- tbb-commits - lists.torproject.org

[tor-browser-bundle/master] Add debug output to authenticode_check script
by gk＠torproject.org 01 Jul '15

01 Jul '15

commit 6cbec232b21da38599438cdb32d865161faf7384 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Jul 1 19:50:55 2015 +0000 Add debug output to authenticode_check script --- tools/authenticode_check.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/authenticode_check.sh b/tools/authenticode_check.sh index 86472ae..646fdce 100755 --- a/tools/authenticode_check.sh +++ b/tools/authenticode_check.sh @@ -71,6 +71,7 @@ for f in `ls *.exe`; do cd tmp if ! [ "$SHA256_TXT" = "`sha256sum $f`" ] then + echo "$f does not have the SHA 256 sum of the unsigned bundle!" BADSIGNED_BUNDLES=`expr $BADSIGNED_BUNDLES + 1` fi cd ..

1 0

[tor-browser-bundle/master] Add fix for bug 13247 to changelog
by gk＠torproject.org 01 Jul '15

01 Jul '15

commit 0530d3eeee374579a1128741ff32afa38b25da5d Author: Georg Koppen <gk(a)torproject.org> Date: Wed Jul 1 09:18:29 2015 +0000 Add fix for bug 13247 to changelog --- Bundle-Data/Docs/ChangeLog.txt | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 9584acd..27d8294 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -3,6 +3,7 @@ Tor Browser 5.0a3 -- June 30 2015 * Update Firefox to 38.1.0esr * Update OpenSSL to 1.0.1o * Update NoScript to 2.6.9.27 + * Update meek to 0.20 * Tor patch backport * Bug 16430: Allow DNS names with _ characters in them (fixes nytimes.com) * Update Torbutton to 1.9.3.0 @@ -16,6 +17,7 @@ Tor Browser 5.0a3 -- June 30 2015 * Bug 16428: Use internal update URL to block updates (instead of 127.0.0.1) * Bug 15145: Visually distinguish "proxy" and "bridge" screens. * Translation updates + * Bug 13247: Fix meek profile error after bowser restarts * Bug 16397: Fix crash related to disabling SVG * Bug 16403: Set search parameters for Disconnect * Bug 16446: Update FTE bridge #1 fingerprint

1 0

[tor-browser-bundle/master] Add additional changelog entries for 5.0a3
by gk＠torproject.org 30 Jun '15

30 Jun '15

commit c23a6e9f5ff90dcbacaf66be6220c25b1d659719 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Jun 30 21:33:12 2015 +0000 Add additional changelog entries for 5.0a3 --- Bundle-Data/Docs/ChangeLog.txt | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index f7f01b7..9584acd 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -35,8 +35,10 @@ Tor Browser 5.0a3 -- June 30 2015 * Bug 16222: Disable WebIDE to prevent remote debugging and addon downloads. * Bug 13024: Disable DOM Resource Timing API * Bug 16340: Disable User Timing API + * Bug 14952: Disable HTTP/2 * Mac OS * Use OSX 10.7 SDK + * Bug 16253: Tor Browser menu on OS X is broken with ESR 38 * Build System * Bug 16351: Upgrade our toolchain to use GCC 5.1 * Bug 15772 and child tickets: Update build system for Firefox 38

1 0

[tor-browser-bundle/master] Binutils 2.25 did not make it into 5.0a3
by gk＠torproject.org 30 Jun '15

30 Jun '15

commit e379172eda433632090681abf7bde3a5d87c52c2 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Jun 30 21:00:59 2015 +0000 Binutils 2.25 did not make it into 5.0a3 --- Bundle-Data/Docs/ChangeLog.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 1b9955f..f7f01b7 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -38,7 +38,7 @@ Tor Browser 5.0a3 -- June 30 2015 * Mac OS * Use OSX 10.7 SDK * Build System - * Bug 16351: Upgrade our toolchain to use GCC 5.1 and Binutils 2.25 + * Bug 16351: Upgrade our toolchain to use GCC 5.1 * Bug 15772 and child tickets: Update build system for Firefox 38 Tor Browser 4.5.3 -- June 30 2015

1 0

[tor-browser-bundle/master] Update 5.0a3 changelog with preference changes.
by mikeperry＠torproject.org 30 Jun '15

30 Jun '15

commit 417e57406ffd84b4c1e755a4859a31e843c018a8 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Jun 30 13:42:24 2015 -0700 Update 5.0a3 changelog with preference changes. --- Bundle-Data/Docs/ChangeLog.txt | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 16c0c62..1b9955f 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -13,7 +13,7 @@ Tor Browser 5.0a3 -- June 30 2015 * Bug 16357: Use Mozilla API to wipe permissions db * Translation updates * Update Tor Launcher to 0.2.6.7 - * Bug 16427: Use internal update URL to block updates (instead of 127.0.0.1) + * Bug 16428: Use internal update URL to block updates (instead of 127.0.0.1) * Bug 15145: Visually distinguish "proxy" and "bridge" screens. * Translation updates * Bug 16397: Fix crash related to disabling SVG @@ -31,6 +31,10 @@ Tor Browser 5.0a3 -- June 30 2015 * Bug 7561: Disable FTP request caching * Bug 6503: Fix single-word URL bar searching * Bug 15526: ES6 page crashes Tor Browser + * Bug 16254: Disable GeoIP-based search results. + * Bug 16222: Disable WebIDE to prevent remote debugging and addon downloads. + * Bug 13024: Disable DOM Resource Timing API + * Bug 16340: Disable User Timing API * Mac OS * Use OSX 10.7 SDK * Build System

1 0

[tor-browser/tor-browser-38.1.0esr-5.0-1] Bug #16315: Test spoofed media queries in picture elements
by gk＠torproject.org 29 Jun '15

29 Jun '15

commit 452f870c8dff8089f759c9052960ad7fc73866a0 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Sat Jun 20 16:10:34 2015 -0700 Bug #16315: Test spoofed media queries in picture elements --- tbb-tests/match.png | Bin 0 -> 1210 bytes tbb-tests/mismatch.png | Bin 0 -> 1573 bytes tbb-tests/mochitest.ini | 3 +++ tbb-tests/test_tor_bug2875.html | 38 ++++++++++++++++++++++++++++++++------ 4 files changed, 35 insertions(+), 6 deletions(-) diff --git a/tbb-tests/match.png b/tbb-tests/match.png new file mode 100644 index 0000000..d3f299b Binary files /dev/null and b/tbb-tests/match.png differ diff --git a/tbb-tests/mismatch.png b/tbb-tests/mismatch.png new file mode 100644 index 0000000..8f9da3f Binary files /dev/null and b/tbb-tests/mismatch.png differ diff --git a/tbb-tests/mochitest.ini b/tbb-tests/mochitest.ini index 1434f89..2dc049a 100644 --- a/tbb-tests/mochitest.ini +++ b/tbb-tests/mochitest.ini @@ -1,4 +1,7 @@ [DEFAULT] +support-files = + match.png + mismatch.png [test_tor_bug2874.html] [test_tor_bug2875.html] diff --git a/tbb-tests/test_tor_bug2875.html b/tbb-tests/test_tor_bug2875.html index 3c34f3b..5eb3370 100644 --- a/tbb-tests/test_tor_bug2875.html +++ b/tbb-tests/test_tor_bug2875.html @@ -9,7 +9,11 @@ https://trac.torproject.org/projects/tor/ticket/2875 <title>Test for Tor Bug #2875: Limit device and system specific CSS Media Queries</title> <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script> <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/> - <script type="application/javascript"> + <script type="application/javascript;version=1.7"> +let test = function () { + + SimpleTest.waitForExplicitFinish(); + var keyValMatches = ([key, val]) => matchMedia("(" + key + ":" + val +")").matches; // Default spoofed values by Tor Browser: @@ -51,23 +55,45 @@ https://trac.torproject.org/projects/tor/ticket/2875 ]; tor_suppressed_toggles.map(key => ok(!keyValMatches([key, 0]) && !keyValMatches([key, 1]), - key + " should not exist.")); + key + " should not exist.")); var foundOSVersion = false; ["windows-xp", "windows-vista", "windows-win7", "windows-win8"].map(function (val) { foundOSVersion = foundOSVersion || keyValMatches(["-moz-os-version", val]); }); ok(!foundOSVersion, "-moz-os-version should have no match"); - + + // Test media queries in picture elements (Tor Bug #16315) + let lines = ""; + for (let [query, expected] of tor_defaults) { + lines += "<picture>\n"; + lines += " <source srcset='match.png' media='(" + query + ": " + expected + ")'>\n"; + lines += " <img class='testImage' src='mismatch.png' alt='" + query + "'>\n"; + lines += "</picture><br>\n"; + } + document.getElementById("content").innerHTML += lines; + var testImages = document.getElementsByClassName("testImage"); + window.setTimeout(function () { + for (let testImage of testImages) { + ok(testImage.currentSrc.endsWith("/match.png"), "Media query in picture should match."); + } + SimpleTest.finish(); + }, 0); + +}; + </script> </head> <body> <a target="_blank" href="https://trac.torproject.org/projects/tor/ticket/2875">Tor Bug 2875</a> <p id="display"></p> -<div id="content" style="display: none"> - -</div> +<div id="content"></div> <pre id="test"> </pre> +<script> + window.onload = function () { + test(); + } +</script> </body> </html>

1 0

[tor-browser-bundle/master] No need for the dev/urandom patch anymore
by gk＠torproject.org 29 Jun '15

29 Jun '15

commit 77299592b1c7aaf46f4c99c63ad855d0852e8e3b Author: Georg Koppen <gk(a)torproject.org> Date: Mon Jun 29 15:27:49 2015 +0000 No need for the dev/urandom patch anymore This got upstreamed into GCC 5. --- gitian/patches/gcc-dev-random.patch | 72 ----------------------------------- 1 file changed, 72 deletions(-) diff --git a/gitian/patches/gcc-dev-random.patch b/gitian/patches/gcc-dev-random.patch deleted file mode 100644 index 9757f92..0000000 --- a/gitian/patches/gcc-dev-random.patch +++ /dev/null @@ -1,72 +0,0 @@ -From b0ce14899060267b5b5e4d7e3d91edcdf5c09514 Mon Sep 17 00:00:00 2001 -From: law <law@138bc75d-0d04-0410-961f-82ee72b054a4> -Date: Tue, 10 Feb 2015 01:44:08 +0000 -Subject: [PATCH] * ssp.c (__guard_setup): For Windows, use approved methods - to get a suitable random number for the stack check guard - rather than reading /dev/random. - -git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/trunk@220559 138bc75d-0d04-0410-961f-82ee72b054a4 ---- - libssp/ChangeLog | 7 +++++++ - libssp/ssp.c | 16 ++++++++++++++++ - 2 files changed, 23 insertions(+) - -diff --git a/libssp/ChangeLog b/libssp/ChangeLog -index a445537..676d2a7 100644 ---- a/libssp/ChangeLog -+++ b/libssp/ChangeLog -@@ -1,3 +1,10 @@ -+2015-02-09 Georg Koppen <gk(a)torproject.org> -+ -+ * ssp.c: Conditionally include <windows.h> -+ (__guard_setup): For Windows, use approved methods to get -+ a suitable random number for the stack check guard rather -+ than reading /dev/random. -+ - 2014-07-16 Release Manager - - * GCC 4.9.1 released. -diff --git a/libssp/ssp.c b/libssp/ssp.c -index 96adf17..38e3ec8 100644 ---- a/libssp/ssp.c -+++ b/libssp/ssp.c -@@ -55,6 +55,7 @@ see the files COPYING3 and COPYING.RUNTIME respectively. If not, see - /* Native win32 apps don't know about /dev/tty but can print directly - to the console using "CONOUT$" */ - #if defined (_WIN32) && !defined (__CYGWIN__) -+#include <windows.h> - # define _PATH_TTY "CONOUT$" - #else - # define _PATH_TTY "/dev/tty" -@@ -75,6 +76,20 @@ __guard_setup (void) - if (__stack_chk_guard != 0) - return; - -+#if defined (_WIN32) && !defined (__CYGWIN__) -+ HCRYPTPROV hprovider = 0; -+ if (CryptAcquireContext(&hprovider, NULL, NULL, PROV_RSA_FULL, -+ CRYPT_VERIFYCONTEXT | CRYPT_SILENT)) -+ { -+ if (CryptGenRandom(hprovider, sizeof (__stack_chk_guard), -+ (BYTE *)&__stack_chk_guard) && __stack_chk_guard != 0) -+ { -+ CryptReleaseContext(hprovider, 0); -+ return; -+ } -+ CryptReleaseContext(hprovider, 0); -+ } -+#else - fd = open ("/dev/urandom", O_RDONLY); - if (fd != -1) - { -@@ -85,6 +100,7 @@ __guard_setup (void) - return; - } - -+#endif - /* If a random generator can't be used, the protector switches the guard - to the "terminator canary". */ - p = (unsigned char *) &__stack_chk_guard; --- -1.7.10.4 -

1 0

[tor-browser-bundle/master] Bug 16351: Update our GCC version to 5.1.0
by gk＠torproject.org 29 Jun '15

29 Jun '15

commit 11bcfffc3e9b806d3c37e68730f7e2096f499bff Author: Georg Koppen <gk(a)torproject.org> Date: Mon Jun 29 15:19:43 2015 +0000 Bug 16351: Update our GCC version to 5.1.0 The original plan was to bump Binutils to 2.25, too. But there are more reproducibility issues involved than anticipated (for the timestamps related one see the last two reverted commits). --- gitian/descriptors/windows/gitian-utils.yml | 5 ----- gitian/versions | 4 ++-- gitian/versions.alpha | 4 ++-- gitian/versions.nightly | 4 ++-- 4 files changed, 6 insertions(+), 11 deletions(-) diff --git a/gitian/descriptors/windows/gitian-utils.yml b/gitian/descriptors/windows/gitian-utils.yml index 6e52c67..ae938af 100644 --- a/gitian/descriptors/windows/gitian-utils.yml +++ b/gitian/descriptors/windows/gitian-utils.yml @@ -28,7 +28,6 @@ files: - "gmp.tar.bz2" - "enable-reloc-section-ld.patch" - "peXXigen.patch" -- "gcc-dev-random.patch" - "versions" - "dzip.sh" script: | @@ -74,10 +73,6 @@ script: | mkdir gcc cd gcc tar -xjvf ../gcc.tar.bz2 - cd gcc-* - # Don't use /dev/random on Windows. See bug 13169 for details. - patch -p1 < ../../gcc-dev-random.patch - cd .. # We don't want to link against msvcrt.dll due to bug 9084. i686-w64-mingw32-g++ -dumpspecs > ~/build/msvcr100.spec sed 's/msvcrt/msvcr100/' -i ~/build/msvcr100.spec diff --git a/gitian/versions b/gitian/versions index d4f18d1..02e6217 100755 --- a/gitian/versions +++ b/gitian/versions @@ -40,7 +40,7 @@ GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION FIREFOX_LANG_BUILD=build2 BINUTILS_VER=2.24 -GCC_VER=4.9.1 +GCC_VER=5.1.0 PYTHON_VER=2.7.5 PYCRYPTO_VER=2.6.1 ARGPARSE_VER=1.2.1 @@ -98,7 +98,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO_HASH=299a6fd8f8adfdce15bc06bde926e7b252ae8e24dd5b16b7d8791ed79e7b5e9b -GCC_HASH=d334781a124ada6f38e63b545e2a3b8c2183049515a1abab6d513f109f1d717e +GCC_HASH=b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad ## Non-git package URLs OPENSSL_URL=https://www.openssl.org/source/${OPENSSL_PACKAGE} diff --git a/gitian/versions.alpha b/gitian/versions.alpha index e7564d7..cee61cd 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -40,7 +40,7 @@ GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION FIREFOX_LANG_BUILD=build1 BINUTILS_VER=2.24 -GCC_VER=4.9.1 +GCC_VER=5.1.0 PYTHON_VER=2.7.5 PYCRYPTO_VER=2.6.1 ARGPARSE_VER=1.2.1 @@ -98,7 +98,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO_HASH=299a6fd8f8adfdce15bc06bde926e7b252ae8e24dd5b16b7d8791ed79e7b5e9b -GCC_HASH=d334781a124ada6f38e63b545e2a3b8c2183049515a1abab6d513f109f1d717e +GCC_HASH=b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad ## Non-git package URLs OPENSSL_URL=https://www.openssl.org/source/${OPENSSL_PACKAGE} diff --git a/gitian/versions.nightly b/gitian/versions.nightly index e2dc33b..1a0ce0a 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -43,7 +43,7 @@ GMP_VER=5.1.3 FIREFOX_LANG_VER=38.0.1esr #$FIREFOX_VERSION FIREFOX_LANG_BUILD=build2 BINUTILS_VER=2.24 -GCC_VER=4.9.1 +GCC_VER=5.1.0 PYTHON_VER=2.7.5 PYCRYPTO_VER=2.6.1 ARGPARSE_VER=1.2.1 @@ -101,7 +101,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO_HASH=299a6fd8f8adfdce15bc06bde926e7b252ae8e24dd5b16b7d8791ed79e7b5e9b -GCC_HASH=d334781a124ada6f38e63b545e2a3b8c2183049515a1abab6d513f109f1d717e +GCC_HASH=b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad ## Non-git package URLs OPENSSL_URL=https://www.openssl.org/source/${OPENSSL_PACKAGE}

1 0

[tor-browser-bundle/master] Revert "Bug 16351: Use --no-insert-timestamp for linking"
by gk＠torproject.org 29 Jun '15

29 Jun '15

commit 8f35a0fc7a156dae5cfacae1606ead635de454cf Author: Georg Koppen <gk(a)torproject.org> Date: Mon Jun 29 08:54:18 2015 +0000 Revert "Bug 16351: Use --no-insert-timestamp for linking" This reverts commit 1b5ae9017625081f251c71afb359bf9345c76b03. --- gitian/build-helpers/i686-w64-mingw32-g++ | 2 +- gitian/build-helpers/i686-w64-mingw32-gcc | 2 +- gitian/build-helpers/i686-w64-mingw32-ld | 2 +- gitian/descriptors/windows/gitian-pluggable-transports.yml | 2 +- gitian/descriptors/windows/gitian-utils.yml | 10 +++++----- 5 files changed, 9 insertions(+), 9 deletions(-) diff --git a/gitian/build-helpers/i686-w64-mingw32-g++ b/gitian/build-helpers/i686-w64-mingw32-g++ index 8975982..b73f107 100755 --- a/gitian/build-helpers/i686-w64-mingw32-g++ +++ b/gitian/build-helpers/i686-w64-mingw32-g++ @@ -1,4 +1,4 @@ #!/bin/sh # Hardened mingw gcc wrapper -/home/ubuntu/install/mingw-w64/bin/i686-w64-mingw32-g++ -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -Wl,--no-insert-timestamp -fstack-protector --param ssp-buffer-size=4 -fno-strict-overflow "$@" +/home/ubuntu/install/mingw-w64/bin/i686-w64-mingw32-g++ -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -fstack-protector --param ssp-buffer-size=4 -fno-strict-overflow "$@" diff --git a/gitian/build-helpers/i686-w64-mingw32-gcc b/gitian/build-helpers/i686-w64-mingw32-gcc index a377c32..d4fd642 100755 --- a/gitian/build-helpers/i686-w64-mingw32-gcc +++ b/gitian/build-helpers/i686-w64-mingw32-gcc @@ -1,4 +1,4 @@ #!/bin/sh # Hardened mingw gcc wrapper -/home/ubuntu/install/mingw-w64/bin/i686-w64-mingw32-gcc -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -Wl,--no-insert-timestamp -fstack-protector --param ssp-buffer-size=4 -fno-strict-overflow "$@" +/home/ubuntu/install/mingw-w64/bin/i686-w64-mingw32-gcc -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -fstack-protector --param ssp-buffer-size=4 -fno-strict-overflow "$@" diff --git a/gitian/build-helpers/i686-w64-mingw32-ld b/gitian/build-helpers/i686-w64-mingw32-ld index 84b5565..f8c61fd 100755 --- a/gitian/build-helpers/i686-w64-mingw32-ld +++ b/gitian/build-helpers/i686-w64-mingw32-ld @@ -1,4 +1,4 @@ #!/bin/sh # Hardened mingw gcc wrapper -/home/ubuntu/install/mingw-w64/bin/i686-w64-mingw32-ld --dynamicbase --nxcompat --enable-reloc-section --no-insert-timestamp -lssp -L$INSTDIR/gcclibs/ "$@" +/home/ubuntu/install/mingw-w64/bin/i686-w64-mingw32-ld --dynamicbase --nxcompat --enable-reloc-section -lssp -L$INSTDIR/gcclibs/ "$@" diff --git a/gitian/descriptors/windows/gitian-pluggable-transports.yml b/gitian/descriptors/windows/gitian-pluggable-transports.yml index 82fd266..1d8caba 100644 --- a/gitian/descriptors/windows/gitian-pluggable-transports.yml +++ b/gitian/descriptors/windows/gitian-pluggable-transports.yml @@ -83,7 +83,7 @@ script: | export TZ=UTC export LC_ALL=C export CFLAGS="-mwindows -fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security" - export LDFLAGS="-mwindows -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -Wl,--no-insert-timestamp -lssp -L$INSTDIR/gcclibs" + export LDFLAGS="-mwindows -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$INSTDIR/gcclibs" umask 0022 unzip -d $INSTDIR mingw-w64-win32-utils.zip diff --git a/gitian/descriptors/windows/gitian-utils.yml b/gitian/descriptors/windows/gitian-utils.yml index 650f7ad..9162426 100644 --- a/gitian/descriptors/windows/gitian-utils.yml +++ b/gitian/descriptors/windows/gitian-utils.yml @@ -82,7 +82,7 @@ script: | sed 's/msvcrt/msvcr100/' -i gcc-*/gcc/config/i386/t-mingw-w32 # LDFLAGS_FOR_TARGET does not work for some reason. Thus, we take # CFLAGS_FOR_TARGET. - export CFLAGS_FOR_TARGET="-specs=/home/ubuntu/build/msvcr100.spec -Wl,--nxcompat -Wl,--dynamicbase -Wl,--no-insert-timestamp" + export CFLAGS_FOR_TARGET="-specs=/home/ubuntu/build/msvcr100.spec -Wl,--nxcompat -Wl,--dynamicbase" gcc-*/configure --prefix=$INSTDIR/mingw-w64 --target=i686-w64-mingw32 --disable-multilib --enable-languages=c,c++ make $MAKEOPTS all-gcc make install-gcc @@ -120,11 +120,11 @@ script: | export FAKETIME=$REFERENCE_DATETIME # Building zlib export CFLAGS="-mwindows -fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security" - export LDFLAGS="-mwindows -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -Wl,--no-insert-timestamp -lssp -L$INSTDIR/gcclibs/" + export LDFLAGS="-mwindows -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$INSTDIR/gcclibs/" cd zlib find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" - make BINARY_PATH=$INSTDIR/zlib/lib INCLUDE_PATH=$INSTDIR/zlib/include LIBRARY_PATH=$INSTDIR/zlib/lib -f win32/Makefile.gcc PREFIX=i686-w64-mingw32- $MAKEOPTS SHARED_MODE=1 LOC="-fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -Wl,--no-insert-timestamp -lssp -L$INSTDIR/gcclibs/" - make BINARY_PATH=$INSTDIR/zlib/lib INCLUDE_PATH=$INSTDIR/zlib/include LIBRARY_PATH=$INSTDIR/zlib/lib -f win32/Makefile.gcc PREFIX=i686-w64-mingw32- $MAKEOPTS SHARED_MODE=1 LOC="-fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -Wl,--no-insert-timestamp -lssp -L$INSTDIR/gcclibs/" install + make BINARY_PATH=$INSTDIR/zlib/lib INCLUDE_PATH=$INSTDIR/zlib/include LIBRARY_PATH=$INSTDIR/zlib/lib -f win32/Makefile.gcc PREFIX=i686-w64-mingw32- $MAKEOPTS SHARED_MODE=1 LOC="-fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$INSTDIR/gcclibs/" + make BINARY_PATH=$INSTDIR/zlib/lib INCLUDE_PATH=$INSTDIR/zlib/include LIBRARY_PATH=$INSTDIR/zlib/lib -f win32/Makefile.gcc PREFIX=i686-w64-mingw32- $MAKEOPTS SHARED_MODE=1 LOC="-fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$INSTDIR/gcclibs/" install cd .. # Building Libevent @@ -141,7 +141,7 @@ script: | cd openssl-* find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" # TODO: Add enable-ec_nistp_64_gcc_128 for 64bit Windows. - ./Configure -shared --cross-compile-prefix=i686-w64-mingw32- mingw "-fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -Wl,--no-insert-timestamp -lssp -L$INSTDIR/gcclibs/" --prefix=$INSTDIR/openssl + ./Configure -shared --cross-compile-prefix=i686-w64-mingw32- mingw "-fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$INSTDIR/gcclibs/" --prefix=$INSTDIR/openssl # Using $MAKEOPTS breaks the build. Might be the issue mentioned on # http://cblfs.cross-lfs.org/index.php/OpenSSL. make

1 0

[tor-browser-bundle/master] Revert "Bug 16351: Update our toolchain (Binutils/GCC)"
by gk＠torproject.org 29 Jun '15

29 Jun '15

commit a77485b5bab46e5947165afe05736035ba4012c9 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Jun 29 08:56:12 2015 +0000 Revert "Bug 16351: Update our toolchain (Binutils/GCC)" This reverts commit 50e6d095bd8d8eaef460d0bddda9455ff222c685. --- gitian/descriptors/windows/gitian-utils.yml | 3 ++ gitian/patches/enable-reloc-section-ld.patch | 53 +++++++++++-------- gitian/patches/gcc-dev-random.patch | 72 ++++++++++++++++++++++++++ gitian/patches/peXXigen.patch | 27 +++++----- gitian/versions.alpha | 6 +-- gitian/versions.nightly | 6 +-- 6 files changed, 125 insertions(+), 42 deletions(-) diff --git a/gitian/descriptors/windows/gitian-utils.yml b/gitian/descriptors/windows/gitian-utils.yml index 9162426..6e52c67 100644 --- a/gitian/descriptors/windows/gitian-utils.yml +++ b/gitian/descriptors/windows/gitian-utils.yml @@ -28,6 +28,7 @@ files: - "gmp.tar.bz2" - "enable-reloc-section-ld.patch" - "peXXigen.patch" +- "gcc-dev-random.patch" - "versions" - "dzip.sh" script: | @@ -74,6 +75,8 @@ script: | cd gcc tar -xjvf ../gcc.tar.bz2 cd gcc-* + # Don't use /dev/random on Windows. See bug 13169 for details. + patch -p1 < ../../gcc-dev-random.patch cd .. # We don't want to link against msvcrt.dll due to bug 9084. i686-w64-mingw32-g++ -dumpspecs > ~/build/msvcr100.spec diff --git a/gitian/patches/enable-reloc-section-ld.patch b/gitian/patches/enable-reloc-section-ld.patch index 5845d75..f393f51 100644 --- a/gitian/patches/enable-reloc-section-ld.patch +++ b/gitian/patches/enable-reloc-section-ld.patch @@ -1,23 +1,30 @@ -From 99ffc3f28b964519892cb1fb8bdc64d42b80d777 Mon Sep 17 00:00:00 2001 +From 093b08a9e7af23a258306b710ebc4556d12f94f7 Mon Sep 17 00:00:00 2001 From: Erinn Clark <erinn(a)torproject.org> Date: Fri, 8 Aug 2014 14:23:44 -0400 Subject: [PATCH] add relocation section so Windows bundles can have ASLR Patch by skruffy. +--- + ld/emultempl/pe.em | 6 +++++ + ld/emultempl/pep.em | 8 ++++++- + ld/pe-dll.c | 63 ++++++++++++++++++++++++++++++----------------------- + ld/pe-dll.h | 1 + + 4 files changed, 50 insertions(+), 28 deletions(-) + diff --git a/ld/emultempl/pe.em b/ld/emultempl/pe.em -index 979cc8b..4a63863 100644 +index 5d6da9e..14c07f7 100644 --- a/ld/emultempl/pe.em +++ b/ld/emultempl/pe.em -@@ -274,6 +274,7 @@ fragment <<EOF +@@ -268,6 +268,7 @@ fragment <<EOF + #define OPTION_TERMINAL_SERVER_AWARE (OPTION_WDM_DRIVER + 1) + /* Determinism. */ #define OPTION_INSERT_TIMESTAMP (OPTION_TERMINAL_SERVER_AWARE + 1) - #define OPTION_NO_INSERT_TIMESTAMP (OPTION_INSERT_TIMESTAMP + 1) - #define OPTION_BUILD_ID (OPTION_NO_INSERT_TIMESTAMP + 1) -+#define OPTION_ENABLE_RELOC_SECTION (OPTION_BUILD_ID + 1) ++#define OPTION_ENABLE_RELOC_SECTION (OPTION_INSERT_TIMESTAMP + 1) static void gld${EMULATION_NAME}_add_options -@@ -317,6 +318,7 @@ gld${EMULATION_NAME}_add_options +@@ -310,6 +311,7 @@ gld${EMULATION_NAME}_add_options {"export-all-symbols", no_argument, NULL, OPTION_EXPORT_ALL}, {"exclude-symbols", required_argument, NULL, OPTION_EXCLUDE_SYMBOLS}, {"exclude-all-symbols", no_argument, NULL, OPTION_EXCLUDE_ALL_SYMBOLS}, @@ -25,7 +32,7 @@ index 979cc8b..4a63863 100644 {"exclude-libs", required_argument, NULL, OPTION_EXCLUDE_LIBS}, {"exclude-modules-for-implib", required_argument, NULL, OPTION_EXCLUDE_MODULES_FOR_IMPLIB}, {"kill-at", no_argument, NULL, OPTION_KILL_ATS}, -@@ -787,6 +789,9 @@ gld${EMULATION_NAME}_handle_option (int optc) +@@ -773,6 +775,9 @@ gld${EMULATION_NAME}_handle_option (int optc) case OPTION_EXCLUDE_ALL_SYMBOLS: pe_dll_exclude_all_symbols = 1; break; @@ -35,7 +42,7 @@ index 979cc8b..4a63863 100644 case OPTION_EXCLUDE_LIBS: pe_dll_add_excludes (optarg, EXCLUDELIBS); break; -@@ -2059,6 +2064,7 @@ gld_${EMULATION_NAME}_finish (void) +@@ -1839,6 +1844,7 @@ gld_${EMULATION_NAME}_finish (void) if (link_info.shared #if !defined(TARGET_IS_shpe) || (!link_info.relocatable && pe_def_file->num_exports != 0) @@ -44,20 +51,20 @@ index 979cc8b..4a63863 100644 ) { diff --git a/ld/emultempl/pep.em b/ld/emultempl/pep.em -index b24a608..caf2946 100644 +index b738800..b566903 100644 --- a/ld/emultempl/pep.em +++ b/ld/emultempl/pep.em -@@ -248,7 +248,8 @@ enum options +@@ -242,7 +242,8 @@ enum options + OPTION_NO_BIND, + OPTION_WDM_DRIVER, OPTION_INSERT_TIMESTAMP, - OPTION_NO_INSERT_TIMESTAMP, - OPTION_TERMINAL_SERVER_AWARE, -- OPTION_BUILD_ID -+ OPTION_BUILD_ID, +- OPTION_TERMINAL_SERVER_AWARE ++ OPTION_TERMINAL_SERVER_AWARE, + OPTION_ENABLE_RELOC_SECTION }; static void -@@ -290,6 +291,7 @@ gld${EMULATION_NAME}_add_options +@@ -284,6 +285,7 @@ gld${EMULATION_NAME}_add_options {"export-all-symbols", no_argument, NULL, OPTION_EXPORT_ALL}, {"exclude-symbols", required_argument, NULL, OPTION_EXCLUDE_SYMBOLS}, {"exclude-all-symbols", no_argument, NULL, OPTION_EXCLUDE_ALL_SYMBOLS}, @@ -65,7 +72,7 @@ index b24a608..caf2946 100644 {"exclude-libs", required_argument, NULL, OPTION_EXCLUDE_LIBS}, {"exclude-modules-for-implib", required_argument, NULL, OPTION_EXCLUDE_MODULES_FOR_IMPLIB}, {"kill-at", no_argument, NULL, OPTION_KILL_ATS}, -@@ -743,6 +745,9 @@ gld${EMULATION_NAME}_handle_option (int optc) +@@ -727,6 +729,9 @@ gld${EMULATION_NAME}_handle_option (int optc) case OPTION_EXCLUDE_ALL_SYMBOLS: pep_dll_exclude_all_symbols = 1; break; @@ -75,7 +82,7 @@ index b24a608..caf2946 100644 case OPTION_EXCLUDE_LIBS: pep_dll_add_excludes (optarg, EXCLUDELIBS); break; -@@ -1838,6 +1843,7 @@ gld_${EMULATION_NAME}_finish (void) +@@ -1618,6 +1623,7 @@ gld_${EMULATION_NAME}_finish (void) #ifdef DLL_SUPPORT if (link_info.shared @@ -84,10 +91,10 @@ index b24a608..caf2946 100644 { pep_dll_fill_sections (link_info.output_bfd, &link_info); diff --git a/ld/pe-dll.c b/ld/pe-dll.c -index 61d8fa5..24c0c72 100644 +index e9e133b..4230dc3 100644 --- a/ld/pe-dll.c +++ b/ld/pe-dll.c -@@ -151,6 +151,7 @@ def_file * pe_def_file = 0; +@@ -152,6 +152,7 @@ def_file * pe_def_file = 0; int pe_dll_export_everything = 0; int pe_dll_exclude_all_symbols = 0; int pe_dll_do_default_excludes = 1; @@ -193,10 +200,10 @@ index 61d8fa5..24c0c72 100644 bfd_boolean diff --git a/ld/pe-dll.h b/ld/pe-dll.h -index 24ea302..6a0d633 100644 +index 4697390..2bf71d9 100644 --- a/ld/pe-dll.h +++ b/ld/pe-dll.h -@@ -30,6 +30,7 @@ extern def_file *pe_def_file; +@@ -31,6 +31,7 @@ extern def_file *pe_def_file; extern int pe_dll_export_everything; extern int pe_dll_exclude_all_symbols; extern int pe_dll_do_default_excludes; @@ -205,5 +212,5 @@ index 24ea302..6a0d633 100644 extern int pe_dll_stdcall_aliases; extern int pe_dll_warn_dup_exports; -- -1.7.9.5 +2.0.1 diff --git a/gitian/patches/gcc-dev-random.patch b/gitian/patches/gcc-dev-random.patch new file mode 100644 index 0000000..9757f92 --- /dev/null +++ b/gitian/patches/gcc-dev-random.patch @@ -0,0 +1,72 @@ +From b0ce14899060267b5b5e4d7e3d91edcdf5c09514 Mon Sep 17 00:00:00 2001 +From: law <law@138bc75d-0d04-0410-961f-82ee72b054a4> +Date: Tue, 10 Feb 2015 01:44:08 +0000 +Subject: [PATCH] * ssp.c (__guard_setup): For Windows, use approved methods + to get a suitable random number for the stack check guard + rather than reading /dev/random. + +git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/trunk@220559 138bc75d-0d04-0410-961f-82ee72b054a4 +--- + libssp/ChangeLog | 7 +++++++ + libssp/ssp.c | 16 ++++++++++++++++ + 2 files changed, 23 insertions(+) + +diff --git a/libssp/ChangeLog b/libssp/ChangeLog +index a445537..676d2a7 100644 +--- a/libssp/ChangeLog ++++ b/libssp/ChangeLog +@@ -1,3 +1,10 @@ ++2015-02-09 Georg Koppen <gk(a)torproject.org> ++ ++ * ssp.c: Conditionally include <windows.h> ++ (__guard_setup): For Windows, use approved methods to get ++ a suitable random number for the stack check guard rather ++ than reading /dev/random. ++ + 2014-07-16 Release Manager + + * GCC 4.9.1 released. +diff --git a/libssp/ssp.c b/libssp/ssp.c +index 96adf17..38e3ec8 100644 +--- a/libssp/ssp.c ++++ b/libssp/ssp.c +@@ -55,6 +55,7 @@ see the files COPYING3 and COPYING.RUNTIME respectively. If not, see + /* Native win32 apps don't know about /dev/tty but can print directly + to the console using "CONOUT$" */ + #if defined (_WIN32) && !defined (__CYGWIN__) ++#include <windows.h> + # define _PATH_TTY "CONOUT$" + #else + # define _PATH_TTY "/dev/tty" +@@ -75,6 +76,20 @@ __guard_setup (void) + if (__stack_chk_guard != 0) + return; + ++#if defined (_WIN32) && !defined (__CYGWIN__) ++ HCRYPTPROV hprovider = 0; ++ if (CryptAcquireContext(&hprovider, NULL, NULL, PROV_RSA_FULL, ++ CRYPT_VERIFYCONTEXT | CRYPT_SILENT)) ++ { ++ if (CryptGenRandom(hprovider, sizeof (__stack_chk_guard), ++ (BYTE *)&__stack_chk_guard) && __stack_chk_guard != 0) ++ { ++ CryptReleaseContext(hprovider, 0); ++ return; ++ } ++ CryptReleaseContext(hprovider, 0); ++ } ++#else + fd = open ("/dev/urandom", O_RDONLY); + if (fd != -1) + { +@@ -85,6 +100,7 @@ __guard_setup (void) + return; + } + ++#endif + /* If a random generator can't be used, the protector switches the guard + to the "terminator canary". */ + p = (unsigned char *) &__stack_chk_guard; +-- +1.7.10.4 + diff --git a/gitian/patches/peXXigen.patch b/gitian/patches/peXXigen.patch index 0ae0979..785aa02 100644 --- a/gitian/patches/peXXigen.patch +++ b/gitian/patches/peXXigen.patch @@ -1,13 +1,14 @@ -diff --git a/bfd/peXXigen.c b/bfd/peXXigen.c -index 13e39e4..deef7b3 100644 ---- a/bfd/peXXigen.c -+++ b/bfd/peXXigen.c -@@ -873,6 +873,8 @@ _bfd_XXi_only_swap_filehdr_out (bfd * abfd, void * in, void * out) - /* Only use a real timestamp if the option was chosen. */ - if ((pe_data (abfd)->insert_timestamp)) - H_PUT_32 (abfd, time (0), filehdr_out->f_timdat); -+ else -+ H_PUT_32 (abfd, 0, filehdr_out->f_timdat); - - PUT_FILEHDR_SYMPTR (abfd, filehdr_in->f_symptr, - filehdr_out->f_symptr); +diff -crB binutils-2.24/bfd/peXXigen.c binutils-2.24/bfd/peXXigen.c +*** binutils-2.24/bfd/peXXigen.c Tue Nov 26 11:37:33 2013 +--- binutils-2.24/bfd/peXXigen.c Mon Aug 4 07:10:15 2014 +*************** +*** 795,800 **** +--- 795,802 ---- + /* Only use a real timestamp if the option was chosen. */ + if ((pe_data (abfd)->insert_timestamp)) + H_PUT_32 (abfd, time(0), filehdr_out->f_timdat); ++ else ++ H_PUT_32 (abfd, 0, filehdr_out->f_timdat); + + PUT_FILEHDR_SYMPTR (abfd, filehdr_in->f_symptr, + filehdr_out->f_symptr); diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 3f94294..e7564d7 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -39,8 +39,8 @@ OPENSSL_VER=1.0.1o GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION FIREFOX_LANG_BUILD=build1 -BINUTILS_VER=2.25 -GCC_VER=5.1.0 +BINUTILS_VER=2.24 +GCC_VER=4.9.1 PYTHON_VER=2.7.5 PYCRYPTO_VER=2.6.1 ARGPARSE_VER=1.2.1 @@ -98,7 +98,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO_HASH=299a6fd8f8adfdce15bc06bde926e7b252ae8e24dd5b16b7d8791ed79e7b5e9b -GCC_HASH=b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad +GCC_HASH=d334781a124ada6f38e63b545e2a3b8c2183049515a1abab6d513f109f1d717e ## Non-git package URLs OPENSSL_URL=https://www.openssl.org/source/${OPENSSL_PACKAGE} diff --git a/gitian/versions.nightly b/gitian/versions.nightly index e613c6d..e2dc33b 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -42,8 +42,8 @@ OPENSSL_VER=1.0.1o GMP_VER=5.1.3 FIREFOX_LANG_VER=38.0.1esr #$FIREFOX_VERSION FIREFOX_LANG_BUILD=build2 -BINUTILS_VER=2.25 -GCC_VER=5.1.0 +BINUTILS_VER=2.24 +GCC_VER=4.9.1 PYTHON_VER=2.7.5 PYCRYPTO_VER=2.6.1 ARGPARSE_VER=1.2.1 @@ -101,7 +101,7 @@ PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 GO_HASH=299a6fd8f8adfdce15bc06bde926e7b252ae8e24dd5b16b7d8791ed79e7b5e9b -GCC_HASH=b7dafdf89cbb0e20333dbf5b5349319ae06e3d1a30bf3515b5488f7e89dca5ad +GCC_HASH=d334781a124ada6f38e63b545e2a3b8c2183049515a1abab6d513f109f1d717e ## Non-git package URLs OPENSSL_URL=https://www.openssl.org/source/${OPENSSL_PACKAGE}

1 0