morgan pushed to branch main at The Tor Project / Applications / tor-browser-build

Commits:

12 changed files:

Changes:

  • projects/rcodesign/build
    ... ... @@ -12,7 +12,7 @@ tar -C /var/tmp/build -xf [% project %]-[% c('version') %].tar.[% c('compress_ta
    12 12 
     tar -C $builddir -xf $rootdir/[% c('input_files_by_name/cargo_vendor') %]
    13 13
    14 14 
     cd $builddir
    15 
    -mkdir .cargo
    15 
    +mkdir -p .cargo
    16 16 
     cat >> .cargo/config << 'EOF'
    17 17
    18 18 
     [source.crates-io]

  • projects/rcodesign/config
    1 1 
     # vim: filetype=yaml sw=2
    2 
    -version: 0.22.0
    3 
    -git_hash: cb406b5feb1439131f36ec60375f607a7f82439d
    2 
    +version: 0.27.0
    3 
    +git_hash: 703362f818272d43b3844105863739bcb6f1a11a
    4 4 
     git_url: https://github.com/indygreg/apple-platform-rs.git
    5 5 
     container:
    6 6 
       use_container: 1
    ... ... @@ -16,4 +16,4 @@ steps:
    16 16 
             project: rcodesign
    17 17 
             pkg_type: cargo_vendor
    18 18 
             norec:
    19 
    -          sha256sum: 04c21203d2948ebfa59f1039d4481e419e656ec636293b4846fdb7868cfd98f0
    19 
    +          sha256sum: c778deb784f68b48a51c6c54095c6cd45e37847d65e9db36ce39b4326874ae9c

  • tools/signing/linux-signer-rcodesign-sign
    ... ... @@ -19,5 +19,5 @@ destdir=~/"$SIGNING_PROJECTNAME-$tbb_version-macos-signed"
    19 19 
     mkdir -p $destdir
    20 20 
     rm -f "$destdir/$output_file"
    21 21
    22 
    -sudo -u signing-macos -- /signing/tor-browser-build/tools/signing/wrappers/sign-rcodesign ~/"$SIGNING_PROJECTNAME-$tbb_version"/$(project-name)-macos-${tbb_version}.dmg "$display_name"
    22 
    +sudo -u signing-macos -- /signing/tor-browser-build/tools/signing/wrappers/sign-rcodesign-128 ~/"$SIGNING_PROJECTNAME-$tbb_version"/$(project-name)-macos-${tbb_version}.dmg "$display_name"
    23 23 
     cp "/home/signing-macos/last-signed-$display_name.tar.zst" "$destdir/$output_file"

  • tools/signing/machines-setup/setup-signing-machine
    ... ... @@ -91,6 +91,7 @@ sudoers_file sign-mar
    91 91 
     sudoers_file sign-exe
    92 92 
     sudoers_file sign-apk
    93 93 
     sudoers_file sign-rcodesign
    94 
    +sudoers_file sign-rcodesign-128
    94 95 
     sudoers_file set-date
    95 96
    96 97 
     authorized_keys boklm boklm-tb-release.pub boklm-yk1.pub

  • tools/signing/machines-setup/sudoers.d/sign-rcodesign-128
    1 
    +Defaults>signing-macos env_keep += "SIGNING_PROJECTNAME tbb_version_type RCODESIGN_PW"
    2 
    +%signing ALL = (signing-macos) NOPASSWD: /signing/tor-browser-build/tools/signing/wrappers/sign-rcodesign-128

  • tools/signing/macos-entitlements/firefox.browser.xml
    1 
    +<?xml version="1.0" encoding="UTF-8"?>
    2 
    +<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    3 
    +<!--
    4 
    +     Entitlements to apply to the main browser process executable during
    5 
    +     codesigning of production channel builds.
    6 
    +-->
    7 
    +<plist version="1.0">
    8 
    +  <dict>
    9 
    +    <!-- Allow loading third party libraries to support pkcs11 modules -->
    10 
    +    <key>com.apple.security.cs.disable-library-validation</key><true/>
    11 
    +
    12 
    +    <!-- Firefox needs to create executable pages with MAP_JIT on aarch64 -->
    13 
    +    <key>com.apple.security.cs.allow-jit</key><true/>
    14 
    +
    15 
    +    <!-- Firefox needs to access the microphone on sites the user allows -->
    16 
    +    <key>com.apple.security.device.audio-input</key><true/>
    17 
    +
    18 
    +    <!-- Firefox needs to access the camera on sites the user allows -->
    19 
    +    <key>com.apple.security.device.camera</key><true/>
    20 
    +
    21 
    +    <!-- Firefox needs to access the location on sites the user allows -->
    22 
    +    <key>com.apple.security.personal-information.location</key><true/>
    23 
    +
    24 
    +    <!-- For SmartCardServices(7) -->
    25 
    +    <key>com.apple.security.smartcard</key><true/>
    26 
    +
    27 
    +    <!-- Required for com.apple.developer.web-browser.public-key-credential -->
    28 
    +    <key>com.apple.application-identifier</key>
    29 
    +    <string>43AQ936H96.org.mozilla.firefox</string>
    30 
    +
    31 
    +    <!-- For platform passkey (webauthn) support -->
    32 
    +    <key>com.apple.developer.web-browser.public-key-credential</key><true/>
    33 
    +  </dict>
    34 
    +</plist>

  • tools/signing/macos-entitlements/media-plugin-helper.xml
    1 
    +<?xml version="1.0" encoding="UTF-8"?>
    2 
    +<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    3 
    +<!--
    4 
    +     Entitlements to apply to the media-plugin-helper.app bundle during
    5 
    +     codesigning of production channel builds.
    6 
    +-->
    7 
    +<plist version="1.0">
    8 
    +  <dict>
    9 
    +    <!-- Allow loading third party CDM libraries -->
    10 
    +    <key>com.apple.security.cs.disable-library-validation</key><true/>
    11 
    +  </dict>
    12 
    +</plist>

  • tools/signing/macos-entitlements/plugin-container.xml
    1 
    +<?xml version="1.0" encoding="UTF-8"?>
    2 
    +<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    3 
    +<!--
    4 
    +     Entitlements to apply to the plugin-container.app bundle during
    5 
    +     codesigning of production channel builds.
    6 
    +-->
    7 
    +<plist version="1.0">
    8 
    +  <dict>
    9 
    +    <!-- Firefox needs to create executable pages with MAP_JIT -->
    10 
    +    <key>com.apple.security.cs.allow-jit</key><true/>
    11 
    +  </dict>
    12 
    +</plist>

  • tools/signing/rcodesign-notary-submit
    ... ... @@ -21,7 +21,7 @@ display_name=$(display_name)
    21 21
    22 22 
     tar -C "$tmpdir" -xf "$macos_rcodesign_signed_tar_dir/$(project-name)-macos-${tbb_version}-rcodesign-signed.tar.zst"
    23 23
    24 
    -"$script_dir/../local/rcodesign/rcodesign" notary-submit --api-key-path "$appstoreconnect_api_key_path" --staple "$tmpdir/$display_name.app"
    24 
    +"$script_dir/../local/rcodesign-128/rcodesign" notary-submit --api-key-path "$appstoreconnect_api_key_path" --staple "$tmpdir/$display_name.app"
    25 25
    26 26 
     output_file="$(project-name)-${tbb_version}-notarized+stapled.tar.zst"
    27 27 
     tar -C "$tmpdir" -caf "$tmpdir/$output_file" "$display_name.app"

  • tools/signing/set-config.rcodesign
    1 
    -rcodesign_version=0.22.0-bc8cc7
    1 
    +rcodesign_version=0.27.0-e252fa
    2 2 
     rcodesign_filename=rcodesign-${rcodesign_version}.tar.gz
    3 
    -rcodesign_sha256sum=2a9eda016fff116c59f52b358e7a740f6fb5c039974f0acc8266c3605d24092a
    3 
    +rcodesign_sha256sum=c228c5fb06a088bc6c50a212d8d5a15425c2bcdf448bfa7f94ea5cc41321c533
    4 4 
     rcodesign_url="https://build-sources.tbb.torproject.org/${rcodesign_filename}"

  • tools/signing/setup-rcodesign
    ... ... @@ -35,8 +35,8 @@ function setup_rcodesign {
    35 35 
       tar -C "$tmpdir" -xf "$rcodesign_path"
    36 36 
       mv "$tmpdir/rcodesign" "$rcodesign_dir"
    37 37 
       chmod -R go+rX "$rcodesign_dir"
    38 
    -  rm -f "$localdir/rcodesign"
    39 
    -  ln -s "rcodesign-$rcodesign_version" "$localdir/rcodesign"
    38 
    +  rm -f "$localdir/rcodesign-128"
    39 
    +  ln -s "rcodesign-$rcodesign_version" "$localdir/rcodesign-128"
    40 40 
     }
    41 41
    42 42 
     download_rcodesign

  • tools/signing/wrappers/sign-rcodesign-128
    1 
    +#!/bin/bash
    2 
    +set -e
    3 
    +
    4 
    +function exit_error {
    5 
    +  for msg in "$@"
    6 
    +  do
    7 
    +    echo "$msg" >&2
    8 
    +  done
    9 
    +  exit 1
    10 
    +}
    11 
    +
    12 
    +test $# -eq 2 || exit_error "Wrong number of arguments"
    13 
    +dmg_file="$1"
    14 
    +display_name="$2"
    15 
    +
    16 
    +output_file="/home/signing-macos/last-signed-$display_name.tar.zst"
    17 
    +rm -f "$output_file"
    18 
    +
    19 
    +rcodesign=/signing/rcodesign-128/rcodesign
    20 
    +rcodesign_signing_p12_file=/home/signing-macos/keys/key-1.p12
    21 
    +test -f "$rcodesign_signing_p12_file" || exit_error "$rcodesign_signing_p12_file is missing"
    22 
    +
    23 
    +tmpdir=$(mktemp -d)
    24 
    +trap "rm -Rf $tmpdir" EXIT
    25 
    +cd "$tmpdir"
    26 
    +7z x "$dmg_file"
    27 
    +
    28 
    +# Fix permission on files:
    29 
    +# https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/29815#note_2957050
    30 
    +# FIXME: Maybe we should extract the .mar file instead of the .dmg to
    31 
    +# preserve permissions
    32 
    +chmod ugo+x "$display_name/$display_name.app/Contents/MacOS"/* \
    33 
    +            "$display_name/$display_name.app/Contents/MacOS/updater.app/Contents/MacOS"/* \
    34 
    +            "$display_name/$display_name.app/Contents/MacOS/plugin-container.app/Contents/MacOS"/* \
    35 
    +            "$display_name/$display_name.app/Contents/MacOS/media-plugin-helper.app/Contents/MacOS"/* \
    36 
    +            "$display_name/$display_name.app/Contents/Frameworks/ChannelPrefs.framework/ChannelPrefs" \
    37 
    +            "$display_name/$display_name.app/Contents/MacOS/updater.app/Contents/Frameworks/UpdateSettings.framework/UpdateSettings"
    38 
    +test -d "$display_name/$display_name.app/Contents/MacOS/Tor" && \
    39 
    +  chmod -R ugo+x "$display_name/$display_name.app/Contents/MacOS/Tor"
    40 
    +
    41 
    +pwdir=/run/lock/rcodesign-pw
    42 
    +trap "rm -Rf $pwdir" EXIT
    43 
    +rm -Rf "$pwdir"
    44 
    +mkdir "$pwdir"
    45 
    +chmod 700 "$pwdir"
    46 
    +cat > "$pwdir/rcodesign-pw-2" << EOF
    47 
    +$RCODESIGN_PW
    48 
    +EOF
    49 
    +tr -d '\n' < "$pwdir/rcodesign-pw-2" > "$pwdir/rcodesign-pw"
    50 
    +rm "$pwdir/rcodesign-pw-2"
    51 
    +
    52 
    +# unset RCODESIGN_PW since it conflicts with rcodesign config
    53 
    +unset RCODESIGN_PW
    54 
    +rcodesign_opts="
    55 
    +  --code-signature-flags runtime
    56 
    +  --timestamp-url http://timestamp.apple.com:8080/ts01
    57 
    +  --p12-file $rcodesign_signing_p12_file
    58 
    +  --p12-password-file $pwdir/rcodesign-pw
    59 
    +  "
    60 
    +
    61 
    +flags=()
    62 
    +for dir in Contents/MacOS Contents/MacOS/Tor Contents/MacOS/Tor/PluggableTransports
    63 
    +do
    64 
    +  d="$display_name/$display_name.app/$dir"
    65 
    +  test -d "$d" || continue
    66 
    +  pushd "$d"
    67 
    +  for file in *
    68 
    +  do
    69 
    +    test -f "$file" || continue
    70 
    +    flags+=('--code-signature-flags' "$dir/$file:runtime")
    71 
    +  done
    72 
    +  popd
    73 
    +done
    74 
    +echo "code-signature-flags: ${flags[@]}"
    75 
    +
    76 
    +echo "**** Signing main bundle ($display_name.app) ****"
    77 
    +$rcodesign sign \
    78 
    +  $rcodesign_opts \
    79 
    +  "${flags[@]}" \
    80 
    +  --code-signature-flags Contents/MacOS/updater.app/Contents/Frameworks/UpdateSettings.framework:runtime \
    81 
    +  --code-signature-flags Contents/MacOS/updater.app:runtime \
    82 
    +  --code-signature-flags Contents/Frameworks/ChannelPrefs.framework:runtime \
    83 
    +  --code-signature-flags Contents/MacOS/plugin-container.app:runtime \
    84 
    +  --code-signature-flags Contents/MacOS/media-plugin-helper.app:runtime \
    85 
    +  --entitlements-xml-path Contents/MacOS/plugin-container.app:/signing/tor-browser-build/tools/signing/macos-entitlements/plugin-container.xml \
    86 
    +  --entitlements-xml-path Contents/MacOS/media-plugin-helper.app:/signing/tor-browser-build/tools/signing/macos-entitlements/media-plugin-helper.xml \
    87 
    +  --entitlements-xml-path /signing/tor-browser-build/tools/signing/macos-entitlements/firefox.browser.xml \
    88 
    +  -- \
    89 
    +  "$display_name/$display_name.app"
    90 
    +
    91 
    +rm -f "$pwdir/rcodesign-pw"
    92 
    +rmdir "$pwdir"
    93 
    +tar -C "$display_name" -caf "$output_file" "$display_name.app"
    94 
    +cd -
    95 
    +rm -Rf "$tmpdir"

    • —
    View it on GitLab.
    You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications · Help