- tbb-commits - lists.torproject.org

[tor-browser-bundle/master] Bug 18904: Mac OS meek-http-helper profile not updated
by gk＠torproject.org 16 May '16

16 May '16

commit 495885feb51d7f1faf6d4c0dc3dd8f47e9f1caa7 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Thu May 12 13:59:23 2016 -0400 Bug 18904: Mac OS meek-http-helper profile not updated When DATA_OUTSIDE_APP_DIR=1, add a meek-template-sha256sum.txt file to the meek-http-helper browser profile template. The meek-client-torbrowser program uses this file to automatically detect changes to the profile, e.g., after Tor Browser is updated. --- gitian/descriptors/mac/gitian-bundle.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/gitian/descriptors/mac/gitian-bundle.yml b/gitian/descriptors/mac/gitian-bundle.yml index ff17520..1d200b5 100644 --- a/gitian/descriptors/mac/gitian-bundle.yml +++ b/gitian/descriptors/mac/gitian-bundle.yml @@ -181,6 +181,12 @@ script: | cat ~/build/torrc-defaults-appendix-mac >> $TORCONFIGPATH/torrc-defaults cat ~/build/bridge_prefs.js >> $EXTOVERRIDESPATH cat ~/build/meek-http-helper-user.js >> $MEEKPROFILEPATH/user.js + if [ "z$DATA_OUTSIDE_APP_DIR" = "z1" ]; then + # Create the meek-template-sha256sum.txt file by generating a list + # of hashes (one for each file within the meek-http-helper profile) and + # and then generating one final hash from the contents of the list. + sha256sum `find $MEEKPROFILEPATH -type f | sort` | sha256sum | sed -e 's/ *-$//' > $MEEKPROFILEPATH/meek-template-sha256sum.txt + fi fi # If not building a multi-lingual package, suppress the language prompt. if [ "z$MULTI_LINGUAL" != "z1" ]; then

1 0

[torbutton/master] Bug 18743: Pref to hide 'Sign in to Sync' button in hamburger menu
by gk＠torproject.org 16 May '16

16 May '16

commit d127873b498fb83e4f608b82a8d382df25183dd3 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Mon Apr 25 23:03:17 2016 -0700 Bug 18743: Pref to hide 'Sign in to Sync' button in hamburger menu --- src/chrome/content/torbutton.js | 16 ++++++++++++++++ src/defaults/preferences/preferences.js | 1 + 2 files changed, 17 insertions(+) diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index a8a4ce6..a293c44 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -236,6 +236,9 @@ var torbutton_unique_pref_observer = case "extensions.torbutton.restrict_thirdparty": torbutton_update_thirdparty_prefs(); break; + case "extensions.torbutton.hide_sync_ui": + torbutton_update_sync_ui(); + break; case "gfx.font_rendering.opentype_svg.enabled": case "javascript.options.ion.content": case "javascript.options.typeinference": @@ -625,6 +628,7 @@ function torbutton_init() { torbutton_update_toolbutton(mode); torbutton_update_statusbar(mode); torbutton_notify_if_update_needed(); + torbutton_update_sync_ui(); createTorCircuitDisplay(m_tb_control_host, m_tb_control_port, m_tb_control_pass, "extensions.torbutton.display_circuit"); @@ -3566,4 +3570,16 @@ function torbutton_is_homepage_url(aURI) return (urls.indexOf(aURI.spec) >= 0); } +// Check if "extensions.torbutton.hide_sync_ui" is enabled, and if so, +// hide the "Sign in to Sync" button on the hamburger menu. +function torbutton_update_sync_ui() +{ + try { + document.getElementById("PanelUI-footer-fxa").style.display = + getBoolPref("extensions.torbutton.hide_sync_ui") ? "none" : ""; + } catch (e) { + torbutton_log(5, 'Error updating the Sync UI: ' + e); + } +} + //vim:set ts=4 diff --git a/src/defaults/preferences/preferences.js b/src/defaults/preferences/preferences.js index 548f4ed..c958ec4 100644 --- a/src/defaults/preferences/preferences.js +++ b/src/defaults/preferences/preferences.js @@ -9,6 +9,7 @@ pref("extensions.torbutton.display_panel",true); pref("extensions.torbutton.panel_style",'text'); pref("extensions.torbutton(a)torproject.org.description", "chrome://torbutton/locale/torbutton.properties"); pref("extensions.torbutton.updateNeeded", false); +pref("extensions.torbutton.hide_sync_ui", true); // proxy prefs pref("extensions.torbutton.settings_method",'recommended');

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] fixup! Bug 12827: Create preference to disable SVG.
by gk＠torproject.org 16 May '16

16 May '16

commit 7ffe3230d2b6020394803784c140765e7c8e4b76 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue May 10 16:57:17 2016 -0400 fixup! Bug 12827: Create preference to disable SVG. When SVGs are disabled, do no load SVG images within the Page Info Media tab (bug 18770). --- image/ImageFactory.cpp | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/image/ImageFactory.cpp b/image/ImageFactory.cpp index 9298d74..ec20c78 100644 --- a/image/ImageFactory.cpp +++ b/image/ImageFactory.cpp @@ -98,8 +98,10 @@ ImageFactory::CreateImage(nsIRequest* aRequest, nsCOMPtr<nsIChannel> channel(do_QueryInterface(aRequest)); isBlocked = !NS_SVGEnabledForChannel(channel); if (!isBlocked && channel && !NS_SVGEnabledForChannel(nullptr)) { - // Special case for favicons: block this image load if SVGs are - // disallowed from content and if this image load originated from the + // This SVG was not blocked based on the channel but SVGs are + // disallowed from content. Check some special cases. + + // For favicons, block this SVG image load if it originated from the // favicon xul:image node within a tab. nsCOMPtr<nsILoadInfo> loadInfo; nsresult rv = channel->GetLoadInfo(getter_AddRefs(loadInfo)); @@ -111,6 +113,17 @@ ImageFactory::CreateImage(nsIRequest* aRequest, nsAutoString anonid; elem->GetAttribute(NS_LITERAL_STRING("anonid"), anonid); isBlocked = anonid.EqualsLiteral("tab-icon-image"); + + if (!isBlocked) { + // For the Page Info "Media" tab, block this SVG image load if + // it originated from a node within a chrome document that has + // an id of "thepreviewimage". + if (nsContentUtils::IsChromeDoc(node->OwnerDoc())) { + nsAutoString loadingID; + elem->GetId(loadingID); + isBlocked = loadingID.EqualsLiteral("thepreviewimage"); + } + } } } }

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] fixup! Regression tests for #5856: Do not expose physical screen info via window & window.screen.
by gk＠torproject.org 13 May '16

13 May '16

commit ec74b173f8a00e59aa42e0cf32e65ec2266cb477 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Sun May 8 23:33:39 2016 -0700 fixup! Regression tests for #5856: Do not expose physical screen info via window & window.screen. --- tbb-tests/test_tor_bug5856.html | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tbb-tests/test_tor_bug5856.html b/tbb-tests/test_tor_bug5856.html index 2eae453..7a9ab6f 100644 --- a/tbb-tests/test_tor_bug5856.html +++ b/tbb-tests/test_tor_bug5856.html @@ -27,7 +27,10 @@ https://trac.torproject.org/projects/tor/ticket/5856 ["window.screen.availLeft", 0], ["window.screen.availTop", 0], ["window.screen.width", "window.innerWidth"], - ["window.screen.height", "window.innerHeight"] + ["window.screen.height", "window.innerHeight"], + ["window.screen.orientation.type", "'landscape-primary'"], + ["window.screen.orientation.angle", 0], + ["window.screen.mozOrientation", "'landscape-primary'"], ]; pairs.map(checkPair);

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] Bug 18958: Spoof screen.orientation values
by gk＠torproject.org 13 May '16

13 May '16

commit a086a5d0070821b1c4dfd2492bdc993c91353a2b Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Sun May 8 22:23:42 2016 -0700 Bug 18958: Spoof screen.orientation values Make sure that screen.orientation.angle -> 0 and screen.orientation.type -> "landscape-primary" Also refactors screen.mozOrientation. --- dom/base/ScreenOrientation.cpp | 29 +++++++++++++++++++++++++++-- dom/base/ScreenOrientation.h | 2 ++ dom/base/nsGlobalWindow.cpp | 7 ++++--- dom/base/nsScreen.cpp | 38 ++++++++++++++++++++------------------ 4 files changed, 53 insertions(+), 23 deletions(-) diff --git a/dom/base/ScreenOrientation.cpp b/dom/base/ScreenOrientation.cpp index 868a1d5..fdea67a 100644 --- a/dom/base/ScreenOrientation.cpp +++ b/dom/base/ScreenOrientation.cpp @@ -15,6 +15,7 @@ #include "mozilla/Preferences.h" #include "mozilla/dom/Promise.h" +#include "nsContentUtils.h" using namespace mozilla; using namespace mozilla::dom; @@ -403,18 +404,23 @@ ScreenOrientation::UnlockDeviceOrientation() OrientationType ScreenOrientation::DeviceType() const { - return mType; + return ShouldResistFingerprinting() ? OrientationType::Landscape_primary + : mType; } uint16_t ScreenOrientation::DeviceAngle() const { - return mAngle; + return ShouldResistFingerprinting() ? 0 : mAngle; } OrientationType ScreenOrientation::GetType(ErrorResult& aRv) const { + if (ShouldResistFingerprinting()) { + return OrientationType::Landscape_primary; + } + nsIDocument* doc = GetResponsibleDocument(); if (!doc) { aRv.Throw(NS_ERROR_UNEXPECTED); @@ -427,6 +433,10 @@ ScreenOrientation::GetType(ErrorResult& aRv) const uint16_t ScreenOrientation::GetAngle(ErrorResult& aRv) const { + if (ShouldResistFingerprinting()) { + return 0; + } + nsIDocument* doc = GetResponsibleDocument(); if (!doc) { aRv.Throw(NS_ERROR_UNEXPECTED); @@ -489,6 +499,10 @@ ScreenOrientation::GetResponsibleDocument() const void ScreenOrientation::Notify(const hal::ScreenConfiguration& aConfiguration) { + if (ShouldResistFingerprinting()) { + return; + } + nsIDocument* doc = GetResponsibleDocument(); if (!doc) { return; @@ -564,6 +578,17 @@ ScreenOrientation::WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto) return ScreenOrientationBinding::Wrap(aCx, this, aGivenProto); } +bool +ScreenOrientation::ShouldResistFingerprinting() const +{ + bool resist = false; + nsCOMPtr<nsPIDOMWindow> owner = GetOwner(); + if (owner) { + resist = nsContentUtils::ShouldResistFingerprinting(owner->GetDocShell()); + } + return resist; +} + NS_IMPL_ISUPPORTS(ScreenOrientation::VisibleEventListener, nsIDOMEventListener) NS_IMETHODIMP diff --git a/dom/base/ScreenOrientation.h b/dom/base/ScreenOrientation.h index afb5e77..a6e51c7 100644 --- a/dom/base/ScreenOrientation.h +++ b/dom/base/ScreenOrientation.h @@ -102,6 +102,8 @@ private: void DispatchChangeEvent(); + bool ShouldResistFingerprinting() const; + LockPermission GetLockOrientationPermission(bool aCheckSandbox) const; // Gets the responsible document as defined in the spec. diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp index ed42538..6dc06b1 100644 --- a/dom/base/nsGlobalWindow.cpp +++ b/dom/base/nsGlobalWindow.cpp @@ -12820,8 +12820,8 @@ void nsGlobalWindow::EnableOrientationChangeListener() { MOZ_ASSERT(IsInnerWindow()); - - if (!mOrientationChangeObserver) { + if (!nsContentUtils::ShouldResistFingerprinting(mDocShell) + && !mOrientationChangeObserver) { mOrientationChangeObserver = new WindowOrientationObserver(this); } @@ -13671,7 +13671,8 @@ nsGlobalWindow::IsModalContentWindow(JSContext* aCx, JSObject* aGlobal) int16_t nsGlobalWindow::Orientation() const { - return WindowOrientationObserver::OrientationAngle(); + return nsContentUtils::ShouldResistFingerprinting(mDocShell) ? + 0 : WindowOrientationObserver::OrientationAngle(); } #endif diff --git a/dom/base/nsScreen.cpp b/dom/base/nsScreen.cpp index ad1642b..49c12eb 100644 --- a/dom/base/nsScreen.cpp +++ b/dom/base/nsScreen.cpp @@ -166,25 +166,21 @@ nsScreen::Orientation() const void nsScreen::GetMozOrientation(nsString& aOrientation) const { - if (ShouldResistFingerprinting()) { + switch (mScreenOrientation->DeviceType()) { + case OrientationType::Portrait_primary: + aOrientation.AssignLiteral("portrait-primary"); + break; + case OrientationType::Portrait_secondary: + aOrientation.AssignLiteral("portrait-secondary"); + break; + case OrientationType::Landscape_primary: aOrientation.AssignLiteral("landscape-primary"); - } else { - switch (mScreenOrientation->DeviceType()) { - case OrientationType::Portrait_primary: - aOrientation.AssignLiteral("portrait-primary"); - break; - case OrientationType::Portrait_secondary: - aOrientation.AssignLiteral("portrait-secondary"); - break; - case OrientationType::Landscape_primary: - aOrientation.AssignLiteral("landscape-primary"); - break; - case OrientationType::Landscape_secondary: - aOrientation.AssignLiteral("landscape-secondary"); - break; - default: - MOZ_CRASH("Unacceptable screen orientation type."); - } + break; + case OrientationType::Landscape_secondary: + aOrientation.AssignLiteral("landscape-secondary"); + break; + default: + MOZ_CRASH("Unacceptable screen orientation type."); } } @@ -236,6 +232,9 @@ bool nsScreen::MozLockOrientation(const Sequence<nsString>& aOrientations, ErrorResult& aRv) { + if (ShouldResistFingerprinting()) { + return false; + } ScreenOrientationInternal orientation = eScreenOrientation_None; for (uint32_t i = 0; i < aOrientations.Length(); ++i) { @@ -283,6 +282,9 @@ nsScreen::MozLockOrientation(const Sequence<nsString>& aOrientations, void nsScreen::MozUnlockOrientation() { + if (ShouldResistFingerprinting()) { + return; + } UpdateDocShellOrientationLock(GetOwner(), eScreenOrientation_None); mScreenOrientation->UnlockDeviceOrientation(); }

1 0

[tor-browser-bundle/hardened-builds] Bug 17406: Include SelfRando support in our nightlies
by gk＠torproject.org 13 May '16

13 May '16

commit 138470ca7ce810f62761af8c3989654ec4a611fa Author: Georg Koppen <gk(a)torproject.org> Date: Thu May 12 20:25:02 2016 +0000 Bug 17406: Include SelfRando support in our nightlies SelfRando is a new defense against code reuse attacks developed by the Radactor and Readactor++ people. We should give it a wider testing audience by including it in the nightly. --- RelativeLink/start-tor-browser | 3 + gitian/descriptors/linux/gitian-firefox.yml | 7 + gitian/descriptors/linux/gitian-utils.yml | 38 +++- gitian/fetch-inputs.sh | 4 +- gitian/gpg/ELFUTILS.gpg | Bin 0 -> 10483 bytes gitian/mkbundle-linux.sh | 9 +- gitian/patches/libfaketime-asan.patch | 268 ++++++++++++++++++++++++++-- gitian/verify-tags.sh | 3 +- gitian/versions.nightly | 4 + 9 files changed, 313 insertions(+), 23 deletions(-) diff --git a/RelativeLink/start-tor-browser b/RelativeLink/start-tor-browser index 2e7805d..19c5cfc 100755 --- a/RelativeLink/start-tor-browser +++ b/RelativeLink/start-tor-browser @@ -270,6 +270,9 @@ fi LD_LIBRARY_PATH="${HOME}/TorBrowser/Tor/" export LD_LIBRARY_PATH +export SELFRANDO_write_layout_file= +export NSS_DISABLE_HW_AES=1 + # We need to disable LSan which is enabled by default now. Otherwise we'll get # a crash during shutdown: https://bugs.torproject.org/10599#comment:59 ASAN_OPTIONS="detect_leaks=0" diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index e24a740..22686b7 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -29,12 +29,15 @@ remotes: "dir": "tor-browser" - "url": "https://github.com/wolfcw/libfaketime" "dir": "faketime" +- "url": "https://github.com/immunant/selfrando.git" + "dir": "selfrando" files: - "binutils-linux64-utils.zip" - "gcc-linux64-utils.zip" - "re-dzip.sh" - "dzip.sh" - "versions" +- "self-rando-utils.zip" script: | source versions INSTDIR="$HOME/install" @@ -49,6 +52,7 @@ script: | export DEB_BUILD_HARDENING_FORMAT=1 export DEB_BUILD_HARDENING_PIE=1 # + unzip -d $INSTDIR self-rando-utils.zip # Preparing Binutils and GCC for Tor Browser unzip -d $INSTDIR binutils-linux$GBUILD_BITS-utils.zip # Make sure gold is used with the hardening wrapper for full RELRO, see @@ -96,6 +100,9 @@ script: | # that feature it would hang sometimes for unknown but to libfaketime related # reasons. export LD_PRELOAD="" + # Self-Rando wrapper + export PATH="$HOME/build/selfrando/Tools/TorBrowser/tc-wrapper/:$PATH" + export SELFRANDO_skip_shuffle= make -f client.mk configure CONFIGURE_ARGS="--with-tor-browser-version=${TORBROWSER_VERSION} --enable-update-channel=${TORBROWSER_UPDATE_CHANNEL} --enable-bundled-fonts" # We need libfaketime for all the timestamps e.g. written into the libraries. # BUT we need to exclude |make build| from it. Otherwise the build fails close diff --git a/gitian/descriptors/linux/gitian-utils.yml b/gitian/descriptors/linux/gitian-utils.yml index 72ead1b..15b26f4 100644 --- a/gitian/descriptors/linux/gitian-utils.yml +++ b/gitian/descriptors/linux/gitian-utils.yml @@ -24,10 +24,14 @@ packages: - "libssl-dev" # Needed for binutils (64bit) as we are building with PIE enabled. - "libstdc++6-4.7-pic" +# Needed for Selfrando +- "scons" reference_datetime: "2000-01-01 00:00:00" remotes: - "url": "https://github.com/libevent/libevent.git" "dir": "libevent" +- "url": "https://github.com/immunant/selfrando.git" + "dir": "selfrando" files: - "binutils.tar.bz2" - "gcc.tar.bz2" @@ -36,6 +40,7 @@ files: - "versions" - "dzip.sh" - "libfaketime-asan.patch" +- "elfutils.tar.bz2" script: | INSTDIR="$HOME/install" source versions @@ -56,11 +61,8 @@ script: | # The libstdc++ shipped by default is non-PIC which breaks the binutils build # if we build with DEB_BUILD_HARDENING_PIE=1. We need to install a PIC one AND # make sure it gets used before the non-PIC one would. - if [ $GBUILD_BITS == "64" ]; - then - ln -s /usr/lib/gcc/x86_64-linux-gnu/4.7/libstdc++_pic.a libstdc++.a - export LDFLAGS="-L/home/debian -lstdc++" - fi + ln -s /usr/lib/gcc/x86_64-linux-gnu/4.7/libstdc++_pic.a libstdc++.a + export LDFLAGS="-L/home/debian -lstdc++" cd binutils* # We want to use gold as the linker in our toolchain mainly as it is way # faster when linking Tor Browser code (especially libxul). But apart from @@ -90,6 +92,31 @@ script: | cd .. export DEB_BUILD_HARDENING_FORMAT=1 + OPATH="$PATH" + OLD_LIBRARY_PATH="$LD_LIBRARY_PATH" + export PATH="$INSTDIR/binutils/bin:$INSTDIR/gcc/bin:$PATH" + export LD_LIBRARY_PATH="$INSTDIR/gcc/lib64/:$LD_LIBRARY_PATH" + + # Building Elfutils + tar xjf elfutils.tar.bz2 + cd elfutils*/ + ./configure --prefix=$INSTDIR/elfutils + make $MAKEOPTS + make install + cd .. + + # Building Selfrando + cd selfrando + scons -Q arch=x86_64 ADDN_CCFLAGS="-include $(ls $HOME/build/elfutils-*/libelf/elf.h) -I $INSTDIR/elfutils/include -fno-reorder-functions" ADDN_LINKFLAGS="-L $INSTDIR/elfutils/lib" + mkdir -p $INSTDIR/self-rando + cp sconsRelease/x86_64/bin/* $INSTDIR/self-rando/ + cd .. + + PATH="$OPATH" + unset OPATH + LD_LIBRARY_PATH="$OLD_LIBRARY_PATH" + unset OLD_LIBRARY_PATH + # Building Libevent cd libevent ./autogen.sh @@ -134,4 +161,5 @@ script: | ~/build/dzip.sh openssl-$OPENSSL_VER-linux$GBUILD_BITS-utils.zip openssl ~/build/dzip.sh libevent-${LIBEVENT_TAG#release-}-linux$GBUILD_BITS-utils.zip libevent ~/build/dzip.sh gmp-$GMP_VER-linux$GBUILD_BITS-utils.zip gmp + ~/build/dzip.sh self-rando-utils.zip self-rando cp *utils.zip $OUTDIR/ diff --git a/gitian/fetch-inputs.sh b/gitian/fetch-inputs.sh index 027a47e..4f63374 100755 --- a/gitian/fetch-inputs.sh +++ b/gitian/fetch-inputs.sh @@ -112,7 +112,7 @@ update_git() { ############################################################################## # Get+verify sigs that exist -for i in OPENSSL BINUTILS GCC PYCRYPTO PYTHON_MSI GMP +for i in OPENSSL BINUTILS GCC PYCRYPTO PYTHON_MSI GMP ELFUTILS do PACKAGE="${i}_PACKAGE" URL="${i}_URL" @@ -236,6 +236,7 @@ ln -sf "$SETUPTOOLS_PACKAGE" setuptools.tar.gz ln -sf "$GMP_PACKAGE" gmp.tar.bz2 ln -sf "$PARSLEY_PACKAGE" parsley.tar.gz ln -sf "$GO_PACKAGE" go.tar.gz +ln -sf "$ELFUTILS_PACKAGE" elfutils.tar.bz2 # Fetch latest gitian-builder itself # XXX - this is broken if a non-standard inputs dir is selected using the command line flag. @@ -273,6 +274,7 @@ goxcrypto https://go.googlesource.com/crypto $GO_X_CRYPTO_TAG goxnet https://go.googlesource.com/net $GO_X_NET_TAG obfs4 https://git.torproject.org/pluggable-transports/obfs4.git $OBFS4_TAG noto-fonts https://github.com/googlei18n/noto-fonts $NOTOFONTS_TAG +selfrando https://github.com/immunant/selfrando.git $SELFRANDO_TAG EOF # HTTPS-Everywhere is special, too. We need to initialize the git submodules and diff --git a/gitian/gpg/ELFUTILS.gpg b/gitian/gpg/ELFUTILS.gpg new file mode 100644 index 0000000..f1cd4b3 Binary files /dev/null and b/gitian/gpg/ELFUTILS.gpg differ diff --git a/gitian/mkbundle-linux.sh b/gitian/mkbundle-linux.sh index a1674dd..48aac24 100755 --- a/gitian/mkbundle-linux.sh +++ b/gitian/mkbundle-linux.sh @@ -35,7 +35,7 @@ fi if [ -z "$VM_MEMORY" ]; then - export VM_MEMORY=4000 + export VM_MEMORY=6000 fi ./make-vms.sh @@ -104,13 +104,14 @@ if [ ! -f inputs/binutils-$BINUTILS_VER-linux64-utils.zip -o \ ! -f inputs/gcc-$GCC_VER-linux64-utils.zip -o \ ! -f inputs/openssl-$OPENSSL_VER-linux64-utils.zip -o \ ! -f inputs/libevent-${LIBEVENT_TAG_ORIG#release-}-linux64-utils.zip -o \ - ! -f inputs/gmp-$GMP_VER-linux64-utils.zip ]; + ! -f inputs/gmp-$GMP_VER-linux64-utils.zip -o \ + ! -f inputs/self-rando-utils.zip ]; then echo echo "****** Starting Utilities Component of Linux Bundle (1/5 for Linux) ******" echo - ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit libevent=$LIBEVENT_TAG $DESCRIPTOR_DIR/linux/gitian-utils.yml + ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit libevent=$LIBEVENT_TAG,selfrando=$SELFRANDO_TAG $DESCRIPTOR_DIR/linux/gitian-utils.yml if [ $? -ne 0 ]; then #mv var/build.log ./utils-fail-linux.log.`date +%Y%m%d%H%M%S` @@ -169,7 +170,7 @@ then echo "****** Starting TorBrowser Component of Linux Bundle (3/5 for Linux) ******" echo - ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit tor-browser=$TORBROWSER_TAG,faketime=$FAKETIME_TAG $DESCRIPTOR_DIR/linux/gitian-firefox.yml + ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit tor-browser=$TORBROWSER_TAG,faketime=$FAKETIME_TAG,selfrando=$SELFRANDO_TAG $DESCRIPTOR_DIR/linux/gitian-firefox.yml if [ $? -ne 0 ]; then #mv var/build.log ./firefox-fail-linux.log.`date +%Y%m%d%H%M%S` diff --git a/gitian/patches/libfaketime-asan.patch b/gitian/patches/libfaketime-asan.patch index 5346eae..ff3e62b 100644 --- a/gitian/patches/libfaketime-asan.patch +++ b/gitian/patches/libfaketime-asan.patch @@ -1,12 +1,3 @@ -From 0ef83e9a0631e25e62e1dbc483108742fc125304 Mon Sep 17 00:00:00 2001 -From: Georg Koppen <gk(a)torproject.org> -Date: Mon, 14 Sep 2015 14:27:36 +0000 -Subject: [PATCH] No dying anymore - ---- - libsanitizer/asan/asan_linux.cc | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - diff --git a/libsanitizer/asan/asan_linux.cc b/libsanitizer/asan/asan_linux.cc index c504168..1d1a6dd 100644 --- a/libsanitizer/asan/asan_linux.cc @@ -23,6 +14,259 @@ index c504168..1d1a6dd 100644 } } --- -1.7.10.4 - +diff --git a/libsanitizer/sanitizer_common/SelfRandoAddressTranslator.h b/libsanitizer/sanitizer_common/SelfRandoAddressTranslator.h +new file mode 100644 +index 0000000..5f13870 +--- /dev/null ++++ b/libsanitizer/sanitizer_common/SelfRandoAddressTranslator.h +@@ -0,0 +1,155 @@ ++// ++// Created by tf on 10/12/2015. ++// ++ ++#pragma once ++#include "sanitizer_internal_defs.h" ++#include "sanitizer_libc.h" ++#include "sanitizer_common.h" ++ ++#define PROT_READ 0x1 /* Page can be read. */ ++#define PROT_WRITE 0x2 /* Page can be written. */ ++#define PROT_EXEC 0x4 /* Page can be executed. */ ++#define PROT_NONE 0x0 /* Page can not be accessed. */ ++#define MAP_SHARED 0x01 /* Share changes. */ ++ ++namespace __sanitizer { ++ class SelfRandoAddressTranslator { ++ struct __attribute__((__packed__)) FunctionRecord { ++ void *undiv_addr; ++ void *div_addr; ++ u32 size; ++ }; ++ ++ struct __attribute__((__packed__)) LibraryRecord { ++ u32 version; ++ u32 seed; ++ void *file_base; ++ void *mem_base; ++ void *size; ++ ++ private: ++ char _name; ++ ++ public: ++ inline char *name() { return &_name; } ++ ++ inline FunctionRecord *function_records() { ++ return (FunctionRecord *) (&_name + internal_strlen(&_name) + 1); ++ } ++ ++ u8 *record_end() { ++ FunctionRecord *fr = function_records(); ++ while (fr->undiv_addr) { ++ fr++; ++ } ++ return (u8 *) fr + sizeof(void *); ++ } ++ }; ++ ++ // 16K loaded modules should be enough for everyone. ++ LibraryRecord* library_records_idx[1<<14]; ++ int library_records_idx_size; ++ u8 *library_records_end; ++ void add_library_record(LibraryRecord* lr); ++ ++ void read_layout_file(); ++ u8 *record_end(int i); ++ ++ public: ++ SelfRandoAddressTranslator(); ++ ++ uptr convertAddress(uptr original_address); ++ }; ++ ++ ++ ++ ++ SelfRandoAddressTranslator::SelfRandoAddressTranslator() { ++ Printf("SRAT init\n"); ++ read_layout_file(); ++ } ++ ++ void SelfRandoAddressTranslator::add_library_record(LibraryRecord* lr) { ++ library_records_idx_size++; ++ CHECK(library_records_idx_size <= 1<<14); ++ library_records_idx[library_records_idx_size - 1] = lr; ++ } ++ ++ u8* SelfRandoAddressTranslator::record_end(int i) { ++ if (i < library_records_idx_size - 1) { ++ return (u8 *) library_records_idx[i + 1] - sizeof(void *); ++ } else { ++ return library_records_end - sizeof(void*); ++ } ++ } ++ ++ void SelfRandoAddressTranslator::read_layout_file() { ++ uptr pid = internal_getpid(); ++ char filename[32]; ++ internal_snprintf(filename, 32, "/tmp/%d.mlf", pid); ++ ++ u8 buf[200]; // Current size of struct stat: 144 ++ if(0 != internal_stat(filename, &buf)) { ++ Printf("SRAT warning: cannot find Memory Layout File. Stack trace will be probably wrong.\n"); ++ return; ++ } ++ ++ uptr fd = OpenFile(filename, /*write*/ false); ++ uptr size = *(uptr*) (buf+48); ++ CHECK_NE(fd, -1); ++ u8 *f = (u8 *) internal_mmap(0, size, PROT_READ, MAP_SHARED, (int) fd, 0); ++ CHECK_NE(f, 0); ++ library_records_end = f + size; ++ ++ u8 *p = f; ++ while (p < library_records_end) { ++ LibraryRecord *lr = (LibraryRecord *) p; ++ add_library_record(lr); ++ CHECK_EQ(lr->version, 0x00000101); ++ p = lr->record_end(); ++ } ++ ++ } ++ ++ uptr SelfRandoAddressTranslator::convertAddress(uptr p) { ++// Printf("conv %p", p); ++ for (int i = 0; i < library_records_idx_size; ++i) { ++ LibraryRecord *lr = library_records_idx[i]; ++ ++ if (p > (uptr) lr->mem_base && p < (uptr) lr->mem_base + (uptr) lr->size) { ++ // found the correct library ++ ++ FunctionRecord *function_records = lr->function_records(); ++ ++ int a = 0; ++ int b = (int) ((FunctionRecord *) record_end(i) - function_records); ++// Printf(" (lib=>%s< a=%d b=%d)", lr->name(), a, b); ++ CHECK_EQ((u8 *) (function_records + b), record_end(i)); ++ ++ while (b - a > 1) { // bisection ++ int c = a + (b - a) / 2; ++ FunctionRecord *fr = &function_records[c]; ++ ++ if ((uptr) fr->div_addr > p) { // too high ++ b = c; ++ } else if ((uptr) fr->div_addr + (uptr) fr->size < p) { // too low ++ a = c; ++ } else { // found ++ b = c + 1; ++ a = c; ++ } ++ } ++ FunctionRecord *fr = &function_records[a]; ++ CHECK((uptr) fr->div_addr < p && p < (uptr) fr->div_addr + (uptr) fr->size); ++ ++ p = (p - (uptr) fr->div_addr + (uptr) fr->undiv_addr); ++ ++ break; ++ } ++ } ++ ++// Printf(" => %p\n", p); ++ return p; ++ } ++} +\ No newline at end of file +diff --git a/libsanitizer/sanitizer_common/sanitizer_symbolizer_posix_libcdep.cc b/libsanitizer/sanitizer_common/sanitizer_symbolizer_posix_libcdep.cc +index 5cc21d3..393a494 100644 +--- a/libsanitizer/sanitizer_common/sanitizer_symbolizer_posix_libcdep.cc ++++ b/libsanitizer/sanitizer_common/sanitizer_symbolizer_posix_libcdep.cc +@@ -21,6 +21,7 @@ + #include "sanitizer_procmaps.h" + #include "sanitizer_symbolizer.h" + #include "sanitizer_symbolizer_libbacktrace.h" ++#include "SelfRandoAddressTranslator.h" + + #include <errno.h> + #include <stdlib.h> +@@ -512,7 +513,7 @@ class POSIXSymbolizer : public Symbolizer { + internal_symbolizer_(internal_symbolizer), + libbacktrace_symbolizer_(libbacktrace_symbolizer) {} + +- uptr SymbolizePC(uptr addr, AddressInfo *frames, uptr max_frames) { ++ virtual uptr SymbolizePC(uptr addr, AddressInfo *frames, uptr max_frames) { + BlockingMutexLock l(&mu_); + if (max_frames == 0) + return 0; +@@ -580,7 +581,7 @@ class POSIXSymbolizer : public Symbolizer { + return frame_id; + } + +- bool SymbolizeData(uptr addr, DataInfo *info) { ++ virtual bool SymbolizeData(uptr addr, DataInfo *info) { + BlockingMutexLock l(&mu_); + LoadedModule *module = FindModuleForAddress(addr); + if (module == 0) +@@ -606,7 +607,7 @@ class POSIXSymbolizer : public Symbolizer { + return true; + } + +- bool GetModuleNameAndOffsetForPC(uptr pc, const char **module_name, ++ virtual bool GetModuleNameAndOffsetForPC(uptr pc, const char **module_name, + uptr *module_address) { + BlockingMutexLock l(&mu_); + return FindModuleNameAndOffsetForAddress(pc, module_name, module_address); +@@ -720,9 +721,40 @@ class POSIXSymbolizer : public Symbolizer { + LibbacktraceSymbolizer *libbacktrace_symbolizer_; // Leaked. + }; + ++ ++ class SelfRandoPOSIXSymbolizer : public POSIXSymbolizer { ++ SelfRandoAddressTranslator translator; ++ ++ public: ++ SelfRandoPOSIXSymbolizer(ExternalSymbolizerInterface *external_symbolizer, ++ InternalSymbolizer *internal_symbolizer, ++ LibbacktraceSymbolizer *libbacktrace_symbolizer) ++ : POSIXSymbolizer(external_symbolizer, internal_symbolizer, libbacktrace_symbolizer), ++ translator() { } ++ ++ ++ private: ++ virtual uptr SymbolizePC(uptr addr, AddressInfo *frames, uptr max_frames) override { ++ uptr conv_addr = translator.convertAddress(addr); ++ uptr res = POSIXSymbolizer::SymbolizePC(conv_addr, frames, max_frames); ++ if (res == 1) frames->address = addr; ++ return res; ++ } ++ ++ virtual bool SymbolizeData(uptr addr, DataInfo *info) override { ++ addr = translator.convertAddress(addr); ++ return POSIXSymbolizer::SymbolizeData(addr, info); ++ } ++ ++ virtual bool GetModuleNameAndOffsetForPC(uptr pc, const char **module_name, uptr *module_address) override { ++ pc = translator.convertAddress(pc); ++ return POSIXSymbolizer::GetModuleNameAndOffsetForPC(pc, module_name, module_address); ++ }; ++ }; ++ + Symbolizer *Symbolizer::PlatformInit() { + if (!common_flags()->symbolize) { +- return new(symbolizer_allocator_) POSIXSymbolizer(0, 0, 0); ++ return new(symbolizer_allocator_) SelfRandoPOSIXSymbolizer(0, 0, 0); + } + InternalSymbolizer* internal_symbolizer = + InternalSymbolizer::get(&symbolizer_allocator_); +@@ -754,10 +786,11 @@ Symbolizer *Symbolizer::PlatformInit() { + } + } + +- return new(symbolizer_allocator_) POSIXSymbolizer( ++ return new(symbolizer_allocator_) SelfRandoPOSIXSymbolizer( + external_symbolizer, internal_symbolizer, libbacktrace_symbolizer); + } + ++ + } // namespace __sanitizer + + #endif // SANITIZER_POSIX diff --git a/gitian/verify-tags.sh b/gitian/verify-tags.sh index 46cb01a..5268f85 100755 --- a/gitian/verify-tags.sh +++ b/gitian/verify-tags.sh @@ -118,10 +118,11 @@ siphash $GOSIPHASH_TAG goxcrypto $GO_X_CRYPTO_TAG goxnet $GO_X_NET_TAG noto-fonts $NOTOFONTS_TAG +selfrando $SELFRANDO_TAG EOF # Verify signatures on signed packages -for i in OPENSSL BINUTILS GCC PYCRYPTO PYTHON_MSI GMP +for i in OPENSSL BINUTILS GCC PYCRYPTO PYTHON_MSI GMP ELFUTILS do PACKAGE="${i}_PACKAGE" URL="${i}_URL" diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 088625b..9ff7e8f 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -48,6 +48,7 @@ GO_X_CRYPTO_TAG=master GO_X_NET_TAG=master OBFS4_TAG=master NOTOFONTS_TAG=720e34851382ee3c1ef024d8dffb68ffbfb234c2 +SELFRANDO_TAG=8e49e7aa664625d8e4793579864231b151589d0f GITIAN_TAG=tor-browser-builder-4 @@ -69,6 +70,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 GO_VER=1.4.2 NSIS_VER=2.51 +ELFUTILS_VER=0.160 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz @@ -99,6 +101,7 @@ NOTOJPFONT_PACKAGE=NotoSansJP-Regular.otf NOTOKRFONT_PACKAGE=NotoSansKR-Regular.otf NOTOSCFONT_PACKAGE=NotoSansSC-Regular.otf NOTOTCFONT_PACKAGE=NotoSansTC-Regular.otf +ELFUTILS_PACKAGE=elfutils-${ELFUTILS_VER}.tar.bz2 # Hashes for packages with weak sigs or no sigs OPENSSL_HASH=e7e81d82f3cd538ab0cdba494006d44aab9dd96b7f6233ce9971fb7c7916d511 @@ -157,3 +160,4 @@ NOTOJPFONT_URL=${NOTOCJKBASE_URL}/${NOTOJPFONT_PACKAGE} NOTOKRFONT_URL=${NOTOCJKBASE_URL}/${NOTOKRFONT_PACKAGE} NOTOSCFONT_URL=${NOTOCJKBASE_URL}/${NOTOSCFONT_PACKAGE} NOTOTCFONT_URL=${NOTOCJKBASE_URL}/${NOTOTCFONT_PACKAGE} +ELFUTILS_URL=https://fedorahosted.org/releases/e/l/elfutils/${ELFUTILS_VER}/${ELFUTILS_PACKAGE}

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] Bug 18995: Regression test to ensure CacheStorage is disabled in private browsing
by gk＠torproject.org 12 May '16

12 May '16

commit cea5f1efcd9590885127a0763432143aca01524c Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Tue May 10 16:51:08 2016 -0700 Bug 18995: Regression test to ensure CacheStorage is disabled in private browsing --- tbb-tests/browser.ini | 5 ++++ tbb-tests/browser_tor_bug18995.js | 50 +++++++++++++++++++++++++++++++++++++++ tbb-tests/bug18995.html | 31 ++++++++++++++++++++++++ tbb-tests/worker_bug_18995.html | 26 ++++++++++++++++++++ tbb-tests/worker_bug_18995.js | 8 +++++++ 5 files changed, 120 insertions(+) diff --git a/tbb-tests/browser.ini b/tbb-tests/browser.ini index f481660..9b6c47b 100644 --- a/tbb-tests/browser.ini +++ b/tbb-tests/browser.ini @@ -1,5 +1,10 @@ [DEFAULT] +support-files = + bug18995.html + worker_bug_18995.js + worker_bug_18995.html +[browser_tor_bug18995.js] [browser_tor_bug2950.js] [browser_tor_omnibox.js] [browser_tor_TB4.js] diff --git a/tbb-tests/browser_tor_bug18995.js b/tbb-tests/browser_tor_bug18995.js new file mode 100644 index 0000000..1f1801b --- /dev/null +++ b/tbb-tests/browser_tor_bug18995.js @@ -0,0 +1,50 @@ +// __browser_tor_bug18995.js__. +// In this test, we open a private browsing window, and load pages +// that test whether we can call `caches.open("test")` + +// Helper function. +// Returns a promise that is fulfilled when the first event of eventype +// arrives from the target. +let listen = function (target, eventType, useCapture) { + return new Promise(function (resolve, reject) { + let listenFunction = function (event) { + target.removeEventListener(eventType, listenFunction, useCapture); + resolve(event); + }; + target.addEventListener(eventType, listenFunction, useCapture); + }); +}; + +// The main test +add_task(function* () { + // First open the private browsing window + let privateWin = yield BrowserTestUtils.openNewBrowserWindow({private: true}); + let privateBrowser = privateWin.gBrowser.selectedBrowser; + + // We have two pages: (1) access CacheStorage in content page + // (2) access CacheStorage in worker + let testURIs = ["http://mochi.test:8888/browser/tbb-tests/bug18995.html", + "http://mochi.test:8888/browser/tbb-tests/worker_bug_18995.html"]; + for (let testURI of testURIs) { + // Load the test page + privateBrowser.loadURI(testURI); + // Wait for it too fully load + yield BrowserTestUtils.browserLoaded(privateBrowser); + // Get the <div id="result"/> in the content page + let resultDiv = privateBrowser.contentDocument.getElementById("result"); + // Send an event to the content page indicating we are ready to receive. + resultDiv.dispatchEvent(new Event("ready")); + // Wait for a signal from the content page that a result is ready. + yield listen(resultDiv, "result", false); + // Read the result from the result <div> + let resultValue = resultDiv.innerHTML; + // Print out the result + info("received: " + resultValue); + // If we are in PBM, then the promise returned by caches.open(...) + // is supposed to arrive at a rejection with a SecurityError. + ok(resultValue.contains("SecurityError"), + "CacheStorage should fail in private browsing mode"); + } + // Close the browser window because we are done testing. + yield BrowserTestUtils.closeWindow(privateWin); +}); diff --git a/tbb-tests/bug18995.html b/tbb-tests/bug18995.html new file mode 100644 index 0000000..445a26ab --- /dev/null +++ b/tbb-tests/bug18995.html @@ -0,0 +1,31 @@ +<!DOCTYPE html> +<html> + <head> + <meta charset="utf-8" /> + <title>Bug 18995 test</title> + </head> + <body> + <div id="result"></div> + <script type="application/javascript"> + let resultDiv = document.getElementById("result"); + // Wait for a signal from chrome to start. + resultDiv.addEventListener("ready", function () { + let resultEvent = new Event("result"); + // Test caches.open(...) + caches.open("test1").then(function (value) { + // We are not supposed to succeed, but if we do, + // post the result to resultDiv. + resultDiv.innerHTML = value.toString(); + // Notify chrome that the result is available. + resultDiv.dispatchEvent(resultEvent); + }, function (reason) { + // We should arrive here to fail. Post the result + // to resultDiv. + resultDiv.innerHTML = reason.toString(); + // Notify chrome that the result is available. + resultDiv.dispatchEvent(resultEvent); + }); + }); + </script> + </body> +</html> diff --git a/tbb-tests/worker_bug_18995.html b/tbb-tests/worker_bug_18995.html new file mode 100644 index 0000000..d9be95c --- /dev/null +++ b/tbb-tests/worker_bug_18995.html @@ -0,0 +1,26 @@ +<!DOCTYPE html> +<html> + <head> + <meta charset="utf-8" /> + <title>Bug 18995 test</title> + </head> + <body> + <div id="result"></div> + <script type="application/javascript"> + let resultDiv = document.getElementById("result"); + // Wait for a signal from chrome to start. + resultDiv.addEventListener("ready", function() { + // Run the test worker. + let worker = new Worker("worker_bug_18995.js"); + // Wait for a message from the worker, which should contain + // the result or the error from the caches.open(...) call. + worker.addEventListener("message", function (msg) { + // Put the result in our resultDiv. + resultDiv.innerHTML = msg.data; + // Notify chrome that the result is ready. + resultDiv.dispatchEvent(new Event("result")); + }); + }); + </script> + </body> +</html> diff --git a/tbb-tests/worker_bug_18995.js b/tbb-tests/worker_bug_18995.js new file mode 100644 index 0000000..11641e1 --- /dev/null +++ b/tbb-tests/worker_bug_18995.js @@ -0,0 +1,8 @@ +// Attempt to open a cache +caches.open("test2").then(function (value) { + // This is not supposed to happen. + self.postMessage(value.toString()); +}, function (reason) { + // We are supposed to fail. + self.postMessage(reason.toString()); +});

1 0

[tor-browser-bundle/hardened-builds] Bug 18915: Use our search plugins in localized builds
by gk＠torproject.org 12 May '16

12 May '16

commit 467796a7b7901fc22f26716860ed6ed8d4102416 Author: Georg Koppen <gk(a)torproject.org> Date: Wed May 11 19:37:29 2016 +0000 Bug 18915: Use our search plugins in localized builds We are preparing the language packs we ship for using our search engines in the order we want. This is necessary due to https://bugzilla.mozilla.org/show_bug.cgi?id=1162569. --- gitian/descriptors/linux/gitian-bundle.yml | 19 +++++++++++++ gitian/descriptors/mac/gitian-bundle.yml | 19 +++++++++++++ gitian/descriptors/windows/gitian-bundle.yml | 40 +++++++++++++++++++++------- 3 files changed, 68 insertions(+), 10 deletions(-) diff --git a/gitian/descriptors/linux/gitian-bundle.yml b/gitian/descriptors/linux/gitian-bundle.yml index b9bf0f9..eca8d0f 100644 --- a/gitian/descriptors/linux/gitian-bundle.yml +++ b/gitian/descriptors/linux/gitian-bundle.yml @@ -184,6 +184,10 @@ script: | cp -a ${TB_STAGE_DIR} ${PKG_DIR} # pushd ${PKG_DIR}/Browser/browser/ + # For the proper search engines in our language packs + unzip omni.ja chrome/en-US/locale/browser/searchplugins* + mv chrome/en-US/locale/browser/searchplugins ~/build + rm -rf chrome unzip omni.ja defaults/preferences/000-tor-browser.js cp defaults/preferences/000-tor-browser.js ~/build/ # Set the locale of the bundle. @@ -194,6 +198,21 @@ script: | # unzip linux-langpacks.zip LINUX_LOCALES="$BUNDLE_LOCALES $BUNDLE_LOCALES_LINUX" + # Prepare our language packs for using the proper search engines. See bug + # 18915 for more details. + for LANG in $LINUX_LOCALES + do + xpi=linux-langpacks/$LANG.xpi + unzip -d prep_$LANG $xpi + search_plugins_path=prep_$LANG/browser/chrome/$LANG/locale/browser + rm -rf $search_plugins_path/searchplugins + cp -rf ~/build/searchplugins $search_plugins_path + rm $xpi + cd prep_$LANG + zip -r9 ../$xpi * + cd .. + rm -rf prep_$LANG + done # If we are building a multi-lingual package, add all of the language packs. if [ "z$MULTI_LINGUAL" = "z1" ]; then pushd linux-langpacks diff --git a/gitian/descriptors/mac/gitian-bundle.yml b/gitian/descriptors/mac/gitian-bundle.yml index 0199cca..e046b57 100644 --- a/gitian/descriptors/mac/gitian-bundle.yml +++ b/gitian/descriptors/mac/gitian-bundle.yml @@ -184,6 +184,10 @@ script: | cd .. # pushd $TORBROWSER_NAME.app/Contents/Resources/browser/ + # For the proper search engines in our language packs + unzip omni.ja chrome/en-US/locale/browser/searchplugins* + mv chrome/en-US/locale/browser/searchplugins ~/build + rm -rf chrome unzip omni.ja defaults/preferences/000-tor-browser.js cp defaults/preferences/000-tor-browser.js ~/build/ # Set the locale of the bundle. @@ -203,6 +207,21 @@ script: | unzip mac-langpacks.zip MAC_LOCALES="$BUNDLE_LOCALES $BUNDLE_LOCALES_MAC" + # Prepare our language packs for using the proper search engines. See bug + # 18915 for more details. + for LANG in $MAC_LOCALES + do + xpi=mac-langpacks/$LANG.xpi + unzip -d prep_$LANG $xpi + search_plugins_path=prep_$LANG/browser/chrome/$LANG/locale/browser + rm -rf $search_plugins_path/searchplugins + cp -rf ~/build/searchplugins $search_plugins_path + rm $xpi + cd prep_$LANG + zip -r9 ../$xpi * + cd .. + rm -rf prep_$LANG + done PKG_LOCALE="en-US" # If we are building a multi-lingual package, add all of the language packs # and use "ALL" in the package name and as the locale for update purposes. diff --git a/gitian/descriptors/windows/gitian-bundle.yml b/gitian/descriptors/windows/gitian-bundle.yml index 51565bf..5473bf3 100644 --- a/gitian/descriptors/windows/gitian-bundle.yml +++ b/gitian/descriptors/windows/gitian-bundle.yml @@ -152,8 +152,38 @@ script: | cp ../versions "Tor Browser"/Browser/TorBrowser/Docs/sources/ cp ../bundle.inputs "Tor Browser"/Browser/TorBrowser/Docs/sources/ + # + pushd "Tor Browser"/Browser/browser/ + # For the proper search engines in our language packs + unzip omni.ja chrome/en-US/locale/browser/searchplugins* + mv chrome/en-US/locale/browser/searchplugins ~/build + rm -rf chrome + unzip omni.ja defaults/preferences/000-tor-browser.js + cp defaults/preferences/000-tor-browser.js ~/build/ + # Set the locale bundle. + echo "pref(\"general.useragent.locale\", \"en-US\");" >> defaults/preferences/000-tor-browser.js + zip -Xm omni.ja defaults/preferences/000-tor-browser.js + rm -rf defaults + popd + # + unzip ../win32-langpacks.zip WIN32_LOCALES="$BUNDLE_LOCALES $BUNDLE_LOCALES_WIN32" + # Prepare our language packs for using the proper search engines. See bug + # 18915 for more details. + for LANG in $WIN32_LOCALES + do + xpi=win32-langpacks/$LANG.xpi + unzip -d prep_$LANG $xpi + search_plugins_path=prep_$LANG/browser/chrome/$LANG/locale/browser + rm -rf $search_plugins_path/searchplugins + cp -rf ~/build/searchplugins $search_plugins_path + rm $xpi + cd prep_$LANG + zip -r9 ../$xpi * + cd .. + rm -rf prep_$LANG + done PKG_LOCALE="en-US" # If we are building a multi-lingual package, add all of the language packs # and use "ALL" in the package name and as the locale for update purposes. @@ -175,16 +205,6 @@ script: | popd fi - # - pushd "Tor Browser"/Browser/browser/ - unzip omni.ja defaults/preferences/000-tor-browser.js - cp defaults/preferences/000-tor-browser.js ~/build/ - # Set the locale bundle. - echo "pref(\"general.useragent.locale\", \"en-US\");" >> defaults/preferences/000-tor-browser.js - zip -Xm omni.ja defaults/preferences/000-tor-browser.js - rm -rf defaults - popd - # # Recreate precomplete file (needs to be accurate for full MAR updates). pushd "Tor Browser"/Browser/ rm -f precomplete

1 0

[tor-browser-bundle/master] Bug 18915: Use our search plugins in localized builds
by gk＠torproject.org 12 May '16

12 May '16

commit 94c6a1c73291f8f456249d9719de57ff002fe6fe Author: Georg Koppen <gk(a)torproject.org> Date: Wed May 11 19:37:29 2016 +0000 Bug 18915: Use our search plugins in localized builds We are preparing the language packs we ship for using our search engines in the order we want. This is necessary due to https://bugzilla.mozilla.org/show_bug.cgi?id=1162569. --- gitian/descriptors/linux/gitian-bundle.yml | 19 +++++++++++++ gitian/descriptors/mac/gitian-bundle.yml | 19 +++++++++++++ gitian/descriptors/windows/gitian-bundle.yml | 40 +++++++++++++++++++++------- 3 files changed, 68 insertions(+), 10 deletions(-) diff --git a/gitian/descriptors/linux/gitian-bundle.yml b/gitian/descriptors/linux/gitian-bundle.yml index d5aaec4..39ad811 100644 --- a/gitian/descriptors/linux/gitian-bundle.yml +++ b/gitian/descriptors/linux/gitian-bundle.yml @@ -194,6 +194,10 @@ script: | cp -a ${TB_STAGE_DIR} ${PKG_DIR} # pushd ${PKG_DIR}/Browser/browser/ + # For the proper search engines in our language packs + unzip omni.ja chrome/en-US/locale/browser/searchplugins* + mv chrome/en-US/locale/browser/searchplugins ~/build + rm -rf chrome unzip omni.ja defaults/preferences/000-tor-browser.js cp defaults/preferences/000-tor-browser.js ~/build/ # Set the locale of the bundle. @@ -204,6 +208,21 @@ script: | # unzip linux-langpacks.zip LINUX_LOCALES="$BUNDLE_LOCALES $BUNDLE_LOCALES_LINUX" + # Prepare our language packs for using the proper search engines. See bug + # 18915 for more details. + for LANG in $LINUX_LOCALES + do + xpi=linux-langpacks/$LANG.xpi + unzip -d prep_$LANG $xpi + search_plugins_path=prep_$LANG/browser/chrome/$LANG/locale/browser + rm -rf $search_plugins_path/searchplugins + cp -rf ~/build/searchplugins $search_plugins_path + rm $xpi + cd prep_$LANG + zip -r9 ../$xpi * + cd .. + rm -rf prep_$LANG + done # If we are building a multi-lingual package, add all of the language packs. if [ "z$MULTI_LINGUAL" = "z1" ]; then pushd linux-langpacks diff --git a/gitian/descriptors/mac/gitian-bundle.yml b/gitian/descriptors/mac/gitian-bundle.yml index 00cd4d1..ff17520 100644 --- a/gitian/descriptors/mac/gitian-bundle.yml +++ b/gitian/descriptors/mac/gitian-bundle.yml @@ -213,6 +213,10 @@ script: | cd .. # pushd $TORBROWSER_NAME.app/Contents/Resources/browser/ + # For the proper search engines in our language packs + unzip omni.ja chrome/en-US/locale/browser/searchplugins* + mv chrome/en-US/locale/browser/searchplugins ~/build + rm -rf chrome unzip omni.ja defaults/preferences/000-tor-browser.js cp defaults/preferences/000-tor-browser.js ~/build/ if [ "z$DATA_OUTSIDE_APP_DIR" = "z1" ]; then @@ -245,6 +249,21 @@ script: | unzip mac-langpacks.zip MAC_LOCALES="$BUNDLE_LOCALES $BUNDLE_LOCALES_MAC" + # Prepare our language packs for using the proper search engines. See bug + # 18915 for more details. + for LANG in $MAC_LOCALES + do + xpi=mac-langpacks/$LANG.xpi + unzip -d prep_$LANG $xpi + search_plugins_path=prep_$LANG/browser/chrome/$LANG/locale/browser + rm -rf $search_plugins_path/searchplugins + cp -rf ~/build/searchplugins $search_plugins_path + rm $xpi + cd prep_$LANG + zip -r9 ../$xpi * + cd .. + rm -rf prep_$LANG + done PKG_LOCALE="en-US" # If we are building a multi-lingual package, add all of the language packs # and use "ALL" in the package name and as the locale for update purposes. diff --git a/gitian/descriptors/windows/gitian-bundle.yml b/gitian/descriptors/windows/gitian-bundle.yml index 4fe4bb6..da65142 100644 --- a/gitian/descriptors/windows/gitian-bundle.yml +++ b/gitian/descriptors/windows/gitian-bundle.yml @@ -161,8 +161,38 @@ script: | cp ../versions "Tor Browser"/Browser/TorBrowser/Docs/sources/ cp ../bundle.inputs "Tor Browser"/Browser/TorBrowser/Docs/sources/ + # + pushd "Tor Browser"/Browser/browser/ + # For the proper search engines in our language packs + unzip omni.ja chrome/en-US/locale/browser/searchplugins* + mv chrome/en-US/locale/browser/searchplugins ~/build + rm -rf chrome + unzip omni.ja defaults/preferences/000-tor-browser.js + cp defaults/preferences/000-tor-browser.js ~/build/ + # Set the locale bundle. + echo "pref(\"general.useragent.locale\", \"en-US\");" >> defaults/preferences/000-tor-browser.js + zip -Xm omni.ja defaults/preferences/000-tor-browser.js + rm -rf defaults + popd + # + unzip ../win32-langpacks.zip WIN32_LOCALES="$BUNDLE_LOCALES $BUNDLE_LOCALES_WIN32" + # Prepare our language packs for using the proper search engines. See bug + # 18915 for more details. + for LANG in $WIN32_LOCALES + do + xpi=win32-langpacks/$LANG.xpi + unzip -d prep_$LANG $xpi + search_plugins_path=prep_$LANG/browser/chrome/$LANG/locale/browser + rm -rf $search_plugins_path/searchplugins + cp -rf ~/build/searchplugins $search_plugins_path + rm $xpi + cd prep_$LANG + zip -r9 ../$xpi * + cd .. + rm -rf prep_$LANG + done PKG_LOCALE="en-US" # If we are building a multi-lingual package, add all of the language packs # and use "ALL" in the package name and as the locale for update purposes. @@ -184,16 +214,6 @@ script: | popd fi - # - pushd "Tor Browser"/Browser/browser/ - unzip omni.ja defaults/preferences/000-tor-browser.js - cp defaults/preferences/000-tor-browser.js ~/build/ - # Set the locale bundle. - echo "pref(\"general.useragent.locale\", \"en-US\");" >> defaults/preferences/000-tor-browser.js - zip -Xm omni.ja defaults/preferences/000-tor-browser.js - rm -rf defaults - popd - # # Recreate precomplete file (needs to be accurate for full MAR updates). pushd "Tor Browser"/Browser/ rm -f precomplete

1 0

[tor-browser-bundle/hardened-builds] Bug 18976: Remove some FTE bridges
by gk＠torproject.org 12 May '16

12 May '16

commit 076028da65ee8d4785b65f818e7f8c19bf9e3f0b Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 9 07:53:06 2016 +0000 Bug 18976: Remove some FTE bridges --- Bundle-Data/PTConfigs/bridge_prefs.js | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/Bundle-Data/PTConfigs/bridge_prefs.js b/Bundle-Data/PTConfigs/bridge_prefs.js index 390d7a5..379f256 100644 --- a/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/Bundle-Data/PTConfigs/bridge_prefs.js @@ -8,15 +8,10 @@ pref("extensions.torlauncher.default_bridge.obfs3.3", "obfs3 169.229.59.75:46328 pref("extensions.torlauncher.default_bridge.obfs3.4", "obfs3 109.105.109.163:38980 1E05F577A0EC0213F971D81BF4D86A9E4E8229ED"); pref("extensions.torlauncher.default_bridge.obfs3.5", "obfs3 109.105.109.163:47779 4C331FA9B3D1D6D8FB0D8FBBF0C259C360D97E6A"); -pref("extensions.torlauncher.default_bridge.fte.1", "fte 192.240.101.106:80 FDC5BA65D93B6BCA5EBDF8EF8E4FA936B7F1F8E5"); -pref("extensions.torlauncher.default_bridge.fte.2", "fte 50.7.176.114:80 2BD466989944867075E872310EBAD65BC88C8AEF"); -pref("extensions.torlauncher.default_bridge.fte.3", "fte 131.252.210.150:8080 0E858AC201BF0F3FA3C462F64844CBFFC7297A42"); -pref("extensions.torlauncher.default_bridge.fte.4", "fte 128.105.214.161:8080 1E326AAFB3FCB515015250D8FCCC8E37F91A153B"); -pref("extensions.torlauncher.default_bridge.fte.5", "fte 128.105.214.162:8080 FC562097E1951DCC41B7D7F324D88157119BB56D"); -pref("extensions.torlauncher.default_bridge.fte.6", "fte 128.105.214.163:8080 A17A40775FBD2CA1184BF80BFC330A77ECF9D0E9"); - -pref("extensions.torlauncher.default_bridge.fte-ipv6.1", "fte [2001:49f0:d002:1::2]:80 FDC5BA65D93B6BCA5EBDF8EF8E4FA936B7F1F8E5"); -pref("extensions.torlauncher.default_bridge.fte-ipv6.2", "fte [2001:49f0:d00a:1::c]:80 2BD466989944867075E872310EBAD65BC88C8AEF"); +pref("extensions.torlauncher.default_bridge.fte.1", "fte 131.252.210.150:8080 0E858AC201BF0F3FA3C462F64844CBFFC7297A42"); +pref("extensions.torlauncher.default_bridge.fte.2", "fte 128.105.214.161:8080 1E326AAFB3FCB515015250D8FCCC8E37F91A153B"); +pref("extensions.torlauncher.default_bridge.fte.3", "fte 128.105.214.162:8080 FC562097E1951DCC41B7D7F324D88157119BB56D"); +pref("extensions.torlauncher.default_bridge.fte.4", "fte 128.105.214.163:8080 A17A40775FBD2CA1184BF80BFC330A77ECF9D0E9"); pref("extensions.torlauncher.default_bridge.scramblesuit.1", "scramblesuit 83.212.101.3:443 A09D536DD1752D542E1FBB3C9CE4449D51298239 password=XTCXLG2JAMJKZW2POLBAOWOQETQSMASH");

1 0