- tbb-commits - lists.torproject.org

[Git][tpo/applications/tor-browser][base-browser-115.5.0esr-13.5-1] fixup! Bug 42019: Empty browser's clipboard on browser shutdown
by ma1 (＠ma1) 04 Dec '23

04 Dec '23

ma1 pushed to branch base-browser-115.5.0esr-13.5-1 at The Tor Project / Applications / Tor Browser Commits: 2a4e21db by hackademix at 2023-12-04T12:18:52+01:00 fixup! Bug 42019: Empty browser's clipboard on browser shutdown Bug 42306: Prevent crashes and actually clear the clipboard on Wayland - - - - - 1 changed file: - browser/components/BrowserGlue.sys.mjs Changes: ===================================== browser/components/BrowserGlue.sys.mjs ===================================== @@ -155,12 +155,17 @@ const ClipboardPrivacy = { _globalActivation: false, _isPrivateClipboard: false, _hasher: null, + _shuttingDown: false, - _computeClipboardHash(win = Services.ww.activeWindow) { + _createTransferable() { const trans = Cc["@mozilla.org/widget/transferable;1"].createInstance( Ci.nsITransferable ); - trans.init(win?.docShell?.QueryInterface(Ci.nsILoadContext) || null); + trans.init(null); + return trans; + }, + _computeClipboardHash() { + const trans = this._createTransferable(); ["text/x-moz-url", "text/plain"].forEach(trans.addDataFlavor); try { Services.clipboard.getData(trans, Ci.nsIClipboard.kGlobalClipboard); @@ -199,16 +204,26 @@ const ClipboardPrivacy = { this._globalActivation = !Services.focus.activeWindow; }, 100); } - const clipboardHash = this._computeClipboardHash(win); - if (clipboardHash !== this._lastClipboardHash) { - this._isPrivateClipboard = - !activation && - (lazy.PrivateBrowsingUtils.permanentPrivateBrowsing || - lazy.PrivateBrowsingUtils.isWindowPrivate(win)); - this._lastClipboardHash = clipboardHash; - console.log( - `Clipboard changed: private ${this._isPrivateClipboard}, hash ${clipboardHash}.` - ); + + const checkClipboardContent = () => { + const clipboardHash = this._computeClipboardHash(); + if (clipboardHash !== this._lastClipboardHash) { + this._isPrivateClipboard = + !activation && + (lazy.PrivateBrowsingUtils.permanentPrivateBrowsing || + lazy.PrivateBrowsingUtils.isWindowPrivate(win)); + this._lastClipboardHash = clipboardHash; + console.log( + `Clipboard changed: private ${this._isPrivateClipboard}, hash ${clipboardHash}.` + ); + } + }; + + if (win.closed) { + checkClipboardContent(); + } else { + // defer clipboard access on DOM events to work-around tor-browser#42306 + lazy.setTimeout(checkClipboardContent, 0); } }; const focusListener = e => @@ -231,18 +246,28 @@ const ClipboardPrivacy = { if ( this._isPrivateClipboard && lazy.PrivateBrowsingUtils.isWindowPrivate(win) && - !( - lazy.PrivateBrowsingUtils.permanentPrivateBrowsing || - Array.from(Services.ww.getWindowEnumerator()).find(w => - lazy.PrivateBrowsingUtils.isWindowPrivate(w) - ) - ) + (this._shuttingDown || + !Array.from(Services.ww.getWindowEnumerator()).find( + w => + lazy.PrivateBrowsingUtils.isWindowPrivate(w) && + // We need to filter out the HIDDEN WebExtensions window, + // which might be private as well but is not UI-relevant. + !w.location.href.startsWith("chrome://extensions/") + )) ) { // no more private windows, empty private content if needed this.emptyPrivate(); } } }); + + lazy.AsyncShutdown.quitApplicationGranted.addBlocker( + "ClipboardPrivacy: removing private data", + () => { + this._shuttingDown = true; + this.emptyPrivate(); + } + ); }, emptyPrivate() { if ( @@ -253,7 +278,20 @@ const ClipboardPrivacy = { ) && this._lastClipboardHash === this._computeClipboardHash() ) { - Services.clipboard.emptyClipboard(Ci.nsIClipboard.kGlobalClipboard); + // nsIClipboard.emptyClipboard() does nothing in Wayland: + // we'll set an empty string as a work-around. + const trans = this._createTransferable(); + const flavor = "text/plain"; + trans.addDataFlavor(flavor); + const emptyString = Cc["@mozilla.org/supports-string;1"].createInstance( + Ci.nsISupportsString + ); + emptyString.data = ""; + trans.setTransferData(flavor, emptyString); + const { clipboard } = Services, + { kGlobalClipboard } = clipboard; + clipboard.setData(trans, null, kGlobalClipboard); + clipboard.emptyClipboard(kGlobalClipboard); this._lastClipboardHash = null; this._isPrivateClipboard = false; console.log("Private clipboard emptied."); @@ -2027,7 +2065,6 @@ BrowserGlue.prototype = { lazy.UpdateListener.reset(); } }, - () => ClipboardPrivacy.emptyPrivate(), // tor-browser#42019 ]; for (let task of tasks) { View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/2a4e21d… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/2a4e21d… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-115.5.0esr-13.0-1] fixup! Bug 42019: Empty browser's clipboard on browser shutdown
by ma1 (＠ma1) 04 Dec '23

04 Dec '23

ma1 pushed to branch tor-browser-115.5.0esr-13.0-1 at The Tor Project / Applications / Tor Browser Commits: 1a9bf95b by hackademix at 2023-12-04T12:13:55+01:00 fixup! Bug 42019: Empty browser's clipboard on browser shutdown Bug 42306: Prevent crashes and actually clear the clipboard on Wayland - - - - - 1 changed file: - browser/components/BrowserGlue.sys.mjs Changes: ===================================== browser/components/BrowserGlue.sys.mjs ===================================== @@ -157,12 +157,17 @@ const ClipboardPrivacy = { _globalActivation: false, _isPrivateClipboard: false, _hasher: null, + _shuttingDown: false, - _computeClipboardHash(win = Services.ww.activeWindow) { + _createTransferable() { const trans = Cc["@mozilla.org/widget/transferable;1"].createInstance( Ci.nsITransferable ); - trans.init(win?.docShell?.QueryInterface(Ci.nsILoadContext) || null); + trans.init(null); + return trans; + }, + _computeClipboardHash() { + const trans = this._createTransferable(); ["text/x-moz-url", "text/plain"].forEach(trans.addDataFlavor); try { Services.clipboard.getData(trans, Ci.nsIClipboard.kGlobalClipboard); @@ -201,16 +206,26 @@ const ClipboardPrivacy = { this._globalActivation = !Services.focus.activeWindow; }, 100); } - const clipboardHash = this._computeClipboardHash(win); - if (clipboardHash !== this._lastClipboardHash) { - this._isPrivateClipboard = - !activation && - (lazy.PrivateBrowsingUtils.permanentPrivateBrowsing || - lazy.PrivateBrowsingUtils.isWindowPrivate(win)); - this._lastClipboardHash = clipboardHash; - console.log( - `Clipboard changed: private ${this._isPrivateClipboard}, hash ${clipboardHash}.` - ); + + const checkClipboardContent = () => { + const clipboardHash = this._computeClipboardHash(); + if (clipboardHash !== this._lastClipboardHash) { + this._isPrivateClipboard = + !activation && + (lazy.PrivateBrowsingUtils.permanentPrivateBrowsing || + lazy.PrivateBrowsingUtils.isWindowPrivate(win)); + this._lastClipboardHash = clipboardHash; + console.log( + `Clipboard changed: private ${this._isPrivateClipboard}, hash ${clipboardHash}.` + ); + } + }; + + if (win.closed) { + checkClipboardContent(); + } else { + // defer clipboard access on DOM events to work-around tor-browser#42306 + lazy.setTimeout(checkClipboardContent, 0); } }; const focusListener = e => @@ -233,18 +248,28 @@ const ClipboardPrivacy = { if ( this._isPrivateClipboard && lazy.PrivateBrowsingUtils.isWindowPrivate(win) && - !( - lazy.PrivateBrowsingUtils.permanentPrivateBrowsing || - Array.from(Services.ww.getWindowEnumerator()).find(w => - lazy.PrivateBrowsingUtils.isWindowPrivate(w) - ) - ) + (this._shuttingDown || + !Array.from(Services.ww.getWindowEnumerator()).find( + w => + lazy.PrivateBrowsingUtils.isWindowPrivate(w) && + // We need to filter out the HIDDEN WebExtensions window, + // which might be private as well but is not UI-relevant. + !w.location.href.startsWith("chrome://extensions/") + )) ) { // no more private windows, empty private content if needed this.emptyPrivate(); } } }); + + lazy.AsyncShutdown.quitApplicationGranted.addBlocker( + "ClipboardPrivacy: removing private data", + () => { + this._shuttingDown = true; + this.emptyPrivate(); + } + ); }, emptyPrivate() { if ( @@ -255,7 +280,20 @@ const ClipboardPrivacy = { ) && this._lastClipboardHash === this._computeClipboardHash() ) { - Services.clipboard.emptyClipboard(Ci.nsIClipboard.kGlobalClipboard); + // nsIClipboard.emptyClipboard() does nothing in Wayland: + // we'll set an empty string as a work-around. + const trans = this._createTransferable(); + const flavor = "text/plain"; + trans.addDataFlavor(flavor); + const emptyString = Cc["@mozilla.org/supports-string;1"].createInstance( + Ci.nsISupportsString + ); + emptyString.data = ""; + trans.setTransferData(flavor, emptyString); + const { clipboard } = Services, + { kGlobalClipboard } = clipboard; + clipboard.setData(trans, null, kGlobalClipboard); + clipboard.emptyClipboard(kGlobalClipboard); this._lastClipboardHash = null; this._isPrivateClipboard = false; console.log("Private clipboard emptied."); @@ -2130,7 +2168,6 @@ BrowserGlue.prototype = { } }, () => lazy.OnionAliasStore.uninit(), - () => ClipboardPrivacy.emptyPrivate(), // tor-browser#42019 ]; for (let task of tasks) { View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/1a9bf95… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/1a9bf95… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-115.5.0esr-13.5-1] fixup! Bug 42019: Empty browser's clipboard on browser shutdown
by ma1 (＠ma1) 04 Dec '23

04 Dec '23

ma1 pushed to branch tor-browser-115.5.0esr-13.5-1 at The Tor Project / Applications / Tor Browser Commits: 410b9a4c by hackademix at 2023-12-04T11:02:42+01:00 fixup! Bug 42019: Empty browser's clipboard on browser shutdown Bug 42306: Prevent crashes and actually clear the clipboard on Wayland - - - - - 1 changed file: - browser/components/BrowserGlue.sys.mjs Changes: ===================================== browser/components/BrowserGlue.sys.mjs ===================================== @@ -159,12 +159,17 @@ const ClipboardPrivacy = { _globalActivation: false, _isPrivateClipboard: false, _hasher: null, + _shuttingDown: false, - _computeClipboardHash(win = Services.ww.activeWindow) { + _createTransferable() { const trans = Cc["@mozilla.org/widget/transferable;1"].createInstance( Ci.nsITransferable ); - trans.init(win?.docShell?.QueryInterface(Ci.nsILoadContext) || null); + trans.init(null); + return trans; + }, + _computeClipboardHash() { + const trans = this._createTransferable(); ["text/x-moz-url", "text/plain"].forEach(trans.addDataFlavor); try { Services.clipboard.getData(trans, Ci.nsIClipboard.kGlobalClipboard); @@ -203,16 +208,26 @@ const ClipboardPrivacy = { this._globalActivation = !Services.focus.activeWindow; }, 100); } - const clipboardHash = this._computeClipboardHash(win); - if (clipboardHash !== this._lastClipboardHash) { - this._isPrivateClipboard = - !activation && - (lazy.PrivateBrowsingUtils.permanentPrivateBrowsing || - lazy.PrivateBrowsingUtils.isWindowPrivate(win)); - this._lastClipboardHash = clipboardHash; - console.log( - `Clipboard changed: private ${this._isPrivateClipboard}, hash ${clipboardHash}.` - ); + + const checkClipboardContent = () => { + const clipboardHash = this._computeClipboardHash(); + if (clipboardHash !== this._lastClipboardHash) { + this._isPrivateClipboard = + !activation && + (lazy.PrivateBrowsingUtils.permanentPrivateBrowsing || + lazy.PrivateBrowsingUtils.isWindowPrivate(win)); + this._lastClipboardHash = clipboardHash; + console.log( + `Clipboard changed: private ${this._isPrivateClipboard}, hash ${clipboardHash}.` + ); + } + }; + + if (win.closed) { + checkClipboardContent(); + } else { + // defer clipboard access on DOM events to work-around tor-browser#42306 + lazy.setTimeout(checkClipboardContent, 0); } }; const focusListener = e => @@ -235,18 +250,28 @@ const ClipboardPrivacy = { if ( this._isPrivateClipboard && lazy.PrivateBrowsingUtils.isWindowPrivate(win) && - !( - lazy.PrivateBrowsingUtils.permanentPrivateBrowsing || - Array.from(Services.ww.getWindowEnumerator()).find(w => - lazy.PrivateBrowsingUtils.isWindowPrivate(w) - ) - ) + (this._shuttingDown || + !Array.from(Services.ww.getWindowEnumerator()).find( + w => + lazy.PrivateBrowsingUtils.isWindowPrivate(w) && + // We need to filter out the HIDDEN WebExtensions window, + // which might be private as well but is not UI-relevant. + !w.location.href.startsWith("chrome://extensions/") + )) ) { // no more private windows, empty private content if needed this.emptyPrivate(); } } }); + + lazy.AsyncShutdown.quitApplicationGranted.addBlocker( + "ClipboardPrivacy: removing private data", + () => { + this._shuttingDown = true; + this.emptyPrivate(); + } + ); }, emptyPrivate() { if ( @@ -257,7 +282,20 @@ const ClipboardPrivacy = { ) && this._lastClipboardHash === this._computeClipboardHash() ) { - Services.clipboard.emptyClipboard(Ci.nsIClipboard.kGlobalClipboard); + // nsIClipboard.emptyClipboard() does nothing in Wayland: + // we'll set an empty string as a work-around. + const trans = this._createTransferable(); + const flavor = "text/plain"; + trans.addDataFlavor(flavor); + const emptyString = Cc["@mozilla.org/supports-string;1"].createInstance( + Ci.nsISupportsString + ); + emptyString.data = ""; + trans.setTransferData(flavor, emptyString); + const { clipboard } = Services, + { kGlobalClipboard } = clipboard; + clipboard.setData(trans, null, kGlobalClipboard); + clipboard.emptyClipboard(kGlobalClipboard); this._lastClipboardHash = null; this._isPrivateClipboard = false; console.log("Private clipboard emptied."); @@ -2118,7 +2156,6 @@ BrowserGlue.prototype = { } }, () => lazy.OnionAliasStore.uninit(), - () => ClipboardPrivacy.emptyPrivate(), // tor-browser#42019 ]; for (let task of tasks) { View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/410b9a4… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/410b9a4… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][maint-13.0] Revert "Bug 40933: Add symlinks to have incrementals between 12.5.x and 13.0"
by boklm (＠boklm) 01 Dec '23

01 Dec '23

boklm pushed to branch maint-13.0 at The Tor Project / Applications / tor-browser-build Commits: e0f8b589 by Richard Pospesel at 2023-11-30T14:41:29+00:00 Revert "Bug 40933: Add symlinks to have incrementals between 12.5.x and 13.0" This reverts commit a21969281d18941b69a94b994b0797f8b88ad45f. Bug 40936: We are no longer building incrementals from the 12.5 series so its time for this patch to go - - - - - 3 changed files: - Makefile - projects/release/config - − projects/release/link_old_mar_filenames Changes: ===================================== Makefile ===================================== @@ -183,7 +183,6 @@ torbrowser-testbuild-src: submodule-update torbrowser-incrementals-release: submodule-update $(rbm) build release --step update_responses_config --target release --target create_unsigned_incrementals --target torbrowser tools/update-responses/download_missing_versions release - $(rbm) build release --step link_old_mar_filenames --target release --target torbrowser tools/update-responses/gen_incrementals release $(rbm) build release --step hash_incrementals --target release --target torbrowser @@ -196,7 +195,6 @@ torbrowser-incrementals-release-unsigned: submodule-update torbrowser-incrementals-alpha: submodule-update $(rbm) build release --step update_responses_config --target alpha --target create_unsigned_incrementals --target torbrowser tools/update-responses/download_missing_versions alpha - $(rbm) build release --step link_old_mar_filenames --target alpha --target torbrowser tools/update-responses/gen_incrementals alpha $(rbm) build release --step hash_incrementals --target alpha --target torbrowser @@ -223,14 +221,12 @@ torbrowser-dmg2mar-release: submodule-update $(rbm) build release --step update_responses_config --target release --target signed --target torbrowser $(rbm) build release --step dmg2mar --target release --target signed --target torbrowser tools/update-responses/download_missing_versions release - $(rbm) build release --step link_old_mar_filenames --target release --target torbrowser CHECK_CODESIGNATURE_EXISTS=1 MAR_SKIP_EXISTING=1 tools/update-responses/gen_incrementals release torbrowser-dmg2mar-alpha: submodule-update $(rbm) build release --step update_responses_config --target alpha --target signed --target torbrowser $(rbm) build release --step dmg2mar --target alpha --target signed --target torbrowser tools/update-responses/download_missing_versions alpha - $(rbm) build release --step link_old_mar_filenames --target alpha --target torbrowser CHECK_CODESIGNATURE_EXISTS=1 MAR_SKIP_EXISTING=1 tools/update-responses/gen_incrementals alpha torbrowser-compare-windows-signed-unsigned-release: submodule-update @@ -527,7 +523,6 @@ mullvadbrowser-testbuild-src: submodule-update mullvadbrowser-incrementals-release: submodule-update $(rbm) build release --step update_responses_config --target release --target create_unsigned_incrementals --target mullvadbrowser tools/update-responses/download_missing_versions release - $(rbm) build release --step link_old_mar_filenames --target release --target mullvadbrowser tools/update-responses/gen_incrementals release $(rbm) build release --step hash_incrementals --target release --target mullvadbrowser @@ -540,7 +535,6 @@ mullvadbrowser-incrementals-release-unsigned: submodule-update mullvadbrowser-incrementals-alpha: submodule-update $(rbm) build release --step update_responses_config --target alpha --target create_unsigned_incrementals --target mullvadbrowser tools/update-responses/download_missing_versions alpha - $(rbm) build release --step link_old_mar_filenames --target alpha --target mullvadbrowser tools/update-responses/gen_incrementals alpha $(rbm) build release --step hash_incrementals --target alpha --target mullvadbrowser @@ -567,14 +561,12 @@ mullvadbrowser-dmg2mar-release: submodule-update $(rbm) build release --step update_responses_config --target release --target signed --target mullvadbrowser $(rbm) build release --step dmg2mar --target release --target signed --target mullvadbrowser tools/update-responses/download_missing_versions release - $(rbm) build release --step link_old_mar_filenames --target release --target mullvadbrowser CHECK_CODESIGNATURE_EXISTS=1 MAR_SKIP_EXISTING=1 tools/update-responses/gen_incrementals release mullvadbrowser-dmg2mar-alpha: submodule-update $(rbm) build release --step update_responses_config --target alpha --target signed --target mullvadbrowser $(rbm) build release --step dmg2mar --target alpha --target signed --target mullvadbrowser tools/update-responses/download_missing_versions alpha - $(rbm) build release --step link_old_mar_filenames --target alpha --target mullvadbrowser CHECK_CODESIGNATURE_EXISTS=1 MAR_SKIP_EXISTING=1 tools/update-responses/gen_incrementals alpha mullvadbrowser-compare-windows-signed-unsigned-release: submodule-update ===================================== projects/release/config ===================================== @@ -243,11 +243,6 @@ steps: debug: 0 input_files: [] update_responses_config: '[% INCLUDE update_responses_config %]' - link_old_mar_filenames: - build_log: '-' - debug: 0 - input_files: [] - link_old_mar_filenames: '[% INCLUDE link_old_mar_filenames %]' create_update_responses_tar: build_log: '-' debug: 0 ===================================== projects/release/link_old_mar_filenames deleted ===================================== @@ -1,19 +0,0 @@ -#!/bin/bash -[% c("var/set_default_env") -%] -# This script is for #40933: -# Fix generating incrementals between 12.5.x and 13.0 -[% FOREACH version = c("var/torbrowser_incremental_from") %] - cd [% shell_quote(path(dest_dir)) %]/[% IF c("var/unsigned_releases_dir") %]un[% END %]signed/[% version %] - test -e [% c("var/project-name") %]-linux-i686-[% version %]_ALL.mar || \ - ln -s [% c("var/project-name") %]-linux32-[% version %]_ALL.mar \ - [% c("var/project-name") %]-linux-i686-[% version %]_ALL.mar - test -e [% c("var/project-name") %]-linux-x86_64-[% version %]_ALL.mar || \ - ln -s [% c("var/project-name") %]-linux64-[% version %]_ALL.mar \ - [% c("var/project-name") %]-linux-x86_64-[% version %]_ALL.mar - test -e [% c("var/project-name") %]-windows-i686-[% version %]_ALL.mar || \ - ln -s [% c("var/project-name") %]-win32-[% version %]_ALL.mar \ - [% c("var/project-name") %]-windows-i686-[% version %]_ALL.mar - test -e [% c("var/project-name") %]-windows-x86_64-[% version %]_ALL.mar || \ - ln -s [% c("var/project-name") %]-win64-[% version %]_ALL.mar \ - [% c("var/project-name") %]-windows-x86_64-[% version %]_ALL.mar -[% END -%] View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/e… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/e… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-115.5.0esr-13.5-1] fixup! Bug 41649: Create rebase and security backport gitlab issue templates
by richard (＠richard) 30 Nov '23

30 Nov '23

richard pushed to branch tor-browser-115.5.0esr-13.5-1 at The Tor Project / Applications / Tor Browser Commits: fac50006 by Pier Angelo Vendrame at 2023-11-30T14:13:06+00:00 fixup! Bug 41649: Create rebase and security backport gitlab issue templates Add the step to update tor-browser-build's main after alpha rebases. - - - - - 1 changed file: - .gitlab/issue_templates/Rebase Browser - Alpha.md Changes: ===================================== .gitlab/issue_templates/Rebase Browser - Alpha.md ===================================== @@ -138,3 +138,10 @@ - **Tag**: `base-browser-$(ESR_VERSION)esr-$(BROWSER_MAJOR).$(BROWSER_MINOR)-1-build1` - **Message**: `Tagging build1 for $(ESR_VERSION)esr-based alpha` - [ ] Push tag to `upstream` +- [ ] Update tor-browser-build's main (no MR required, you can just push it if you have the permissions) + - [ ] Update `projects/firefox/config` + - [ ] Update `firefox_platform_version` + - [ ] Set `browser_build` to 1 (to prevent failures in alpha testbuilds) + - [ ] Update `projects/geckoview/config` + - [ ] Update `geckoview_version` + - [ ] Set `browser_build` to 1 View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/fac5000… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/fac5000… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-115.5.0esr-13.5-1] fixup! Adding issue and merge request templates
by richard (＠richard) 30 Nov '23

30 Nov '23

richard pushed to branch tor-browser-115.5.0esr-13.5-1 at The Tor Project / Applications / Tor Browser Commits: a084de1d by Pier Angelo Vendrame at 2023-11-30T14:03:08+00:00 fixup! Adding issue and merge request templates Add the step to update tor-browser-build's main after alpha rebases. - - - - - 1 changed file: - .gitlab/issue_templates/Rebase Browser - Alpha.md Changes: ===================================== .gitlab/issue_templates/Rebase Browser - Alpha.md ===================================== @@ -138,3 +138,10 @@ - **Tag**: `base-browser-$(ESR_VERSION)esr-$(BROWSER_MAJOR).$(BROWSER_MINOR)-1-build1` - **Message**: `Tagging build1 for $(ESR_VERSION)esr-based alpha` - [ ] Push tag to `upstream` +- [ ] Update tor-browser-build's main (no MR required, you can just push it if you have the permissions) + - [ ] Update `projects/firefox/config` + - [ ] Update `firefox_platform_version` + - [ ] Set `browser_build` to 1 (to prevent failures in alpha testbuilds) + - [ ] Update `projects/geckoview/config` + - [ ] Update `geckoview_version` + - [ ] Set `browser_build` to 1 View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/a084de1… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/a084de1… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][maint-13.0] Bug 41031: Add make targets to unsign and compare mar files
by richard (＠richard) 30 Nov '23

30 Nov '23

richard pushed to branch maint-13.0 at The Tor Project / Applications / tor-browser-build Commits: ae9e3999 by Nicolas Vigier at 2023-11-30T13:58:17+00:00 Bug 41031: Add make targets to unsign and compare mar files - - - - - 4 changed files: - Makefile - doc/MAKEFILE.txt - + projects/release/compare_mar_signed_unsigned - projects/release/config Changes: ===================================== Makefile ===================================== @@ -239,6 +239,12 @@ torbrowser-compare-windows-signed-unsigned-release: submodule-update torbrowser-compare-windows-signed-unsigned-alpha: submodule-update $(rbm) build release --step compare_windows_signed_unsigned_exe --target alpha --target signed --target torbrowser +torbrowser-compare-mar-signed-unsigned-release: submodule-update + $(rbm) build release --step compare_mar_signed_unsigned --target release --target signed --target torbrowser + +torbrowser-compare-mar-signed-unsigned-alpha: submodule-update + $(rbm) build release --step compare_mar_signed_unsigned --target alpha --target signed --target torbrowser + ######################## # Base Browser Targets # @@ -577,6 +583,12 @@ mullvadbrowser-compare-windows-signed-unsigned-release: submodule-update mullvadbrowser-compare-windows-signed-unsigned-alpha: submodule-update $(rbm) build release --step compare_windows_signed_unsigned_exe --target alpha --target signed --target mullvadbrowser +mullvadbrowser-compare-mar-signed-unsigned-release: submodule-update + $(rbm) build release --step compare_mar_signed_unsigned --target release --target signed --target mullvadbrowser + +mullvadbrowser-compare-mar-signed-unsigned-alpha: submodule-update + $(rbm) build release --step compare_mar_signed_unsigned --target alpha --target signed --target mullvadbrowser + ############################ # Toolchain Update Targets # ===================================== doc/MAKEFILE.txt ===================================== @@ -141,3 +141,8 @@ torbrowser-compare-windows-signed-unsigned-{release,alpha} Unsign exe files from directory torbrowser/{release,alpha}/signed/$version and compare them with the checksum from sha256sums-unsigned-build.txt. +torbrowser-compare-mar-signed-unsigned-{release,alpha} +---------------------------------------------------------- +Unsign mar files from directory torbrowser/{release,alpha}/signed/$version +and compare them with the checksum from sha256sums-unsigned-build.txt. + ===================================== projects/release/compare_mar_signed_unsigned ===================================== @@ -0,0 +1,44 @@ +#!/bin/bash +[% c("var/set_default_env") -%] +[% IF c("var/nightly") -%] + build_dir=[% shell_quote(path(dest_dir)) %]/[% c("version") %] +[% ELSE -%] + build_dir=[% shell_quote(path(dest_dir)) %]/[% c("var/signed_status") %]/[% c("version") %] +[% END -%] + +if ! test -d "$build_dir" +then + echo "Error: Directory $build_dir does not exist" 1>&2 + echo "You can download it with this command:" 1>&2 + echo " ./tools/download-[% c("var/projectname") %] [% c("var/torbrowser_version") %]" 1>&2 + exit 1 +fi + +sha256sums_files=sha256sums-unsigned-build.txt +cd "$build_dir" +test -f sha256sums-unsigned-build.incrementals.txt \ + && sha256sums_files="$sha256sums_files sha256sums-unsigned-build.incrementals.txt" +cp -a -- $(ls -1 *.mar | grep -v -- -macos-) $sha256sums_files "$rootdir/" +cd "$rootdir" + +unzip -q "$rootdir/[% c('input_files_by_name/mar-tools') %]" +export PATH="$rootdir/mar-tools:$PATH" +export LD_LIBRARY_PATH="$rootdir/mar-tools" + +for file in *.mar +do + signmar -r "$file" "unsigned-$file" + mv -f "unsigned-$file" "$file" + echo "Unsigned $file" +done + +grep -h -- '\.mar$' $sha256sums_files | grep -v -- -macos- | sha256sum -c + +cat << 'EOF' +macOS mar files have been skipped as we don't yet have a good solution +to remove code signing from those files. +See https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4… + +Windows and Linux unsigned mar files are matching with +sha256sums-unsigned-build.txt. +EOF ===================================== projects/release/config ===================================== @@ -271,3 +271,11 @@ steps: name: osslsigncode pkg_type: build compare_windows_signed_unsigned_exe: '[% INCLUDE compare_windows_signed_unsigned_exe %]' + compare_mar_signed_unsigned: + build_log: '-' + debug: 0 + input_files: + - project: mar-tools + name: mar-tools + pkg_type: fetch_martools + compare_mar_signed_unsigned: '[% INCLUDE compare_mar_signed_unsigned %]' View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/a… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/a… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41031: Add make targets to unsign and compare mar files
by richard (＠richard) 30 Nov '23

30 Nov '23

richard pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 226e45d9 by Nicolas Vigier at 2023-11-30T12:31:54+01:00 Bug 41031: Add make targets to unsign and compare mar files - - - - - 4 changed files: - Makefile - doc/MAKEFILE.txt - + projects/release/compare_mar_signed_unsigned - projects/release/config Changes: ===================================== Makefile ===================================== @@ -235,6 +235,12 @@ torbrowser-compare-windows-signed-unsigned-release: submodule-update torbrowser-compare-windows-signed-unsigned-alpha: submodule-update $(rbm) build release --step compare_windows_signed_unsigned_exe --target alpha --target signed --target torbrowser +torbrowser-compare-mar-signed-unsigned-release: submodule-update + $(rbm) build release --step compare_mar_signed_unsigned --target release --target signed --target torbrowser + +torbrowser-compare-mar-signed-unsigned-alpha: submodule-update + $(rbm) build release --step compare_mar_signed_unsigned --target alpha --target signed --target torbrowser + ######################## # Base Browser Targets # @@ -569,6 +575,12 @@ mullvadbrowser-compare-windows-signed-unsigned-release: submodule-update mullvadbrowser-compare-windows-signed-unsigned-alpha: submodule-update $(rbm) build release --step compare_windows_signed_unsigned_exe --target alpha --target signed --target mullvadbrowser +mullvadbrowser-compare-mar-signed-unsigned-release: submodule-update + $(rbm) build release --step compare_mar_signed_unsigned --target release --target signed --target mullvadbrowser + +mullvadbrowser-compare-mar-signed-unsigned-alpha: submodule-update + $(rbm) build release --step compare_mar_signed_unsigned --target alpha --target signed --target mullvadbrowser + ############################ # Toolchain Update Targets # ===================================== doc/MAKEFILE.txt ===================================== @@ -141,3 +141,8 @@ torbrowser-compare-windows-signed-unsigned-{release,alpha} Unsign exe files from directory torbrowser/{release,alpha}/signed/$version and compare them with the checksum from sha256sums-unsigned-build.txt. +torbrowser-compare-mar-signed-unsigned-{release,alpha} +---------------------------------------------------------- +Unsign mar files from directory torbrowser/{release,alpha}/signed/$version +and compare them with the checksum from sha256sums-unsigned-build.txt. + ===================================== projects/release/compare_mar_signed_unsigned ===================================== @@ -0,0 +1,44 @@ +#!/bin/bash +[% c("var/set_default_env") -%] +[% IF c("var/nightly") -%] + build_dir=[% shell_quote(path(dest_dir)) %]/[% c("version") %] +[% ELSE -%] + build_dir=[% shell_quote(path(dest_dir)) %]/[% c("var/signed_status") %]/[% c("version") %] +[% END -%] + +if ! test -d "$build_dir" +then + echo "Error: Directory $build_dir does not exist" 1>&2 + echo "You can download it with this command:" 1>&2 + echo " ./tools/download-[% c("var/projectname") %] [% c("var/torbrowser_version") %]" 1>&2 + exit 1 +fi + +sha256sums_files=sha256sums-unsigned-build.txt +cd "$build_dir" +test -f sha256sums-unsigned-build.incrementals.txt \ + && sha256sums_files="$sha256sums_files sha256sums-unsigned-build.incrementals.txt" +cp -a -- $(ls -1 *.mar | grep -v -- -macos-) $sha256sums_files "$rootdir/" +cd "$rootdir" + +unzip -q "$rootdir/[% c('input_files_by_name/mar-tools') %]" +export PATH="$rootdir/mar-tools:$PATH" +export LD_LIBRARY_PATH="$rootdir/mar-tools" + +for file in *.mar +do + signmar -r "$file" "unsigned-$file" + mv -f "unsigned-$file" "$file" + echo "Unsigned $file" +done + +grep -h -- '\.mar$' $sha256sums_files | grep -v -- -macos- | sha256sum -c + +cat << 'EOF' +macOS mar files have been skipped as we don't yet have a good solution +to remove code signing from those files. +See https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4… + +Windows and Linux unsigned mar files are matching with +sha256sums-unsigned-build.txt. +EOF ===================================== projects/release/config ===================================== @@ -271,3 +271,11 @@ steps: name: osslsigncode pkg_type: build compare_windows_signed_unsigned_exe: '[% INCLUDE compare_windows_signed_unsigned_exe %]' + compare_mar_signed_unsigned: + build_log: '-' + debug: 0 + input_files: + - project: mar-tools + name: mar-tools + pkg_type: fetch_martools + compare_mar_signed_unsigned: '[% INCLUDE compare_mar_signed_unsigned %]' View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/2… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/2… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][maint-13.0] 2 commits: Bug 41030: Add script to download a torbrowser/mullvadbrowser release
by richard (＠richard) 30 Nov '23

30 Nov '23

richard pushed to branch maint-13.0 at The Tor Project / Applications / tor-browser-build Commits: 0f610931 by Nicolas Vigier at 2023-11-30T12:47:22+00:00 Bug 41030: Add script to download a torbrowser/mullvadbrowser release - - - - - 4dc9c81f by Nicolas Vigier at 2023-11-30T12:48:19+00:00 Bug 41030: Add make targets to unsign and compare exe files - - - - - 6 changed files: - Makefile - doc/MAKEFILE.txt - + projects/release/compare_windows_signed_unsigned_exe - projects/release/config - + tools/download-mullvadbrowser - + tools/download-torbrowser Changes: ===================================== Makefile ===================================== @@ -233,6 +233,12 @@ torbrowser-dmg2mar-alpha: submodule-update $(rbm) build release --step link_old_mar_filenames --target alpha --target torbrowser CHECK_CODESIGNATURE_EXISTS=1 MAR_SKIP_EXISTING=1 tools/update-responses/gen_incrementals alpha +torbrowser-compare-windows-signed-unsigned-release: submodule-update + $(rbm) build release --step compare_windows_signed_unsigned_exe --target release --target signed --target torbrowser + +torbrowser-compare-windows-signed-unsigned-alpha: submodule-update + $(rbm) build release --step compare_windows_signed_unsigned_exe --target alpha --target signed --target torbrowser + ######################## # Base Browser Targets # @@ -565,6 +571,12 @@ mullvadbrowser-dmg2mar-alpha: submodule-update $(rbm) build release --step link_old_mar_filenames --target alpha --target mullvadbrowser CHECK_CODESIGNATURE_EXISTS=1 MAR_SKIP_EXISTING=1 tools/update-responses/gen_incrementals alpha +mullvadbrowser-compare-windows-signed-unsigned-release: submodule-update + $(rbm) build release --step compare_windows_signed_unsigned_exe --target release --target signed --target mullvadbrowser + +mullvadbrowser-compare-windows-signed-unsigned-alpha: submodule-update + $(rbm) build release --step compare_windows_signed_unsigned_exe --target alpha --target signed --target mullvadbrowser + ############################ # Toolchain Update Targets # ===================================== doc/MAKEFILE.txt ===================================== @@ -136,3 +136,8 @@ Create update responses xml files for a signed build in the release or alpha channel. The files can be found in a tar in the directory torbrowser/{release,alpha}/update-responses. +torbrowser-compare-windows-signed-unsigned-{release,alpha} +---------------------------------------------------------- +Unsign exe files from directory torbrowser/{release,alpha}/signed/$version +and compare them with the checksum from sha256sums-unsigned-build.txt. + ===================================== projects/release/compare_windows_signed_unsigned_exe ===================================== @@ -0,0 +1,30 @@ +#!/bin/bash +[% c("var/set_default_env") -%] +[% IF c("var/nightly") -%] + build_dir=[% shell_quote(path(dest_dir)) %]/[% c("version") %] +[% ELSE -%] + build_dir=[% shell_quote(path(dest_dir)) %]/[% c("var/signed_status") %]/[% c("version") %] +[% END -%] + +if ! test -d "$build_dir" +then + echo "Error: Directory $build_dir does not exist" 1>&2 + echo "You can download it with this command:" 1>&2 + echo " ./tools/download-[% c("var/projectname") %] [% c("var/torbrowser_version") %]" 1>&2 + exit 1 +fi + +cp -a "$build_dir"/*.exe "$build_dir"/sha256sums-unsigned-build.txt . + +tar -xf $rootdir/[% c('input_files_by_name/osslsigncode') %] + +for file in *.exe +do + ./osslsigncode/bin/osslsigncode remove-signature -in "$file" -out "unsigned-$file" > /dev/null + mv -f "unsigned-$file" "$file" + echo "Unsigned $file" +done + +grep '\.exe$' sha256sums-unsigned-build.txt | sha256sum -c + +echo "Unsigned exe files are matching with sha256sums-unsigned-build.txt" ===================================== projects/release/config ===================================== @@ -263,3 +263,11 @@ steps: debug: 0 input_files: [] dmg2mar: '[% INCLUDE dmg2mar %]' + compare_windows_signed_unsigned_exe: + build_log: '-' + debug: 0 + input_files: + - project: osslsigncode + name: osslsigncode + pkg_type: build + compare_windows_signed_unsigned_exe: '[% INCLUDE compare_windows_signed_unsigned_exe %]' ===================================== tools/download-mullvadbrowser ===================================== @@ -0,0 +1 @@ +download-torbrowser \ No newline at end of file ===================================== tools/download-torbrowser ===================================== @@ -0,0 +1,100 @@ +#!/usr/bin/perl -w + +# This script downloads a torbrowser or mullvadbrowser release, checking +# its signature + +use strict; +use English; +use LWP::Simple; +use IO::CaptureOutput qw(capture_exec); +use File::Temp; +use File::Basename qw(fileparse); +use FindBin; +use File::Path qw(make_path); +use File::Copy; +use Path::Tiny; +use Digest::SHA qw(sha256_hex); + + +sub exit_error { + print STDERR "Error: ", $_[0], "\n"; + chdir '/'; + exit (exists $_[1] ? $_[1] : 1); +} + +sub gpg_verify_file { + my ($file) = @_; + if (system('gpg', '--no-default-keyring', '--keyring', + "$FindBin::Bin/../keyring/torbrowser.gpg", '--verify', + "$file.asc", + $file)) { + exit_error "Error checking gpg signature for file $file"; + } +} + +my $progname = fileparse($PROGRAM_NAME); +my ($projectname) = $progname =~ m/^download-(.+)$/; +if (@ARGV != 1) { + print STDERR "usage: $progname <version>\n"; + exit 1; +} + +my $version = $ARGV[0]; +my $version_type = $version =~ m/a/ ? 'alpha' : 'release'; +my $destdir = "$FindBin::Bin/../$projectname/$version_type/signed/$version"; +my $urldir = "https://archive.torproject.org/tor-package-archive/$projectname/$version"; + +make_path($destdir); +my $tmpdir = File::Temp->newdir(DIR => "$FindBin::Bin/../tmp"); + +foreach my $file (qw(sha256sums-signed-build.txt sha256sums-signed-build.txt.asc + sha256sums-unsigned-build.txt sha256sums-unsigned-build.txt.asc)) { + if (getstore("$urldir/$file", "$tmpdir/$file") != 200) { + exit_error "Error downloading $urldir/$file"; + } +} +gpg_verify_file("$tmpdir/sha256sums-signed-build.txt"); +move "$tmpdir/sha256sums-signed-build.txt.asc", "$destdir/sha256sums-signed-build.txt.asc"; +move "$tmpdir/sha256sums-signed-build.txt", "$destdir/sha256sums-signed-build.txt"; +gpg_verify_file("$tmpdir/sha256sums-unsigned-build.txt"); +move "$tmpdir/sha256sums-unsigned-build.txt.asc", "$destdir/sha256sums-unsigned-build.txt.asc"; +move "$tmpdir/sha256sums-unsigned-build.txt", "$destdir/sha256sums-unsigned-build.txt"; + +foreach my $file (qw(sha256sums-signed-build.incrementals.txt + sha256sums-signed-build.incrementals.txt.asc + sha256sums-unsigned-build.incrementals.txt + sha256sums-unsigned-build.incrementals.txt.asc)) { + if (getstore("$urldir/$file", "$tmpdir/$file") != 200) { + last; + } +} +if (-f "$tmpdir/sha256sums-signed-build.incrementals.txt.asc") { + gpg_verify_file("$tmpdir/sha256sums-signed-build.incrementals.txt"); + move "$tmpdir/sha256sums-signed-build.incrementals.txt.asc", "$destdir/sha256sums-signed-build.incrementals.txt.asc"; + move "$tmpdir/sha256sums-signed-build.incrementals.txt", "$destdir/sha256sums-signed-build.incrementals.txt"; +} +if (-f "$tmpdir/sha256sums-unsigned-build.incrementals.txt.asc") { + gpg_verify_file("$tmpdir/sha256sums-unsigned-build.incrementals.txt"); + move "$tmpdir/sha256sums-unsigned-build.incrementals.txt.asc", "$destdir/sha256sums-unsigned-build.incrementals.txt.asc"; + move "$tmpdir/sha256sums-unsigned-build.incrementals.txt", "$destdir/sha256sums-unsigned-build.incrementals.txt"; +} + +my @sha256_lines = path("$destdir/sha256sums-signed-build.txt")->lines; +push @sha256_lines, path("$destdir/sha256sums-signed-build.incrementals.txt")->lines + if -f "$destdir/sha256sums-signed-build.incrementals.txt"; +my %sums = map { chomp; reverse split ' ', $_ } @sha256_lines; + +foreach my $file (sort keys %sums) { + if (-f "$destdir/$file") { + print "Not downloading $file (already there)\n"; + next; + } + print "Downloading $file\n"; + exit_error "Error downloading $urldir/$file\n" + unless getstore("$urldir/$file", "$tmpdir/$file") == 200; + exit_error "Wrong checksum for $file" + unless $sums{$file} eq sha256_hex(path("$tmpdir/$file")->slurp); + move "$tmpdir/$file", "$destdir/$file"; +} + +print "Finished downloading $projectname $version in $destdir\n"; View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/compare/… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/compare/… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] 2 commits: Bug 41030: Add script to download a torbrowser/mullvadbrowser release
by richard (＠richard) 30 Nov '23

30 Nov '23

richard pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 07898fd4 by Nicolas Vigier at 2023-11-30T11:59:45+01:00 Bug 41030: Add script to download a torbrowser/mullvadbrowser release - - - - - 93819f81 by Nicolas Vigier at 2023-11-30T11:59:49+01:00 Bug 41030: Add make targets to unsign and compare exe files - - - - - 6 changed files: - Makefile - doc/MAKEFILE.txt - + projects/release/compare_windows_signed_unsigned_exe - projects/release/config - + tools/download-mullvadbrowser - + tools/download-torbrowser Changes: ===================================== Makefile ===================================== @@ -229,6 +229,12 @@ torbrowser-dmg2mar-alpha: submodule-update tools/update-responses/download_missing_versions alpha CHECK_CODESIGNATURE_EXISTS=1 MAR_SKIP_EXISTING=1 tools/update-responses/gen_incrementals alpha +torbrowser-compare-windows-signed-unsigned-release: submodule-update + $(rbm) build release --step compare_windows_signed_unsigned_exe --target release --target signed --target torbrowser + +torbrowser-compare-windows-signed-unsigned-alpha: submodule-update + $(rbm) build release --step compare_windows_signed_unsigned_exe --target alpha --target signed --target torbrowser + ######################## # Base Browser Targets # @@ -557,6 +563,12 @@ mullvadbrowser-dmg2mar-alpha: submodule-update tools/update-responses/download_missing_versions alpha CHECK_CODESIGNATURE_EXISTS=1 MAR_SKIP_EXISTING=1 tools/update-responses/gen_incrementals alpha +mullvadbrowser-compare-windows-signed-unsigned-release: submodule-update + $(rbm) build release --step compare_windows_signed_unsigned_exe --target release --target signed --target mullvadbrowser + +mullvadbrowser-compare-windows-signed-unsigned-alpha: submodule-update + $(rbm) build release --step compare_windows_signed_unsigned_exe --target alpha --target signed --target mullvadbrowser + ############################ # Toolchain Update Targets # ===================================== doc/MAKEFILE.txt ===================================== @@ -136,3 +136,8 @@ Create update responses xml files for a signed build in the release or alpha channel. The files can be found in a tar in the directory torbrowser/{release,alpha}/update-responses. +torbrowser-compare-windows-signed-unsigned-{release,alpha} +---------------------------------------------------------- +Unsign exe files from directory torbrowser/{release,alpha}/signed/$version +and compare them with the checksum from sha256sums-unsigned-build.txt. + ===================================== projects/release/compare_windows_signed_unsigned_exe ===================================== @@ -0,0 +1,30 @@ +#!/bin/bash +[% c("var/set_default_env") -%] +[% IF c("var/nightly") -%] + build_dir=[% shell_quote(path(dest_dir)) %]/[% c("version") %] +[% ELSE -%] + build_dir=[% shell_quote(path(dest_dir)) %]/[% c("var/signed_status") %]/[% c("version") %] +[% END -%] + +if ! test -d "$build_dir" +then + echo "Error: Directory $build_dir does not exist" 1>&2 + echo "You can download it with this command:" 1>&2 + echo " ./tools/download-[% c("var/projectname") %] [% c("var/torbrowser_version") %]" 1>&2 + exit 1 +fi + +cp -a "$build_dir"/*.exe "$build_dir"/sha256sums-unsigned-build.txt . + +tar -xf $rootdir/[% c('input_files_by_name/osslsigncode') %] + +for file in *.exe +do + ./osslsigncode/bin/osslsigncode remove-signature -in "$file" -out "unsigned-$file" > /dev/null + mv -f "unsigned-$file" "$file" + echo "Unsigned $file" +done + +grep '\.exe$' sha256sums-unsigned-build.txt | sha256sum -c + +echo "Unsigned exe files are matching with sha256sums-unsigned-build.txt" ===================================== projects/release/config ===================================== @@ -263,3 +263,11 @@ steps: debug: 0 input_files: [] upload_sha256sums: '[% INCLUDE upload_sha256sums %]' + compare_windows_signed_unsigned_exe: + build_log: '-' + debug: 0 + input_files: + - project: osslsigncode + name: osslsigncode + pkg_type: build + compare_windows_signed_unsigned_exe: '[% INCLUDE compare_windows_signed_unsigned_exe %]' ===================================== tools/download-mullvadbrowser ===================================== @@ -0,0 +1 @@ +download-torbrowser \ No newline at end of file ===================================== tools/download-torbrowser ===================================== @@ -0,0 +1,100 @@ +#!/usr/bin/perl -w + +# This script downloads a torbrowser or mullvadbrowser release, checking +# its signature + +use strict; +use English; +use LWP::Simple; +use IO::CaptureOutput qw(capture_exec); +use File::Temp; +use File::Basename qw(fileparse); +use FindBin; +use File::Path qw(make_path); +use File::Copy; +use Path::Tiny; +use Digest::SHA qw(sha256_hex); + + +sub exit_error { + print STDERR "Error: ", $_[0], "\n"; + chdir '/'; + exit (exists $_[1] ? $_[1] : 1); +} + +sub gpg_verify_file { + my ($file) = @_; + if (system('gpg', '--no-default-keyring', '--keyring', + "$FindBin::Bin/../keyring/torbrowser.gpg", '--verify', + "$file.asc", + $file)) { + exit_error "Error checking gpg signature for file $file"; + } +} + +my $progname = fileparse($PROGRAM_NAME); +my ($projectname) = $progname =~ m/^download-(.+)$/; +if (@ARGV != 1) { + print STDERR "usage: $progname <version>\n"; + exit 1; +} + +my $version = $ARGV[0]; +my $version_type = $version =~ m/a/ ? 'alpha' : 'release'; +my $destdir = "$FindBin::Bin/../$projectname/$version_type/signed/$version"; +my $urldir = "https://archive.torproject.org/tor-package-archive/$projectname/$version"; + +make_path($destdir); +my $tmpdir = File::Temp->newdir(DIR => "$FindBin::Bin/../tmp"); + +foreach my $file (qw(sha256sums-signed-build.txt sha256sums-signed-build.txt.asc + sha256sums-unsigned-build.txt sha256sums-unsigned-build.txt.asc)) { + if (getstore("$urldir/$file", "$tmpdir/$file") != 200) { + exit_error "Error downloading $urldir/$file"; + } +} +gpg_verify_file("$tmpdir/sha256sums-signed-build.txt"); +move "$tmpdir/sha256sums-signed-build.txt.asc", "$destdir/sha256sums-signed-build.txt.asc"; +move "$tmpdir/sha256sums-signed-build.txt", "$destdir/sha256sums-signed-build.txt"; +gpg_verify_file("$tmpdir/sha256sums-unsigned-build.txt"); +move "$tmpdir/sha256sums-unsigned-build.txt.asc", "$destdir/sha256sums-unsigned-build.txt.asc"; +move "$tmpdir/sha256sums-unsigned-build.txt", "$destdir/sha256sums-unsigned-build.txt"; + +foreach my $file (qw(sha256sums-signed-build.incrementals.txt + sha256sums-signed-build.incrementals.txt.asc + sha256sums-unsigned-build.incrementals.txt + sha256sums-unsigned-build.incrementals.txt.asc)) { + if (getstore("$urldir/$file", "$tmpdir/$file") != 200) { + last; + } +} +if (-f "$tmpdir/sha256sums-signed-build.incrementals.txt.asc") { + gpg_verify_file("$tmpdir/sha256sums-signed-build.incrementals.txt"); + move "$tmpdir/sha256sums-signed-build.incrementals.txt.asc", "$destdir/sha256sums-signed-build.incrementals.txt.asc"; + move "$tmpdir/sha256sums-signed-build.incrementals.txt", "$destdir/sha256sums-signed-build.incrementals.txt"; +} +if (-f "$tmpdir/sha256sums-unsigned-build.incrementals.txt.asc") { + gpg_verify_file("$tmpdir/sha256sums-unsigned-build.incrementals.txt"); + move "$tmpdir/sha256sums-unsigned-build.incrementals.txt.asc", "$destdir/sha256sums-unsigned-build.incrementals.txt.asc"; + move "$tmpdir/sha256sums-unsigned-build.incrementals.txt", "$destdir/sha256sums-unsigned-build.incrementals.txt"; +} + +my @sha256_lines = path("$destdir/sha256sums-signed-build.txt")->lines; +push @sha256_lines, path("$destdir/sha256sums-signed-build.incrementals.txt")->lines + if -f "$destdir/sha256sums-signed-build.incrementals.txt"; +my %sums = map { chomp; reverse split ' ', $_ } @sha256_lines; + +foreach my $file (sort keys %sums) { + if (-f "$destdir/$file") { + print "Not downloading $file (already there)\n"; + next; + } + print "Downloading $file\n"; + exit_error "Error downloading $urldir/$file\n" + unless getstore("$urldir/$file", "$tmpdir/$file") == 200; + exit_error "Wrong checksum for $file" + unless $sums{$file} eq sha256_hex(path("$tmpdir/$file")->slurp); + move "$tmpdir/$file", "$destdir/$file"; +} + +print "Finished downloading $projectname $version in $destdir\n"; View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/compare/… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/compare/… You're receiving this email because of your account on gitlab.torproject.org.

1 0