi6VJ6J2vipXSWBf8xbcOB+PY5Kk6L+EZiWaepiM23CdaZjNOJCAB6wFHlGe+zUk87whpLa7GrtrHjTb8u9TSS+mwjhvgfP8ILZrWhzb5H/ybgmD7jYaJGIDY/WDmq1gVe03fShxD09Ml1P7H38o5kbFLnbbqpqC6n8SfUI31MiJAXAN2e6rAOM8EmocAY0EC5KUooXKRsYvHzhwwHkwIbbe6QpTUlIqvw1MPlQPs7Zu/MBnVmyGTSqJxtYoklr0MaEXnJNY3g3FDf1R0Opp2/BEY9Vh3Fc9Pq6qWIhGoMyWdueoSYa+GURqDbsuYnk7Zk ysxK+yRoFJu4x3TUBmMKM14jQKLgxvuIzWVn6qg6cw7ye/DYNufc+DSPSTSakSsWJ9IPxiAU7xJ+GCMzaZ10Y3VGOybGLuPxDlSd6KALAoMcl9ghB2mvfB0N3wv6uWnbKuxihq/qDps+FjliNvr7C66mIVH+9rkyHIy6GgIUlwr7E88Qqw+SQeNeph6NIY85PL4p0Y8KivKP4J928tpp18wLuHNbIG+YaUk5WUDZ6/2621pi19UZQ8iiHxN/XKQIDAQABo4IBiTCCAYUwDAYDVR0TBAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwMwHQYDVR0OBBYEFBY++xz/DCuT+JsV1y2jwuZ4YdztMIGoBgNVHSMEgaAwgZ2AFLO86lh0q+FueCqyq5wjHqhjLJe3oYGBpH8wfTELMAkGA1UEBhMCVVMxHDAaBgNVBAoTE01vemlsbGEgQ29ycG9yYXRpb24xLzAtBgNVBAsTJk1vemlsbGEgQU1PIFByb2R1Y3Rpb24gU2lnbmluZyBTZXJ2aWNlMR8wHQYDVQQDExZyb290LWNhLXByb2R1Y3Rpb24tYW1vggEBMDMGCWCGSAGG+EIBBAQmFiRodHRwOi8vYWRkb25zLm1vemlsbGEub3JnL2NhL2NybC5wZW0wTgYDVR0eBEcwRaFDMCCCHi5jb250ZW50LXNpZ25hdHVyZS5tb3ppbGxhLm9yZzAfgh1jb250ZW50LXNpZ25hdHVyZS5tb3ppbGxhLm9yZzANBgkqhkiG9w0BAQwFAAOCAgEAX1PNli/zErw3tK3S9Bv803RV4tHkrMa5xztxzlWja0VAUJKEQx7f1yM8vmcQJ9g5RE8WFc43IePwzbAoum5F4BTM7tqM//+e476F1YUgB7SnkDTVpBOnV5vRLz1Si4iJ/U0HUvMUvNJEweXvKg/DNbXuCreSvTEAawmRIxqNYoaigQD8x4hC zGcVtIi5Xk2aMCJW2K/6JqkN50pnLBNkPx6FeiYMJCP8z0FIz3fv53FHgu3oeDhi2u3VdONjK3aaFWTlKNiGeDU0/lr0suWfQLsNyphTMbYKyTqQYHxXYJno9PuNi7e1903PvM47fKB5bFmSLyzB1hB1YIVLj0/YqD4nz3lADDB91gMBB7vR2h5bRjFqLOxuOutNNcNRnv7UPqtVCtLF2jVb4/AmdJU78jpfDs+BgY/t2bnGBVFBuwqS2Kult/2kth4YMrL5DrURIM8oXWVQRBKxzr843yDmHo8+2rqxLnZcmWoe8yQ41srZ4IB+V3w2TIAd4gxZAB0Xa6KfnR4D8RgE5sgmgQoK7Y/hdvd9Ahu0WEZI8Eg+mDeCeojWcyjF+dt6c2oERiTmFTIFUoojEjJwLyIqHKt+eApEYpF7imaWcumFN1jR+iUjE4ZSUoVxGtZ/Jdnkf8VVQMhiBA+i7r5PsfrHq+lqTTGOg+GzYx7OmoeJAT0zo4c="; + +function addMissingIntermediateCertificate() { + const PREF_SIGNER_HOTFIXED = "extensions.signer.hotfixed"; + let hotfixApplied = Services.prefs.getBoolPref(PREF_SIGNER_HOTFIXED, false); + if (hotfixApplied) { + return; + } + logger.debug("hotfix for addon signing cert has not been applied; applying"); + + try { + let certDB = Cc["@mozilla.org/security/x509certdb;1"].getService(Ci.nsIX509CertDB); + certDB.addCertFromBase64(MISSING_INTERMEDIATE_CERTIFICATE, ",,"); + logger.debug("new intermediate certificate added"); + } catch (e) { + logger.error("failed to add new intermediate certificate:", e); + return; + } + + Services.prefs.setBoolPref(PREF_SIGNER_HOTFIXED, true); +} + var XPIProvider = { get name() { return "XPIProvider"; @@ -2121,6 +2144,11 @@ var XPIProvider = { XPIProvider.installLocationsByName[location.name] = location; } + // Add missing certificate (bug 1548973). Mistakenly disabled add-ons are + // going to be re-enabled because the schema version bump forces a new + // signature verification check. + addMissingIntermediateCertificate(); + try { AddonManagerPrivate.recordTimestamp("XPI_startup_begin");

1 0