- tbb-commits - lists.torproject.org

[tor-browser/tor-browser-45.1.0esr-6.0-1] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 29 Apr '16

29 Apr '16

commit d592a0e41881c06e6d93c4f272ea7e4f3ea6e9bb Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Tue Apr 26 16:46:38 2016 -0700 fixup! TB4: Tor Browser's Firefox preference overrides. Disable Pocket feature (bug 18886) --- browser/app/profile/000-tor-browser.js | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index b2beff5..bd24118 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -97,6 +97,10 @@ pref("browser.search.geoip.url", ""); pref("browser.fixup.alternate.enabled", false); // Bug #16783: Prevent .onion fixups // Make sure there is no Tracking Protection active in Tor Browser, see: #17898. pref("privacy.trackingprotection.pbmode.enabled", false); +// Disable the Pocket extension (Bug #18886) +pref("browser.pocket.enabled", false); +pref("browser.pocket.api", ""); +pref("browser.pocket.site", ""); // Fingerprinting pref("webgl.min_capability_mode", true);

1 0

[tor-browser-bundle/hardened-builds] Preparations for -build4
by gk＠torproject.org 27 Apr '16

27 Apr '16

commit 52d518cc8c89b2934190838fbe3075e686e05b97 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Apr 26 21:28:04 2016 +0000 Preparations for -build4 --- Bundle-Data/Docs/ChangeLog.txt | 6 +++++- gitian/versions.alpha | 2 +- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 49a49e5..35d0e9d 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,4 +1,4 @@ -Tor Browser 6.0a5-hardened -- April 27 2016 +Tor Browser 6.0a5-hardened -- April 28 2016 * All Platforms * Update Firefox to 45.1.0esr * Update Tor to 0.2.8.2-alpha @@ -14,6 +14,7 @@ Tor Browser 6.0a5-hardened -- April 27 2016 * Update meek to 0.22 (tag 0.22-18371-2) * Bug 18371: Symlinks are incompatible with Gatekeeper signing * Bug 15197 and child tickets: Rebase Tor Browser patches to ESR 45 + * Bug 18900: Fix broken updater on Linux * Bug 18042: Disable SHA1 certificate support * Bug 18821: Disable libmdns support for desktop and mobile * Bug 18848: Disable additional welcome URL shown on first start @@ -33,6 +34,9 @@ Tor Browser 6.0a5-hardened -- April 27 2016 * Bug 18741: Fix OCSP and favicon isolation for ESR 45 * Bug 16998: Disable <link rel="preconnect"> for now * Bug 17506: Reenable building hardened Tor Browser with startup cache + * Bug 18898: Exempt the meek extension from the signing requirement as well + * Bug 18899: Don't copy Torbutton, TorLauncher, etc. into meek profile + * Bug 18890: Test importScripts() for cache and network isolation * Bug 18726: Add new default obfs4 bridge (GreenBelt) * Build System * Bug 16224: Don't use BUILD_HOSTNAME anymore in Firefox builds diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 2a8e10f..b9239dc 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -18,7 +18,7 @@ FIREFOX_VERSION=45.1.0esr TORBROWSER_UPDATE_CHANNEL=hardened -TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-6.0-1-build2 +TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-6.0-1-build3 TOR_TAG=tor-0.2.8.2-alpha TORLAUNCHER_TAG=0.2.8.4 TORBUTTON_TAG=1.9.5.3

1 0

[tor-browser-bundle/master] Update changelog for -build4
by gk＠torproject.org 27 Apr '16

27 Apr '16

commit 91ee3ab05a1a2775acd680bb3dd75b8eb2797890 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Apr 26 20:41:06 2016 +0000 Update changelog for -build4 --- Bundle-Data/Docs/ChangeLog.txt | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 4d27e9e..5ea56f1 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,4 +1,4 @@ -Tor Browser 6.0a5 -- April 27 2016 +Tor Browser 6.0a5 -- April 28 2016 * All Platforms * Update Firefox to 45.1.0esr * Update Tor to 0.2.8.2-alpha @@ -14,6 +14,7 @@ Tor Browser 6.0a5 -- April 27 2016 * Update meek to 0.22 (tag 0.22-18371-2) * Bug 18371: Symlinks are incompatible with Gatekeeper signing * Bug 15197 and child tickets: Rebase Tor Browser patches to ESR 45 + * Bug 18900: Fix broken updater on Linux * Bug 18042: Disable SHA1 certificate support * Bug 18821: Disable libmdns support for desktop and mobile * Bug 18848: Disable additional welcome URL shown on first start @@ -32,6 +33,9 @@ Tor Browser 6.0a5 -- April 27 2016 * Bug 16326: Verify cache isolation for Request and Fetch APIs * Bug 18741: Fix OCSP and favicon isolation for ESR 45 * Bug 16998: Disable <link rel="preconnect"> for now + * Bug 18898: Exempt the meek extension from the signing requirement as well + * Bug 18899: Don't copy Torbutton, TorLauncher, etc. into meek profile + * Bug 18890: Test importScripts() for cache and network isolation * Bug 18726: Add new default obfs4 bridge (GreenBelt) * Windows * Bug 13419: Support ICU in Windows builds

1 0

[tor-browser-bundle/master] Using tor-browser-45.1.0esr-6.0-1-build3
by gk＠torproject.org 27 Apr '16

27 Apr '16

commit 127c4835c3ff00db224b4e38e51d0bf3ef322a9b Author: Georg Koppen <gk(a)torproject.org> Date: Tue Apr 26 21:15:07 2016 +0000 Using tor-browser-45.1.0esr-6.0-1-build3 --- gitian/versions.alpha | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 8752e76..f2023f0 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -14,7 +14,7 @@ FIREFOX_VERSION=45.1.0esr TORBROWSER_UPDATE_CHANNEL=alpha -TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-6.0-1-build2 +TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-6.0-1-build3 TOR_TAG=tor-0.2.8.2-alpha TORLAUNCHER_TAG=0.2.9.1 TORBUTTON_TAG=1.9.5.3

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] fixup! Bug 14970: Don't block our unsigned extensions
by gk＠torproject.org 27 Apr '16

27 Apr '16

commit f46c63ff6856251faf39e20a040ee104fa113176 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Apr 26 19:55:31 2016 +0000 fixup! Bug 14970: Don't block our unsigned extensions --- toolkit/mozapps/extensions/internal/XPIProvider.jsm | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/toolkit/mozapps/extensions/internal/XPIProvider.jsm b/toolkit/mozapps/extensions/internal/XPIProvider.jsm index 3056201..94c33ea 100644 --- a/toolkit/mozapps/extensions/internal/XPIProvider.jsm +++ b/toolkit/mozapps/extensions/internal/XPIProvider.jsm @@ -683,12 +683,13 @@ function isUsableAddon(aAddon) { return false; } // Temporary and system add-ons do not require signing. Neither do Torbutton - // nor TorLauncher nor EFF's HTTPS-Everywhere. + // nor TorLauncher nor EFF's HTTPS-Everywhere nor meek. if ((aAddon._installLocation.name != KEY_APP_SYSTEM_DEFAULTS && aAddon._installLocation.name != KEY_APP_TEMPORARY) && aAddon.id != "torbutton(a)torproject.org" && aAddon.id != "tor-launcher(a)torproject.org" && aAddon.id != "https-everywhere-eff(a)eff.org" && + aAddon.id != "meek-http-helper(a)bamsoftware.com" && mustSign(aAddon.type)) { if (aAddon.signedState <= AddonManager.SIGNEDSTATE_MISSING) return false; @@ -3289,12 +3290,13 @@ this.XPIProvider = { continue; } - // Make sure Torbutton, TorLauncher and EFF's HTTPS-Everywhere are still - // working after an update. + // Make sure Torbutton, TorLauncher, EFF's HTTPS-Everywhere and meek + // are still working after an update. if (mustSign(addon.type) && addon.id != "torbutton(a)torproject.org" && addon.id != "tor-launcher(a)torproject.org" && addon.id != "https-everywhere-eff(a)eff.org" && + addon.id != "meek-http-helper(a)bamsoftware.com" && addon.signedState <= AddonManager.SIGNEDSTATE_MISSING) { logger.warn("Refusing to install staged add-on " + id + " with signed state " + addon.signedState); seenFiles.push(stageDirEntry.leafName);

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] Bug 18900: updater doesn't work on Linux (cannot find libraries)
by gk＠torproject.org 27 Apr '16

27 Apr '16

commit 82cfa7c8786c1ad1421666365bd71f3594861328 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue Apr 26 14:25:35 2016 -0400 Bug 18900: updater doesn't work on Linux (cannot find libraries) Revert "Bug 1159090 - Only append library path for updater if it is a unique value. r=rstrong" This reverts commit 5c4fcaf37f8e479b5d3c46a21b8a48ad1fe567d8. --- toolkit/xre/nsUpdateDriver.cpp | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/toolkit/xre/nsUpdateDriver.cpp b/toolkit/xre/nsUpdateDriver.cpp index 0c7b6b0..d256f2a 100644 --- a/toolkit/xre/nsUpdateDriver.cpp +++ b/toolkit/xre/nsUpdateDriver.cpp @@ -488,20 +488,20 @@ CopyUpdaterIntoUpdateDir(nsIFile *greDir, nsIFile *appDir, nsIFile *updateDir, static void AppendToLibPath(const char *pathToAppend) { + char *s = nullptr; char *pathValue = getenv(LD_LIBRARY_PATH_ENVVAR_NAME); if (nullptr == pathValue || '\0' == *pathValue) { - char *s = PR_smprintf("%s=%s", LD_LIBRARY_PATH_ENVVAR_NAME, pathToAppend); - PR_SetEnv(s); - } else if (!strstr(pathValue, pathToAppend)) { - char *s = PR_smprintf("%s=%s" PATH_SEPARATOR "%s", + s = PR_smprintf("%s=%s", LD_LIBRARY_PATH_ENVVAR_NAME, pathToAppend); + } else { + s = PR_smprintf("%s=%s" PATH_SEPARATOR "%s", LD_LIBRARY_PATH_ENVVAR_NAME, pathToAppend, pathValue); - PR_SetEnv(s); } // The memory used by PR_SetEnv is not copied to the environment on all // platform, it can be used by reference directly. So we purposely do not // call PR_smprintf_free on s. Subsequent calls to PR_SetEnv will free // the old memory first. + PR_SetEnv(s); } #endif

1 0

[tor-browser-bundle/hardened-builds] Bug 18899: meek profile gets all extensions
by gk＠torproject.org 27 Apr '16

27 Apr '16

commit 210aa37e48b1bc27f6925f8a4be5d7f47551803e Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue Apr 26 15:11:06 2016 -0400 Bug 18899: meek profile gets all extensions Set extensions.installDistroAddons = false in the meek-http-helper browser profile so that Tor Launcher, Torbutton, etc. are not copied into that profile. --- Bundle-Data/PTConfigs/meek-http-helper-user.js | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/Bundle-Data/PTConfigs/meek-http-helper-user.js b/Bundle-Data/PTConfigs/meek-http-helper-user.js index de2355c..820335d 100644 --- a/Bundle-Data/PTConfigs/meek-http-helper-user.js +++ b/Bundle-Data/PTConfigs/meek-http-helper-user.js @@ -40,3 +40,7 @@ user_pref("network.proxy.socks_port", 9); user_pref("network.proxy.socks_remote_dns", true); user_pref("extensions.enabledAddons", "meek-http-helper@bamsoftware.com:1.0"); + +// Ensure that distribution extensions (e.g., Tor Launcher) are not copied +// into the meek-http-helper profile. +user_pref("extensions.installDistroAddons", false);

1 0

[tor-browser-bundle/master] Bug 18899: meek profile gets all extensions
by gk＠torproject.org 27 Apr '16

27 Apr '16

commit 3b226118fadf42623032b423e41d6803e05901c1 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue Apr 26 15:11:06 2016 -0400 Bug 18899: meek profile gets all extensions Set extensions.installDistroAddons = false in the meek-http-helper browser profile so that Tor Launcher, Torbutton, etc. are not copied into that profile. --- Bundle-Data/PTConfigs/meek-http-helper-user.js | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/Bundle-Data/PTConfigs/meek-http-helper-user.js b/Bundle-Data/PTConfigs/meek-http-helper-user.js index de2355c..820335d 100644 --- a/Bundle-Data/PTConfigs/meek-http-helper-user.js +++ b/Bundle-Data/PTConfigs/meek-http-helper-user.js @@ -40,3 +40,7 @@ user_pref("network.proxy.socks_port", 9); user_pref("network.proxy.socks_remote_dns", true); user_pref("extensions.enabledAddons", "meek-http-helper@bamsoftware.com:1.0"); + +// Ensure that distribution extensions (e.g., Tor Launcher) are not copied +// into the meek-http-helper profile. +user_pref("extensions.installDistroAddons", false);

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] squash! Bug #13749.2: Regression tests for first-party isolation of cache
by gk＠torproject.org 26 Apr '16

26 Apr '16

commit 7caee5e04bfac481c4f39ac75b366c530aba5374 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Mon Apr 25 17:15:21 2016 -0700 squash! Bug #13749.2: Regression tests for first-party isolation of cache Also tests for isolation of WorkerGlobalScope.importScripts() https://bugs.torproject.org/18890 --- netwerk/test/browser/browser.ini | 1 + netwerk/test/browser/browser_cacheFirstParty.js | 3 ++- netwerk/test/browser/thirdPartyChild.import.js | 1 + netwerk/test/browser/thirdPartyChild.worker.js | 2 ++ 4 files changed, 6 insertions(+), 1 deletion(-) diff --git a/netwerk/test/browser/browser.ini b/netwerk/test/browser/browser.ini index 9bc3361..a78557b 100644 --- a/netwerk/test/browser/browser.ini +++ b/netwerk/test/browser/browser.ini @@ -8,6 +8,7 @@ support-files = thirdPartyChild.fetch.html thirdPartyChild.iframe.html thirdPartyChild.img.png + thirdPartyChild.import.js thirdPartyChild.link.css thirdPartyChild.object.png thirdPartyChild.request.html diff --git a/netwerk/test/browser/browser_cacheFirstParty.js b/netwerk/test/browser/browser_cacheFirstParty.js index 08b3231..967c597 100644 --- a/netwerk/test/browser/browser_cacheFirstParty.js +++ b/netwerk/test/browser/browser_cacheFirstParty.js @@ -113,7 +113,8 @@ let privacyPref = "privacy.thirdparty.isolate", "embed.png", "xhr.html", "worker.xhr.html", "audio.ogg", "video.ogv", "track.vtt", "favicon.ico", "fetch.html", "worker.fetch.html", - "request.html", "worker.request.html"]; + "request.html", "worker.request.html", + "import.js"]; // __checkCachePopulation(pref, numberOfDomains)__. // Check if the number of entries found in the cache for each diff --git a/netwerk/test/browser/thirdPartyChild.import.js b/netwerk/test/browser/thirdPartyChild.import.js new file mode 100644 index 0000000..dbf8f83 --- /dev/null +++ b/netwerk/test/browser/thirdPartyChild.import.js @@ -0,0 +1 @@ +// dummy script, to be called by self.importScripts(...) diff --git a/netwerk/test/browser/thirdPartyChild.worker.js b/netwerk/test/browser/thirdPartyChild.worker.js index 34627b2..c8c187b 100644 --- a/netwerk/test/browser/thirdPartyChild.worker.js +++ b/netwerk/test/browser/thirdPartyChild.worker.js @@ -5,3 +5,5 @@ xhr.send(); fetch("http://example.net/browser/netwerk/test/browser/thirdPartyChild.worker.fetc…", {cache: "force-cache"} ); var myRequest = new Request("http://example.net/browser/netwerk/test/browser/thirdPartyChild.worker.requ…"); fetch(myRequest, {cache: "force-cache"} ); + +self.importScripts("http://example.net/browser/netwerk/test/browser/thirdPartyChild.import.js");

1 0

[tor-browser-bundle/hardened-builds] Don't include old OS X toolchain in results anymore
by gk＠torproject.org 25 Apr '16

25 Apr '16

commit 41386f37bbc771c559e5986963a6db79b1abd9b7 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Apr 25 12:34:50 2016 +0000 Don't include old OS X toolchain in results anymore --- gitian/record-inputs.sh | 1 - 1 file changed, 1 deletion(-) diff --git a/gitian/record-inputs.sh b/gitian/record-inputs.sh index afcd70d..a74d70b 100755 --- a/gitian/record-inputs.sh +++ b/gitian/record-inputs.sh @@ -25,7 +25,6 @@ rm -f bundle.inputs sha256sum $OSXSDK_PACKAGE >> bundle.inputs sha256sum $OPENSSL_PACKAGE >> bundle.inputs -sha256sum $TOOLCHAIN4_PACKAGE >> bundle.inputs echo >> bundle.inputs sha256sum noscript(a)noscript.net.xpi >> bundle.inputs echo >> bundle.inputs

1 0