ma1 pushed to branch main at The Tor Project / Applications / tor-browser-build

Commits:

4 changed files:

Changes:

  • tools/signing/linux-signer-rcodesign-sign
    ... ... @@ -21,6 +21,6 @@ rm -f "$destdir/$output_file"
    21 21
     
    
    22 22
     volume=~/"$SIGNING_PROJECTNAME-$tbb_version"/"$(project-name)-macos-${tbb_version}.hfs"
    
    23 23
     echo "Using $volume"
    
    24
    -sudo -u signing-macos -- /signing/tor-browser-build/tools/signing/wrappers/sign-rcodesign-128 "$volume" "$display_name"
    
    24
    +sudo -u signing-macos -- /signing/tor-browser-build/tools/signing/wrappers/sign-rcodesign-146 "$volume" "$display_name"
    
    25 25
     cp "/home/signing-macos/last-signed-$display_name.tar.zst" "$destdir/$output_file"
    
    26 26
     rm -f "$volume"

  • tools/signing/machines-setup/setup-signing-machine
    ... ... @@ -93,6 +93,7 @@ sudoers_file sign-apk
    93 93
     sudoers_file sign-aab
    
    94 94
     sudoers_file sign-rcodesign
    
    95 95
     sudoers_file sign-rcodesign-128
    
    96
    +sudoers_file sign-rcodesign-146
    
    96 97
     sudoers_file set-date
    
    97 98
     
    
    98 99
     authorized_keys boklm boklm-tb-release.pub boklm-yk1.pub
    

  • tools/signing/machines-setup/sudoers.d/sign-rcodesign-146
    1
    +Defaults>signing-macos env_keep += "SIGNING_PROJECTNAME tbb_version_type RCODESIGN_PW"
    
    2
    +%signing ALL = (signing-macos) NOPASSWD: /signing/tor-browser-build/tools/signing/wrappers/sign-rcodesign-146

  • tools/signing/wrappers/sign-rcodesign-146
    1
    +#!/bin/bash
    
    2
    +set -e
    
    3
    +
    
    4
    +function exit_error {
    
    5
    +  for msg in "$@"
    
    6
    +  do
    
    7
    +    echo "$msg" >&2
    
    8
    +  done
    
    9
    +  exit 1
    
    10
    +}
    
    11
    +
    
    12
    +test $# -eq 2 || exit_error "Wrong number of arguments"
    
    13
    +dmg_file="$1"
    
    14
    +display_name="$2"
    
    15
    +
    
    16
    +output_file="/home/signing-macos/last-signed-$display_name.tar.zst"
    
    17
    +rm -f "$output_file"
    
    18
    +
    
    19
    +rcodesign=/signing/rcodesign-128/rcodesign
    
    20
    +rcodesign_signing_p12_file=/home/signing-macos/keys/key-1.p12
    
    21
    +test -f "$rcodesign_signing_p12_file" || exit_error "$rcodesign_signing_p12_file is missing"
    
    22
    +
    
    23
    +tmpdir=$(mktemp -d)
    
    24
    +trap "rm -Rf $tmpdir" EXIT
    
    25
    +cd "$tmpdir"
    
    26
    +7z x "$dmg_file"
    
    27
    +
    
    28
    +# Fix permission on files:
    
    29
    +# https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/29815#note_2957050
    
    30
    +# FIXME: Maybe we should extract the .mar file instead of the .dmg to
    
    31
    +# preserve permissions
    
    32
    +chmod ugo+x "$display_name/$display_name.app/Contents/MacOS"/* \
    
    33
    +            "$display_name/$display_name.app/Contents/MacOS/updater.app/Contents/MacOS"/* \
    
    34
    +            "$display_name/$display_name.app/Contents/MacOS/plugin-container.app/Contents/MacOS"/* \
    
    35
    +            "$display_name/$display_name.app/Contents/MacOS/media-plugin-helper.app/Contents/MacOS"/* \
    
    36
    +            "$display_name/$display_name.app/Contents/MacOS/gpu-helper.app/Contents/MacOS"/* \
    
    37
    +            "$display_name/$display_name.app/Contents/Frameworks/ChannelPrefs.framework/ChannelPrefs" \
    
    38
    +            "$display_name/$display_name.app/Contents/MacOS/updater.app/Contents/Frameworks/UpdateSettings.framework/UpdateSettings"
    
    39
    +test -d "$display_name/$display_name.app/Contents/MacOS/Tor" && \
    
    40
    +  chmod -R ugo+x "$display_name/$display_name.app/Contents/MacOS/Tor"
    
    41
    +
    
    42
    +pwdir=/run/lock/rcodesign-pw
    
    43
    +trap "rm -Rf $pwdir" EXIT
    
    44
    +rm -Rf "$pwdir"
    
    45
    +mkdir "$pwdir"
    
    46
    +chmod 700 "$pwdir"
    
    47
    +cat > "$pwdir/rcodesign-pw-2" << EOF
    
    48
    +$RCODESIGN_PW
    
    49
    +EOF
    
    50
    +tr -d '\n' < "$pwdir/rcodesign-pw-2" > "$pwdir/rcodesign-pw"
    
    51
    +rm "$pwdir/rcodesign-pw-2"
    
    52
    +
    
    53
    +# unset RCODESIGN_PW since it conflicts with rcodesign config
    
    54
    +unset RCODESIGN_PW
    
    55
    +rcodesign_opts="
    
    56
    +  --code-signature-flags runtime
    
    57
    +  --timestamp-url http://timestamp.apple.com:8080/ts01
    
    58
    +  --p12-file $rcodesign_signing_p12_file
    
    59
    +  --p12-password-file $pwdir/rcodesign-pw
    
    60
    +  "
    
    61
    +
    
    62
    +flags=()
    
    63
    +for dir in Contents/MacOS Contents/MacOS/Tor Contents/MacOS/Tor/PluggableTransports
    
    64
    +do
    
    65
    +  d="$display_name/$display_name.app/$dir"
    
    66
    +  test -d "$d" || continue
    
    67
    +  pushd "$d"
    
    68
    +  for file in *
    
    69
    +  do
    
    70
    +    test -f "$file" || continue
    
    71
    +    flags+=('--code-signature-flags' "$dir/$file:runtime")
    
    72
    +  done
    
    73
    +  popd
    
    74
    +done
    
    75
    +echo "code-signature-flags: ${flags[@]}"
    
    76
    +
    
    77
    +echo "**** Signing main bundle ($display_name.app) ****"
    
    78
    +$rcodesign sign \
    
    79
    +  $rcodesign_opts \
    
    80
    +  "${flags[@]}" \
    
    81
    +  --code-signature-flags Contents/MacOS/updater.app/Contents/Frameworks/UpdateSettings.framework:runtime \
    
    82
    +  --code-signature-flags Contents/MacOS/updater.app:runtime \
    
    83
    +  --code-signature-flags Contents/Frameworks/ChannelPrefs.framework:runtime \
    
    84
    +  --code-signature-flags Contents/MacOS/plugin-container.app:runtime \
    
    85
    +  --code-signature-flags Contents/MacOS/media-plugin-helper.app:runtime \
    
    86
    +  --code-signature-flags Contents/MacOS/gpu-helper.app:runtime \
    
    87
    +  --entitlements-xml-path Contents/MacOS/Tor/tor:/signing/tor-browser-build/tools/signing/macos-entitlements/tor.xml \
    
    88
    +  --entitlements-xml-path Contents/MacOS/plugin-container.app:/signing/tor-browser-build/tools/signing/macos-entitlements/plugin-container.xml \
    
    89
    +  --entitlements-xml-path Contents/MacOS/media-plugin-helper.app:/signing/tor-browser-build/tools/signing/macos-entitlements/media-plugin-helper.xml \
    
    90
    +  --entitlements-xml-path /signing/tor-browser-build/tools/signing/macos-entitlements/firefox.browser.xml \
    
    91
    +  -- \
    
    92
    +  "$display_name/$display_name.app"
    
    93
    +
    
    94
    +rm -f "$pwdir/rcodesign-pw"
    
    95
    +rmdir "$pwdir"
    
    96
    +tar -C "$display_name" -caf "$output_file" "$display_name.app"
    
    97
    +cd -
    
    98
    +rm -Rf "$tmpdir"