- tbb-commits - lists.torproject.org

[rbm/master] Bug 30480: Check that a signed tag object contains the expected tag name
by gk＠torproject.org 27 May '19

27 May '19

commit e04f03f9626e993bb66d7784d258f95ca07bc769 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu May 16 12:38:08 2019 +0200 Bug 30480: Check that a signed tag object contains the expected tag name When checking the signature on a tag, we also need to check that the tag is really the expected tag in order to avoid rollback attacks. Thanks to Santiago Torres-Arias and Keving Gallagher from NYU for reporting and helping to fix this issue. --- lib/RBM.pm | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/lib/RBM.pm b/lib/RBM.pm index 4416a0c..75912af 100644 --- a/lib/RBM.pm +++ b/lib/RBM.pm @@ -308,6 +308,16 @@ sub git_commit_sign_id { return gpg_get_fingerprint(@l); } +sub git_get_signed_tagname { + foreach my $l (split(/\n/, $_[0])) { + # the tag message is separated from headers by an empty line, so we + # ignore anything after the first empty line + return '' unless $l; + return $1 if $l =~ m/^tag (.*)$/; + } + return ''; +} + sub git_tag_sign_id { my ($project, $tag) = @_; my $w = set_git_gpg_wrapper($project); @@ -315,6 +325,7 @@ sub git_tag_sign_id { = capture_exec('git', 'tag', '-v', $tag); unset_git_gpg_wrapper($w); return undef unless $success; + return undef unless git_get_signed_tagname($stdout) eq $tag; return gpg_get_fingerprint(split /\n/, $stderr); }

1 0

[tor-browser-build/master] Merge branch 'bug_30491'
by gk＠torproject.org 27 May '19

27 May '19

commit 734f6d1d8cf70fafaafad687513665477095f2fa Merge: 32f6ddd cfa06e4 Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 27 06:34:40 2019 +0000 Merge branch 'bug_30491' projects/debootstrap-image/config | 18 ------------------ projects/rust/config | 1 + rbm.conf | 2 +- 3 files changed, 2 insertions(+), 19 deletions(-)

1 0

[tor-browser-build/master] Bug 30491: Move our macOS builds to Debian Stretch
by gk＠torproject.org 27 May '19

27 May '19

commit cfa06e43015e845c4350b8019c465860f655e1b9 Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 20 12:16:27 2019 +0000 Bug 30491: Move our macOS builds to Debian Stretch --- projects/debootstrap-image/config | 18 ------------------ projects/rust/config | 1 + rbm.conf | 2 +- 3 files changed, 2 insertions(+), 19 deletions(-) diff --git a/projects/debootstrap-image/config b/projects/debootstrap-image/config index 99326dd..cad9c77 100644 --- a/projects/debootstrap-image/config +++ b/projects/debootstrap-image/config @@ -58,24 +58,6 @@ targets: arch: amd64 debootstrap_mirror: "http://archive.debian.org/debian/" - jessie-amd64: - var: - minimal_apt_version: 1.0.9.8.5 - # https://lists.debian.org/debian-lts-announce/2019/01/msg00014.html - apt_packages_baseurl: http://security.debian.org/debian-security/pool/updates/main/a/apt - apt_package_filename: apt_1.0.9.8.5_amd64.deb - apt_package_sha256sum: 4078748632abc19836d045f80f9d6933326065ca1d47367909a0cf7f29e7dfe8 - apt_utils_package_filename: apt-utils_1.0.9.8.5_amd64.deb - apt_utils_package_sha256sum: 87c55d9ccadcabd59674873c221357c774020c116afd978fb9df6d2d0303abf2 - libapt_inst_package_filename: libapt-inst1.5_1.0.9.8.5_amd64.deb - libapt_inst_package_sha256sum: f9615532b1577b3d1455fa51839ce91765f2860eb3a6810fb5e0de0c87253030 - libapt_pkg_package_filename: libapt-pkg4.12_1.0.9.8.5_amd64.deb - libapt_pkg_package_sha256sum: 295d9c69854a4cfbcb46001b09b853f5a098a04c986fc5ae01a0124c1c27e6bd - - container: - suite: jessie - arch: amd64 - stretch-amd64: var: minimal_apt_version: 1.4.9 diff --git a/projects/rust/config b/projects/rust/config index 8d65fc6..2ed48c0 100644 --- a/projects/rust/config +++ b/projects/rust/config @@ -75,6 +75,7 @@ targets: arch_deps: - libssl-dev - pkg-config + - zlib1g-dev configure_opt: --enable-local-rust --enable-vendor --enable-extended --release-channel=stable --sysconfdir=etc --target=x86_64-apple-darwin --set=target.x86_64-apple-darwin.cc=x86_64-apple-darwin-clang windows: diff --git a/rbm.conf b/rbm.conf index ee805fc..2e9abf1 100644 --- a/rbm.conf +++ b/rbm.conf @@ -312,7 +312,7 @@ targets: osx: 1 osname: osx-x86_64 container: - suite: jessie + suite: stretch arch: amd64 compiler: 'macosx-toolchain' configure_opt: '--host=x86_64-apple-darwin11 CC="x86_64-apple-darwin11-clang [% c("var/FLAGS") %]" CXX="x86_64-apple-darwin11-clang++ [% c("var/FLAGS") %]"'

1 0

[tor-browser-build/master] Merge commit '4674d8a76619eb05562d81b3f77756cce1ebfe9d'
by gk＠torproject.org 27 May '19

27 May '19

commit 32f6ddd0869e3e24136218b8158c605263dc730e Merge: ae8f6de 4674d8a Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 27 06:33:32 2019 +0000 Merge commit '4674d8a76619eb05562d81b3f77756cce1ebfe9d' projects/go/config | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

1 0

[tor-browser-build/master] Bug 30536: Update Go to 1.12.5
by gk＠torproject.org 27 May '19

27 May '19

commit 4674d8a76619eb05562d81b3f77756cce1ebfe9d Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 20 07:57:22 2019 +0000 Bug 30536: Update Go to 1.12.5 We use the upgrade to 1.12.x mainly to be able to make progress with moving our macOS cross-builds to Debian Stretch. See: #30491 for more details. --- projects/go/config | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/projects/go/config b/projects/go/config index c039b04..0d0a2d4 100644 --- a/projects/go/config +++ b/projects/go/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 1.11.5 +version: 1.12.5 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' var: @@ -87,7 +87,7 @@ input_files: enable: '[% c("var/windows") || c("var/osx") %]' - URL: 'https://golang.org/dl/go[% c("version") %].src.tar.gz' name: go - sha256sum: bc1ef02bb1668835db1390a2e478dcbccb5dd16911691af9d75184bbe5aa943e + sha256sum: 2aa5f088cbb332e73fc3def546800616b38d3bfe6b8713b8a6404060f22503e8 - URL: 'https://golang.org/dl/go[% c("var/go14_version") %].src.tar.gz' name: go14 sha256sum: 9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959

1 0

[tor-browser-build/master] Merge remote-tracking branch 'gk/bug_25930_v3'
by boklm＠torproject.org 24 May '19

24 May '19

commit ae8f6de9939dd372945bea063245ab7123019cb6 Merge: 51e5e85 e8bf133 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri May 24 12:20:44 2019 +0200 Merge remote-tracking branch 'gk/bug_25930_v3' projects/gcc/config | 4 ++-- projects/tor/build | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)

1 0

[tor-browser-build/master] Bug 25930: Update GCC to 8.3.0 for our Linux builds
by boklm＠torproject.org 24 May '19

24 May '19

commit e8bf1330d8e5e5ccc48d69d47ab424ce746c30ee Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 13 06:37:38 2019 +0000 Bug 25930: Update GCC to 8.3.0 for our Linux builds --- projects/gcc/config | 4 ++-- projects/tor/build | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/projects/gcc/config b/projects/gcc/config index 88dabdd..9fef3c4 100644 --- a/projects/gcc/config +++ b/projects/gcc/config @@ -1,6 +1,6 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' -version: 6.4.0 +version: 8.3.0 var: container: use_container: 1 @@ -52,4 +52,4 @@ targets: input_files: - project: container-image - URL: 'https://ftp.gnu.org/gnu/gcc/gcc-[% c("version") %]/gcc-[% c("version") %].tar.xz' - sha256sum: 850bf21eafdfe5cd5f6827148184c08c4a0852a37ccf36ce69855334d2c914d4 + sha256sum: 64baadfe6cc0f4947a84cb12d7f0dfaf45bb58b7e92461639596c21e02d97d2c diff --git a/projects/tor/build b/projects/tor/build index 7f9fd53..a9305d6 100644 --- a/projects/tor/build +++ b/projects/tor/build @@ -61,8 +61,8 @@ openssldir=/var/tmp/dist/openssl mkdir -p "$distdir/Tor/libstdc++" cp /var/tmp/dist/gcc/[% c("var/libdir") %]/libstdc++.so.6 "$distdir/Tor/libstdc++/" [% IF c("var/asan") -%] - cp /var/tmp/dist/gcc/[% c("var/libdir") %]/libasan.so.3 "$distdir/Tor/" - cp /var/tmp/dist/gcc/[% c("var/libdir") %]/libubsan.so.0 "$distdir/Tor/" + cp /var/tmp/dist/gcc/[% c("var/libdir") %]/libasan.so.5 "$distdir/Tor/" + cp /var/tmp/dist/gcc/[% c("var/libdir") %]/libubsan.so.1 "$distdir/Tor/" [% END -%] chmod 700 "$distdir"/Tor/*.so* chmod 700 "$distdir"/Tor/libstdc++/*.so*

1 0

[tor-browser-build/master] Fold in 8.5 Changelog
by gk＠torproject.org 24 May '19

24 May '19

commit 51e5e85e1e0d021d7e91bcf86f9a85cb42e19edd Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 24 10:15:35 2019 +0000 Fold in 8.5 Changelog --- .../tor-browser/Bundle-Data/Docs/ChangeLog.txt | 126 +++++++++++++++++++++ 1 file changed, 126 insertions(+) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 8ea6f9f..42d43ce 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -58,6 +58,132 @@ Tor Browser 9.0a1 -- May 21 2019 * Bug 30404: Remove Orbot Project * Bug 30280: Wrong SHA-256 sum for j2objc-annotations-1.1.jar +Tor Browser 8.5 -- May 21 2019 + * All platforms + * Update Firefox to 60.7.0esr + * Update Torbutton to 2.1.8 + * Bug 25013: Integrate Torbutton into tor-browser for Android + * Bug 27111: Update about:tor desktop version to work on mobile + * Bug 22538+22513: Fix new circuit button for error pages + * Bug 25145: Update circuit display when back button is pressed + * Bug 27749: Opening about:config shows circuit from previous website + * Bug 30115+27449+25145: Map browser+domain to credentials to fix circuit display + * Bug 25702: Update Tor Browser icon to follow design guidelines + * Bug 21805: Add click-to-play button for WebGL + * Bug 28836: Links on about:tor are not clickable + * Bug 30171: Don't sync cookie.cookieBehavior and firstparty.isolate + * Bug 29825: Intelligently add new Security Level button to taskbar + * Bug 29903: No WebGL click-to-play on the standard security level + * Bug 27290: Remove WebGL pref for min capability mode + * Bug 25658: Replace security slider with security level UI + * Bug 28628: Change onboarding Security panel to open new Security Level panel + * Bug 29440: Update about:tor when Tor Browser is updated + * Bug 27478: Improved Torbutton icons for dark theme + * Bug 29239: Don't ship the Torbutton .xpi on mobile + * Bug 27484: Improve navigation within onboarding (strings) + * Bug 29768: Introduce new features to users (strings) + * Bug 28093: Update donation banner style to make it fit in small screens + * Bug 28543: about:tor has scroll bar between widths 900px and 1000px + * Bug 28039: Enable dump() if log method is 0 + * Bug 27701: Don't show App Blocker dialog on Android + * Bug 28187: Change tor circuit icon to torbutton.svg + * Bug 29943: Use locales in AB-CD scheme to match Mozilla + * Bug 26498: Add locale: es-AR + * Bug 28082: Add locales cs, el, hu, ka + * Bug 29973: Remove remaining stopOpenSecuritySettingsObserver() pieces + * Bug 28075: Tone down missing SOCKS credential warning + * Bug 30425: Revert armagadd-on-2.0 changes + * Bug 30497: Add Donate link to about:tor + * Bug 30069: Use slider and about:tor localizations on mobile + * Bug 21263: Remove outdated information from the README + * Bug 28747: Remove NoScript (XPCOM) related unused code + * Translations update + * Code clean-up + * Update HTTPS Everywhere to 2019.5.6.1 + * Bug 27290: Remove WebGL pref for min capability mode + * Bug 29120: Enable media cache in memory + * Bug 24622: Proper first-party isolation of s3.amazonaws.com + * Bug 29082: Backport patches for bug 1469916 + * Bug 28711: Backport patches for bug 1474659 + * Bug 27828: "Check for Tor Browser update" doesn't seem to do anything + * Bug 29028: Auto-decline most canvas warning prompts again + * Bug 27919: Backport SSL status API + * Bug 27597: Fix our debug builds + * Bug 28082: Add locales cs, el, hu, ka + * Bug 26498: Add locale: es-AR + * Bug 29916: Make sure enterprise policies are disabled + * Bug 29349: Remove network.http.spdy.* overrides from meek helper user.js + * Bug 29327: TypeError: hostName is null on about:tor page + * Bug 30425: Revert armagadd-on-2.0 changes + * Windows + OS X + Linux + * Update OpenSSL to 1.0.2r + * Update Tor Launcher to 0.2.18.3 + * Bug 27994+25151: Use the new Tor Browser logo + * Bug 29328: Account for Tor 0.4.0.x's revised bootstrap status reporting + * Bug 22402: Improve "For assistance" link + * Bug 27994: Use the new Tor Browser logo + * Bug 25405: Cannot use Moat if a meek bridge is configured + * Bug 27392: Update Moat URLs + * Bug 28082: Add locales cs, el, hu, ka + * Bug 26498: Add locale es-AR + * Bug 28039: Enable dump() if log method is 0 + * Translations update + * Bug 25702: Activity 1.1 Update Tor Browser icon to follow design guidelines + * Bug 28111: Use Tor Browser icon in identity box + * Bug 22343: Make 'Save Page As' obey first-party isolation + * Bug 29768: Introduce new features to users + * Bug 27484: Improve navigation within onboarding + * Bug 25658+29554: Replace security slider with security level UI + * Bug 25405: Cannot use Moat if a meek bridge is configured + * Bug 28885: Notify users that update is downloading + * Bug 29180: MAR download stalls when about dialog is opened + * Bug 27485: Users are not taught how to open security-slider dialog + * Bug 27486: Avoid about:blank tabs when opening onboarding pages + * Bug 29440: Update about:tor when Tor Browser is updated + * Bug 23359: WebExtensions icons are not shown on first start + * Bug 28628: Change onboarding Security panel to open new Security Level panel + * Bug 27905: Fix many occurrences of "Firefox" in about:preferences + * Bug 28369: Stop shipping pingsender executable + * Bug 30457: Remove defunct default bridges + * Windows + * Bug 27503: Improve screen reader accessibility + * Bug 27865: Tor Browser 8.5a2 is crashing on Windows + * Bug 22654: Firefox icon is shown for Tor Browser on Windows 10 start menu + * Bug 28874: Bump mingw-w64 commit to fix WebGL crash + * Bug 12885: Windows Jump Lists fail for Tor Browser + * Bug 28618: Set MOZILLA_OFFICIAL for Windows build + * Bug 21704: Abort install if CPU is missing SSE2 support + * OS X + * Bug 27623: Use MOZILLA_OFFICIAL for our builds + * Linux + * Bug 28022: Use `/usr/bin/env bash` for bash invocation + * Bug 27623: Use MOZILLA_OFFICIAL for our builds + * Android + * Bug 5709: Ship Tor Browser for Android + * Build System + * All platforms + * Bug 25623: Disable network during build + * Bug 25876: Generate source tarballs during build + * Bug 28685: Set Build ID based on Tor Browser version + * Bug 29194: Set DEBIAN_FRONTEND=noninteractive + * Bug 29167: Upgrade go to 1.11.5 + * Bug 29158: Install updated apt packages (CVE-2019-3462) + * Bug 29097: Don't try to install python3.6-lxml for HTTPS Everywhere + * Bug 27061: Enable verification of langpacks checksums + * Windows + * Bug 26148: Update binutils to 2.31.1 + * Bug 27320: Build certutil for Windows + * OS X + * Bug 27320: Build certutil for macOS + * Linux + * Bug 26323+29812: Build 32bit Linux bundles on 64bit Debian Wheezy + * Bug 26148: Update binutils to 2.31.1 + * Bug 29758: Build firefox debug symbols for linux-i686 + * Bug 29966: Use archive.debian.org for Wheezy images + * Bug 29183: Use linux-x86_64 langpacks on linux-x86_64 + * Android + * Bug 29981: Add option to build without using containers + Tor Browser 8.5a12 -- May 7 2019 * All platforms * Update Torbutton to 2.1.7

1 0

[tor-browser-build/maint-8.5] Correct 8.5 Changelog
by gk＠torproject.org 24 May '19

24 May '19

commit b6549e4aaa3bce60faeaccd2b5454cb0d203580a Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 24 07:55:57 2019 +0000 Correct 8.5 Changelog Thanks Anonymous. --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 2 -- 1 file changed, 2 deletions(-) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 934f03a..83e2a2d 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -93,7 +93,6 @@ Tor Browser 8.5 -- May 21 2019 * Bug 12885: Windows Jump Lists fail for Tor Browser * Bug 28618: Set MOZILLA_OFFICIAL for Windows build * Bug 21704: Abort install if CPU is missing SSE2 support - * Bug 28002: Fix the precomplete file in the en-US installer * OS X * Bug 27623: Use MOZILLA_OFFICIAL for our builds * Linux @@ -103,7 +102,6 @@ Tor Browser 8.5 -- May 21 2019 * Bug 5709: Ship Tor Browser for Android * Build System * All platforms - * Bug 29868: Fix installation of python-future package * Bug 25623: Disable network during build * Bug 25876: Generate source tarballs during build * Bug 28685: Set Build ID based on Tor Browser version

1 0

[tor-browser-build/master] Compile go-webrtc with a non executable stack
by gk＠torproject.org 23 May '19

23 May '19

commit 24f585bf1851bfa022128a5b587b7c0940ec775c Author: Cecylia Bocovich <cohosh(a)torproject.org> Date: Mon May 13 22:44:22 2019 +0000 Compile go-webrtc with a non executable stack Ensure that cgo programs can be built with the nonexecstack ld flag Fix for bug #30451 --- projects/go-webrtc/config | 2 +- projects/go/config | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/projects/go-webrtc/config b/projects/go-webrtc/config index 5dbee5f..ba1e801 100644 --- a/projects/go-webrtc/config +++ b/projects/go-webrtc/config @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' git_url: https://github.com/keroserene/go-webrtc.git -git_hash: dcbfc825aa33471253a5da1834d499257e05d557 +git_hash: ed20e74ef428d6149a95bab8e63afb47af55c204 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' build: '[% c("projects/go/var/build_go_lib") %]' diff --git a/projects/go/config b/projects/go/config index c039b04..792da10 100644 --- a/projects/go/config +++ b/projects/go/config @@ -15,6 +15,10 @@ var: export GOARCH=[% c("var/GOARCH") %] export GOPATH=/var/tmp/dist/gopath export PATH=/var/tmp/dist/go/bin:/var/tmp/dist/gopath/bin:"$PATH" + [% IF c("var/linux") -%] + export CGO_LDFLAGS_ALLOW="-z|noexecstack" + export CGO_LDFLAGS="-z noexecstack" + [% END -%] [% IF c("var/linux-i686") -%] export CGO_ENABLED=1 [% END -%]

1 0