- tbb-commits - lists.torproject.org

[tor-browser-build/master] Bug 10026: add support for building Tor for Windows 64
by gk＠torproject.org 06 Nov '17

06 Nov '17

commit 0292709b91ac032e7c6e69e39fc2aa760e4708ed Author: Nicolas Vigier <boklm(a)torproject.org> Date: Sat Aug 12 23:33:31 2017 +0200 Bug 10026: add support for building Tor for Windows 64 Fix the build of openssl and zlib for Windows 64. --- projects/openssl/config | 4 ++-- projects/tor/config | 2 +- projects/zlib/build | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/projects/openssl/config b/projects/openssl/config index dca3a1c..8c6ccbf 100644 --- a/projects/openssl/config +++ b/projects/openssl/config @@ -13,9 +13,9 @@ targets: linux-i686: var: configure_opts: -shared linux-generic32 - windows-i686: + windows: var: - configure_opts: '-shared --cross-compile-prefix=i686-w64-mingw32- mingw "-fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$gcclibs"' + configure_opts: '-shared --cross-compile-prefix=[% c("arch") %]-w64-mingw32- mingw[% IF c("var/windows-x86_64") %]64[% END %] "-fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$gcclibs"' osx-x86_64: var: configure_opts: --cross-compile-prefix=x86_64-apple-darwin10- darwin64-x86_64-cc enable-ec_nistp_64_gcc_128 diff --git a/projects/tor/config b/projects/tor/config index b5df573..af829cd 100644 --- a/projects/tor/config +++ b/projects/tor/config @@ -37,7 +37,7 @@ targets: var: arch_deps: - faketime - windows-i686: + windows: var: arch_deps: - faketime diff --git a/projects/zlib/build b/projects/zlib/build index 4031ef5..4cb384b 100644 --- a/projects/zlib/build +++ b/projects/zlib/build @@ -7,8 +7,8 @@ tar -C /var/tmp/build -xf [% project %]-[% c('version') %].tar.gz cd /var/tmp/build/[% project %]-[% c('version') %] export CFLAGS="[% c("var/CFLAGS") %]" export LDFLAGS="[% c("var/LDFLAGS") %]" -make BINARY_PATH=$distdir/lib INCLUDE_PATH=$distdir/include LIBRARY_PATH=$distdir/lib -f win32/Makefile.gcc PREFIX=i686-w64-mingw32- -j4 SHARED_MODE=1 LOC="-fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$gcclibs" -make BINARY_PATH=$distdir/lib INCLUDE_PATH=$distdir/include LIBRARY_PATH=$distdir/lib -f win32/Makefile.gcc PREFIX=i686-w64-mingw32- -j4 SHARED_MODE=1 LOC="-fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$gcclibs" install +make BINARY_PATH=$distdir/lib INCLUDE_PATH=$distdir/include LIBRARY_PATH=$distdir/lib -f win32/Makefile.gcc PREFIX=[% c("arch") %]-w64-mingw32- -j4 SHARED_MODE=1 LOC="-fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$gcclibs" +make BINARY_PATH=$distdir/lib INCLUDE_PATH=$distdir/include LIBRARY_PATH=$distdir/lib -f win32/Makefile.gcc PREFIX=[% c("arch") %]-w64-mingw32- -j4 SHARED_MODE=1 LOC="-fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$gcclibs" install cd /var/tmp/dist [% c('tar', {

1 0

[tor-browser-build/master] Bug 23228: add support for building mingw-w64 for Windows 64
by gk＠torproject.org 06 Nov '17

06 Nov '17

commit b82d82d9cf9cb751e088085fb1093026b20a0e4d Author: Nicolas Vigier <boklm(a)torproject.org> Date: Sat Aug 12 22:50:58 2017 +0200 Bug 23228: add support for building mingw-w64 for Windows 64 Add torbrowser-windows-x86_64 support to rbm.conf. Update mingw-w64 to use the x86_64-w64-mingw32 target (instead of i686-w64-mingw32) for torbrowser-windows-x86_64 builds. --- projects/binutils/64bit-fixups.patch | 55 +++++++++++++++++++++++++++++++++ projects/binutils/build | 7 +++-- projects/binutils/config | 6 ++-- projects/mingw-w64/build | 32 +++++++++++++------ projects/mingw-w64/config | 15 ++++++--- projects/mingw-w64/i686-w64-mingw32-g++ | 4 --- projects/mingw-w64/i686-w64-mingw32-gcc | 4 --- projects/mingw-w64/i686-w64-mingw32-ld | 4 --- rbm.conf | 33 ++++++++++++++------ 9 files changed, 122 insertions(+), 38 deletions(-) diff --git a/projects/binutils/64bit-fixups.patch b/projects/binutils/64bit-fixups.patch new file mode 100644 index 0000000..33c0297 --- /dev/null +++ b/projects/binutils/64bit-fixups.patch @@ -0,0 +1,55 @@ +From f3ba95e14437f10de8b8f296930ff2a8495d18c6 Mon Sep 17 00:00:00 2001 +From: Georg Koppen <gk(a)torproject.org> +Date: Tue, 12 Sep 2017 07:21:16 +0000 +Subject: [PATCH] 64bit fixups + + +diff --git a/ld/emultempl/pep.em b/ld/emultempl/pep.em +index b566903b14..27006bdf79 100644 +--- a/ld/emultempl/pep.em ++++ b/ld/emultempl/pep.em +@@ -730,7 +730,7 @@ gld${EMULATION_NAME}_handle_option (int optc) + pep_dll_exclude_all_symbols = 1; + break; + case OPTION_ENABLE_RELOC_SECTION: +- pe_dll_enable_reloc_section = 1; ++ pep_dll_enable_reloc_section = 1; + break; + case OPTION_EXCLUDE_LIBS: + pep_dll_add_excludes (optarg, EXCLUDELIBS); +@@ -1623,7 +1623,7 @@ gld_${EMULATION_NAME}_finish (void) + + #ifdef DLL_SUPPORT + if (link_info.shared +- || (!link_info.relocatable && pe_dll_enable_reloc_section) ++ || (!link_info.relocatable && pep_dll_enable_reloc_section) + || (!link_info.relocatable && pep_def_file->num_exports != 0)) + { + pep_dll_fill_sections (link_info.output_bfd, &link_info); +diff --git a/ld/pep-dll.c b/ld/pep-dll.c +index 0e5e8b1523..b5f99b90e0 100644 +--- a/ld/pep-dll.c ++++ b/ld/pep-dll.c +@@ -31,6 +31,7 @@ + #define pe_dll_export_everything pep_dll_export_everything + #define pe_dll_exclude_all_symbols pep_dll_exclude_all_symbols + #define pe_dll_do_default_excludes pep_dll_do_default_excludes ++#define pe_dll_enable_reloc_section pep_dll_enable_reloc_section + #define pe_dll_kill_ats pep_dll_kill_ats + #define pe_dll_stdcall_aliases pep_dll_stdcall_aliases + #define pe_dll_warn_dup_exports pep_dll_warn_dup_exports +diff --git a/ld/pep-dll.h b/ld/pep-dll.h +index 1e7e3d65d4..c31e69cc8e 100644 +--- a/ld/pep-dll.h ++++ b/ld/pep-dll.h +@@ -31,6 +31,7 @@ extern def_file * pep_def_file; + extern int pep_dll_export_everything; + extern int pep_dll_exclude_all_symbols; + extern int pep_dll_do_default_excludes; ++extern int pep_dll_enable_reloc_section; + extern int pep_dll_kill_ats; + extern int pep_dll_stdcall_aliases; + extern int pep_dll_warn_dup_exports; +-- +2.14.1 + diff --git a/projects/binutils/build b/projects/binutils/build index a7d83d9..6d8e0b2 100644 --- a/projects/binutils/build +++ b/projects/binutils/build @@ -21,10 +21,13 @@ cd [% project %]-[% c("version") %] [% IF c('var/windows') -%] # XXX: This is needed due to bug 10102. sed 's/= extern_rt_rel_d;/= extern_rt_rel_d;\n memset (extern_rt_rel_d, 0, PE_IDATA5_SIZE);/' -i ld/pe-dll.c - # Needed for the hardening... - patch -p1 < ../enable-reloc-section-ld.patch # Zeroing timestamps in PE headers reliably, see bug 12753. patch -p1 < ../peXXigen.patch + # Needed for the hardening... + patch -p1 < ../enable-reloc-section-ld.patch +[% END -%] +[% IF c('var/windows-x86_64') -%] + patch -p1 < ../64bit-fixups.patch [% END -%] [% IF c("var/linux") -%] # We need to work around a gold linker bug in 2.24 to get selfrando working, diff --git a/projects/binutils/config b/projects/binutils/config index f272c76..25417c0 100644 --- a/projects/binutils/config +++ b/projects/binutils/config @@ -7,9 +7,9 @@ var: use_container: 1 targets: - windows-i686: + windows: var: - configure_opt: '--target=i686-w64-mingw32 --disable-multilib --enable-deterministic-archives' + configure_opt: '--target=[% c("arch") %]-w64-mingw32 --disable-multilib --enable-deterministic-archives' input_files: - URL: https://ftp.gnu.org/gnu/binutils/binutils-[% c("version") %].tar.bz2 @@ -19,6 +19,8 @@ input_files: - project: container-image - filename: enable-reloc-section-ld.patch enable: '[% c("var/windows") %]' + - filename: 64bit-fixups.patch + enable: '[% c("var/windows-x86_64") %]' - filename: peXXigen.patch enable: '[% c("var/windows") %]' - filename: binutils-224-gold.patch diff --git a/projects/mingw-w64/build b/projects/mingw-w64/build index 0fc4517..8d3e567 100644 --- a/projects/mingw-w64/build +++ b/projects/mingw-w64/build @@ -14,7 +14,7 @@ tar xf $rootdir/[% project %]-[% c("version") %].tar.gz mkdir -p builddir/mingw-w64/mingw-w64-headers32 cd builddir/mingw-w64/mingw-w64-headers32 /var/tmp/build/[% project %]-[% c("version") %]/mingw-w64-headers/configure \ - --prefix=$distdir/i686-w64-mingw32 --host=i686-w64-mingw32 \ + --prefix=$distdir/[% c("arch") %]-w64-mingw32 --host=[% c("arch") %]-w64-mingw32 \ --enable-sdk=all --enable-secure-api --enable-idl make install @@ -23,28 +23,28 @@ mkdir gcc cd gcc tar xjf $rootdir/gcc-[% c("var/gcc_version") %].tar.bz2 # We don't want to link against msvcrt.dll due to bug 9084. -i686-w64-mingw32-g++ -dumpspecs > $distdir/msvcr100.spec +[% c("arch") %]-w64-mingw32-g++ -dumpspecs > $distdir/msvcr100.spec sed 's/msvcrt/msvcr100/' -i $distdir/msvcr100.spec # Linking libgcc against msvcrt is hard-coded... sed 's/msvcrt/msvcr100/' -i gcc-[% c("var/gcc_version") %]/gcc/config/i386/t-mingw-w32 # LDFLAGS_FOR_TARGET does not work for some reason. Thus, we take # CFLAGS_FOR_TARGET. export CFLAGS_FOR_TARGET="-specs=$distdir/msvcr100.spec -Wl,--nxcompat -Wl,--dynamicbase" -gcc-[% c("var/gcc_version") %]/configure --prefix=$distdir --target=i686-w64-mingw32 --disable-multilib --enable-languages=c,c++ +gcc-[% c("var/gcc_version") %]/configure --prefix=$distdir --target=[% c("arch") %]-w64-mingw32 --disable-multilib --enable-languages=c,c++ make -j[% c("buildconf/num_procs") %] all-gcc make install-gcc mkdir -p /var/tmp/build/builddir/mingw-w64/mingw-w64-crt32 cd /var/tmp/build/builddir/mingw-w64/mingw-w64-crt32 /var/tmp/build/[% project %]-[% c("version") %]/mingw-w64-crt/configure \ - --host=i686-w64-mingw32 --prefix=$distdir/i686-w64-mingw32 + --host=[% c("arch") %]-w64-mingw32 --prefix=$distdir/[% c("arch") %]-w64-mingw32 make -j[% c("buildconf/num_procs") %] make install mkdir -p /var/tmp/build/builddir/mingw-w64/widl32 cd /var/tmp/build/builddir/mingw-w64/widl32 /var/tmp/build/[% project %]-[% c("version") %]/mingw-w64-tools/widl/configure \ - --prefix=$distdir --target=i686-w64-mingw32 + --prefix=$distdir --target=[% c("arch") %]-w64-mingw32 make -j[% c("buildconf/num_procs") %] make install @@ -52,12 +52,26 @@ cd /var/tmp/build/gcc make -j[% c("buildconf/num_procs") %] make install mkdir -p $distdir/gcclibs -cp i686-w64-mingw32/libssp/.libs/libssp-0.dll $distdir/gcclibs -cp i686-w64-mingw32/libgcc/shlib/libgcc_s_sjlj-1.dll $distdir/gcclibs +cp [% c("arch") %]-w64-mingw32/libssp/.libs/libssp-0.dll $distdir/gcclibs +cp [% c("arch") %]-w64-mingw32/libgcc/shlib/[% c("var/libgcc_dll") %] $distdir/gcclibs mkdir -p $distdir/helpers -mv $rootdir/i686-w64-mingw32-g++ $rootdir/i686-w64-mingw32-gcc \ - $rootdir/i686-w64-mingw32-ld $distdir/helpers/ + +cat > $distdir/helpers/[% c("arch") %]-w64-mingw32-g++ << 'EOF' +#!/bin/sh +/var/tmp/dist/mingw-w64/bin/[% c("arch") %]-w64-mingw32-g++ -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -fstack-protector --param ssp-buffer-size=4 -fno-strict-overflow "$@" +EOF + +cat > $distdir/helpers/[% c("arch") %]-w64-mingw32-gcc << 'EOF' +#!/bin/sh +/var/tmp/dist/mingw-w64/bin/[% c("arch") %]-w64-mingw32-gcc -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -fstack-protector --param ssp-buffer-size=4 -fno-strict-overflow "$@" +EOF + +cat > $distdir/helpers/[% c("arch") %]-w64-mingw32-ld << 'EOF' +#!/bin/sh +/var/tmp/dist/mingw-w64/bin/[% c("arch") %]-w64-mingw32-ld --dynamicbase --nxcompat --enable-reloc-section -lssp -L$gcclibs "$@" +EOF + chmod +x $distdir/helpers/* cd /var/tmp/dist diff --git a/projects/mingw-w64/config b/projects/mingw-w64/config index ac1caa9..bb66167 100644 --- a/projects/mingw-w64/config +++ b/projects/mingw-w64/config @@ -11,19 +11,26 @@ var: - automake - build-essential - libmpc-dev - - g++-mingw-w64-i686 setup: | [% c("var/setarch") -%] mkdir -p /var/tmp/dist tar -C /var/tmp/dist -xf [% c("compiler_tarfile") %] export PATH="/var/tmp/dist/mingw-w64/helpers:/var/tmp/dist/mingw-w64/bin:$PATH" export gcclibs=/var/tmp/dist/mingw-w64/gcclibs +targets: + windows-i686: + var: + libgcc_dll: libgcc_s_sjlj-1.dll + arch_deps: + - g++-mingw-w64-i686 + windows-x86_64: + var: + libgcc_dll: libgcc_s_seh-1.dll + arch_deps: + - g++-mingw-w64-x86-64 input_files: - project: container-image - URL: 'https://ftp.gnu.org/gnu/gcc/gcc-[% c("var/gcc_version") %]/gcc-[% c("var/gcc_version") %].tar.bz2' sha256sum: 608df76dec2d34de6558249d8af4cbee21eceddbcb580d666f7a5a583ca3303a - name: binutils project: binutils - - filename: i686-w64-mingw32-g++ - - filename: i686-w64-mingw32-gcc - - filename: i686-w64-mingw32-ld diff --git a/projects/mingw-w64/i686-w64-mingw32-g++ b/projects/mingw-w64/i686-w64-mingw32-g++ deleted file mode 100755 index c5421a2..0000000 --- a/projects/mingw-w64/i686-w64-mingw32-g++ +++ /dev/null @@ -1,4 +0,0 @@ -#!/bin/sh -# Hardened mingw gcc wrapper - -/var/tmp/dist/mingw-w64/bin/i686-w64-mingw32-g++ -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -fstack-protector --param ssp-buffer-size=4 -fno-strict-overflow "$@" diff --git a/projects/mingw-w64/i686-w64-mingw32-gcc b/projects/mingw-w64/i686-w64-mingw32-gcc deleted file mode 100755 index 741ef8a..0000000 --- a/projects/mingw-w64/i686-w64-mingw32-gcc +++ /dev/null @@ -1,4 +0,0 @@ -#!/bin/sh -# Hardened mingw gcc wrapper - -/var/tmp/dist/mingw-w64/bin/i686-w64-mingw32-gcc -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -fstack-protector --param ssp-buffer-size=4 -fno-strict-overflow "$@" diff --git a/projects/mingw-w64/i686-w64-mingw32-ld b/projects/mingw-w64/i686-w64-mingw32-ld deleted file mode 100755 index bcf5e5b..0000000 --- a/projects/mingw-w64/i686-w64-mingw32-ld +++ /dev/null @@ -1,4 +0,0 @@ -#!/bin/sh -# Hardened mingw gcc wrapper - -/var/tmp/dist/mingw-w64/bin/i686-w64-mingw32-ld --dynamicbase --nxcompat --enable-reloc-section -lssp -L$gcclibs "$@" diff --git a/rbm.conf b/rbm.conf index ab2a080..6e800f2 100644 --- a/rbm.conf +++ b/rbm.conf @@ -171,15 +171,36 @@ targets: torbrowser-windows-i686: - windows-i686 + - windows + torbrowser-windows-x86_64: + - windows-x86_64 + - windows + windows-x86_64: + arch: x86_64 + var: + windows-x86_64: 1 + osname: windows-x86_64 + container: + arch: amd64 windows-i686: arch: i686 var: - windows: 1 + windows-i686: 1 osname: windows-i686 container: - suite: precise arch: i386 - configure_opt: '--host=i686-w64-mingw32 CFLAGS="[% c("var/CFLAGS") %]" LDFLAGS="[% c("var/LDFLAGS") %]"' + setarch: | + if test -z "$RBM_SETARCH" + then + export RBM_SETARCH=1 + exec setarch i686 ./build + fi + windows: + var: + windows: 1 + container: + suite: precise + configure_opt: '--host=[% c("arch") %]-w64-mingw32 CFLAGS="[% c("var/CFLAGS") %]" LDFLAGS="[% c("var/LDFLAGS") %]"' CFLAGS: '[% c("var/flag_mwindows") %] -fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security' LDFLAGS: '[% c("var/flag_mwindows") %] -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$gcclibs' flag_mwindows: '-mwindows' @@ -193,12 +214,6 @@ targets: - zip - unzip faketime_path: /usr/lib/faketime/libfaketime.so.1 - setarch: | - if test -z "$RBM_SETARCH" - then - export RBM_SETARCH=1 - exec setarch i686 ./build - fi fteproxy: 1 install_wine_ppa: | # Install a Wine new enough to have a fix for

1 0

[tor-browser-build/master] Fold in missing stable release notes
by gk＠torproject.org 03 Nov '17

03 Nov '17

commit 897d6d1a74fda13743828846fe9b1616d3455011 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Oct 30 10:00:38 2017 +0000 Fold in missing stable release notes --- .../tor-browser/Bundle-Data/Docs/ChangeLog.txt | 34 ++++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 7697b5c..e1c70f2 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -4,6 +4,13 @@ Tor Browser 7.5a7 -- November 6 2017 * Linux * Bug 24052: Streamline handling of file:// resources +Tor Browser 7.0.8 -- October 25 2017 + * All Platforms + * Update Torbutton to 1.9.7.9 + * Bug 23949: Fix donation banner display + * Update locales with translated banner + * Translations update + Tor Browser 7.5a6 -- October 19 2017 * All Platforms * Update Firefox to 52.4.1esr @@ -22,6 +29,33 @@ Tor Browser 7.5a6 -- October 19 2017 * Bug 23807: Tab crashes when playing video on High Sierra * Bug 23025: Add some hardening flags to macOS build +Tor Browser 7.0.7 -- October 19 2017 + * All Platforms + * Update Firefox to 52.4.1esr + * Update Torbutton to 1.9.7.8 + * Bug 23887: Update banner locales and Mozilla text + * Bug 23526: Add 2017 Donation banner text + * Bug 23483: Donation banner on about:tor for 2017 (testing mode) + * Bug 22610: Avoid crashes when canceling external helper app related downloads + * Bug 22472: Fix FTP downloads when external helper app dialog is shown + * Bug 22471: Downloading pdf files via the PDF viewer download button is broken + * Bug 22618: Downloading pdf file via file:/// is stalling + * Translations update + * Update HTTPS-Everywhere to 2017.10.4 + * Update NoScript to 5.1.2 + * Bug 23723: Loading entities from NoScript .dtd files is blocked + * Bug 23724: NoScript update breaks Security Slider and its icon disappears + * Bug 23745: Tab crashes when using Tor Browser to access Google Drive + * Bug 22610: Avoid crashes when canceling external helper app related downloads + * Bug 22472: Fix FTP downloads when external helper app dialog is shown + * Bug 22471: Downloading pdf files via the PDF viewer download button is broken + * Bug 22618: Downloading pdf file via file:/// is stalling + * Bug 23694: Update the detailsURL in update responses + * OS X + * Bug 23807: Tab crashes when playing video on High Sierra + * Linux + * Bug 22692: Enable content sandboxing on Linux + Tor Browser 7.5a5 -- September 28 2017 * All Platforms * Update Firefox to 52.4.0esr

1 0

[tor-browser-build/master] Apply follow-up patch for bug 24052
by gk＠torproject.org 03 Nov '17

03 Nov '17

commit 409a6951d0c081905fc44f12e5b2359032178f18 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Nov 2 11:10:00 2017 +0000 Apply follow-up patch for bug 24052 --- projects/firefox/24052_2.patch | 29 +++++++++++++++++++++++++++++ projects/firefox/build | 1 + projects/firefox/config | 2 ++ 3 files changed, 32 insertions(+) diff --git a/projects/firefox/24052_2.patch b/projects/firefox/24052_2.patch new file mode 100644 index 0000000..0060428 --- /dev/null +++ b/projects/firefox/24052_2.patch @@ -0,0 +1,29 @@ +From e2c1240ad25f4edcc7d3828b29f6aeb953a24a2e Mon Sep 17 00:00:00 2001 +From: Arthur Edelstein <arthuredelstein(a)gmail.com> +Date: Wed, 1 Nov 2017 02:33:18 -0700 +Subject: [PATCH] Bug 24052: Handle redirects by blocking them early + +This is the second part of the workaround for +https://bugzilla.mozilla.org/show_bug.cgi?id=1412081. + +diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp +index 0e570e8cb57d..b38be48bf0c9 100644 +--- a/netwerk/protocol/http/nsHttpChannel.cpp ++++ b/netwerk/protocol/http/nsHttpChannel.cpp +@@ -5419,6 +5419,13 @@ nsHttpChannel::AsyncProcessRedirection(uint32_t redirectType) + return NS_ERROR_CORRUPTED_CONTENT; + } + ++ bool isRedirectToFile = false; ++ rv = mRedirectURI->SchemeIs("file", &isRedirectToFile); ++ if (!NS_FAILED(rv) && isRedirectToFile) { ++ LOG(("Attempted to redirect from a remote page to a file:// URI.")); ++ return NS_ERROR_FAILURE; ++ } ++ + if (mApplicationCache) { + // if we are redirected to a different origin check if there is a fallback + // cache entry to fall back to. we don't care about file strict +-- +2.14.2 + diff --git a/projects/firefox/build b/projects/firefox/build index 97b148d..3806fdf 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -88,6 +88,7 @@ fi [% IF c("var/linux") || c("var/osx") %] patch -p1 < $rootdir/24052.patch + patch -p1 < $rootdir/24052_2.patch [% END -%] rm -f configure diff --git a/projects/firefox/config b/projects/firefox/config index c0c620f..2e30001 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -83,6 +83,8 @@ input_files: enable: '[% c("var/osx") %]' - filename: 24052.patch enable: '[% c("var/linux") || c("var/osx") %]' + - filename: 24052_2.patch + enable: '[% c("var/linux") || c("var/osx") %]' - URL: https://people.torproject.org/~gk/mirrors/sources/msvcr100.dll sha256sum: 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18 enable: '[% c("var/windows") %]'

1 0

[tor-browser-build/master] Version bump and Changelog update
by gk＠torproject.org 03 Nov '17

03 Nov '17

commit b0390291a524873a5e10ee2973999596c30d40c2 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Nov 2 11:12:52 2017 +0000 Version bump and Changelog update --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 6 ++++++ rbm.conf | 4 ++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index e18d650..7697b5c 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,9 @@ +Tor Browser 7.5a7 -- November 6 2017 + * OS X + * Bug 24052: Streamline handling of file:// resources + * Linux + * Bug 24052: Streamline handling of file:// resources + Tor Browser 7.5a6 -- October 19 2017 * All Platforms * Update Firefox to 52.4.1esr diff --git a/rbm.conf b/rbm.conf index 80a7091..ab2a080 100644 --- a/rbm.conf +++ b/rbm.conf @@ -15,10 +15,10 @@ buildconf: git_signtag_opt: '-s' var: - torbrowser_version: '7.5a6' + torbrowser_version: '7.5a7' torbrowser_build: 'build1' torbrowser_incremental_from: - - 7.5a5 + - 7.5a6 project_name: tor-browser multi_lingual: 0 build_mar: 1

1 0

[tor-browser-build/master] Applying patch for bug 24052
by gk＠torproject.org 03 Nov '17

03 Nov '17

commit e0e6bfd780cdbb529aecc57699a8f410f667c62f Author: Georg Koppen <gk(a)torproject.org> Date: Mon Oct 30 09:44:58 2017 +0000 Applying patch for bug 24052 --- projects/firefox/24052.patch | 57 ++++++++++++++++++++++++++++++++++++++++++++ projects/firefox/build | 4 ++++ projects/firefox/config | 2 ++ 3 files changed, 63 insertions(+) diff --git a/projects/firefox/24052.patch b/projects/firefox/24052.patch new file mode 100644 index 0000000..a418a97 --- /dev/null +++ b/projects/firefox/24052.patch @@ -0,0 +1,57 @@ +From c5d1bb91512f9dd20e0f54c6f3e6979588cf9f56 Mon Sep 17 00:00:00 2001 +From: Georg Koppen <gk(a)torproject.org> +Date: Fri, 27 Oct 2017 20:40:57 +0000 +Subject: [PATCH] Bug 24052: Streamline handling of file:// resources + +We should make sure restrictions regarding loading of file:// resources +are adhered to more strictly, at least on *nix platforms. + +This is a workaround for +https://bugzilla.mozilla.org/show_bug.cgi?id=1412081. + +diff --git a/netwerk/base/nsIOService.cpp b/netwerk/base/nsIOService.cpp +index 0da79c18ae41..0cc67da7b18f 100644 +--- a/netwerk/base/nsIOService.cpp ++++ b/netwerk/base/nsIOService.cpp +@@ -789,12 +789,20 @@ nsIOService::NewChannelFromURIWithProxyFlagsInternal(nsIURI* aURI, + // if calling newChannel2() fails we try to fall back to + // creating a new channel by calling NewChannel(). + if (NS_FAILED(rv)) { ++#ifdef XP_UNIX ++ if (rv == NS_ERROR_FILE_TARGET_DOES_NOT_EXIST) { ++ return rv; ++ } else { ++#endif + rv = handler->NewChannel(aURI, getter_AddRefs(channel)); + NS_ENSURE_SUCCESS(rv, rv); + // The protocol handler does not implement NewChannel2, so + // maybe we need to wrap the channel (see comment in MaybeWrap + // function). + channel = nsSecCheckWrapChannel::MaybeWrap(channel, aLoadInfo); ++#ifdef XP_UNIX ++ } ++#endif + } + } + +diff --git a/netwerk/protocol/file/nsFileProtocolHandler.cpp b/netwerk/protocol/file/nsFileProtocolHandler.cpp +index e55cb9d47460..c24c928b6f02 100644 +--- a/netwerk/protocol/file/nsFileProtocolHandler.cpp ++++ b/netwerk/protocol/file/nsFileProtocolHandler.cpp +@@ -188,6 +188,13 @@ nsFileProtocolHandler::NewChannel2(nsIURI* uri, + nsILoadInfo* aLoadInfo, + nsIChannel** result) + { ++#ifdef XP_UNIX ++ if (aLoadInfo && aLoadInfo->TriggeringPrincipal()) { ++ if (aLoadInfo->TriggeringPrincipal()->GetIsCodebasePrincipal()) { ++ return NS_ERROR_FILE_TARGET_DOES_NOT_EXIST; ++ } ++ } ++#endif + nsFileChannel *chan = new nsFileChannel(uri); + if (!chan) + return NS_ERROR_OUT_OF_MEMORY; +-- +2.14.2 + diff --git a/projects/firefox/build b/projects/firefox/build index 8ff265d..97b148d 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -86,6 +86,10 @@ fi export CC='gcc -m32' [% END -%] +[% IF c("var/linux") || c("var/osx") %] + patch -p1 < $rootdir/24052.patch +[% END -%] + rm -f configure rm -f js/src/configure make -f client.mk configure CONFIGURE_ARGS="--with-tor-browser-version=[% c("var/torbrowser_version") %] --with-distribution-id=org.torproject --enable-update-channel=[% c("var/torbrowser_update_channel") %] --enable-bundled-fonts" diff --git a/projects/firefox/config b/projects/firefox/config index 85a4f00..c0c620f 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -81,6 +81,8 @@ input_files: enable: '[% c("var/linux") %]' - filename: fix-info-plist.py enable: '[% c("var/osx") %]' + - filename: 24052.patch + enable: '[% c("var/linux") || c("var/osx") %]' - URL: https://people.torproject.org/~gk/mirrors/sources/msvcr100.dll sha256sum: 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18 enable: '[% c("var/windows") %]'

1 0

[tor-browser-bundle/maint-7.0] Apply patch for bug 24052
by boklm＠torproject.org 03 Nov '17

03 Nov '17

commit f1366de5a2a67dc5fda27718135ee2cff28c344d Author: Georg Koppen <gk(a)torproject.org> Date: Mon Oct 30 08:45:44 2017 +0000 Apply patch for bug 24052 --- gitian/descriptors/linux/gitian-firefox.yml | 2 + gitian/descriptors/mac/gitian-firefox.yml | 2 + gitian/patches/24052.patch | 57 +++++++++++++++++++++++++++++ 3 files changed, 61 insertions(+) diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index 1ff66a2..766bf99 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -36,6 +36,7 @@ files: - "re-dzip.sh" - "dzip.sh" - "versions" +- "24052.patch" script: | source versions INSTDIR="$HOME/install" @@ -88,6 +89,7 @@ script: | mkdir -p $INSTDIR/Debug/Browser/ cd tor-browser + patch -p1 < ../24052.patch # run get-moz-build-date before removing .git, which is used to get the year chmod +x ~/build/get-moz-build-date eval $(~/build/get-moz-build-date $(cat browser/config/version.txt)) diff --git a/gitian/descriptors/mac/gitian-firefox.yml b/gitian/descriptors/mac/gitian-firefox.yml index 73c46bf..f47afc8 100644 --- a/gitian/descriptors/mac/gitian-firefox.yml +++ b/gitian/descriptors/mac/gitian-firefox.yml @@ -24,6 +24,7 @@ files: - "dzip.sh" - "fix-info-plist.py" - "versions" +- "24052.patch" script: | INSTDIR="$HOME/install/" source versions @@ -36,6 +37,7 @@ script: | mkdir -p $OUTDIR/ cd tor-browser + patch -p1 < ../24052.patch # Extracting all the necessary tools tar xaf ../MacOSX10.7.sdk.tar.gz tar xaf ../cctools.tar.gz diff --git a/gitian/patches/24052.patch b/gitian/patches/24052.patch new file mode 100644 index 0000000..a418a97 --- /dev/null +++ b/gitian/patches/24052.patch @@ -0,0 +1,57 @@ +From c5d1bb91512f9dd20e0f54c6f3e6979588cf9f56 Mon Sep 17 00:00:00 2001 +From: Georg Koppen <gk(a)torproject.org> +Date: Fri, 27 Oct 2017 20:40:57 +0000 +Subject: [PATCH] Bug 24052: Streamline handling of file:// resources + +We should make sure restrictions regarding loading of file:// resources +are adhered to more strictly, at least on *nix platforms. + +This is a workaround for +https://bugzilla.mozilla.org/show_bug.cgi?id=1412081. + +diff --git a/netwerk/base/nsIOService.cpp b/netwerk/base/nsIOService.cpp +index 0da79c18ae41..0cc67da7b18f 100644 +--- a/netwerk/base/nsIOService.cpp ++++ b/netwerk/base/nsIOService.cpp +@@ -789,12 +789,20 @@ nsIOService::NewChannelFromURIWithProxyFlagsInternal(nsIURI* aURI, + // if calling newChannel2() fails we try to fall back to + // creating a new channel by calling NewChannel(). + if (NS_FAILED(rv)) { ++#ifdef XP_UNIX ++ if (rv == NS_ERROR_FILE_TARGET_DOES_NOT_EXIST) { ++ return rv; ++ } else { ++#endif + rv = handler->NewChannel(aURI, getter_AddRefs(channel)); + NS_ENSURE_SUCCESS(rv, rv); + // The protocol handler does not implement NewChannel2, so + // maybe we need to wrap the channel (see comment in MaybeWrap + // function). + channel = nsSecCheckWrapChannel::MaybeWrap(channel, aLoadInfo); ++#ifdef XP_UNIX ++ } ++#endif + } + } + +diff --git a/netwerk/protocol/file/nsFileProtocolHandler.cpp b/netwerk/protocol/file/nsFileProtocolHandler.cpp +index e55cb9d47460..c24c928b6f02 100644 +--- a/netwerk/protocol/file/nsFileProtocolHandler.cpp ++++ b/netwerk/protocol/file/nsFileProtocolHandler.cpp +@@ -188,6 +188,13 @@ nsFileProtocolHandler::NewChannel2(nsIURI* uri, + nsILoadInfo* aLoadInfo, + nsIChannel** result) + { ++#ifdef XP_UNIX ++ if (aLoadInfo && aLoadInfo->TriggeringPrincipal()) { ++ if (aLoadInfo->TriggeringPrincipal()->GetIsCodebasePrincipal()) { ++ return NS_ERROR_FILE_TARGET_DOES_NOT_EXIST; ++ } ++ } ++#endif + nsFileChannel *chan = new nsFileChannel(uri); + if (!chan) + return NS_ERROR_OUT_OF_MEMORY; +-- +2.14.2 +

1 0

[tor-browser-bundle/maint-7.0] Prepare 7.0.9 release for Linux and OS X
by boklm＠torproject.org 03 Nov '17

03 Nov '17

commit 8c793c6e481079e21c8d73b4cbb95e6453c359e0 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Oct 30 08:55:00 2017 +0000 Prepare 7.0.9 release for Linux and OS X Changelog and config.yml update --- Bundle-Data/Docs/ChangeLog.txt | 6 ++++++ tools/update-responses/config.yml | 8 ++++---- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 835426f..40e382b 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,9 @@ +Tor Browser 7.0.9 -- October 31 2017 + * OS X + * Bug 24052: Streamline handling of file:// resources + * Linux + * Bug 24052: Streamline handling of file:// resources + Tor Browser 7.0.8 -- October 25 2017 * All Platforms * Update Torbutton to 1.9.7.9 diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index 82fa8f0..cf3cd4d 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -20,14 +20,14 @@ build_targets: osx64: Darwin_x86_64-gcc3 channels: alpha: 7.0a4 - release: 7.0.8 + release: 7.0.9 versions: - 7.0.8: + 7.0.9: platformVersion: 52.4.1 - detailsURL: https://blog.torproject.org/tor-browser-708-released + detailsURL: https://blog.torproject.org/tor-browser-709-released incremental_from: - - 7.0.6 - 7.0.7 + - 7.0.8 migrate_archs: osx32: osx64 migrate_langs:

1 0

[tor-browser-bundle/maint-7.0] Apply follow-up patch for bug 24052
by boklm＠torproject.org 03 Nov '17

03 Nov '17

commit a5388a804d47d7d4fb157beb351ebef9897e8a2b Author: Georg Koppen <gk(a)torproject.org> Date: Wed Nov 1 20:35:18 2017 +0000 Apply follow-up patch for bug 24052 --- gitian/descriptors/linux/gitian-firefox.yml | 2 ++ gitian/descriptors/mac/gitian-firefox.yml | 2 ++ gitian/patches/24052_2.patch | 29 +++++++++++++++++++++++++++++ 3 files changed, 33 insertions(+) diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index 766bf99..967a981 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -37,6 +37,7 @@ files: - "dzip.sh" - "versions" - "24052.patch" +- "24052_2.patch" script: | source versions INSTDIR="$HOME/install" @@ -90,6 +91,7 @@ script: | cd tor-browser patch -p1 < ../24052.patch + patch -p1 < ../24052_2.patch # run get-moz-build-date before removing .git, which is used to get the year chmod +x ~/build/get-moz-build-date eval $(~/build/get-moz-build-date $(cat browser/config/version.txt)) diff --git a/gitian/descriptors/mac/gitian-firefox.yml b/gitian/descriptors/mac/gitian-firefox.yml index f47afc8..a38fc0b 100644 --- a/gitian/descriptors/mac/gitian-firefox.yml +++ b/gitian/descriptors/mac/gitian-firefox.yml @@ -25,6 +25,7 @@ files: - "fix-info-plist.py" - "versions" - "24052.patch" +- "24052_2.patch" script: | INSTDIR="$HOME/install/" source versions @@ -38,6 +39,7 @@ script: | cd tor-browser patch -p1 < ../24052.patch + patch -p1 < ../24052_2.patch # Extracting all the necessary tools tar xaf ../MacOSX10.7.sdk.tar.gz tar xaf ../cctools.tar.gz diff --git a/gitian/patches/24052_2.patch b/gitian/patches/24052_2.patch new file mode 100644 index 0000000..0060428 --- /dev/null +++ b/gitian/patches/24052_2.patch @@ -0,0 +1,29 @@ +From e2c1240ad25f4edcc7d3828b29f6aeb953a24a2e Mon Sep 17 00:00:00 2001 +From: Arthur Edelstein <arthuredelstein(a)gmail.com> +Date: Wed, 1 Nov 2017 02:33:18 -0700 +Subject: [PATCH] Bug 24052: Handle redirects by blocking them early + +This is the second part of the workaround for +https://bugzilla.mozilla.org/show_bug.cgi?id=1412081. + +diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp +index 0e570e8cb57d..b38be48bf0c9 100644 +--- a/netwerk/protocol/http/nsHttpChannel.cpp ++++ b/netwerk/protocol/http/nsHttpChannel.cpp +@@ -5419,6 +5419,13 @@ nsHttpChannel::AsyncProcessRedirection(uint32_t redirectType) + return NS_ERROR_CORRUPTED_CONTENT; + } + ++ bool isRedirectToFile = false; ++ rv = mRedirectURI->SchemeIs("file", &isRedirectToFile); ++ if (!NS_FAILED(rv) && isRedirectToFile) { ++ LOG(("Attempted to redirect from a remote page to a file:// URI.")); ++ return NS_ERROR_FAILURE; ++ } ++ + if (mApplicationCache) { + // if we are redirected to a different origin check if there is a fallback + // cache entry to fall back to. we don't care about file strict +-- +2.14.2 +

1 0

[tor-browser-bundle/maint-7.0] Update release date for 7.0.9
by boklm＠torproject.org 03 Nov '17

03 Nov '17

commit d92ad6b540e7330340a13fbdf52bd2cff0b10d79 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Nov 1 20:59:50 2017 +0000 Update release date for 7.0.9 --- Bundle-Data/Docs/ChangeLog.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 40e382b..478814b 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,4 +1,4 @@ -Tor Browser 7.0.9 -- October 31 2017 +Tor Browser 7.0.9 -- November 3 2017 * OS X * Bug 24052: Streamline handling of file:// resources * Linux

1 0