- tbb-commits - lists.torproject.org

[tor-browser/tor-browser-38.2.1esr-5.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by mikeperry＠torproject.org 15 Sep '15

15 Sep '15

commit 565b5d0020d66fc8da2874015572fe907e6fd19c Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Sep 15 16:41:46 2015 -0700 fixup! TB4: Tor Browser's Firefox preference overrides. This sets prefs for: Bug #7446 - TorButton should not fixup .onion domains Bug #16837 - Disable Firefox Hotfix updates Bug #17046 - Event.timeStamp reveals startup time --- browser/app/profile/000-tor-browser.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index c80c119..b94b6d1 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -14,6 +14,7 @@ pref("startup.homepage_override_url", ""); // Try to nag a bit more about updates: Pop up a restart dialog an hour after the initial dialog pref("app.update.promptWaitTime", 3600); pref("app.update.badge", true); +pref("extensions.hotfix.id", ""); // Bug 16837: Disable hotfix updates as they may cause compat issues // Disable "Slow startup" warnings and associated disk history // (bug #13346) @@ -73,6 +74,7 @@ pref("browser.newtabpage.preload", false); // Bug 16316 - Avoid potential confus pref("browser.search.countryCode", "US"); // The next three prefs disable GeoIP search lookups (#16254) pref("browser.search.region", "US"); pref("browser.search.geoip.url", ""); +pref("browser.fixup.alternate.enabled", false); // Bug #16783: Prevent .onion fixups // Fingerprinting pref("webgl.min_capability_mode", true); @@ -109,6 +111,7 @@ pref("device.sensors.enabled", false); pref("dom.enable_resource_timing", false); // Bug 13024: To hell with this API pref("dom.enable_user_timing", false); // Bug 16336: To hell with this API pref("privacy.resistFingerprinting", true); +pref("dom.event.highrestimestamp.enabled", true); // Bug #17046: "Highres" (but truncated) timestamps prevent uptime leaks // Third party stuff pref("network.cookie.cookieBehavior", 1);

1 0

[tor-browser/tor-browser-38.2.1esr-5.5-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by mikeperry＠torproject.org 15 Sep '15

15 Sep '15

commit 15243aa153711dd09bf6e1cdcecfdd7d31d1e957 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Sep 15 16:41:46 2015 -0700 fixup! TB4: Tor Browser's Firefox preference overrides. This sets prefs for: Bug #7446 - TorButton should not fixup .onion domains Bug #16837 - Disable Firefox Hotfix updates Bug #17046 - Event.timeStamp reveals startup time --- browser/app/profile/000-tor-browser.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 3e77a82..0610297 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -19,6 +19,7 @@ pref("startup.homepage_override_url", "https://blog.torproject.org/category/tags // Try to nag a bit more about updates: Pop up a restart dialog an hour after the initial dialog pref("app.update.promptWaitTime", 3600); pref("app.update.badge", true); +pref("extensions.hotfix.id", ""); // Bug 16837: Disable hotfix updates as they may cause compat issues // Disable "Slow startup" warnings and associated disk history // (bug #13346) @@ -78,6 +79,7 @@ pref("browser.newtabpage.preload", false); // Bug 16316 - Avoid potential confus pref("browser.search.countryCode", "US"); // The next three prefs disable GeoIP search lookups (#16254) pref("browser.search.region", "US"); pref("browser.search.geoip.url", ""); +pref("browser.fixup.alternate.enabled", false); // Bug #16783: Prevent .onion fixups // Fingerprinting pref("webgl.min_capability_mode", true); @@ -114,6 +116,7 @@ pref("device.sensors.enabled", false); pref("dom.enable_resource_timing", false); // Bug 13024: To hell with this API pref("dom.enable_user_timing", false); // Bug 16336: To hell with this API pref("privacy.resistFingerprinting", true); +pref("dom.event.highrestimestamp.enabled", true); // Bug #17046: "Highres" (but truncated) timestamps prevent uptime leaks // Third party stuff pref("network.cookie.cookieBehavior", 1);

1 0

[tor-browser-bundle/maint-5.0] Bug 16783: Normalize NoScript default whitelist
by mikeperry＠torproject.org 15 Sep '15

15 Sep '15

commit 079f1dcba2ac77c33bb232bc12f9f88ebb1c1774 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Sep 15 16:12:28 2015 -0700 Bug 16783: Normalize NoScript default whitelist This ensures that if/when the NoScript whitelist is reset, the right list is there. The most important change here is noscript.mandatory, as NoScript ensures that those elements are in the whitelist every restart (and on New Identity). --- .../Browser/profile.default/preferences/extension-overrides.js | 5 +++-- .../Browser/profile.default/preferences/extension-overrides.js | 5 +++-- .../Browser/profile.default/preferences/extension-overrides.js | 5 +++-- 3 files changed, 9 insertions(+), 6 deletions(-) diff --git a/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js index 26b019c..83d4bbf 100644 --- a/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js @@ -17,13 +17,14 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: chrome: resource:"); +pref("capability.policy.maonoscript.sites", "about: chrome: resource: blob: mediasource: moz-safe-about:"); +pref("noscript.default", "about: chrome: resource: blob: mediasource: moz-safe-about:"); +pref("noscript.mandatory", "about: chrome: resource: blob: mediasource: moz-safe-about:"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false); pref("noscript.confirmUnblock", false); pref("noscript.contentBlocker", true); -pref("noscript.default", "about: chrome: resources:"); pref("noscript.firstRunRedirection", false); pref("noscript.global", true); pref("noscript.gtemp", ""); diff --git a/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js index 26b019c..83d4bbf 100644 --- a/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js @@ -17,13 +17,14 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: chrome: resource:"); +pref("capability.policy.maonoscript.sites", "about: chrome: resource: blob: mediasource: moz-safe-about:"); +pref("noscript.default", "about: chrome: resource: blob: mediasource: moz-safe-about:"); +pref("noscript.mandatory", "about: chrome: resource: blob: mediasource: moz-safe-about:"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false); pref("noscript.confirmUnblock", false); pref("noscript.contentBlocker", true); -pref("noscript.default", "about: chrome: resources:"); pref("noscript.firstRunRedirection", false); pref("noscript.global", true); pref("noscript.gtemp", ""); diff --git a/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js index d92bd3b..83d4bbf 100644 --- a/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js @@ -17,13 +17,14 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: chrome: resource:"); +pref("capability.policy.maonoscript.sites", "about: chrome: resource: blob: mediasource: moz-safe-about:"); +pref("noscript.default", "about: chrome: resource: blob: mediasource: moz-safe-about:"); +pref("noscript.mandatory", "about: chrome: resource: blob: mediasource: moz-safe-about:"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false); pref("noscript.confirmUnblock", false); pref("noscript.contentBlocker", true); -pref("noscript.default", "about: chrome: resource:"); pref("noscript.firstRunRedirection", false); pref("noscript.global", true); pref("noscript.gtemp", "");

1 0

[tor-browser-bundle/master] Bug 16783: Normalize NoScript default whitelist
by mikeperry＠torproject.org 15 Sep '15

15 Sep '15

commit 41adead1637a07ec370fbab90e95324d62c2d1a6 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Sep 15 16:12:28 2015 -0700 Bug 16783: Normalize NoScript default whitelist This ensures that if/when the NoScript whitelist is reset, the right list is there. The most important change here is noscript.mandatory, as NoScript ensures that those elements are in the whitelist every restart (and on New Identity). --- .../Browser/profile.default/preferences/extension-overrides.js | 5 +++-- .../Browser/profile.default/preferences/extension-overrides.js | 5 +++-- .../Browser/profile.default/preferences/extension-overrides.js | 5 +++-- 3 files changed, 9 insertions(+), 6 deletions(-) diff --git a/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js index 26b019c..83d4bbf 100644 --- a/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js @@ -17,13 +17,14 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: chrome: resource:"); +pref("capability.policy.maonoscript.sites", "about: chrome: resource: blob: mediasource: moz-safe-about:"); +pref("noscript.default", "about: chrome: resource: blob: mediasource: moz-safe-about:"); +pref("noscript.mandatory", "about: chrome: resource: blob: mediasource: moz-safe-about:"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false); pref("noscript.confirmUnblock", false); pref("noscript.contentBlocker", true); -pref("noscript.default", "about: chrome: resources:"); pref("noscript.firstRunRedirection", false); pref("noscript.global", true); pref("noscript.gtemp", ""); diff --git a/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js index 26b019c..83d4bbf 100644 --- a/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js @@ -17,13 +17,14 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: chrome: resource:"); +pref("capability.policy.maonoscript.sites", "about: chrome: resource: blob: mediasource: moz-safe-about:"); +pref("noscript.default", "about: chrome: resource: blob: mediasource: moz-safe-about:"); +pref("noscript.mandatory", "about: chrome: resource: blob: mediasource: moz-safe-about:"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false); pref("noscript.confirmUnblock", false); pref("noscript.contentBlocker", true); -pref("noscript.default", "about: chrome: resources:"); pref("noscript.firstRunRedirection", false); pref("noscript.global", true); pref("noscript.gtemp", ""); diff --git a/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js index d92bd3b..83d4bbf 100644 --- a/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js @@ -17,13 +17,14 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: chrome: resource:"); +pref("capability.policy.maonoscript.sites", "about: chrome: resource: blob: mediasource: moz-safe-about:"); +pref("noscript.default", "about: chrome: resource: blob: mediasource: moz-safe-about:"); +pref("noscript.mandatory", "about: chrome: resource: blob: mediasource: moz-safe-about:"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false); pref("noscript.confirmUnblock", false); pref("noscript.contentBlocker", true); -pref("noscript.default", "about: chrome: resource:"); pref("noscript.firstRunRedirection", false); pref("noscript.global", true); pref("noscript.gtemp", "");

1 0

[tor-browser/tor-browser-38.2.1esr-5.5-2] fixup! Bug #4234: Use the Firefox Update Process for Tor Browser.
by gk＠torproject.org 11 Sep '15

11 Sep '15

commit 769e682313bdd3ea26bdbc492c3158e1b0698c28 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Sep 9 14:04:54 2015 +0000 fixup! Bug #4234: Use the Firefox Update Process for Tor Browser. This is part of the fix for bug 16909. We need to adapt our update packaging tools to cope with the HTTPS Everywhere extension ID change introduced by version 5.1.0. --- tools/update-packaging/make_full_update.sh | 5 ++++- tools/update-packaging/make_incremental_update.sh | 13 ++++++++----- 2 files changed, 12 insertions(+), 6 deletions(-) diff --git a/tools/update-packaging/make_full_update.sh b/tools/update-packaging/make_full_update.sh index 62baf4c..3578ae4 100755 --- a/tools/update-packaging/make_full_update.sh +++ b/tools/update-packaging/make_full_update.sh @@ -11,7 +11,10 @@ . $(dirname "$0")/common.sh # TODO: it would be better to pass this as a command line option. -directories_to_remove='TorBrowser/Data/Browser/profile.default/extensions/https-everywhere(a)eff.org' +# Make sure we delete the pre 5.1.0 HTTPS Everywhere as well in case it +# exists. The extension ID got changed with the version bump to 5.1.0. +ext_path='TorBrowser/Data/Browser/profile.default/extensions' +directories_to_remove="$ext_path/https-everywhere(a)eff.org $ext_path/https-everywhere-eff(a)eff.org" # ----------------------------------------------------------------------------- diff --git a/tools/update-packaging/make_incremental_update.sh b/tools/update-packaging/make_incremental_update.sh index 0e1e3f6..c803809 100755 --- a/tools/update-packaging/make_incremental_update.sh +++ b/tools/update-packaging/make_incremental_update.sh @@ -64,7 +64,8 @@ check_for_forced_update() { fi # If the file in the skip list ends with /*, do a prefix match. - # This allows TorBrowser/Data/Browser/profile.default/extensions/https-everywhere(a)eff.org/* to be used to force all HTTPS Everywhere files to be updated. + # This allows TorBrowser/Data/Browser/profile.default/extensions/https-everywhere-eff(a)eff.org/* + # to be used to force all HTTPS Everywhere files to be updated. f_suffix=${f##*/} if [[ $f_suffix = "*" ]]; then f_prefix="${f%\/\*}"; @@ -122,7 +123,7 @@ archivefiles="updatev2.manifest updatev3.manifest" # If the NoScript or HTTPS Everywhere extensions have changed between # releases, add them to the "force updates" list. ext_path='TorBrowser/Data/Browser/profile.default/extensions' -https_everywhere='https-everywhere(a)eff.org' +https_everywhere='https-everywhere-eff(a)eff.org' noscript='{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi' # NoScript is a packed extension, so we simply compare the old and the new @@ -144,12 +145,14 @@ https_everywhere_install_rdf="$ext_path/$https_everywhere/install.rdf" diff "$olddir/$https_everywhere_install_rdf" \ "$newdir/$https_everywhere_install_rdf" > /dev/null rc=$? -if [ $rc -gt 1 ]; then +if [ $rc -gt 1 -a -e "$olddir/$https_everywhere_install_rdf" ]; then notice "Unexpected exit $rc from $https_everywhere_install_rdf diff command" exit 2 -elif [ $rc -eq 1 ]; then +elif [ $rc -ge 1 ]; then requested_forced_updates="$requested_forced_updates $ext_path/$https_everywhere/*" - directories_to_remove="$directories_to_remove $ext_path/$https_everywhere" + # Make sure we delete the pre 5.1.0 HTTPS Everywhere as well in case it + # exists. The extension ID got changed with the version bump to 5.1.0. + directories_to_remove="$directories_to_remove $ext_path/https-everywhere(a)eff.org $ext_path/$https_everywhere" fi mkdir -p "$workdir"

1 0

[tor-browser-bundle/master] Bug 16909: Adapt to HTTPS-Everyhwere build changes
by gk＠torproject.org 11 Sep '15

11 Sep '15

commit f8a4557bb2a46f06e664e47a57a7065322dbbd35 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Sep 8 15:18:17 2015 +0000 Bug 16909: Adapt to HTTPS-Everyhwere build changes There are two changes that got made recently: 1) The extension ID got renamed due to conflicts on the AMO dashboard with the version hosted by Mozilla. 2) Translations moved to an own git submodule. The first change is unproblematic. For the second one, however, we need to bump the mininmum Ubuntu version for the host operating system to 14.04. We want to initialize and update the submodules right while we are fetching the inputs and not during build time to be not dependent on network access during the bundling step. This fails on Ubuntu 12.04 due to an old git version (1.7.9.5) that uses abolute paths to locate submodules. As this path is not available on the build VM the build breaks. This does not affect Debian Wheezy (which ships with git 1.7.10.4) nor any later Debian version. In order to make this change obvious for 12.04 users we include an Ubuntu version check in check-prerequisites.sh. Additionally, we cleaned the bundling descriptors up to implement a proper solution for #10066 instead of working around that bug. --- gitian/README.build | 2 +- gitian/check-prerequisites.sh | 25 ++++++++++++++++--------- gitian/descriptors/linux/gitian-bundle.yml | 18 ++++++++++++------ gitian/descriptors/mac/gitian-bundle.yml | 18 ++++++++++++------ gitian/descriptors/windows/gitian-bundle.yml | 18 ++++++++++++------ gitian/fetch-inputs.sh | 9 ++++++++- gitian/versions | 2 +- gitian/versions.alpha | 2 +- gitian/versions.beta | 2 +- 9 files changed, 64 insertions(+), 32 deletions(-) diff --git a/gitian/README.build b/gitian/README.build index 656dddd..f289791 100644 --- a/gitian/README.build +++ b/gitian/README.build @@ -1,6 +1,6 @@ QuickStart: - On an Ubuntu 12.04+/Debian Wheezy+ machine or VM, run: + On an Ubuntu 14.04+/Debian Wheezy+ machine or VM, run: $ make diff --git a/gitian/check-prerequisites.sh b/gitian/check-prerequisites.sh index 32c9b7b..cc16d0e 100755 --- a/gitian/check-prerequisites.sh +++ b/gitian/check-prerequisites.sh @@ -6,7 +6,7 @@ if [ ! -f /etc/debian_version ]; then echo "Gitian is dependent upon the Ubuntu Virtualization Tools." echo - echo "You need to run Ubuntu 12.04 LTS/Debian Wheezy or newer." + echo "You need to run Ubuntu 14.04 LTS/Debian Wheezy or newer." exit 1 fi @@ -14,15 +14,22 @@ DISTRO=`cat /etc/issue | grep -Eo 'Ubuntu|Debian*'` if [ $DISTRO = "Ubuntu" ]; then - dpkg -s ruby apache2 git apt-cacher-ng python-vm-builder qemu-kvm virt-what lxc lxctl fakeroot faketime zip unzip subversion torsocks tor 2>/dev/null >/dev/null - - if [ $? -ne 0 ]; + VERSION=`cat /etc/issue | grep -Eo '[0-9]{2}' | head -1` + if [ "$VERSION" -ge "14" ]; then - echo "You are missing one or more Gitian build tool dependencies." - echo - echo "Please run:" - echo " sudo apt-get install torsocks tor" - echo " sudo torsocks apt-get install ruby apache2 git apt-cacher-ng python-vm-builder qemu-kvm virt-what lxc lxctl fakeroot faketime zip unzip subversion" + dpkg -s ruby apache2 git apt-cacher-ng python-vm-builder qemu-kvm virt-what lxc lxctl fakeroot faketime zip unzip subversion torsocks tor 2>/dev/null >/dev/null + + if [ $? -ne 0 ]; + then + echo "You are missing one or more Gitian build tool dependencies." + echo + echo "Please run:" + echo " sudo apt-get install torsocks tor" + echo " sudo torsocks apt-get install ruby apache2 git apt-cacher-ng python-vm-builder qemu-kvm virt-what lxc lxctl fakeroot faketime zip unzip subversion" + exit 1 + fi + else + echo "Your Ubuntu is too old. You need Ubuntu 14.04 LTS or newer to build Tor Browser with Gitian." exit 1 fi elif [ $DISTRO = "Debian" ]; diff --git a/gitian/descriptors/linux/gitian-bundle.yml b/gitian/descriptors/linux/gitian-bundle.yml index afb632e..a8f8d51 100644 --- a/gitian/descriptors/linux/gitian-bundle.yml +++ b/gitian/descriptors/linux/gitian-bundle.yml @@ -66,7 +66,7 @@ script: | umask 0022 # mkdir -p $OUTDIR/ - mkdir -p tor-browser/Browser/TorBrowser/Data/Browser/profile.default/extensions/https-everywhere(a)eff.org + mkdir -p tor-browser/Browser/TorBrowser/Data/Browser/profile.default/extensions/https-everywhere-eff(a)eff.org mkdir -p tor-browser/Browser/TorBrowser/Data/Browser/profile.meek-http-helper/extensions mkdir -p tor-browser/Browser/TorBrowser/Data/Browser/Caches mkdir -p tor-browser/Browser/TorBrowser/Docs/sources/ @@ -100,10 +100,16 @@ script: | cd ../../../ # cd https-everywhere - # XXX: Bloody hack to workaround a bug in HTTPS_E's git hash extraction in - # makexpi.sh. See https://trac.torproject.org/projects/tor/ticket/10066 - rm -f .git/refs/heads/master - ./makexpi.sh + # We are invoking the build script with a particular tag to avoid #10066. This + # does not work for nightlies as there is no "master" tag in that sense. But + # we don't need to care about that as we don't need reproducibility for + # nightly builds. + if [ $HTTPSE_TAG != "master" ]; + then + ./makexpi.sh $HTTPSE_TAG + else + ./makexpi.sh + fi # Since 5.0.2 a .xpi for AMO is built, too. We don't need it. rm ./pkg/*-amo.xpi cp pkg/*.xpi ../tor-browser/Browser/TorBrowser/Data/Browser/profile.default/extensions/https-everywhere(a)eff.org.xpi @@ -112,7 +118,7 @@ script: | cp *.xpi tor-browser/Browser/TorBrowser/Data/Browser/profile.default/extensions/ cd tor-browser/Browser/TorBrowser/Data/Browser/profile.default/extensions mv noscript(a)noscript.net.xpi {73a6fe31-595d-460b-a920-fcc0f8843232}.xpi - cd https-everywhere(a)eff.org/ + cd https-everywhere-eff(a)eff.org/ unzip ../https-everywhere(a)eff.org.xpi rm ../https-everywhere(a)eff.org.xpi cd ~/build diff --git a/gitian/descriptors/mac/gitian-bundle.yml b/gitian/descriptors/mac/gitian-bundle.yml index da441a2..bd54f0d 100644 --- a/gitian/descriptors/mac/gitian-bundle.yml +++ b/gitian/descriptors/mac/gitian-bundle.yml @@ -74,7 +74,7 @@ script: | MARTOOLS=~/build/mar-tools # mkdir -p $OUTDIR/ - mkdir -p $TORBROWSER_NAME.app/TorBrowser/Data/Browser/profile.default/extensions/https-everywhere(a)eff.org + mkdir -p $TORBROWSER_NAME.app/TorBrowser/Data/Browser/profile.default/extensions/https-everywhere-eff(a)eff.org mkdir -p $TORBROWSER_NAME.app/TorBrowser/Data/Browser/profile.meek-http-helper/extensions mkdir -p $TORBROWSER_NAME.app/TorBrowser/Data/Browser/Caches mkdir -p $TORBROWSER_NAME.app/TorBrowser/Docs/sources @@ -102,10 +102,16 @@ script: | cd ../../../ # cd https-everywhere - # XXX: Bloody hack to workaround a bug in HTTPS_E's git hash extraction in - # makexpi.sh. See https://trac.torproject.org/projects/tor/ticket/10066 - rm -f .git/refs/heads/master - ./makexpi.sh + # We are invoking the build script with a particular tag to avoid #10066. This + # does not work for nightlies as there is no "master" tag in that sense. But + # we don't need to care about that as we don't need reproducibility for + # nightly builds. + if [ $HTTPSE_TAG != "master" ]; + then + ./makexpi.sh $HTTPSE_TAG + else + ./makexpi.sh + fi # Since 5.0.2 a .xpi for AMO is built, too. We don't need it. rm ./pkg/*-amo.xpi cp pkg/*.xpi ../$TORBROWSER_NAME.app/TorBrowser/Data/Browser/profile.default/extensions/https-everywhere(a)eff.org.xpi @@ -114,7 +120,7 @@ script: | cp *.xpi ./$TORBROWSER_NAME.app/TorBrowser/Data/Browser/profile.default/extensions/ cd $TORBROWSER_NAME.app/TorBrowser/Data/Browser/profile.default/extensions/ mv noscript(a)noscript.net.xpi {73a6fe31-595d-460b-a920-fcc0f8843232}.xpi - cd https-everywhere(a)eff.org + cd https-everywhere-eff(a)eff.org unzip ../https-everywhere(a)eff.org.xpi rm ../https-everywhere(a)eff.org.xpi cd ~/build/ diff --git a/gitian/descriptors/windows/gitian-bundle.yml b/gitian/descriptors/windows/gitian-bundle.yml index d4ae0fa..b821528 100644 --- a/gitian/descriptors/windows/gitian-bundle.yml +++ b/gitian/descriptors/windows/gitian-bundle.yml @@ -65,7 +65,7 @@ script: | MARTOOLS=~/build/mar-tools # mkdir -p $OUTDIR/ - mkdir -p tbb-windows-installer/"Tor Browser"/Browser/TorBrowser/Data/Browser/profile.default/extensions/https-everywhere(a)eff.org + mkdir -p tbb-windows-installer/"Tor Browser"/Browser/TorBrowser/Data/Browser/profile.default/extensions/https-everywhere-eff(a)eff.org mkdir -p tbb-windows-installer/"Tor Browser"/Browser/TorBrowser/Data/Browser/profile.meek-http-helper/extensions mkdir -p tbb-windows-installer/"Tor Browser"/Browser/TorBrowser/Data/Browser/Caches mkdir -p tbb-windows-installer/"Tor Browser"/Browser/TorBrowser/Docs/sources @@ -90,10 +90,16 @@ script: | cd ../../../ # cd https-everywhere - # XXX: Bloody hack to workaround a bug in HTTPS_E's git hash extraction in - # makexpi.sh. See https://trac.torproject.org/projects/tor/ticket/10066 - rm -f .git/refs/heads/master - ./makexpi.sh + # We are invoking the build script with a particular tag to avoid #10066. This + # does not work for nightlies as there is no "master" tag in that sense. But + # we don't need to care about that as we don't need reproducibility for + # nightly builds. + if [ $HTTPSE_TAG != "master" ]; + then + ./makexpi.sh $HTTPSE_TAG + else + ./makexpi.sh + fi # Since 5.0.2 a .xpi for AMO is built, too. We don't need it. rm ./pkg/*-amo.xpi cp ./pkg/*.xpi ../tbb-windows-installer/"Tor Browser"/Browser/TorBrowser/Data/Browser/profile.default/extensions/https-everywhere(a)eff.org.xpi @@ -102,7 +108,7 @@ script: | cp *.xpi tbb-windows-installer/"Tor Browser"/Browser/TorBrowser/Data/Browser/profile.default/extensions cd tbb-windows-installer/"Tor Browser"/Browser/TorBrowser/Data/Browser/profile.default/extensions mv noscript(a)noscript.net.xpi {73a6fe31-595d-460b-a920-fcc0f8843232}.xpi - cd https-everywhere(a)eff.org + cd https-everywhere-eff(a)eff.org unzip ../https-everywhere(a)eff.org.xpi rm ../https-everywhere(a)eff.org.xpi cd ~/build/ diff --git a/gitian/fetch-inputs.sh b/gitian/fetch-inputs.sh index 42efa33..22162b0 100755 --- a/gitian/fetch-inputs.sh +++ b/gitian/fetch-inputs.sh @@ -162,7 +162,7 @@ do get "${!PACKAGE}" "${!URL}" done -# NoScript and HTTPS-Everywhere are magikal and special: +# NoScript is magikal and special: wget -U "" -N ${NOSCRIPT_URL} # Verify packages with weak or no signatures via direct sha256 check @@ -281,5 +281,12 @@ obfs4 https://git.torproject.org/pluggable-transports/obfs4.git noto-fonts https://github.com/googlei18n/noto-fonts $NOTOFONTS_TAG EOF +# HTTPS-Everywhere is special, too. We need to initialize the git submodules and +# update them here. Otherwise it would happen during the build. +cd https-everywhere +git submodule init +git submodule update +cd .. + exit 0 diff --git a/gitian/versions b/gitian/versions index b833342..70801b2 100755 --- a/gitian/versions +++ b/gitian/versions @@ -16,7 +16,7 @@ TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-5.0-1-build2 TOR_TAG=tor-0.2.6.10 TORLAUNCHER_TAG=0.2.7.7 TORBUTTON_TAG=1.9.3.2 -HTTPSE_TAG=5.0.7 +HTTPSE_TAG=5.1.0 NSIS_TAG=v0.3 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.21-stable diff --git a/gitian/versions.alpha b/gitian/versions.alpha index f37b98a..679da18 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -15,7 +15,7 @@ TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-5.5-2-build2 TOR_TAG=tor-0.2.7.2-alpha TORLAUNCHER_TAG=0.2.7.7 TORBUTTON_TAG=1.9.3.3 -HTTPSE_TAG=5.0.7 +HTTPSE_TAG=5.1.0 NSIS_TAG=v0.3 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.21-stable diff --git a/gitian/versions.beta b/gitian/versions.beta index c2143a0..8c4cfa9 100755 --- a/gitian/versions.beta +++ b/gitian/versions.beta @@ -15,7 +15,7 @@ TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-1-build4 TOR_TAG=tor-0.2.4.21 TORLAUNCHER_TAG=0.2.5.4 TORBUTTON_TAG=1.6.9.0 -HTTPSE_TAG=5.0.2 +HTTPSE_TAG=5.1.0 NSIS_TAG=v0.1 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.21-stable

1 0

[tor-browser/tor-browser-38.2.1esr-5.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 09 Sep '15

09 Sep '15

commit dd27a46185405a87cf5a8a56e4d293bddedde52a Author: Georg Koppen <gk(a)torproject.org> Date: Wed Sep 9 13:02:51 2015 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. This fixes bug 13579. Thanks to anonym for proposing this patch. --- browser/app/profile/000-tor-browser.js | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 20e2f3a..c80c119 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -238,6 +238,11 @@ pref("security.tls.version.max", 3); // Enforce certificate pinning, see: https://bugs.torproject.org/16206 pref("security.cert_pinning.enforcement_level", 2); +// Workaround for https://bugs.torproject.org/13579. Progress on +// `about:downloads` is only shown if the following preference is set to `true` +// in case the download panel got removed from the toolbar. +pref("browser.download.panel.shown", true); + #ifdef TOR_BROWSER_VERSION #expand pref("torbrowser.version", __TOR_BROWSER_VERSION__); #endif

1 0

[tor-browser/tor-browser-38.2.1esr-5.5-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 09 Sep '15

09 Sep '15

commit 2e79f3111bc999b6f30f3ec43d47913a3f0e5002 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Sep 9 13:02:51 2015 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. This fixes bug 13579. Thanks to anonym for proposing this patch. --- browser/app/profile/000-tor-browser.js | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 34b8e6e..3e77a82 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -243,6 +243,11 @@ pref("security.tls.version.max", 3); // Enforce certificate pinning, see: https://bugs.torproject.org/16206 pref("security.cert_pinning.enforcement_level", 2); +// Workaround for https://bugs.torproject.org/13579. Progress on +// `about:downloads` is only shown if the following preference is set to `true` +// in case the download panel got removed from the toolbar. +pref("browser.download.panel.shown", true); + #ifdef TOR_BROWSER_VERSION #expand pref("torbrowser.version", __TOR_BROWSER_VERSION__); #endif

1 0

[tor-browser-bundle/maint-5.0] Bug 16910: Mac OS app bundle has wrong copyright year.
by gk＠torproject.org 09 Sep '15

09 Sep '15

commit 7d0d8bb670f93be292997d6483825f661a29583f Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue Sep 8 10:29:10 2015 -0400 Bug 16910: Mac OS app bundle has wrong copyright year. Insert the year associated with the last tor-browser commit when generating the Info.plist file for Mac OS. --- gitian/build-helpers/fix-info-plist.py | 6 +++--- gitian/descriptors/mac/gitian-firefox.yml | 4 +++- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/gitian/build-helpers/fix-info-plist.py b/gitian/build-helpers/fix-info-plist.py index ac531ec..fae29ed 100755 --- a/gitian/build-helpers/fix-info-plist.py +++ b/gitian/build-helpers/fix-info-plist.py @@ -10,17 +10,17 @@ import plistlib import sys def usage(): - print >> sys.stderr, "usage: %s TORBROWSER_VERSION < Info.plist > FixedInfo.plist" % sys.argv[0] + print >> sys.stderr, "usage: %s TORBROWSER_VERSION YEAR < Info.plist > FixedInfo.plist" % sys.argv[0] sys.exit(2) _, args = getopt.gnu_getopt(sys.argv[1:], "") -if len(args) != 1: +if len(args) != 2: usage() TORBROWSER_VERSION = args[0] +YEAR = args[1] -YEAR = "2014" COPYRIGHT = "Tor Browser %s Copyright %s The Tor Project" % (TORBROWSER_VERSION, YEAR) plist = plistlib.readPlist(sys.stdin) diff --git a/gitian/descriptors/mac/gitian-firefox.yml b/gitian/descriptors/mac/gitian-firefox.yml index e8f1046..1c34544 100644 --- a/gitian/descriptors/mac/gitian-firefox.yml +++ b/gitian/descriptors/mac/gitian-firefox.yml @@ -58,6 +58,8 @@ script: | tar xaf MacOSX10.7.sdk.tar.gz # cd tor-browser + TB_COMMIT_DATE=$(git show -s --format='%ci') + COPYRIGHT_YEAR=${TB_COMMIT_DATE%%-*} mv .mozconfig-mac .mozconfig # .git and the src takes up a lot of useless space, and we need the space to build #git archive HEAD | tar -x -C $OUTDIR/src @@ -101,7 +103,7 @@ script: | # Adjust the Info.plist file INFO_PLIST=TorBrowser.app/Contents/Info.plist mv $INFO_PLIST tmp.plist - ~/build/fix-info-plist.py $TORBROWSER_VERSION < tmp.plist > $INFO_PLIST + ~/build/fix-info-plist.py $TORBROWSER_VERSION $COPYRIGHT_YEAR < tmp.plist > $INFO_PLIST rm -f tmp.plist ~/build/re-dzip.sh TorBrowser.app/Contents/Resources/omni.ja ~/build/re-dzip.sh TorBrowser.app/Contents/Resources/webapprt/omni.ja

1 0

[tor-browser-bundle/master] Bug 16910: Mac OS app bundle has wrong copyright year.
by gk＠torproject.org 09 Sep '15

09 Sep '15

commit 5019358bcac86508260703ae9cd99a4dfd2983e1 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue Sep 8 10:29:10 2015 -0400 Bug 16910: Mac OS app bundle has wrong copyright year. Insert the year associated with the last tor-browser commit when generating the Info.plist file for Mac OS. --- gitian/build-helpers/fix-info-plist.py | 6 +++--- gitian/descriptors/mac/gitian-firefox.yml | 4 +++- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/gitian/build-helpers/fix-info-plist.py b/gitian/build-helpers/fix-info-plist.py index ac531ec..fae29ed 100755 --- a/gitian/build-helpers/fix-info-plist.py +++ b/gitian/build-helpers/fix-info-plist.py @@ -10,17 +10,17 @@ import plistlib import sys def usage(): - print >> sys.stderr, "usage: %s TORBROWSER_VERSION < Info.plist > FixedInfo.plist" % sys.argv[0] + print >> sys.stderr, "usage: %s TORBROWSER_VERSION YEAR < Info.plist > FixedInfo.plist" % sys.argv[0] sys.exit(2) _, args = getopt.gnu_getopt(sys.argv[1:], "") -if len(args) != 1: +if len(args) != 2: usage() TORBROWSER_VERSION = args[0] +YEAR = args[1] -YEAR = "2014" COPYRIGHT = "Tor Browser %s Copyright %s The Tor Project" % (TORBROWSER_VERSION, YEAR) plist = plistlib.readPlist(sys.stdin) diff --git a/gitian/descriptors/mac/gitian-firefox.yml b/gitian/descriptors/mac/gitian-firefox.yml index 8b85b5a..1a35eab 100644 --- a/gitian/descriptors/mac/gitian-firefox.yml +++ b/gitian/descriptors/mac/gitian-firefox.yml @@ -58,6 +58,8 @@ script: | tar xaf MacOSX10.7.sdk.tar.gz # cd tor-browser + TB_COMMIT_DATE=$(git show -s --format='%ci') + COPYRIGHT_YEAR=${TB_COMMIT_DATE%%-*} mv .mozconfig-mac .mozconfig # .git and the src takes up a lot of useless space, and we need the space to build #git archive HEAD | tar -x -C $OUTDIR/src @@ -101,7 +103,7 @@ script: | # Adjust the Info.plist file INFO_PLIST=TorBrowser.app/Contents/Info.plist mv $INFO_PLIST tmp.plist - ~/build/fix-info-plist.py $TORBROWSER_VERSION < tmp.plist > $INFO_PLIST + ~/build/fix-info-plist.py $TORBROWSER_VERSION $COPYRIGHT_YEAR < tmp.plist > $INFO_PLIST rm -f tmp.plist ~/build/re-dzip.sh TorBrowser.app/Contents/Resources/omni.ja ~/build/re-dzip.sh TorBrowser.app/Contents/Resources/webapprt/omni.ja

1 0