- tbb-commits - lists.torproject.org

[tor-browser-bundle/hardened-builds] We just want to have 64bit things for hardened
by gk＠torproject.org 05 Jan '17

05 Jan '17

commit 2eca5d42245a98b4572943b0307a74392bfa4f5c Author: Georg Koppen <gk(a)torproject.org> Date: Thu Jan 5 11:55:16 2017 +0000 We just want to have 64bit things for hardened --- gitian/descriptors/linux/gitian-pluggable-transports.yml | 3 --- gitian/descriptors/linux/gitian-webrtc.yml | 3 --- gitian/mkbundle-linux.sh | 3 +-- 3 files changed, 1 insertion(+), 8 deletions(-) diff --git a/gitian/descriptors/linux/gitian-pluggable-transports.yml b/gitian/descriptors/linux/gitian-pluggable-transports.yml index 31aa9bb..9b4a278 100644 --- a/gitian/descriptors/linux/gitian-pluggable-transports.yml +++ b/gitian/descriptors/linux/gitian-pluggable-transports.yml @@ -59,11 +59,8 @@ files: - "dzip.sh" - "gmp-linux64-utils.zip" - "openssl-linux64-utils.zip" -- "binutils-linux32-utils.zip" - "binutils-linux64-utils.zip" -- "gcc-linux32-utils.zip" - "gcc-linux64-utils.zip" -- "webrtc-linux32-gbuilt.zip" - "webrtc-linux64-gbuilt.zip" script: | INSTDIR="$HOME/install" diff --git a/gitian/descriptors/linux/gitian-webrtc.yml b/gitian/descriptors/linux/gitian-webrtc.yml index ba654c5..f18da52 100644 --- a/gitian/descriptors/linux/gitian-webrtc.yml +++ b/gitian/descriptors/linux/gitian-webrtc.yml @@ -4,7 +4,6 @@ distro: "debian" suites: - "wheezy" architectures: -- "i386" - "amd64" packages: - "unzip" @@ -24,9 +23,7 @@ remotes: "dir": "depot_tools" files: - "dzip.sh" -- "binutils-linux32-utils.zip" - "binutils-linux64-utils.zip" -- "gcc-linux32-utils.zip" - "gcc-linux64-utils.zip" - "webrtc.tar.gz" script: | diff --git a/gitian/mkbundle-linux.sh b/gitian/mkbundle-linux.sh index e5be697..a9f4cea 100755 --- a/gitian/mkbundle-linux.sh +++ b/gitian/mkbundle-linux.sh @@ -187,8 +187,7 @@ else echo fi -if [ ! -f inputs/webrtc-linux32-gbuilt.zip -o \ - ! -f inputs/webrtc-linux64-gbuilt.zip ]; +if [ ! -f inputs/webrtc-linux64-gbuilt.zip ]; then echo echo "****** Starting WebRTC Component of Linux Bundle (4/6 for Linux) ******"

1 0

[tor-browser-bundle/hardened-builds] Bug 20735: Add snowflake pt to alpha Linux builds
by gk＠torproject.org 05 Jan '17

05 Jan '17

commit f78866cad71122fa851ebdf6c63053605c565826 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Apr 30 15:42:21 2016 -0700 Bug 20735: Add snowflake pt to alpha Linux builds * Snowflake depends on go-webrtc, which in turn depends on libwebrtc, which adds significantly to the build. webrtc is special, having its own build system that brings in lots of Chromium dependencies. * Further, building cgo reproducibly requires go 1.7.3 and a compiler that supports the following flags, -gno-record-gcc-switches -fdebug-prefix-map=$WORK=/tmp/go-build --- Bundle-Data/PTConfigs/bridge_prefs.js | 2 + .../PTConfigs/linux/torrc-defaults-appendix | 3 + gitian/Makefile | 5 +- gitian/check-prerequisites.sh | 8 +- .../linux/gitian-pluggable-transports.yml | 79 +++++++++++++ gitian/descriptors/linux/gitian-webrtc.yml | 125 +++++++++++++++++++++ gitian/fetch-inputs.sh | 28 +++++ gitian/mkbundle-linux.sh | 44 ++++++-- gitian/verify-tags.sh | 6 + gitian/versions | 13 ++- gitian/versions.alpha | 6 + gitian/versions.beta | 5 + gitian/versions.nightly | 6 + 13 files changed, 312 insertions(+), 18 deletions(-) diff --git a/Bundle-Data/PTConfigs/bridge_prefs.js b/Bundle-Data/PTConfigs/bridge_prefs.js index 6831555..bd92585 100644 --- a/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/Bundle-Data/PTConfigs/bridge_prefs.js @@ -38,3 +38,5 @@ pref("extensions.torlauncher.default_bridge.obfs4.20", "obfs4 85.17.30.79:443 FC pref("extensions.torlauncher.default_bridge.meek-amazon.1", "meek 0.0.2.0:2 B9E7141C594AF25699E0079C1F0146F409495296 url=https://d2zfqthxsdq309.cloudfront.net/ front=a0.awsstatic.com"); pref("extensions.torlauncher.default_bridge.meek-azure.1", "meek 0.0.2.0:3 A2C13B7DFCAB1CBF3A884B6EB99A98067AB6EF44 url=https://az786092.vo.msecnd.net/ front=ajax.aspnetcdn.com"); + +pref("extensions.torlauncher.default_bridge.snowflake.1", "snowflake 0.0.3.0:1 B05EC36590AC0374F0E4D36DDA77908FD59D97F3"); diff --git a/Bundle-Data/PTConfigs/linux/torrc-defaults-appendix b/Bundle-Data/PTConfigs/linux/torrc-defaults-appendix index c79efde..7fbf63c 100644 --- a/Bundle-Data/PTConfigs/linux/torrc-defaults-appendix +++ b/Bundle-Data/PTConfigs/linux/torrc-defaults-appendix @@ -6,3 +6,6 @@ ClientTransportPlugin obfs2,obfs3,obfs4,scramblesuit exec ./TorBrowser/Tor/Plugg ## meek configuration ClientTransportPlugin meek exec ./TorBrowser/Tor/PluggableTransports/meek-client-torbrowser -- ./TorBrowser/Tor/PluggableTransports/meek-client + +## snowflake configuration +ClientTransportPlugin snowflake exec ./TorBrowser/Tor/PluggableTransports/snowflake-client -url https://snowflake-reg.appspot.com/ -front www.google.com -ice stun:stun.l.google.com:19302 diff --git a/gitian/Makefile b/gitian/Makefile index 1aac5ed..b321eab 100644 --- a/gitian/Makefile +++ b/gitian/Makefile @@ -93,7 +93,7 @@ prep-alpha: $(TORSOCKS) ./fetch-inputs.sh ../../gitian-builder/inputs/ versions.alpha -clean: clean-utils clean-tor clean-browser clean-pt clean-bundle +clean: clean-utils clean-tor clean-browser clean-webrtc clean-pt clean-bundle rm -f ../../gitian-builder/inputs/*.yml rm -f ../../gitian-builder/inputs/bundle.inputs rm -f ../../gitian-builder/inputs/versions* @@ -112,6 +112,9 @@ clean-browser: clean-bundle rm -f ../../gitian-builder/inputs/tor-browser-win* rm -f ../../gitian-builder/inputs/mar-tools-* +clean-webrtc: clean-bundle + rm -f ../../gitian-builder/inputs/webrtc-*-gbuilt.zip + clean-pt: clean-bundle rm -f ../../gitian-builder/inputs/pluggable-transports* diff --git a/gitian/check-prerequisites.sh b/gitian/check-prerequisites.sh index 858fd4d..530e160 100755 --- a/gitian/check-prerequisites.sh +++ b/gitian/check-prerequisites.sh @@ -17,7 +17,7 @@ then VERSION=`cat /etc/issue | grep -Eo '[0-9]{2}' | head -1` if [ "$VERSION" -ge "14" ]; then - dpkg -s ruby apache2 git apt-cacher-ng qemu-kvm virt-what lxc lxctl fakeroot faketime zip unzip subversion debian-archive-keyring torsocks tor 2>/dev/null >/dev/null + dpkg -s ruby apache2 git apt-cacher-ng qemu-kvm virt-what lxc lxctl fakeroot faketime zip unzip subversion debian-archive-keyring curl pkg-config libgtk2.0-dev libglib2.0-dev torsocks tor 2>/dev/null >/dev/null if [ $? -ne 0 ]; then @@ -25,7 +25,7 @@ then echo echo "Please run:" echo " sudo apt-get install torsocks tor" - echo " sudo torsocks apt-get install ruby apache2 git apt-cacher-ng qemu-kvm virt-what lxc lxctl fakeroot faketime zip unzip subversion debian-archive-keyring" + echo " sudo torsocks apt-get install ruby apache2 git apt-cacher-ng qemu-kvm virt-what lxc lxctl fakeroot faketime zip unzip subversion debian-archive-keyring curl pkg-config libgtk2.0-dev libglib2.0-dev" exit 1 fi else @@ -34,7 +34,7 @@ then fi elif [ $DISTRO = "Debian" ]; then - dpkg -s ruby git apt-cacher-ng qemu-kvm virt-what lxc lxctl fakeroot zip unzip torsocks tor python-cheetah debootstrap parted kpartx rsync 2>/dev/null >/dev/null + dpkg -s ruby git apt-cacher-ng qemu-kvm virt-what lxc lxctl fakeroot zip unzip python-cheetah debootstrap parted kpartx rsync curl pkg-config libgtk2.0-dev libglib2.0-dev torsocks tor 2>/dev/null >/dev/null if [ $? -ne 0 ]; then @@ -42,7 +42,7 @@ then echo echo "Please run" echo " sudo apt-get install torsocks tor" - echo " sudo torsocks apt-get install ruby git apt-cacher-ng qemu-kvm virt-what lxc lxctl fakeroot zip unzip python-cheetah debootstrap parted kpartx rsync" + echo " sudo torsocks apt-get install ruby git apt-cacher-ng qemu-kvm virt-what lxc lxctl fakeroot zip unzip python-cheetah debootstrap parted kpartx rsync curl pkg-config libgtk2.0-dev libglib2.0-dev" exit 1 fi else diff --git a/gitian/descriptors/linux/gitian-pluggable-transports.yml b/gitian/descriptors/linux/gitian-pluggable-transports.yml index 2793a76..31aa9bb 100644 --- a/gitian/descriptors/linux/gitian-pluggable-transports.yml +++ b/gitian/descriptors/linux/gitian-pluggable-transports.yml @@ -13,6 +13,8 @@ packages: - "swig" - "zip" - "hardening-wrapper" +- "pkg-config" +- "libx11-dev" reference_datetime: "2000-01-01 00:00:00" remotes: - "url": "https://git.torproject.org/pluggable-transports/pyptlib.git" @@ -39,6 +41,12 @@ remotes: "dir": "goxnet" - "url": "https://git.torproject.org/pluggable-transports/obfs4.git" "dir": "obfs4" +- "url": "https://github.com/keroserene/go-webrtc.git" + "dir": "go-webrtc" +- "url": "https://git.torproject.org/pluggable-transports/snowflake.git" + "dir": "snowflake" +- "url": "https://github.com/dchest/uniuri.git" + "dir": "uniuri" files: - "pycrypto.tar.gz" - "argparse.tar.gz" @@ -51,6 +59,12 @@ files: - "dzip.sh" - "gmp-linux64-utils.zip" - "openssl-linux64-utils.zip" +- "binutils-linux32-utils.zip" +- "binutils-linux64-utils.zip" +- "gcc-linux32-utils.zip" +- "gcc-linux64-utils.zip" +- "webrtc-linux32-gbuilt.zip" +- "webrtc-linux64-gbuilt.zip" script: | INSTDIR="$HOME/install" PTDIR="$INSTDIR/Tor/PluggableTransports" @@ -73,6 +87,35 @@ script: | # FTE only needs libgmp.so.10 and no libgmpxx anymore. cp $INSTDIR/gmp/lib/libgmp.so.10 $INSTDIR/Tor + # Preparing Binutils and GCC for webrtc + unzip -d $INSTDIR binutils-linux$GBUILD_BITS-utils.zip + # Make sure gold is used with the hardening wrapper for full RELRO, see + # #13031. + cd $INSTDIR/binutils/bin + rm ld + cp /usr/bin/hardened-ld ./ + mv ld.gold ld.gold.real + ln -sf hardened-ld ld.gold + ln -sf ld.gold ld + cd ~/build + unzip -d $INSTDIR gcc-linux$GBUILD_BITS-utils.zip + # Make sure we use the hardening wrapper when compiling Tor Browser. + cd $INSTDIR/gcc/bin + cp /usr/bin/hardened-cc ./ + mv gcc gcc.real + mv c++ c++.real + ln -sf hardened-cc gcc + ln -sf hardened-cc c++ + cd ~/build + export PATH=$INSTDIR/gcc/bin:$INSTDIR/binutils/bin:$PATH + ARCH="" + if [ $GBUILD_BITS == "64" ]; + then + ARCH="64" + fi + # Make sure our GCC gets properly used. + export LD_LIBRARY_PATH=$INSTDIR/gcc/lib$ARCH + # Building go 1.4.x # This is needed to bootstrap the go that we actually use # https://golang.org/doc/install/source#go14 @@ -231,6 +274,14 @@ script: | go install github.com/dchest/siphash cd .. + # Building go uniuri + cd uniuri + find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" + mkdir -p "$GOPATH/src/github.com/dchest/" + ln -sf "$PWD" "$GOPATH/src/github.com/dchest/uniuri" + go install github.com/dchest/uniuri + cd .. + # Building golang.org/x/crypto (obfs4proxy > 0.0.3 || Go >= 1.4) cd goxcrypto find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" @@ -259,6 +310,34 @@ script: | cp -a obfs4proxy $PTDIR cd ../.. + unzip webrtc-linux$GBUILD_BITS-gbuilt.zip + + # Building go-webrtc + cd go-webrtc + # Replace the prebuilt webrtc library with our own one. + rm -rf include/ lib/ + ln -sf ../webrtc/{include,lib} . + find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" + mkdir -p "$GOPATH/src/github.com/keroserene/" + ln -sf "$PWD" "$GOPATH/src/github.com/keroserene/go-webrtc" + # The go-webrtc package sets _GLIBCXX_USE_CXX11_ABI=0 for compatibility with + # the prebuilt libwebrtc-magic.a libraries. Since we build our own + # libwebrtc-magic.a with the C++11 ABI, we have to undo that setting here, + # using CGO_CXXFLAGS. + CGO_CXXFLAGS=-D_GLIBCXX_USE_CXX11_ABI=1 go install github.com/keroserene/go-webrtc + cd .. + + # Building snowflake + cd snowflake + find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" + cd client + go build -ldflags '-s' + cp -a client $PTDIR/snowflake-client + cd .. + mkdir -p $INSTDIR/Docs/snowflake + cp -a README.md LICENSE $INSTDIR/Docs/snowflake + cd .. + # Grabbing the results and making sure timestamps don't spoil them cd $INSTDIR ~/build/dzip.sh pluggable-transports-linux$GBUILD_BITS-gbuilt.zip Tor/ Docs/ diff --git a/gitian/descriptors/linux/gitian-webrtc.yml b/gitian/descriptors/linux/gitian-webrtc.yml new file mode 100644 index 0000000..ba654c5 --- /dev/null +++ b/gitian/descriptors/linux/gitian-webrtc.yml @@ -0,0 +1,125 @@ +--- +name: "webrtc-linux" +distro: "debian" +suites: +- "wheezy" +architectures: +- "i386" +- "amd64" +packages: +- "unzip" +- "zip" +- "hardening-wrapper" +- "libasound2-dev" +- "libexpat1-dev" +- "libudev-dev" +- "libx11-dev" +- "libxext-dev" +- "libxrandr-dev" +- "default-jre-headless" +- "default-jdk" +reference_datetime: "2000-01-01 00:00:00" +remotes: +- "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git" + "dir": "depot_tools" +files: +- "dzip.sh" +- "binutils-linux32-utils.zip" +- "binutils-linux64-utils.zip" +- "gcc-linux32-utils.zip" +- "gcc-linux64-utils.zip" +- "webrtc.tar.gz" +script: | + INSTDIR="$HOME/install" + export REFERENCE_DATETIME + export TZ=UTC + export LC_ALL=C + umask 0022 + # + mkdir -p $OUTDIR/ + + # Config options for hardening-wrapper + export DEB_BUILD_HARDENING=1 + export DEB_BUILD_HARDENING_STACKPROTECTOR=1 + export DEB_BUILD_HARDENING_FORTIFY=1 + export DEB_BUILD_HARDENING_FORMAT=1 + export DEB_BUILD_HARDENING_PIE=1 + + # Preparing Binutils and GCC for webrtc + unzip -d $INSTDIR binutils-linux$GBUILD_BITS-utils.zip + # Make sure gold is used with the hardening wrapper for full RELRO, see + # #13031. + cd $INSTDIR/binutils/bin + rm ld + cp /usr/bin/hardened-ld ./ + mv ld.gold ld.gold.real + ln -sf hardened-ld ld.gold + ln -sf ld.gold ld + cd ~/build + unzip -d $INSTDIR gcc-linux$GBUILD_BITS-utils.zip + # Make sure we use the hardening wrapper when compiling Tor Browser. + cd $INSTDIR/gcc/bin + cp /usr/bin/hardened-cc ./ + mv gcc gcc.real + mv c++ c++.real + ln -sf hardened-cc gcc + ln -sf hardened-cc c++ + cd ~/build + export PATH=$INSTDIR/gcc/bin:$INSTDIR/binutils/bin:$PATH + ARCH="" + if [ $GBUILD_BITS == "64" ]; + then + ARCH="64" + fi + # Make sure our GCC gets properly used. + export LD_LIBRARY_PATH=$INSTDIR/gcc/lib$ARCH + + # Setting up depot_tools + # https://dev.chromium.org/developers/how-tos/install-depot-tools + export PATH="$PATH:$PWD/depot_tools" + # Disable automatic updating. + export DEPOT_TOOLS_UPDATE=0 + + # Building webrtc + tar xaf webrtc.tar.gz + cd webrtc/src + export GYP_CROSSCOMPILE=1 + export GYP_DEFINES="OS=linux target_arch=$(if [ $GBUILD_BITS = 32 ]; then echo ia32; else echo x64; fi)" + # Do not use bundled utilities. + GYP_DEFINES+=" clang=0 host_clang=0 use_sysroot=0" + GYP_DEFINES+=" linux_use_bundled_gold=0 linux_use_gold_flags=0 linux_use_bundled_binutils=0" + # Avoid some dependencies. Some of these don't seem to work fully; for + # example even with use_alsa=0 we need libasound2-dev. + GYP_DEFINES+=" use_x11=0 use_gtk=0 use_gconf=0 use_alsa=0 use_pulseaudio=0 use_libpci=0 include_internal_audio_device=0 enabled_libjingle_device_manager=0" + # examples and tests also bring in dependencies. + GYP_DEFINES+=" include_examples=0 include_tests=0" + # embedded=1 is supposed to turn of various features; see + # https://bugs.chromium.org/p/chromium/issues/detail?id=318413. + GYP_DEFINES+=" embedded=1" + GYP_DEFINES+=" werror=" + JAVA_HOME=/usr/lib/jvm/default-java webrtc/build/gyp_webrtc.py + ninja -C out/Release + # Run ninja once more, without include_tests=0, in order to build just the + # FakeAudioCaptureModule that go-webrtc uses. + GYP_DEFINES="$(echo "$GYP_DEFINES" | sed -e 's/include_tests=0//g')" + JAVA_HOME=/usr/lib/jvm/default-java webrtc/build/gyp_webrtc.py + ninja -C out/Release obj/webrtc/api/test/peerconnection_unittests.fakeaudiocapturemodule.o + # https://github.com/keroserene/go-webrtc/issues/23#issuecomment-175312648 + # dump_syms_regtest.o is actually an executable, not an object file. If not + # excluded, it results in the error: + # libwebrtc-linux-386-magic.a(dump_syms_regtest.o): unsupported ELF file type 2 + ar crs libwebrtc-magic.a $(find . -name '*.o' -not -name '*.main.o' -not -name 'dump_syms_regtest.o' | sort) + cd ../.. + + # Grabbing the result + cd $INSTDIR + mkdir -p webrtc/include webrtc/lib + cp -f $HOME/build/webrtc/src/libwebrtc-magic.a webrtc/lib/libwebrtc-linux-$(if [ $GBUILD_BITS = 32 ]; then echo 386; else echo amd64; fi)-magic.a + INCLUDE_DIR="$PWD/webrtc/include" + (cd $HOME/build/webrtc/src && for h in $(find talk/ webrtc/ -type f -name '*.h'); do + mkdir -p "$INCLUDE_DIR/$(dirname $h)" + cp -f "$h" "$INCLUDE_DIR/$h" + done) + + ~/build/dzip.sh webrtc-linux$GBUILD_BITS-gbuilt.zip webrtc + cp webrtc-linux$GBUILD_BITS-gbuilt.zip $OUTDIR/ diff --git a/gitian/fetch-inputs.sh b/gitian/fetch-inputs.sh index 65ebc11..01ec802 100755 --- a/gitian/fetch-inputs.sh +++ b/gitian/fetch-inputs.sh @@ -273,6 +273,7 @@ https-everywhere https://git.torproject.org/https-everywhere.git $HTTPSE_TA torbutton https://git.torproject.org/torbutton.git $TORBUTTON_TAG tor-launcher https://git.torproject.org/tor-launcher.git $TORLAUNCHER_TAG tor-browser https://git.torproject.org/tor-browser.git $TORBROWSER_TAG +libcxx https://github.com/llvm-mirror/libcxx $LIBCXX_TAG mingw-w64-git http://git.code.sf.net/p/mingw-w64/mingw-w64 $MINGW_TAG pyptlib https://git.torproject.org/pluggable-transports/pyptlib.git $PYPTLIB_TAG obfsproxy https://git.torproject.org/pluggable-transports/obfsproxy.git $OBFSPROXY_TAG @@ -290,6 +291,10 @@ goxnet https://go.googlesource.com/net $GO_X_NET_TAG obfs4 https://git.torproject.org/pluggable-transports/obfs4.git $OBFS4_TAG noto-fonts https://github.com/googlei18n/noto-fonts $NOTOFONTS_TAG selfrando https://github.com/immunant/selfrando.git $SELFRANDO_TAG +depot_tools https://chromium.googlesource.com/chromium/tools/depot_tools.git $DEPOT_TOOLS_TAG +go-webrtc https://github.com/keroserene/go-webrtc $GO_WEBRTC_TAG +snowflake https://git.torproject.org/pluggable-transports/snowflake.git $SNOWFLAKE_TAG +uniuri https://github.com/dchest/uniuri $UNIURI_TAG EOF # HTTPS-Everywhere is special, too. We need to initialize the git submodules and @@ -299,5 +304,28 @@ git submodule init git submodule update cd .. +# WebRTC is special, having its own build system that brings in lots of Chromium dependencies. +# https://webrtc.org/native-code/development/ +# depot_tools must have been downloaded before running this code. +dir=webrtc +PATH="$PATH:$PWD/depot_tools" +# GYP_CROSSCOMPILE=1 and GYP_DEFINES="use_x11=0" prevent probing for certain dependencies. +# Use --no-history because the whole checkout with history is about 12 GB. +export GYP_CROSSCOMPILE=1 +export GYP_DEFINES="use_x11=0" +mkdir -p "$dir" +cd "$dir" +if [ ! -d "src" ]; +then + # "fetch" is part of depot_tools. + fetch --nohooks --no-history webrtc +fi +# "gclient" is part of depot_tools. This download takes a long time the first time. +# JAVA_HOME is needed in a hook for libjingle. The readlink line tries to find the current JRE. +# default-java comes from the package default-jdk-headless. +JAVA_HOME=/usr/lib/jvm/default-java gclient sync --with_branch_heads --no-history -r $WEBRTC_TAG +cd .. +tar --exclude .git -czf webrtc.tar.gz webrtc + exit 0 diff --git a/gitian/mkbundle-linux.sh b/gitian/mkbundle-linux.sh index 48aac24..e5be697 100755 --- a/gitian/mkbundle-linux.sh +++ b/gitian/mkbundle-linux.sh @@ -108,7 +108,7 @@ if [ ! -f inputs/binutils-$BINUTILS_VER-linux64-utils.zip -o \ ! -f inputs/self-rando-utils.zip ]; then echo - echo "****** Starting Utilities Component of Linux Bundle (1/5 for Linux) ******" + echo "****** Starting Utilities Component of Linux Bundle (1/6 for Linux) ******" echo ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit libevent=$LIBEVENT_TAG,selfrando=$SELFRANDO_TAG $DESCRIPTOR_DIR/linux/gitian-utils.yml @@ -129,7 +129,7 @@ then #cp -a result/utils-linux-res.yml inputs/ else echo - echo "****** SKIPPING already built Utilities Component of Linux Bundle (1/5 for Linux) ******" + echo "****** SKIPPING already built Utilities Component of Linux Bundle (1/6 for Linux) ******" echo # We might have built the utilities in the past but maybe the links are # pointing to the wrong version. Refresh them. @@ -145,7 +145,7 @@ fi if [ ! -f inputs/tor-linux64-gbuilt.zip ]; then echo - echo "****** Starting Tor Component of Linux Bundle (2/5 for Linux) ******" + echo "****** Starting Tor Component of Linux Bundle (2/6 for Linux) ******" echo ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit tor=$TOR_TAG $DESCRIPTOR_DIR/linux/gitian-tor.yml @@ -160,14 +160,14 @@ then #cp -a result/tor-linux-res.yml inputs/ else echo - echo "****** SKIPPING already built Tor Component of Linux Bundle (2/5 for Linux) ******" + echo "****** SKIPPING already built Tor Component of Linux Bundle (2/6 for Linux) ******" echo fi if [ ! -f inputs/tor-browser-linux64-gbuilt.zip ]; then echo - echo "****** Starting TorBrowser Component of Linux Bundle (3/5 for Linux) ******" + echo "****** Starting TorBrowser Component of Linux Bundle (3/6 for Linux) ******" echo ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit tor-browser=$TORBROWSER_TAG,faketime=$FAKETIME_TAG,selfrando=$SELFRANDO_TAG $DESCRIPTOR_DIR/linux/gitian-firefox.yml @@ -183,17 +183,39 @@ then #cp -a result/torbrowser-linux-res.yml inputs/ else echo - echo "****** SKIPPING already built TorBrowser Component of Linux Bundle (3/5 for Linux) ******" + echo "****** SKIPPING already built TorBrowser Component of Linux Bundle (3/6 for Linux) ******" + echo +fi + +if [ ! -f inputs/webrtc-linux32-gbuilt.zip -o \ + ! -f inputs/webrtc-linux64-gbuilt.zip ]; +then + echo + echo "****** Starting WebRTC Component of Linux Bundle (4/6 for Linux) ******" + echo + + ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit depot_tools=$DEPOT_TOOLS_TAG $DESCRIPTOR_DIR/linux/gitian-webrtc.yml + if [ $? -ne 0 ]; + then + #mv var/build.log ./webrtc-fail-linux.log.`date +%Y%m%d%H%M%S` + exit 1 + fi + + cp -a build/out/webrtc-linux*-gbuilt.zip inputs/ + #cp -a result/webrtc-linux-res.yml inputs/ +else + echo + echo "****** SKIPPING already built WebRTC Component of Linux Bundle (4/6 for Linux) ******" echo fi if [ ! -f inputs/pluggable-transports-linux64-gbuilt.zip ]; then echo - echo "****** Starting Pluggable Transports Component of Linux Bundle (4/5 for Linux) ******" + echo "****** Starting Pluggable Transports Component of Linux Bundle (5/6 for Linux) ******" echo - ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit pyptlib=$PYPTLIB_TAG,obfsproxy=$OBFSPROXY_TAG,libfte=$LIBFTE_TAG,fteproxy=$FTEPROXY_TAG,txsocksx=$TXSOCKSX_TAG,goptlib=$GOPTLIB_TAG,meek=$MEEK_TAG,ed25519=$GOED25519_TAG,siphash=$GOSIPHASH_TAG,goxcrypto=$GO_X_CRYPTO_TAG,goxnet=$GO_X_NET_TAG,obfs4=$OBFS4_TAG $DESCRIPTOR_DIR/linux/gitian-pluggable-transports.yml + ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit pyptlib=$PYPTLIB_TAG,obfsproxy=$OBFSPROXY_TAG,libfte=$LIBFTE_TAG,fteproxy=$FTEPROXY_TAG,txsocksx=$TXSOCKSX_TAG,goptlib=$GOPTLIB_TAG,meek=$MEEK_TAG,ed25519=$GOED25519_TAG,siphash=$GOSIPHASH_TAG,goxcrypto=$GO_X_CRYPTO_TAG,goxnet=$GO_X_NET_TAG,obfs4=$OBFS4_TAG,go-webrtc=$GO_WEBRTC_TAG,snowflake=$SNOWFLAKE_TAG,uniuri=$UNIURI_TAG $DESCRIPTOR_DIR/linux/gitian-pluggable-transports.yml if [ $? -ne 0 ]; then #mv var/build.log ./pluggable-transports-fail-linux.log.`date +%Y%m%d%H%M%S` @@ -204,14 +226,14 @@ then #cp -a result/pluggable-transports-linux-res.yml inputs/ else echo - echo "****** SKIPPING already built Pluggable Transports Component of Linux Bundle (4/5 for Linux) ******" + echo "****** SKIPPING already built Pluggable Transports Component of Linux Bundle (5/6 for Linux) ******" echo fi if [ ! -f inputs/bundle-linux.gbuilt ]; then echo - echo "****** Starting Bundling+Localization of Linux Bundle (5/5 for Linux) ******" + echo "****** Starting Bundling+Localization of Linux Bundle (6/6 for Linux) ******" echo cd $WRAPPER_DIR && ./record-inputs.sh $VERSIONS_FILE && cd $GITIAN_DIR @@ -231,7 +253,7 @@ then touch inputs/bundle-linux.gbuilt else echo - echo "****** SKIPPING already built Bundling+Localization of Linux Bundle (5/5 for Linux) ******" + echo "****** SKIPPING already built Bundling+Localization of Linux Bundle (6/6 for Linux) ******" echo fi diff --git a/gitian/verify-tags.sh b/gitian/verify-tags.sh index b7c45c4..575901b 100755 --- a/gitian/verify-tags.sh +++ b/gitian/verify-tags.sh @@ -108,6 +108,7 @@ EOF while read dir commit; do check_git_hash "$dir" "$commit" done << EOF +libcxx $LIBCXX_TAG mingw-w64-git $MINGW_TAG libdmg-hfsplus $LIBDMG_TAG libfte $LIBFTE_TAG @@ -120,6 +121,10 @@ goxcrypto $GO_X_CRYPTO_TAG goxnet $GO_X_NET_TAG noto-fonts $NOTOFONTS_TAG selfrando $SELFRANDO_TAG +depot_tools $DEPOT_TOOLS_TAG +go-webrtc $GO_WEBRTC_TAG +snowflake $SNOWFLAKE_TAG +uniuri $UNIURI_TAG EOF # Verify signatures on signed packages @@ -152,6 +157,7 @@ do fi done +# webrtc? Its fetch brings in sources from many repos. cd "$INPUTS_DIR" verify_git "." "$WRAPPER_DIR/gpg/torbutton.gpg" "$GITIAN_TAG" diff --git a/gitian/versions b/gitian/versions index 3b84b63..1b88910 100755 --- a/gitian/versions +++ b/gitian/versions @@ -19,8 +19,12 @@ TORBUTTON_TAG=1.9.3.2 HTTPSE_TAG=5.1.0 NSIS_TAG=v0.3 ZLIB_TAG=v1.2.8 -LIBEVENT_TAG=release-2.0.21-stable -MINGW_TAG=a883b47a45ff74ced41dfbd9f748d5c2c61f3c01 # due to bug 1156131 +LIBEVENT_TAG=release-2.0.22-stable +CMAKE_TAG=v2.8.12.2 +LLVM_TAG=8f188e0ea735ac9383a65a0d1c846eb790c2ec74 # r247539 +CLANG_TAG=592b43b609b42cffd1531a700c140e10766bf049 # r247539 +LIBCXX_TAG=af9a44f256be54de6874d1eefd1d282d0671c0cf # r247539 +MINGW_TAG=a0cd5afeb60be3be0860e9a203314c10485bb9b8 PYPTLIB_TAG=pyptlib-0.0.6 OBFSPROXY_TAG=obfsproxy-0.2.12 FLASHPROXY_TAG=1.6 @@ -37,6 +41,11 @@ GO_X_CRYPTO_TAG=4ed45ec682102c643324fae5dff8dab085b6c300 GO_X_NET_TAG=7dbad50ab5b31073856416cdcfeb2796d682f844 OBFS4_TAG=obfs4proxy-0.0.5 NOTOFONTS_TAG=720e34851382ee3c1ef024d8dffb68ffbfb234c2 +DEPOT_TOOLS_TAG=28216cd14b44716db5c83634afbdc6e90492652b +WEBRTC_TAG=f33698296719f956497d2dbff81b5080864a8804 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/52 +GO_WEBRTC_TAG=69c5ca70533142494d145b43ef2f46ca94715557 +SNOWFLAKE_TAG=6cecd31fd896eb26e64ad8bab8a9ea510ec3b21d +UNIURI_TAG=8902c56451e9b58ff940bbe5fec35d5f9c04584a GITIAN_TAG=tor-browser-builder-3.x-8 diff --git a/gitian/versions.alpha b/gitian/versions.alpha index f553468..d9ce0cb 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -29,6 +29,7 @@ LIBEVENT_TAG=release-2.0.22-stable CMAKE_TAG=v2.8.12.2 LLVM_TAG=8f188e0ea735ac9383a65a0d1c846eb790c2ec74 # r247539 CLANG_TAG=592b43b609b42cffd1531a700c140e10766bf049 # r247539 +LIBCXX_TAG=af9a44f256be54de6874d1eefd1d282d0671c0cf # r247539 MINGW_TAG=a0cd5afeb60be3be0860e9a203314c10485bb9b8 PYPTLIB_TAG=pyptlib-0.0.6 OBFSPROXY_TAG=obfsproxy-0.2.12 @@ -46,6 +47,11 @@ GO_X_NET_TAG=7dbad50ab5b31073856416cdcfeb2796d682f844 OBFS4_TAG=obfs4proxy-0.0.5 NOTOFONTS_TAG=720e34851382ee3c1ef024d8dffb68ffbfb234c2 SELFRANDO_TAG=44ac0df8c0e8eb291f2d913e2dd147000bf54863 +DEPOT_TOOLS_TAG=28216cd14b44716db5c83634afbdc6e90492652b +WEBRTC_TAG=f33698296719f956497d2dbff81b5080864a8804 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/52 +GO_WEBRTC_TAG=69c5ca70533142494d145b43ef2f46ca94715557 +SNOWFLAKE_TAG=6cecd31fd896eb26e64ad8bab8a9ea510ec3b21d +UNIURI_TAG=8902c56451e9b58ff940bbe5fec35d5f9c04584a GITIAN_TAG=tor-browser-builder-4-1 diff --git a/gitian/versions.beta b/gitian/versions.beta index 2bcde03..a9c988e 100755 --- a/gitian/versions.beta +++ b/gitian/versions.beta @@ -30,6 +30,11 @@ TXSOCKSX_TAG=216eb0894a1755872f4789f9458aa6cf543b8433 # unsigned habnabit/1.13.0 GOPTLIB_TAG=0.2 MEEK_TAG=0.25 NOTOFONTS_TAG=720e34851382ee3c1ef024d8dffb68ffbfb234c2 +DEPOT_TOOLS_TAG=28216cd14b44716db5c83634afbdc6e90492652b +WEBRTC_TAG=f33698296719f956497d2dbff81b5080864a8804 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/52 +GO_WEBRTC_TAG=69c5ca70533142494d145b43ef2f46ca94715557 +SNOWFLAKE_TAG=6cecd31fd896eb26e64ad8bab8a9ea510ec3b21d +UNIURI_TAG=8902c56451e9b58ff940bbe5fec35d5f9c04584a GITIAN_TAG=tor-browser-builder-3.x-6 diff --git a/gitian/versions.nightly b/gitian/versions.nightly index d606efc..ad3f017 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -32,6 +32,7 @@ LIBEVENT_TAG=release-2.0.22-stable CMAKE_TAG=v2.8.12.2 LLVM_TAG=8f188e0ea735ac9383a65a0d1c846eb790c2ec74 # r247539 CLANG_TAG=592b43b609b42cffd1531a700c140e10766bf049 # r247539 +LIBCXX_TAG=af9a44f256be54de6874d1eefd1d282d0671c0cf # r247539 MINGW_TAG=a0cd5afeb60be3be0860e9a203314c10485bb9b8 PYPTLIB_TAG=master OBFSPROXY_TAG=master @@ -49,6 +50,11 @@ GO_X_NET_TAG=master OBFS4_TAG=master NOTOFONTS_TAG=720e34851382ee3c1ef024d8dffb68ffbfb234c2 SELFRANDO_TAG=44ac0df8c0e8eb291f2d913e2dd147000bf54863 +DEPOT_TOOLS_TAG=master +WEBRTC_TAG=f33698296719f956497d2dbff81b5080864a8804 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/52 +GO_WEBRTC_TAG=master +SNOWFLAKE_TAG=master +UNIURI_TAG=master GITIAN_TAG=tor-browser-builder-4

1 0

[tor-browser-bundle/master] Bug 20735: Add snowflake pt to alpha Linux builds
by gk＠torproject.org 05 Jan '17

05 Jan '17

commit 761b0dbabd8fd14e8d9149634b52869f0c68375b Author: David Fifield <david(a)bamsoftware.com> Date: Mon Dec 19 13:10:04 2016 -0800 Bug 20735: Add snowflake pt to alpha Linux builds * Snowflake depends on go-webrtc, which in turn depends on libwebrtc, which adds significantly to the build. webrtc is special, having its own build system that brings in lots of Chromium dependencies. * Further, building cgo reproducibly requires go 1.7.3 and a compiler that supports the following flags, -gno-record-gcc-switches -fdebug-prefix-map=$WORK=/tmp/go-build --- Bundle-Data/PTConfigs/bridge_prefs.js | 2 + .../PTConfigs/linux/torrc-defaults-appendix | 3 + gitian/Makefile | 5 +- gitian/check-prerequisites.sh | 8 +- .../linux/gitian-pluggable-transports.yml | 79 +++++++++++++ gitian/descriptors/linux/gitian-webrtc.yml | 125 +++++++++++++++++++++ gitian/fetch-inputs.sh | 28 +++++ gitian/mkbundle-linux.sh | 48 +++++--- gitian/verify-tags.sh | 6 + gitian/versions | 6 + gitian/versions.alpha | 6 + gitian/versions.beta | 5 + gitian/versions.nightly | 6 + 13 files changed, 309 insertions(+), 18 deletions(-) diff --git a/Bundle-Data/PTConfigs/bridge_prefs.js b/Bundle-Data/PTConfigs/bridge_prefs.js index 6831555..bd92585 100644 --- a/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/Bundle-Data/PTConfigs/bridge_prefs.js @@ -38,3 +38,5 @@ pref("extensions.torlauncher.default_bridge.obfs4.20", "obfs4 85.17.30.79:443 FC pref("extensions.torlauncher.default_bridge.meek-amazon.1", "meek 0.0.2.0:2 B9E7141C594AF25699E0079C1F0146F409495296 url=https://d2zfqthxsdq309.cloudfront.net/ front=a0.awsstatic.com"); pref("extensions.torlauncher.default_bridge.meek-azure.1", "meek 0.0.2.0:3 A2C13B7DFCAB1CBF3A884B6EB99A98067AB6EF44 url=https://az786092.vo.msecnd.net/ front=ajax.aspnetcdn.com"); + +pref("extensions.torlauncher.default_bridge.snowflake.1", "snowflake 0.0.3.0:1 B05EC36590AC0374F0E4D36DDA77908FD59D97F3"); diff --git a/Bundle-Data/PTConfigs/linux/torrc-defaults-appendix b/Bundle-Data/PTConfigs/linux/torrc-defaults-appendix index c79efde..7fbf63c 100644 --- a/Bundle-Data/PTConfigs/linux/torrc-defaults-appendix +++ b/Bundle-Data/PTConfigs/linux/torrc-defaults-appendix @@ -6,3 +6,6 @@ ClientTransportPlugin obfs2,obfs3,obfs4,scramblesuit exec ./TorBrowser/Tor/Plugg ## meek configuration ClientTransportPlugin meek exec ./TorBrowser/Tor/PluggableTransports/meek-client-torbrowser -- ./TorBrowser/Tor/PluggableTransports/meek-client + +## snowflake configuration +ClientTransportPlugin snowflake exec ./TorBrowser/Tor/PluggableTransports/snowflake-client -url https://snowflake-reg.appspot.com/ -front www.google.com -ice stun:stun.l.google.com:19302 diff --git a/gitian/Makefile b/gitian/Makefile index 5694cbf..666dc53 100644 --- a/gitian/Makefile +++ b/gitian/Makefile @@ -101,7 +101,7 @@ prep-alpha: ./check-prerequisites.sh $(TORSOCKS) ./fetch-inputs.sh ../../gitian-builder/inputs/ versions.alpha -clean: clean-utils clean-tor clean-browser clean-pt clean-sandbox clean-bundle +clean: clean-utils clean-tor clean-browser clean-webrtc clean-pt clean-sandbox clean-bundle rm -f ../../gitian-builder/inputs/*.yml rm -f ../../gitian-builder/inputs/bundle.inputs rm -f ../../gitian-builder/inputs/versions* @@ -120,6 +120,9 @@ clean-browser: clean-bundle rm -f ../../gitian-builder/inputs/tor-browser-win* rm -f ../../gitian-builder/inputs/mar-tools-* +clean-webrtc: clean-bundle + rm -f ../../gitian-builder/inputs/webrtc-*-gbuilt.zip + clean-pt: clean-bundle rm -f ../../gitian-builder/inputs/pluggable-transports* diff --git a/gitian/check-prerequisites.sh b/gitian/check-prerequisites.sh index 858fd4d..530e160 100755 --- a/gitian/check-prerequisites.sh +++ b/gitian/check-prerequisites.sh @@ -17,7 +17,7 @@ then VERSION=`cat /etc/issue | grep -Eo '[0-9]{2}' | head -1` if [ "$VERSION" -ge "14" ]; then - dpkg -s ruby apache2 git apt-cacher-ng qemu-kvm virt-what lxc lxctl fakeroot faketime zip unzip subversion debian-archive-keyring torsocks tor 2>/dev/null >/dev/null + dpkg -s ruby apache2 git apt-cacher-ng qemu-kvm virt-what lxc lxctl fakeroot faketime zip unzip subversion debian-archive-keyring curl pkg-config libgtk2.0-dev libglib2.0-dev torsocks tor 2>/dev/null >/dev/null if [ $? -ne 0 ]; then @@ -25,7 +25,7 @@ then echo echo "Please run:" echo " sudo apt-get install torsocks tor" - echo " sudo torsocks apt-get install ruby apache2 git apt-cacher-ng qemu-kvm virt-what lxc lxctl fakeroot faketime zip unzip subversion debian-archive-keyring" + echo " sudo torsocks apt-get install ruby apache2 git apt-cacher-ng qemu-kvm virt-what lxc lxctl fakeroot faketime zip unzip subversion debian-archive-keyring curl pkg-config libgtk2.0-dev libglib2.0-dev" exit 1 fi else @@ -34,7 +34,7 @@ then fi elif [ $DISTRO = "Debian" ]; then - dpkg -s ruby git apt-cacher-ng qemu-kvm virt-what lxc lxctl fakeroot zip unzip torsocks tor python-cheetah debootstrap parted kpartx rsync 2>/dev/null >/dev/null + dpkg -s ruby git apt-cacher-ng qemu-kvm virt-what lxc lxctl fakeroot zip unzip python-cheetah debootstrap parted kpartx rsync curl pkg-config libgtk2.0-dev libglib2.0-dev torsocks tor 2>/dev/null >/dev/null if [ $? -ne 0 ]; then @@ -42,7 +42,7 @@ then echo echo "Please run" echo " sudo apt-get install torsocks tor" - echo " sudo torsocks apt-get install ruby git apt-cacher-ng qemu-kvm virt-what lxc lxctl fakeroot zip unzip python-cheetah debootstrap parted kpartx rsync" + echo " sudo torsocks apt-get install ruby git apt-cacher-ng qemu-kvm virt-what lxc lxctl fakeroot zip unzip python-cheetah debootstrap parted kpartx rsync curl pkg-config libgtk2.0-dev libglib2.0-dev" exit 1 fi else diff --git a/gitian/descriptors/linux/gitian-pluggable-transports.yml b/gitian/descriptors/linux/gitian-pluggable-transports.yml index c790a9f..ecf49de 100644 --- a/gitian/descriptors/linux/gitian-pluggable-transports.yml +++ b/gitian/descriptors/linux/gitian-pluggable-transports.yml @@ -12,6 +12,8 @@ packages: - "python-dev" - "zip" - "hardening-wrapper" +- "pkg-config" +- "libx11-dev" reference_datetime: "2000-01-01 00:00:00" remotes: - "url": "https://git.torproject.org/pluggable-transports/pyptlib.git" @@ -38,6 +40,12 @@ remotes: "dir": "goxnet" - "url": "https://git.torproject.org/pluggable-transports/obfs4.git" "dir": "obfs4" +- "url": "https://github.com/keroserene/go-webrtc.git" + "dir": "go-webrtc" +- "url": "https://git.torproject.org/pluggable-transports/snowflake.git" + "dir": "snowflake" +- "url": "https://github.com/dchest/uniuri.git" + "dir": "uniuri" files: - "pycrypto.tar.gz" - "argparse.tar.gz" @@ -52,6 +60,12 @@ files: - "openssl-linux64-utils.zip" - "go-linux32-utils.zip" - "go-linux64-utils.zip" +- "binutils-linux32-utils.zip" +- "binutils-linux64-utils.zip" +- "gcc-linux32-utils.zip" +- "gcc-linux64-utils.zip" +- "webrtc-linux32-gbuilt.zip" +- "webrtc-linux64-gbuilt.zip" script: | INSTDIR="$HOME/install" PTDIR="$INSTDIR/Tor/PluggableTransports" @@ -78,6 +92,35 @@ script: | # FTE only needs libgmp.so.10 and no libgmpxx anymore. cp $INSTDIR/gmp/lib/libgmp.so.10 $INSTDIR/Tor + # Preparing Binutils and GCC for webrtc + unzip -d $INSTDIR binutils-linux$GBUILD_BITS-utils.zip + # Make sure gold is used with the hardening wrapper for full RELRO, see + # #13031. + cd $INSTDIR/binutils/bin + rm ld + cp /usr/bin/hardened-ld ./ + mv ld.gold ld.gold.real + ln -sf hardened-ld ld.gold + ln -sf ld.gold ld + cd ~/build + unzip -d $INSTDIR gcc-linux$GBUILD_BITS-utils.zip + # Make sure we use the hardening wrapper when compiling Tor Browser. + cd $INSTDIR/gcc/bin + cp /usr/bin/hardened-cc ./ + mv gcc gcc.real + mv c++ c++.real + ln -sf hardened-cc gcc + ln -sf hardened-cc c++ + cd ~/build + export PATH=$INSTDIR/gcc/bin:$INSTDIR/binutils/bin:$PATH + ARCH="" + if [ $GBUILD_BITS == "64" ]; + then + ARCH="64" + fi + # Make sure our GCC gets properly used. + export LD_LIBRARY_PATH=$INSTDIR/gcc/lib$ARCH + # Building pyptlib cd pyptlib find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" @@ -216,6 +259,14 @@ script: | go install github.com/dchest/siphash cd .. + # Building go uniuri + cd uniuri + find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" + mkdir -p "$GOPATH/src/github.com/dchest/" + ln -sf "$PWD" "$GOPATH/src/github.com/dchest/uniuri" + go install github.com/dchest/uniuri + cd .. + # Building golang.org/x/crypto (obfs4proxy > 0.0.3 || Go >= 1.4) cd goxcrypto find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" @@ -244,6 +295,34 @@ script: | cp -a obfs4proxy $PTDIR cd ../.. + unzip webrtc-linux$GBUILD_BITS-gbuilt.zip + + # Building go-webrtc + cd go-webrtc + # Replace the prebuilt webrtc library with our own one. + rm -rf include/ lib/ + ln -sf ../webrtc/{include,lib} . + find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" + mkdir -p "$GOPATH/src/github.com/keroserene/" + ln -sf "$PWD" "$GOPATH/src/github.com/keroserene/go-webrtc" + # The go-webrtc package sets _GLIBCXX_USE_CXX11_ABI=0 for compatibility with + # the prebuilt libwebrtc-magic.a libraries. Since we build our own + # libwebrtc-magic.a with the C++11 ABI, we have to undo that setting here, + # using CGO_CXXFLAGS. + CGO_CXXFLAGS=-D_GLIBCXX_USE_CXX11_ABI=1 go install github.com/keroserene/go-webrtc + cd .. + + # Building snowflake + cd snowflake + find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" + cd client + go build -ldflags '-s' + cp -a client $PTDIR/snowflake-client + cd .. + mkdir -p $INSTDIR/Docs/snowflake + cp -a README.md LICENSE $INSTDIR/Docs/snowflake + cd .. + # Grabbing the results and making sure timestamps don't spoil them cd $INSTDIR ~/build/dzip.sh pluggable-transports-linux$GBUILD_BITS-gbuilt.zip Tor/ Docs/ diff --git a/gitian/descriptors/linux/gitian-webrtc.yml b/gitian/descriptors/linux/gitian-webrtc.yml new file mode 100644 index 0000000..ba654c5 --- /dev/null +++ b/gitian/descriptors/linux/gitian-webrtc.yml @@ -0,0 +1,125 @@ +--- +name: "webrtc-linux" +distro: "debian" +suites: +- "wheezy" +architectures: +- "i386" +- "amd64" +packages: +- "unzip" +- "zip" +- "hardening-wrapper" +- "libasound2-dev" +- "libexpat1-dev" +- "libudev-dev" +- "libx11-dev" +- "libxext-dev" +- "libxrandr-dev" +- "default-jre-headless" +- "default-jdk" +reference_datetime: "2000-01-01 00:00:00" +remotes: +- "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git" + "dir": "depot_tools" +files: +- "dzip.sh" +- "binutils-linux32-utils.zip" +- "binutils-linux64-utils.zip" +- "gcc-linux32-utils.zip" +- "gcc-linux64-utils.zip" +- "webrtc.tar.gz" +script: | + INSTDIR="$HOME/install" + export REFERENCE_DATETIME + export TZ=UTC + export LC_ALL=C + umask 0022 + # + mkdir -p $OUTDIR/ + + # Config options for hardening-wrapper + export DEB_BUILD_HARDENING=1 + export DEB_BUILD_HARDENING_STACKPROTECTOR=1 + export DEB_BUILD_HARDENING_FORTIFY=1 + export DEB_BUILD_HARDENING_FORMAT=1 + export DEB_BUILD_HARDENING_PIE=1 + + # Preparing Binutils and GCC for webrtc + unzip -d $INSTDIR binutils-linux$GBUILD_BITS-utils.zip + # Make sure gold is used with the hardening wrapper for full RELRO, see + # #13031. + cd $INSTDIR/binutils/bin + rm ld + cp /usr/bin/hardened-ld ./ + mv ld.gold ld.gold.real + ln -sf hardened-ld ld.gold + ln -sf ld.gold ld + cd ~/build + unzip -d $INSTDIR gcc-linux$GBUILD_BITS-utils.zip + # Make sure we use the hardening wrapper when compiling Tor Browser. + cd $INSTDIR/gcc/bin + cp /usr/bin/hardened-cc ./ + mv gcc gcc.real + mv c++ c++.real + ln -sf hardened-cc gcc + ln -sf hardened-cc c++ + cd ~/build + export PATH=$INSTDIR/gcc/bin:$INSTDIR/binutils/bin:$PATH + ARCH="" + if [ $GBUILD_BITS == "64" ]; + then + ARCH="64" + fi + # Make sure our GCC gets properly used. + export LD_LIBRARY_PATH=$INSTDIR/gcc/lib$ARCH + + # Setting up depot_tools + # https://dev.chromium.org/developers/how-tos/install-depot-tools + export PATH="$PATH:$PWD/depot_tools" + # Disable automatic updating. + export DEPOT_TOOLS_UPDATE=0 + + # Building webrtc + tar xaf webrtc.tar.gz + cd webrtc/src + export GYP_CROSSCOMPILE=1 + export GYP_DEFINES="OS=linux target_arch=$(if [ $GBUILD_BITS = 32 ]; then echo ia32; else echo x64; fi)" + # Do not use bundled utilities. + GYP_DEFINES+=" clang=0 host_clang=0 use_sysroot=0" + GYP_DEFINES+=" linux_use_bundled_gold=0 linux_use_gold_flags=0 linux_use_bundled_binutils=0" + # Avoid some dependencies. Some of these don't seem to work fully; for + # example even with use_alsa=0 we need libasound2-dev. + GYP_DEFINES+=" use_x11=0 use_gtk=0 use_gconf=0 use_alsa=0 use_pulseaudio=0 use_libpci=0 include_internal_audio_device=0 enabled_libjingle_device_manager=0" + # examples and tests also bring in dependencies. + GYP_DEFINES+=" include_examples=0 include_tests=0" + # embedded=1 is supposed to turn of various features; see + # https://bugs.chromium.org/p/chromium/issues/detail?id=318413. + GYP_DEFINES+=" embedded=1" + GYP_DEFINES+=" werror=" + JAVA_HOME=/usr/lib/jvm/default-java webrtc/build/gyp_webrtc.py + ninja -C out/Release + # Run ninja once more, without include_tests=0, in order to build just the + # FakeAudioCaptureModule that go-webrtc uses. + GYP_DEFINES="$(echo "$GYP_DEFINES" | sed -e 's/include_tests=0//g')" + JAVA_HOME=/usr/lib/jvm/default-java webrtc/build/gyp_webrtc.py + ninja -C out/Release obj/webrtc/api/test/peerconnection_unittests.fakeaudiocapturemodule.o + # https://github.com/keroserene/go-webrtc/issues/23#issuecomment-175312648 + # dump_syms_regtest.o is actually an executable, not an object file. If not + # excluded, it results in the error: + # libwebrtc-linux-386-magic.a(dump_syms_regtest.o): unsupported ELF file type 2 + ar crs libwebrtc-magic.a $(find . -name '*.o' -not -name '*.main.o' -not -name 'dump_syms_regtest.o' | sort) + cd ../.. + + # Grabbing the result + cd $INSTDIR + mkdir -p webrtc/include webrtc/lib + cp -f $HOME/build/webrtc/src/libwebrtc-magic.a webrtc/lib/libwebrtc-linux-$(if [ $GBUILD_BITS = 32 ]; then echo 386; else echo amd64; fi)-magic.a + INCLUDE_DIR="$PWD/webrtc/include" + (cd $HOME/build/webrtc/src && for h in $(find talk/ webrtc/ -type f -name '*.h'); do + mkdir -p "$INCLUDE_DIR/$(dirname $h)" + cp -f "$h" "$INCLUDE_DIR/$h" + done) + + ~/build/dzip.sh webrtc-linux$GBUILD_BITS-gbuilt.zip webrtc + cp webrtc-linux$GBUILD_BITS-gbuilt.zip $OUTDIR/ diff --git a/gitian/fetch-inputs.sh b/gitian/fetch-inputs.sh index b3d5c26..729e492 100755 --- a/gitian/fetch-inputs.sh +++ b/gitian/fetch-inputs.sh @@ -277,6 +277,7 @@ tor-browser https://git.torproject.org/tor-browser.git $TORBR cmake https://cmake.org/cmake.git $CMAKE_TAG llvm https://github.com/llvm-mirror/llvm $LLVM_TAG clang https://github.com/llvm-mirror/clang $CLANG_TAG +libcxx https://github.com/llvm-mirror/libcxx $LIBCXX_TAG mingw-w64-git http://git.code.sf.net/p/mingw-w64/mingw-w64 $MINGW_TAG pyptlib https://git.torproject.org/pluggable-transports/pyptlib.git $PYPTLIB_TAG obfsproxy https://git.torproject.org/pluggable-transports/obfsproxy.git $OBFSPROXY_TAG @@ -296,6 +297,10 @@ noto-fonts https://github.com/googlei18n/noto-fonts $NOTOFONTS_TAG errors https://github.com/pkg/errors $ERRORS_TAG gb https://github.com/constabulary/gb $GB_TAG sandbox https://git.schwanenlied.me/yawning/sandboxed-tor-browser $SANDBOX_TAG +depot_tools https://chromium.googlesource.com/chromium/tools/depot_tools.git $DEPOT_TOOLS_TAG +go-webrtc https://github.com/keroserene/go-webrtc $GO_WEBRTC_TAG +snowflake https://git.torproject.org/pluggable-transports/snowflake.git $SNOWFLAKE_TAG +uniuri https://github.com/dchest/uniuri $UNIURI_TAG EOF # HTTPS-Everywhere is special, too. We need to initialize the git submodules and @@ -305,5 +310,28 @@ git submodule init git submodule update cd .. +# WebRTC is special, having its own build system that brings in lots of Chromium dependencies. +# https://webrtc.org/native-code/development/ +# depot_tools must have been downloaded before running this code. +dir=webrtc +PATH="$PATH:$PWD/depot_tools" +# GYP_CROSSCOMPILE=1 and GYP_DEFINES="use_x11=0" prevent probing for certain dependencies. +# Use --no-history because the whole checkout with history is about 12 GB. +export GYP_CROSSCOMPILE=1 +export GYP_DEFINES="use_x11=0" +mkdir -p "$dir" +cd "$dir" +if [ ! -d "src" ]; +then + # "fetch" is part of depot_tools. + fetch --nohooks --no-history webrtc +fi +# "gclient" is part of depot_tools. This download takes a long time the first time. +# JAVA_HOME is needed in a hook for libjingle. The readlink line tries to find the current JRE. +# default-java comes from the package default-jdk-headless. +JAVA_HOME=/usr/lib/jvm/default-java gclient sync --with_branch_heads --no-history -r $WEBRTC_TAG +cd .. +tar --exclude .git -czf webrtc.tar.gz webrtc + exit 0 diff --git a/gitian/mkbundle-linux.sh b/gitian/mkbundle-linux.sh index 27cccd0..f1da2e0 100755 --- a/gitian/mkbundle-linux.sh +++ b/gitian/mkbundle-linux.sh @@ -114,7 +114,7 @@ if [ ! -f inputs/binutils-$BINUTILS_VER-linux32-utils.zip -o \ ! -f inputs/go-$GO_VER-linux64-utils.zip ]; then echo - echo "****** Starting Utilities Component of Linux Bundle (1/6 for Linux) ******" + echo "****** Starting Utilities Component of Linux Bundle (1/7 for Linux) ******" echo ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit libevent=$LIBEVENT_TAG $DESCRIPTOR_DIR/linux/gitian-utils.yml @@ -142,7 +142,7 @@ then #cp -a result/utils-linux-res.yml inputs/ else echo - echo "****** SKIPPING already built Utilities Component of Linux Bundle (1/6 for Linux) ******" + echo "****** SKIPPING already built Utilities Component of Linux Bundle (1/7 for Linux) ******" echo # We might have built the utilities in the past but maybe the links are # pointing to the wrong version. Refresh them. @@ -166,7 +166,7 @@ if [ ! -f inputs/tor-linux32-gbuilt.zip -o \ ! -f inputs/tor-linux64-gbuilt.zip ]; then echo - echo "****** Starting Tor Component of Linux Bundle (2/6 for Linux) ******" + echo "****** Starting Tor Component of Linux Bundle (2/7 for Linux) ******" echo ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit tor=$TOR_TAG $DESCRIPTOR_DIR/linux/gitian-tor.yml @@ -181,7 +181,7 @@ then #cp -a result/tor-linux-res.yml inputs/ else echo - echo "****** SKIPPING already built Tor Component of Linux Bundle (2/6 for Linux) ******" + echo "****** SKIPPING already built Tor Component of Linux Bundle (2/7 for Linux) ******" echo fi @@ -190,7 +190,7 @@ if [ ! -f inputs/tor-browser-linux32-gbuilt.zip -o \ ! -f inputs/tor-browser-linux64-gbuilt.zip ]; then echo - echo "****** Starting TorBrowser Component of Linux Bundle (3/6 for Linux) ******" + echo "****** Starting TorBrowser Component of Linux Bundle (3/7 for Linux) ******" echo ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit tor-browser=$TORBROWSER_TAG,faketime=$FAKETIME_TAG $DESCRIPTOR_DIR/linux/gitian-firefox.yml @@ -206,7 +206,29 @@ then #cp -a result/torbrowser-linux-res.yml inputs/ else echo - echo "****** SKIPPING already built TorBrowser Component of Linux Bundle (3/6 for Linux) ******" + echo "****** SKIPPING already built TorBrowser Component of Linux Bundle (3/7 for Linux) ******" + echo +fi + +if [ ! -f inputs/webrtc-linux32-gbuilt.zip -o \ + ! -f inputs/webrtc-linux64-gbuilt.zip ]; +then + echo + echo "****** Starting WebRTC Component of Linux Bundle (4/7 for Linux) ******" + echo + + ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit depot_tools=$DEPOT_TOOLS_TAG $DESCRIPTOR_DIR/linux/gitian-webrtc.yml + if [ $? -ne 0 ]; + then + #mv var/build.log ./webrtc-fail-linux.log.`date +%Y%m%d%H%M%S` + exit 1 + fi + + cp -a build/out/webrtc-linux*-gbuilt.zip inputs/ + #cp -a result/webrtc-linux-res.yml inputs/ +else + echo + echo "****** SKIPPING already built WebRTC Component of Linux Bundle (4/7 for Linux) ******" echo fi @@ -214,10 +236,10 @@ if [ ! -f inputs/pluggable-transports-linux32-gbuilt.zip -o \ ! -f inputs/pluggable-transports-linux64-gbuilt.zip ]; then echo - echo "****** Starting Pluggable Transports Component of Linux Bundle (4/6 for Linux) ******" + echo "****** Starting Pluggable Transports Component of Linux Bundle (5/7 for Linux) ******" echo - ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit pyptlib=$PYPTLIB_TAG,obfsproxy=$OBFSPROXY_TAG,libfte=$LIBFTE_TAG,fteproxy=$FTEPROXY_TAG,txsocksx=$TXSOCKSX_TAG,goptlib=$GOPTLIB_TAG,meek=$MEEK_TAG,ed25519=$GOED25519_TAG,siphash=$GOSIPHASH_TAG,goxcrypto=$GO_X_CRYPTO_TAG,goxnet=$GO_X_NET_TAG,obfs4=$OBFS4_TAG $DESCRIPTOR_DIR/linux/gitian-pluggable-transports.yml + ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit pyptlib=$PYPTLIB_TAG,obfsproxy=$OBFSPROXY_TAG,libfte=$LIBFTE_TAG,fteproxy=$FTEPROXY_TAG,txsocksx=$TXSOCKSX_TAG,goptlib=$GOPTLIB_TAG,meek=$MEEK_TAG,ed25519=$GOED25519_TAG,siphash=$GOSIPHASH_TAG,goxcrypto=$GO_X_CRYPTO_TAG,goxnet=$GO_X_NET_TAG,obfs4=$OBFS4_TAG,go-webrtc=$GO_WEBRTC_TAG,snowflake=$SNOWFLAKE_TAG,uniuri=$UNIURI_TAG $DESCRIPTOR_DIR/linux/gitian-pluggable-transports.yml if [ $? -ne 0 ]; then #mv var/build.log ./pluggable-transports-fail-linux.log.`date +%Y%m%d%H%M%S` @@ -228,7 +250,7 @@ then #cp -a result/pluggable-transports-linux-res.yml inputs/ else echo - echo "****** SKIPPING already built Pluggable Transports Component of Linux Bundle (4/6 for Linux) ******" + echo "****** SKIPPING already built Pluggable Transports Component of Linux Bundle (5/7 for Linux) ******" echo fi @@ -243,7 +265,7 @@ if [ ! -f inputs/sandbox-$SB_TAG-linux32.zip -o \ ! -f inputs/sandbox-$SB_TAG-linux64.zip ]; then echo - echo "****** Starting Sandbox Component of Linux Bundle (5/6 for Linux) ******" + echo "****** Starting Sandbox Component of Linux Bundle (6/7 for Linux) ******" echo ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit errors=$ERRORS_TAG,gb=$GB_TAG,sandbox=$SANDBOX_TAG $DESCRIPTOR_DIR/linux/gitian-sandbox.yml @@ -256,14 +278,14 @@ then #cp -a result/sandbox-linux-res.yml inputs/ else echo - echo "****** SKIPPING already built Sandbox Component of Linux Bundle (5/6 for Linux) ******" + echo "****** SKIPPING already built Sandbox Component of Linux Bundle (6/7 for Linux) ******" echo fi if [ ! -f inputs/bundle-linux.gbuilt ]; then echo - echo "****** Starting Bundling+Localization of Linux Bundle (6/6 for Linux) ******" + echo "****** Starting Bundling+Localization of Linux Bundle (7/7 for Linux) ******" echo cd $WRAPPER_DIR && ./record-inputs.sh $VERSIONS_FILE && cd $GITIAN_DIR @@ -284,7 +306,7 @@ then touch inputs/bundle-linux.gbuilt else echo - echo "****** SKIPPING already built Bundling+Localization of Linux Bundle (6/6 for Linux) ******" + echo "****** SKIPPING already built Bundling+Localization of Linux Bundle (7/7 for Linux) ******" echo fi diff --git a/gitian/verify-tags.sh b/gitian/verify-tags.sh index d95b0e0..368a990 100755 --- a/gitian/verify-tags.sh +++ b/gitian/verify-tags.sh @@ -111,6 +111,7 @@ while read dir commit; do done << EOF llvm $LLVM_TAG clang $CLANG_TAG +libcxx $LIBCXX_TAG mingw-w64-git $MINGW_TAG libdmg-hfsplus $LIBDMG_TAG libfte $LIBFTE_TAG @@ -122,6 +123,10 @@ siphash $GOSIPHASH_TAG goxcrypto $GO_X_CRYPTO_TAG goxnet $GO_X_NET_TAG noto-fonts $NOTOFONTS_TAG +depot_tools $DEPOT_TOOLS_TAG +go-webrtc $GO_WEBRTC_TAG +snowflake $SNOWFLAKE_TAG +uniuri $UNIURI_TAG EOF # Verify signatures on signed packages @@ -154,6 +159,7 @@ do fi done +# webrtc? Its fetch brings in sources from many repos. cd "$INPUTS_DIR" verify_git "." "$WRAPPER_DIR/gpg/torbutton.gpg" "$GITIAN_TAG" diff --git a/gitian/versions b/gitian/versions index 81963bb..598a945 100755 --- a/gitian/versions +++ b/gitian/versions @@ -25,6 +25,7 @@ LIBEVENT_TAG=release-2.0.22-stable CMAKE_TAG=v2.8.12.2 LLVM_TAG=8f188e0ea735ac9383a65a0d1c846eb790c2ec74 # r247539 CLANG_TAG=592b43b609b42cffd1531a700c140e10766bf049 # r247539 +LIBCXX_TAG=af9a44f256be54de6874d1eefd1d282d0671c0cf # r247539 MINGW_TAG=a0cd5afeb60be3be0860e9a203314c10485bb9b8 PYPTLIB_TAG=pyptlib-0.0.6 OBFSPROXY_TAG=obfsproxy-0.2.12 @@ -41,6 +42,11 @@ GO_X_CRYPTO_TAG=4ed45ec682102c643324fae5dff8dab085b6c300 GO_X_NET_TAG=7dbad50ab5b31073856416cdcfeb2796d682f844 OBFS4_TAG=obfs4proxy-0.0.5 NOTOFONTS_TAG=720e34851382ee3c1ef024d8dffb68ffbfb234c2 +DEPOT_TOOLS_TAG=28216cd14b44716db5c83634afbdc6e90492652b +WEBRTC_TAG=f33698296719f956497d2dbff81b5080864a8804 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/52 +GO_WEBRTC_TAG=69c5ca70533142494d145b43ef2f46ca94715557 +SNOWFLAKE_TAG=6cecd31fd896eb26e64ad8bab8a9ea510ec3b21d +UNIURI_TAG=8902c56451e9b58ff940bbe5fec35d5f9c04584a GITIAN_TAG=tor-browser-builder-4-1 diff --git a/gitian/versions.alpha b/gitian/versions.alpha index a8a08c1..14ed662 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -25,6 +25,7 @@ LIBEVENT_TAG=release-2.0.22-stable CMAKE_TAG=v2.8.12.2 LLVM_TAG=8f188e0ea735ac9383a65a0d1c846eb790c2ec74 # r247539 CLANG_TAG=592b43b609b42cffd1531a700c140e10766bf049 # r247539 +LIBCXX_TAG=af9a44f256be54de6874d1eefd1d282d0671c0cf # r247539 MINGW_TAG=a0cd5afeb60be3be0860e9a203314c10485bb9b8 PYPTLIB_TAG=pyptlib-0.0.6 OBFSPROXY_TAG=obfsproxy-0.2.12 @@ -44,6 +45,11 @@ NOTOFONTS_TAG=720e34851382ee3c1ef024d8dffb68ffbfb234c2 ERRORS_TAG=248dadf4e9068a0b3e79f02ed0a610d935de5302 GB_TAG=06cc925cce6592e922dcc4839a8b44feb384e71e SANDBOX_TAG=sandboxed-tor-browser-0.0.2 +DEPOT_TOOLS_TAG=28216cd14b44716db5c83634afbdc6e90492652b +WEBRTC_TAG=f33698296719f956497d2dbff81b5080864a8804 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/52 +GO_WEBRTC_TAG=69c5ca70533142494d145b43ef2f46ca94715557 +SNOWFLAKE_TAG=6cecd31fd896eb26e64ad8bab8a9ea510ec3b21d +UNIURI_TAG=8902c56451e9b58ff940bbe5fec35d5f9c04584a GITIAN_TAG=tor-browser-builder-4-2 diff --git a/gitian/versions.beta b/gitian/versions.beta index 577b802..b1342b9 100755 --- a/gitian/versions.beta +++ b/gitian/versions.beta @@ -29,6 +29,11 @@ TXSOCKSX_TAG=216eb0894a1755872f4789f9458aa6cf543b8433 # unsigned habnabit/1.13.0 GOPTLIB_TAG=0.2 MEEK_TAG=0.25 NOTOFONTS_TAG=720e34851382ee3c1ef024d8dffb68ffbfb234c2 +DEPOT_TOOLS_TAG=28216cd14b44716db5c83634afbdc6e90492652b +WEBRTC_TAG=f33698296719f956497d2dbff81b5080864a8804 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/52 +GO_WEBRTC_TAG=69c5ca70533142494d145b43ef2f46ca94715557 +SNOWFLAKE_TAG=6cecd31fd896eb26e64ad8bab8a9ea510ec3b21d +UNIURI_TAG=8902c56451e9b58ff940bbe5fec35d5f9c04584a GITIAN_TAG=tor-browser-builder-3.x-6 diff --git a/gitian/versions.nightly b/gitian/versions.nightly index c661b0e..1b1b346 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -32,6 +32,7 @@ LIBEVENT_TAG=release-2.0.22-stable CMAKE_TAG=v2.8.12.2 LLVM_TAG=8f188e0ea735ac9383a65a0d1c846eb790c2ec74 # r247539 CLANG_TAG=592b43b609b42cffd1531a700c140e10766bf049 # r247539 +LIBCXX_TAG=af9a44f256be54de6874d1eefd1d282d0671c0cf # r247539 MINGW_TAG=a0cd5afeb60be3be0860e9a203314c10485bb9b8 PYPTLIB_TAG=master OBFSPROXY_TAG=master @@ -51,6 +52,11 @@ NOTOFONTS_TAG=720e34851382ee3c1ef024d8dffb68ffbfb234c2 ERRORS_TAG=248dadf4e9068a0b3e79f02ed0a610d935de5302 GB_TAG=06cc925cce6592e922dcc4839a8b44feb384e71e SANDBOX_TAG=master +DEPOT_TOOLS_TAG=master +WEBRTC_TAG=f33698296719f956497d2dbff81b5080864a8804 # https://chromium.googlesource.com/external/webrtc.git/+/refs/branch-heads/52 +GO_WEBRTC_TAG=master +SNOWFLAKE_TAG=master +UNIURI_TAG=master GITIAN_TAG=tor-browser-builder-4

1 0

[tor-browser-bundle/hardened-builds] Bug 20297: Upgrade Go to 1.7.4.
by gk＠torproject.org 19 Dec '16

19 Dec '16

commit 53cfa479a398234424cb8311ded98c589c4ebab7 Author: David Fifield <david(a)bamsoftware.com> Date: Mon Dec 12 17:18:47 2016 -0800 Bug 20297: Upgrade Go to 1.7.4. --- gitian/versions | 4 ++-- gitian/versions.alpha | 4 ++-- gitian/versions.beta | 4 ++-- gitian/versions.nightly | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/gitian/versions b/gitian/versions index d1dfa22..3b84b63 100755 --- a/gitian/versions +++ b/gitian/versions @@ -58,7 +58,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 # We need a Go 1.4 to bootstrap later versions; see https://golang.org/doc/install/source#go14 GO14_VER=1.4.3 -GO_VER=1.7.3 +GO_VER=1.7.4 NSIS_VER=2.51 ## File names for the source packages @@ -112,7 +112,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 -GO_HASH=79430a0027a09b0b3ad57e214c4c1acfdd7af290961dd08d322818895af1ef44 +GO_HASH=4c189111e9ba651a2bb3ee868aa881fab36b2f2da3409e80885ca758a6b614cc NSIS_HASH=43d4c9209847e35eb6e2c7cd5a7586e1445374c056c2c7899e40a080e17a1be7 NSIS_DEBIAN_HASH=1dee6957b4a4b8dfe69bcf28bc7f301a13b96b3fa5a394e36c8926ae781e774a GCC_HASH=b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad diff --git a/gitian/versions.alpha b/gitian/versions.alpha index f64f8d7..f553468 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -67,7 +67,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 # We need a Go 1.4 to bootstrap later versions; see https://golang.org/doc/install/source#go14 GO14_VER=1.4.3 -GO_VER=1.7.3 +GO_VER=1.7.4 NSIS_VER=2.51 ELFUTILS_VER=0.160 @@ -121,7 +121,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 -GO_HASH=79430a0027a09b0b3ad57e214c4c1acfdd7af290961dd08d322818895af1ef44 +GO_HASH=4c189111e9ba651a2bb3ee868aa881fab36b2f2da3409e80885ca758a6b614cc NSIS_HASH=43d4c9209847e35eb6e2c7cd5a7586e1445374c056c2c7899e40a080e17a1be7 NSIS_DEBIAN_HASH=1dee6957b4a4b8dfe69bcf28bc7f301a13b96b3fa5a394e36c8926ae781e774a GCC_HASH=608df76dec2d34de6558249d8af4cbee21eceddbcb580d666f7a5a583ca3303a diff --git a/gitian/versions.beta b/gitian/versions.beta index 6444915..2bcde03 100755 --- a/gitian/versions.beta +++ b/gitian/versions.beta @@ -51,7 +51,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 # We need a Go 1.4 to bootstrap later versions; see https://golang.org/doc/install/source#go14 GO14_VER=1.4.3 -GO_VER=1.7.3 +GO_VER=1.7.4 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz @@ -102,7 +102,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 -GO_HASH=79430a0027a09b0b3ad57e214c4c1acfdd7af290961dd08d322818895af1ef44 +GO_HASH=4c189111e9ba651a2bb3ee868aa881fab36b2f2da3409e80885ca758a6b614cc STIXMATHFONT_HASH=e3b0f712e2644438eee2d0dcd2b10b2d54f1b972039de95b2f8e800bae1adbd8 NOTOEMOJIFONT_HASH=415dc6290378574135b64c808dc640c1df7531973290c4970c51fdeb849cb0c5 NOTOJPFONT_HASH=3e8146c4ce0945f255cb9dbc12b392380af80bd117e0a60eae555c99c7e618da diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 10644de..d606efc 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -70,7 +70,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 # We need a Go 1.4 to bootstrap later versions; see https://golang.org/doc/install/source#go14 GO14_VER=1.4.3 -GO_VER=1.7.3 +GO_VER=1.7.4 NSIS_VER=2.51 ELFUTILS_VER=0.160 @@ -124,7 +124,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 -GO_HASH=79430a0027a09b0b3ad57e214c4c1acfdd7af290961dd08d322818895af1ef44 +GO_HASH=4c189111e9ba651a2bb3ee868aa881fab36b2f2da3409e80885ca758a6b614cc NSIS_HASH=43d4c9209847e35eb6e2c7cd5a7586e1445374c056c2c7899e40a080e17a1be7 NSIS_DEBIAN_HASH=1dee6957b4a4b8dfe69bcf28bc7f301a13b96b3fa5a394e36c8926ae781e774a GCC_HASH=608df76dec2d34de6558249d8af4cbee21eceddbcb580d666f7a5a583ca3303a

1 0

[tor-browser-bundle/master] Bug 20297: Upgrade Go to 1.7.4.
by gk＠torproject.org 19 Dec '16

19 Dec '16

commit 29a85d9d9f62e18b4496a05394c7cb3aceaf850a Author: David Fifield <david(a)bamsoftware.com> Date: Mon Dec 12 17:18:47 2016 -0800 Bug 20297: Upgrade Go to 1.7.4. --- gitian/versions | 4 ++-- gitian/versions.alpha | 4 ++-- gitian/versions.beta | 4 ++-- gitian/versions.nightly | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/gitian/versions b/gitian/versions index 4d1ae98..81963bb 100755 --- a/gitian/versions +++ b/gitian/versions @@ -62,7 +62,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 # We need a Go 1.4 to bootstrap later versions; see https://golang.org/doc/install/source#go14 GO14_VER=1.4.3 -GO_VER=1.7.3 +GO_VER=1.7.4 NSIS_VER=2.51 ## File names for the source packages @@ -114,7 +114,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 -GO_HASH=79430a0027a09b0b3ad57e214c4c1acfdd7af290961dd08d322818895af1ef44 +GO_HASH=4c189111e9ba651a2bb3ee868aa881fab36b2f2da3409e80885ca758a6b614cc NSIS_HASH=43d4c9209847e35eb6e2c7cd5a7586e1445374c056c2c7899e40a080e17a1be7 NSIS_DEBIAN_HASH=1dee6957b4a4b8dfe69bcf28bc7f301a13b96b3fa5a394e36c8926ae781e774a GCC_HASH=b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad diff --git a/gitian/versions.alpha b/gitian/versions.alpha index d72aa18..a8a08c1 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -65,7 +65,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 # We need a Go 1.4 to bootstrap later versions; see https://golang.org/doc/install/source#go14 GO14_VER=1.4.3 -GO_VER=1.7.3 +GO_VER=1.7.4 NSIS_VER=2.51 ## File names for the source packages @@ -117,7 +117,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 -GO_HASH=79430a0027a09b0b3ad57e214c4c1acfdd7af290961dd08d322818895af1ef44 +GO_HASH=4c189111e9ba651a2bb3ee868aa881fab36b2f2da3409e80885ca758a6b614cc NSIS_HASH=43d4c9209847e35eb6e2c7cd5a7586e1445374c056c2c7899e40a080e17a1be7 NSIS_DEBIAN_HASH=1dee6957b4a4b8dfe69bcf28bc7f301a13b96b3fa5a394e36c8926ae781e774a GCC_HASH=b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad diff --git a/gitian/versions.beta b/gitian/versions.beta index 8027bd9..577b802 100755 --- a/gitian/versions.beta +++ b/gitian/versions.beta @@ -49,7 +49,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 # We need a Go 1.4 to bootstrap later versions; see https://golang.org/doc/install/source#go14 GO14_VER=1.4.3 -GO_VER=1.7.3 +GO_VER=1.7.4 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz @@ -96,7 +96,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 -GO_HASH=79430a0027a09b0b3ad57e214c4c1acfdd7af290961dd08d322818895af1ef44 +GO_HASH=4c189111e9ba651a2bb3ee868aa881fab36b2f2da3409e80885ca758a6b614cc STIXMATHFONT_HASH=e3b0f712e2644438eee2d0dcd2b10b2d54f1b972039de95b2f8e800bae1adbd8 NOTOEMOJIFONT_HASH=415dc6290378574135b64c808dc640c1df7531973290c4970c51fdeb849cb0c5 NOTOJPFONT_HASH=3e8146c4ce0945f255cb9dbc12b392380af80bd117e0a60eae555c99c7e618da diff --git a/gitian/versions.nightly b/gitian/versions.nightly index e6a486b..c661b0e 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -72,7 +72,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 # We need a Go 1.4 to bootstrap later versions; see https://golang.org/doc/install/source#go14 GO14_VER=1.4.3 -GO_VER=1.7.3 +GO_VER=1.7.4 NSIS_VER=2.51 ## File names for the source packages @@ -124,7 +124,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO14_HASH=9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 -GO_HASH=79430a0027a09b0b3ad57e214c4c1acfdd7af290961dd08d322818895af1ef44 +GO_HASH=4c189111e9ba651a2bb3ee868aa881fab36b2f2da3409e80885ca758a6b614cc NSIS_HASH=43d4c9209847e35eb6e2c7cd5a7586e1445374c056c2c7899e40a080e17a1be7 NSIS_DEBIAN_HASH=1dee6957b4a4b8dfe69bcf28bc7f301a13b96b3fa5a394e36c8926ae781e774a GCC_HASH=b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad

1 0

[tor-browser-bundle/hardened-builds] Adding third subkey to torbrowser.gpg
by gk＠torproject.org 19 Dec '16

19 Dec '16

commit 6ff1efc56de40ebe2f83e822ca88f733ca5dd22a Author: Georg Koppen <gk(a)torproject.org> Date: Fri Dec 16 12:14:27 2016 +0000 Adding third subkey to torbrowser.gpg --- gitian/gpg/torbrowser.gpg | Bin 18952 -> 49267 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/gitian/gpg/torbrowser.gpg b/gitian/gpg/torbrowser.gpg index d1033d4..dfdee06 100644 Binary files a/gitian/gpg/torbrowser.gpg and b/gitian/gpg/torbrowser.gpg differ

1 0

[tor-browser-bundle/master] Adding third subkey to torbrowser.gpg
by gk＠torproject.org 19 Dec '16

19 Dec '16

commit 3af9d507c307ea0faba9ad9827fcc81de13948f4 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Dec 16 12:14:27 2016 +0000 Adding third subkey to torbrowser.gpg --- gitian/gpg/torbrowser.gpg | Bin 18952 -> 49267 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/gitian/gpg/torbrowser.gpg b/gitian/gpg/torbrowser.gpg index d1033d4..dfdee06 100644 Binary files a/gitian/gpg/torbrowser.gpg and b/gitian/gpg/torbrowser.gpg differ

1 0

[tor-browser-bundle/hardened-builds] Bug 20147: (re-)dzip.sh: various improvements
by gk＠torproject.org 16 Dec '16

16 Dec '16

commit 4704bcdec26e2662d3765fd9a3bc69fc11e69453 Author: Rusty Bird <rustybird(a)openmailbox.org> Date: Thu Dec 8 17:18:12 2016 +0000 Bug 20147: (re-)dzip.sh: various improvements - Don't ignore errors (except unzip exit status 1 or 2) - Quote $@ and $1 - Work with absolute filenames and filenames starting with a dash - Pass many files per chmod invocation (much faster) - Pass $UNZIPOPTS, like $ZIPOPTS - Reuse dzip.sh in re-dzip.sh The (re)generated zip files are identical. --- gitian/build-helpers/dzip.sh | 17 ++++++++--------- gitian/build-helpers/re-dzip.sh | 23 ++++++++++------------- 2 files changed, 18 insertions(+), 22 deletions(-) diff --git a/gitian/build-helpers/dzip.sh b/gitian/build-helpers/dzip.sh index 5772c8b..64fcdca 100755 --- a/gitian/build-helpers/dzip.sh +++ b/gitian/build-helpers/dzip.sh @@ -1,14 +1,13 @@ -#!/bin/sh +#!/bin/sh -e # Crappy deterministic zip wrapper export LC_ALL=C -ZIPFILE=$1 +ZIPFILE=${1:?} shift -[ -n "$REFERENCE_DATETIME" ] && \ - find $@ -exec touch --date="$REFERENCE_DATETIME" {} \; - -find $@ -executable -exec chmod 700 {} \; -find $@ ! -executable -exec chmod 600 {} \; - -find $@ | sort | zip $ZIPOPTS -X -@ "$ZIPFILE" +if [ -n "$REFERENCE_DATETIME" ]; then + find "$@" -exec touch --date="$REFERENCE_DATETIME" -- {} + +fi +find "$@" -executable -exec chmod 700 {} + +find "$@" ! -executable -exec chmod 600 {} + +find "$@" | sort | zip $ZIPOPTS -X -@ "$ZIPFILE" diff --git a/gitian/build-helpers/re-dzip.sh b/gitian/build-helpers/re-dzip.sh index 27828e9..8e8abbf 100755 --- a/gitian/build-helpers/re-dzip.sh +++ b/gitian/build-helpers/re-dzip.sh @@ -1,17 +1,14 @@ -#!/bin/sh +#!/bin/sh -e # Crappy deterministic zip repackager export LC_ALL=C -ZIPFILE=`basename $1` +ZIPFILE_BASENAME=$(basename -- "${1:?}") +TEMPDIR=tmp-re-dzip-$$ +RE_DZIP=$(readlink -f -- "$(which -- "$0")") +PATH=$PATH:$(dirname "$RE_DZIP") -mkdir tmp_dzip -cd tmp_dzip -unzip ../$1 -[ -n "$REFERENCE_DATETIME" ] && \ - find . -exec touch --date="$REFERENCE_DATETIME" {} \; -find . -executable -exec chmod 700 {} \; -find . ! -executable -exec chmod 600 {} \; -find . | sort | zip $ZIPOPTS -X -@ $ZIPFILE -mv $ZIPFILE ../$1 -cd .. -rm -rf tmp_dzip +mkdir "$TEMPDIR" +unzip $UNZIPOPTS -d "$TEMPDIR" -- "$1" || [ $? -lt 3 ] +(cd "$TEMPDIR"; dzip.sh ./"$ZIPFILE_BASENAME" .) +mv -- "$TEMPDIR"/"$ZIPFILE_BASENAME" "$1" +rm -rf "$TEMPDIR"

1 0

[tor-browser-bundle/master] Bug 20147: (re-)dzip.sh: various improvements
by gk＠torproject.org 16 Dec '16

16 Dec '16

commit cb3acb5f6a878e9b34f60b6d9bb2bacb5194a3b8 Author: Rusty Bird <rustybird(a)openmailbox.org> Date: Thu Dec 8 17:18:12 2016 +0000 Bug 20147: (re-)dzip.sh: various improvements - Don't ignore errors (except unzip exit status 1 or 2) - Quote $@ and $1 - Work with absolute filenames and filenames starting with a dash - Pass many files per chmod invocation (much faster) - Pass $UNZIPOPTS, like $ZIPOPTS - Reuse dzip.sh in re-dzip.sh The (re)generated zip files are identical. --- gitian/build-helpers/dzip.sh | 17 ++++++++--------- gitian/build-helpers/re-dzip.sh | 23 ++++++++++------------- 2 files changed, 18 insertions(+), 22 deletions(-) diff --git a/gitian/build-helpers/dzip.sh b/gitian/build-helpers/dzip.sh index 5772c8b..64fcdca 100755 --- a/gitian/build-helpers/dzip.sh +++ b/gitian/build-helpers/dzip.sh @@ -1,14 +1,13 @@ -#!/bin/sh +#!/bin/sh -e # Crappy deterministic zip wrapper export LC_ALL=C -ZIPFILE=$1 +ZIPFILE=${1:?} shift -[ -n "$REFERENCE_DATETIME" ] && \ - find $@ -exec touch --date="$REFERENCE_DATETIME" {} \; - -find $@ -executable -exec chmod 700 {} \; -find $@ ! -executable -exec chmod 600 {} \; - -find $@ | sort | zip $ZIPOPTS -X -@ "$ZIPFILE" +if [ -n "$REFERENCE_DATETIME" ]; then + find "$@" -exec touch --date="$REFERENCE_DATETIME" -- {} + +fi +find "$@" -executable -exec chmod 700 {} + +find "$@" ! -executable -exec chmod 600 {} + +find "$@" | sort | zip $ZIPOPTS -X -@ "$ZIPFILE" diff --git a/gitian/build-helpers/re-dzip.sh b/gitian/build-helpers/re-dzip.sh index 27828e9..8e8abbf 100755 --- a/gitian/build-helpers/re-dzip.sh +++ b/gitian/build-helpers/re-dzip.sh @@ -1,17 +1,14 @@ -#!/bin/sh +#!/bin/sh -e # Crappy deterministic zip repackager export LC_ALL=C -ZIPFILE=`basename $1` +ZIPFILE_BASENAME=$(basename -- "${1:?}") +TEMPDIR=tmp-re-dzip-$$ +RE_DZIP=$(readlink -f -- "$(which -- "$0")") +PATH=$PATH:$(dirname "$RE_DZIP") -mkdir tmp_dzip -cd tmp_dzip -unzip ../$1 -[ -n "$REFERENCE_DATETIME" ] && \ - find . -exec touch --date="$REFERENCE_DATETIME" {} \; -find . -executable -exec chmod 700 {} \; -find . ! -executable -exec chmod 600 {} \; -find . | sort | zip $ZIPOPTS -X -@ $ZIPFILE -mv $ZIPFILE ../$1 -cd .. -rm -rf tmp_dzip +mkdir "$TEMPDIR" +unzip $UNZIPOPTS -d "$TEMPDIR" -- "$1" || [ $? -lt 3 ] +(cd "$TEMPDIR"; dzip.sh ./"$ZIPFILE_BASENAME" .) +mv -- "$TEMPDIR"/"$ZIPFILE_BASENAME" "$1" +rm -rf "$TEMPDIR"

1 0

[tor-browser-bundle/master] Remove webapprt/omni.ja rezipping
by gk＠torproject.org 16 Dec '16

16 Dec '16

commit fcda7b592553df7fb44a59f4d9341b424f4ad372 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Dec 16 10:34:21 2016 +0000 Remove webapprt/omni.ja rezipping After trying to apply the fix for #20147 it turns out that we had an error in the Firefox descriptor for Windows: the webapprt/omni.ja file does not exist. There is therefore no need to re-zip it in order to get a deterministic layout. The current script we use ignores this error while the new one proposed in #20147 is not so lenient anymore. --- gitian/descriptors/windows/gitian-firefox.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/gitian/descriptors/windows/gitian-firefox.yml b/gitian/descriptors/windows/gitian-firefox.yml index 8b68925..ef956fc 100644 --- a/gitian/descriptors/windows/gitian-firefox.yml +++ b/gitian/descriptors/windows/gitian-firefox.yml @@ -105,7 +105,6 @@ script: | # Making the .ja files deterministic and grabbing the results cd $INSTDIR ~/build/re-dzip.sh Browser/omni.ja - ~/build/re-dzip.sh Browser/webapprt/omni.ja ~/build/re-dzip.sh Browser/browser/omni.ja ~/build/dzip.sh tor-browser-win32-gbuilt.zip Browser

1 0