- tbb-commits - lists.torproject.org

[tor-browser-bundle/master] Bug 12103: Adding RELRO back to browser binaries.
by mikeperry＠torproject.org 30 Aug '14

30 Aug '14

commit d8e92e2f4d362216dfff1790026309e6c0a51b58 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Aug 29 15:32:35 2014 -0700 Bug 12103: Adding RELRO back to browser binaries. We removed the build-id from browser binaries in bug 11042 as it turned out that despite the contents being exactly the same the build-id was not occasionally. But doing that with bjcopy destroyed RELRO protections as well. Having the build-id non-deterministic seems to be an ld issue as switching to gold solves this. --- gitian/descriptors/linux/gitian-firefox.yml | 6 ++++-- gitian/descriptors/linux/gitian-utils.yml | 20 ++++++++++++++++++++ gitian/mkbundle-linux.sh | 8 +++++++- 3 files changed, 31 insertions(+), 3 deletions(-) diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index 90958c2..0cd4b28 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -29,6 +29,8 @@ remotes: - "url": "https://git.torproject.org/tor-browser.git" "dir": "tor-browser" files: +- "binutils-linux32-utils.zip" +- "binutils-linux64-utils.zip" - "python-linux32-utils.zip" - "python-linux64-utils.zip" - "re-dzip.sh" @@ -62,6 +64,8 @@ script: | ln -sf $INSTDIR/python/bin/python2.7 $INSTDIR/python/bin/python export PATH=$INSTDIR/python/bin:$PATH # + unzip -d $INSTDIR binutils-linux$GBUILD_BITS-utils.zip + export PATH=$INSTDIR/binutils/bin:$PATH mkdir -p $INSTDIR/Browser/ mkdir -p $INSTDIR/Debug/Browser/components # @@ -100,8 +104,6 @@ script: | cd $INSTDIR for LIB in Browser/*.so Browser/webapprt-stub Browser/mozilla-xremote-client Browser/firefox Browser/plugin-container Browser/components/*.so # Browser/updater do - # Build-ID is sometimes non-deterministic, and we use debuglink anyway - objcopy --remove-section=.note.gnu.build-id $LIB objcopy --only-keep-debug $LIB Debug/$LIB strip $LIB objcopy --add-gnu-debuglink=./Debug/$LIB $LIB diff --git a/gitian/descriptors/linux/gitian-utils.yml b/gitian/descriptors/linux/gitian-utils.yml index 34b1672..ea122db 100644 --- a/gitian/descriptors/linux/gitian-utils.yml +++ b/gitian/descriptors/linux/gitian-utils.yml @@ -15,6 +15,8 @@ packages: - "faketime" - "libtool" - "hardening-wrapper" +# Needed for compiling gold. +- "bison" # These packages are needed for Python due to HTTPS-Everywhere >= 3.5. - "libsqlite3-dev" - "zlib1g-dev" @@ -25,6 +27,7 @@ remotes: - "url": "https://github.com/libevent/libevent.git" "dir": "libevent" files: +- "binutils.tar.bz2" - "openssl.tar.gz" - "python.tar.bz2" - "lxml.tar.gz" @@ -47,6 +50,22 @@ script: | export DEB_BUILD_HARDENING_FORMAT=1 export DEB_BUILD_HARDENING_PIE=1 + # Building Binutils + tar xjf binutils.tar.bz2 + cd binutils* + # We want to use gold as the linker in our toolchain mainly as it is way + # faster when linking Tor Browser code (especially libxul). But apart from + # that it fixes #12103 and issues with ESR 31 and our Gitian setup as well + # (see bug #12743). + ./configure --prefix=$INSTDIR/binutils --disable-multilib --enable-gold + make $MAKEOPTS + make install + # Make sure gold is used and not ld. + cd $INSTDIR/binutils/bin + rm ld + ln -sf ld.gold ld + cd ~/build + # Building Libevent cd libevent ./autogen.sh @@ -104,6 +123,7 @@ script: | # Grabbing the remaining results cd $INSTDIR + ~/build/dzip.sh binutils-$BINUTILS_VER-linux$GBUILD_BITS-utils.zip binutils ~/build/dzip.sh openssl-$OPENSSL_VER-linux$GBUILD_BITS-utils.zip openssl ~/build/dzip.sh libevent-${LIBEVENT_TAG#release-}-linux$GBUILD_BITS-utils.zip libevent ~/build/dzip.sh python-$PYTHON_VER-linux$GBUILD_BITS-utils.zip python diff --git a/gitian/mkbundle-linux.sh b/gitian/mkbundle-linux.sh index 7e90165..dd8e00a 100755 --- a/gitian/mkbundle-linux.sh +++ b/gitian/mkbundle-linux.sh @@ -98,7 +98,9 @@ fi cd $GITIAN_DIR -if [ ! -f inputs/openssl-$OPENSSL_VER-linux32-utils.zip -o \ +if [ ! -f inputs/binutils-$BINUTILS_VER-linux32-utils.zip -o \ + ! -f inputs/binutils-$BINUTILS_VER-linux64-utils.zip -o \ + ! -f inputs/openssl-$OPENSSL_VER-linux32-utils.zip -o \ ! -f inputs/openssl-$OPENSSL_VER-linux64-utils.zip -o \ ! -f inputs/libevent-${LIBEVENT_TAG_ORIG#release-}-linux32-utils.zip -o \ ! -f inputs/libevent-${LIBEVENT_TAG_ORIG#release-}-linux64-utils.zip -o \ @@ -122,6 +124,8 @@ then cd inputs cp -a ../build/out/*-utils.zip . + ln -sf binutils-$BINUTILS_VER-linux32-utils.zip binutils-linux32-utils.zip + ln -sf binutils-$BINUTILS_VER-linux64-utils.zip binutils-linux64-utils.zip ln -sf openssl-$OPENSSL_VER-linux32-utils.zip openssl-linux32-utils.zip ln -sf openssl-$OPENSSL_VER-linux64-utils.zip openssl-linux64-utils.zip ln -sf libevent-${LIBEVENT_TAG_ORIG#release-}-linux32-utils.zip libevent-linux32-utils.zip @@ -141,6 +145,8 @@ else # We might have built the utilities in the past but maybe the links are # pointing to the wrong version. Refresh them. cd inputs + ln -sf binutils-$BINUTILS_VER-linux32-utils.zip binutils-linux32-utils.zip + ln -sf binutils-$BINUTILS_VER-linux64-utils.zip binutils-linux64-utils.zip ln -sf openssl-$OPENSSL_VER-linux32-utils.zip openssl-linux32-utils.zip ln -sf openssl-$OPENSSL_VER-linux64-utils.zip openssl-linux64-utils.zip ln -sf libevent-${LIBEVENT_TAG_ORIG#release-}-linux32-utils.zip libevent-linux32-utils.zip

1 0

[tor-browser-bundle/maint-3.6] Bug 12103: Adding RELRO back to browser binaries.
by mikeperry＠torproject.org 30 Aug '14

30 Aug '14

commit 7df10ce04da9ed36a55e91c193fca29e88ac7a5f Author: Georg Koppen <gk(a)torproject.org> Date: Fri Aug 29 20:28:39 2014 +0000 Bug 12103: Adding RELRO back to browser binaries. We removed the build-id from browser binaries in bug 11042 as it turned out that despite the contents being exactly the same the build-id was not occasionally. But doing that with bjcopy destroyed RELRO protections as well. Having the build-id non-deterministic seems to be an ld issue as switching to gold solves this. --- gitian/descriptors/linux/gitian-firefox.yml | 6 ++++-- gitian/descriptors/linux/gitian-utils.yml | 20 ++++++++++++++++++++ gitian/mkbundle-linux.sh | 8 +++++++- 3 files changed, 31 insertions(+), 3 deletions(-) diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index 7e6c598..cbd2b17 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -29,6 +29,8 @@ remotes: - "url": "https://git.torproject.org/tor-browser.git" "dir": "tor-browser" files: +- "binutils-linux32-utils.zip" +- "binutils-linux64-utils.zip" - "python-linux32-utils.zip" - "python-linux64-utils.zip" - "re-dzip.sh" @@ -62,6 +64,8 @@ script: | ln -sf $INSTDIR/python/bin/python2.7 $INSTDIR/python/bin/python export PATH=$INSTDIR/python/bin:$PATH # + unzip -d $INSTDIR binutils-linux$GBUILD_BITS-utils.zip + export PATH=$INSTDIR/binutils/bin:$PATH mkdir -p $INSTDIR/Browser/ mkdir -p $INSTDIR/Debug/Browser/components # @@ -89,8 +93,6 @@ script: | cd $INSTDIR for LIB in Browser/*.so Browser/webapprt-stub Browser/mozilla-xremote-client Browser/firefox Browser/plugin-container Browser/components/*.so # Browser/updater do - # Build-ID is sometimes non-deterministic, and we use debuglink anyway - objcopy --remove-section=.note.gnu.build-id $LIB objcopy --only-keep-debug $LIB Debug/$LIB strip $LIB objcopy --add-gnu-debuglink=./Debug/$LIB $LIB diff --git a/gitian/descriptors/linux/gitian-utils.yml b/gitian/descriptors/linux/gitian-utils.yml index 34b1672..ea122db 100644 --- a/gitian/descriptors/linux/gitian-utils.yml +++ b/gitian/descriptors/linux/gitian-utils.yml @@ -15,6 +15,8 @@ packages: - "faketime" - "libtool" - "hardening-wrapper" +# Needed for compiling gold. +- "bison" # These packages are needed for Python due to HTTPS-Everywhere >= 3.5. - "libsqlite3-dev" - "zlib1g-dev" @@ -25,6 +27,7 @@ remotes: - "url": "https://github.com/libevent/libevent.git" "dir": "libevent" files: +- "binutils.tar.bz2" - "openssl.tar.gz" - "python.tar.bz2" - "lxml.tar.gz" @@ -47,6 +50,22 @@ script: | export DEB_BUILD_HARDENING_FORMAT=1 export DEB_BUILD_HARDENING_PIE=1 + # Building Binutils + tar xjf binutils.tar.bz2 + cd binutils* + # We want to use gold as the linker in our toolchain mainly as it is way + # faster when linking Tor Browser code (especially libxul). But apart from + # that it fixes #12103 and issues with ESR 31 and our Gitian setup as well + # (see bug #12743). + ./configure --prefix=$INSTDIR/binutils --disable-multilib --enable-gold + make $MAKEOPTS + make install + # Make sure gold is used and not ld. + cd $INSTDIR/binutils/bin + rm ld + ln -sf ld.gold ld + cd ~/build + # Building Libevent cd libevent ./autogen.sh @@ -104,6 +123,7 @@ script: | # Grabbing the remaining results cd $INSTDIR + ~/build/dzip.sh binutils-$BINUTILS_VER-linux$GBUILD_BITS-utils.zip binutils ~/build/dzip.sh openssl-$OPENSSL_VER-linux$GBUILD_BITS-utils.zip openssl ~/build/dzip.sh libevent-${LIBEVENT_TAG#release-}-linux$GBUILD_BITS-utils.zip libevent ~/build/dzip.sh python-$PYTHON_VER-linux$GBUILD_BITS-utils.zip python diff --git a/gitian/mkbundle-linux.sh b/gitian/mkbundle-linux.sh index 0d07364..ea6d171 100755 --- a/gitian/mkbundle-linux.sh +++ b/gitian/mkbundle-linux.sh @@ -98,7 +98,9 @@ fi cd $GITIAN_DIR -if [ ! -f inputs/openssl-$OPENSSL_VER-linux32-utils.zip -o \ +if [ ! -f inputs/binutils-$BINUTILS_VER-linux32-utils.zip -o \ + ! -f inputs/binutils-$BINUTILS_VER-linux64-utils.zip -o \ + ! -f inputs/openssl-$OPENSSL_VER-linux32-utils.zip -o \ ! -f inputs/openssl-$OPENSSL_VER-linux64-utils.zip -o \ ! -f inputs/libevent-${LIBEVENT_TAG_ORIG#release-}-linux32-utils.zip -o \ ! -f inputs/libevent-${LIBEVENT_TAG_ORIG#release-}-linux64-utils.zip -o \ @@ -122,6 +124,8 @@ then cd inputs cp -a ../build/out/*-utils.zip . + ln -sf binutils-$BINUTILS_VER-linux32-utils.zip binutils-linux32-utils.zip + ln -sf binutils-$BINUTILS_VER-linux64-utils.zip binutils-linux64-utils.zip ln -sf openssl-$OPENSSL_VER-linux32-utils.zip openssl-linux32-utils.zip ln -sf openssl-$OPENSSL_VER-linux64-utils.zip openssl-linux64-utils.zip ln -sf libevent-${LIBEVENT_TAG_ORIG#release-}-linux32-utils.zip libevent-linux32-utils.zip @@ -141,6 +145,8 @@ else # We might have built the utilities in the past but maybe the links are # pointing to the wrong version. Refresh them. cd inputs + ln -sf binutils-$BINUTILS_VER-linux32-utils.zip binutils-linux32-utils.zip + ln -sf binutils-$BINUTILS_VER-linux64-utils.zip binutils-linux64-utils.zip ln -sf openssl-$OPENSSL_VER-linux32-utils.zip openssl-linux32-utils.zip ln -sf openssl-$OPENSSL_VER-linux64-utils.zip openssl-linux64-utils.zip ln -sf libevent-${LIBEVENT_TAG_ORIG#release-}-linux32-utils.zip libevent-linux32-utils.zip

1 0

[tor-browser-bundle/master] Merge remote-tracking branch 'erinn/tbb-4.x-hardening'
by mikeperry＠torproject.org 30 Aug '14

30 Aug '14

commit 393ac6898933fc17d31edb6be518ca8c957c6034 Merge: 59cb26c e92aa0a Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Fri Aug 29 15:11:04 2014 -0700 Merge remote-tracking branch 'erinn/tbb-4.x-hardening' gitian/build-helpers/i686-w64-mingw32-g++ | 2 +- gitian/build-helpers/i686-w64-mingw32-gcc | 2 +- gitian/build-helpers/i686-w64-mingw32-ld | 7 +- gitian/build-helpers/wine-wrappers/dllwrap.py | 2 +- gitian/build-helpers/wine-wrappers/g++.py | 2 +- gitian/build-helpers/wine-wrappers/gcc.py | 2 +- gitian/descriptors/windows/gitian-firefox.yml | 24 +-- .../windows/gitian-pluggable-transports.yml | 12 +- gitian/descriptors/windows/gitian-tor.yml | 18 +- gitian/descriptors/windows/gitian-utils.yml | 24 ++- gitian/mkbundle-windows.sh | 6 +- gitian/patches/enable-reloc-section-ld.patch | 216 ++++++++++++++++++++ 12 files changed, 264 insertions(+), 53 deletions(-) diff --cc gitian/descriptors/windows/gitian-firefox.yml index 4ea551f,0968911..d6a6756 --- a/gitian/descriptors/windows/gitian-firefox.yml +++ b/gitian/descriptors/windows/gitian-firefox.yml @@@ -69,19 -72,12 +71,12 @@@ script: find -type f | xargs touch --date="$REFERENCE_DATETIME" rm -f configure rm -f js/src/configure - make -f client.mk configure + make -f client.mk configure CONFIGURE_ARGS="--with-tor-browser-version=${TORBROWSER_VERSION} --enable-update-channel=${TORBROWSER_UPDATE_CHANNEL}" find -type f | xargs touch --date="$REFERENCE_DATETIME" # - # FIXME: MinGW doens't like being built with hardening, and Firefox doesn't - # like being configured with it - # XXX: These changes cause the exes to crash on launch. - #mkdir -p ~/build/bin/ - #cp ~/build/i686* ~/build/bin/ - #export PATH=~/build/bin:$PATH - # XXX: the path to ld is hardcoded in mingw.. This forces gcc's linking to - # use our flags: - #sudo mv /usr/bin/i686-w64-mingw32-ld /usr/bin/i686-w64-mingw32-ld.orig - #sudo cp ~/build/bin/i686-w64-mingw32-ld /usr/bin/ + mkdir -p ~/build/bin/ + cp ~/build/i686* ~/build/bin/ + export PATH=~/build/bin:$PATH # make $MAKEOPTS -f client.mk build #

1 0

[tor-browser-bundle/master] add --enable-reloc-section patch from skruffy
by mikeperry＠torproject.org 30 Aug '14

30 Aug '14

commit 1221eecfdc639fe412bc5fe051e3151e1ce5d6a9 Author: Erinn Clark <erinn(a)torproject.org> Date: Thu Aug 21 19:23:30 2014 -0400 add --enable-reloc-section patch from skruffy --- gitian/patches/enable-reloc-section-ld.patch | 216 ++++++++++++++++++++++++++ 1 file changed, 216 insertions(+) diff --git a/gitian/patches/enable-reloc-section-ld.patch b/gitian/patches/enable-reloc-section-ld.patch new file mode 100644 index 0000000..f393f51 --- /dev/null +++ b/gitian/patches/enable-reloc-section-ld.patch @@ -0,0 +1,216 @@ +From 093b08a9e7af23a258306b710ebc4556d12f94f7 Mon Sep 17 00:00:00 2001 +From: Erinn Clark <erinn(a)torproject.org> +Date: Fri, 8 Aug 2014 14:23:44 -0400 +Subject: [PATCH] add relocation section so Windows bundles can have ASLR + +Patch by skruffy. + +--- + ld/emultempl/pe.em | 6 +++++ + ld/emultempl/pep.em | 8 ++++++- + ld/pe-dll.c | 63 ++++++++++++++++++++++++++++++----------------------- + ld/pe-dll.h | 1 + + 4 files changed, 50 insertions(+), 28 deletions(-) + +diff --git a/ld/emultempl/pe.em b/ld/emultempl/pe.em +index 5d6da9e..14c07f7 100644 +--- a/ld/emultempl/pe.em ++++ b/ld/emultempl/pe.em +@@ -268,6 +268,7 @@ fragment <<EOF + #define OPTION_TERMINAL_SERVER_AWARE (OPTION_WDM_DRIVER + 1) + /* Determinism. */ + #define OPTION_INSERT_TIMESTAMP (OPTION_TERMINAL_SERVER_AWARE + 1) ++#define OPTION_ENABLE_RELOC_SECTION (OPTION_INSERT_TIMESTAMP + 1) + + static void + gld${EMULATION_NAME}_add_options +@@ -310,6 +311,7 @@ gld${EMULATION_NAME}_add_options + {"export-all-symbols", no_argument, NULL, OPTION_EXPORT_ALL}, + {"exclude-symbols", required_argument, NULL, OPTION_EXCLUDE_SYMBOLS}, + {"exclude-all-symbols", no_argument, NULL, OPTION_EXCLUDE_ALL_SYMBOLS}, ++ {"enable-reloc-section", no_argument, NULL, OPTION_ENABLE_RELOC_SECTION}, + {"exclude-libs", required_argument, NULL, OPTION_EXCLUDE_LIBS}, + {"exclude-modules-for-implib", required_argument, NULL, OPTION_EXCLUDE_MODULES_FOR_IMPLIB}, + {"kill-at", no_argument, NULL, OPTION_KILL_ATS}, +@@ -773,6 +775,9 @@ gld${EMULATION_NAME}_handle_option (int optc) + case OPTION_EXCLUDE_ALL_SYMBOLS: + pe_dll_exclude_all_symbols = 1; + break; ++ case OPTION_ENABLE_RELOC_SECTION: ++ pe_dll_enable_reloc_section = 1; ++ break; + case OPTION_EXCLUDE_LIBS: + pe_dll_add_excludes (optarg, EXCLUDELIBS); + break; +@@ -1839,6 +1844,7 @@ gld_${EMULATION_NAME}_finish (void) + if (link_info.shared + #if !defined(TARGET_IS_shpe) + || (!link_info.relocatable && pe_def_file->num_exports != 0) ++ || (!link_info.relocatable && pe_dll_enable_reloc_section) + #endif + ) + { +diff --git a/ld/emultempl/pep.em b/ld/emultempl/pep.em +index b738800..b566903 100644 +--- a/ld/emultempl/pep.em ++++ b/ld/emultempl/pep.em +@@ -242,7 +242,8 @@ enum options + OPTION_NO_BIND, + OPTION_WDM_DRIVER, + OPTION_INSERT_TIMESTAMP, +- OPTION_TERMINAL_SERVER_AWARE ++ OPTION_TERMINAL_SERVER_AWARE, ++ OPTION_ENABLE_RELOC_SECTION + }; + + static void +@@ -284,6 +285,7 @@ gld${EMULATION_NAME}_add_options + {"export-all-symbols", no_argument, NULL, OPTION_EXPORT_ALL}, + {"exclude-symbols", required_argument, NULL, OPTION_EXCLUDE_SYMBOLS}, + {"exclude-all-symbols", no_argument, NULL, OPTION_EXCLUDE_ALL_SYMBOLS}, ++ {"enable-reloc-section", no_argument, NULL, OPTION_ENABLE_RELOC_SECTION}, + {"exclude-libs", required_argument, NULL, OPTION_EXCLUDE_LIBS}, + {"exclude-modules-for-implib", required_argument, NULL, OPTION_EXCLUDE_MODULES_FOR_IMPLIB}, + {"kill-at", no_argument, NULL, OPTION_KILL_ATS}, +@@ -727,6 +729,9 @@ gld${EMULATION_NAME}_handle_option (int optc) + case OPTION_EXCLUDE_ALL_SYMBOLS: + pep_dll_exclude_all_symbols = 1; + break; ++ case OPTION_ENABLE_RELOC_SECTION: ++ pe_dll_enable_reloc_section = 1; ++ break; + case OPTION_EXCLUDE_LIBS: + pep_dll_add_excludes (optarg, EXCLUDELIBS); + break; +@@ -1618,6 +1623,7 @@ gld_${EMULATION_NAME}_finish (void) + + #ifdef DLL_SUPPORT + if (link_info.shared ++ || (!link_info.relocatable && pe_dll_enable_reloc_section) + || (!link_info.relocatable && pep_def_file->num_exports != 0)) + { + pep_dll_fill_sections (link_info.output_bfd, &link_info); +diff --git a/ld/pe-dll.c b/ld/pe-dll.c +index e9e133b..4230dc3 100644 +--- a/ld/pe-dll.c ++++ b/ld/pe-dll.c +@@ -152,6 +152,7 @@ def_file * pe_def_file = 0; + int pe_dll_export_everything = 0; + int pe_dll_exclude_all_symbols = 0; + int pe_dll_do_default_excludes = 1; ++int pe_dll_enable_reloc_section = 0; + int pe_dll_kill_ats = 0; + int pe_dll_stdcall_aliases = 0; + int pe_dll_warn_dup_exports = 0; +@@ -3370,8 +3371,15 @@ pe_dll_build_sections (bfd *abfd, struct bfd_link_info *info) + process_def_file_and_drectve (abfd, info); + + if (pe_def_file->num_exports == 0 && !info->shared) +- return; +- ++ { ++ if (pe_dll_enable_reloc_section) ++ { ++ build_filler_bfd (0); ++ pe_output_file_set_long_section_names (filler_bfd); ++ } ++ return; ++ } ++ + generate_edata (abfd, info); + build_filler_bfd (1); + pe_output_file_set_long_section_names (filler_bfd); +@@ -3386,13 +3394,9 @@ pe_exe_build_sections (bfd *abfd, struct bfd_link_info *info ATTRIBUTE_UNUSED) + pe_output_file_set_long_section_names (filler_bfd); + } + +-void +-pe_dll_fill_sections (bfd *abfd, struct bfd_link_info *info) ++static void ++pe_dll_create_reloc (bfd *abfd, struct bfd_link_info *info) + { +- pe_dll_id_target (bfd_get_target (abfd)); +- pe_output_file_set_long_section_names (abfd); +- image_base = pe_data (abfd)->pe_opthdr.ImageBase; +- + generate_reloc (abfd, info); + if (reloc_sz > 0) + { +@@ -3409,38 +3413,43 @@ pe_dll_fill_sections (bfd *abfd, struct bfd_link_info *info) + lang_do_assignments (lang_final_phase_enum); + } + +- fill_edata (abfd, info); +- +- if (info->shared && !info->pie) +- pe_data (abfd)->dll = 1; +- +- edata_s->contents = edata_d; + reloc_s->contents = reloc_d; + } + + void +-pe_exe_fill_sections (bfd *abfd, struct bfd_link_info *info) ++pe_dll_fill_sections (bfd *abfd, struct bfd_link_info *info) + { ++ if (!reloc_s && !edata_s) ++ return; + pe_dll_id_target (bfd_get_target (abfd)); + pe_output_file_set_long_section_names (abfd); + image_base = pe_data (abfd)->pe_opthdr.ImageBase; + +- generate_reloc (abfd, info); +- if (reloc_sz > 0) ++ if (reloc_s) ++ pe_dll_create_reloc (abfd, info); ++ ++ if (edata_s) + { +- bfd_set_section_size (filler_bfd, reloc_s, reloc_sz); ++ fill_edata (abfd, info); ++ edata_s->contents = edata_d; ++ } + +- /* Resize the sections. */ +- lang_reset_memory_regions (); +- lang_size_sections (NULL, TRUE); ++ if (info->shared && !info->pie) ++ pe_data (abfd)->dll = 1; + +- /* Redo special stuff. */ +- ldemul_after_allocation (); + +- /* Do the assignments again. */ +- lang_do_assignments (lang_final_phase_enum); +- } +- reloc_s->contents = reloc_d; ++} ++ ++void ++pe_exe_fill_sections (bfd *abfd, struct bfd_link_info *info) ++{ ++ if (!reloc_s) ++ return; ++ pe_dll_id_target (bfd_get_target (abfd)); ++ pe_output_file_set_long_section_names (abfd); ++ image_base = pe_data (abfd)->pe_opthdr.ImageBase; ++ ++ pe_dll_create_reloc (abfd, info); + } + + bfd_boolean +diff --git a/ld/pe-dll.h b/ld/pe-dll.h +index 4697390..2bf71d9 100644 +--- a/ld/pe-dll.h ++++ b/ld/pe-dll.h +@@ -31,6 +31,7 @@ extern def_file *pe_def_file; + extern int pe_dll_export_everything; + extern int pe_dll_exclude_all_symbols; + extern int pe_dll_do_default_excludes; ++extern int pe_dll_enable_reloc_section; + extern int pe_dll_kill_ats; + extern int pe_dll_stdcall_aliases; + extern int pe_dll_warn_dup_exports; +-- +2.0.1 +

1 0

[tor-browser-bundle/master] add hardening for Windows bundles
by mikeperry＠torproject.org 30 Aug '14

30 Aug '14

commit 9b138783e0f6e2423caba58bad777fc5622169db Author: Erinn Clark <erinn(a)torproject.org> Date: Thu Aug 21 19:21:43 2014 -0400 add hardening for Windows bundles --- gitian/build-helpers/i686-w64-mingw32-g++ | 2 +- gitian/build-helpers/i686-w64-mingw32-gcc | 2 +- gitian/build-helpers/i686-w64-mingw32-ld | 7 +----- gitian/descriptors/windows/gitian-firefox.yml | 24 ++++++++------------ .../windows/gitian-pluggable-transports.yml | 12 ++++++++-- gitian/descriptors/windows/gitian-tor.yml | 16 +++++++------ gitian/descriptors/windows/gitian-utils.yml | 24 +++++++++++--------- gitian/mkbundle-windows.sh | 6 ++--- 8 files changed, 48 insertions(+), 45 deletions(-) diff --git a/gitian/build-helpers/i686-w64-mingw32-g++ b/gitian/build-helpers/i686-w64-mingw32-g++ index e3c13fd..b73f107 100755 --- a/gitian/build-helpers/i686-w64-mingw32-g++ +++ b/gitian/build-helpers/i686-w64-mingw32-g++ @@ -1,4 +1,4 @@ #!/bin/sh # Hardened mingw gcc wrapper -/usr/bin/i686-w64-mingw32-g++ -Wl,--dynamicbase -Wl,--nxcompat -fstack-protector-all -pie -fPIE --param ssp-buffer-size=4 -fno-strict-overflow "$@" +/home/ubuntu/install/mingw-w64/bin/i686-w64-mingw32-g++ -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -fstack-protector --param ssp-buffer-size=4 -fno-strict-overflow "$@" diff --git a/gitian/build-helpers/i686-w64-mingw32-gcc b/gitian/build-helpers/i686-w64-mingw32-gcc index 830e11b..d4fd642 100755 --- a/gitian/build-helpers/i686-w64-mingw32-gcc +++ b/gitian/build-helpers/i686-w64-mingw32-gcc @@ -1,4 +1,4 @@ #!/bin/sh # Hardened mingw gcc wrapper -/usr/bin/i686-w64-mingw32-gcc -Wl,--dynamicbase -Wl,--nxcompat -fstack-protector-all -pie -fPIE --param ssp-buffer-size=4 -fno-strict-overflow "$@" +/home/ubuntu/install/mingw-w64/bin/i686-w64-mingw32-gcc -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -fstack-protector --param ssp-buffer-size=4 -fno-strict-overflow "$@" diff --git a/gitian/build-helpers/i686-w64-mingw32-ld b/gitian/build-helpers/i686-w64-mingw32-ld index e085bdd..f8c61fd 100755 --- a/gitian/build-helpers/i686-w64-mingw32-ld +++ b/gitian/build-helpers/i686-w64-mingw32-ld @@ -1,9 +1,4 @@ #!/bin/sh # Hardened mingw gcc wrapper -if [ -x /usr/bin/i686-w64-mingw32-ld.orig ]; -then - /usr/bin/i686-w64-mingw32-ld.orig --dynamicbase --nxcompat -lssp -L/usr/lib/gcc/i686-w64-mingw32/4.6/ "$@" -else - /usr/bin/i686-w64-mingw32-ld --dynamicbase --nxcompat -lssp -L/usr/lib/gcc/i686-w64-mingw32/4.6/ "$@" -fi +/home/ubuntu/install/mingw-w64/bin/i686-w64-mingw32-ld --dynamicbase --nxcompat --enable-reloc-section -lssp -L$INSTDIR/gcclibs/ "$@" diff --git a/gitian/descriptors/windows/gitian-firefox.yml b/gitian/descriptors/windows/gitian-firefox.yml index 94b5eef..0968911 100644 --- a/gitian/descriptors/windows/gitian-firefox.yml +++ b/gitian/descriptors/windows/gitian-firefox.yml @@ -20,10 +20,10 @@ files: - "mingw-w64-win32-utils.zip" - "re-dzip.sh" - "dzip.sh" -# TODO: Hardening. -#- "i686-w64-mingw32-gcc" -#- "i686-w64-mingw32-g++" -#- "i686-w64-mingw32-ld" +- "gcclibs-win32-utils.zip" +- "i686-w64-mingw32-gcc" +- "i686-w64-mingw32-g++" +- "i686-w64-mingw32-ld" - "msvcr100.dll" - "versions" script: | @@ -38,8 +38,10 @@ script: | mkdir -p $INSTDIR/Browser/ mkdir -p $OUTDIR/ unzip -d $INSTDIR mingw-w64-win32-utils.zip + unzip -d $INSTDIR gcclibs-win32-utils.zip # Make sure our custom mingw gets used. export PATH=$INSTDIR/mingw-w64/bin:$PATH + # We don't want to link against msvcrt.dll due to bug 9084. i686-w64-mingw32-g++ -dumpspecs > msvcr100.spec sed 's/msvcrt/msvcr100/' -i msvcr100.spec @@ -73,22 +75,16 @@ script: | make -f client.mk configure find -type f | xargs touch --date="$REFERENCE_DATETIME" # - # FIXME: MinGW doens't like being built with hardening, and Firefox doesn't - # like being configured with it - # XXX: These changes cause the exes to crash on launch. - #mkdir -p ~/build/bin/ - #cp ~/build/i686* ~/build/bin/ - #export PATH=~/build/bin:$PATH - # XXX: the path to ld is hardcoded in mingw.. This forces gcc's linking to - # use our flags: - #sudo mv /usr/bin/i686-w64-mingw32-ld /usr/bin/i686-w64-mingw32-ld.orig - #sudo cp ~/build/bin/i686-w64-mingw32-ld /usr/bin/ + mkdir -p ~/build/bin/ + cp ~/build/i686* ~/build/bin/ + export PATH=~/build/bin:$PATH # make $MAKEOPTS -f client.mk build # make -C obj-* package INNER_MAKE_PACKAGE=true cp -a obj-*/dist/firefox/* $INSTDIR/Browser/ cp -a ~/build/msvcr100.dll $INSTDIR/Browser/ + cp -a $INSTDIR/gcclibs/libssp-0.dll $INSTDIR/Browser/ # # What the hell are these three bytes anyways? # FIXME: This was probably fixed by patching binutils. If we get matching diff --git a/gitian/descriptors/windows/gitian-pluggable-transports.yml b/gitian/descriptors/windows/gitian-pluggable-transports.yml index 1580152..bac9bf0 100644 --- a/gitian/descriptors/windows/gitian-pluggable-transports.yml +++ b/gitian/descriptors/windows/gitian-pluggable-transports.yml @@ -50,8 +50,10 @@ files: - "go.tar.gz" - "dzip.sh" - "pyc-timestamp.sh" +- "binutils-win32-utils.zip" - "openssl-win32-utils.zip" - "gmp-win32-utils.zip" +- "gcclibs-win32-utils.zip" script: | # Set the timestamp on every .pyc file in a zip file, and re-dzip the zip file. function py2exe_zip_timestomp { @@ -75,14 +77,20 @@ script: | export FAKETIME=$REFERENCE_DATETIME export TZ=UTC export LC_ALL=C - export CFLAGS="-mwindows" - export LDFLAGS="-mwindows" + export CFLAGS="-mwindows -fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security" + export LDFLAGS="-mwindows -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$INSTDIR/gcclibs" umask 0022 + unzip -d $INSTDIR binutils-win32-utils.zip unzip -d $INSTDIR gmp-win32-utils.zip unzip -d $INSTDIR openssl-win32-utils.zip + unzip -d $INSTDIR gcclibs-win32-utils.zip cp $INSTDIR/gmp/bin/*dll* $INSTDIR/Tor + export PATH=$INSTDIR/mingw-w64/bin:$PATH + sudo mv /usr/bin/i686-w64-mingw32-ld /usr/bin/i686-w64-mingw32-ld.orig + sudo cp $INSTDIR/mingw-w64/bin/i686-w64-mingw32-ld /usr/bin/ + # We need at least Wine 1.5.29 which is not in Ubuntu's main repository (see # below). Thus, we resort to a PPA and need therefore to determine the correct # network interface depending on the virtualization we use. diff --git a/gitian/descriptors/windows/gitian-tor.yml b/gitian/descriptors/windows/gitian-tor.yml index bc70839..65df589 100644 --- a/gitian/descriptors/windows/gitian-tor.yml +++ b/gitian/descriptors/windows/gitian-tor.yml @@ -35,6 +35,7 @@ files: - "openssl-win32-utils.zip" - "libevent-win32-utils.zip" - "zlib-win32-utils.zip" +- "gcclibs-win32-utils.zip" script: | INSTDIR="$HOME/install" source versions @@ -51,14 +52,17 @@ script: | unzip -d $INSTDIR zlib-win32-utils.zip unzip -d $INSTDIR libevent-win32-utils.zip unzip -d $INSTDIR openssl-win32-utils.zip + unzip -d $INSTDIR gcclibs-win32-utils.zip cp $INSTDIR/zlib/lib/*.dll $INSTDIR/Tor/ cp $INSTDIR/libevent/bin/*.dll $INSTDIR/Tor/ cp $INSTDIR/openssl/bin/*.dll $INSTDIR/Tor/ - # Make sure our custom ld gets used. - # See the we-need-only-the-binutils-comment in gitian-utils.yml for the - # reasoning behind the "mingw-w64" dir instead of an expected "binutils" one. + cp $INSTDIR/gcclibs/*.dll $INSTDIR/Tor/ + export PATH=$INSTDIR/mingw-w64/bin:$PATH + sudo mv /usr/bin/i686-w64-mingw32-ld /usr/bin/i686-w64-mingw32-ld.orig + sudo cp $INSTDIR/mingw-w64/bin/i686-w64-mingw32-ld /usr/bin/ + # Building tor cd tor git update-index --refresh -q @@ -89,8 +93,8 @@ script: | mkdir -p $OUTDIR/src #git archive HEAD | tar -x -C $OUTDIR/src # Let's avoid the console window popping up. - export CFLAGS="-mwindows" - export LDFLAGS="-mwindows" + export CFLAGS="-mwindows -fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security" + export LDFLAGS="-mwindows -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$INSTDIR/gcclibs" ./autogen.sh find -type f | xargs touch --date="$REFERENCE_DATETIME" ./configure --disable-asciidoc --host=i686-w64-mingw32 --with-libevent-dir=$INSTDIR/libevent --with-openssl-dir=$INSTDIR/openssl --prefix=$INSTDIR --with-zlib-dir=$INSTDIR/zlib/ @@ -100,8 +104,6 @@ script: | install -s $INSTDIR/bin/tor.exe $INSTDIR/Tor/ cp $INSTDIR/share/tor/geoip $INSTDIR/Data/Tor/ cp $INSTDIR/share/tor/geoip6 $INSTDIR/Data/Tor/ - cp -a /usr/lib/gcc/i686-w64-mingw32/4.6/libgcc_s_sjlj-1.dll $INSTDIR/Tor/ - cp -a /usr/lib/gcc/i686-w64-mingw32/4.6/libssp*.dll $INSTDIR/Tor/ # Grabbing the result cd $INSTDIR diff --git a/gitian/descriptors/windows/gitian-utils.yml b/gitian/descriptors/windows/gitian-utils.yml index 87dbe16..2d0b3db 100644 --- a/gitian/descriptors/windows/gitian-utils.yml +++ b/gitian/descriptors/windows/gitian-utils.yml @@ -31,6 +31,7 @@ files: - "gcc.tar.bz2" - "openssl.tar.gz" - "gmp.tar.bz2" +- "enable-reloc-section-ld.patch" - "peXXigen.patch" - "versions" - "dzip.sh" @@ -47,15 +48,11 @@ script: | # XXX: This is needed due to bug 10102. sed 's/= extern_rt_rel_d;/= extern_rt_rel_d;\n memset (extern_rt_rel_d, 0, PE_IDATA5_SIZE);/' -i ld/pe-dll.c # Zeroing timestamps in PE headers reliably, see bug 12753. + patch -p1 < ../enable-reloc-section-ld.patch patch -p1 < ../peXXigen.patch ./configure --prefix=$INSTDIR/mingw-w64 --target=i686-w64-mingw32 --disable-multilib make $MAKEOPTS make install - # XXX: We currently do this as we are not using our own compiler but only our - # own binutils for compiling tor. See bug 10077. Nevertheless, we need both - # for cross-compiling Tor Browser. - cd $INSTDIR - ~/build/dzip.sh binutils-$BINUTILS_VER-win32-utils.zip mingw-w64 # Make sure our ld etc. is found and used. export PATH=$INSTDIR/mingw-w64/bin:$PATH cd ~/build @@ -78,7 +75,7 @@ script: | sed 's/msvcrt/msvcr100/' -i gcc-*/gcc/config/i386/t-mingw-w32 # LDFLAGS_FOR_TARGET does not work for some reason. Thus, we take # CFLAGS_FOR_TARGET. - export CFLAGS_FOR_TARGET="-specs=/home/ubuntu/build/msvcr100.spec" + export CFLAGS_FOR_TARGET="-specs=/home/ubuntu/build/msvcr100.spec -Wl,--nxcompat -Wl,--dynamicbase" gcc-*/configure --prefix=$INSTDIR/mingw-w64 --target=i686-w64-mingw32 --disable-multilib --enable-languages=c,c++ make $MAKEOPTS all-gcc make install-gcc @@ -99,8 +96,12 @@ script: | cd .. # Second stage of gcc compilation cd gcc + find -type f | xargs touch --date="$REFERENCE_DATETIME" make $MAKEOPTS make install + mkdir -p $INSTDIR/gcclibs + cp i686-w64-mingw32/libssp/.libs/libssp-0.dll $INSTDIR/gcclibs + cp i686-w64-mingw32/libgcc/shlib/libgcc_s_sjlj-1.dll $INSTDIR/gcclibs cd .. # XXX: Build the libraries we include into the bundles deterministically. As @@ -111,12 +112,12 @@ script: | export LD_PRELOAD=/usr/lib/faketime/libfaketime.so.1 export FAKETIME=$REFERENCE_DATETIME # Building zlib - export CFLAGS="-mwindows" - export LDFLAGS="-mwindows" + export CFLAGS="-mwindows -fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security" + export LDFLAGS="-mwindows -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$INSTDIR/gcclibs/" cd zlib find -type f | xargs touch --date="$REFERENCE_DATETIME" - make BINARY_PATH=$INSTDIR/zlib/lib INCLUDE_PATH=$INSTDIR/zlib/include LIBRARY_PATH=$INSTDIR/zlib/lib -f win32/Makefile.gcc PREFIX=i686-w64-mingw32- $MAKEOPTS SHARED_MODE=1 - make BINARY_PATH=$INSTDIR/zlib/lib INCLUDE_PATH=$INSTDIR/zlib/include LIBRARY_PATH=$INSTDIR/zlib/lib -f win32/Makefile.gcc PREFIX=i686-w64-mingw32- $MAKEOPTS SHARED_MODE=1 install + make BINARY_PATH=$INSTDIR/zlib/lib INCLUDE_PATH=$INSTDIR/zlib/include LIBRARY_PATH=$INSTDIR/zlib/lib -f win32/Makefile.gcc PREFIX=i686-w64-mingw32- $MAKEOPTS SHARED_MODE=1 LOC="-fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$INSTDIR/gcclibs/" + make BINARY_PATH=$INSTDIR/zlib/lib INCLUDE_PATH=$INSTDIR/zlib/include LIBRARY_PATH=$INSTDIR/zlib/lib -f win32/Makefile.gcc PREFIX=i686-w64-mingw32- $MAKEOPTS SHARED_MODE=1 LOC="-fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$INSTDIR/gcclibs/" install cd .. # Building Libevent @@ -133,7 +134,7 @@ script: | cd openssl-* find -type f | xargs touch --date="$REFERENCE_DATETIME" # TODO: Add enable-ec_nistp_64_gcc_128 for 64bit Windows. - ./Configure -shared --cross-compile-prefix=i686-w64-mingw32- mingw --prefix=$INSTDIR/openssl + ./Configure -shared --cross-compile-prefix=i686-w64-mingw32- mingw "-fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$INSTDIR/gcclibs/" --prefix=$INSTDIR/openssl # Using $MAKEOPTS breaks the build. Might be the issue mentioned on # http://cblfs.cross-lfs.org/index.php/OpenSSL. make @@ -156,4 +157,5 @@ script: | ~/build/dzip.sh libevent-${LIBEVENT_TAG#release-}-win32-utils.zip libevent ~/build/dzip.sh openssl-$OPENSSL_VER-win32-utils.zip openssl ~/build/dzip.sh gmp-$GMP_VER-win32-utils.zip gmp + ~/build/dzip.sh gcclibs-$GCC_VER-win32-utils.zip gcclibs cp *-utils.zip $OUTDIR/ diff --git a/gitian/mkbundle-windows.sh b/gitian/mkbundle-windows.sh index 0af015d..9ef5c41 100755 --- a/gitian/mkbundle-windows.sh +++ b/gitian/mkbundle-windows.sh @@ -97,7 +97,7 @@ fi cd $GITIAN_DIR -if [ ! -f inputs/binutils-$BINUTILS_VER-win32-utils.zip -o \ +if [ ! -f inputs/gcclibs-$GCC_VER-win32-utils.zip -o \ ! -f inputs/mingw-w64-$GCC_VER-win32-utils.zip -o \ ! -f inputs/zlib-${ZLIB_TAG_ORIG#v}-win32-utils.zip -o \ ! -f inputs/libevent-${LIBEVENT_TAG_ORIG#release-}-win32-utils.zip -o \ @@ -117,12 +117,12 @@ then cd inputs cp -a ../build/out/*-utils.zip . - ln -sf binutils-$BINUTILS_VER-win32-utils.zip binutils-win32-utils.zip ln -sf mingw-w64-$GCC_VER-win32-utils.zip mingw-w64-win32-utils.zip ln -sf zlib-${ZLIB_TAG_ORIG#v}-win32-utils.zip zlib-win32-utils.zip ln -sf libevent-${LIBEVENT_TAG_ORIG#release-}-win32-utils.zip libevent-win32-utils.zip ln -sf openssl-$OPENSSL_VER-win32-utils.zip openssl-win32-utils.zip ln -sf gmp-$GMP_VER-win32-utils.zip gmp-win32-utils.zip + ln -sf gcclibs-$GCC_VER-win32-utils.zip gcclibs-win32-utils.zip cd .. #cp -a result/utils-win-res.yml inputs/ else @@ -132,12 +132,12 @@ else # We might have built the utilities in the past but maybe the links are # pointing to the wrong version. Refresh them. cd inputs - ln -sf binutils-$BINUTILS_VER-win32-utils.zip binutils-win32-utils.zip ln -sf mingw-w64-$GCC_VER-win32-utils.zip mingw-w64-win32-utils.zip ln -sf zlib-${ZLIB_TAG_ORIG#v}-win32-utils.zip zlib-win32-utils.zip ln -sf libevent-${LIBEVENT_TAG_ORIG#release-}-win32-utils.zip libevent-win32-utils.zip ln -sf openssl-$OPENSSL_VER-win32-utils.zip openssl-win32-utils.zip ln -sf gmp-$GMP_VER-win32-utils.zip gmp-win32-utils.zip + ln -sf gcclibs-$GCC_VER-win32-utils.zip gcclibs-win32-utils.zip cd .. fi

1 0

[tor-browser-bundle/master] make Tor and the PTs build with our mingw compilers
by mikeperry＠torproject.org 30 Aug '14

30 Aug '14

commit e92aa0a6a20117a9badd0c116284e77afd8b9dbb Author: Erinn Clark <erinn(a)torproject.org> Date: Tue Aug 26 11:01:48 2014 -0400 make Tor and the PTs build with our mingw compilers --- gitian/build-helpers/wine-wrappers/dllwrap.py | 2 +- gitian/build-helpers/wine-wrappers/g++.py | 2 +- gitian/build-helpers/wine-wrappers/gcc.py | 2 +- gitian/descriptors/windows/gitian-pluggable-transports.yml | 8 ++------ gitian/descriptors/windows/gitian-tor.yml | 8 ++------ 5 files changed, 7 insertions(+), 15 deletions(-) diff --git a/gitian/build-helpers/wine-wrappers/dllwrap.py b/gitian/build-helpers/wine-wrappers/dllwrap.py index fdff035..8f339ff 100755 --- a/gitian/build-helpers/wine-wrappers/dllwrap.py +++ b/gitian/build-helpers/wine-wrappers/dllwrap.py @@ -10,7 +10,7 @@ import sys import common -args = ["/usr/bin/i686-w64-mingw32-dllwrap"] +args = ["/home/ubuntu/install/mingw-w64/bin/i686-w64-mingw32-dllwrap"] sys.argv.pop(0) while sys.argv: a = sys.argv.pop(0) diff --git a/gitian/build-helpers/wine-wrappers/g++.py b/gitian/build-helpers/wine-wrappers/g++.py index 4738420..0688285 100755 --- a/gitian/build-helpers/wine-wrappers/g++.py +++ b/gitian/build-helpers/wine-wrappers/g++.py @@ -10,7 +10,7 @@ import sys import common -args = ["/usr/bin/i686-w64-mingw32-g++"] +args = ["/home/ubuntu/install/mingw-w64/bin/i686-w64-mingw32-g++"] sys.argv.pop(0) while sys.argv: a = sys.argv.pop(0) diff --git a/gitian/build-helpers/wine-wrappers/gcc.py b/gitian/build-helpers/wine-wrappers/gcc.py index 493b27b..37bb1d8 100755 --- a/gitian/build-helpers/wine-wrappers/gcc.py +++ b/gitian/build-helpers/wine-wrappers/gcc.py @@ -10,7 +10,7 @@ import sys import common -args = ["/usr/bin/i686-w64-mingw32-gcc"] +args = ["/home/ubuntu/install/mingw-w64/bin/i686-w64-mingw32-gcc"] sys.argv.pop(0) while sys.argv: a = sys.argv.pop(0) diff --git a/gitian/descriptors/windows/gitian-pluggable-transports.yml b/gitian/descriptors/windows/gitian-pluggable-transports.yml index bac9bf0..93776b8 100644 --- a/gitian/descriptors/windows/gitian-pluggable-transports.yml +++ b/gitian/descriptors/windows/gitian-pluggable-transports.yml @@ -11,8 +11,6 @@ packages: - "swig" - "p7zip-full" - "m4" -- "mingw-w64" -- "g++-mingw-w64" - "python-dev" - "faketime" - "libtool" @@ -50,7 +48,7 @@ files: - "go.tar.gz" - "dzip.sh" - "pyc-timestamp.sh" -- "binutils-win32-utils.zip" +- "mingw-w64-win32-utils.zip" - "openssl-win32-utils.zip" - "gmp-win32-utils.zip" - "gcclibs-win32-utils.zip" @@ -81,15 +79,13 @@ script: | export LDFLAGS="-mwindows -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$INSTDIR/gcclibs" umask 0022 - unzip -d $INSTDIR binutils-win32-utils.zip + unzip -d $INSTDIR mingw-w64-win32-utils.zip unzip -d $INSTDIR gmp-win32-utils.zip unzip -d $INSTDIR openssl-win32-utils.zip unzip -d $INSTDIR gcclibs-win32-utils.zip cp $INSTDIR/gmp/bin/*dll* $INSTDIR/Tor export PATH=$INSTDIR/mingw-w64/bin:$PATH - sudo mv /usr/bin/i686-w64-mingw32-ld /usr/bin/i686-w64-mingw32-ld.orig - sudo cp $INSTDIR/mingw-w64/bin/i686-w64-mingw32-ld /usr/bin/ # We need at least Wine 1.5.29 which is not in Ubuntu's main repository (see # below). Thus, we resort to a PPA and need therefore to determine the correct diff --git a/gitian/descriptors/windows/gitian-tor.yml b/gitian/descriptors/windows/gitian-tor.yml index 65df589..277f2d0 100644 --- a/gitian/descriptors/windows/gitian-tor.yml +++ b/gitian/descriptors/windows/gitian-tor.yml @@ -11,7 +11,6 @@ packages: - "autoconf" - "automake" - "autoconf2.13" -- "mingw-w64" - "faketime" - "libtool" reference_datetime: "2000-01-01 00:00:00" @@ -31,7 +30,7 @@ files: - "bug11200-hang-0.2.5.patch" - "binutils.tar.bz2" - "dzip.sh" -- "binutils-win32-utils.zip" +- "mingw-w64-win32-utils.zip" - "openssl-win32-utils.zip" - "libevent-win32-utils.zip" - "zlib-win32-utils.zip" @@ -48,7 +47,7 @@ script: | mkdir -p $INSTDIR/bin/ mkdir -p $INSTDIR/Tor/ mkdir -p $INSTDIR/Data/Tor/ - unzip -d $INSTDIR binutils-win32-utils.zip + unzip -d $INSTDIR mingw-w64-win32-utils.zip unzip -d $INSTDIR zlib-win32-utils.zip unzip -d $INSTDIR libevent-win32-utils.zip unzip -d $INSTDIR openssl-win32-utils.zip @@ -60,9 +59,6 @@ script: | export PATH=$INSTDIR/mingw-w64/bin:$PATH - sudo mv /usr/bin/i686-w64-mingw32-ld /usr/bin/i686-w64-mingw32-ld.orig - sudo cp $INSTDIR/mingw-w64/bin/i686-w64-mingw32-ld /usr/bin/ - # Building tor cd tor git update-index --refresh -q

1 0

[tor-browser-bundle/master] Update changelog and bumped Tor Browser branch.
by gk＠torproject.org 29 Aug '14

29 Aug '14

commit 59cb26c5fa474bc766e13974d893d51e98ea8453 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Aug 29 13:57:11 2014 +0000 Update changelog and bumped Tor Browser branch. --- Bundle-Data/Docs/ChangeLog.txt | 5 ++++- gitian/versions.alpha | 4 ++-- gitian/versions.nightly | 4 ++-- 3 files changed, 8 insertions(+), 5 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 37d8339..80c80b4 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -8,6 +8,7 @@ Tor Browser Bundle 4.0-alpha-2 -- Sep 2 2014 * Bug 11199: Improve error messages if Tor exits unexpectedly * Update Torbutton to 1.6.12.1 * Bug 12684: New strings for canvas image extraction message + * Bug 8940: Move RecommendedTBBVersions file to www.torproject.org * Bug 12684: Improve Canvas image extraction permissions prompt * Bug 7265: Only prompt for first party canvas access. Log all scripts that attempt to extract canvas images to Browser console. @@ -16,15 +17,17 @@ Tor Browser Bundle 4.0-alpha-2 -- Sep 2 2014 * Bug 4234: Automatic Update support (off by default) * Bug 9881: Open popups in new tabs by default * Meek Pluggable Transport: - * Use TLSv1.0 in meek-http-helper to blend in with Firefox 24 + * Bug 12766: Use TLSv1.0 in meek-http-helper to blend in with Firefox 24 * Windows: * Bug 10065: Enable DEP, ASLR, and SSP hardening options Tor Browser Bundle 3.6.5 -- Sep 2 2014 * All Platforms * Update Firefox to 24.8.0esr + * Update HTTPS Everywhere to 4.0.0 * Update Torbutton to 1.6.12.1 * Bug 12684: New strings for canvas image extraction message + * Bug 8940: Move RecommendedTBBVersions file to www.torproject.org * Bug 9531: Workaround to avoid rare hangs during New Identity * Bug 12684: Improve Canvas image extraction permissions prompt * Bug 7265: Only prompt for first party canvas access. Log all scripts diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 685bbc2..e503ef2 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -1,10 +1,10 @@ -TORBROWSER_VERSION=4.0-alpha-1 +TORBROWSER_VERSION=4.0-alpha-2 BUNDLE_LOCALES="ar de es-ES fa fr it ko nl pl pt-PT ru tr vi zh-CN" BUILD_PT_BUNDLES=1 VERIFY_TAGS=1 -FIREFOX_VERSION=24.7.0esr +FIREFOX_VERSION=24.8.0esr TORBROWSER_UPDATE_CHANNEL=alpha diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 38f7863..4f483be 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -4,11 +4,11 @@ BUILD_PT_BUNDLES=1 VERIFY_TAGS=0 -FIREFOX_VERSION=24.7.0esr +FIREFOX_VERSION=24.8.0esr TORBROWSER_UPDATE_CHANNEL=default -TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-4.x-2 +TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-4.x-1 TOR_TAG=master TORLAUNCHER_TAG=master TORBUTTON_TAG=master

1 0

[tor-browser-bundle/maint-3.6] Bump HTTPS Everyhwere version.
by gk＠torproject.org 29 Aug '14

29 Aug '14

commit 6bf678be02b43e0bf8264017aa45f31b408fda7d Author: Georg Koppen <gk(a)torproject.org> Date: Fri Aug 29 13:38:57 2014 +0000 Bump HTTPS Everyhwere version. --- Bundle-Data/Docs/ChangeLog.txt | 1 + gitian/versions | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index af1cb61..f33c616 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,6 +1,7 @@ Tor Browser Bundle 3.6.5 -- Sep 2 2014 * All Platforms * Update Firefox to 24.8.0esr + * Update HTTPS Everywhere to 4.0.0 * Update Torbutton to 1.6.12.1 * Bug 12684: New strings for canvas image extraction message * Bug 8940: Move RecommendedTBBVersions file to www.torproject.org diff --git a/gitian/versions b/gitian/versions index 11ed2ae..14803a8 100755 --- a/gitian/versions +++ b/gitian/versions @@ -42,7 +42,7 @@ PY2EXE_VER=0.6.9 SETUPTOOLS_VER=1.4 LXML_VER=3.3.5 PARSLEY_VER=1.2 -HTTPSE_VER=3.5.3 +HTTPSE_VER=4.0.0 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz @@ -76,7 +76,7 @@ OSXSDK_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc TOOLCHAIN4_HASH=7b71bfe02820409b994c5c33a7eab81a81c72550f5da85ff7af70da3da244645 TOOLCHAIN4_OLD_HASH=65c1b2d302358a6b95a26c6828a66908a199276193bb0b268f2dcc1a997731e9 NOSCRIPT_HASH=3c8ed31dbd67634debf333f957ba5c08bf3596408c9d09b5bf4da98499733af4 -HTTPSE_HASH=06a635a6a9dd2a31f4ab72c9ed8bf612bdda33941f5fe8b3225553fdc3b99e10 +HTTPSE_HASH=1241631091f9ceb417f639a6df76425cda36ee4b38b78ce8d318088eb17a7219 MINGW_HASH=a5b03d0448a309341be4cf34c6ad3016d04c89952dca5243254b4d6c738b164f MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c

1 0

[tor-browser-bundle/maint-3.6] Add the versions file change to Torbutton changelog.
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 6269b8673bf0d923ca312dec27db4bc77fda417c Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Fri Aug 29 01:00:39 2014 -0700 Add the versions file change to Torbutton changelog. --- Bundle-Data/Docs/ChangeLog.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index e2301cf..af1cb61 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -3,6 +3,7 @@ Tor Browser Bundle 3.6.5 -- Sep 2 2014 * Update Firefox to 24.8.0esr * Update Torbutton to 1.6.12.1 * Bug 12684: New strings for canvas image extraction message + * Bug 8940: Move RecommendedTBBVersions file to www.torproject.org * Bug 9531: Workaround to avoid rare hangs during New Identity * Bug 12684: Improve Canvas image extraction permissions prompt * Bug 7265: Only prompt for first party canvas access. Log all scripts

1 0

[tor-browser-bundle/maint-3.6] Update versions file for 3.6.5.
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 924707d621d1a77b9628b03e58611a68a9b67e69 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Fri Aug 29 01:01:09 2014 -0700 Update versions file for 3.6.5. --- gitian/versions | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/gitian/versions b/gitian/versions index 25bafb0..11ed2ae 100755 --- a/gitian/versions +++ b/gitian/versions @@ -1,15 +1,15 @@ -TORBROWSER_VERSION=3.6.4 +TORBROWSER_VERSION=3.6.5 BUNDLE_LOCALES="ar de es-ES fa fr it ko nl pl pt-PT ru tr vi zh-CN" BUILD_PT_BUNDLES=1 VERIFY_TAGS=1 -FIREFOX_VERSION=24.7.0esr +FIREFOX_VERSION=24.8.0esr TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-3.x-1-build1 TOR_TAG=tor-0.2.4.23 TORLAUNCHER_TAG=0.2.5.6 -TORBUTTON_TAG=1.6.11.1 +TORBUTTON_TAG=1.6.12.1 HTTPSE_TAG=3.5.3 # XXX: HTTPSE_VER is used instead, pending #11630 NSIS_TAG=v0.1 ZLIB_TAG=v1.2.8

1 0