- tbb-commits - lists.torproject.org

[gitian-builder/tor-browser-builder-3] ensure guest upgrade occurs before attempting to get manifest
by gk＠torproject.org 22 Jan '16

22 Jan '16

commit 5c81bf36119dbecc17e55568ef3bc9f30dce0cff Author: Devrandom <c1.devrandom(a)niftybox.net> Date: Mon Mar 23 20:47:39 2015 -0700 ensure guest upgrade occurs before attempting to get manifest fixes #85 --- .gitignore | 1 + RELEASE_NOTES | 13 +++++++++++++ bin/gbuild | 9 ++++++++- target-bin/grab-packages.sh | 6 +++--- target-bin/upgrade-system.sh | 15 +++++++++++++++ 5 files changed, 40 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 54df527..696aae0 100644 --- a/.gitignore +++ b/.gitignore @@ -9,3 +9,4 @@ inputs base* *.qcow2 sigs +target-bin/bootstrap-fixup diff --git a/RELEASE_NOTES b/RELEASE_NOTES index 514cfdc..7662703 100644 --- a/RELEASE_NOTES +++ b/RELEASE_NOTES @@ -1,3 +1,16 @@ +2015-03-23 +---------- + +Now ensuring that `apt-get dist-upgrade` occurs at least once before package manifest +is computed. This is because distributions usually don't store old versions of packages +in the repos, so we can't download the exact package version we have installed if it's +out of date. + +gbuild now has a --upgrade flag that forces an upgrade after the first one. + +Other Notes +=========== + Important: We are planning on switching from using lxc-start to using lxc-execute. lxc-execute requires lxc-init (or init.lxc) to be available on the guest at one of the expected places. You might have to manually install lxc on your base VM image or recreate the image. diff --git a/bin/gbuild b/bin/gbuild index da49d50..d256986 100755 --- a/bin/gbuild +++ b/bin/gbuild @@ -92,7 +92,11 @@ def build_one_configuration(suite, arch, build_desc, reference_datetime) info "Installing additional packages (log in var/install.log)" system! "on-target -u root -e DEBIAN_FRONTEND=noninteractive apt-get --no-install-recommends -y install #{build_desc["packages"].join(" ")} > var/install.log 2>&1" - info "Grabbing package manifest" + if @options[:upgrade] || system("on-target -u root '[ ! -e /var/cache/gitian/initial-upgrade ]'") + info "Upgrading system, may take a while" + system! "on-target -u root bash < target-bin/upgrade-system.sh > var/install.log 2>&1" + end + info "Creating package manifest" system! "on-target -u root bash < target-bin/grab-packages.sh > var/base-#{suitearch}.manifest" info "Creating build script (var/build-script)" @@ -130,6 +134,9 @@ OptionParser.new do |opts| opts.on("-i", "--skip-image", "reuse current target image") do |v| @options[:skip_image] = v end + opts.on("--upgrade", "upgrade guest with latest packages") do |v| + @options[:upgrade] = v + end opts.on("-q", "--quiet", "be quiet") do |v| @options[:quiet] = v end diff --git a/target-bin/grab-packages.sh b/target-bin/grab-packages.sh index adf8e34..2fef08e 100644 --- a/target-bin/grab-packages.sh +++ b/target-bin/grab-packages.sh @@ -6,7 +6,7 @@ set -e cd /var/cache/apt/archives -#apt-get clean - -dpkg-query -W -f '${Package}\n' | xargs -n 50 apt-get install --reinstall -y -d > /dev/null +# make sure all packages with installed versions are downloaded +dpkg-query -W -f '${Package}=${Version}\n' | xargs -n 50 apt-get install -q --reinstall -y -d > /tmp/download.log +grep "cannot be downloaded" /tmp/download.log && { echo Could not download some packages, please run gbuild --upgrade 1>&2 ; exit 1 ; } sha256sum *.deb | sort --key 2 diff --git a/target-bin/upgrade-system.sh b/target-bin/upgrade-system.sh new file mode 100644 index 0000000..9384229 --- /dev/null +++ b/target-bin/upgrade-system.sh @@ -0,0 +1,15 @@ +#!/bin/sh + +# Upgrade system + +set -e + +mkdir -p /var/cache/gitian + +# remove obsolete grub, it causes package dependency issues +apt-get -q -y purge grub > /dev/null 2>&1 || true + +# upgrade packages +DEBIAN_FRONTEND=noninteractive apt-get -y dist-upgrade > /dev/null > /var/cache/gitian/upgrade.log 2>&1 + +touch /var/cache/gitian/initial-upgrade

1 0

[tor-browser/tor-browser-38.6.0esr-6.0-1] Bug 1202266 - Suppress '-Wformat-security' in libstagefright CXXFLAGS. r=kentuckyfriedtakahe
by gk＠torproject.org 22 Jan '16

22 Jan '16

commit fcbfae6fc60a23fe79a80d543d12891f0a66b93e Author: Johannes Pfrang <johannespfrang(a)gmail.com> Date: Thu Sep 10 09:49:00 2015 +0200 Bug 1202266 - Suppress '-Wformat-security' in libstagefright CXXFLAGS. r=kentuckyfriedtakahe --HG-- extra : rebase_source : a93c2b3648b6dd14bf0a679fa241e8780c693780 --- media/libstagefright/moz.build | 1 + 1 file changed, 1 insertion(+) diff --git a/media/libstagefright/moz.build b/media/libstagefright/moz.build index 651ae85..f43a09f 100644 --- a/media/libstagefright/moz.build +++ b/media/libstagefright/moz.build @@ -142,6 +142,7 @@ elif CONFIG['GNU_CXX']: ] CXXFLAGS += [ '-Wno-format', + '-Wno-format-security', '-Wno-multichar', '-Wno-sign-compare', '-Wno-unused',

1 0

[tor-browser-bundle/master] Bug 15578: drop our Python build
by gk＠torproject.org 22 Jan '16

22 Jan '16

commit ac9da1d5965169f91973d57737fcd20e06351b08 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Sun Jan 10 17:09:43 2016 +0100 Bug 15578: drop our Python build After switching to Debian Wheezy, we don't need to build Python since the version provided by the distribution is recent enough. --- gitian/descriptors/linux/gitian-bundle.yml | 9 +-------- gitian/descriptors/linux/gitian-firefox.yml | 8 +------- gitian/descriptors/linux/gitian-utils.yml | 25 ------------------------- gitian/fetch-inputs.sh | 7 ++----- gitian/mkbundle-linux.sh | 12 ------------ gitian/verify-tags.sh | 5 ++--- gitian/versions | 5 ----- gitian/versions.alpha | 5 ----- gitian/versions.beta | 5 ----- gitian/versions.nightly | 5 ----- 10 files changed, 6 insertions(+), 80 deletions(-) diff --git a/gitian/descriptors/linux/gitian-bundle.yml b/gitian/descriptors/linux/gitian-bundle.yml index bfecb0f..e44635e 100644 --- a/gitian/descriptors/linux/gitian-bundle.yml +++ b/gitian/descriptors/linux/gitian-bundle.yml @@ -14,6 +14,7 @@ packages: - "libxslt1.1" - "libxml2-utils" - "sqlite3" +- "python-lxml" reference_datetime: "2000-01-01 00:00:00" remotes: - "url": "https://git.torproject.org/tor-launcher.git" @@ -35,10 +36,6 @@ files: - "tor-linux64-gbuilt.zip" - "pluggable-transports-linux32-gbuilt.zip" - "pluggable-transports-linux64-gbuilt.zip" -- "python-linux32-utils.zip" -- "python-linux64-utils.zip" -- "lxml-linux32-utils.zip" -- "lxml-linux64-utils.zip" - "torrc-defaults-appendix-linux" - "bridge_prefs.js" - "meek-http-helper-user.js" @@ -83,10 +80,6 @@ script: | mkdir -p ${TB_STAGE_DIR}/Browser/TorBrowser/Data/Browser/profile.meek-http-helper/extensions mkdir -p ${TB_STAGE_DIR}/Browser/TorBrowser/Data/Browser/Caches mkdir -p ${TB_STAGE_DIR}/Browser/TorBrowser/Docs/sources/ - # Preparing Python for HTTPS-Everywhere. - unzip -d $INSTDIR python-linux$GBUILD_BITS-utils.zip - export PATH=$INSTDIR/python/bin:$PATH - unzip -d $INSTDIR/python/lib/python2.7 lxml-linux$GBUILD_BITS-utils.zip # # Extract the MAR tools. unzip -d ~/build ~/build/mar-tools-linux${GBUILD_BITS}.zip diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index 468d6e5..f7ea1c6 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -17,6 +17,7 @@ packages: - "libgstreamer-plugins-base0.10-dev" - "libxt-dev" - "hardening-wrapper" +- "python-dev" # To pass configure since ESR 31. - "libpulse-dev" # We built GCC but not the libmpc2, thus we need to install it. @@ -32,8 +33,6 @@ files: - "binutils-linux64-utils.zip" - "gcc-linux32-utils.zip" - "gcc-linux64-utils.zip" -- "python-linux32-utils.zip" -- "python-linux64-utils.zip" - "re-dzip.sh" - "dzip.sh" - "versions" @@ -53,11 +52,6 @@ script: | export DEB_BUILD_HARDENING_FORMAT=1 export DEB_BUILD_HARDENING_PIE=1 # - # Preparing Python for Tor Browser - unzip -d $INSTDIR python-linux$GBUILD_BITS-utils.zip - # TODO: We might want to have a smarter solution than hard-coding the version. - ln -sf $INSTDIR/python/bin/python2.7 $INSTDIR/python/bin/python - export PATH=$INSTDIR/python/bin:$PATH # Preparing Binutils and GCC for Tor Browser unzip -d $INSTDIR binutils-linux$GBUILD_BITS-utils.zip # Make sure gold is used with the hardening wrapper for full RELRO, see diff --git a/gitian/descriptors/linux/gitian-utils.yml b/gitian/descriptors/linux/gitian-utils.yml index 34e93dc..e8801cc 100644 --- a/gitian/descriptors/linux/gitian-utils.yml +++ b/gitian/descriptors/linux/gitian-utils.yml @@ -33,8 +33,6 @@ files: - "binutils.tar.bz2" - "gcc.tar.bz2" - "openssl.tar.gz" -- "python.tar.bz2" -- "lxml.tar.gz" - "gmp.tar.bz2" - "versions" - "dzip.sh" @@ -117,29 +115,7 @@ script: | make install cd .. - # Building Python - # Fx 24 ESR and HTTPS Everywhere >= 3.5 do not work with Python < 2.7 anymore. - # But 10.04 does only ship with Python 2.6. Thus, we compile 2.7 ourselves... - tar xjf python.tar.bz2 - cd Python-* - ./configure - make $MAKEOPTS altinstall prefix=$INSTDIR/python exec-prefix=$INSTDIR/python - cd .. - - # Building lxml - export LD_PRELOAD="" - tar xzf lxml.tar.gz - cd lxml-* - # Make sure we use our freshly built python binary here. Otherwise bad things - # may happen when we do so in the bundle step assembling the HTTPS-Everywhere - # rules. - $INSTDIR/python/bin/python2.7 setup.py build - cd build/lib* - export LD_PRELOAD=/usr/lib/faketime/libfaketime.so.1 - ~/build/dzip.sh lxml-$LXML_VER-linux$GBUILD_BITS-utils.zip lxml export LD_PRELOAD="" - cp *utils.zip $OUTDIR - cd ../../../ # Building GMP tar xjf gmp.tar.bz2 @@ -161,6 +137,5 @@ script: | ~/build/dzip.sh gcc-$GCC_VER-linux$GBUILD_BITS-utils.zip gcc ~/build/dzip.sh openssl-$OPENSSL_VER-linux$GBUILD_BITS-utils.zip openssl ~/build/dzip.sh libevent-${LIBEVENT_TAG#release-}-linux$GBUILD_BITS-utils.zip libevent - ~/build/dzip.sh python-$PYTHON_VER-linux$GBUILD_BITS-utils.zip python ~/build/dzip.sh gmp-$GMP_VER-linux$GBUILD_BITS-utils.zip gmp cp *utils.zip $OUTDIR/ diff --git a/gitian/fetch-inputs.sh b/gitian/fetch-inputs.sh index 206023b..9d6f2f3 100755 --- a/gitian/fetch-inputs.sh +++ b/gitian/fetch-inputs.sh @@ -112,12 +112,11 @@ update_git() { ############################################################################## # Get+verify sigs that exist -for i in OPENSSL BINUTILS GCC PYTHON PYCRYPTO PYTHON_MSI GMP LXML +for i in OPENSSL BINUTILS GCC PYCRYPTO PYTHON_MSI GMP do PACKAGE="${i}_PACKAGE" URL="${i}_URL" - if [ "${i}" == "PYTHON" -o "${i}" == "PYCRYPTO" -o "${i}" == "PYTHON_MSI" -o \ - "${i}" == "LXML" -o "${i}" == "OPENSSL" ]; then + if [ "${i}" == "PYCRYPTO" -o "${i}" == "PYTHON_MSI" -o "${i}" == "OPENSSL" ]; then SUFFIX="asc" else SUFFIX="sig" @@ -226,7 +225,6 @@ ln -sf "$NOSCRIPT_PACKAGE" noscript(a)noscript.net.xpi ln -sf "$OPENSSL_PACKAGE" openssl.tar.gz ln -sf "$BINUTILS_PACKAGE" binutils.tar.bz2 ln -sf "$GCC_PACKAGE" gcc.tar.bz2 -ln -sf "$PYTHON_PACKAGE" python.tar.bz2 ln -sf "$PYTHON_MSI_PACKAGE" python.msi ln -sf "$PYCRYPTO_PACKAGE" pycrypto.tar.gz ln -sf "$ARGPARSE_PACKAGE" argparse.tar.gz @@ -236,7 +234,6 @@ ln -sf "$TWISTED_PACKAGE" twisted.tar.bz2 ln -sf "$PY2EXE_PACKAGE" py2exe.exe ln -sf "$SETUPTOOLS_PACKAGE" setuptools.tar.gz ln -sf "$GMP_PACKAGE" gmp.tar.bz2 -ln -sf "$LXML_PACKAGE" lxml.tar.gz ln -sf "$PARSLEY_PACKAGE" parsley.tar.gz ln -sf "$GO_PACKAGE" go.tar.gz diff --git a/gitian/mkbundle-linux.sh b/gitian/mkbundle-linux.sh index 0c70732..f8aaec1 100755 --- a/gitian/mkbundle-linux.sh +++ b/gitian/mkbundle-linux.sh @@ -108,10 +108,6 @@ if [ ! -f inputs/binutils-$BINUTILS_VER-linux32-utils.zip -o \ ! -f inputs/openssl-$OPENSSL_VER-linux64-utils.zip -o \ ! -f inputs/libevent-${LIBEVENT_TAG_ORIG#release-}-linux32-utils.zip -o \ ! -f inputs/libevent-${LIBEVENT_TAG_ORIG#release-}-linux64-utils.zip -o \ - ! -f inputs/python-$PYTHON_VER-linux32-utils.zip -o \ - ! -f inputs/python-$PYTHON_VER-linux64-utils.zip -o \ - ! -f inputs/lxml-$LXML_VER-linux32-utils.zip -o \ - ! -f inputs/lxml-$LXML_VER-linux64-utils.zip -o \ ! -f inputs/gmp-$GMP_VER-linux32-utils.zip -o \ ! -f inputs/gmp-$GMP_VER-linux64-utils.zip ]; then @@ -136,10 +132,6 @@ then ln -sf openssl-$OPENSSL_VER-linux64-utils.zip openssl-linux64-utils.zip ln -sf libevent-${LIBEVENT_TAG_ORIG#release-}-linux32-utils.zip libevent-linux32-utils.zip ln -sf libevent-${LIBEVENT_TAG_ORIG#release-}-linux64-utils.zip libevent-linux64-utils.zip - ln -sf python-$PYTHON_VER-linux32-utils.zip python-linux32-utils.zip - ln -sf python-$PYTHON_VER-linux64-utils.zip python-linux64-utils.zip - ln -sf lxml-$LXML_VER-linux32-utils.zip lxml-linux32-utils.zip - ln -sf lxml-$LXML_VER-linux64-utils.zip lxml-linux64-utils.zip ln -sf gmp-$GMP_VER-linux32-utils.zip gmp-linux32-utils.zip ln -sf gmp-$GMP_VER-linux64-utils.zip gmp-linux64-utils.zip cd .. @@ -159,10 +151,6 @@ else ln -sf openssl-$OPENSSL_VER-linux64-utils.zip openssl-linux64-utils.zip ln -sf libevent-${LIBEVENT_TAG_ORIG#release-}-linux32-utils.zip libevent-linux32-utils.zip ln -sf libevent-${LIBEVENT_TAG_ORIG#release-}-linux64-utils.zip libevent-linux64-utils.zip - ln -sf python-$PYTHON_VER-linux32-utils.zip python-linux32-utils.zip - ln -sf python-$PYTHON_VER-linux64-utils.zip python-linux64-utils.zip - ln -sf lxml-$LXML_VER-linux32-utils.zip lxml-linux32-utils.zip - ln -sf lxml-$LXML_VER-linux64-utils.zip lxml-linux64-utils.zip ln -sf gmp-$GMP_VER-linux32-utils.zip gmp-linux32-utils.zip ln -sf gmp-$GMP_VER-linux64-utils.zip gmp-linux64-utils.zip cd .. diff --git a/gitian/verify-tags.sh b/gitian/verify-tags.sh index 82a810a..fc62344 100755 --- a/gitian/verify-tags.sh +++ b/gitian/verify-tags.sh @@ -121,12 +121,11 @@ noto-fonts $NOTOFONTS_TAG EOF # Verify signatures on signed packages -for i in OPENSSL BINUTILS GCC PYTHON PYCRYPTO PYTHON_MSI GMP LXML +for i in OPENSSL BINUTILS GCC PYCRYPTO PYTHON_MSI GMP do PACKAGE="${i}_PACKAGE" URL="${i}_URL" - if [ "${i}" == "PYTHON" -o "${i}" == "PYCRYPTO" -o "${i}" == "PYTHON_MSI" -o \ - "${i}" == "LXML" -o "${i}" == "OPENSSL" ]; then + if [ "${i}" == "PYCRYPTO" -o "${i}" == "PYTHON_MSI" -o "${i}" == "OPENSSL" ]; then SUFFIX="asc" else SUFFIX="sig" diff --git a/gitian/versions b/gitian/versions index 7ff094e..bd484bb 100755 --- a/gitian/versions +++ b/gitian/versions @@ -52,7 +52,6 @@ ZOPEINTERFACE_VER=4.0.5 TWISTED_VER=13.2.0 PY2EXE_VER=0.6.9 SETUPTOOLS_VER=1.4 -LXML_VER=3.3.5 PARSLEY_VER=1.2 GO_VER=1.4.2 NOTOCJKFONT_VER=1.004 @@ -68,7 +67,6 @@ OSXSDK_OLD_PACKAGE=apple-uni-sdk-10.6_20110407-0.flosoft1_i386.deb MSVCR100_PACKAGE=msvcr100.dll BINUTILS_PACKAGE=binutils-${BINUTILS_VER}.tar.bz2 GCC_PACKAGE=gcc-${GCC_VER}.tar.bz2 -PYTHON_PACKAGE=Python-${PYTHON_VER}.tar.bz2 PYTHON_MSI_PACKAGE=python-${PYTHON_VER}.msi PYCRYPTO_PACKAGE=pycrypto-${PYCRYPTO_VER}.tar.gz ARGPARSE_PACKAGE=argparse-${ARGPARSE_VER}.tar.gz @@ -77,7 +75,6 @@ ZOPEINTERFACE_PACKAGE=zope.interface-${ZOPEINTERFACE_VER}.zip TWISTED_PACKAGE=Twisted-${TWISTED_VER}.tar.bz2 PY2EXE_PACKAGE=py2exe-${PY2EXE_VER}.win32-py2.7.exe SETUPTOOLS_PACKAGE=setuptools-${SETUPTOOLS_VER}.tar.gz -LXML_PACKAGE=lxml-${LXML_VER}.tar.gz PARSLEY_PACKAGE=Parsley-${PARSLEY_VER}.tar.gz GO_PACKAGE=go${GO_VER}.src.tar.gz NOTOCJKFONT_PACKAGE=NotoSansCJKsc-Regular.otf @@ -114,7 +111,6 @@ OSXSDK_URL=https://launchpad.net/~flosoft/+archive/cross-apple/+files/${OSX… BINUTILS_URL=https://ftp.gnu.org/gnu/binutils/${BINUTILS_PACKAGE} GCC_URL=https://ftp.gnu.org/gnu/gcc/gcc-${GCC_VER}/${GCC_PACKAGE} NOSCRIPT_URL=https://addons.cdn.mozilla.net/user-media/addons/722/${NOSCRIP… -PYTHON_URL=https://www.python.org/ftp/python/${PYTHON_VER}/${PYTHON_PACKAGE} PYTHON_MSI_URL=https://www.python.org/ftp/python/${PYTHON_VER}/${PYTHON_MSI… PYCRYPTO_URL=https://pypi.python.org/packages/source/p/pycrypto/${PYCRYPTO_… ARGPARSE_URL=https://argparse.googlecode.com/files/${ARGPARSE_PACKAGE} @@ -124,7 +120,6 @@ TWISTED_URL=https://pypi.python.org/packages/source/T/Twisted/${TWISTED_PAC… # TWISTED_URL=https://twistedmatrix.com/Releases/Twisted/$(echo ${TWISTED_VER} | awk -F. '{print $1"."$2}')/${TWISTED_PACKAGE} PY2EXE_URL=http://liquidtelecom.dl.sourceforge.net/project/py2exe/py2exe/${… SETUPTOOLS_URL=https://pypi.python.org/packages/source/s/setuptools/${SETUP… -LXML_URL=https://pypi.python.org/packages/source/l/lxml/${LXML_PACKAGE} PARSLEY_URL=https://pypi.python.org/packages/source/P/Parsley/${PARSLEY_PAC… GO_URL=https://golang.org/dl/${GO_PACKAGE} NOTOCJKFONT_URL=https://github.com/googlei18n/noto-cjk/raw/f36eda03dfa5582a… diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 95ca078..5b7ef02 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -52,7 +52,6 @@ ZOPEINTERFACE_VER=4.0.5 TWISTED_VER=13.2.0 PY2EXE_VER=0.6.9 SETUPTOOLS_VER=1.4 -LXML_VER=3.3.5 PARSLEY_VER=1.2 GO_VER=1.4.2 NOTOCJKFONT_VER=1.004 @@ -68,7 +67,6 @@ OSXSDK_OLD_PACKAGE=apple-uni-sdk-10.6_20110407-0.flosoft1_i386.deb MSVCR100_PACKAGE=msvcr100.dll BINUTILS_PACKAGE=binutils-${BINUTILS_VER}.tar.bz2 GCC_PACKAGE=gcc-${GCC_VER}.tar.bz2 -PYTHON_PACKAGE=Python-${PYTHON_VER}.tar.bz2 PYTHON_MSI_PACKAGE=python-${PYTHON_VER}.msi PYCRYPTO_PACKAGE=pycrypto-${PYCRYPTO_VER}.tar.gz ARGPARSE_PACKAGE=argparse-${ARGPARSE_VER}.tar.gz @@ -77,7 +75,6 @@ ZOPEINTERFACE_PACKAGE=zope.interface-${ZOPEINTERFACE_VER}.zip TWISTED_PACKAGE=Twisted-${TWISTED_VER}.tar.bz2 PY2EXE_PACKAGE=py2exe-${PY2EXE_VER}.win32-py2.7.exe SETUPTOOLS_PACKAGE=setuptools-${SETUPTOOLS_VER}.tar.gz -LXML_PACKAGE=lxml-${LXML_VER}.tar.gz PARSLEY_PACKAGE=Parsley-${PARSLEY_VER}.tar.gz GO_PACKAGE=go${GO_VER}.src.tar.gz NOTOCJKFONT_PACKAGE=NotoSansCJKsc-Regular.otf @@ -114,7 +111,6 @@ OSXSDK_URL=https://launchpad.net/~flosoft/+archive/cross-apple/+files/${OSX… BINUTILS_URL=https://ftp.gnu.org/gnu/binutils/${BINUTILS_PACKAGE} GCC_URL=https://ftp.gnu.org/gnu/gcc/gcc-${GCC_VER}/${GCC_PACKAGE} NOSCRIPT_URL=https://addons.cdn.mozilla.net/user-media/addons/722/${NOSCRIP… -PYTHON_URL=https://www.python.org/ftp/python/${PYTHON_VER}/${PYTHON_PACKAGE} PYTHON_MSI_URL=https://www.python.org/ftp/python/${PYTHON_VER}/${PYTHON_MSI… PYCRYPTO_URL=https://pypi.python.org/packages/source/p/pycrypto/${PYCRYPTO_… ARGPARSE_URL=https://argparse.googlecode.com/files/${ARGPARSE_PACKAGE} @@ -124,7 +120,6 @@ TWISTED_URL=https://pypi.python.org/packages/source/T/Twisted/${TWISTED_PAC… # TWISTED_URL=https://twistedmatrix.com/Releases/Twisted/$(echo ${TWISTED_VER} | awk -F. '{print $1"."$2}')/${TWISTED_PACKAGE} PY2EXE_URL=http://liquidtelecom.dl.sourceforge.net/project/py2exe/py2exe/${… SETUPTOOLS_URL=https://pypi.python.org/packages/source/s/setuptools/${SETUP… -LXML_URL=https://pypi.python.org/packages/source/l/lxml/${LXML_PACKAGE} PARSLEY_URL=https://pypi.python.org/packages/source/P/Parsley/${PARSLEY_PAC… GO_URL=https://golang.org/dl/${GO_PACKAGE} NOTOCJKFONT_URL=https://github.com/googlei18n/noto-cjk/raw/f36eda03dfa5582a… diff --git a/gitian/versions.beta b/gitian/versions.beta index 43c5fde..1bde7e5 100755 --- a/gitian/versions.beta +++ b/gitian/versions.beta @@ -48,7 +48,6 @@ TWISTED_VER=13.2.0 M2CRYPTO_VER=0.21.1 PY2EXE_VER=0.6.9 SETUPTOOLS_VER=1.4 -LXML_VER=3.3.5 PARSLEY_VER=1.2 GO_VER=1.4.2 NOTOCJKFONT_VER=1.004 @@ -64,7 +63,6 @@ MINGW_PACKAGE=mingw-w64-svn-snapshot.zip MSVCR100_PACKAGE=msvcr100.dll BINUTILS_PACKAGE=binutils-${BINUTILS_VER}.tar.bz2 GCC_PACKAGE=gcc-${GCC_VER}.tar.bz2 -PYTHON_PACKAGE=Python-${PYTHON_VER}.tar.bz2 PYTHON_MSI_PACKAGE=python-${PYTHON_VER}.msi PYCRYPTO_PACKAGE=pycrypto-${PYCRYPTO_VER}.tar.gz ARGPARSE_PACKAGE=argparse-${ARGPARSE_VER}.tar.gz @@ -74,7 +72,6 @@ TWISTED_PACKAGE=Twisted-${TWISTED_VER}.tar.bz2 M2CRYPTO_PACKAGE=M2Crypto-${M2CRYPTO_VER}.tar.gz PY2EXE_PACKAGE=py2exe-${PY2EXE_VER}.win32-py2.7.exe SETUPTOOLS_PACKAGE=setuptools-${SETUPTOOLS_VER}.tar.gz -LXML_PACKAGE=lxml-${LXML_VER}.tar.gz PARSLEY_PACKAGE=Parsley-${PARSLEY_VER}.tar.gz GO_PACKAGE=go${GO_VER}.src.tar.gz NOTOCJKFONT_PACKAGE=NotoSansCJKsc-Regular.otf @@ -111,7 +108,6 @@ OSXSDK_URL=https://launchpad.net/~flosoft/+archive/cross-apple/+files/${OSX… BINUTILS_URL=https://ftp.gnu.org/gnu/binutils/${BINUTILS_PACKAGE} GCC_URL=https://ftp.gnu.org/gnu/gcc/gcc-${GCC_VER}/${GCC_PACKAGE} NOSCRIPT_URL=https://addons.cdn.mozilla.net/storage/public-staging/722/${NO… -PYTHON_URL=https://www.python.org/ftp/python/${PYTHON_VER}/${PYTHON_PACKAGE} PYTHON_MSI_URL=https://www.python.org/ftp/python/${PYTHON_VER}/${PYTHON_MSI… PYCRYPTO_URL=https://pypi.python.org/packages/source/p/pycrypto/${PYCRYPTO_… ARGPARSE_URL=https://argparse.googlecode.com/files/${ARGPARSE_PACKAGE} @@ -122,7 +118,6 @@ TWISTED_URL=https://pypi.python.org/packages/source/T/Twisted/${TWISTED_PAC… M2CRYPTO_URL=https://pypi.python.org/packages/source/M/M2Crypto/${M2CRYPTO_… PY2EXE_URL=http://softlayer-dal.dl.sourceforge.net/project/py2exe/py2exe/${… SETUPTOOLS_URL=https://pypi.python.org/packages/source/s/setuptools/${SETUP… -LXML_URL=https://pypi.python.org/packages/source/l/lxml/${LXML_PACKAGE} PARSLEY_URL=https://pypi.python.org/packages/source/P/Parsley/${PARSLEY_PAC… GO_URL=https://golang.org/dl/${GO_PACKAGE} NOTOCJKFONT_URL=https://github.com/googlei18n/noto-cjk/raw/f36eda03dfa5582a… diff --git a/gitian/versions.nightly b/gitian/versions.nightly index b1c7387..c64d4bb 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -59,7 +59,6 @@ ZOPEINTERFACE_VER=4.0.5 TWISTED_VER=13.2.0 PY2EXE_VER=0.6.9 SETUPTOOLS_VER=1.4 -LXML_VER=3.3.5 PARSLEY_VER=1.2 GO_VER=1.4.2 NOTOCJKFONT_VER=1.004 @@ -75,7 +74,6 @@ OSXSDK_OLD_PACKAGE=apple-uni-sdk-10.6_20110407-0.flosoft1_i386.deb MSVCR100_PACKAGE=msvcr100.dll BINUTILS_PACKAGE=binutils-${BINUTILS_VER}.tar.bz2 GCC_PACKAGE=gcc-${GCC_VER}.tar.bz2 -PYTHON_PACKAGE=Python-${PYTHON_VER}.tar.bz2 PYTHON_MSI_PACKAGE=python-${PYTHON_VER}.msi PYCRYPTO_PACKAGE=pycrypto-${PYCRYPTO_VER}.tar.gz ARGPARSE_PACKAGE=argparse-${ARGPARSE_VER}.tar.gz @@ -84,7 +82,6 @@ ZOPEINTERFACE_PACKAGE=zope.interface-${ZOPEINTERFACE_VER}.zip TWISTED_PACKAGE=Twisted-${TWISTED_VER}.tar.bz2 PY2EXE_PACKAGE=py2exe-${PY2EXE_VER}.win32-py2.7.exe SETUPTOOLS_PACKAGE=setuptools-${SETUPTOOLS_VER}.tar.gz -LXML_PACKAGE=lxml-${LXML_VER}.tar.gz PARSLEY_PACKAGE=Parsley-${PARSLEY_VER}.tar.gz GO_PACKAGE=go${GO_VER}.src.tar.gz NOTOCJKFONT_PACKAGE=NotoSansCJKsc-Regular.otf @@ -121,7 +118,6 @@ OSXSDK_URL=https://launchpad.net/~flosoft/+archive/cross-apple/+files/${OSX… BINUTILS_URL=https://ftp.gnu.org/gnu/binutils/${BINUTILS_PACKAGE} GCC_URL=https://ftp.gnu.org/gnu/gcc/gcc-${GCC_VER}/${GCC_PACKAGE} NOSCRIPT_URL=https://addons.cdn.mozilla.net/user-media/addons/722/${NOSCRIP… -PYTHON_URL=https://www.python.org/ftp/python/${PYTHON_VER}/${PYTHON_PACKAGE} PYTHON_MSI_URL=https://www.python.org/ftp/python/${PYTHON_VER}/${PYTHON_MSI… PYCRYPTO_URL=https://pypi.python.org/packages/source/p/pycrypto/${PYCRYPTO_… ARGPARSE_URL=https://argparse.googlecode.com/files/${ARGPARSE_PACKAGE} @@ -131,7 +127,6 @@ TWISTED_URL=https://pypi.python.org/packages/source/T/Twisted/${TWISTED_PAC… # TWISTED_URL=https://twistedmatrix.com/Releases/Twisted/$(echo ${TWISTED_VER} | awk -F. '{print $1"."$2}')/${TWISTED_PACKAGE} PY2EXE_URL=http://liquidtelecom.dl.sourceforge.net/project/py2exe/py2exe/${… SETUPTOOLS_URL=https://pypi.python.org/packages/source/s/setuptools/${SETUP… -LXML_URL=https://pypi.python.org/packages/source/l/lxml/${LXML_PACKAGE} PARSLEY_URL=https://pypi.python.org/packages/source/P/Parsley/${PARSLEY_PAC… GO_URL=https://golang.org/dl/${GO_PACKAGE} NOTOCJKFONT_URL=https://github.com/googlei18n/noto-cjk/raw/f36eda03dfa5582a…

1 0

[tor-browser-bundle/master] Bug 15578: Switch Linux descriptors over to Wheezy
by gk＠torproject.org 22 Jan '16

22 Jan '16

commit f78282bad0e1e2255adcf65198137ee14d7b2235 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Dec 7 12:33:16 2015 +0000 Bug 15578: Switch Linux descriptors over to Wheezy Besides using Wheezy for building Linux bundles this patch cleans up our usage of libfaketime as well to make it obvious where exactly we still need it. --- gitian/Makefile | 2 +- gitian/README.build | 2 +- gitian/check-prerequisites.sh | 41 ++++++++++---------- gitian/descriptors/linux/gitian-bundle.yml | 7 +--- gitian/descriptors/linux/gitian-firefox.yml | 9 ++--- .../linux/gitian-pluggable-transports.yml | 7 ++-- gitian/descriptors/linux/gitian-tor.yml | 7 ++-- gitian/descriptors/linux/gitian-utils.yml | 40 ++++++++++++++----- gitian/make-vms.sh | 29 ++++++++------ 9 files changed, 85 insertions(+), 59 deletions(-) diff --git a/gitian/Makefile b/gitian/Makefile index 8f89bca..50d4328 100644 --- a/gitian/Makefile +++ b/gitian/Makefile @@ -120,7 +120,7 @@ clean-bundle: vmclean: rm -rf ../../gitian-builder/*.qcow2 rm -rf ../../gitian-builder/base-* - rm -rf ../../gitian-builder/target-{lucid,precise}* + rm -rf ../../gitian-builder/target-{lucid,wheezy,precise}* distclean: vmclean rm -rf ../../gitian-builder/inputs/* diff --git a/gitian/README.build b/gitian/README.build index f289791..4d01d6a 100644 --- a/gitian/README.build +++ b/gitian/README.build @@ -177,7 +177,7 @@ Known Issues and Quirks: where 'make vmclean' causes the rebuild of two VMs in a row.. This might trigger weird bugs in python-vm-builder.. To rebuild only one set of VMs, use either 'rm ../../gitian-builder/*precise*' (to remove the Windows/Mac - VMs) or 'rm ../../gitian-builder/*lucid*' (to remove the Linux VMs). + VMs) or 'rm ../../gitian-builder/*wheezy*' (to remove the Linux VMs). You probably want to make sure you have no stray qemu processes before rebuilding the VMs or starting a new build, too. 'killall qemu-kvm' is diff --git a/gitian/check-prerequisites.sh b/gitian/check-prerequisites.sh index cc16d0e..a5f8393 100755 --- a/gitian/check-prerequisites.sh +++ b/gitian/check-prerequisites.sh @@ -17,7 +17,7 @@ then VERSION=`cat /etc/issue | grep -Eo '[0-9]{2}' | head -1` if [ "$VERSION" -ge "14" ]; then - dpkg -s ruby apache2 git apt-cacher-ng python-vm-builder qemu-kvm virt-what lxc lxctl fakeroot faketime zip unzip subversion torsocks tor 2>/dev/null >/dev/null + dpkg -s ruby apache2 git apt-cacher-ng qemu-kvm virt-what lxc lxctl fakeroot faketime zip unzip subversion torsocks tor 2>/dev/null >/dev/null if [ $? -ne 0 ]; then @@ -25,7 +25,7 @@ then echo echo "Please run:" echo " sudo apt-get install torsocks tor" - echo " sudo torsocks apt-get install ruby apache2 git apt-cacher-ng python-vm-builder qemu-kvm virt-what lxc lxctl fakeroot faketime zip unzip subversion" + echo " sudo torsocks apt-get install ruby apache2 git apt-cacher-ng qemu-kvm virt-what lxc lxctl fakeroot faketime zip unzip subversion" exit 1 fi else @@ -45,28 +45,29 @@ then echo " sudo torsocks apt-get install ruby git apt-cacher-ng qemu-kvm virt-what lxc lxctl fakeroot zip unzip python-cheetah debootstrap parted kpartx rsync" exit 1 fi - - # python-vm-builder is special as we don't have a Debian package for it. - vmbuilder --help 2>/dev/null >/dev/null - if [ $? -ne 0 ]; - then - echo "The VM tool python-vm-builder is missing." - echo - echo "Please run" - echo 'torsocks wget -U "" http://archive.ubuntu.com/ubuntu/pool/universe/v/vm-builder/vm-builder_0.12…' - echo 'echo "ec12e0070a007989561bfee5862c89a32c301992dd2771c4d5078ef1b3014f03 vm-builder_0.12.4+bzr489.orig.tar.gz" | sha256sum -c' - echo "# (verification -- must return OK)" - echo "tar -zxvf vm-builder_0.12.4+bzr489.orig.tar.gz" - echo "cd vm-builder-0.12.4+bzr489" - echo "sudo python setup.py install" - echo "cd .." - exit 1 - fi else echo "We need Debian or Ubuntu which seem to be missing. Aborting." exit 1 fi +# vmbuilder is special as we don't have a package for it yet. +# XXX: Make sure an already installed vmbuilder is recent enough. +vmbuilder --help 2>/dev/null >/dev/null +if [ $? -ne 0 ]; +then + echo "The VM tool python-vm-builder is missing." + echo + echo "Please run" + echo 'torsocks wget -U "" https://bugs.launchpad.net/ubuntu/+archive/primary/+files/vm-builder_0.12.4…' + echo 'echo "76cbf8c52c391160b2641e7120dbade5afded713afaa6032f733a261f13e6a8e vm-builder_0.12.4+bzr494.orig.tar.gz" | sha256sum -c' + echo "# (verification -- must return OK)" + echo "tar -zxvf vm-builder_0.12.4+bzr494.orig.tar.gz" + echo "cd vm-builder-0.12.4+bzr494" + echo "sudo python setup.py install" + echo "cd .." + exit 1 +fi + update_responses_pkg="libyaml-perl libfile-slurp-perl libxml-writer-perl libio-captureoutput-perl libfile-which-perl libparallel-forkmanager-perl libxml-libxml-perl libwww-perl libjson-perl" missing_pkg='' for pkg in $update_responses_pkg @@ -80,7 +81,7 @@ if [ -n "$missing_pkg" ] then echo "You are missing one or more dependencies for the update_responses script" echo "Please run" - echo " sudo apt-get install $missing_pkg" + echo " sudo torsocks apt-get install $missing_pkg" exit 1 fi diff --git a/gitian/descriptors/linux/gitian-bundle.yml b/gitian/descriptors/linux/gitian-bundle.yml index 15f6359..bfecb0f 100644 --- a/gitian/descriptors/linux/gitian-bundle.yml +++ b/gitian/descriptors/linux/gitian-bundle.yml @@ -1,7 +1,8 @@ --- name: "bundle-linux" +distro: "debian" suites: -- "lucid" +- "wheezy" architectures: - "i386" - "amd64" @@ -28,7 +29,6 @@ remotes: - "url": "https://github.com/wolfcw/libfaketime" "dir": "faketime" files: -# TODO: Can we use an env for this file+version?? - "tor-browser-linux32-gbuilt.zip" - "tor-browser-linux64-gbuilt.zip" - "tor-linux32-gbuilt.zip" @@ -113,9 +113,6 @@ script: | cd ../../../ # cd https-everywhere - # Workaround for git not knowing `git submodule -f` in the version shipped in - # 10.04. - sed 's/recursive -f/recursive/' -i makexpi.sh # XXX: Bloody hack to workaround a bug in HTTPS_E's git hash extraction in # makexpi.sh. See https://trac.torproject.org/projects/tor/ticket/10066 # The solution there does not work for us as doing something like diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index 1efed90..468d6e5 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -1,7 +1,8 @@ --- name: "torbrowser-linux" +distro: "debian" suites: -- "lucid" +- "wheezy" architectures: - "i386" - "amd64" @@ -11,9 +12,10 @@ packages: - "autoconf2.13" - "libgtk2.0-dev" - "libdbus-glib-1-dev" -- "yasm-1" +- "yasm" - "libasound2-dev" - "libgstreamer-plugins-base0.10-dev" +- "libxt-dev" - "hardening-wrapper" # To pass configure since ESR 31. - "libpulse-dev" @@ -51,9 +53,6 @@ script: | export DEB_BUILD_HARDENING_FORMAT=1 export DEB_BUILD_HARDENING_PIE=1 # - mkdir -p $INSTDIR/build/bin/ - ln -s /usr/bin/yasm-1 $INSTDIR/build/bin/yasm - export PATH=$PATH:$INSTDIR/build/bin # Preparing Python for Tor Browser unzip -d $INSTDIR python-linux$GBUILD_BITS-utils.zip # TODO: We might want to have a smarter solution than hard-coding the version. diff --git a/gitian/descriptors/linux/gitian-pluggable-transports.yml b/gitian/descriptors/linux/gitian-pluggable-transports.yml index 31deebb..0643e6b 100644 --- a/gitian/descriptors/linux/gitian-pluggable-transports.yml +++ b/gitian/descriptors/linux/gitian-pluggable-transports.yml @@ -1,7 +1,8 @@ --- name: "pluggable-transports-linux" +distro: "debian" suites: -- "lucid" +- "wheezy" architectures: - "i386" - "amd64" @@ -57,7 +58,6 @@ script: | INSTDIR="$HOME/install" PTDIR="$INSTDIR/Tor/PluggableTransports" mkdir -p $PTDIR - export LD_PRELOAD=/usr/lib/faketime/libfaketime.so.1 export FAKETIME=$REFERENCE_DATETIME export TZ=UTC export LC_ALL=C @@ -251,7 +251,8 @@ script: | cp -a obfs4proxy $PTDIR cd ../.. - # Grabbing the results + # Grabbing the results and making sure timestamps don't spoil them + export LD_PRELOAD=/usr/lib/faketime/libfaketime.so.1 cd $INSTDIR ~/build/dzip.sh pluggable-transports-linux$GBUILD_BITS-gbuilt.zip Tor/ Docs/ cp pluggable-transports-linux$GBUILD_BITS-gbuilt.zip $OUTDIR/ diff --git a/gitian/descriptors/linux/gitian-tor.yml b/gitian/descriptors/linux/gitian-tor.yml index 0e35d2f..bc1dc67 100644 --- a/gitian/descriptors/linux/gitian-tor.yml +++ b/gitian/descriptors/linux/gitian-tor.yml @@ -1,7 +1,8 @@ --- name: "tor-linux" +distro: "debian" suites: -- "lucid" +- "wheezy" architectures: - "i386" - "amd64" @@ -29,7 +30,6 @@ files: script: | INSTDIR="$HOME/install" source versions - export LD_PRELOAD=/usr/lib/faketime/libfaketime.so.1 export FAKETIME=$REFERENCE_DATETIME export TZ=UTC export LC_ALL=C @@ -93,7 +93,8 @@ script: | objcopy --add-gnu-debuglink=./Debug/Tor/$LIB $INSTDIR/Tor/$LIB done - # Grabbing the results + # Grabbing the results and making sure timestamps don't spoil them + export LD_PRELOAD=/usr/lib/faketime/libfaketime.so.1 ~/build/dzip.sh tor-linux$GBUILD_BITS-gbuilt.zip Data/ Tor/ ~/build/dzip.sh tor-linux$GBUILD_BITS-debug.zip Debug/ cp tor-linux$GBUILD_BITS-gbuilt.zip $OUTDIR/ diff --git a/gitian/descriptors/linux/gitian-utils.yml b/gitian/descriptors/linux/gitian-utils.yml index 740a22c..34e93dc 100644 --- a/gitian/descriptors/linux/gitian-utils.yml +++ b/gitian/descriptors/linux/gitian-utils.yml @@ -1,7 +1,8 @@ --- name: "utils-linux" +distro: "debian" suites: -- "lucid" +- "wheezy" architectures: - "i386" - "amd64" @@ -22,6 +23,8 @@ packages: - "libxslt-dev" # Needed for passing the Python related part of configure in ESR 31. - "libssl-dev" +# Needed for binutils (64bit) as we are building with PIE enabled. +- "libstdc++6-4.7-pic" reference_datetime: "2000-01-01 00:00:00" remotes: - "url": "https://github.com/libevent/libevent.git" @@ -40,6 +43,7 @@ script: | source versions export TZ=UTC export LC_ALL=C + export FAKETIME=$REFERENCE_DATETIME umask 0022 # Config options for hardening-wrapper @@ -51,16 +55,33 @@ script: | # Building Binutils tar xjf binutils.tar.bz2 + # The libstdc++ shipped by default is non-PIC which breaks the binutils build + # if we build with DEB_BUILD_HARDENING_PIE=1. We need to install a PIC one AND + # make sure it gets used before the non-PIC one would. + if [ $GBUILD_BITS == "64" ]; + then + ln -s /usr/lib/gcc/x86_64-linux-gnu/4.7/libstdc++_pic.a libstdc++.a + export LDFLAGS="-L/home/debian -lstdc++" + fi cd binutils* # We want to use gold as the linker in our toolchain mainly as it is way # faster when linking Tor Browser code (especially libxul). But apart from # that it fixes #12103 and issues with ESR 31 and our Gitian setup as well # (see bug #12743). - ./configure --prefix=$INSTDIR/binutils --disable-multilib --enable-gold + ./configure --prefix=$INSTDIR/binutils --disable-multilib --enable-gold --enable-plugins make $MAKEOPTS make install cd .. + export LDFLAGS="" + # We need to disable `-Werror=format-security` as GCC does not build with it + # anymore. It seems it got audited for those problems already: + # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=48817. + export DEB_BUILD_HARDENING_FORMAT=0 + # libfaketime gets into our way when building GCC 4.9.x. See: + # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61314 for details. Thus, we + # avoid it for the toolchain and cross our fingers. + # TODO: Test a newer libfaketime than 0.8. # Building GCC tar xjf gcc.tar.bz2 cd gcc-* @@ -69,13 +90,7 @@ script: | make install cd .. - # libfaketime gets into our way when building GCC 4.9.x. See: - # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61314 for details. Thus, we - # avoid it for the toolchain and cross our fingers. - # TODO: Test a newer libfaketime than 0.8. - export LD_PRELOAD=/usr/lib/faketime/libfaketime.so.1 - export FAKETIME=$REFERENCE_DATETIME - + export DEB_BUILD_HARDENING_FORMAT=1 # Building Libevent cd libevent ./autogen.sh @@ -86,6 +101,7 @@ script: | cd .. # Building OpenSSL + export LD_PRELOAD=/usr/lib/faketime/libfaketime.so.1 tar xzf openssl.tar.gz cd openssl-* find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" @@ -111,6 +127,7 @@ script: | cd .. # Building lxml + export LD_PRELOAD="" tar xzf lxml.tar.gz cd lxml-* # Make sure we use our freshly built python binary here. Otherwise bad things @@ -118,7 +135,9 @@ script: | # rules. $INSTDIR/python/bin/python2.7 setup.py build cd build/lib* + export LD_PRELOAD=/usr/lib/faketime/libfaketime.so.1 ~/build/dzip.sh lxml-$LXML_VER-linux$GBUILD_BITS-utils.zip lxml + export LD_PRELOAD="" cp *utils.zip $OUTDIR cd ../../../ @@ -135,7 +154,8 @@ script: | make install cd .. - # Grabbing the remaining results + # Grabbing the remaining results and making sure timestamps don't spoil them + export LD_PRELOAD=/usr/lib/faketime/libfaketime.so.1 cd $INSTDIR ~/build/dzip.sh binutils-$BINUTILS_VER-linux$GBUILD_BITS-utils.zip binutils ~/build/dzip.sh gcc-$GCC_VER-linux$GBUILD_BITS-utils.zip gcc diff --git a/gitian/make-vms.sh b/gitian/make-vms.sh index a3b43b5..469a9ca 100755 --- a/gitian/make-vms.sh +++ b/gitian/make-vms.sh @@ -33,7 +33,14 @@ build_and_test_vm() { export LXC_ARCH=$arch ./bin/make-base-vm --suite $dist --lxc --arch $arch else - ./bin/make-base-vm --suite $dist --arch $arch + if [ "$dist" = "wheezy" ]; + then + export DISTRO=debian + ./bin/make-base-vm --distro debian --suite $dist --arch $arch + else + export DISTRO=ubuntu + ./bin/make-base-vm --suite $dist --arch $arch + fi fi make-clean-vm --suite $dist --arch $arch @@ -56,21 +63,21 @@ build_and_test_vm() { return 0 } -while ! build_and_test_vm lucid i386 32 +while ! build_and_test_vm wheezy i386 32 do - stop-target 32 lucid - rm ./base-lucid-i386* + stop-target 32 wheezy + rm ./base-wheezy-i386* echo - echo "Lucid i386 VM build failed... Trying again" + echo "Wheezy i386 VM build failed... Trying again" echo done -while ! build_and_test_vm lucid amd64 64 +while ! build_and_test_vm wheezy amd64 64 do - stop-target 64 lucid - rm ./base-lucid-amd64* + stop-target 64 wheezy + rm ./base-wheezy-amd64* echo - echo "Lucid amd64 VM build failed... Trying again" + echo "Wheezy amd64 VM build failed... Trying again" echo done @@ -79,7 +86,7 @@ do stop-target 32 precise rm ./base-precise-i386* echo - echo "Lucid amd64 VM build failed... Trying again" + echo "Precise amd64 VM build failed... Trying again" echo done @@ -88,7 +95,7 @@ do stop-target 64 precise rm ./base-precise-amd64* echo - echo "Lucid amd64 VM build failed... Trying again" + echo "Precise amd64 VM build failed... Trying again" echo done

1 0

[tor-browser-bundle/master] Release preparations
by gk＠torproject.org 21 Jan '16

21 Jan '16

commit 56c9e21c35d93e29d2750184fa44d23f46aef71c Author: Georg Koppen <gk(a)torproject.org> Date: Thu Jan 21 20:22:19 2016 +0000 Release preparations --- Bundle-Data/Docs/ChangeLog.txt | 49 +++++++++++++++++++++++++++++++++++++ gitian/versions | 32 ++++++++++-------------- tools/update-responses/config.yml | 12 ++++----- 3 files changed, 68 insertions(+), 25 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index dbb01bd..6042c2f 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,52 @@ +Tor Browser 5.5 -- January 26 2016 + * All Platforms + * Update Firefox to 38.6.0esr + * Update libevent to 2.0.22-stable + * Update NoScript to 2.9.0.2 + * Update Torbutton to 1.9.4.3 + * Bug 16990: Show circuit display for connections using multi-party channels + * Bug 18019: Avoid empty prompt shown after non-en-US update + * Bug 18004: Remove Tor fundraising donation banner + * Bug 16940: After update, load local change notes + * Bug 17108: Polish about:tor appearance + * Bug 17568: Clean up tor-control-port.js + * Bug 16620: Move window.name handling into a Firefox patch + * Bug 17351: Code cleanup + * Translation updates + * Update Tor Launcher to 0.2.7.8 + * Bug 18113: Randomly permutate available default bridges of chosen type + * Bug 13313: Bundle a fixed set of fonts to defend against fingerprinting + * Bug 10140: Add new Tor Browser locale (Japanese) + * Bug 17428: Remove Flashproxy + * Bug 13512: Load a static tab with change notes after an update + * Bug 9659: Avoid loop due to optimistic data SOCKS code (fix of #3875) + * Bug 15564: Isolate SharedWorkers by first-party domain + * Bug 16940: After update, load local change notes + * Bug 17759: Apply whitelist to local fonts in @font-face (fix of #13313) + * Bug 17009: Shift and Alt keys leak physical keyboard layout (fix of #15646) + * Bug 17369: Disable RC4 fallback + * Bug 17442: Remove custom updater certificate pinning + * Bug 16620: Move window.name handling into a Firefox patch + * Bug 17220: Support math symbols in font whitelist + * Bug 10599+17305: Include updater and build patches needed for hardened builds + * Bug 18115+18102+18071+18091: Update/add new obfs4 bridge + * Bug 18072: Change recommended pluggable transport type to obfs4 + * Bug 18008: Create a new MAR Signing key and bake it into Tor Browser + * Bug 16322: Use onion address for DuckDuckGo search engine + * Bug 17917: Changelog after update is empty if JS is disabled + * Windows + * Bug 17250: Add localized font names to font whitelist + * Bug 16707: Allow more system fonts to get used on Windows + * Bug 13819: Ship expert bundles with console enabled + * Bug 17250: Fix broken Japanese fonts + * Bug 17870: Add intermediate certificate for authenticode signing + * OS X + * Bug 17122: Rename Japanese OS X bundle + * Bug 16707: Allow more system fonts to get used on OS X + * Bug 17661: Whitelist font .Helvetica Neue DeskInterface + * Linux + * Bug 16672: Don't use font whitelisting for Linux users + Tor Browser 5.5a6-hardened -- January 7 2016 * All Platforms * Update NoScript to 2.9 diff --git a/gitian/versions b/gitian/versions index 8e35391..7ff094e 100755 --- a/gitian/versions +++ b/gitian/versions @@ -3,27 +3,25 @@ BUNDLE_LOCALES="ar de es-ES fa fr it ko nl pl pt-PT ru tr vi zh-CN" BUNDLE_LOCALES_LINUX="ja" BUNDLE_LOCALES_WIN32="ja" BUNDLE_LOCALES_MAC="ja-JP-mac" - BUILD_PT_BUNDLES=1 VERIFY_TAGS=1 -FIREFOX_VERSION=38.2.0esr +FIREFOX_VERSION=38.6.0esr TORBROWSER_UPDATE_CHANNEL=release -TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-5.0-1-build2 -TOR_TAG=tor-0.2.6.10 -TORLAUNCHER_TAG=0.2.7.7 -TORBUTTON_TAG=1.9.3.2 -HTTPSE_TAG=5.1.0 +TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-5.5-1-build1 +TOR_TAG=tor-0.2.7.6 +TORLAUNCHER_TAG=0.2.7.8 +TORBUTTON_TAG=1.9.4.3 +HTTPSE_TAG=5.1.2 NSIS_TAG=v0.3 ZLIB_TAG=v1.2.8 -LIBEVENT_TAG=release-2.0.21-stable +LIBEVENT_TAG=release-2.0.22-stable MINGW_TAG=a883b47a45ff74ced41dfbd9f748d5c2c61f3c01 # due to bug 1156131 PYPTLIB_TAG=pyptlib-0.0.6 OBFSPROXY_TAG=obfsproxy-0.2.12 -FLASHPROXY_TAG=1.6 LIBFTE_TAG=85ef8ae58dbf0d02ea26b627e343784b5574c428 # sketch master with fix FTEPROXY_TAG=597f8378f6f4f3de570b8e1064c2e4cb8d67fbd0 # tag 0.2.19 LIBDMG_TAG=dfd5e5cc3dc1191e37d3c3a6118975afdd1d7014 @@ -38,12 +36,12 @@ GO_X_NET_TAG=7dbad50ab5b31073856416cdcfeb2796d682f844 OBFS4_TAG=obfs4proxy-0.0.5 NOTOFONTS_TAG=720e34851382ee3c1ef024d8dffb68ffbfb234c2 -GITIAN_TAG=tor-browser-builder-3.x-8 +GITIAN_TAG=tor-browser-builder-3.x-8-gpgsux -OPENSSL_VER=1.0.1p +OPENSSL_VER=1.0.1q GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION -FIREFOX_LANG_BUILD=build2 +FIREFOX_LANG_BUILD=build1 BINUTILS_VER=2.24 GCC_VER=5.1.0 PYTHON_VER=2.7.5 @@ -52,7 +50,6 @@ ARGPARSE_VER=1.2.1 PYYAML_VER=3.11 ZOPEINTERFACE_VER=4.0.5 TWISTED_VER=13.2.0 -M2CRYPTO_VER=0.21.1 PY2EXE_VER=0.6.9 SETUPTOOLS_VER=1.4 LXML_VER=3.3.5 @@ -63,7 +60,7 @@ NOTOCJKFONT_VER=1.004 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 -NOSCRIPT_PACKAGE=noscript_security_suite-2.6.9.34-sm+fn+fx.xpi +NOSCRIPT_PACKAGE=noscript_security_suite-2.9.0.2-sm+fx+fn.xpi TOOLCHAIN4_PACKAGE=x86_64-apple-darwin10.tar.xz TOOLCHAIN4_OLD_PACKAGE=multiarch-darwin11-cctools127.2-gcc42-5666.3-llvmgcc42-2336.1-Linux-120724.tar.xz OSXSDK_PACKAGE=MacOSX10.7.sdk.tar.gz @@ -78,7 +75,6 @@ ARGPARSE_PACKAGE=argparse-${ARGPARSE_VER}.tar.gz PYYAML_PACKAGE=PyYAML-${PYYAML_VER}.tar.gz ZOPEINTERFACE_PACKAGE=zope.interface-${ZOPEINTERFACE_VER}.zip TWISTED_PACKAGE=Twisted-${TWISTED_VER}.tar.bz2 -M2CRYPTO_PACKAGE=M2Crypto-${M2CRYPTO_VER}.tar.gz PY2EXE_PACKAGE=py2exe-${PY2EXE_VER}.win32-py2.7.exe SETUPTOOLS_PACKAGE=setuptools-${SETUPTOOLS_VER}.tar.gz LXML_PACKAGE=lxml-${LXML_VER}.tar.gz @@ -88,20 +84,19 @@ NOTOCJKFONT_PACKAGE=NotoSansCJKsc-Regular.otf STIXMATHFONT_PACKAGE=STIXv1.1.1-latex.zip # Hashes for packages with weak sigs or no sigs -OPENSSL_HASH=bd5ee6803165c0fb60bbecbacacf244f1f90d2aa0d71353af610c29121e9b2f1 +OPENSSL_HASH=b3658b84e9ea606a5ded3c972a5517cd785282e7ea86b20c78aa4b773a047fb7 GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf OSXSDK_OLD_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc TOOLCHAIN4_HASH=7b71bfe02820409b994c5c33a7eab81a81c72550f5da85ff7af70da3da244645 TOOLCHAIN4_OLD_HASH=65c1b2d302358a6b95a26c6828a66908a199276193bb0b268f2dcc1a997731e9 -NOSCRIPT_HASH=d17e3eeb8cc6ddc6c6cabd002184eced5c8cf061c9d337bac2085e7d2daceacd +NOSCRIPT_HASH=f3c9dec710e02d809fa85ac76750e5f074656105c1bde03d400cb597b2eb1fba MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c ARGPARSE_HASH=ddaf4b0a618335a32b6664d4ae038a1de8fbada3b25033f9021510ed2b3941a4 PYYAML_HASH=c36c938a872e5ff494938b33b14aaa156cb439ec67548fcab3535bb78b0846e8 ZOPEINTERFACE_HASH=1a7c84716bbd9981915b64a81d8a3f076a5934a8c8df4224655469b3564940cc TWISTED_HASH=095175638c019ac7c0604f4c291724a16ff1acd062e181b01293bf4dcbc62cf3 -M2CRYPTO_HASH=25b94498505c2d800ee465db0cc1aff097b1615adc3ac042a1c85ceca264fc0a PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 @@ -127,7 +122,6 @@ PYYAML_URL=https://pypi.python.org/packages/source/P/PyYAML/${PYYAML_PACKAG… ZOPEINTERFACE_URL=https://pypi.python.org/packages/source/z/zope.interface/… TWISTED_URL=https://pypi.python.org/packages/source/T/Twisted/${TWISTED_PAC… # TWISTED_URL=https://twistedmatrix.com/Releases/Twisted/$(echo ${TWISTED_VER} | awk -F. '{print $1"."$2}')/${TWISTED_PACKAGE} -M2CRYPTO_URL=https://pypi.python.org/packages/source/M/M2Crypto/${M2CRYPTO_PACKAGE} PY2EXE_URL=http://liquidtelecom.dl.sourceforge.net/project/py2exe/py2exe/${… SETUPTOOLS_URL=https://pypi.python.org/packages/source/s/setuptools/${SETUP… LXML_URL=https://pypi.python.org/packages/source/l/lxml/${LXML_PACKAGE} diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index d61793c..362c146 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -10,14 +10,14 @@ build_targets: osx64: Darwin_x86_64-gcc3 channels: alpha: 5.5a6 - release: 5.0 + release: 5.5 versions: - 5.0: - platformVersion: 38.2.0 - detailsURL: https://www.torproject.org/projects/torbrowser.html.en - download_url: https://www.torproject.org/dist/torbrowser/5.0 + 5.5: + platformVersion: 38.6.0 + detailsURL: https://blog.torproject.org/blog/tor-browser-55-released + download_url: https://www.torproject.org/dist/torbrowser/5.5 incremental_from: - - 4.5.3 + - 5.0.7 migrate_archs: osx32: osx64 osx32:

1 0

[tor-launcher/maint-0.2.7] Bug 18113: Randomly permutate available default bridges of chosen type.
by gk＠torproject.org 21 Jan '16

21 Jan '16

commit 99ea6908eace93472b72670abc1f0bc6c4f86dfa Author: Isis Lovecruft <isis(a)torproject.org> Date: Thu Jan 21 03:37:43 2016 +0000 Bug 18113: Randomly permutate available default bridges of chosen type. * ADDS a new function to TorLauncherUtil, rearrangeBridges() which takes an array of items and returns a random permutation of that array. * CHANGE defaultBridges() getter to call this.rearrangeBridges() before returning the default bridges. This causing the ordering of the default bridges in the torrc to vary among clients, resulting in a more even distribution of clients to default bridges. --- src/modules/tl-util.jsm | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/src/modules/tl-util.jsm b/src/modules/tl-util.jsm index ac680a8..2ef4b15 100644 --- a/src/modules/tl-util.jsm +++ b/src/modules/tl-util.jsm @@ -242,6 +242,19 @@ let TorLauncherUtil = // Public } catch (e) {} }, + // Currently, this returns a random permutation of an array, bridgeArray. + // Later, we might want to change this function to weight based on the + // bridges' bandwidths. + rearrangeBridges: function(bridgeArray) + { + for (var j, x, i = bridgeArray.length; i; + j = parseInt(Math.random() * i), + x = bridgeArray[--i], + bridgeArray[i] = bridgeArray[j], + bridgeArray[j] = x); + return bridgeArray; + }, + get shouldStartAndOwnTor() { const kPrefStartTor = "extensions.torlauncher.start_tor"; @@ -341,6 +354,7 @@ let TorLauncherUtil = // Public bridgeArray.push(s); } } + this.rearrangeBridges(bridgeArray); return bridgeArray; } catch(e) {};

1 0

[tor-launcher/maint-0.2.7] Version bump
by gk＠torproject.org 21 Jan '16

21 Jan '16

commit 5cf4922eedbca64f956f0cc589701757f0b88680 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Jan 21 14:41:57 2016 +0000 Version bump --- src/install.rdf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/install.rdf b/src/install.rdf index a7524b7..06ebe1a 100644 --- a/src/install.rdf +++ b/src/install.rdf @@ -7,7 +7,7 @@ <em:creator>The Tor Project, Inc.</em:creator> <em:contributor>Pearl Crescent, LLC</em:contributor> <em:id>tor-launcher(a)torproject.org</em:id> - <em:version>0.2.7.7</em:version> + <em:version>0.2.7.8</em:version> <em:homepageURL>https://www.torproject.org/projects/torbrowser.html</em:homepageURL> <em:updateURL>data:text/plain,</em:updateURL> <em:updateKey>-</em:updateKey>

1 0

[torbutton/maint-1.9.4] Changelog fix
by gk＠torproject.org 21 Jan '16

21 Jan '16

commit 92db556549b0ec74772a5e3d3ea169edd2463b59 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Jan 21 11:58:41 2016 +0000 Changelog fix --- src/CHANGELOG | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/CHANGELOG b/src/CHANGELOG index b8b1853..baf3fd0 100644 --- a/src/CHANGELOG +++ b/src/CHANGELOG @@ -1,6 +1,6 @@ 1.9.4.3 * Bug 16990: Show circuit display for connections using multi-party channels - * Bug 18019: Empty prompt shown after non-en-US update + * Bug 18019: Avoid empty prompt shown after non-en-US update * Bug 18004: Remove Tor fundraising donation banner * Code cleanup * Translation updates

1 0

[torbutton/master] Include changelogs from maint-1.9.3
by gk＠torproject.org 21 Jan '16

21 Jan '16

commit 0cd72154dd04a4d15567f4585a6607cfb2d4ece6 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Jan 21 11:05:24 2016 +0000 Include changelogs from maint-1.9.3 --- src/CHANGELOG | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/src/CHANGELOG b/src/CHANGELOG index 2d8647f..c56939d 100644 --- a/src/CHANGELOG +++ b/src/CHANGELOG @@ -23,6 +23,21 @@ * Bug 16797: brandShorterName is missing from brand.properties * Translation updates +1.9.3.7 + * Bug 16990: Avoid matching '250 ' to the end of node name + * Bug 17565: Tor fundraising campaign donation banner + * Bug 17770: Fix alignments on donation banner + * Bug 17792: Include donation banner in some non en-US Tor Browsers + * Translation updates + +1.9.3.5 + * Bug 9623: Spoof Referer when leaving a .onion domain + * Bug 16735: about:tor should accommodate different fonts/font sizes + * Bug 16937: Don't translate the hompepage/spellchecker dictionary string + * Bug 17164: Don't show text-select cursor on circuit display + * Bug 17351: Remove unused code + * Translation updates + 1.9.3.4 * Bug 16887: Update intl.accept_languages value * Bug 15493: Update circuit display on new circuit info

1 0

[tor-browser/tor-browser-38.5.0esr-5.5-2] fixup! Bug 15646: Prevent keyboard layout fingerprinting in KeyboardEvent
by gk＠torproject.org 21 Jan '16

21 Jan '16

commit 1ad4ed85948e5814e46744cedd0b5a9b1707cac4 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Wed Jan 20 17:51:46 2016 -0800 fixup! Bug 15646: Prevent keyboard layout fingerprinting in KeyboardEvent --- dom/events/KeyCodeConsensus.h | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/dom/events/KeyCodeConsensus.h b/dom/events/KeyCodeConsensus.h index 47d8341..e789326 100644 --- a/dom/events/KeyCodeConsensus.h +++ b/dom/events/KeyCodeConsensus.h @@ -181,15 +181,14 @@ static void createKeyCodes() KEY("8", Digit8, 56) KEY("9", Digit9, 57) - SHIFT("!", Digit0, 48) - SHIFT("@", Digit1, 49) - SHIFT("#", Digit2, 50) - SHIFT("$", Digit3, 51) - SHIFT("%", Digit4, 52) - SHIFT("^", Digit5, 53) - SHIFT("&", Digit6, 54) - SHIFT("*", Digit7, 55) - SHIFT("(", Digit8, 56) - SHIFT(")", Digit9, 57) - + SHIFT(")", Digit0, 48) + SHIFT("!", Digit1, 49) + SHIFT("@", Digit2, 50) + SHIFT("#", Digit3, 51) + SHIFT("$", Digit4, 52) + SHIFT("%", Digit5, 53) + SHIFT("^", Digit6, 54) + SHIFT("&", Digit7, 55) + SHIFT("*", Digit8, 56) + SHIFT("(", Digit9, 57) }

1 0