- tbb-commits - lists.torproject.org

[tor-browser-build/master] Bug 20989: Browser sandbox profile is too restrictive on OSX 10.12.2
by boklm＠torproject.org 30 Jan '17

30 Jan '17

commit b53e849e92ca9defab6eede768ad85aad6e8e702 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue Jan 17 10:27:25 2017 -0500 Bug 20989: Browser sandbox profile is too restrictive on OSX 10.12.2 Allow full read access to all files under /usr/lib. Allow full read access to /Library/Preferences/com.apple.ViewBridge.plist. Allow writes to TorBrowser-Data/Browser/profiles.ini (otherwise, a new browser profile is created each time the browser is opened). --- projects/tor-browser/Bundle-Data/mac-sandbox/tb.sb | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/projects/tor-browser/Bundle-Data/mac-sandbox/tb.sb b/projects/tor-browser/Bundle-Data/mac-sandbox/tb.sb index eda7a1f..385e914 100644 --- a/projects/tor-browser/Bundle-Data/mac-sandbox/tb.sb +++ b/projects/tor-browser/Bundle-Data/mac-sandbox/tb.sb @@ -28,6 +28,7 @@ (allow file-read* (path "/Library/Preferences/com.apple.HIToolbox.plist") + (path "/Library/Preferences/com.apple.ViewBridge.plist") (path "/Library/Preferences/.GlobalPreferences.plist") (path "/dev/random") (path "/dev/urandom") @@ -41,6 +42,7 @@ (subpath "/Library/Fonts") (subpath "/System") (subpath "/private/var/folders") + (subpath "/usr/lib") (subpath "/usr/share") (home-subpath "/Downloads") (home-subpath "/Library/Input Methods") @@ -66,7 +68,6 @@ (path "/private/var/db/.AppleSetupDone") (path "/tmp") (path "/var") - (subpath "/usr/lib") (torbrowser-data-dir-path "/Tor/control.socket") (torbrowser-data-dir-path "/Tor/socks.socket") (path-regex "/private/tmp/Tor[-0-9]*/control.socket") @@ -86,11 +87,6 @@ (path "/Library/Preferences/.GlobalPreferences.plist") ) -; Disallow writes to the profiles ini file. -(deny file-write* - (torbrowser-data-dir-subpath "/Browser/profiles.ini") -) - (allow iokit-open) (allow ipc-posix-shm

1 0

[tor-browser-build/master] Bump NoScript version to 2.9.5.3
by boklm＠torproject.org 30 Jan '17

30 Jan '17

commit bb035e0a65cf13f9bb6b4048f1086c8effcfd8eb Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Jan 30 10:52:11 2017 +0100 Bump NoScript version to 2.9.5.3 --- projects/tor-browser/config | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/projects/tor-browser/config b/projects/tor-browser/config index d220913..9ec262b 100644 --- a/projects/tor-browser/config +++ b/projects/tor-browser/config @@ -43,9 +43,9 @@ input_files: - project: fonts name: fonts - filename: Bundle-Data - - URL: https://addons.cdn.mozilla.net/user-media/addons/722/noscript_security_suit… + - URL: https://addons.cdn.mozilla.net/user-media/addons/722/noscript_security_suit… name: noscript - sha256sum: ed71ca922790e81bc5e8c6a87bb81f394a38676ac37d1fba518a6a428d128dd5 + sha256sum: ce9779a3a5a2574b958f8e4d079a99d43a8f84193bef52c587c704ed81c2fbbd - filename: RelativeLink enable: '[% c("var/linux") %]' - project: libdmg-hfsplus

1 0

[tor-browser-build/master] binutils: build with hardening flags on Linux
by boklm＠torproject.org 30 Jan '17

30 Jan '17

commit 406904e68c064f29785d06f79d083170b85dee23 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Jan 30 10:37:51 2017 +0100 binutils: build with hardening flags on Linux --- projects/binutils/build | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/projects/binutils/build b/projects/binutils/build index 11e25d6..3ff4bdb 100644 --- a/projects/binutils/build +++ b/projects/binutils/build @@ -1,6 +1,21 @@ #!/bin/sh set -e +rootdir=$(pwd) distdir=/var/tmp/dist/binutils +[% IF c("var/linux") %] + # Config options for hardening-wrapper + export DEB_BUILD_HARDENING=1 + export DEB_BUILD_HARDENING_STACKPROTECTOR=1 + export DEB_BUILD_HARDENING_FORTIFY=1 + export DEB_BUILD_HARDENING_FORMAT=1 + export DEB_BUILD_HARDENING_PIE=1 + + # The libstdc++ shipped by default is non-PIC which breaks the binutils build + # if we build with DEB_BUILD_HARDENING_PIE=1. We need to install a PIC one AND + # make sure it gets used before the non-PIC one would. + ln -s /usr/lib/gcc/x86_64-linux-gnu/4.7/libstdc++_pic.a libstdc++.a + export LDFLAGS="-L$rootdir -lstdc++" +[% END %] tar xf [% project %]-[% c("version") %].tar.bz2 cd [% project %]-[% c("version") %] [% IF c('var/windows') -%]

1 0

[tor-browser-bundle/master] Bug 21332: libcxx is not needed for snowflake support on Linux
by gk＠torproject.org 27 Jan '17

27 Jan '17

commit 6e78d453a906909c5051e33f23033f13186cad82 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Jan 27 09:59:50 2017 +0000 Bug 21332: libcxx is not needed for snowflake support on Linux --- gitian/fetch-inputs.sh | 1 - gitian/verify-tags.sh | 1 - gitian/versions | 1 - gitian/versions.alpha | 1 - gitian/versions.nightly | 1 - 5 files changed, 5 deletions(-) diff --git a/gitian/fetch-inputs.sh b/gitian/fetch-inputs.sh index 8c543d8..0ae2df5 100755 --- a/gitian/fetch-inputs.sh +++ b/gitian/fetch-inputs.sh @@ -277,7 +277,6 @@ tor-browser https://git.torproject.org/tor-browser.git $TORBR cmake https://cmake.org/cmake.git $CMAKE_TAG llvm https://github.com/llvm-mirror/llvm $LLVM_TAG clang https://github.com/llvm-mirror/clang $CLANG_TAG -libcxx https://github.com/llvm-mirror/libcxx $LIBCXX_TAG mingw-w64-git http://git.code.sf.net/p/mingw-w64/mingw-w64 $MINGW_TAG pyptlib https://git.torproject.org/pluggable-transports/pyptlib.git $PYPTLIB_TAG obfsproxy https://git.torproject.org/pluggable-transports/obfsproxy.git $OBFSPROXY_TAG diff --git a/gitian/verify-tags.sh b/gitian/verify-tags.sh index 368a990..e8dfe3f 100755 --- a/gitian/verify-tags.sh +++ b/gitian/verify-tags.sh @@ -111,7 +111,6 @@ while read dir commit; do done << EOF llvm $LLVM_TAG clang $CLANG_TAG -libcxx $LIBCXX_TAG mingw-w64-git $MINGW_TAG libdmg-hfsplus $LIBDMG_TAG libfte $LIBFTE_TAG diff --git a/gitian/versions b/gitian/versions index 598a945..91bea14 100755 --- a/gitian/versions +++ b/gitian/versions @@ -25,7 +25,6 @@ LIBEVENT_TAG=release-2.0.22-stable CMAKE_TAG=v2.8.12.2 LLVM_TAG=8f188e0ea735ac9383a65a0d1c846eb790c2ec74 # r247539 CLANG_TAG=592b43b609b42cffd1531a700c140e10766bf049 # r247539 -LIBCXX_TAG=af9a44f256be54de6874d1eefd1d282d0671c0cf # r247539 MINGW_TAG=a0cd5afeb60be3be0860e9a203314c10485bb9b8 PYPTLIB_TAG=pyptlib-0.0.6 OBFSPROXY_TAG=obfsproxy-0.2.12 diff --git a/gitian/versions.alpha b/gitian/versions.alpha index a6f1aac..0644778 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -25,7 +25,6 @@ LIBEVENT_TAG=release-2.0.22-stable CMAKE_TAG=v2.8.12.2 LLVM_TAG=8f188e0ea735ac9383a65a0d1c846eb790c2ec74 # r247539 CLANG_TAG=592b43b609b42cffd1531a700c140e10766bf049 # r247539 -LIBCXX_TAG=af9a44f256be54de6874d1eefd1d282d0671c0cf # r247539 MINGW_TAG=a0cd5afeb60be3be0860e9a203314c10485bb9b8 PYPTLIB_TAG=pyptlib-0.0.6 OBFSPROXY_TAG=obfsproxy-0.2.12 diff --git a/gitian/versions.nightly b/gitian/versions.nightly index d181106..ac8cfd1 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -32,7 +32,6 @@ LIBEVENT_TAG=release-2.0.22-stable CMAKE_TAG=v2.8.12.2 LLVM_TAG=8f188e0ea735ac9383a65a0d1c846eb790c2ec74 # r247539 CLANG_TAG=592b43b609b42cffd1531a700c140e10766bf049 # r247539 -LIBCXX_TAG=af9a44f256be54de6874d1eefd1d282d0671c0cf # r247539 MINGW_TAG=a0cd5afeb60be3be0860e9a203314c10485bb9b8 PYPTLIB_TAG=master OBFSPROXY_TAG=master

1 0

[tor-browser-bundle/master] Fix typo and copyright date python helper
by gk＠torproject.org 27 Jan '17

27 Jan '17

commit cad2bdae295d3d2e6bbcd63a195d758e265efd45 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Jan 27 11:43:19 2017 +0000 Fix typo and copyright date python helper --- gitian/build-helpers/pe_checksum_fix.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gitian/build-helpers/pe_checksum_fix.py b/gitian/build-helpers/pe_checksum_fix.py index 101e77f..85d8fef 100755 --- a/gitian/build-helpers/pe_checksum_fix.py +++ b/gitian/build-helpers/pe_checksum_fix.py @@ -1,6 +1,6 @@ #!/usr/bin/env python -# Copyright (c) 2015, The Tor Project, Inc. +# Copyright (c) 2015-2017, The Tor Project, Inc. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are @@ -37,7 +37,7 @@ SHA256 mismatch if one tries to check that the binary we offer is actually the the one we got from our reproducible builds. This small Python snippet does both things: It pads the .exe if necessary and it -recalculates the PE-file checksum. Details of the discussion can be foun in bug +recalculates the PE-file checksum. Details of the discussion can be found in bug 15339: https://bugs.torproject.org/15539. Thanks to a cypherpunk for this workaround idea.

1 0

[torbutton/master] Bug 21324: Don't update NoScript button with timer update
by gk＠torproject.org 26 Jan '17

26 Jan '17

commit 8bc9aef5b873eecdae32a34f69170006c31eeddc Author: Georg Koppen <gk(a)torproject.org> Date: Thu Jan 26 15:49:11 2017 +0000 Bug 21324: Don't update NoScript button with timer update --- src/chrome/content/torbutton.js | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index 62b9371..990a990 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -140,9 +140,13 @@ var torbutton_unique_pref_observer = } return; } - + if (topic != "nsPref:changed") return; - if (data.startsWith("noscript.")) { + // Make sure the NoScript button shows the current NoScript state. We + // don't want to run the update function, though, if just a timer gets + // updated. Fixes bug 21324. + if (data.startsWith("noscript.") && + data !== "noscript.subscription.lastCheck") { torbutton_update_noscript_button(); } switch (data) {

1 0

[tor-launcher/maint-0.2.10] Bug 21264: Add a README file.
by gk＠torproject.org 26 Jan '17

26 Jan '17

commit e16b92f0db218f9441cdf5ae007a5807da520615 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Thu Jan 26 10:25:17 2017 -0500 Bug 21264: Add a README file. --- README | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) diff --git a/README b/README new file mode 100644 index 0000000..568acc1 --- /dev/null +++ b/README @@ -0,0 +1,50 @@ +PLEASE NOTE: + Tor Launcher is packaged with Tor Browser, Tor Messenger, and + other Tor-enabled applications and is designed for those + applications. You should not install and try to use it in + Mozilla Firefox or another Firefox-based browser. + +OVERVIEW +Tor Launcher is a browser extension that starts the tor process +(which connects the browser and other applications to the Tor +Network), and Tor Launcher helps people configure and use Tor. The +first window that you see when you start Tor Browser is displayed +by Tor Launcher. + +BUG TRACKER +Tor Launcher bugs and enhancement requests are tracked using the +Tor Project's Trac system. Open the following link to view a list +of open tickets: + https://trac.torproject.org/projects/tor/query?status=!closed&component=App… + +SOURCE CODE +The main Tor Launcher Git repository may be cloned by using either +of these URLs: + https://git.torproject.org/tor-launcher.git + http://dccbbv6cooddgcrq.onion/tor-launcher.git + +A browsable view of the code is available via: + https://gitweb.torproject.org/tor-launcher.git + +The main development branch is master, which is currently used for +the hardened Tor Browser releases. Maintenance branches are used +for other product releases; e.g., maint-0.2.10 is a branch that is +used for releases in the Tor Browser 6.5 series. + +BUILDING TOR LAUNCHER +Official builds of Tor Launcher are done as part of a larger +application build process. For example, look here for information +about the Tor Browser build process: + https://trac.torproject.org/projects/tor/wiki/doc/TorBrowser/Hacking + +If you want to build your own standalone copy of Tor Launcher in +order to test a translation or code change that you have made, run +the following command: + make package + +The resulting xpi file is created in a subdirectory named pkg. + +CONTACTING THE DEVELOPERS +To contact the Tor Launcher developers, use the #tor-dev channel +on irc.oftc.net or post a message to the tbb-dev mailing list (see +https://lists.torproject.org/cgi-bin/mailman/listinfo/tbb-dev).

1 0

[tor-launcher/master] Bug 21264: Add a README file.
by brade＠torproject.org 26 Jan '17

26 Jan '17

commit fd0ae33ec9af248ebbcea8774a0349a2aa1413ca Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Thu Jan 26 10:25:17 2017 -0500 Bug 21264: Add a README file. --- README | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) diff --git a/README b/README new file mode 100644 index 0000000..568acc1 --- /dev/null +++ b/README @@ -0,0 +1,50 @@ +PLEASE NOTE: + Tor Launcher is packaged with Tor Browser, Tor Messenger, and + other Tor-enabled applications and is designed for those + applications. You should not install and try to use it in + Mozilla Firefox or another Firefox-based browser. + +OVERVIEW +Tor Launcher is a browser extension that starts the tor process +(which connects the browser and other applications to the Tor +Network), and Tor Launcher helps people configure and use Tor. The +first window that you see when you start Tor Browser is displayed +by Tor Launcher. + +BUG TRACKER +Tor Launcher bugs and enhancement requests are tracked using the +Tor Project's Trac system. Open the following link to view a list +of open tickets: + https://trac.torproject.org/projects/tor/query?status=!closed&component=App… + +SOURCE CODE +The main Tor Launcher Git repository may be cloned by using either +of these URLs: + https://git.torproject.org/tor-launcher.git + http://dccbbv6cooddgcrq.onion/tor-launcher.git + +A browsable view of the code is available via: + https://gitweb.torproject.org/tor-launcher.git + +The main development branch is master, which is currently used for +the hardened Tor Browser releases. Maintenance branches are used +for other product releases; e.g., maint-0.2.10 is a branch that is +used for releases in the Tor Browser 6.5 series. + +BUILDING TOR LAUNCHER +Official builds of Tor Launcher are done as part of a larger +application build process. For example, look here for information +about the Tor Browser build process: + https://trac.torproject.org/projects/tor/wiki/doc/TorBrowser/Hacking + +If you want to build your own standalone copy of Tor Launcher in +order to test a translation or code change that you have made, run +the following command: + make package + +The resulting xpi file is created in a subdirectory named pkg. + +CONTACTING THE DEVELOPERS +To contact the Tor Launcher developers, use the #tor-dev channel +on irc.oftc.net or post a message to the tbb-dev mailing list (see +https://lists.torproject.org/cgi-bin/mailman/listinfo/tbb-dev).

1 0

[tor-browser-bundle/hardened-builds] Bug 21318: Use MAKEOPTS for GMP build
by gk＠torproject.org 25 Jan '17

25 Jan '17

commit 1d289e1565405dbb8f328d466716dc754db96017 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Jan 25 13:42:29 2017 +0000 Bug 21318: Use MAKEOPTS for GMP build --- gitian/descriptors/linux/gitian-utils.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gitian/descriptors/linux/gitian-utils.yml b/gitian/descriptors/linux/gitian-utils.yml index 2d095d0..a0590e3 100644 --- a/gitian/descriptors/linux/gitian-utils.yml +++ b/gitian/descriptors/linux/gitian-utils.yml @@ -141,7 +141,7 @@ script: | # --enable-fat makes the binaries slightly bigger but fixes reproducibility # issues when compiling on LXC. See bug 12238 comment 4. ./configure --prefix=$INSTDIR/gmp --disable-static --enable-shared --enable-cxx --enable-fat - make + make $MAKEOPTS make install cd ..

1 0

[tor-browser-bundle/master] Bug 21318: Use MAKEOPTS for GMP build
by gk＠torproject.org 25 Jan '17

25 Jan '17

commit 18bb5d3c20f563f774a7c935b1572f60d6330a06 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Jan 25 13:42:29 2017 +0000 Bug 21318: Use MAKEOPTS for GMP build --- gitian/descriptors/linux/gitian-utils.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gitian/descriptors/linux/gitian-utils.yml b/gitian/descriptors/linux/gitian-utils.yml index b5246f4..d10422b 100644 --- a/gitian/descriptors/linux/gitian-utils.yml +++ b/gitian/descriptors/linux/gitian-utils.yml @@ -120,7 +120,7 @@ script: | # --enable-fat makes the binaries slightly bigger but fixes reproducibility # issues when compiling on LXC. See bug 12238 comment 4. ./configure --prefix=$INSTDIR/gmp --disable-static --enable-shared --enable-cxx --enable-fat - make + make $MAKEOPTS make install cd ..

1 0