- tbb-commits - lists.torproject.org

[tor-browser-bundle/master] Bump nightly versions
by gk＠torproject.org 23 Jun '15

23 Jun '15

commit 19712f39e9ad2051ce3138aecd5640cd9aaa3f78 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Jun 23 11:11:25 2015 +0000 Bump nightly versions Note, we hardcode the Firefox version foe the language packs this time as the branch name of our pre-alpha Tor Browser branch does already contain the ESR version number of the upcoming release. --- gitian/versions.nightly | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 79051b3..6d69c68 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -7,11 +7,11 @@ BUILD_PT_BUNDLES=1 VERIFY_TAGS=0 -FIREFOX_VERSION=31.7.0esr +FIREFOX_VERSION=38.1.0esr TORBROWSER_UPDATE_CHANNEL=default -TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-5.0-2 +TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-5.x-1 TOR_TAG=master TORLAUNCHER_TAG=master TORBUTTON_TAG=master @@ -40,7 +40,7 @@ GITIAN_TAG=tor-browser-builder-3.x-7 OPENSSL_VER=1.0.1o GMP_VER=5.1.3 -FIREFOX_LANG_VER=$FIREFOX_VERSION +FIREFOX_LANG_VER=38.0.1 #$FIREFOX_VERSION FIREFOX_LANG_BUILD=build2 BINUTILS_VER=2.25 GCC_VER=5.1.0 @@ -60,7 +60,7 @@ GO_VER=1.4.2 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 -NOSCRIPT_PACKAGE=noscript_security_suite-2.6.9.26-sm+fn+fx.xpi +NOSCRIPT_PACKAGE=noscript_security_suite-2.6.9.27-sm+fn+fx.xpi TOOLCHAIN4_PACKAGE=x86_64-apple-darwin10.tar.xz TOOLCHAIN4_OLD_PACKAGE=multiarch-darwin11-cctools127.2-gcc42-5666.3-llvmgcc42-2336.1-Linux-120724.tar.xz OSXSDK_PACKAGE=MacOSX10.7.sdk.tar.gz @@ -89,7 +89,7 @@ OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf OSXSDK_OLD_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc TOOLCHAIN4_HASH=7b71bfe02820409b994c5c33a7eab81a81c72550f5da85ff7af70da3da244645 TOOLCHAIN4_OLD_HASH=65c1b2d302358a6b95a26c6828a66908a199276193bb0b268f2dcc1a997731e9 -NOSCRIPT_HASH=06d9fa6093378682a7fabfc0b2d156dfafcfda749ddd802970ce14d1860e6a3e +NOSCRIPT_HASH=a59a2150a4fa03091afd670d86333b60b6516ccd104bcef918afe99460fb436a MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c ARGPARSE_HASH=ddaf4b0a618335a32b6664d4ae038a1de8fbada3b25033f9021510ed2b3941a4

1 0

[tor-browser-bundle/master] Merge branch 'bug_16351'
by gk＠torproject.org 23 Jun '15

23 Jun '15

commit fd538cbe5226b82512e837c378647f83a21d724f Merge: ff23e83 50e6d09 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Jun 23 10:46:47 2015 +0000 Merge branch 'bug_16351' gitian/descriptors/windows/gitian-utils.yml | 3 -- gitian/patches/enable-reloc-section-ld.patch | 53 ++++++++----------- gitian/patches/gcc-dev-random.patch | 72 -------------------------- gitian/patches/peXXigen.patch | 27 +++++----- gitian/versions.alpha | 6 +-- gitian/versions.nightly | 6 +-- 6 files changed, 42 insertions(+), 125 deletions(-)

1 0

[tor-browser-bundle/master] Bug 16351: Update our toolchain (Binutils/GCC)
by gk＠torproject.org 23 Jun '15

23 Jun '15

commit 50e6d095bd8d8eaef460d0bddda9455ff222c685 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Jun 15 14:24:54 2015 +0000 Bug 16351: Update our toolchain (Binutils/GCC) --- gitian/descriptors/windows/gitian-utils.yml | 3 -- gitian/patches/enable-reloc-section-ld.patch | 53 ++++++++----------- gitian/patches/gcc-dev-random.patch | 72 -------------------------- gitian/patches/peXXigen.patch | 27 +++++----- gitian/versions.alpha | 6 +-- gitian/versions.nightly | 6 +-- 6 files changed, 42 insertions(+), 125 deletions(-) diff --git a/gitian/descriptors/windows/gitian-utils.yml b/gitian/descriptors/windows/gitian-utils.yml index bef262d..78da8a7 100644 --- a/gitian/descriptors/windows/gitian-utils.yml +++ b/gitian/descriptors/windows/gitian-utils.yml @@ -28,7 +28,6 @@ files: - "gmp.tar.bz2" - "enable-reloc-section-ld.patch" - "peXXigen.patch" -- "gcc-dev-random.patch" - "versions" - "dzip.sh" script: | @@ -66,8 +65,6 @@ script: | cd gcc tar -xjvf ../gcc.tar.bz2 cd gcc-* - # Don't use /dev/random on Windows. See bug 13169 for details. - patch -p1 < ../../gcc-dev-random.patch cd .. # We don't want to link against msvcrt.dll due to bug 9084. i686-w64-mingw32-g++ -dumpspecs > ~/build/msvcr100.spec diff --git a/gitian/patches/enable-reloc-section-ld.patch b/gitian/patches/enable-reloc-section-ld.patch index f393f51..5845d75 100644 --- a/gitian/patches/enable-reloc-section-ld.patch +++ b/gitian/patches/enable-reloc-section-ld.patch @@ -1,30 +1,23 @@ -From 093b08a9e7af23a258306b710ebc4556d12f94f7 Mon Sep 17 00:00:00 2001 +From 99ffc3f28b964519892cb1fb8bdc64d42b80d777 Mon Sep 17 00:00:00 2001 From: Erinn Clark <erinn(a)torproject.org> Date: Fri, 8 Aug 2014 14:23:44 -0400 Subject: [PATCH] add relocation section so Windows bundles can have ASLR Patch by skruffy. ---- - ld/emultempl/pe.em | 6 +++++ - ld/emultempl/pep.em | 8 ++++++- - ld/pe-dll.c | 63 ++++++++++++++++++++++++++++++----------------------- - ld/pe-dll.h | 1 + - 4 files changed, 50 insertions(+), 28 deletions(-) - diff --git a/ld/emultempl/pe.em b/ld/emultempl/pe.em -index 5d6da9e..14c07f7 100644 +index 979cc8b..4a63863 100644 --- a/ld/emultempl/pe.em +++ b/ld/emultempl/pe.em -@@ -268,6 +268,7 @@ fragment <<EOF - #define OPTION_TERMINAL_SERVER_AWARE (OPTION_WDM_DRIVER + 1) - /* Determinism. */ +@@ -274,6 +274,7 @@ fragment <<EOF #define OPTION_INSERT_TIMESTAMP (OPTION_TERMINAL_SERVER_AWARE + 1) -+#define OPTION_ENABLE_RELOC_SECTION (OPTION_INSERT_TIMESTAMP + 1) + #define OPTION_NO_INSERT_TIMESTAMP (OPTION_INSERT_TIMESTAMP + 1) + #define OPTION_BUILD_ID (OPTION_NO_INSERT_TIMESTAMP + 1) ++#define OPTION_ENABLE_RELOC_SECTION (OPTION_BUILD_ID + 1) static void gld${EMULATION_NAME}_add_options -@@ -310,6 +311,7 @@ gld${EMULATION_NAME}_add_options +@@ -317,6 +318,7 @@ gld${EMULATION_NAME}_add_options {"export-all-symbols", no_argument, NULL, OPTION_EXPORT_ALL}, {"exclude-symbols", required_argument, NULL, OPTION_EXCLUDE_SYMBOLS}, {"exclude-all-symbols", no_argument, NULL, OPTION_EXCLUDE_ALL_SYMBOLS}, @@ -32,7 +25,7 @@ index 5d6da9e..14c07f7 100644 {"exclude-libs", required_argument, NULL, OPTION_EXCLUDE_LIBS}, {"exclude-modules-for-implib", required_argument, NULL, OPTION_EXCLUDE_MODULES_FOR_IMPLIB}, {"kill-at", no_argument, NULL, OPTION_KILL_ATS}, -@@ -773,6 +775,9 @@ gld${EMULATION_NAME}_handle_option (int optc) +@@ -787,6 +789,9 @@ gld${EMULATION_NAME}_handle_option (int optc) case OPTION_EXCLUDE_ALL_SYMBOLS: pe_dll_exclude_all_symbols = 1; break; @@ -42,7 +35,7 @@ index 5d6da9e..14c07f7 100644 case OPTION_EXCLUDE_LIBS: pe_dll_add_excludes (optarg, EXCLUDELIBS); break; -@@ -1839,6 +1844,7 @@ gld_${EMULATION_NAME}_finish (void) +@@ -2059,6 +2064,7 @@ gld_${EMULATION_NAME}_finish (void) if (link_info.shared #if !defined(TARGET_IS_shpe) || (!link_info.relocatable && pe_def_file->num_exports != 0) @@ -51,20 +44,20 @@ index 5d6da9e..14c07f7 100644 ) { diff --git a/ld/emultempl/pep.em b/ld/emultempl/pep.em -index b738800..b566903 100644 +index b24a608..caf2946 100644 --- a/ld/emultempl/pep.em +++ b/ld/emultempl/pep.em -@@ -242,7 +242,8 @@ enum options - OPTION_NO_BIND, - OPTION_WDM_DRIVER, +@@ -248,7 +248,8 @@ enum options OPTION_INSERT_TIMESTAMP, -- OPTION_TERMINAL_SERVER_AWARE -+ OPTION_TERMINAL_SERVER_AWARE, + OPTION_NO_INSERT_TIMESTAMP, + OPTION_TERMINAL_SERVER_AWARE, +- OPTION_BUILD_ID ++ OPTION_BUILD_ID, + OPTION_ENABLE_RELOC_SECTION }; static void -@@ -284,6 +285,7 @@ gld${EMULATION_NAME}_add_options +@@ -290,6 +291,7 @@ gld${EMULATION_NAME}_add_options {"export-all-symbols", no_argument, NULL, OPTION_EXPORT_ALL}, {"exclude-symbols", required_argument, NULL, OPTION_EXCLUDE_SYMBOLS}, {"exclude-all-symbols", no_argument, NULL, OPTION_EXCLUDE_ALL_SYMBOLS}, @@ -72,7 +65,7 @@ index b738800..b566903 100644 {"exclude-libs", required_argument, NULL, OPTION_EXCLUDE_LIBS}, {"exclude-modules-for-implib", required_argument, NULL, OPTION_EXCLUDE_MODULES_FOR_IMPLIB}, {"kill-at", no_argument, NULL, OPTION_KILL_ATS}, -@@ -727,6 +729,9 @@ gld${EMULATION_NAME}_handle_option (int optc) +@@ -743,6 +745,9 @@ gld${EMULATION_NAME}_handle_option (int optc) case OPTION_EXCLUDE_ALL_SYMBOLS: pep_dll_exclude_all_symbols = 1; break; @@ -82,7 +75,7 @@ index b738800..b566903 100644 case OPTION_EXCLUDE_LIBS: pep_dll_add_excludes (optarg, EXCLUDELIBS); break; -@@ -1618,6 +1623,7 @@ gld_${EMULATION_NAME}_finish (void) +@@ -1838,6 +1843,7 @@ gld_${EMULATION_NAME}_finish (void) #ifdef DLL_SUPPORT if (link_info.shared @@ -91,10 +84,10 @@ index b738800..b566903 100644 { pep_dll_fill_sections (link_info.output_bfd, &link_info); diff --git a/ld/pe-dll.c b/ld/pe-dll.c -index e9e133b..4230dc3 100644 +index 61d8fa5..24c0c72 100644 --- a/ld/pe-dll.c +++ b/ld/pe-dll.c -@@ -152,6 +152,7 @@ def_file * pe_def_file = 0; +@@ -151,6 +151,7 @@ def_file * pe_def_file = 0; int pe_dll_export_everything = 0; int pe_dll_exclude_all_symbols = 0; int pe_dll_do_default_excludes = 1; @@ -200,10 +193,10 @@ index e9e133b..4230dc3 100644 bfd_boolean diff --git a/ld/pe-dll.h b/ld/pe-dll.h -index 4697390..2bf71d9 100644 +index 24ea302..6a0d633 100644 --- a/ld/pe-dll.h +++ b/ld/pe-dll.h -@@ -31,6 +31,7 @@ extern def_file *pe_def_file; +@@ -30,6 +30,7 @@ extern def_file *pe_def_file; extern int pe_dll_export_everything; extern int pe_dll_exclude_all_symbols; extern int pe_dll_do_default_excludes; @@ -212,5 +205,5 @@ index 4697390..2bf71d9 100644 extern int pe_dll_stdcall_aliases; extern int pe_dll_warn_dup_exports; -- -2.0.1 +1.7.9.5 diff --git a/gitian/patches/gcc-dev-random.patch b/gitian/patches/gcc-dev-random.patch deleted file mode 100644 index 9757f92..0000000 --- a/gitian/patches/gcc-dev-random.patch +++ /dev/null @@ -1,72 +0,0 @@ -From b0ce14899060267b5b5e4d7e3d91edcdf5c09514 Mon Sep 17 00:00:00 2001 -From: law <law@138bc75d-0d04-0410-961f-82ee72b054a4> -Date: Tue, 10 Feb 2015 01:44:08 +0000 -Subject: [PATCH] * ssp.c (__guard_setup): For Windows, use approved methods - to get a suitable random number for the stack check guard - rather than reading /dev/random. - -git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/trunk@220559 138bc75d-0d04-0410-961f-82ee72b054a4 ---- - libssp/ChangeLog | 7 +++++++ - libssp/ssp.c | 16 ++++++++++++++++ - 2 files changed, 23 insertions(+) - -diff --git a/libssp/ChangeLog b/libssp/ChangeLog -index a445537..676d2a7 100644 ---- a/libssp/ChangeLog -+++ b/libssp/ChangeLog -@@ -1,3 +1,10 @@ -+2015-02-09 Georg Koppen <gk(a)torproject.org> -+ -+ * ssp.c: Conditionally include <windows.h> -+ (__guard_setup): For Windows, use approved methods to get -+ a suitable random number for the stack check guard rather -+ than reading /dev/random. -+ - 2014-07-16 Release Manager - - * GCC 4.9.1 released. -diff --git a/libssp/ssp.c b/libssp/ssp.c -index 96adf17..38e3ec8 100644 ---- a/libssp/ssp.c -+++ b/libssp/ssp.c -@@ -55,6 +55,7 @@ see the files COPYING3 and COPYING.RUNTIME respectively. If not, see - /* Native win32 apps don't know about /dev/tty but can print directly - to the console using "CONOUT$" */ - #if defined (_WIN32) && !defined (__CYGWIN__) -+#include <windows.h> - # define _PATH_TTY "CONOUT$" - #else - # define _PATH_TTY "/dev/tty" -@@ -75,6 +76,20 @@ __guard_setup (void) - if (__stack_chk_guard != 0) - return; - -+#if defined (_WIN32) && !defined (__CYGWIN__) -+ HCRYPTPROV hprovider = 0; -+ if (CryptAcquireContext(&hprovider, NULL, NULL, PROV_RSA_FULL, -+ CRYPT_VERIFYCONTEXT | CRYPT_SILENT)) -+ { -+ if (CryptGenRandom(hprovider, sizeof (__stack_chk_guard), -+ (BYTE *)&__stack_chk_guard) && __stack_chk_guard != 0) -+ { -+ CryptReleaseContext(hprovider, 0); -+ return; -+ } -+ CryptReleaseContext(hprovider, 0); -+ } -+#else - fd = open ("/dev/urandom", O_RDONLY); - if (fd != -1) - { -@@ -85,6 +100,7 @@ __guard_setup (void) - return; - } - -+#endif - /* If a random generator can't be used, the protector switches the guard - to the "terminator canary". */ - p = (unsigned char *) &__stack_chk_guard; --- -1.7.10.4 - diff --git a/gitian/patches/peXXigen.patch b/gitian/patches/peXXigen.patch index 785aa02..0ae0979 100644 --- a/gitian/patches/peXXigen.patch +++ b/gitian/patches/peXXigen.patch @@ -1,14 +1,13 @@ -diff -crB binutils-2.24/bfd/peXXigen.c binutils-2.24/bfd/peXXigen.c -*** binutils-2.24/bfd/peXXigen.c Tue Nov 26 11:37:33 2013 ---- binutils-2.24/bfd/peXXigen.c Mon Aug 4 07:10:15 2014 -*************** -*** 795,800 **** ---- 795,802 ---- - /* Only use a real timestamp if the option was chosen. */ - if ((pe_data (abfd)->insert_timestamp)) - H_PUT_32 (abfd, time(0), filehdr_out->f_timdat); -+ else -+ H_PUT_32 (abfd, 0, filehdr_out->f_timdat); - - PUT_FILEHDR_SYMPTR (abfd, filehdr_in->f_symptr, - filehdr_out->f_symptr); +diff --git a/bfd/peXXigen.c b/bfd/peXXigen.c +index 13e39e4..deef7b3 100644 +--- a/bfd/peXXigen.c ++++ b/bfd/peXXigen.c +@@ -873,6 +873,8 @@ _bfd_XXi_only_swap_filehdr_out (bfd * abfd, void * in, void * out) + /* Only use a real timestamp if the option was chosen. */ + if ((pe_data (abfd)->insert_timestamp)) + H_PUT_32 (abfd, time (0), filehdr_out->f_timdat); ++ else ++ H_PUT_32 (abfd, 0, filehdr_out->f_timdat); + + PUT_FILEHDR_SYMPTR (abfd, filehdr_in->f_symptr, + filehdr_out->f_symptr); diff --git a/gitian/versions.alpha b/gitian/versions.alpha index d34f0af..d883b0e 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -39,8 +39,8 @@ OPENSSL_VER=1.0.1n GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION FIREFOX_LANG_BUILD=build2 -BINUTILS_VER=2.24 -GCC_VER=4.9.1 +BINUTILS_VER=2.25 +GCC_VER=5.1.0 PYTHON_VER=2.7.5 PYCRYPTO_VER=2.6.1 ARGPARSE_VER=1.2.1 @@ -96,7 +96,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO_HASH=299a6fd8f8adfdce15bc06bde926e7b252ae8e24dd5b16b7d8791ed79e7b5e9b -GCC_HASH=d334781a124ada6f38e63b545e2a3b8c2183049515a1abab6d513f109f1d717e +GCC_HASH=b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad ## Non-git package URLs OPENSSL_URL=https://www.openssl.org/source/${OPENSSL_PACKAGE} diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 5a8eb91..73f8f73 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -42,8 +42,8 @@ OPENSSL_VER=1.0.1m GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION FIREFOX_LANG_BUILD=build2 -BINUTILS_VER=2.24 -GCC_VER=4.9.1 +BINUTILS_VER=2.25 +GCC_VER=5.1.0 PYTHON_VER=2.7.5 PYCRYPTO_VER=2.6.1 ARGPARSE_VER=1.2.1 @@ -99,7 +99,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO_HASH=299a6fd8f8adfdce15bc06bde926e7b252ae8e24dd5b16b7d8791ed79e7b5e9b -GCC_HASH=d334781a124ada6f38e63b545e2a3b8c2183049515a1abab6d513f109f1d717e +GCC_HASH=b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad ## Non-git package URLs OPENSSL_URL=https://www.openssl.org/source/${OPENSSL_PACKAGE}

1 0

[tor-browser-bundle/master] Merge branch 'bug_16210'
by gk＠torproject.org 23 Jun '15

23 Jun '15

commit 6807f337314448d287a10d92516817fbae1cf5f4 Merge: d0bc63e ccb9a00 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Jun 23 09:39:12 2015 +0000 Merge branch 'bug_16210' gitian/descriptors/linux/gitian-firefox.yml | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)

1 0

[tor-browser-bundle/master] Bug 16210: Fix paths and stripping for ESR 38
by gk＠torproject.org 23 Jun '15

23 Jun '15

commit ccb9a005e959b9812b654a9fd0c9d4937e051030 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Jun 17 09:04:34 2015 +0000 Bug 16210: Fix paths and stripping for ESR 38 In addition to fixing broken paths and stripping Linux binaries we exempt |python 2.7| from libfaketime due to #13877, too. --- gitian/descriptors/linux/gitian-firefox.yml | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index e7c8bfa..05b2beb 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -38,7 +38,6 @@ files: script: | source versions INSTDIR="$HOME/install" - export LIBRARY_PATH="$INSTDIR/lib" export CFLAGS="-frandom-seed=tor" export CXXFLAGS="-frandom-seed=tor" export TZ=UTC @@ -91,6 +90,7 @@ script: | # mkdir -p $INSTDIR/Browser/ mkdir -p $INSTDIR/Debug/Browser/components + mkdir -p $INSTDIR/Debug/Browser/browser/components # Building libfaketime cd faketime @@ -115,9 +115,10 @@ script: | # BUT we need to exclude |make build| from it. Otherwise the build fails close # to the end, see #12461 comment 8 and later. Additionally, we need to avoid # breaking the ICU compilation. Exlcuding |bash| helps here. See #12461 - # comment 13. + # comment 13. Finally, we need to exclude |python2.7| as not doing so would + # stall the build right at the beginning. See #13877. export LD_PRELOAD="$INSTDIR/faketime/usr/local/lib/faketime/libfaketime.so.1" - export FAKETIME_SKIP_CMDS="bash,make" + export FAKETIME_SKIP_CMDS="python2.7,bash,make" find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" make BUILD_HOSTNAME="gitian" $MAKEOPTS -f client.mk build # Packaging is broken with libfaketime enabled, thus we disable it again. See @@ -158,9 +159,9 @@ script: | cp -p mar-tools-linux${GBUILD_BITS}.zip $OUTDIR/ # # Strip and generate debuginfo for the firefox binary that we keep, all *.so - # files, and the plugin-container (see ticket #10126) + # files, the plugin-container, and the updater (see ticket #10126) cd $INSTDIR - for LIB in Browser/*.so Browser/webapprt-stub Browser/mozilla-xremote-client Browser/firefox Browser/plugin-container Browser/components/*.so # Browser/updater + for LIB in Browser/*.so Browser/webapprt-stub Browser/firefox Browser/plugin-container Browser/components/*.so Browser/browser/components/*.so Browser/updater do objcopy --only-keep-debug $LIB Debug/$LIB strip $LIB

1 0

[tor-browser-bundle/master] Bug 16181: Gitian changes for ESR 38 on OS X
by gk＠torproject.org 23 Jun '15

23 Jun '15

commit ff23e83bcc9e5ade5fcbf954c449446c4044df78 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Jun 23 10:40:20 2015 +0000 Bug 16181: Gitian changes for ESR 38 on OS X --- gitian/descriptors/mac/gitian-bundle.yml | 86 ++++++++------------- gitian/descriptors/mac/gitian-firefox.yml | 46 ++++++------ gitian/descriptors/mac/gitian-utils.yml | 115 +++++++++++++++++------------ gitian/fetch-inputs.sh | 6 +- gitian/mkbundle-mac.sh | 5 +- gitian/patches/libfaketime.patch | 54 ++++++++++++++ gitian/verify-tags.sh | 4 +- gitian/versions | 6 +- gitian/versions.alpha | 6 +- gitian/versions.nightly | 6 +- 10 files changed, 196 insertions(+), 138 deletions(-) diff --git a/gitian/descriptors/mac/gitian-bundle.yml b/gitian/descriptors/mac/gitian-bundle.yml index 61a024b..255d327 100644 --- a/gitian/descriptors/mac/gitian-bundle.yml +++ b/gitian/descriptors/mac/gitian-bundle.yml @@ -64,13 +64,8 @@ script: | export TORBROWSER_VERSION=`cat bare-version` export LC_ALL=C umask 0022 - if [ ${TORBROWSER_VERSION::3} == "3.5" ]; then - export TORBROWSER_APP="TorBrowserBundle" - export TORBROWSER_NAME="TorBrowserBundle" - else - export TORBROWSER_APP="TorBrowser" - export TORBROWSER_NAME="TorBrowserBundle" - fi + export TORBROWSER_APP="TorBrowser" + export TORBROWSER_NAME="TorBrowserBundle" # # Extract the MAR tools. unzip -d ~/build ~/build/mar-tools-mac$GBUILD_BITS.zip @@ -161,7 +156,7 @@ script: | tar -Jxvf ~/build/dmg-applications.tar.xz cd .. # - pushd $TORBROWSER_NAME.app/Contents/MacOS/browser/ + pushd $TORBROWSER_NAME.app/Contents/Resources/browser/ unzip omni.ja defaults/preferences/000-tor-browser.js cp defaults/preferences/000-tor-browser.js ~/build/ # Set the locale of the bundle. @@ -179,27 +174,21 @@ script: | unzip ~/build/TorBrowser.app.meek-http-helper.zip popd # - if [ ${TORBROWSER_VERSION::3} == "3.5" ]; then - cp -a ~/build/$TORBROWSER_NAME.app ~/build/${TORBROWSER_NAME}_en-US.app - ~/build/dzip.sh $OUTDIR/TorBrowserBundle-${TORBROWSER_VERSION}-osx${GBUILD_BITS}_en-US.zip ${TORBROWSER_NAME}_en-US.app - rm -rf ~/build/${TORBROWSER_NAME}_en-US.app - else - # XXX: We need to insert these placeholders because otherwise mkisofs won't - # include these otherwise empty dirs: - touch ~/build/$TORBROWSER_NAME.app/TorBrowser/Data/Browser/Caches/placeholder.txt - # Recreate precomplete file (needs to be accurate for full MAR updates). - pushd ~/build/$TORBROWSER_NAME.app/ - rm -f precomplete - python $MARTOOLS/createprecomplete.py - popd - # - # Create full MAR file and disk image. - MAR_FILE=tor-browser-osx${GBUILD_BITS}-${TORBROWSER_VERSION}_en-US.mar - MAR=$MARTOOLS/mar MBSDIFF=$MARTOOLS/mbsdiff $MARTOOLS/make_full_update.sh -q $OUTDIR/$MAR_FILE ~/build/$TORBROWSER_NAME.app - cp -a ~/build/$TORBROWSER_NAME.app ~/build/dmg/$TORBROWSER_APP.app - ~/build/ddmg.sh $OUTDIR/TorBrowser-${TORBROWSER_VERSION}-osx${GBUILD_BITS}_en-US.dmg ~/build/dmg - rm -rf ~/build/dmg/$TORBROWSER_APP.app - fi + # XXX: We need to insert these placeholders because otherwise mkisofs won't + # include these otherwise empty dirs: + touch ~/build/$TORBROWSER_NAME.app/TorBrowser/Data/Browser/Caches/placeholder.txt + # Recreate precomplete file (needs to be accurate for full MAR updates). + pushd ~/build/$TORBROWSER_NAME.app/Contents/Resources/ + rm -f precomplete + python $MARTOOLS/createprecomplete.py + popd + # + # Create full MAR file and disk image. + MAR_FILE=tor-browser-osx${GBUILD_BITS}-${TORBROWSER_VERSION}_en-US.mar + MAR=$MARTOOLS/mar MBSDIFF=$MARTOOLS/mbsdiff $MARTOOLS/make_full_update.sh -q $OUTDIR/$MAR_FILE ~/build/$TORBROWSER_NAME.app + cp -a ~/build/$TORBROWSER_NAME.app ~/build/dmg/$TORBROWSER_APP.app + ~/build/ddmg.sh $OUTDIR/TorBrowser-${TORBROWSER_VERSION}-osx${GBUILD_BITS}_en-US.dmg ~/build/dmg + rm -rf ~/build/dmg/$TORBROWSER_APP.app mv $TORBROWSER_NAME.app ${TORBROWSER_NAME}_plain.app # unzip mac-langpacks.zip @@ -207,16 +196,12 @@ script: | for LANG in $BUNDLE_LOCALES do xpi=$LANG.xpi - if [ ${TORBROWSER_VERSION::3} == "3.5" ]; then - DEST=${TORBROWSER_APP}_$LANG - else - DEST=$TORBROWSER_APP - fi + DEST=$TORBROWSER_APP cp -a ../${TORBROWSER_NAME}_plain.app ~/build/dmg/$DEST.app cp $xpi ~/build/dmg/$DEST.app/TorBrowser/Data/Browser/profile.default/extensions/langpack-$LANG(a)firefox.mozilla.org.xpi cd .. - pushd ~/build/dmg/$DEST.app/Contents/MacOS/browser/ + pushd ~/build/dmg/$DEST.app/Contents/Resources/browser/ mkdir -p defaults/preferences cp ~/build/000-tor-browser.js defaults/preferences/ # Set the locale of the bundle. @@ -225,28 +210,19 @@ script: | rm -rf defaults popd - # Set the update.locale (it is used to replace %LOCALE% within app.update.url). - pushd ~/build/dmg/$DEST.app/Contents/MacOS/ + # Set the update.locale (it is used to replace %LOCALE% within + # app.update.url) and recreate the precomplete file (needs to be accurate + # for full MAR updates). + pushd ~/build/dmg/$DEST.app/Contents/Resources/ echo "$LANG" > update.locale zip -Xm omni.ja update.locale + rm -f precomplete + python $MARTOOLS/createprecomplete.py popd - - if [ ${TORBROWSER_VERSION::3} == "3.5" ]; then - pushd ~/build/dmg/ - ~/build/dzip.sh $OUTDIR/TorBrowserBundle-${TORBROWSER_VERSION}-osx${GBUILD_BITS}_$LANG.zip $DEST.app - rm -rf TorBrowserBundle_$LANG.app - popd - else - # Recreate precomplete file (needs to be accurate for full MAR updates). - pushd ~/build/dmg/$DEST.app/ - rm -f precomplete - python $MARTOOLS/createprecomplete.py - popd - # - MAR_FILE=tor-browser-osx${GBUILD_BITS}-${TORBROWSER_VERSION}_$LANG.mar - MAR=$MARTOOLS/mar MBSDIFF=$MARTOOLS/mbsdiff $MARTOOLS/make_full_update.sh -q $OUTDIR/$MAR_FILE ~/build/dmg/$DEST.app - ~/build/ddmg.sh $OUTDIR/TorBrowser-${TORBROWSER_VERSION}-osx${GBUILD_BITS}_$LANG.dmg ~/build/dmg/ - rm -rf ~/build/dmg/$DEST.app - fi + # + MAR_FILE=tor-browser-osx${GBUILD_BITS}-${TORBROWSER_VERSION}_$LANG.mar + MAR=$MARTOOLS/mar MBSDIFF=$MARTOOLS/mbsdiff $MARTOOLS/make_full_update.sh -q $OUTDIR/$MAR_FILE ~/build/dmg/$DEST.app + ~/build/ddmg.sh $OUTDIR/TorBrowser-${TORBROWSER_VERSION}-osx${GBUILD_BITS}_$LANG.dmg ~/build/dmg/ + rm -rf ~/build/dmg/$DEST.app cd mac-langpacks done diff --git a/gitian/descriptors/mac/gitian-firefox.yml b/gitian/descriptors/mac/gitian-firefox.yml index e7a4dcb..e8f1046 100644 --- a/gitian/descriptors/mac/gitian-firefox.yml +++ b/gitian/descriptors/mac/gitian-firefox.yml @@ -16,11 +16,13 @@ remotes: - "url": "https://github.com/wolfcw/libfaketime" "dir": "faketime" files: -- "apple-uni-sdk-10.6_20110407-0.flosoft1_i386.deb" +- "gcc-linux64-precise-utils.zip" +- "MacOSX10.7.sdk.tar.gz" - "x86_64-apple-darwin10.tar.xz" - "re-dzip.sh" - "dzip.sh" - "fix-info-plist.py" +- "libfaketime.patch" - "versions" script: | INSTDIR="$HOME/install/" @@ -34,25 +36,26 @@ script: | # Building libfaketime. cd faketime + export GIT_COMMITTER_NAME="nobody" + export GIT_COMMITTER_EMAIL="nobody@localhost" + export GIT_COMMITTER_DATE="$REFERENCE_DATETIME" + git am ~/build/libfaketime.patch make DESTDIR="$INSTDIR/faketime" make install export LD_PRELOAD="$INSTDIR/faketime/usr/local/lib/faketime/libfaketime.so.1" export FAKETIME=$REFERENCE_DATETIME cd .. - sudo dpkg -i *.deb - tar -xavf x86_64-apple-darwin10.tar.xz - # XXX: Needed for the otool patch. But we should replace that one with a - # better solution. See: comment 15 in - # https://bugzilla.mozilla.org/show_bug.cgi?id=936115 - export PATH=$PATH:/home/ubuntu/build/x-tools/x86_64-apple-darwin10/bin - # FIXME: path hacks: - sudo mkdir -p /System/Library/ - sudo ln -s /usr/lib/apple/SDKs/MacOSX10.6.sdk /usr/lib/apple/SDKs/MacOSX10.5.sdk - sudo ln -s /usr/lib/apple/SDKs/MacOSX10.6.sdk /usr/lib/apple/SDKs/MacOSX10.5.sdk - sudo ln -s /usr/lib/apple/SDKs/MacOSX10.6.sdk/System/Library/Frameworks/ /System/Library/ - sudo ln -s /usr/lib/apple/SDKs/MacOSX10.6.sdk/System/Library/PrivateFrameworks/ /System/Library/ - sudo ln -s /usr/lib/apple/SDKs/MacOSX10.6.sdk/usr/lib/libstdc++.6.dylib /usr/lib/apple/SDKs/MacOSX10.6.sdk/usr/lib/libstdc++.dylib + unzip -d $INSTDIR ~/build/gcc-linux64-precise-utils.zip + # We need a link to our GCC, otherwise the system cc gets used which points to + # /usr/bin/gcc. + ln -s gcc $INSTDIR/gcc/bin/cc + export LD_LIBRARY_PATH=$INSTDIR/gcc/lib64 + # XXX: cross-compiler path is needed for ICU + export PATH=/home/ubuntu/build/x-tools/x86_64-apple-darwin10/bin:$INSTDIR/gcc/bin:$PATH + + tar xaf x86_64-apple-darwin10.tar.xz + tar xaf MacOSX10.7.sdk.tar.gz # cd tor-browser mv .mozconfig-mac .mozconfig @@ -72,11 +75,10 @@ script: | # BUT we need to exclude |make build| from it. Otherwise the build fails close # to the end, see #12812 comment 6 and #12461 comment 8 and later. # Additionally, we need to exclude |rsync| due to #10153 which is reproducible - # reliably with the new libfaketime. + # reliably with the new libfaketime and |python2.7| as well as the build would + # stall otherwise right at the beginning. See #13877 for details. export LD_PRELOAD="$INSTDIR/faketime/usr/local/lib/faketime/libfaketime.so.1" - # XXX Order matters as for some reason the env variable has only the first - # command assigned when it comes to the rsync parts in the build process. - export FAKETIME_SKIP_CMDS="rsync,make" + export FAKETIME_SKIP_CMDS="python2.7,rsync,make" make BUILD_HOSTNAME="gitian" $MAKEOPTS -f client.mk build # make -C obj-macos package INNER_MAKE_PACKAGE=true @@ -101,11 +103,9 @@ script: | mv $INFO_PLIST tmp.plist ~/build/fix-info-plist.py $TORBROWSER_VERSION < tmp.plist > $INFO_PLIST rm -f tmp.plist - ~/build/re-dzip.sh TorBrowser.app/Contents/MacOS/omni.ja - ~/build/re-dzip.sh TorBrowser.app/Contents/MacOS/webapprt/omni.ja - if [ -f TorBrowser.app/Contents/MacOS/browser/omni.ja ]; then # FF24 includes a third .ja - ~/build/re-dzip.sh TorBrowser.app/Contents/MacOS/browser/omni.ja - fi + ~/build/re-dzip.sh TorBrowser.app/Contents/Resources/omni.ja + ~/build/re-dzip.sh TorBrowser.app/Contents/Resources/webapprt/omni.ja + ~/build/re-dzip.sh TorBrowser.app/Contents/Resources/browser/omni.ja cd TorBrowser.app/ ~/build/dzip.sh tor-browser-mac${GBUILD_BITS}-gbuilt.zip ./Contents cp tor-browser-mac${GBUILD_BITS}-gbuilt.zip $OUTDIR diff --git a/gitian/descriptors/mac/gitian-utils.yml b/gitian/descriptors/mac/gitian-utils.yml index 6d93817..c47767e 100644 --- a/gitian/descriptors/mac/gitian-utils.yml +++ b/gitian/descriptors/mac/gitian-utils.yml @@ -4,11 +4,14 @@ suites: - "precise" architectures: - "i386" +- "amd64" packages: - "faketime" - "automake" - "libtool" - "zip" +# Needed for compiling GCC. +- "libmpc-dev" reference_datetime: "2000-01-01 00:00:00" remotes: - "url": "https://github.com/libevent/libevent.git" @@ -16,6 +19,7 @@ remotes: files: - "apple-uni-sdk-10.6_20110407-0.flosoft1_i386.deb" - "multiarch-darwin11-cctools127.2-gcc42-5666.3-llvmgcc42-2336.1-Linux-120724.tar.xz" +- "gcc.tar.bz2" - "openssl.tar.gz" - "gmp.tar.bz2" - "versions" @@ -23,61 +27,76 @@ files: script: | INSTDIR="$HOME/install" source versions - export LD_PRELOAD=/usr/lib/faketime/libfaketime.so.1 - export FAKETIME=$REFERENCE_DATETIME export TZ=UTC export LC_ALL=C umask 0022 - sudo dpkg -i *.deb - tar xaf multiarch-darwin*tar.xz - export PATH="$PATH:$HOME/build/apple-osx/bin/" - # For OpenSSL - ln -s ~/build/apple-osx/bin/apple-osx-gcc ~/build/apple-osx/bin/i686-apple-darwin11-cc - #For gmp, need to trick it so it knows we're doing a 64 bit build - for i in ~/build/apple-osx/bin/i686-apple-darwin11-*; do j=`echo $i | sed 's/i686/x86_64/'`; ln -s $i $j; done; + if [ $GBUILD_BITS == "64" ]; + then + # Building GCC. We need this as Firefox ESR 38 has GCC 4.7 as minimum + # requirement for the host compiler but Ubuntu Precise is only shipping 4.6. + tar xaf gcc.tar.bz2 + cd gcc-* + ./configure --prefix=$INSTDIR/gcc --disable-multilib --enable-languages=c,c++ + make $MAKEOPTS + make install + cd $INSTDIR + ~/build/dzip.sh gcc-$GCC_VER-linux64-precise-utils.zip gcc + cp *utils.zip $OUTDIR/ + else + export LD_PRELOAD=/usr/lib/faketime/libfaketime.so.1 + export FAKETIME=$REFERENCE_DATETIME - # XXX Clean up these flags? - export CFLAGS="-m64 -I/usr/lib/apple/SDKs/MacOSX10.6.sdk/usr/include/ -I/usr/lib/gcc/i686-apple-darwin10/4.2.1/include/ -I. -L/usr/lib/apple/SDKs/MacOSX10.6.sdk/usr/lib/ -L/usr/lib/apple/SDKs/MacOSX10.6.sdk/usr/lib/system/ -mmacosx-version-min=10.5" - export CXXFLAGS="-m64 -I/usr/lib/apple/SDKs/MacOSX10.6.sdk/usr/include/ -I/usr/lib/gcc/i686-apple-darwin10/4.2.1/include/ -I. -L/usr/lib/apple/SDKs/MacOSX10.6.sdk/usr/lib/ -L/usr/lib/apple/SDKs/MacOSX10.6.sdk/usr/lib/system/ -L/usr/lib/apple/SDKs/MacOSX10.6.sdk/usr/lib/i686-apple-darwin10/4.2.1 -mmacosx-version-min=10.5" - export LDFLAGS="-L/usr/lib/apple/SDKs/MacOSX10.6.sdk/usr/lib/ -L/usr/lib/apple/SDKs/MacOSX10.6.sdk/usr/lib/system/ -mmacosx-version-min=10.5" + sudo dpkg -i *.deb + tar xaf multiarch-darwin*tar.xz + export PATH="$PATH:$HOME/build/apple-osx/bin/" + # For OpenSSL + ln -s ~/build/apple-osx/bin/apple-osx-gcc ~/build/apple-osx/bin/i686-apple-darwin11-cc + #For gmp, need to trick it so it knows we're doing a 64 bit build + for i in ~/build/apple-osx/bin/i686-apple-darwin11-*; do j=`echo $i | sed 's/i686/x86_64/'`; ln -s $i $j; done; - # Building Libevent - cd libevent - ./autogen.sh - find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" - ./configure --disable-static --host=i686-apple-darwin11 --prefix=$INSTDIR/libevent - make $MAKEOPTS - make install - cd .. + # XXX Clean up these flags? + export CFLAGS="-m64 -I/usr/lib/apple/SDKs/MacOSX10.6.sdk/usr/include/ -I/usr/lib/gcc/i686-apple-darwin10/4.2.1/include/ -I. -L/usr/lib/apple/SDKs/MacOSX10.6.sdk/usr/lib/ -L/usr/lib/apple/SDKs/MacOSX10.6.sdk/usr/lib/system/ -mmacosx-version-min=10.5" + export CXXFLAGS="-m64 -I/usr/lib/apple/SDKs/MacOSX10.6.sdk/usr/include/ -I/usr/lib/gcc/i686-apple-darwin10/4.2.1/include/ -I. -L/usr/lib/apple/SDKs/MacOSX10.6.sdk/usr/lib/ -L/usr/lib/apple/SDKs/MacOSX10.6.sdk/usr/lib/system/ -L/usr/lib/apple/SDKs/MacOSX10.6.sdk/usr/lib/i686-apple-darwin10/4.2.1 -mmacosx-version-min=10.5" + export LDFLAGS="-L/usr/lib/apple/SDKs/MacOSX10.6.sdk/usr/lib/ -L/usr/lib/apple/SDKs/MacOSX10.6.sdk/usr/lib/system/ -mmacosx-version-min=10.5" - # Building OpenSSL - tar xzf openssl.tar.gz - cd openssl-* - find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" - # TODO: Add enable-ec_nistp_64_gcc_128 for 64bit OS X. - ./Configure --cross-compile-prefix=i686-apple-darwin11- $CFLAGS darwin64-x86_64-cc --prefix=$INSTDIR/openssl enable-ec_nistp_64_gcc_128 - # Using $MAKEOPTS breaks the build. Might be the issue mentioned on - # http://cblfs.cross-lfs.org/index.php/OpenSSL. - make - make install - cd .. + # Building Libevent + cd libevent + ./autogen.sh + find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" + ./configure --disable-static --host=i686-apple-darwin11 --prefix=$INSTDIR/libevent + make $MAKEOPTS + make install + cd .. - # Building GMP - tar xjf gmp.tar.bz2 - cd gmp-* - find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" - # Even if we are not shipping libgmpxx anymore we still need --enable-xcc - # during compile time. - ./configure --host=x86_64-apple-darwin11 --prefix=$INSTDIR/gmp --disable-static --enable-shared --enable-cxx - make - make install - cd .. + # Building OpenSSL + tar xzf openssl.tar.gz + cd openssl-* + find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" + # TODO: Add enable-ec_nistp_64_gcc_128 for 64bit OS X. + ./Configure --cross-compile-prefix=i686-apple-darwin11- $CFLAGS darwin64-x86_64-cc --prefix=$INSTDIR/openssl enable-ec_nistp_64_gcc_128 + # Using $MAKEOPTS breaks the build. Might be the issue mentioned on + # http://cblfs.cross-lfs.org/index.php/OpenSSL. + make + make install + cd .. - # Grabbing the results - cd $INSTDIR - ~/build/dzip.sh openssl-$OPENSSL_VER-mac64-utils.zip openssl - ~/build/dzip.sh libevent-${LIBEVENT_TAG#release-}-mac64-utils.zip libevent - ~/build/dzip.sh gmp-$GMP_VER-mac64-utils.zip gmp + # Building GMP + tar xjf gmp.tar.bz2 + cd gmp-* + find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" + # Even if we are not shipping libgmpxx anymore we still need --enable-xcc + # during compile time. + ./configure --host=x86_64-apple-darwin11 --prefix=$INSTDIR/gmp --disable-static --enable-shared --enable-cxx + make + make install + cd .. - cp *utils.zip $OUTDIR/ + # Grabbing the results + cd $INSTDIR + ~/build/dzip.sh openssl-$OPENSSL_VER-mac64-utils.zip openssl + ~/build/dzip.sh libevent-${LIBEVENT_TAG#release-}-mac64-utils.zip libevent + ~/build/dzip.sh gmp-$GMP_VER-mac64-utils.zip gmp + + cp *utils.zip $OUTDIR/ + fi diff --git a/gitian/fetch-inputs.sh b/gitian/fetch-inputs.sh index 63460e8..2a5bd16 100755 --- a/gitian/fetch-inputs.sh +++ b/gitian/fetch-inputs.sh @@ -132,7 +132,7 @@ do fi done -for i in TOOLCHAIN4 TOOLCHAIN4_OLD OSXSDK MSVCR100 +for i in TOOLCHAIN4 TOOLCHAIN4_OLD OSXSDK OSXSDK_OLD MSVCR100 do PACKAGE="${i}_PACKAGE" URL="${MIRROR_URL}${!PACKAGE}" @@ -166,8 +166,8 @@ done wget -U "" -N ${NOSCRIPT_URL} # Verify packages with weak or no signatures via direct sha256 check -# (OpenSSL is signed with MD5, and OSXSDK is not signed at all) -for i in OSXSDK TOOLCHAIN4 TOOLCHAIN4_OLD NOSCRIPT MSVCR100 PYCRYPTO ARGPARSE PYYAML ZOPEINTERFACE TWISTED M2CRYPTO SETUPTOOLS OPENSSL GMP PARSLEY GO GCC +# (OpenSSL is signed with MD5, and OSXSDK + OSXSDK_OLD are not signed at all) +for i in OSXSDK OSXSDK_OLD TOOLCHAIN4 TOOLCHAIN4_OLD NOSCRIPT MSVCR100 PYCRYPTO ARGPARSE PYYAML ZOPEINTERFACE TWISTED M2CRYPTO SETUPTOOLS OPENSSL GMP PARSLEY GO GCC do PACKAGE="${i}_PACKAGE" HASH="${i}_HASH" diff --git a/gitian/mkbundle-mac.sh b/gitian/mkbundle-mac.sh index ea547e9..363ebb1 100755 --- a/gitian/mkbundle-mac.sh +++ b/gitian/mkbundle-mac.sh @@ -106,7 +106,8 @@ fi cd $GITIAN_DIR -if [ ! -f inputs/openssl-$OPENSSL_VER-mac64-utils.zip -o \ +if [ ! -f inputs/gcc-$GCC_VER-linux64-precise-utils.zip -o \ + ! -f inputs/openssl-$OPENSSL_VER-mac64-utils.zip -o \ ! -f inputs/libevent-${LIBEVENT_TAG_ORIG#release-}-mac64-utils.zip -o \ ! -f inputs/gmp-$GMP_VER-mac64-utils.zip ]; then @@ -122,6 +123,7 @@ then cd inputs cp -a ../build/out/*-utils.zip . + ln -sf gcc-$GCC_VER-linux64-precise-utils.zip gcc-linux64-precise-utils.zip ln -sf openssl-$OPENSSL_VER-mac64-utils.zip openssl-mac64-utils.zip ln -sf libevent-${LIBEVENT_TAG_ORIG#release-}-mac64-utils.zip libevent-mac64-utils.zip ln -sf gmp-$GMP_VER-mac64-utils.zip gmp-mac64-utils.zip @@ -135,6 +137,7 @@ else # We might have built the utilities in the past but maybe the links are # pointing to the wrong version. Refresh them. cd inputs + ln -sf gcc-$GCC_VER-linux64-precise-utils.zip gcc-linux64-precise-utils.zip ln -sf openssl-$OPENSSL_VER-mac64-utils.zip openssl-mac64-utils.zip ln -sf libevent-${LIBEVENT_TAG_ORIG#release-}-mac64-utils.zip libevent-mac64-utils.zip ln -sf gmp-$GMP_VER-mac64-utils.zip gmp-mac64-utils.zip diff --git a/gitian/patches/libfaketime.patch b/gitian/patches/libfaketime.patch new file mode 100644 index 0000000..d170eda --- /dev/null +++ b/gitian/patches/libfaketime.patch @@ -0,0 +1,54 @@ +From 3ea3df1129a9918dea7efdf3a529227f16b237aa Mon Sep 17 00:00:00 2001 +From: Georg Koppen <gk(a)torproject.org> +Date: Thu, 21 May 2015 07:32:16 +0000 +Subject: [PATCH] Allow more than one command being skipped + +--- + src/libfaketime.c | 28 ++++++++++++++++++++-------- + 1 file changed, 20 insertions(+), 8 deletions(-) + +diff --git a/src/libfaketime.c b/src/libfaketime.c +index ecda143..ad45857 100644 +--- a/src/libfaketime.c ++++ b/src/libfaketime.c +@@ -1455,17 +1455,29 @@ void __attribute__ ((constructor)) ftpl_init(void) + /* We can prevent faking time for specified commands */ + if ((tmp_env = getenv("FAKETIME_SKIP_CMDS")) != NULL) + { +- char *skip_cmd, *saveptr; +- skip_cmd = strtok_r(tmp_env, ",", &saveptr); +- while (skip_cmd != NULL) ++ char *skip_cmd, *saveptr, *tmpvar; ++ /* Don't mess with the env variable directly. */ ++ tmpvar = strdup(tmp_env); ++ if (tmpvar != NULL) + { +- if (0 == strcmp(progname, skip_cmd)) ++ skip_cmd = strtok_r(tmpvar, ",", &saveptr); ++ while (skip_cmd != NULL) + { +- ft_mode = FT_NOOP; +- dont_fake = true; +- break; ++ if (0 == strcmp(progname, skip_cmd)) ++ { ++ ft_mode = FT_NOOP; ++ dont_fake = true; ++ break; ++ } ++ skip_cmd = strtok_r(NULL, ",", &saveptr); + } +- skip_cmd = strtok_r(NULL, ",", &saveptr); ++ free(tmpvar); ++ tmpvar = NULL; ++ } ++ else ++ { ++ fprintf(stderr, "Error: Could not copy the environment variable value.\n"); ++ exit(EXIT_FAILURE); + } + } + +-- +2.1.4 + diff --git a/gitian/verify-tags.sh b/gitian/verify-tags.sh index 5c1d552..2c4e8c6 100755 --- a/gitian/verify-tags.sh +++ b/gitian/verify-tags.sh @@ -140,8 +140,8 @@ do done # Verify packages with weak or no signatures via direct sha256 check -# (OpenSSL is signed with MD5, and OSXSDK is not signed at all) -for i in OSXSDK TOOLCHAIN4 TOOLCHAIN4_OLD NOSCRIPT MSVCR100 PYCRYPTO ARGPARSE PYYAML ZOPEINTERFACE TWISTED M2CRYPTO SETUPTOOLS OPENSSL GMP PARSLEY GO GCC +# (OpenSSL is signed with MD5, and OSXSDK + OSXSDK_OLD are not signed at all) +for i in OSXSDK OSXSDK_OLD TOOLCHAIN4 TOOLCHAIN4_OLD NOSCRIPT MSVCR100 PYCRYPTO ARGPARSE PYYAML ZOPEINTERFACE TWISTED M2CRYPTO SETUPTOOLS OPENSSL GMP PARSLEY GO GCC do PACKAGE="${i}_PACKAGE" HASH="${i}_HASH" diff --git a/gitian/versions b/gitian/versions index 4a612c1..dc8b095 100755 --- a/gitian/versions +++ b/gitian/versions @@ -60,7 +60,8 @@ GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 NOSCRIPT_PACKAGE=noscript_security_suite-2.6.9.26-sm+fn+fx.xpi TOOLCHAIN4_PACKAGE=x86_64-apple-darwin10.tar.xz TOOLCHAIN4_OLD_PACKAGE=multiarch-darwin11-cctools127.2-gcc42-5666.3-llvmgcc42-2336.1-Linux-120724.tar.xz -OSXSDK_PACKAGE=apple-uni-sdk-10.6_20110407-0.flosoft1_i386.deb +OSXSDK_PACKAGE=MacOSX10.7.sdk.tar.gz +OSXSDK_OLD_PACKAGE=apple-uni-sdk-10.6_20110407-0.flosoft1_i386.deb MSVCR100_PACKAGE=msvcr100.dll BINUTILS_PACKAGE=binutils-${BINUTILS_VER}.tar.bz2 GCC_PACKAGE=gcc-${GCC_VER}.tar.bz2 @@ -81,7 +82,8 @@ GO_PACKAGE=go${GO_VER}.src.tar.gz # Hashes for packages with weak sigs or no sigs OPENSSL_HASH=16e678c6a05f2502811e075f2c4059ac01c878d091c9c585afc49ebc541f7b13 GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 -OSXSDK_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc +OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf +OSXSDK_OLD_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc TOOLCHAIN4_HASH=7b71bfe02820409b994c5c33a7eab81a81c72550f5da85ff7af70da3da244645 TOOLCHAIN4_OLD_HASH=65c1b2d302358a6b95a26c6828a66908a199276193bb0b268f2dcc1a997731e9 NOSCRIPT_HASH=06d9fa6093378682a7fabfc0b2d156dfafcfda749ddd802970ce14d1860e6a3e diff --git a/gitian/versions.alpha b/gitian/versions.alpha index c4b04cc..229e46d 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -60,7 +60,8 @@ GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 NOSCRIPT_PACKAGE=noscript_security_suite-2.6.9.26-sm+fn+fx.xpi TOOLCHAIN4_PACKAGE=x86_64-apple-darwin10.tar.xz TOOLCHAIN4_OLD_PACKAGE=multiarch-darwin11-cctools127.2-gcc42-5666.3-llvmgcc42-2336.1-Linux-120724.tar.xz -OSXSDK_PACKAGE=apple-uni-sdk-10.6_20110407-0.flosoft1_i386.deb +OSXSDK_PACKAGE=MacOSX10.7.sdk.tar.gz +OSXSDK_OLD_PACKAGE=apple-uni-sdk-10.6_20110407-0.flosoft1_i386.deb MSVCR100_PACKAGE=msvcr100.dll BINUTILS_PACKAGE=binutils-${BINUTILS_VER}.tar.bz2 GCC_PACKAGE=gcc-${GCC_VER}.tar.bz2 @@ -81,7 +82,8 @@ GO_PACKAGE=go${GO_VER}.src.tar.gz # Hashes for packages with weak sigs or no sigs OPENSSL_HASH=16e678c6a05f2502811e075f2c4059ac01c878d091c9c585afc49ebc541f7b13 GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 -OSXSDK_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc +OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf +OSXSDK_OLD_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc TOOLCHAIN4_HASH=7b71bfe02820409b994c5c33a7eab81a81c72550f5da85ff7af70da3da244645 TOOLCHAIN4_OLD_HASH=65c1b2d302358a6b95a26c6828a66908a199276193bb0b268f2dcc1a997731e9 NOSCRIPT_HASH=06d9fa6093378682a7fabfc0b2d156dfafcfda749ddd802970ce14d1860e6a3e diff --git a/gitian/versions.nightly b/gitian/versions.nightly index cef40eb..27a2e27 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -63,7 +63,8 @@ GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 NOSCRIPT_PACKAGE=noscript_security_suite-2.6.9.26-sm+fn+fx.xpi TOOLCHAIN4_PACKAGE=x86_64-apple-darwin10.tar.xz TOOLCHAIN4_OLD_PACKAGE=multiarch-darwin11-cctools127.2-gcc42-5666.3-llvmgcc42-2336.1-Linux-120724.tar.xz -OSXSDK_PACKAGE=apple-uni-sdk-10.6_20110407-0.flosoft1_i386.deb +OSXSDK_PACKAGE=MacOSX10.7.sdk.tar.gz +OSXSDK_OLD_PACKAGE=apple-uni-sdk-10.6_20110407-0.flosoft1_i386.deb MSVCR100_PACKAGE=msvcr100.dll BINUTILS_PACKAGE=binutils-${BINUTILS_VER}.tar.bz2 GCC_PACKAGE=gcc-${GCC_VER}.tar.bz2 @@ -84,7 +85,8 @@ GO_PACKAGE=go${GO_VER}.src.tar.gz # Hashes for packages with weak sigs or no sigs OPENSSL_HASH=16e678c6a05f2502811e075f2c4059ac01c878d091c9c585afc49ebc541f7b13 GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 -OSXSDK_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc +OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf +OSXSDK_OLD_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc TOOLCHAIN4_HASH=7b71bfe02820409b994c5c33a7eab81a81c72550f5da85ff7af70da3da244645 TOOLCHAIN4_OLD_HASH=65c1b2d302358a6b95a26c6828a66908a199276193bb0b268f2dcc1a997731e9 NOSCRIPT_HASH=06d9fa6093378682a7fabfc0b2d156dfafcfda749ddd802970ce14d1860e6a3e

1 0

[tor-browser-bundle/master] Bug 15990: Gitian changes for ESR 38 on Windows
by gk＠torproject.org 23 Jun '15

23 Jun '15

commit d0bc63e7d7a1149c8faf336190d7a771eb46c234 Author: Georg Koppen <gk(a)torproject.org> Date: Thu May 28 09:23:00 2015 +0000 Bug 15990: Gitian changes for ESR 38 on Windows --- gitian/descriptors/windows/gitian-firefox.yml | 25 ++++++++++++------------- gitian/descriptors/windows/gitian-utils.yml | 10 ++++++++++ gitian/mkbundle-windows.sh | 3 +++ gitian/versions | 2 +- gitian/versions.alpha | 2 +- gitian/versions.nightly | 2 +- 6 files changed, 28 insertions(+), 16 deletions(-) diff --git a/gitian/descriptors/windows/gitian-firefox.yml b/gitian/descriptors/windows/gitian-firefox.yml index ab8d7c6..c7efb62 100644 --- a/gitian/descriptors/windows/gitian-firefox.yml +++ b/gitian/descriptors/windows/gitian-firefox.yml @@ -4,8 +4,8 @@ suites: architectures: - "i386" packages: -- "autoconf2.13" - "unzip" +- "autoconf2.13" - "yasm" - "zip" reference_datetime: "2000-01-01 00:00:00" @@ -15,6 +15,7 @@ remotes: - "url": "https://github.com/wolfcw/libfaketime" "dir": "faketime" files: +- "gcc-linux32-precise-utils.zip" - "mingw-w64-win32-utils.zip" - "re-dzip.sh" - "dzip.sh" @@ -33,10 +34,15 @@ script: | # mkdir -p $INSTDIR/Browser/ mkdir -p $OUTDIR/ + unzip -d $INSTDIR gcc-linux32-precise-utils.zip + # We need a link to our GCC, otherwise the system cc gets used which points to + # /usr/bin/gcc. + ln -s gcc $INSTDIR/gcc/bin/cc unzip -d $INSTDIR mingw-w64-win32-utils.zip unzip -d $INSTDIR gcclibs-win32-utils.zip - # Make sure our custom mingw gets used. - export PATH=$INSTDIR/mingw-w64/bin:$PATH + # Make sure our custom mingw and GCC (as host compiler) get used. + export LD_LIBRARY_PATH=$INSTDIR/gcc/lib + export PATH=$INSTDIR/mingw-w64/bin:$INSTDIR/gcc/bin:$PATH # Building libfaketime cd faketime @@ -90,23 +96,16 @@ script: | # We need libfaketime for all the timestamps e.g. written into the libraries. # BUT we need to exclude |make build| from it. Otherwise the build fails close # to the end, see #12811 comment 14 and #12461 comment 8 and later. + # Additionally, we need to exclude |python2.7| as well as the build would + # stall otherwise right at the beginning. See #13877 for details. export LD_PRELOAD="$INSTDIR/faketime/usr/local/lib/faketime/libfaketime.so.1" - export FAKETIME_SKIP_CMDS="make" + export FAKETIME_SKIP_CMDS="python2.7,make" make BUILD_HOSTNAME="gitian" $MAKEOPTS -f client.mk build # make -C obj-* package INNER_MAKE_PACKAGE=true cp -a obj-*/dist/firefox/* $INSTDIR/Browser/ cp -a ~/build/msvcr100.dll $INSTDIR/Browser/ cp -a $INSTDIR/gcclibs/libssp-0.dll $INSTDIR/Browser/ - # - # What the hell are these three bytes anyways? - # FIXME: This was probably fixed by patching binutils. If we get matching - # builds without it, remove these two: - #sed 's/\x94\x0C\xE7\x6A\xB8\x0C\xE7\x6A\x08...\x04\xBA\xCB\x7E/\x94\x0c\xe7\x6a\xb8\x0c\xe7\x6a\x08\x23\x23\x23\x04\xba\xcb\x7e/M' -i $INSTDIR/Browser/xul.dll - #sed 's/\x94\xb1\x24\x65\xb8\xb1\x24\x65\xf8...\x04\xba\xcb\x7e/\x94\xb1\x24\x65\xb8\xb1\x24\x65\xf8\x23\x23\x23\x04\xba\xcb\x7e/M' -i $INSTDIR/Browser/gkmedias.dll - # Stripping again updates the PE header checksums to be correct - i686-w64-mingw32-strip $INSTDIR/Browser/gkmedias.dll - i686-w64-mingw32-strip $INSTDIR/Browser/xul.dll # Make MAR-based update tools available for use during the bundle phase. MARTOOLS=~/build/mar-tools diff --git a/gitian/descriptors/windows/gitian-utils.yml b/gitian/descriptors/windows/gitian-utils.yml index 2b978e3..6e52c67 100644 --- a/gitian/descriptors/windows/gitian-utils.yml +++ b/gitian/descriptors/windows/gitian-utils.yml @@ -38,6 +38,15 @@ script: | export LC_ALL=C umask 0022 + # Building GCC to use it as the host compiler. Firefox 38 needs GCC >= 4.7 but + # Ubuntu Precise is only shipping with GCC 4.6.x. + tar xjf gcc.tar.bz2 + cd gcc-* + ./configure --prefix=$INSTDIR/gcc --disable-multilib --enable-languages=c,c++ + make $MAKEOPTS + make install + cd .. + # Building binutils tar xjf binutils.tar.bz2 cd binutils* @@ -157,6 +166,7 @@ script: | cd $INSTDIR # We might want to bump binutils independent of bumping mingw-w64. touch binutils-$BINUTILS_VER-win32-utils.zip + ~/build/dzip.sh gcc-$GCC_VER-linux32-precise-utils.zip gcc ~/build/dzip.sh mingw-w64-$GCC_VER-win32-utils.zip mingw-w64 ~/build/dzip.sh zlib-${ZLIB_TAG#v}-win32-utils.zip zlib ~/build/dzip.sh libevent-${LIBEVENT_TAG#release-}-win32-utils.zip libevent diff --git a/gitian/mkbundle-windows.sh b/gitian/mkbundle-windows.sh index 4de847b..238ad51 100755 --- a/gitian/mkbundle-windows.sh +++ b/gitian/mkbundle-windows.sh @@ -102,6 +102,7 @@ cd $GITIAN_DIR if [ ! -f inputs/binutils-$BINUTILS_VER-win32-utils.zip -o \ ! -f inputs/gcclibs-$GCC_VER-win32-utils.zip -o \ + ! -f inputs/gcc-$GCC_VER-linux32-precise-utils.zip -o \ ! -f inputs/mingw-w64-$GCC_VER-win32-utils.zip -o \ ! -f inputs/zlib-${ZLIB_TAG_ORIG#v}-win32-utils.zip -o \ ! -f inputs/libevent-${LIBEVENT_TAG_ORIG#release-}-win32-utils.zip -o \ @@ -127,6 +128,7 @@ then ln -sf openssl-$OPENSSL_VER-win32-utils.zip openssl-win32-utils.zip ln -sf gmp-$GMP_VER-win32-utils.zip gmp-win32-utils.zip ln -sf gcclibs-$GCC_VER-win32-utils.zip gcclibs-win32-utils.zip + ln -sf gcc-$GCC_VER-linux32-precise-utils.zip gcc-linux32-precise-utils.zip cd .. #cp -a result/utils-win-res.yml inputs/ else @@ -142,6 +144,7 @@ else ln -sf openssl-$OPENSSL_VER-win32-utils.zip openssl-win32-utils.zip ln -sf gmp-$GMP_VER-win32-utils.zip gmp-win32-utils.zip ln -sf gcclibs-$GCC_VER-win32-utils.zip gcclibs-win32-utils.zip + ln -sf gcc-$GCC_VER-linux32-precise-utils.zip gcc-linux32-precise-utils.zip cd .. fi diff --git a/gitian/versions b/gitian/versions index a073427..4a612c1 100755 --- a/gitian/versions +++ b/gitian/versions @@ -16,7 +16,7 @@ HTTPSE_TAG=5.0.5 NSIS_TAG=v0.3 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.21-stable -MINGW_TAG=e712bb8b106d059914388e6ccd93c584a6416082 # XXX: ??? +MINGW_TAG=a883b47a45ff74ced41dfbd9f748d5c2c61f3c01 # due to bug 1156131 PYPTLIB_TAG=pyptlib-0.0.6 OBFSPROXY_TAG=obfsproxy-0.2.12 FLASHPROXY_TAG=1.6 diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 56b46b9..c4b04cc 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -16,7 +16,7 @@ HTTPSE_TAG=5.0.5 NSIS_TAG=v0.3 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.21-stable -MINGW_TAG=e712bb8b106d059914388e6ccd93c584a6416082 # XXX: ??? +MINGW_TAG=a883b47a45ff74ced41dfbd9f748d5c2c61f3c01 # due to bug 1156131 PYPTLIB_TAG=pyptlib-0.0.6 OBFSPROXY_TAG=obfsproxy-0.2.12 FLASHPROXY_TAG=1.6 diff --git a/gitian/versions.nightly b/gitian/versions.nightly index bea7547..cef40eb 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -19,7 +19,7 @@ HTTPSE_TAG=master NSIS_TAG=v0.3 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.21-stable -MINGW_TAG=e712bb8b106d059914388e6ccd93c584a6416082 # XXX: ??? +MINGW_TAG=a883b47a45ff74ced41dfbd9f748d5c2c61f3c01 # due to bug 1156131 PYPTLIB_TAG=master OBFSPROXY_TAG=master FLASHPROXY_TAG=master

1 0

[tor-browser-bundle/master] Bug 16011: Add a script to check authenticode sigs
by gk＠torproject.org 18 Jun '15

18 Jun '15

commit fa0f65f3f2b9be47c82dc931e0648b9dddfa8c05 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Jun 8 13:29:49 2015 +0000 Bug 16011: Add a script to check authenticode sigs --- tools/authenticode_check.sh | 95 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 95 insertions(+) diff --git a/tools/authenticode_check.sh b/tools/authenticode_check.sh new file mode 100755 index 0000000..86472ae --- /dev/null +++ b/tools/authenticode_check.sh @@ -0,0 +1,95 @@ +#!/bin/sh + +# Copyright (c) 2015, The Tor Project, Inc. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are +# met: + +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following disclaimer +# in the documentation and/or other materials provided with the +# distribution. +# +# * Neither the names of the copyright owners nor the names of its +# contributors may be used to endorse or promote products derived from +# this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +# Usage: +# 1) Let OSSLSIGNCODE point to your osslsigncode binary +# 2) Change into the directory containing the .exe files and the sha256sums.txt +# 3) Run /path/to/authenticode_check.sh + +if [ -z "$OSSLSIGNCODE" ] +then + echo "The path to your osslsigncode binary is missing!" + exit 1 +fi + +UNSIGNED_BUNDLES=0 +BADSIGNED_BUNDLES=0 + +mkdir tmp + +for f in `ls *.exe`; do + SHA256_TXT=`grep "$f" sha256sums.txt` + + # Test 1: Is the .exe file still unsigned? I.e. does its SHA 256 sum still + # match the one we had before we signed the .exe file? If so, notify us + # later and exit. + if [ "$SHA256_TXT" = "`sha256sum $f`" ] + then + echo "$f has still the SHA 256 sum of the unsigned bundle!" + UNSIGNED_BUNDLES=`expr $UNSIGNED_BUNDLES + 1` + fi + + # Test 2: Do we get the old SHA 256 sum after stripping the authenticode + # signature? If not, notify us later and exit. + if [ "$UNSIGNED_BUNDLES" = "0" ] + then + # At least we seem to have attempted to sign the bundle. Let's see if we + # succeeded by stripping the signature. This behavior is reproducible. + # Thus, we know if we don't get the same SHA 256 sum we did not sign the + # bundle correctly. + echo "Trying to strip the authenticode signature of $f..." + ${OSSLSIGNCODE} remove-signature $f tmp/$f + cd tmp + if ! [ "$SHA256_TXT" = "`sha256sum $f`" ] + then + BADSIGNED_BUNDLES=`expr $BADSIGNED_BUNDLES + 1` + fi + cd .. + fi +done + +rm -rf tmp/ + +if ! [ "$UNSIGNED_BUNDLES" = "0" ] +then + echo "We got $UNSIGNED_BUNDLES unsigned bundle(s), exiting..." + exit 1 +fi + +if ! [ "$BADSIGNED_BUNDLES" = "0" ] +then + echo "We got $BADSIGNED_BUNDLES badly signed bundle(s), exiting..." + exit 1 +fi + +echo "The signatures are fine." +exit 0

1 0

[tor-browser-bundle/master] Merge branch 'bug_16011'
by gk＠torproject.org 18 Jun '15

18 Jun '15

commit c15148af3030d08c550d6b25261714e7f26d0f3d Merge: f35744d fa0f65f Author: Georg Koppen <gk(a)torproject.org> Date: Thu Jun 18 08:02:54 2015 +0000 Merge branch 'bug_16011' tools/authenticode_check.sh | 95 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 95 insertions(+)

1 0

[tor-browser-bundle/master] Merge branch 'bug_16283'
by gk＠torproject.org 17 Jun '15

17 Jun '15

commit f35744d076aa2aeceeb5fd64faf1945b58ba435e Merge: f0f7fdb 8b3ad7a Author: Georg Koppen <gk(a)torproject.org> Date: Wed Jun 17 13:43:47 2015 +0000 Merge branch 'bug_16283' gitian/README.build | 6 +++--- gitian/mkbundle-linux.sh | 2 +- gitian/mkbundle-mac.sh | 2 +- gitian/mkbundle-windows.sh | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-)

1 0