- tbb-commits - lists.torproject.org

[tor-browser-bundle/master] Bump OpenSSL version to 1.0.1t
by gk＠torproject.org 23 May '16

23 May '16

commit f2d7ac9e6199f2047581b8aa5bb60d7ebf71631a Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 23 10:47:47 2016 +0000 Bump OpenSSL version to 1.0.1t --- gitian/versions.alpha | 4 ++-- gitian/versions.nightly | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/gitian/versions.alpha b/gitian/versions.alpha index c84324c..fe1eb9b 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -44,7 +44,7 @@ NOTOFONTS_TAG=720e34851382ee3c1ef024d8dffb68ffbfb234c2 GITIAN_TAG=tor-browser-builder-4-1 -OPENSSL_VER=1.0.1s +OPENSSL_VER=1.0.1t GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION FIREFOX_LANG_BUILD=build1 @@ -94,7 +94,7 @@ NOTOSCFONT_PACKAGE=NotoSansSC-Regular.otf NOTOTCFONT_PACKAGE=NotoSansTC-Regular.otf # Hashes for packages with weak sigs or no sigs -OPENSSL_HASH=e7e81d82f3cd538ab0cdba494006d44aab9dd96b7f6233ce9971fb7c7916d511 +OPENSSL_HASH=4a6ee491a2fdb22e519c76fdc2a628bb3cec12762cd456861d207996c8a07088 GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf OSXSDK_OLD_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc diff --git a/gitian/versions.nightly b/gitian/versions.nightly index b97ed7c..4db79f7 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -51,7 +51,7 @@ NOTOFONTS_TAG=720e34851382ee3c1ef024d8dffb68ffbfb234c2 GITIAN_TAG=tor-browser-builder-4 -OPENSSL_VER=1.0.1s +OPENSSL_VER=1.0.1t GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION FIREFOX_LANG_BUILD=build1 @@ -101,7 +101,7 @@ NOTOSCFONT_PACKAGE=NotoSansSC-Regular.otf NOTOTCFONT_PACKAGE=NotoSansTC-Regular.otf # Hashes for packages with weak sigs or no sigs -OPENSSL_HASH=e7e81d82f3cd538ab0cdba494006d44aab9dd96b7f6233ce9971fb7c7916d511 +OPENSSL_HASH=4a6ee491a2fdb22e519c76fdc2a628bb3cec12762cd456861d207996c8a07088 GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf OSXSDK_OLD_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc

1 0

[tor-browser-bundle/hardened-builds] Bump OpenSSL version to 1.0.1t
by gk＠torproject.org 23 May '16

23 May '16

commit fa1a28524e54632c4d434908a1931d8f2ab30764 Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 23 10:47:47 2016 +0000 Bump OpenSSL version to 1.0.1t --- gitian/versions.alpha | 4 ++-- gitian/versions.nightly | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/gitian/versions.alpha b/gitian/versions.alpha index b9239dc..99e47ea 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -48,7 +48,7 @@ NOTOFONTS_TAG=720e34851382ee3c1ef024d8dffb68ffbfb234c2 GITIAN_TAG=tor-browser-builder-4-1 -OPENSSL_VER=1.0.1s +OPENSSL_VER=1.0.1t GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION FIREFOX_LANG_BUILD=build1 @@ -98,7 +98,7 @@ NOTOSCFONT_PACKAGE=NotoSansSC-Regular.otf NOTOTCFONT_PACKAGE=NotoSansTC-Regular.otf # Hashes for packages with weak sigs or no sigs -OPENSSL_HASH=e7e81d82f3cd538ab0cdba494006d44aab9dd96b7f6233ce9971fb7c7916d511 +OPENSSL_HASH=4a6ee491a2fdb22e519c76fdc2a628bb3cec12762cd456861d207996c8a07088 GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf OSXSDK_OLD_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 9ff7e8f..86ee3f8 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -52,7 +52,7 @@ SELFRANDO_TAG=8e49e7aa664625d8e4793579864231b151589d0f GITIAN_TAG=tor-browser-builder-4 -OPENSSL_VER=1.0.1s +OPENSSL_VER=1.0.1t GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION FIREFOX_LANG_BUILD=build1 @@ -104,7 +104,7 @@ NOTOTCFONT_PACKAGE=NotoSansTC-Regular.otf ELFUTILS_PACKAGE=elfutils-${ELFUTILS_VER}.tar.bz2 # Hashes for packages with weak sigs or no sigs -OPENSSL_HASH=e7e81d82f3cd538ab0cdba494006d44aab9dd96b7f6233ce9971fb7c7916d511 +OPENSSL_HASH=4a6ee491a2fdb22e519c76fdc2a628bb3cec12762cd456861d207996c8a07088 GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf OSXSDK_OLD_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc

1 0

[tor-browser-bundle/master] Bug 18904: Update meek-http-helper profile on OS X
by gk＠torproject.org 23 May '16

23 May '16

commit b53cdc44638e7074a0433abf268ab101d4cd6b47 Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 23 10:36:17 2016 +0000 Bug 18904: Update meek-http-helper profile on OS X This commit bumps the meek tag to 0.22-18371-3 which is including the changes on the pluggable transport side that are necessary to fix #18904. --- gitian/versions.alpha | 2 +- gitian/versions.nightly | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/gitian/versions.alpha b/gitian/versions.alpha index f2023f0..c84324c 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -33,7 +33,7 @@ FTEPROXY_TAG=597f8378f6f4f3de570b8e1064c2e4cb8d67fbd0 # tag 0.2.19 LIBDMG_TAG=dfd5e5cc3dc1191e37d3c3a6118975afdd1d7014 TXSOCKSX_TAG=216eb0894a1755872f4789f9458aa6cf543b8433 # unsigned habnabit/1.13.0.2 GOPTLIB_TAG=0.5 -MEEK_TAG=0.22-18371-2 +MEEK_TAG=0.22-18371-3 FAKETIME_TAG=70aa6b394d9341522dffe8a5a5cf5929e82cc6b9 # unsigned v0.9.6 GOED25519_TAG=c4161f4c7483313562781c61b9a20aba73daf9de GOSIPHASH_TAG=42ba037e748c9062a75e0924705c43b893edefcd diff --git a/gitian/versions.nightly b/gitian/versions.nightly index cbc0a92..b97ed7c 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -40,7 +40,7 @@ FTEPROXY_TAG=master LIBDMG_TAG=dfd5e5cc3dc1191e37d3c3a6118975afdd1d7014 TXSOCKSX_TAG=216eb0894a1755872f4789f9458aa6cf543b8433 # unsigned habnabit/1.13.0.2 GOPTLIB_TAG=master -MEEK_TAG=0.22-18371-2 #master +MEEK_TAG=0.22-18371-3 #master FAKETIME_TAG=70aa6b394d9341522dffe8a5a5cf5929e82cc6b9 # unsigned v0.9.6 GOED25519_TAG=c4161f4c7483313562781c61b9a20aba73daf9de GOSIPHASH_TAG=42ba037e748c9062a75e0924705c43b893edefcd

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] Bug 19121: reinstate the update.xml hash check
by gk＠torproject.org 20 May '16

20 May '16

commit c179270e049f085ec8ae1ad443dd1b1fe1084728 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Fri May 20 11:08:51 2016 -0400 Bug 19121: reinstate the update.xml hash check This is a partial revert of commit f1241db6986e4b54473a1ed870f7584c75d51122. Revert most changes from Mozilla Bug 862173 "don't verify mar file hash when using mar signing to verify the mar file (lessens main thread I/O)." We kept the addition to the AppConstants API in case other JS code references it in the future. --- toolkit/mozapps/update/nsUpdateService.js | 7 ------- .../chrome/test_0061_check_verifyFailPartial_noComplete.xul | 4 ++-- .../chrome/test_0062_check_verifyFailComplete_noPartial.xul | 4 ++-- .../tests/chrome/test_0063_check_verifyFailPartialComplete.xul | 6 +++--- .../test_0064_check_verifyFailPartial_successComplete.xul | 4 ++-- .../chrome/test_0071_notify_verifyFailPartial_noComplete.xul | 4 ++-- .../chrome/test_0072_notify_verifyFailComplete_noPartial.xul | 4 ++-- .../chrome/test_0073_notify_verifyFailPartialComplete.xul | 6 +++--- .../test_0074_notify_verifyFailPartial_successComplete.xul | 4 ++-- .../chrome/test_0084_error_patchApplyFailure_verify_failed.xul | 2 +- toolkit/mozapps/update/tests/chrome/update.sjs | 10 +++++----- .../update/tests/unit_aus_update/downloadAndHashCheckMar.js | 8 +------- 12 files changed, 25 insertions(+), 38 deletions(-) diff --git a/toolkit/mozapps/update/nsUpdateService.js b/toolkit/mozapps/update/nsUpdateService.js index e12636d..4495210 100644 --- a/toolkit/mozapps/update/nsUpdateService.js +++ b/toolkit/mozapps/update/nsUpdateService.js @@ -3714,13 +3714,6 @@ Downloader.prototype = { } LOG("Downloader:_verifyDownload downloaded size == expected size."); - - // The hash check is not necessary when mar signatures are used to verify - // the downloaded mar file. - if (AppConstants.MOZ_VERIFY_MAR_SIGNATURE) { - return true; - } - let fileStream = Cc["@mozilla.org/network/file-input-stream;1"]. createInstance(Ci.nsIFileInputStream); fileStream.init(destination, FileUtils.MODE_RDONLY, FileUtils.PERMS_FILE, 0); diff --git a/toolkit/mozapps/update/tests/chrome/test_0061_check_verifyFailPartial_noComplete.xul b/toolkit/mozapps/update/tests/chrome/test_0061_check_verifyFailPartial_noComplete.xul index ba2347c..fe877ee 100644 --- a/toolkit/mozapps/update/tests/chrome/test_0061_check_verifyFailPartial_noComplete.xul +++ b/toolkit/mozapps/update/tests/chrome/test_0061_check_verifyFailPartial_noComplete.xul @@ -8,7 +8,7 @@ <?xml-stylesheet href="chrome://global/skin" type="text/css"?> <?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css" type="text/css"?> -<window title="Update Wizard pages: update check, basic, download, and errors (partial patch with an invalid size)" +<window title="Update Wizard pages: update check, basic, download, and errors (partial patch with an invalid hash)" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="runTestDefault();"> <script type="application/javascript" @@ -35,7 +35,7 @@ function runTest() { debugDump("entering"); let url = URL_HTTP_UPDATE_XML + "?showDetails=1&partialPatchOnly=1" + - "&invalidPartialSize=1" + getVersionParams(); + "&invalidPartialHash=1" + getVersionParams(); setUpdateURLOverride(url); gUP.checkForUpdates(); diff --git a/toolkit/mozapps/update/tests/chrome/test_0062_check_verifyFailComplete_noPartial.xul b/toolkit/mozapps/update/tests/chrome/test_0062_check_verifyFailComplete_noPartial.xul index 731a258..39c63c6 100644 --- a/toolkit/mozapps/update/tests/chrome/test_0062_check_verifyFailComplete_noPartial.xul +++ b/toolkit/mozapps/update/tests/chrome/test_0062_check_verifyFailComplete_noPartial.xul @@ -8,7 +8,7 @@ <?xml-stylesheet href="chrome://global/skin" type="text/css"?> <?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css" type="text/css"?> -<window title="Update Wizard pages: update check, basic, download, and errors (complete patch with an invalid size)" +<window title="Update Wizard pages: update check, basic, download, and errors (complete patch with an invalid hash)" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="runTestDefault();"> <script type="application/javascript" @@ -35,7 +35,7 @@ function runTest() { debugDump("entering"); let url = URL_HTTP_UPDATE_XML + "?showDetails=1&completePatchOnly=1" + - "&invalidCompleteSize=1" + getVersionParams(); + "&invalidCompleteHash=1" + getVersionParams(); setUpdateURLOverride(url); gUP.checkForUpdates(); diff --git a/toolkit/mozapps/update/tests/chrome/test_0063_check_verifyFailPartialComplete.xul b/toolkit/mozapps/update/tests/chrome/test_0063_check_verifyFailPartialComplete.xul index 65071bc..16ec709 100644 --- a/toolkit/mozapps/update/tests/chrome/test_0063_check_verifyFailPartialComplete.xul +++ b/toolkit/mozapps/update/tests/chrome/test_0063_check_verifyFailPartialComplete.xul @@ -8,7 +8,7 @@ <?xml-stylesheet href="chrome://global/skin" type="text/css"?> <?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css" type="text/css"?> -<window title="Update Wizard pages: update check, basic, download, and errors (partial and complete patches with invalid sizes)" +<window title="Update Wizard pages: update check, basic, download, and errors (partial and complete patches with invalid hashes)" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="runTestDefault();"> <script type="application/javascript" @@ -34,8 +34,8 @@ const TESTS = [ { function runTest() { debugDump("entering"); - let url = URL_HTTP_UPDATE_XML + "?showDetails=1&invalidPartialSize=1" + - "&invalidCompleteSize=1" + getVersionParams(); + let url = URL_HTTP_UPDATE_XML + "?showDetails=1&invalidPartialHash=1" + + "&invalidCompleteHash=1" + getVersionParams(); setUpdateURLOverride(url); gUP.checkForUpdates(); diff --git a/toolkit/mozapps/update/tests/chrome/test_0064_check_verifyFailPartial_successComplete.xul b/toolkit/mozapps/update/tests/chrome/test_0064_check_verifyFailPartial_successComplete.xul index 6bb0eb8..73b9351 100644 --- a/toolkit/mozapps/update/tests/chrome/test_0064_check_verifyFailPartial_successComplete.xul +++ b/toolkit/mozapps/update/tests/chrome/test_0064_check_verifyFailPartial_successComplete.xul @@ -8,7 +8,7 @@ <?xml-stylesheet href="chrome://global/skin" type="text/css"?> <?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css" type="text/css"?> -<window title="Update Wizard pages: update check, basic, download, and finished (partial patch with an invalid size and successful complete patch)" +<window title="Update Wizard pages: update check, basic, download, and finished (partial patch with an invalid hash and successful complete patch)" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="runTestDefault();"> <script type="application/javascript" @@ -34,7 +34,7 @@ const TESTS = [ { function runTest() { debugDump("entering"); - let url = URL_HTTP_UPDATE_XML + "?showDetails=1&invalidPartialSize=1" + + let url = URL_HTTP_UPDATE_XML + "?showDetails=1&invalidPartialHash=1" + getVersionParams(); setUpdateURLOverride(url); diff --git a/toolkit/mozapps/update/tests/chrome/test_0071_notify_verifyFailPartial_noComplete.xul b/toolkit/mozapps/update/tests/chrome/test_0071_notify_verifyFailPartial_noComplete.xul index 8c09a67..ce087a9 100644 --- a/toolkit/mozapps/update/tests/chrome/test_0071_notify_verifyFailPartial_noComplete.xul +++ b/toolkit/mozapps/update/tests/chrome/test_0071_notify_verifyFailPartial_noComplete.xul @@ -8,7 +8,7 @@ <?xml-stylesheet href="chrome://global/skin" type="text/css"?> <?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css" type="text/css"?> -<window title="Update Wizard pages: errors (partial patch with an invalid size)" +<window title="Update Wizard pages: errors (partial patch with an invalid hash)" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="runTestDefault();"> <script type="application/javascript" @@ -27,7 +27,7 @@ const TESTS = [ { function runTest() { debugDump("entering"); - let patches = getLocalPatchString("partial", null, null, null, "1234", null, + let patches = getLocalPatchString("partial", null, null, "1234", null, null, STATE_DOWNLOADING); let updates = getLocalUpdateString(patches, null, null, null, Services.appinfo.version, diff --git a/toolkit/mozapps/update/tests/chrome/test_0072_notify_verifyFailComplete_noPartial.xul b/toolkit/mozapps/update/tests/chrome/test_0072_notify_verifyFailComplete_noPartial.xul index 67f4556..01f4a2c 100644 --- a/toolkit/mozapps/update/tests/chrome/test_0072_notify_verifyFailComplete_noPartial.xul +++ b/toolkit/mozapps/update/tests/chrome/test_0072_notify_verifyFailComplete_noPartial.xul @@ -8,7 +8,7 @@ <?xml-stylesheet href="chrome://global/skin" type="text/css"?> <?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css" type="text/css"?> -<window title="Update Wizard pages: errors (complete patch with an invalid size)" +<window title="Update Wizard pages: errors (complete patch with an invalid hash)" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="runTestDefault();"> <script type="application/javascript" @@ -27,7 +27,7 @@ const TESTS = [ { function runTest() { debugDump("entering"); - let patches = getLocalPatchString("complete", null, null, null, "1234", null, + let patches = getLocalPatchString("complete", null, null, "1234", null, null, STATE_DOWNLOADING); let updates = getLocalUpdateString(patches, null, null, null, Services.appinfo.version, diff --git a/toolkit/mozapps/update/tests/chrome/test_0073_notify_verifyFailPartialComplete.xul b/toolkit/mozapps/update/tests/chrome/test_0073_notify_verifyFailPartialComplete.xul index 8e9814e..ffa8048 100644 --- a/toolkit/mozapps/update/tests/chrome/test_0073_notify_verifyFailPartialComplete.xul +++ b/toolkit/mozapps/update/tests/chrome/test_0073_notify_verifyFailPartialComplete.xul @@ -8,7 +8,7 @@ <?xml-stylesheet href="chrome://global/skin" type="text/css"?> <?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css" type="text/css"?> -<window title="Update Wizard pages: errors (partial and complete patches with invalid sizes)" +<window title="Update Wizard pages: errors (partial and complete patches with invalid hashes)" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="runTestDefault();"> <script type="application/javascript" @@ -27,9 +27,9 @@ const TESTS = [ { function runTest() { debugDump("entering"); - let patches = getLocalPatchString("partial", null, null, null, "1234", null, + let patches = getLocalPatchString("partial", null, null, "1234", null, null, STATE_DOWNLOADING) + - getLocalPatchString("complete", null, null, null, "1234", + getLocalPatchString("complete", null, null, "1234", null, "false"); let updates = getLocalUpdateString(patches, null, null, null, Services.appinfo.version, diff --git a/toolkit/mozapps/update/tests/chrome/test_0074_notify_verifyFailPartial_successComplete.xul b/toolkit/mozapps/update/tests/chrome/test_0074_notify_verifyFailPartial_successComplete.xul index 1f5799e..708c6bf 100644 --- a/toolkit/mozapps/update/tests/chrome/test_0074_notify_verifyFailPartial_successComplete.xul +++ b/toolkit/mozapps/update/tests/chrome/test_0074_notify_verifyFailPartial_successComplete.xul @@ -8,7 +8,7 @@ <?xml-stylesheet href="chrome://global/skin" type="text/css"?> <?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css" type="text/css"?> -<window title="Update Wizard pages: finishedBackground (partial patch with an invalid size and successful complete patch)" +<window title="Update Wizard pages: finishedBackground (partial patch with an invalid hash and successful complete patch)" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="runTestDefault();"> <script type="application/javascript" @@ -27,7 +27,7 @@ const TESTS = [ { function runTest() { debugDump("entering"); - let patches = getLocalPatchString("partial", null, null, null, "1234", null, + let patches = getLocalPatchString("partial", null, null, "1234", null, null, STATE_DOWNLOADING) + getLocalPatchString("complete", null, null, null, null, "false"); diff --git a/toolkit/mozapps/update/tests/chrome/test_0084_error_patchApplyFailure_verify_failed.xul b/toolkit/mozapps/update/tests/chrome/test_0084_error_patchApplyFailure_verify_failed.xul index 6b742ad..8861e24 100644 --- a/toolkit/mozapps/update/tests/chrome/test_0084_error_patchApplyFailure_verify_failed.xul +++ b/toolkit/mozapps/update/tests/chrome/test_0084_error_patchApplyFailure_verify_failed.xul @@ -42,7 +42,7 @@ function runTest() { let patches = getLocalPatchString("partial", null, null, null, null, null, STATE_PENDING) + getLocalPatchString("complete", slowDownloadURL, "MD5", - null, "1234", + "1234cd43a1c77e30191c53a329a3f99d", null, "false"); let updates = getLocalUpdateString(patches, null, null, null, Services.appinfo.version, diff --git a/toolkit/mozapps/update/tests/chrome/update.sjs b/toolkit/mozapps/update/tests/chrome/update.sjs index e054384..0f1e6ac 100644 --- a/toolkit/mozapps/update/tests/chrome/update.sjs +++ b/toolkit/mozapps/update/tests/chrome/update.sjs @@ -112,18 +112,18 @@ function handleRequest(aRequest, aResponse) { return; } - let size; + let hash; let patches = ""; if (!params.partialPatchOnly) { - size = SIZE_SIMPLE_MAR + (params.invalidCompleteSize ? "1" : ""); + hash = SHA512_HASH_SIMPLE_MAR + (params.invalidCompleteHash ? "e" : ""); patches += getRemotePatchString("complete", SERVICE_URL, "SHA512", - SHA512_HASH_SIMPLE_MAR, size); + hash, SIZE_SIMPLE_MAR); } if (!params.completePatchOnly) { - size = SIZE_SIMPLE_MAR + (params.invalidPartialSize ? "1" : ""); + hash = SHA512_HASH_SIMPLE_MAR + (params.invalidPartialHash ? "e" : ""); patches += getRemotePatchString("partial", SERVICE_URL, "SHA512", - SHA512_HASH_SIMPLE_MAR, size); + hash, SIZE_SIMPLE_MAR); } let type = params.type ? params.type : "major"; diff --git a/toolkit/mozapps/update/tests/unit_aus_update/downloadAndHashCheckMar.js b/toolkit/mozapps/update/tests/unit_aus_update/downloadAndHashCheckMar.js index 8727e37..c6b2f81 100644 --- a/toolkit/mozapps/update/tests/unit_aus_update/downloadAndHashCheckMar.js +++ b/toolkit/mozapps/update/tests/unit_aus_update/downloadAndHashCheckMar.js @@ -23,13 +23,7 @@ function run_test() { // The mock XMLHttpRequest is MUCH faster overrideXHR(callHandleEvent); standardInit(); - // Only perform the non hash check tests when mar signing is enabled since the - // update service doesn't perform hash checks when mar signing is enabled. - if (IS_MAR_CHECKS_ENABLED) { - do_execute_soon(run_test_pt11); - } else { - do_execute_soon(run_test_pt1); - } + do_execute_soon(run_test_pt1); } // The HttpServer must be stopped before calling do_test_finished

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] Bug 18885: Disable possible logging of TLS key material
by gk＠torproject.org 18 May '16

18 May '16

commit f5c58c88029648b608d75cdb06d82b06f0d30953 Author: Georg Koppen <gk(a)torproject.org> Date: Tue May 17 18:30:08 2016 +0000 Bug 18885: Disable possible logging of TLS key material This is a backport of the bugfix for #1183318 (https://hg.mozilla.org/projects/nss/rev/68d0b829490f) This is working for us as we are building Tor Browser optimized for all the platforms we support. --- security/nss/lib/ssl/Makefile | 7 +++++++ security/nss/lib/ssl/ssl3con.c | 6 ++++++ security/nss/lib/ssl/sslsock.c | 6 ++++++ 3 files changed, 19 insertions(+) diff --git a/security/nss/lib/ssl/Makefile b/security/nss/lib/ssl/Makefile index d56cbf2..abf54c9 100644 --- a/security/nss/lib/ssl/Makefile +++ b/security/nss/lib/ssl/Makefile @@ -39,6 +39,13 @@ CSRCS += unix_err.c endif endif +# Enable key logging by default in debug builds, but not opt builds. +# Logging still needs to be enabled at runtime through env vars. +NSS_ALLOW_SSLKEYLOGFILE ?= $(if $(BUILD_OPT),0,1) +ifeq (1,$(NSS_ALLOW_SSLKEYLOGFILE)) +DEFINES += -DNSS_ALLOW_SSLKEYLOGFILE=1 +endif + ####################################################################### # (5) Execute "global" rules. (OPTIONAL) # ####################################################################### diff --git a/security/nss/lib/ssl/ssl3con.c b/security/nss/lib/ssl/ssl3con.c index 8f1c547..ac57812 100644 --- a/security/nss/lib/ssl/ssl3con.c +++ b/security/nss/lib/ssl/ssl3con.c @@ -6029,6 +6029,7 @@ done: return unwrappedWrappingKey; } +#ifdef NSS_ALLOW_SSLKEYLOGFILE /* hexEncode hex encodes |length| bytes from |in| and writes it as |length*2| * bytes to |out|. */ static void @@ -6042,6 +6043,7 @@ hexEncode(char *out, const unsigned char *in, unsigned int length) *(out++) = hextable[in[i] & 15]; } } +#endif /* Called from ssl3_SendClientKeyExchange(). */ /* Presently, this always uses PKCS11. There is no bypass for this. */ @@ -6081,6 +6083,7 @@ sendRSAClientKeyExchange(sslSocket * ss, SECKEYPublicKey * svrPubKey) goto loser; } +#ifdef NSS_ALLOW_SSLKEYLOGFILE if (ssl_keylog_iob) { SECStatus extractRV = PK11_ExtractKeyValue(pms); if (extractRV == SECSuccess) { @@ -6112,6 +6115,7 @@ sendRSAClientKeyExchange(sslSocket * ss, SECKEYPublicKey * svrPubKey) } } } +#endif rv = ssl3_AppendHandshakeHeader(ss, client_key_exchange, isTLS ? enc_pms.len + 2 : enc_pms.len); @@ -10989,6 +10993,7 @@ ssl3_SendNextProto(sslSocket *ss) static void ssl3_RecordKeyLog(sslSocket *ss) { +#ifdef NSS_ALLOW_SSLKEYLOGFILE SECStatus rv; SECItem *keyData; char buf[14 /* "CLIENT_RANDOM " */ + @@ -11039,6 +11044,7 @@ ssl3_RecordKeyLog(sslSocket *ss) return; fflush(ssl_keylog_iob); return; +#endif } /* called from ssl3_SendClientSecondRound diff --git a/security/nss/lib/ssl/sslsock.c b/security/nss/lib/ssl/sslsock.c index f735009..de9a1315 100644 --- a/security/nss/lib/ssl/sslsock.c +++ b/security/nss/lib/ssl/sslsock.c @@ -118,7 +118,11 @@ int ssl_lock_readers = 1; /* default true. */ char ssl_debug; char ssl_trace; FILE * ssl_trace_iob; + +#ifdef NSS_ALLOW_SSLKEYLOGFILE FILE * ssl_keylog_iob; +#endif + char lockStatus[] = "Locks are ENABLED. "; #define LOCKSTATUS_OFFSET 10 /* offset of ENABLED */ @@ -3118,6 +3122,7 @@ ssl_SetDefaultsFromEnvironment(void) SSL_TRACE(("SSL: debugging set to %d", ssl_debug)); } #endif /* DEBUG */ +#ifdef NSS_ALLOW_SSLKEYLOGFILE ev = getenv("SSLKEYLOGFILE"); if (ev && ev[0]) { ssl_keylog_iob = fopen(ev, "a"); @@ -3131,6 +3136,7 @@ ssl_SetDefaultsFromEnvironment(void) SSL_TRACE(("SSL: logging SSL/TLS secrets to %s", ev)); } } +#endif #ifndef NO_PKCS11_BYPASS ev = getenv("SSLBYPASS"); if (ev && ev[0]) {

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 17 May '16

17 May '16

commit 0651282ea94c4dddcec724f0ea6c21aecfd6b942 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue May 17 14:08:43 2016 -0400 fixup! TB4: Tor Browser's Firefox preference overrides. Set the heartbeat URL to an empty string as a defense in depth measure and disable the UITour backend (bug 19047). --- browser/app/profile/000-tor-browser.js | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 91542b7..f4f4bfe 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -78,7 +78,11 @@ pref("datareporting.healthreport.about.reportUrl", "data:text/plain,"); // Make sure Selfsupport and Unified Telemetry are really disabled, see: #18738. pref("datareporting.healthreport.about.reportUrlUnified", "data:text/plain,"); pref("browser.selfsupport.enabled", false); +pref("browser.selfsupport.url", ""); pref("toolkit.telemetry.unified", false); +// Disable the UITour backend so there is no chance that a remote page +// can use it to confuse Tor Browser users. +pref("browser.uitour.enabled", false); pref("security.mixed_content.block_active_content", false); // Disable until https://bugzilla.mozilla.org/show_bug.cgi?id=878890 is patched pref("browser.syncPromoViewsLeftMap", "{\"addons\":0, \"passwords\":0, \"bookmarks\":0}"); // Don't promote sync pref("services.sync.engine.prefs", false); // Never sync prefs, addons, or tabs with other browsers

1 0

[tor-browser-bundle/hardened-builds] Bug 19065: Don't delete Tor Browser icons
by gk＠torproject.org 17 May '16

17 May '16

commit 48055f68ba9954c402760b91a5096f98d6720665 Author: Georg Koppen <gk(a)torproject.org> Date: Tue May 17 12:10:37 2016 +0000 Bug 19065: Don't delete Tor Browser icons Deleting the extracted chrome/en-US folder is good but we should not delete the whole chrome folder as it contains the Tor Browser icons. --- gitian/descriptors/linux/gitian-bundle.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gitian/descriptors/linux/gitian-bundle.yml b/gitian/descriptors/linux/gitian-bundle.yml index eca8d0f..3e8ae2e 100644 --- a/gitian/descriptors/linux/gitian-bundle.yml +++ b/gitian/descriptors/linux/gitian-bundle.yml @@ -187,7 +187,7 @@ script: | # For the proper search engines in our language packs unzip omni.ja chrome/en-US/locale/browser/searchplugins* mv chrome/en-US/locale/browser/searchplugins ~/build - rm -rf chrome + rm -rf chrome/en-US unzip omni.ja defaults/preferences/000-tor-browser.js cp defaults/preferences/000-tor-browser.js ~/build/ # Set the locale of the bundle.

1 0

[tor-browser-bundle/master] Bug 19065: Don't delete Tor Browser icons
by gk＠torproject.org 17 May '16

17 May '16

commit 091cb50929055718277fcede5f61c61504ab8b87 Author: Georg Koppen <gk(a)torproject.org> Date: Tue May 17 12:10:37 2016 +0000 Bug 19065: Don't delete Tor Browser icons Deleting the extracted chrome/en-US folder is good but we should not delete the whole chrome folder as it contains the Tor Browser icons. --- gitian/descriptors/linux/gitian-bundle.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gitian/descriptors/linux/gitian-bundle.yml b/gitian/descriptors/linux/gitian-bundle.yml index 39ad811..20315ec 100644 --- a/gitian/descriptors/linux/gitian-bundle.yml +++ b/gitian/descriptors/linux/gitian-bundle.yml @@ -197,7 +197,7 @@ script: | # For the proper search engines in our language packs unzip omni.ja chrome/en-US/locale/browser/searchplugins* mv chrome/en-US/locale/browser/searchplugins ~/build - rm -rf chrome + rm -rf chrome/en-US unzip omni.ja defaults/preferences/000-tor-browser.js cp defaults/preferences/000-tor-browser.js ~/build/ # Set the locale of the bundle.

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] Regression tests for Bug 15646: Prevent keyboard layout fingerprinting in KeyboardEvent
by gk＠torproject.org 17 May '16

17 May '16

commit de5346adae7452c79820958873cf6eca473f537f Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Tue Dec 22 12:35:17 2015 -0800 Regression tests for Bug 15646: Prevent keyboard layout fingerprinting in KeyboardEvent --- dom/events/test/mochitest.ini | 1 + dom/events/test/test_tor_bug15646.html | 159 +++++++++++++++++++++++++++++++++ 2 files changed, 160 insertions(+) diff --git a/dom/events/test/mochitest.ini b/dom/events/test/mochitest.ini index e23b950..e7fb89c 100644 --- a/dom/events/test/mochitest.ini +++ b/dom/events/test/mochitest.ini @@ -192,3 +192,4 @@ support-files = [test_bug1013412.html] skip-if = buildapp == 'b2g' # no wheel events on b2g [test_dom_activate_event.html] +[test_tor_bug15646.html] diff --git a/dom/events/test/test_tor_bug15646.html b/dom/events/test/test_tor_bug15646.html new file mode 100644 index 0000000..463781f --- /dev/null +++ b/dom/events/test/test_tor_bug15646.html @@ -0,0 +1,159 @@ +<!DOCTYPE HTML> +<html> + +<head> + <title>Test for Bug 15646</title> + <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="application/javascript" src="/tests/SimpleTest/SpawnTask.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/> +</head> +<body> +<a target="_blank" href="https://trac.torproject.org/15466">Tor Bug 15646</a> +<p id="display"></p> +<div id="content" style="display: none"> + +</div> +<pre id="test"> +</pre> +<span id="testTarget" style="border: 1px solid black;">testTarget</span> +<script type="application/javascript;version=1.7"> + SimpleTest.waitForExplicitFinish(); + let miscKeyData = [ + ["Alt", "AltLeft", 18], + ["ArrowDown", "ArrowDown", 40], + ["ArrowLeft", "ArrowLeft", 37], + ["ArrowRight", "ArrowRight", 39], + ["ArrowUp", "ArrowUp", 38], + ["Backspace", "Backspace", 8], + ["CapsLock", "CapsLock", 20], + ["ContextMenu", "ContextMenu", 93], + ["Control", "ControlLeft", 17], + ["Delete", "Delete", 46], + ["End", "End", 35], + ["Enter", "Enter", 13], + ["Escape", "Escape", 27], + ["Help", "Help", 6], + ["Home", "Home", 36], + ["Insert", "Insert", 45], + ["Meta", "OSLeft", 91], + ["PageDown", "PageDown", 34], + ["PageUp", "PageUp", 33], + ["Pause", "Pause", 19], + ["PrintScreen", "PrintScreen", 44], + ["ScrollLock", "ScrollLock", 145], + ["Shift", "ShiftLeft", 16], + ["Tab", "Tab", 9], + [" ", "Space", 32], + [",", "Comma", 188], + [".", "Period", 190], + ["/", "Slash", 191], + [";", "Semicolon", 59], + ["'", "Quote", 222], + ["[", "BracketLeft", 219], + ["]", "BracketRight", 221], + ["`", "Backquote", 192], + ["\\", "Backslash", 220], + ["-", "Minus", 173], + ["=", "Equal", 61], + ]; + let uppers = [], lowers = []; + for (let i = 65; i < 91; ++i) { + let upperChar = String.fromCharCode(i); + lowers.push([upperChar.toLowerCase(), "Key" + upperChar, i]); + uppers.push([upperChar, "Key" + upperChar, i]); + } + let fnKeys = []; + for (let i = 1; i < 25; ++i) { + let keyName = "F" + i, + keyCode = i + 111; + fnKeys.push([keyName, keyName, keyCode]); + } + let digits = []; + for (let i = 0; i < 10; ++i) { + let keyName = "" + i, + keyCode = 48 + i; + digits.push([keyName, "Digit" + keyName, keyCode]); + } + let allKeyData = miscKeyData.concat(lowers).concat(fnKeys).concat(digits); + let pushPref = function (key, value) { + return new Promise(resolve => { + SpecialPowers.pushPrefEnv({"set": [[key, value]]}, resolve); + }); + }; + let miscShiftKeyData = [ + ["!", "Digit1", 49], + ["@", "Digit2", 50], + ["#", "Digit3", 51], + ["$", "Digit4", 52], + ["%", "Digit5", 53], + ["^", "Digit6", 54], + ["&", "Digit7", 55], + ["*", "Digit8", 56], + ["(", "Digit9", 57], + [")", "Digit0", 48], + ["<", "Comma", 188], + [">", "Period", 190], + ["?", "Slash", 191], + [":", "Semicolon", 59], + ["\"", "Quote", 222], + ["{", "BracketLeft", 219], + ["}", "BracketRight", 221], + ["~", "Backquote", 192], + ["|", "Backslash", 220], + ["_", "Minus", 173], + ["+", "Equal", 61], + ]; + let allShiftKeyData = miscShiftKeyData.concat(uppers); + + // __dispatchAndListen(target, eventObject)__. + // Dispatch the given event to the target object. + // Return a promise that resolves to the event when + // that event is received by an event listener. + let dispatchAndListen = function (target, eventObject) { + let eventType = eventObject.type; + return new Promise(function (resolve, reject) { + let listenFunction = function (event) { + target.removeEventListener(eventType, listenFunction); + resolve(event); + }; + target.addEventListener(eventType, listenFunction); + target.dispatchEvent(eventObject); + }); + }; + + // Run tests asynchronously. + spawnTask(function* () { + for (let keyData of [allKeyData, allShiftKeyData]) { + for (let resistFingerprinting of [false, true]) { + let expectedShiftKey = keyData === allShiftKeyData && resistFingerprinting; + yield pushPref("privacy.resistFingerprinting", resistFingerprinting); + for (let [keyName, code, keyCode] of keyData) { + let keyboardEvent = new KeyboardEvent("keydown", { key : keyName, altKey : true, location : 2 }); + let receivedEvent = yield dispatchAndListen(document.body, keyboardEvent); + let expectedKeyCode = resistFingerprinting ? keyCode : 0; + is(receivedEvent.keyCode, expectedKeyCode, + "Event.keyCode should be " + expectedKeyCode); + is(receivedEvent.shiftKey, expectedShiftKey, + "Event.shiftKey should be " + expectedShiftKey); + if (expectedShiftKey) { + ok(!receivedEvent.altKey, + "Alt should be suppressed for fake shift keys."); + } + if (resistFingerprinting) { + let expectedCode = code; + is(receivedEvent.code, expectedCode, + "Event.code should be " + expectedCode); + ok(receivedEvent.location === 0 || receivedEvent.location === 1, + "Event.location should be 0 or 1."); + } + } + } + } + SimpleTest.finish(); + }); + +</script> +</body> +</html>

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] Regression tests for Bug 17009: Pref to suppress some modifier key events
by gk＠torproject.org 17 May '16

17 May '16

commit b815400e8aae371dcc55141d202ae96155c4c78d Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Wed Dec 23 09:52:05 2015 -0800 Regression tests for Bug 17009: Pref to suppress some modifier key events --- dom/tests/browser/browser.ini | 2 + dom/tests/browser/browser_tor_bug17009.html | 8 +++ dom/tests/browser/browser_tor_bug17009.js | 98 +++++++++++++++++++++++++++++ 3 files changed, 108 insertions(+) diff --git a/dom/tests/browser/browser.ini b/dom/tests/browser/browser.ini index 363758e..bd07b47 100644 --- a/dom/tests/browser/browser.ini +++ b/dom/tests/browser/browser.ini @@ -2,6 +2,7 @@ skip-if = e10s # Bug ?????? - most of these tests fail for currently unknown reasons. support-files = browser_frame_elements.html + browser_tor_bug17009.html page_privatestorageevent.html position.html test-console-api.html @@ -44,3 +45,4 @@ disabled = re-enable when bug 794920 is fixed [browser_xhr_sandbox.js] skip-if= buildapp == 'mulet' [browser_bug1004814.js] +[browser_tor_bug17009.js] diff --git a/dom/tests/browser/browser_tor_bug17009.html b/dom/tests/browser/browser_tor_bug17009.html new file mode 100644 index 0000000..455d547 --- /dev/null +++ b/dom/tests/browser/browser_tor_bug17009.html @@ -0,0 +1,8 @@ +<!DOCTYPE html> +<head> + <meta charset="utf-8"> + <title>Tor Bug 17009 tests</title> +</head> +<body> + Testing that Alt and Shift keydown/keyup events aren't detected in content. +</body> diff --git a/dom/tests/browser/browser_tor_bug17009.js b/dom/tests/browser/browser_tor_bug17009.js new file mode 100644 index 0000000..794baa4 --- /dev/null +++ b/dom/tests/browser/browser_tor_bug17009.js @@ -0,0 +1,98 @@ +"use strict"; + +/*jshint esnext:true */ + +const CONTENT_PAGE = "http://example.com/browser/dom/tests/browser/browser_tor_bug17009.html"; + +// __pushPref(key, value)__. +// Set the given pref to a value. Returns a promise +// that resolves asynchronously when the pref is +// successfully set. +let pushPref = function (key, value) { + return new Promise(resolve => { + SpecialPowers.pushPrefEnv({"set": [[key, value]]}, resolve); + }); +}; + +// __listen(target, eventType, useCapture)__. +// Returns a promise that resolves after a single event +// of eventType is received by the target. +let listen = function (target, eventType, useCapture) { + return new Promise(function (resolve, reject) { + let listenFunction = function (event) { + target.removeEventListener(eventType, listenFunction, useCapture); + resolve(event); + }; + target.addEventListener(eventType, listenFunction, useCapture); + }); +}; + +// __soon()__. +// Wait a little bit before we continue. Returns a promise. +let soon = function () { + return new Promise(resolve => executeSoon(resolve)); +}; + +// __runTests(contentWindow)__. +// The main tests. We test to make sure that, when +// "privacy.suppressModifierKeyEvents" is true, then content +// will not see Alt or Shift keydown or keyup events, +// but chrome will still see those events. +// If the pref is off, then both content and chrome +// should see all events. +let runTests = function* (contentWindow) { + // Check behavior for both non-resistance and resistance. + for (let resistFingerprinting of [false, true]) { + yield pushPref("privacy.resistFingerprinting", resistFingerprinting); + // Check behavior, both non-suppressing and suppressing. + for (let suppressModifiers of [false, true]) { + yield pushPref("privacy.suppressModifierKeyEvents", suppressModifiers); + // Check both keydown and keyup events. + for (let eventType of ["keydown", "keyup"]) { + // Check Alt and Shift keys. + for (let modifierKey of ["Alt", "Shift"]) { + // Listen for a single key event in the content window. + let contentEventPromise = listen(contentWindow, eventType, false); + // Listen for a single key event in the chrome window. + let chromeEventPromise = listen(window, eventType, false); + // Generate a Alt or Shift key event. + EventUtils.synthesizeKey("VK_" + modifierKey.toUpperCase(), + { type : eventType }, contentWindow); + // Generate a dummy "x" key event that will only be handled if + // modifier key is successfully suppressed. + EventUtils.synthesizeKey("x", { type: eventType }, contentWindow); + // Collect the events received in content and chrome. + let contentEvent = yield contentEventPromise; + let chromeEvent = yield chromeEventPromise; + // We should always see the modifier key in chrome, regardless of the + // pref state. + is(chromeEvent.key, modifierKey, + modifierKey + " key should be seen in chrome."); + // If and only if fingerprinting resistance is active and suppression + // is enabled, we should see the dummy "x" key; otherwise we expect + // to see the modifier key as usual. + let expectedContentKey = resistFingerprinting && suppressModifiers + ? "x" : modifierKey; + is(contentEvent.key, expectedContentKey, + expectedContentKey + " key should be seen in content."); + } + } + } + } +}; + +// Run tests asynchronously to make testing event handling straightforward. +add_task(function* () { + // Set up a content tab and select it. + let tab = gBrowser.addTab(CONTENT_PAGE), + browser = gBrowser.getBrowserForTab(tab); + gBrowser.selectedTab = tab; + + // Wait for tab to be completely loaded, then run the tests. + yield listen(browser, "DOMContentLoaded", false); + yield soon(); + yield runTests(gBrowser.contentWindow); + + // cleanup + gBrowser.removeTab(tab); +});

1 0