- tbb-commits - lists.torproject.org

[tor-launcher/master] Bump version for 0.2.5.4.
by mikeperry＠torproject.org 25 Apr '14

25 Apr '14

commit 2adfdeec19eb64954cc8991fe0a3b75e710f3867 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Fri Apr 25 10:38:51 2014 -0700 Bump version for 0.2.5.4. --- src/install.rdf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/install.rdf b/src/install.rdf index 7b47f07..495b8ca 100644 --- a/src/install.rdf +++ b/src/install.rdf @@ -7,7 +7,7 @@ <em:creator>The Tor Project, Inc.</em:creator> <em:contributor>Pearl Crescent, LLC</em:contributor> <em:id>tor-launcher(a)torproject.org</em:id> - <em:version>0.2.5.4pre</em:version> + <em:version>0.2.5.4</em:version> <em:homepageURL>https://www.torproject.org/projects/torbrowser.html</em:homepageURL> <em:updateURL>https://127.0.0.1/</em:updateURL> <!--

1 0

[tor-launcher/master] Update translations.
by mikeperry＠torproject.org 25 Apr '14

25 Apr '14

commit eed30d03d66166b5e0bc4c38ede9df2b73c8254e Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Fri Apr 25 10:38:18 2014 -0700 Update translations. --- src/chrome/locale/bg/network-settings.dtd | 40 +++++++++++++-------------- src/chrome/locale/cy/torlauncher.properties | 2 +- src/chrome/locale/nl/torlauncher.properties | 2 +- src/chrome/locale/pl/torlauncher.properties | 2 +- 4 files changed, 23 insertions(+), 23 deletions(-) diff --git a/src/chrome/locale/bg/network-settings.dtd b/src/chrome/locale/bg/network-settings.dtd index a38b198..2ad9e78 100644 --- a/src/chrome/locale/bg/network-settings.dtd +++ b/src/chrome/locale/bg/network-settings.dtd @@ -2,27 +2,27 @@  -<!ENTITY torsettings.prompt "Before you connect to the Tor network, you need to provide information about this computer's Internet connection."> +<!ENTITY torsettings.prompt "Преди да се свържете към Tor мрежата,вие трябва да предоставите информация относно интернет връзката на този компютър"> <!ENTITY torSettings.yes "Да"> <!ENTITY torSettings.no "Не"> -<!ENTITY torSettings.firstQuestion "Which of the following best describes your situation?"> -<!ENTITY torSettings.configurePrompt1 "This computer's Internet connection is censored, filtered, or proxied."> +<!ENTITY torSettings.firstQuestion "Кое от следните описва най-добре вашата ситуация?"> +<!ENTITY torSettings.configurePrompt1 "Интернет връзката на този компютър е цензурирана,филтрирана или преминава през прокси."> <!ENTITY torSettings.configurePrompt2 "I need to configure bridge, firewall, or proxy settings."> -<!ENTITY torSettings.configure "Configure"> -<!ENTITY torSettings.connectPrompt2 "I would like to connect directly to the Tor network."> -<!ENTITY torSettings.connectPrompt3 "This will work in most situations."> +<!ENTITY torSettings.configure "Конфигурирай"> +<!ENTITY torSettings.connectPrompt2 "Бих искал да се свържа директно към Tor мрежата."> +<!ENTITY torSettings.connectPrompt3 "Това ще работи при повечето ситуации."> <!ENTITY torSettings.connect "Свържи се"> -<!ENTITY torSettings.proxyQuestion "Does this computer need to use a proxy to access the Internet?"> +<!ENTITY torSettings.proxyQuestion "Нуждае ли се този компютър от прокси за свързване към Интернет?">  -<!ENTITY torSettings.proxyHelp "If you are not sure how to answer this question, look at the Internet settings in another browser to see whether it is configured to use a proxy."> -<!ENTITY torSettings.enterProxy "Enter the proxy settings."> -<!ENTITY torSettings.firewallQuestion "Does this computer's Internet connection go through a firewall that only allows connections to certain ports?"> -<!ENTITY torSettings.firewallHelp "If you are not sure how to answer this question, choose No. If you encounter problems connecting to the Tor network, change this setting."> -<!ENTITY torSettings.enterFirewall "Enter a comma-separated list of ports that are allowed by the firewall."> -<!ENTITY torSettings.bridgeQuestion "Does your Internet Service Provider (ISP) block or otherwise censor connections to the Tor Network?"> +<!ENTITY torSettings.proxyHelp "Ако не сте сигурни как да отговорите на този въпрос проверете интернет настройките на друг браузър,за да видите дали е настроен да използва прокси."> +<!ENTITY torSettings.enterProxy "Въведете настройките за прокси."> +<!ENTITY torSettings.firewallQuestion "Интернет връзката на този компютър преминава ли през firewall,който позволява връзки към определени портове?"> +<!ENTITY torSettings.firewallHelp "Ако не сте сигурни как да отговорите на въпроса,изберете Не.Ако срещнете проблеми при свързване към Tor мрежата променете тези настройки."> +<!ENTITY torSettings.enterFirewall "Въведете списък с портове разделени със запетая,които са позволени от firewall."> +<!ENTITY torSettings.bridgeQuestion "Блокирани или цензурирани ли са връзките към Tor Мрежата от вашият Интернет Доставчик(ISP)?"> <!ENTITY torSettings.bridgeHelp "If you are not sure how to answer this question, choose No.&#160; If you choose Yes, you will be asked to configure Tor Bridges, which are unlisted relays that make it more difficult to block connections to the Tor Network."> <!ENTITY torSettings.bridgeSettingsPrompt "You may use the provided set of bridges or you may obtain and enter a custom set of bridges."> @@ -33,8 +33,8 @@ <!ENTITY torsettings.optional "Допълнителен"> -<!ENTITY torsettings.useProxy.checkbox "This computer needs to use a proxy to access the Internet"> -<!ENTITY torsettings.useProxy.type "Proxy Type:"> +<!ENTITY torsettings.useProxy.checkbox "Този компютър се нуждае от прокси за да се свърже към Интернет."> +<!ENTITY torsettings.useProxy.type "Прокси Тип:"> <!ENTITY torsettings.useProxy.address "Адрес:"> <!ENTITY torsettings.useProxy.address.placeholder "IP адрес или хост"> <!ENTITY torsettings.useProxy.port "Порт:"> @@ -43,21 +43,21 @@ <!ENTITY torsettings.useProxy.type.socks4 "SOCKS 4"> <!ENTITY torsettings.useProxy.type.socks5 "SOCKS 5"> <!ENTITY torsettings.useProxy.type.http "HTTP / HTTPS"> -<!ENTITY torsettings.firewall.checkbox "This computer goes through a firewall that only allows connections to certain ports"> +<!ENTITY torsettings.firewall.checkbox "Този компютър се свързва през firewall,който позволява връзки само към определени портове."> <!ENTITY torsettings.firewall.allowedPorts "Позволени портове:"> -<!ENTITY torsettings.useBridges.checkbox "My Internet Service Provider (ISP) blocks connections to the Tor network"> +<!ENTITY torsettings.useBridges.checkbox "Моят Интернет Доставчик (ISP) блокира връзките към Tor мрежата"> <!ENTITY torsettings.useBridges.default "Connect with provided bridges"> <!ENTITY torsettings.useBridges.type "Transport type:"> <!ENTITY torsettings.useBridges.custom "Enter custom bridges"> <!ENTITY torsettings.useBridges.label "Enter one or more bridge relays (one per line)."> -<!ENTITY torsettings.useBridges.placeholder "type address:port"> +<!ENTITY torsettings.useBridges.placeholder "въведете адрес:порт"> <!ENTITY torsettings.copyLog "Копирай Tor лога в клипборда"> <!ENTITY torsettings.bridgeHelpTitle "Bridge Relay Help"> <!ENTITY torsettings.bridgeHelp1 "If you are unable to connect to the Tor network, it could be that your Internet Service Provider (ISP) or another agency is blocking Tor.&#160; Often, you can work around this problem by using Tor Bridges, which are unlisted relays that are more difficult to block."> <!ENTITY torsettings.bridgeHelp1B "You may use the preconfigured, provided set of bridge addresses or you may obtain a custom set of addresses by using one of these three methods:"> -<!ENTITY torsettings.bridgeHelp2Heading "Through the Web"> -<!ENTITY torsettings.bridgeHelp2 "Use a web browser to visit https://bridges.torproject.org"> +<!ENTITY torsettings.bridgeHelp2Heading "През Web"> +<!ENTITY torsettings.bridgeHelp2 "Използвайте уеб браузър за да посетите https://bridges.torproject.org"> <!ENTITY torsettings.bridgeHelp3Heading "Through the Email Autoresponder"> <!ENTITY torsettings.bridgeHelp3 "Send email to bridges(a)torproject.org with the line 'get bridges' by itself in the body of the message.&#160; However, to make it harder for an attacker to learn a lot of bridge addresses, you must send this request from a gmail.com or yahoo.com email address."> <!ENTITY torsettings.bridgeHelp4Heading "Through the Help Desk"> diff --git a/src/chrome/locale/cy/torlauncher.properties b/src/chrome/locale/cy/torlauncher.properties index 97c0389..f26cdfa 100644 --- a/src/chrome/locale/cy/torlauncher.properties +++ b/src/chrome/locale/cy/torlauncher.properties @@ -55,4 +55,4 @@ torlauncher.bootstrapWarning.identity=anghysondeb hunaniaeth torlauncher.bootstrapWarning.timeout=cysylltiad goramser torlauncher.bootstrapWarning.noroute=ddim llwybr i'r cad torlauncher.bootstrapWarning.ioerror=camgymeriad darllen/sgwennu -torlauncher.bootstrapWarning.pt_missing=missing pluggable transport +torlauncher.bootstrapWarning.pt_missing=trafnyddiaeth plygadwy ar goll diff --git a/src/chrome/locale/nl/torlauncher.properties b/src/chrome/locale/nl/torlauncher.properties index c4b2760..f104345 100644 --- a/src/chrome/locale/nl/torlauncher.properties +++ b/src/chrome/locale/nl/torlauncher.properties @@ -55,4 +55,4 @@ torlauncher.bootstrapWarning.identity=identiteitsfout torlauncher.bootstrapWarning.timeout=verbindingstimeout torlauncher.bootstrapWarning.noroute=geen route naar de server torlauncher.bootstrapWarning.ioerror=lees/schrijffout -torlauncher.bootstrapWarning.pt_missing=missing pluggable transport +torlauncher.bootstrapWarning.pt_missing=ontbrekend plugbaar vervoer diff --git a/src/chrome/locale/pl/torlauncher.properties b/src/chrome/locale/pl/torlauncher.properties index 7651ef2..32feaa8 100644 --- a/src/chrome/locale/pl/torlauncher.properties +++ b/src/chrome/locale/pl/torlauncher.properties @@ -55,4 +55,4 @@ torlauncher.bootstrapWarning.identity=niezgodność tożsamości torlauncher.bootstrapWarning.timeout=upłynął czas połączenia torlauncher.bootstrapWarning.noroute=brak trasy do hosta torlauncher.bootstrapWarning.ioerror=błąd zapisu/odczytu -torlauncher.bootstrapWarning.pt_missing=missing pluggable transport +torlauncher.bootstrapWarning.pt_missing=brak podłączanego transportu

1 0

[tor-browser/tor-browser-24.5.0esr-1] fix #9308 and #11433: don't leak user install path of TBB
by mikeperry＠torproject.org 25 Apr '14

25 Apr '14

commit 7ac088b732719d6e69466e583b7eb31767759d22 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Wed Apr 23 16:05:48 2014 -0700 fix #9308 and #11433: don't leak user install path of TBB --- js/xpconnect/src/XPCConvert.cpp | 5 ++++- js/xpconnect/src/XPCException.cpp | 7 ++++++- js/xpconnect/src/XPCStack.cpp | 7 +++++-- xpcom/build/Omnijar.cpp | 29 +++++++++++++++++++++++++++++ xpcom/build/Omnijar.h | 13 +++++++++++++ 5 files changed, 57 insertions(+), 4 deletions(-) diff --git a/js/xpconnect/src/XPCConvert.cpp b/js/xpconnect/src/XPCConvert.cpp index a94a519..dd8c8f4 100644 --- a/js/xpconnect/src/XPCConvert.cpp +++ b/js/xpconnect/src/XPCConvert.cpp @@ -8,6 +8,7 @@ /* Data conversion between native and JavaScript types. */ #include "mozilla/Util.h" +#include "mozilla/Omnijar.h" #include "xpcprivate.h" #include "nsString.h" @@ -1319,9 +1320,11 @@ XPCConvert::JSErrorToXPCException(const char* message, static_cast<const PRUnichar*>(report->uclinebuf); data = new nsScriptError(); + nsAutoCString resourceFilename; + Omnijar::ConvertToResourceFilename(nsCString(report->filename), resourceFilename); data->InitWithWindowID( bestMessage, - NS_ConvertASCIItoUTF16(report->filename), + NS_ConvertASCIItoUTF16(resourceFilename.get()), uclinebuf ? nsDependentString(uclinebuf) : EmptyString(), report->lineno, report->uctokenptr - report->uclinebuf, report->flags, diff --git a/js/xpconnect/src/XPCException.cpp b/js/xpconnect/src/XPCException.cpp index a0b48c2..1e42662 100644 --- a/js/xpconnect/src/XPCException.cpp +++ b/js/xpconnect/src/XPCException.cpp @@ -9,6 +9,7 @@ #include "xpcprivate.h" #include "nsError.h" #include "nsIUnicodeDecoder.h" +#include "mozilla/Omnijar.h" /***************************************************************************/ /* Quick and dirty mapping of well known result codes to strings. We only @@ -291,8 +292,12 @@ nsXPCException::Initialize(const char *aMessage, nsresult aResult, const char *a // For now, fill in our location details from our stack frame. // Later we may allow other locations? nsresult rc; - if (NS_FAILED(rc = aLocation->GetFilename(&mFilename))) + char* rawFilename = nullptr; + if (NS_FAILED(rc = aLocation->GetFilename(&rawFilename))) return rc; + nsAutoCString resourceFilename; + mozilla::Omnijar::ConvertToResourceFilename(nsCString(rawFilename), resourceFilename); + mFilename = (char *) nsMemory::Clone(resourceFilename.get(), resourceFilename.Length()+1); if (NS_FAILED(rc = aLocation->GetLineNumber(&mLineNumber))) return rc; } else { diff --git a/js/xpconnect/src/XPCStack.cpp b/js/xpconnect/src/XPCStack.cpp index db30556..adfd456 100644 --- a/js/xpconnect/src/XPCStack.cpp +++ b/js/xpconnect/src/XPCStack.cpp @@ -7,6 +7,7 @@ /* Implements nsIStackFrame. */ #include "xpcprivate.h" +#include "mozilla/Omnijar.h" class XPCJSStackFrame : public nsIStackFrame { @@ -107,9 +108,11 @@ XPCJSStackFrame::CreateStack(JSContext* cx, XPCJSStackFrame** stack) JSAutoCompartment ac(cx, desc->frames[i].script); const char* filename = JS_GetScriptFilename(cx, desc->frames[i].script); if (filename) { + nsAutoCString resourceFilename; + mozilla::Omnijar::ConvertToResourceFilename(nsCString(filename), resourceFilename); self->mFilename = (char*) - nsMemory::Clone(filename, - sizeof(char)*(strlen(filename)+1)); + nsMemory::Clone(resourceFilename.get(), + sizeof(char)*(resourceFilename.Length()+1)); } self->mLineno = desc->frames[i].lineno; diff --git a/xpcom/build/Omnijar.cpp b/xpcom/build/Omnijar.cpp index 4d75c7e..79fa163 100644 --- a/xpcom/build/Omnijar.cpp +++ b/xpcom/build/Omnijar.cpp @@ -164,4 +164,33 @@ Omnijar::GetURIString(Type aType, nsACString &result) return NS_OK; } +bool +Omnijar::RebaseFilename(const nsCString& filename, const nsCString& oldBase, const nsCString& newBase, nsACString &result) { + PRInt32 pos = filename.Find(oldBase); + if (pos > -1) { + nsAutoCString path; + filename.Right(path, filename.Length() - pos - oldBase.Length()); + result = newBase + path; + return true; + } + result = filename; + return false; +} + +void +Omnijar::ConvertToResourceFilename(const nsCString& filename, nsACString &result) { + if (StringBeginsWith(filename, NS_LITERAL_CSTRING("file://")) + || StringBeginsWith(filename, NS_LITERAL_CSTRING("jar:"))) { + if (RebaseFilename(filename, NS_LITERAL_CSTRING("/browser/omni.ja!/"), + NS_LITERAL_CSTRING("resource://app/"), result)) { + return; + } + if (RebaseFilename(filename, NS_LITERAL_CSTRING("/omni.ja!/"), + NS_LITERAL_CSTRING("resource://gre/"), result)) { + return; + } + } + result = filename; +} + } /* namespace mozilla */ diff --git a/xpcom/build/Omnijar.h b/xpcom/build/Omnijar.h index a261e35..4ba49a7 100644 --- a/xpcom/build/Omnijar.h +++ b/xpcom/build/Omnijar.h @@ -117,12 +117,25 @@ static already_AddRefed<nsZipArchive> GetReader(nsIFile *aPath); */ static nsresult GetURIString(Type aType, nsACString &result); +/** + * If the filename contains a "file://" URI, which is an absolute path, + * attempts to convert to a "resource://" URI. Otherwise returns the + * filename unchanged. + */ +static void ConvertToResourceFilename(const nsCString& filename, nsACString &result); + private: /** * Used internally, respectively by Init() and CleanUp() */ static void InitOne(nsIFile *aPath, Type aType); static void CleanUpOne(Type aType); +/** + * Rebases a filename, given a (possibly internal) base directory, and a new + * base directory name. E.g.: RebaseFilename("a/b/c","b","d",result) -> result = "d/c". + */ +static bool RebaseFilename(const nsCString& filename, const nsCString& oldBase, const nsCString& newBase, nsACString &result); + }; /* class Omnijar */

1 0

[tor-browser/tor-browser-24.5.0esr-1] fixup! fix #9308 and #11433: don't leak user install path of TBB
by mikeperry＠torproject.org 25 Apr '14

25 Apr '14

commit 0806951f373ae1b0223229605ca6cca62f7464bd Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Fri Apr 25 14:46:39 2014 +0200 fixup! fix #9308 and #11433: don't leak user install path of TBB Fix a memory leak, and add a couple length checks for extra safety. The length checks appear to be redundant to internal nsCString checks, but the string classes are such a mess of indirection, size, length, and char type templates that we might as well double-check first. --- js/xpconnect/src/XPCException.cpp | 1 + xpcom/build/Omnijar.cpp | 5 +++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/js/xpconnect/src/XPCException.cpp b/js/xpconnect/src/XPCException.cpp index 1e42662..bb4064a 100644 --- a/js/xpconnect/src/XPCException.cpp +++ b/js/xpconnect/src/XPCException.cpp @@ -298,6 +298,7 @@ nsXPCException::Initialize(const char *aMessage, nsresult aResult, const char *a nsAutoCString resourceFilename; mozilla::Omnijar::ConvertToResourceFilename(nsCString(rawFilename), resourceFilename); mFilename = (char *) nsMemory::Clone(resourceFilename.get(), resourceFilename.Length()+1); + nsMemory::Free(rawFileName); // allocated by GetFilename if (NS_FAILED(rc = aLocation->GetLineNumber(&mLineNumber))) return rc; } else { diff --git a/xpcom/build/Omnijar.cpp b/xpcom/build/Omnijar.cpp index 79fa163..36602a7 100644 --- a/xpcom/build/Omnijar.cpp +++ b/xpcom/build/Omnijar.cpp @@ -167,9 +167,10 @@ Omnijar::GetURIString(Type aType, nsACString &result) bool Omnijar::RebaseFilename(const nsCString& filename, const nsCString& oldBase, const nsCString& newBase, nsACString &result) { PRInt32 pos = filename.Find(oldBase); - if (pos > -1) { + PRInt32 pathLen = filename.Length() - pos - oldBase.Length(); + if (pos > -1 && pathLen > -1 && pathLen <= filename.Length()) { nsAutoCString path; - filename.Right(path, filename.Length() - pos - oldBase.Length()); + filename.Right(path, pathLen); result = newBase + path; return true; }

1 0

[tor-browser-bundle/master] Update fteproxy fingerprints, post heartbleed
by mikeperry＠torproject.org 25 Apr '14

25 Apr '14

commit 409a2634d95b0c0882f251cbb4b3e7b6002eb58f Author: Kevin P. Dyer <kpdyer(a)gmail.com> Date: Fri Apr 25 09:17:23 2014 -0700 Update fteproxy fingerprints, post heartbleed --- Bundle-Data/PTConfigs/bridge_prefs.js | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/Bundle-Data/PTConfigs/bridge_prefs.js b/Bundle-Data/PTConfigs/bridge_prefs.js index bb000cd..f14cf07 100644 --- a/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/Bundle-Data/PTConfigs/bridge_prefs.js @@ -19,7 +19,5 @@ pref("extensions.torlauncher.default_bridge.flashproxy.5", "flashproxy 0.0.1.0:5 pref("extensions.torlauncher.default_bridge.fte.1", "fte 128.105.214.161:8080 1E326AAFB3FCB515015250D8FCCC8E37F91A153B"); pref("extensions.torlauncher.default_bridge.fte.2", "fte 128.105.214.162:8080 FC562097E1951DCC41B7D7F324D88157119BB56D"); pref("extensions.torlauncher.default_bridge.fte.3", "fte 128.105.214.163:8080 A17A40775FBD2CA1184BF80BFC330A77ECF9D0E9"); -// XXX: Fingerprints changed: -//pref("extensions.torlauncher.default_bridge.fte.4", "fte 131.252.210.150:8080 271EC1874E40FE65C145C6397AA34FFF7008E50E"); -//pref("extensions.torlauncher.default_bridge.fte.5", "fte 79.125.3.12:8080 17AF9F9F4E57614A060B7221DCCEDB8BB546DD73"); - +pref("extensions.torlauncher.default_bridge.fte.4", "fte 131.252.210.150:8080 0E858AC201BF0F3FA3C462F64844CBFFC7297A42"); +pref("extensions.torlauncher.default_bridge.fte.5", "fte 79.125.3.12:8080 272465348803EE2546A9BB8EE37D462915531F09");

1 0

[tor-browser-bundle/master] Update the gitian branch we recommend people clone from.
by mikeperry＠torproject.org 25 Apr '14

25 Apr '14

commit a97d04ef46c7ea6b35b9cfa961be3ce4db25a338 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Fri Apr 25 15:45:27 2014 +0200 Update the gitian branch we recommend people clone from. --- gitian/check-prerequisites.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gitian/check-prerequisites.sh b/gitian/check-prerequisites.sh index b4df5a3..e470b84 100755 --- a/gitian/check-prerequisites.sh +++ b/gitian/check-prerequisites.sh @@ -27,7 +27,7 @@ then echo echo "Please run:" echo " cd ../../ " - echo " torsocks git clone -b tor-browser-builder-2 https://git.torproject.org/builders/gitian-builder.git" + echo " torsocks git clone -b tor-browser-builder-3 https://git.torproject.org/builders/gitian-builder.git" echo " cd -" exit 1 fi

1 0

[tor-browser-bundle/master] Update documentation and TODO file.
by mikeperry＠torproject.org 25 Apr '14

25 Apr '14

commit e4d79c85701de21e6b15d6a0aba39b4931b4ba71 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Fri Apr 25 15:40:23 2014 +0200 Update documentation and TODO file. Some of the TODO file may still be out of date. I think we have fixed most of the hardening issues, for example, but we should double check that. --- gitian/README.build | 75 +++++++++++++++++++++++++++++---------------------- gitian/TODO | 7 ----- 2 files changed, 43 insertions(+), 39 deletions(-) diff --git a/gitian/README.build b/gitian/README.build index ece4cb6..47a8f57 100644 --- a/gitian/README.build +++ b/gitian/README.build @@ -48,18 +48,18 @@ Detailed Explanation of Scripts: 0. Makefile: The main Makefile. It has six main commands: - prep: Check OS prerequisites and download source dependency inputs - build: Build localized bundles for Linux, Windows, and Mac - - clean: Remove prior partial build stages (Tor and Firefox) + - clean: Remove prior partial build stages (see 'Partial Rebuilds' below) - vmclean: Remove VM base images - distclean: Remove source dependency inputs, and run clean and vmclean - all: The default. It calls clean, prep, and then build. - - sign: Signs your build output and uplodas it to people.torproject.org + - sign: Signs your build output and uploads it to people.torproject.org - match: Checks your build output against public signed hashes - To build alpha bundles, alternate targets are provided: - - alpha: The equivalent to the 'all' rule for alpha packages - - build-alpha: The equivalent to the 'build' rule for alpha packages - - prep-alpha: The equivalent to the 'prep' rule for alpha packages - - sign-alpha: Signs your build output and uplodas it to people.torproject.org - - match-alpha: Checks your build output against public signed hashes + To build beta/alpha/nightly bundles, alternate targets are provided: + - beta: The equivalent to the 'all' rule for beta packages + - build-beta: The equivalent to the 'build' rule for beta packages + - prep-beta: The equivalent to the 'prep' rule for beta packages + - sign-beta: Signs your build output and uploads it to people.torproject.org + - match-beta: Checks your build output against public signed hashes 1. check-prerequisites.sh: This script checks if your system is capable of running Gitian, and if it is not, it tells you what you need to do. @@ -95,31 +95,47 @@ Detailed Explanation of Scripts: call the appropriate descriptors to build a 32bit Mac bundle. It also will create build VM images for you if you haven't done that before. + 9. record-inputs.sh: This script records all of the hashes and bundle + inputs for inclusion in the 'Docs/sources' subdirectory of the bundles + themselves. + + 10. hash-bundles.sh: This script generates a 'sha256sums.txt' file in sorted, + reproducible order. -Partial Rebuilds: + 11. check-match.sh: This script checks your 'sha256sums.txt' file against + any signed, published builds. - The mkbundle shell scripts each have three Gitian stages. + 12. upload-signature.sh: This script signs and uploads your 'sha256sums.txt' + file (for use if you are an official builder). - First, using their platform's gitian-tor.yml Gitian descriptor, they build - tor and the tor dependencies (libevent, zlib, and openssl). Second, using - the gitian-firefox.yml descriptor, they build Firefox with the Tor Browser - patches and preferences applied. Third, in gitian-bundle.yml, they assemble - the bundles using the addons and localization packs. - The Tor and Firefox stages end up as a *gbuilt*.zip files in - ../../gitian-builder/inputs/, and those zip files are used as inputs into - the final bundling and localization stage. If those files exist in that - directory, the corresponding bundle will *not* be built. +Partial Rebuilds: + + The mkbundle shell scripts each have five Gitian stages: + 1. Build support utilities (gitian-utils.yml) + 2. Tor (gitian-tor.yml) + 3. Tor Browser (gitian-firefox.yml) + 4. Pluggable Transports (gitian-pluggable-transports.yml) + 5. Addon and bundle package assembly (gitian-bundle.yml) + + Each stage leaves build artifacts in ../../gitian-builder/inputs/ for use + in later stages. If the artifact files for a given stage are present, that + stage is skipped by a 'make build'. No other dependency checking on build stages is performed. - This means that if any of the source inputs, or the Ubuntu buildchain tools, - or the build tools' dependencies upgrade, your Tor and Firefox inputs will - no longer match those produced by someone else's build from a fresher VM - that downloaded those newer toolchain packages. + If you wish to rebuild only a given stage, there are several 'make clean-' + targets to remove the artifacts for that stage. Running a subsequent + 'make build' after that will rebuild only those targets that have been + cleaned, and then re-package everything again as well. + + Note that if any of the source inputs, or the Ubuntu buildchain tools, or + the build tools' dependencies upgrade, your Tor and Firefox inputs will + no longer match those produced by someone else's build from a fresh build + that downloaded those newer input, dependency, and toolchain packages. - This means for official builds, you should always run 'make clean' (which - is called by the default Makefile target). + This means for official builds, it is a good idea to always run a full + 'make clean' first, or just run 'make'. Known Issues and Quirks: @@ -138,7 +154,8 @@ Known Issues and Quirks: VMs) or 'rm ../../gitian-builder/*lucid*' (to remove the Linux VMs). You probably want to make sure you have no stray qemu processes before - rebuilding the VMs or starting a new build, too. + rebuilding the VMs or starting a new build, too. 'killall qemu-kvm' is + your friend. Once you get a working set of base VMs (in ../../gitian-builder/base-*), you should probably copy them somewhere safe if you want to avoid VM @@ -166,12 +183,6 @@ Known Issues and Quirks: SSH keys of the previous instances' VM, and VM startup will either hang or prompt you for an SSH password). - 6. The number of cpus in the VM images is currently hardcoded at 4. If you - need a different number, please let me know and I will write a patch to - support configuring the number of CPUs easily. - - 7. LXC-built bundles are still not deterministic and may run into other issues. - See TODO file for details. Diagnosing Problems: diff --git a/gitian/TODO b/gitian/TODO index cda7f32..47a1b6f 100644 --- a/gitian/TODO +++ b/gitian/TODO @@ -20,7 +20,6 @@ Short Term: - Refuse to build if `git diff --raw` is non-zero? - Detect arch on Linux - https://trac.torproject.org/projects/tor/ticket/3841 - - Too many libevent libs are included.. Only need a couple Mid Term: - Write a VM test+rebuild script @@ -36,8 +35,6 @@ Mid Term: - Clean up old paths (requires Tor Launcher commits) - Remove FirefoxPortable paths for Windows - Relocate torrc to Library/Tor for MacOS - - DMGs for Mac - https://trac.torproject.org/projects/tor/ticket/4261 - Universal binaries for Mac? - Usability win, but gettor loss (we're at 23M right now) - https://developer.mozilla.org/en-US/docs/Mac_OS_X_Universal_Binaries @@ -48,10 +45,6 @@ Mid Term: - Fix windows issues: - Link to DirectX via Wine (for WebGL) - Weird C++ stdext namespace issues remain :/ - - Accesibility still fails :/ - - https://bugzilla.mozilla.org/show_bug.cgi?id=815581 - - Has conflicts with FF17-ESR :/ - - Can we just pull the whole accessibility dir? - If Tor Launcher fails to load, the browser still can launch - Add browser code to detect missing addons? - Missing/Partial Localization strings can cause this..

1 0

[tor-browser-bundle/master] Also clean the bundle marker files if any stages get cleaned.
by mikeperry＠torproject.org 25 Apr '14

25 Apr '14

commit bc96dc6dfdd3be3872783dd68794fbb5a6023565 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Fri Apr 25 15:39:27 2014 +0200 Also clean the bundle marker files if any stages get cleaned. If someone cleans a stage and then does 'make build', they probably also want to repackage everything after building that stage. --- gitian/Makefile | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/gitian/Makefile b/gitian/Makefile index b24ec53..c81e32c 100644 --- a/gitian/Makefile +++ b/gitian/Makefile @@ -77,20 +77,20 @@ clean: clean-utils clean-tor clean-browser clean-pt clean-bundle rm -f ../../gitian-builder/inputs/bundle.inputs rm -f ../../gitian-builder/inputs/versions* -clean-utils: +clean-utils: clean-bundle rm -f ../../gitian-builder/inputs/*utils.zip -clean-tor: +clean-tor: clean-bundle rm -f ../../gitian-builder/inputs/tor-linux* rm -f ../../gitian-builder/inputs/tor-mac* rm -f ../../gitian-builder/inputs/tor-win* -clean-browser: +clean-browser: clean-bundle rm -f ../../gitian-builder/inputs/tor-browser-linux* rm -f ../../gitian-builder/inputs/tor-browser-mac* rm -f ../../gitian-builder/inputs/tor-browser-win* -clean-pt: +clean-pt: clean-bundle rm -f ../../gitian-builder/inputs/pluggable-transports* clean-bundle:

1 0

[tor-browser-bundle/master] Fix broken nightly due to patch for bug 11200.
by gk＠torproject.org 25 Apr '14

25 Apr '14

commit 6da5650703e7c10f7592232df379963a44fee079 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Apr 25 15:13:32 2014 +0000 Fix broken nightly due to patch for bug 11200. It seems the patch for bug 11200 does not apply cleanly to the latest tor master anymore. Make sure it gets only applied when 0.2.4 is used. --- gitian/descriptors/linux/gitian-tor.yml | 2 +- gitian/descriptors/mac/gitian-tor.yml | 2 +- gitian/descriptors/windows/gitian-tor.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/gitian/descriptors/linux/gitian-tor.yml b/gitian/descriptors/linux/gitian-tor.yml index 5c4ae00..826d355 100644 --- a/gitian/descriptors/linux/gitian-tor.yml +++ b/gitian/descriptors/linux/gitian-tor.yml @@ -78,8 +78,8 @@ script: | git am ~/build/bug11069.patch git am ~/build/bug11156.patch git am ~/build/bug9665.patch + git am ~/build/bug11200.patch fi - git am ~/build/bug11200.patch fi mkdir -p $OUTDIR/src #git archive HEAD | tar -x -C $OUTDIR/src diff --git a/gitian/descriptors/mac/gitian-tor.yml b/gitian/descriptors/mac/gitian-tor.yml index 98668ac..c3ae8d8 100644 --- a/gitian/descriptors/mac/gitian-tor.yml +++ b/gitian/descriptors/mac/gitian-tor.yml @@ -109,8 +109,8 @@ script: | git am ~/build/bug11069.patch git am ~/build/bug11156.patch git am ~/build/bug9665.patch + git am ~/build/bug11200.patch fi - git am ~/build/bug11200.patch fi mkdir -p $OUTDIR/src git archive HEAD | tar -x -C $OUTDIR/src diff --git a/gitian/descriptors/windows/gitian-tor.yml b/gitian/descriptors/windows/gitian-tor.yml index ffac916..5e452b9 100644 --- a/gitian/descriptors/windows/gitian-tor.yml +++ b/gitian/descriptors/windows/gitian-tor.yml @@ -105,8 +105,8 @@ script: | git am ~/build/bug11069.patch git am ~/build/bug11156.patch git am ~/build/bug9665.patch + git am ~/build/bug11200.patch fi - git am ~/build/bug11200.patch fi mkdir -p $OUTDIR/src git archive HEAD | tar -x -C $OUTDIR/src

1 0

[tor-browser-bundle/master] Fix broken nightly due to patch for bug 9229.
by gk＠torproject.org 25 Apr '14

25 Apr '14

commit d984aa174e42c1a1919ed8a763ab33b095067278 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Apr 25 11:46:35 2014 +0000 Fix broken nightly due to patch for bug 9229. It seems the patch for bug 9229 does not apply cleanly to the latest tor master anymore. Make sure it gets only applied when 0.2.4 is used. --- gitian/descriptors/linux/gitian-tor.yml | 2 +- gitian/descriptors/mac/gitian-tor.yml | 2 +- gitian/descriptors/windows/gitian-tor.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/gitian/descriptors/linux/gitian-tor.yml b/gitian/descriptors/linux/gitian-tor.yml index 60a5015..5c4ae00 100644 --- a/gitian/descriptors/linux/gitian-tor.yml +++ b/gitian/descriptors/linux/gitian-tor.yml @@ -71,9 +71,9 @@ script: | git am ~/build/bug10297.patch fi if [ $BUILD_PT_BUNDLES ]; then - git am ~/build/bug9229.patch if [ ${TOR_TAG::9} == "tor-0.2.4" ]; then + git am ~/build/bug9229.patch git am ~/build/bug5018.patch git am ~/build/bug11069.patch git am ~/build/bug11156.patch diff --git a/gitian/descriptors/mac/gitian-tor.yml b/gitian/descriptors/mac/gitian-tor.yml index 3304f76..98668ac 100644 --- a/gitian/descriptors/mac/gitian-tor.yml +++ b/gitian/descriptors/mac/gitian-tor.yml @@ -102,9 +102,9 @@ script: | git am ~/build/bug10297.patch fi if [ $BUILD_PT_BUNDLES ]; then - git am ~/build/bug9229.patch if [ ${TOR_TAG::9} == "tor-0.2.4" ]; then + git am ~/build/bug9229.patch git am ~/build/bug5018.patch git am ~/build/bug11069.patch git am ~/build/bug11156.patch diff --git a/gitian/descriptors/windows/gitian-tor.yml b/gitian/descriptors/windows/gitian-tor.yml index ce4ef63..ffac916 100644 --- a/gitian/descriptors/windows/gitian-tor.yml +++ b/gitian/descriptors/windows/gitian-tor.yml @@ -98,9 +98,9 @@ script: | git am ~/build/bug10297.patch fi if [ $BUILD_PT_BUNDLES ]; then - git am ~/build/bug9229.patch if [ ${TOR_TAG::9} == "tor-0.2.4" ]; then + git am ~/build/bug9229.patch git am ~/build/bug5018.patch git am ~/build/bug11069.patch git am ~/build/bug11156.patch

1 0