- tbb-commits - lists.torproject.org

[tor-browser-bundle/hardened-builds] No old OS X toolchain anymore
by gk＠torproject.org 08 Apr '17

08 Apr '17

commit c71de11f9ee2828526fdd7397441163aa737d6bf Author: Georg Koppen <gk(a)torproject.org> Date: Sat Apr 8 13:46:47 2017 +0000 No old OS X toolchain anymore --- gitian/fetch-inputs.sh | 6 +++--- gitian/versions.nightly | 1 - 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/gitian/fetch-inputs.sh b/gitian/fetch-inputs.sh index e70eb4c..9665917 100755 --- a/gitian/fetch-inputs.sh +++ b/gitian/fetch-inputs.sh @@ -132,7 +132,7 @@ do fi done -for i in TOOLCHAIN4_OLD OSXSDK OSXSDK_OLD MSVCR100 +for i in OSXSDK MSVCR100 do PACKAGE="${i}_PACKAGE" URL="${MIRROR_URL}${!PACKAGE}" @@ -173,8 +173,8 @@ done wget -U "" -N ${NOSCRIPT_URL} # Verify packages with weak or no signatures via direct sha256 check -# (OpenSSL is signed with MD5, and OSXSDK + OSXSDK_OLD are not signed at all) -for i in OSXSDK OSXSDK_OLD TOOLCHAIN4_OLD CCTOOLS NOSCRIPT MSVCR100 PYCRYPTO ARGPARSE PYYAML ZOPEINTERFACE TWISTED SETUPTOOLS OPENSSL GMP PARSLEY GO14 GO GCC STIXMATHFONT NOTOEMOJIFONT NOTOJPFONT NOTOKRFONT NOTOSCFONT NOTOTCFONT NSIS NSIS_DEBIAN +# (OpenSSL is signed with MD5, and OSXSDK are not signed at all) +for i in OSXSDK CCTOOLS NOSCRIPT MSVCR100 PYCRYPTO ARGPARSE PYYAML ZOPEINTERFACE TWISTED SETUPTOOLS OPENSSL GMP PARSLEY GO14 GO GCC STIXMATHFONT NOTOEMOJIFONT NOTOJPFONT NOTOKRFONT NOTOSCFONT NOTOTCFONT NSIS NSIS_DEBIAN do PACKAGE="${i}_PACKAGE" HASH="${i}_HASH" diff --git a/gitian/versions.nightly b/gitian/versions.nightly index ddbbc05..236af56 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -86,7 +86,6 @@ GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 NOSCRIPT_PACKAGE=noscript_security_suite-5.0.2-fx+sm.xpi CCTOOLS_PACKAGE=cctools.tar.gz OSXSDK_PACKAGE=MacOSX10.7.sdk.tar.gz -OSXSDK_OLD_PACKAGE=apple-uni-sdk-10.6_20110407-0.flosoft1_i386.deb MSVCR100_PACKAGE=msvcr100.dll BINUTILS_PACKAGE=binutils-${BINUTILS_VER}.tar.bz2 GCC_PACKAGE=gcc-${GCC_VER}.tar.bz2

1 0

[tor-browser-bundle/master] Bug 20683: Integrate Selfrando into alpha Linux builds
by gk＠torproject.org 07 Apr '17

07 Apr '17

commit 0ea68f848f54aaeceeeed22dc1496d3723cbe128 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Apr 7 16:50:29 2017 +0000 Bug 20683: Integrate Selfrando into alpha Linux builds Selfrando is a new defense against code reuse attacks developed by the Redactor and Readactor++ people. We should give it a wider testing audience by including it in the alpha series. This is currently only available for 64bit Linux builds, though. Supporting other platforms and architectures is work in progress. --- RelativeLink/start-tor-browser | 1 + gitian/descriptors/linux/gitian-firefox.yml | 17 +++++++++++++ gitian/descriptors/linux/gitian-utils.yml | 38 ++++++++++++++++++++++++++++ gitian/fetch-inputs.sh | 4 ++- gitian/gpg/ELFUTILS.gpg | Bin 0 -> 10483 bytes gitian/mkbundle-linux.sh | 13 ++++++---- gitian/verify-tags.sh | 3 ++- gitian/versions.alpha | 4 +++ gitian/versions.nightly | 4 +++ 9 files changed, 77 insertions(+), 7 deletions(-) diff --git a/RelativeLink/start-tor-browser b/RelativeLink/start-tor-browser index a78b367..2dd40fc 100755 --- a/RelativeLink/start-tor-browser +++ b/RelativeLink/start-tor-browser @@ -270,6 +270,7 @@ fi LD_LIBRARY_PATH="${HOME}/TorBrowser/Tor/" export LD_LIBRARY_PATH +export SELFRANDO_write_layout_file= function setControlPortPasswd() { local ctrlPasswd=$1 diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index d607f6a..b20941a 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -27,6 +27,8 @@ reference_datetime: "2000-01-01 00:00:00" remotes: - "url": "https://git.torproject.org/tor-browser.git" "dir": "tor-browser" +- "url": "https://github.com/immunant/selfrando.git" + "dir": "selfrando" files: - "binutils-linux32-utils.zip" - "binutils-linux64-utils.zip" @@ -36,6 +38,8 @@ files: - "re-dzip.sh" - "dzip.sh" - "versions" +# XXX: 64bits only for now :(, see #20683. +- "selfrando-linux64-utils.zip" script: | source versions INSTDIR="$HOME/install" @@ -53,6 +57,11 @@ script: | export DEB_BUILD_HARDENING_FORMAT=1 export DEB_BUILD_HARDENING_PIE=1 # + # XXX: 64bits only for now :(, see #20683. + if [ $GBUILD_BITS == "64" ]; + then + unzip -d $INSTDIR selfrando-linux64-utils.zip + fi # Preparing Binutils and GCC for Tor Browser unzip -d $INSTDIR binutils-linux$GBUILD_BITS-utils.zip # Make sure gold is used with the hardening wrapper for full RELRO, see @@ -94,6 +103,14 @@ script: | find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" rm -f configure rm -f js/src/configure + # XXX: 64bits only for now :(, see #20683. + if [ $GBUILD_BITS == "64" ]; + then + # Selfrando wrapper + export PATH="$HOME/build/selfrando/Tools/TorBrowser/tc-wrapper/:$PATH" + # We need to avoid the shuffling while building as this breaks compilation + export SELFRANDO_skip_shuffle= + fi make -f client.mk configure CONFIGURE_ARGS="--with-tor-browser-version=${TORBROWSER_VERSION} --with-distribution-id=org.torproject --enable-update-channel=${TORBROWSER_UPDATE_CHANNEL} --enable-bundled-fonts" find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" make $MAKEOPTS -f client.mk build diff --git a/gitian/descriptors/linux/gitian-utils.yml b/gitian/descriptors/linux/gitian-utils.yml index d10422b..1cadb61 100644 --- a/gitian/descriptors/linux/gitian-utils.yml +++ b/gitian/descriptors/linux/gitian-utils.yml @@ -24,10 +24,14 @@ packages: - "libssl-dev" # Needed for binutils (64bit) as we are building with PIE enabled. - "libstdc++6-4.7-pic" +# Needed for Selfrando +- "scons" reference_datetime: "2000-01-01 00:00:00" remotes: - "url": "https://github.com/libevent/libevent.git" "dir": "libevent" +- "url": "https://github.com/immunant/selfrando.git" + "dir": "selfrando" files: - "binutils.tar.bz2" - "gcc.tar.bz2" @@ -37,6 +41,7 @@ files: - "go.tar.gz" - "versions" - "dzip.sh" +- "elfutils.tar.bz2" script: | INSTDIR="$HOME/install" source versions @@ -52,6 +57,12 @@ script: | export DEB_BUILD_HARDENING_FORMAT=1 export DEB_BUILD_HARDENING_PIE=1 + ARCH="" + if [ $GBUILD_BITS == "64" ]; + then + ARCH="64" + fi + # Building Binutils tar xjf binutils.tar.bz2 # The libstdc++ shipped by default is non-PIC which breaks the binutils build @@ -86,6 +97,28 @@ script: | cd .. export DEB_BUILD_HARDENING_FORMAT=1 + export PATH="$INSTDIR/binutils/bin:$INSTDIR/gcc/bin:$PATH" + export LD_LIBRARY_PATH="$INSTDIR/gcc/lib$ARCH" + + # XXX: 64bits only for now :(, see #20683. + if [ $GBUILD_BITS == "64" ]; + then + # Building Elfutils + tar xjf elfutils.tar.bz2 + cd elfutils*/ + ./configure --prefix=$INSTDIR/elfutils + make $MAKEOPTS + make install + cd .. + + # Building Selfrando + cd selfrando + scons -Q arch=x86_64 LIBELF_PATH="$INSTDIR/elfutils" FORCE_INPLACE=1 DEBUG_LEVEL=env WRITE_LAYOUTS=env LOG=console + mkdir -p $INSTDIR/selfrando + cp out/x86_64/bin/* $INSTDIR/selfrando/ + cd .. + fi + # Building Libevent cd libevent ./autogen.sh @@ -157,4 +190,9 @@ script: | ~/build/dzip.sh libevent-${LIBEVENT_TAG#release-}-linux$GBUILD_BITS-utils.zip libevent ~/build/dzip.sh gmp-$GMP_VER-linux$GBUILD_BITS-utils.zip gmp ~/build/dzip.sh go-$GO_VER-linux$GBUILD_BITS-utils.zip go + # XXX: 64bits only for now :(, see #20683. + if [ $GBUILD_BITS == "64" ]; + then + ~/build/dzip.sh selfrando-$SELFRANDO_TAG-linux$GBUILD_BITS-utils.zip selfrando + fi cp *utils.zip $OUTDIR/ diff --git a/gitian/fetch-inputs.sh b/gitian/fetch-inputs.sh index b7fcf36..c110eb8 100755 --- a/gitian/fetch-inputs.sh +++ b/gitian/fetch-inputs.sh @@ -113,7 +113,7 @@ update_git() { ############################################################################## # Get+verify sigs that exist -for i in OPENSSL BINUTILS GCC PYTHON_MSI GMP LLVM CFE LIBCXX LIBCXXABI +for i in OPENSSL BINUTILS GCC PYTHON_MSI GMP LLVM CFE LIBCXX LIBCXXABI ELFUTILS do PACKAGE="${i}_PACKAGE" URL="${i}_URL" @@ -252,6 +252,7 @@ ln -sf "$GO_PACKAGE" go.tar.gz ln -sf "$NSIS_PACKAGE" nsis.tar.bz2 ln -sf "$NSIS_DEBIAN_PACKAGE" nsis-debian.tar.xz ln -sf "$YASM_PACKAGE" yasm.tar.gz +ln -sf "$ELFUTILS_PACKAGE" elfutils.tar.bz2 # Fetch latest gitian-builder itself # XXX - this is broken if a non-standard inputs dir is selected using the command line flag. @@ -303,6 +304,7 @@ depot_tools https://chromium.googlesource.com/chromium/tools/depot_too go-webrtc https://github.com/keroserene/go-webrtc $GO_WEBRTC_TAG snowflake https://git.torproject.org/pluggable-transports/snowflake.git $SNOWFLAKE_TAG uniuri https://github.com/dchest/uniuri $UNIURI_TAG +selfrando https://github.com/immunant/selfrando.git $SELFRANDO_TAG EOF # HTTPS-Everywhere is special, too. We need to initialize the git submodules and diff --git a/gitian/gpg/ELFUTILS.gpg b/gitian/gpg/ELFUTILS.gpg new file mode 100644 index 0000000..f1cd4b3 Binary files /dev/null and b/gitian/gpg/ELFUTILS.gpg differ diff --git a/gitian/mkbundle-linux.sh b/gitian/mkbundle-linux.sh index 6dbbe51..0a1613f 100755 --- a/gitian/mkbundle-linux.sh +++ b/gitian/mkbundle-linux.sh @@ -35,7 +35,7 @@ fi if [ -z "$VM_MEMORY" ]; then - export VM_MEMORY=4000 + export VM_MEMORY=6000 fi ./make-vms.sh @@ -99,7 +99,7 @@ then fi cd $GITIAN_DIR - +# XXX: 64bits selfrando only for now :(, see #20683. if [ ! -f inputs/binutils-$BINUTILS_VER-linux32-utils.zip -o \ ! -f inputs/binutils-$BINUTILS_VER-linux64-utils.zip -o \ ! -f inputs/gcc-$GCC_VER-linux32-utils.zip -o \ @@ -111,13 +111,14 @@ if [ ! -f inputs/binutils-$BINUTILS_VER-linux32-utils.zip -o \ ! -f inputs/gmp-$GMP_VER-linux32-utils.zip -o \ ! -f inputs/gmp-$GMP_VER-linux64-utils.zip -o \ ! -f inputs/go-$GO_VER-linux32-utils.zip -o \ - ! -f inputs/go-$GO_VER-linux64-utils.zip ]; + ! -f inputs/go-$GO_VER-linux64-utils.zip -o \ + ! -f inputs/selfrando-$SELFRANDO_TAG-linux64-utils.zip ]; then echo echo "****** Starting Utilities Component of Linux Bundle (1/7 for Linux) ******" echo - ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit libevent=$LIBEVENT_TAG $DESCRIPTOR_DIR/linux/gitian-utils.yml + ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit libevent=$LIBEVENT_TAG,selfrando=$SELFRANDO_TAG $DESCRIPTOR_DIR/linux/gitian-utils.yml if [ $? -ne 0 ]; then #mv var/build.log ./utils-fail-linux.log.`date +%Y%m%d%H%M%S` @@ -138,6 +139,7 @@ then ln -sf gmp-$GMP_VER-linux64-utils.zip gmp-linux64-utils.zip ln -sf go-$GO_VER-linux32-utils.zip go-linux32-utils.zip ln -sf go-$GO_VER-linux64-utils.zip go-linux64-utils.zip + ln -sf selfrando-$SELFRANDO_TAG-linux64-utils.zip selfrando-linux64-utils.zip cd .. #cp -a result/utils-linux-res.yml inputs/ else @@ -159,6 +161,7 @@ else ln -sf gmp-$GMP_VER-linux64-utils.zip gmp-linux64-utils.zip ln -sf go-$GO_VER-linux32-utils.zip go-linux32-utils.zip ln -sf go-$GO_VER-linux64-utils.zip go-linux64-utils.zip + ln -sf selfrando-$SELFRANDO_TAG-linux64-utils.zip selfrando-linux64-utils.zip cd .. fi @@ -193,7 +196,7 @@ then echo "****** Starting TorBrowser Component of Linux Bundle (3/7 for Linux) ******" echo - ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit tor-browser=$TORBROWSER_TAG,faketime=$FAKETIME_TAG $DESCRIPTOR_DIR/linux/gitian-firefox.yml + ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit tor-browser=$TORBROWSER_TAG,faketime=$FAKETIME_TAG,selfrando=$SELFRANDO_TAG $DESCRIPTOR_DIR/linux/gitian-firefox.yml if [ $? -ne 0 ]; then #mv var/build.log ./firefox-fail-linux.log.`date +%Y%m%d%H%M%S` diff --git a/gitian/verify-tags.sh b/gitian/verify-tags.sh index dc207f5..7d551b8 100755 --- a/gitian/verify-tags.sh +++ b/gitian/verify-tags.sh @@ -125,10 +125,11 @@ depot_tools $DEPOT_TOOLS_TAG go-webrtc $GO_WEBRTC_TAG snowflake $SNOWFLAKE_TAG uniuri $UNIURI_TAG +selfrando $SELFRANDO_TAG EOF # Verify signatures on signed packages -for i in OPENSSL BINUTILS GCC PYTHON_MSI GMP LLVM CFE LIBCXX LIBCXXABI +for i in OPENSSL BINUTILS GCC PYTHON_MSI GMP LLVM CFE LIBCXX LIBCXXABI ELFUTILS do PACKAGE="${i}_PACKAGE" URL="${i}_URL" diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 2e6fb2c..be79310 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -47,6 +47,7 @@ WEBRTC_TAG=c279861207c5b15fc51069e96595782350e0ac12 # https://chromium.googlesou GO_WEBRTC_TAG=ab1b64862e0c4b4182010699911c2c5818f0a101 SNOWFLAKE_TAG=9f2e9a6ecb696149708716ca06ce842df03cf492 UNIURI_TAG=8902c56451e9b58ff940bbe5fec35d5f9c04584a +SELFRANDO_TAG=40bfacc7175301bcb9e01d2ad05e72c0e35291c8 GITIAN_TAG=tor-browser-builder-4-2 @@ -71,6 +72,7 @@ GO14_VER=1.4.3 GO_VER=1.7.5 NSIS_VER=2.51 YASM_VER=1.2.0 +ELFUTILS_VER=0.160 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz @@ -105,6 +107,7 @@ NOTOKRFONT_PACKAGE=NotoSansKR-Regular.otf NOTOSCFONT_PACKAGE=NotoSansSC-Regular.otf NOTOTCFONT_PACKAGE=NotoSansTC-Regular.otf YASM_PACKAGE=yasm-${YASM_VER}.tar.gz +ELFUTILS_PACKAGE=elfutils-${ELFUTILS_VER}.tar.bz2 # Hashes for packages with weak sigs or no sigs OPENSSL_HASH=6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 @@ -167,3 +170,4 @@ NOTOKRFONT_URL=${NOTOCJKBASE_URL}/${NOTOKRFONT_PACKAGE} NOTOSCFONT_URL=${NOTOCJKBASE_URL}/${NOTOSCFONT_PACKAGE} NOTOTCFONT_URL=${NOTOCJKBASE_URL}/${NOTOTCFONT_PACKAGE} YASM_URL=https://www.tortall.net/projects/yasm/releases/${YASM_PACKAGE} +ELFUTILS_URL=https://fedorahosted.org/releases/e/l/elfutils/${ELFUTILS_VER}/${ELFUTILS_PACKAGE} diff --git a/gitian/versions.nightly b/gitian/versions.nightly index b45e7d6..43c5234 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -54,6 +54,7 @@ WEBRTC_TAG=c279861207c5b15fc51069e96595782350e0ac12 # https://chromium.googlesou GO_WEBRTC_TAG=master SNOWFLAKE_TAG=master UNIURI_TAG=master +SELFRANDO_TAG=62932627f30551e7b0b8e12d0453100f0eede017 GITIAN_TAG=tor-browser-builder-4 @@ -78,6 +79,7 @@ GO14_VER=1.4.3 GO_VER=1.7.5 NSIS_VER=2.51 YASM_VER=1.2.0 +ELFUTILS_VER=0.166 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz @@ -112,6 +114,7 @@ NOTOKRFONT_PACKAGE=NotoSansKR-Regular.otf NOTOSCFONT_PACKAGE=NotoSansSC-Regular.otf NOTOTCFONT_PACKAGE=NotoSansTC-Regular.otf YASM_PACKAGE=yasm-${YASM_VER}.tar.gz +ELFUTILS_PACKAGE=elfutils-${ELFUTILS_VER}.tar.bz2 # Hashes for packages with weak sigs or no sigs OPENSSL_HASH=6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 @@ -174,3 +177,4 @@ NOTOKRFONT_URL=${NOTOCJKBASE_URL}/${NOTOKRFONT_PACKAGE} NOTOSCFONT_URL=${NOTOCJKBASE_URL}/${NOTOSCFONT_PACKAGE} NOTOTCFONT_URL=${NOTOCJKBASE_URL}/${NOTOTCFONT_PACKAGE} YASM_URL=https://www.tortall.net/projects/yasm/releases/${YASM_PACKAGE} +ELFUTILS_URL=https://fedorahosted.org/releases/e/l/elfutils/${ELFUTILS_VER}/${ELFUTILS_PACKAGE}

1 0

[torbutton/master] Revert "Bug 21201.1: Use new svg.disabled pref"
by gk＠torproject.org 07 Apr '17

07 Apr '17

commit de57f2c4ef125ca1334e83efa1949770a87e7c38 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Apr 7 08:26:32 2017 +0000 Revert "Bug 21201.1: Use new svg.disabled pref" This reverts commit 1b7ce9f53f6a27e8684fdcda0b3be086a914d054. We did not backport Mozilla's patch which uses the new preference. Thus we need to stick to the old one for now. Closes #21885. --- src/modules/security-prefs.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/modules/security-prefs.js b/src/modules/security-prefs.js index f508b87..4a39ca8 100644 --- a/src/modules/security-prefs.js +++ b/src/modules/security-prefs.js @@ -29,7 +29,7 @@ const kSecuritySettings = { "noscript.global" : [, false, false, false, true ], "noscript.globalHttpsWhitelist" : [, false, true, true, false], "noscript.forbidFonts" : [, true, false, false, false], - "svg.disabled" : [, true, false, false, false], + "svg.in-content.enabled" : [, false, true, true, true ], }; // The Security Settings prefs in question.

1 0

[tor-browser-build/master] Update mozconfig files
by boklm＠torproject.org 07 Apr '17

07 Apr '17

commit e6fb26f57bd0aca191e55798f63a533ea82675cd Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri Apr 7 13:41:03 2017 +0200 Update mozconfig files Update the mozconfig files with the changes from the versions in tor-browser.git. We are currently not using the mozconfig files from tor-browser.git directly as we need to modify some of them. --- projects/firefox/mozconfig-linux-i686 | 11 ++++------- projects/firefox/mozconfig-linux-x86_64 | 11 ++++------- projects/firefox/mozconfig-osx-x86_64 | 4 +--- projects/firefox/mozconfig-windows-i686 | 5 +---- 4 files changed, 10 insertions(+), 21 deletions(-) diff --git a/projects/firefox/mozconfig-linux-i686 b/projects/firefox/mozconfig-linux-i686 index 306b674..8b4ecb3 100755 --- a/projects/firefox/mozconfig-linux-i686 +++ b/projects/firefox/mozconfig-linux-i686 @@ -5,10 +5,6 @@ mk_add_options MOZ_APP_DISPLAYNAME="Tor Browser" mk_add_options MOZILLA_OFFICIAL=1 mk_add_options BUILD_OFFICIAL=1 -# Use jemalloc 4.x. In 52ESR, we should use -# the --enable-jemalloc=4 flag instead: -export MOZ_JEMALLOC4=1 - export CFLAGS=-m32 export CXXFLAGS=-m32 export LDFLAGS=-m32 @@ -21,8 +17,10 @@ ac_add_options --enable-optimize #ac_add_options --disable-optimize ac_add_options --enable-official-branding +# Let's support GTK2 for ESR52 +ac_add_options --enable-default-toolkit=cairo-gtk2 + ac_add_options --enable-tor-browser-update -ac_add_options --enable-update-packaging ac_add_options --enable-signmar ac_add_options --enable-verify-mar @@ -34,7 +32,6 @@ ac_add_options --disable-maintenance-service ac_add_options --disable-crashreporter ac_add_options --disable-webrtc # Let's not compile EME at least until we can enable ClearKey and only Clearkey. -# (Apart from that there is no Adobe CRM module for Linux right now) ac_add_options --disable-eme #ac_add_options --disable-ctypes -ac_add_options --disable-loop +ac_add_options --enable-jemalloc=4 diff --git a/projects/firefox/mozconfig-linux-x86_64 b/projects/firefox/mozconfig-linux-x86_64 index a419808..cde5b49 100755 --- a/projects/firefox/mozconfig-linux-x86_64 +++ b/projects/firefox/mozconfig-linux-x86_64 @@ -5,16 +5,14 @@ mk_add_options MOZ_APP_DISPLAYNAME="Tor Browser" mk_add_options MOZILLA_OFFICIAL=1 mk_add_options BUILD_OFFICIAL=1 -# Use jemalloc 4.x. In 52ESR, we should use -# the --enable-jemalloc=4 flag instead: -export MOZ_JEMALLOC4=1 - ac_add_options --enable-optimize #ac_add_options --disable-optimize ac_add_options --enable-official-branding +# Let's support GTK2 for ESR52 +ac_add_options --enable-default-toolkit=cairo-gtk2 + ac_add_options --enable-tor-browser-update -ac_add_options --enable-update-packaging ac_add_options --enable-signmar ac_add_options --enable-verify-mar @@ -26,7 +24,6 @@ ac_add_options --disable-maintenance-service ac_add_options --disable-crashreporter ac_add_options --disable-webrtc # Let's not compile EME at least until we can enable ClearKey and only Clearkey. -# (Apart from that there is no Adobe CRM module for Linux right now) ac_add_options --disable-eme #ac_add_options --disable-ctypes -ac_add_options --disable-loop +ac_add_options --enable-jemalloc=4 diff --git a/projects/firefox/mozconfig-osx-x86_64 b/projects/firefox/mozconfig-osx-x86_64 index 259e745..c75b2f5 100644 --- a/projects/firefox/mozconfig-osx-x86_64 +++ b/projects/firefox/mozconfig-osx-x86_64 @@ -18,7 +18,7 @@ export AR=${TOOLCHAIN_PREFIX}ar export RANLIB=${TOOLCHAIN_PREFIX}ranlib export STRIP=${TOOLCHAIN_PREFIX}strip export OTOOL=${TOOLCHAIN_PREFIX}otool -export DSYMUTIL=$topsrcdir/clang/bin/llvm-dsymutil +export DSYMUTIL="$TOOLCHAIN_DIR/clang/bin/llvm-dsymutil" export HOST_CC="$TOOLCHAIN_DIR/clang/helpers/clang" export HOST_CXX="$TOOLCHAIN_DIR/clang/helpers/clang++" @@ -43,7 +43,6 @@ ac_add_options --disable-debug ac_add_options --enable-tor-browser-data-outside-app-dir ac_add_options --enable-tor-browser-update -ac_add_options --enable-update-packaging ac_add_options --enable-signmar ac_add_options --enable-verify-mar @@ -55,4 +54,3 @@ ac_add_options --disable-tests # (Apart from that there is no Adobe CRM module for OS X right now) ac_add_options --disable-eme # ac_add_options --disable-ctypes -ac_add_options --disable-loop diff --git a/projects/firefox/mozconfig-windows-i686 b/projects/firefox/mozconfig-windows-i686 index 33ea6d4..de86c49 100644 --- a/projects/firefox/mozconfig-windows-i686 +++ b/projects/firefox/mozconfig-windows-i686 @@ -2,6 +2,7 @@ CROSS_COMPILE=1 ac_add_options --enable-application=browser ac_add_options --target=i686-w64-mingw32 +ac_add_options --with-toolchain-prefix=i686-w64-mingw32- ac_add_options --enable-default-toolkit=cairo-windows mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/obj-mingw mk_add_options MOZ_APP_DISPLAYNAME="Tor Browser" @@ -14,7 +15,6 @@ ac_add_options --enable-strip ac_add_options --enable-official-branding ac_add_options --enable-tor-browser-update -ac_add_options --enable-update-packaging ac_add_options --enable-signmar ac_add_options --enable-verify-mar @@ -27,6 +27,3 @@ ac_add_options --disable-crashreporter ac_add_options --disable-maintenance-service ac_add_options --disable-webrtc ac_add_options --disable-tests - -#ac_add_options --disable-ctypes -ac_add_options --disable-loop

1 0

[tor-browser-build/master] Adapt OSX Firefox descriptor to ESR52
by boklm＠torproject.org 07 Apr '17

07 Apr '17

commit 449a330e2cb43e6eb9420987cf68fdd87561ff75 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri Apr 7 13:34:52 2017 +0200 Adapt OSX Firefox descriptor to ESR52 In tor-browser-bundle.git this change was done as part of commit cd4465477ac10d2b740d5a32505cdab5a197e405. --- projects/firefox/build | 1 - 1 file changed, 1 deletion(-) diff --git a/projects/firefox/build b/projects/firefox/build index 8b36428..4d83b28 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -152,7 +152,6 @@ done [% c("var/rezip", { rezip_file => 'Browser/browser/omni.ja' }) %] [% ELSIF c("var/osx") %] [% c("var/rezip", { rezip_file => 'TorBrowser.app/Contents/Resources/omni.ja' }) %] - [% c("var/rezip", { rezip_file => 'TorBrowser.app/Contents/Resources/webapprt/omni.ja' }) %] [% c("var/rezip", { rezip_file => 'TorBrowser.app/Contents/Resources/browser/omni.ja' }) %] [% END %]

1 0

[tor-browser-build/master] Bug 21709: Upgrade Go to 1.7.5.
by boklm＠torproject.org 07 Apr '17

07 Apr '17

commit 949c0d9e83d911b2fa80279edddb06c7e6299c80 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri Apr 7 13:11:41 2017 +0200 Bug 21709: Upgrade Go to 1.7.5. tor-browser-bundle.git commit: 1942f7b2f6e5f82c64dcfeab82713604866cb26f --- projects/go/config | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/projects/go/config b/projects/go/config index dbd7aab..89b4b45 100644 --- a/projects/go/config +++ b/projects/go/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 1.7.4 +version: 1.7.5 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' remote_docker: 1 @@ -75,7 +75,7 @@ input_files: enable: '[% c("var/windows") || c("var/osx") %]' - URL: 'https://golang.org/dl/go[% c("version") %].src.tar.gz' name: go - sha256sum: 4c189111e9ba651a2bb3ee868aa881fab36b2f2da3409e80885ca758a6b614cc + sha256sum: 4e834513a2079f8cbbd357502cccaac9507fd00a1efe672375798858ff291815 - URL: 'https://golang.org/dl/go[% c("var/go14_version") %].src.tar.gz' name: go14 sha256sum: 9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959

1 0

[tor-browser-build/master] Bug 21723: Fix inconsistent generation of MOZ_MACBUNDLE_ID
by boklm＠torproject.org 07 Apr '17

07 Apr '17

commit ec86de4f618aa28c3694a5af1fb941cde802cae6 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri Apr 7 13:12:44 2017 +0200 Bug 21723: Fix inconsistent generation of MOZ_MACBUNDLE_ID Use org.torproject as the MOZ_DISTRIBUTION_ID. This results in a bundle ID of org.torproject.torbrowser. tor-browser-bundle.git commit: 50b6e6fff4a535044f9b506854535df757125267 --- projects/firefox/build | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/firefox/build b/projects/firefox/build index 496c215..abd699b 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -73,7 +73,7 @@ export CC='gcc -m32' rm -f configure rm -f js/src/configure -make -f client.mk configure CONFIGURE_ARGS="--with-tor-browser-version=[% c("var/torbrowser_version") %] --enable-update-channel=[% c("var/torbrowser_update_channel") %] --enable-bundled-fonts" +make -f client.mk configure CONFIGURE_ARGS="--with-tor-browser-version=[% c("var/torbrowser_version") %] --with-distribution-id=org.torproject --enable-update-channel=[% c("var/torbrowser_update_channel") %] --enable-bundled-fonts" make -j8 -f client.mk build make -C obj-* package INNER_MAKE_PACKAGE=true

1 0

[tor-browser-build/master] Bug 21239: Adapt Linux Firefox descriptor to ESR52
by boklm＠torproject.org 07 Apr '17

07 Apr '17

commit 67fbf56501a186f0934db144c7087834229d5da4 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri Apr 7 13:33:19 2017 +0200 Bug 21239: Adapt Linux Firefox descriptor to ESR52 tor-browser-bundle.git commit: f279b94f424c1c7eeabaa0119ccfc8fea326bed6 --- projects/firefox/build | 8 +++----- projects/firefox/config | 9 ++++----- 2 files changed, 7 insertions(+), 10 deletions(-) diff --git a/projects/firefox/build b/projects/firefox/build index 1dce495..8b36428 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -35,8 +35,7 @@ mkdir -p $distdir/Browser [% END %] [% IF c("var/linux") %] -mkdir -p $distdir/Debug/Browser/components -mkdir -p $distdir/Debug/Browser/browser/components +mkdir -p $distdir/Debug/Browser/gmp-clearkey/0.1 [% END %] cd /var/tmp/build/[% project %]-[% c("version") %] @@ -124,7 +123,7 @@ cp -p obj-*/dist/host/bin/mbsdiff $MARTOOLS/ [% IF c("var/linux") %] cp -p obj-*/modules/libmar/tool/signmar $MARTOOLS/ cp -p obj-*/security/nss/cmd/certutil/certutil $MARTOOLS/ -NSS_LIBS="libfreebl3.so libmozsqlite3.so libnss3.so libnssdbm3.so libnssutil3.so libsmime3.so libsoftokn3.so libssl3.so" +NSS_LIBS="libmozsqlite3.so libnss3.so libnssdbm3.so libnssutil3.so libsmime3.so libssl3.so" NSPR_LIBS="libnspr4.so libplc4.so libplds4.so" for LIB in $NSS_LIBS $NSPR_LIBS; do cp -p obj-*/dist/bin/$LIB $MARTOOLS/ @@ -136,7 +135,7 @@ cd $distdir [% IF c("var/linux") %] # Strip and generate debuginfo for the firefox binary that we keep, all *.so # files, the plugin-container, and the updater (see ticket #10126) -for LIB in Browser/*.so Browser/webapprt-stub Browser/firefox Browser/plugin-container Browser/browser/components/*.so Browser/updater +for LIB in Browser/*.so Browser/firefox Browser/plugin-container Browser/gmp-clearkey/0.1/*.so Browser/updater do objcopy --only-keep-debug $LIB Debug/$LIB strip $LIB @@ -151,7 +150,6 @@ done [% IF c("var/windows") || c("var/linux") %] [% c("var/rezip", { rezip_file => 'Browser/omni.ja' }) %] [% c("var/rezip", { rezip_file => 'Browser/browser/omni.ja' }) %] - [% IF c("var/linux") %][% c("var/rezip", { rezip_file => 'Browser/webapprt/omni.ja' }) %][% END %] [% ELSIF c("var/osx") %] [% c("var/rezip", { rezip_file => 'TorBrowser.app/Contents/Resources/omni.ja' }) %] [% c("var/rezip", { rezip_file => 'TorBrowser.app/Contents/Resources/webapprt/omni.ja' }) %] diff --git a/projects/firefox/config b/projects/firefox/config index c71025d..83307d0 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -33,14 +33,14 @@ targets: arch_deps: - libgtk2.0-dev - libdbus-glib-1-dev - - libasound2-dev - - libgstreamer-plugins-base0.10-dev - libxt-dev - hardening-wrapper # To pass configure since ESR 31. - libpulse-dev # To pass configure since ESR 45. - libgconf2-dev + # To pass configure since ESR 52 + - libx11-xcb-dev # We built GCC but not the libmpc2, thus we need to install it - libmpc2 @@ -52,14 +52,13 @@ targets: - libc6-dev-i386 - libgtk2.0-dev:i386 - libdbus-glib-1-dev:i386 - - lib32asound2-dev - - libasound2-dev:i386 - - libgstreamer-plugins-base0.10-dev:i386 - libxt-dev:i386 # To pass configure since ESR 31. - libpulse-dev:i386 # To pass configure since ESR 45. - libgconf2-dev:i386 + # To pass configure since ESR 52 + - libx11-xcb-dev:i386 # We built GCC but not the libmpc2, thus we need to install it - libmpc2 - hardening-wrapper

1 0

[tor-browser-build/master] Bug 18831: Use own Yasm for Firefox cross-compilation
by boklm＠torproject.org 07 Apr '17

07 Apr '17

commit f9b9039a8b7f5ed8b1bd823f4f3a9f8fc6302287 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri Apr 7 13:22:31 2017 +0200 Bug 18831: Use own Yasm for Firefox cross-compilation Starting with Firefox ESR52 Yasm < 1.2.0 is not sufficient anymore to compile our browser part for Windows. Ubuntu Precise still ships with such a version, though. We compile our own version until we get off of Precise. tor-browser-bundle.git commit: 910094fc33ae4e75e10fee754bec106e83e0eac5 --- projects/firefox/build | 4 ++++ projects/firefox/config | 3 +++ projects/yasm/build | 14 ++++++++++++++ projects/yasm/config | 10 ++++++++++ 4 files changed, 31 insertions(+) diff --git a/projects/firefox/build b/projects/firefox/build index abd699b..1dce495 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -11,6 +11,10 @@ # compiler setup so that mingw is first in the PATH. export LD_LIBRARY_PATH=$hgccdir/lib64 export PATH=$hgccdir/bin:$PATH + + # Firefox ESR52 needs Yasm >= 1.2.0 which Ubuntu Precise does not ship. + tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/yasm') %] + export PATH="/var/tmp/dist/yasm/bin:$PATH" [% END -%] [% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] distdir=/var/tmp/dist/[% project %] diff --git a/projects/firefox/config b/projects/firefox/config index f7e89e5..c71025d 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -92,3 +92,6 @@ input_files: - project: gcc name: gcc enable: '[% c("var/windows") %]' + - project: yasm + name: yasm + enable: '[% c("var/windows") %]' diff --git a/projects/yasm/build b/projects/yasm/build new file mode 100644 index 0000000..82d037a --- /dev/null +++ b/projects/yasm/build @@ -0,0 +1,14 @@ +#!/bin/bash +[% c("var/set_default_env") -%] +distdir=/var/tmp/dist/[% project %] +mkdir -p /var/tmp/build +tar -C /var/tmp/build -xf $rootdir/[% c('input_files_by_name/yasm') %] +cd /var/tmp/build/yasm-[% c("version") %] +./configure --prefix="$distdir" +make -j4 +make install +cd /var/tmp/dist +[% c('tar', { + tar_src => [ project ], + tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'), + }) %] diff --git a/projects/yasm/config b/projects/yasm/config new file mode 100644 index 0000000..3d8a28a --- /dev/null +++ b/projects/yasm/config @@ -0,0 +1,10 @@ +# vim: filetype=yaml sw=2 +version: 1.2.0 +filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' +remote_docker: 1 + +input_files: + - project: docker-image + - URL: 'https://www.tortall.net/projects/yasm/releases/yasm-[% c("version") %].tar.gz' + name: yasm + sha256sum: 768ffab457b90a20a6d895c39749adb547c1b7cb5c108e84b151a838a23ccf31

1 0

[tor-browser-build/master] Bug 21240: Bump mingw-w64 commit for ESR52 compilation
by boklm＠torproject.org 07 Apr '17

07 Apr '17

commit 580dad39db54fcd8d0f6e9f418bd791d02b1e8b3 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri Apr 7 13:24:37 2017 +0200 Bug 21240: Bump mingw-w64 commit for ESR52 compilation tor-browser-bundle.git commit: b5beb33b57643ff83838337ded870511599d45f5 --- projects/mingw-w64/config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/mingw-w64/config b/projects/mingw-w64/config index 425e125..3065df7 100644 --- a/projects/mingw-w64/config +++ b/projects/mingw-w64/config @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' git_url: http://git.code.sf.net/p/mingw-w64/mingw-w64 -git_hash: a0cd5afeb60be3be0860e9a203314c10485bb9b8 +git_hash: 9c7c7122401cfd932e599bec5b4b7ca846deb5c0 version: '[% c("abbrev") %]' remote_docker: 1 var:

1 0