boklm pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 821c192e by Nicolas Vigier at 2025-08-29T12:16:22+02:00 Bug 41522: Adapt signing scripts for tor-vpn - - - - - 30 changed files: - rbm.conf - tools/signing/do-all-signing - + tools/signing/do-all-signing.torvpn - tools/signing/functions - + tools/signing/linux-signer-gpg-sign.torvpn - + tools/signing/linux-signer-sign-android-aab - + tools/signing/linux-signer-sign-android-aab.torvpn - tools/signing/linux-signer-sign-android-apks - + tools/signing/linux-signer-sign-android-apks.torvpn - tools/signing/machines-setup/setup-signing-machine - + tools/signing/machines-setup/sudoers.d/sign-aab - tools/signing/machines-setup/sudoers.d/sign-apk - tools/signing/set-config - + tools/signing/staticiforme-prepare-cdn-dist-upload.torvpn - + tools/signing/sync-builder-to-local.torvpn - + tools/signing/sync-builder-to-local.torvpn.dry-run - + tools/signing/sync-builder-unsigned-to-local-signed.torvpn - + tools/signing/sync-builder-unsigned-to-local-signed.torvpn.dry-run - + tools/signing/sync-linux-signer-to-local.torvpn - + tools/signing/sync-linux-signer-to-local.torvpn.dry-run - + tools/signing/sync-local-to-builder.torvpn - + tools/signing/sync-local-to-builder.torvpn.dry-run - + tools/signing/sync-local-to-linux-signer.torvpn - + tools/signing/sync-local-to-linux-signer.torvpn.dry-run - + tools/signing/sync-local-to-staticiforme.torvpn - + tools/signing/sync-local-to-staticiforme.torvpn.dry-run - + tools/signing/sync-scripts-to-linux-signer.torvpn - + tools/signing/sync-scripts-to-linux-signer.torvpn.dry-run - + tools/signing/wrappers/sign-aab - tools/signing/wrappers/sign-apk Changes: ===================================== rbm.conf ===================================== @@ -97,8 +97,8 @@ var: # enable/disable all android or desktop platforms. If you want to # check whether a release includes some android or desktop platforms # see signing_android and signing_desktop below. - is_android_release: '[% c("var/tor-browser") %]' - is_desktop_release: '1' + is_android_release: '[% c("var/tor-browser") || c("var/tor-vpn") %]' + is_desktop_release: '[% ! c("var/tor-vpn") %]' # signing_android is used in signing scripts to check if at least # one android platform is being signed/published @@ -328,6 +328,18 @@ targets: max_torbrowser_incremental_from: 2 build_infos_json: 1 + torvpn: + var: + tor-vpn: 1 + torbrowser_version: '1.0.0Beta' + torbrowser_build: 'build1' + browser_release_date: '2025/08/28 15:33:44' + project-name: tor-vpn + projectname: torvpn + Project_Name: 'Tor VPN' + ProjectName: TorVPN + project_initials: tv + torbrowser: var: tor-browser: 1 ===================================== tools/signing/do-all-signing ===================================== @@ -67,7 +67,7 @@ echo echo [ -z "$platform_android" ] || \ - [ -f "$steps_dir/linux-signer-sign-android-apks.done" ] || \ + [ -f "$steps_dir/sync-after-sign-android-apks.done" ] || \ [ -n "$KSPASS" ] || \ read -sp "Enter android apk signing password ($tbb_version_type): " KSPASS echo @@ -155,6 +155,14 @@ EOF unset KSPASS } +function linux-signer-sign-android-aab { + ssh "$ssh_host_linux_signer" 'bash -s' << EOF + export KSPASS=$KSPASS + ~/signing-$SIGNING_PROJECTNAME-$tbb_version_type/linux-signer-sign-android-aab.$SIGNING_PROJECTNAME +EOF + unset KSPASS +} + function sync-after-sign-android-apks { "$script_dir/sync-linux-signer-to-local" } @@ -257,6 +265,8 @@ do_step sync-before-linux-signer-signmars do_step sync-after-signmars [ -n "$platform_android" ] && \ do_step linux-signer-sign-android-apks +[ "$SIGNING_PROJECTNAME" = 'torvpn' ] && [ -n "$platform_android" ] && \ + do_step linux-signer-sign-android-aab [ -n "$platform_android" ] && \ do_step sync-after-sign-android-apks [ -n "$platform_windows" ] && \ @@ -275,6 +285,6 @@ do_step download-unsigned-sha256sums-gpg-signatures-from-people-tpo do_step sync-local-to-staticiforme do_step sync-scripts-to-staticiforme do_step staticiforme-prepare-cdn-dist-upload -! is_legacy && \ +[ "$SIGNING_PROJECTNAME" != 'torvpn' ] && ! is_legacy \ do_step upload-update_responses-to-staticiforme do_step finished-signing-clean-linux-signer ===================================== tools/signing/do-all-signing.torvpn ===================================== @@ -0,0 +1 @@ +do-all-signing \ No newline at end of file ===================================== tools/signing/functions ===================================== @@ -14,6 +14,7 @@ function var_is_defined { } function check_update_responses_repository_dir { + test "$SIGNING_PROJECTNAME" = 'torvpn' && return 0 if test -z "$update_responses_repository_dir" || ! test -d "$update_responses_repository_dir" then cat << 'EOF' > /dev/stderr ===================================== tools/signing/linux-signer-gpg-sign.torvpn ===================================== @@ -0,0 +1 @@ +linux-signer-gpg-sign \ No newline at end of file ===================================== tools/signing/linux-signer-sign-android-aab ===================================== @@ -0,0 +1,46 @@ +#!/bin/bash + +set -e +no_generate_config=1 +script_dir=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) +source "$script_dir/functions" + +topdir="$script_dir/../.." +test "$SIGNING_PROJECTNAME" = 'torvpn' +projname=$(project-name) +# tbb_version_type, tbb_version and SIGNING_PROJECTNAME are used in +# wrappers/sign-apk, so we export them +export tbb_version tbb_version_type SIGNING_PROJECTNAME +# (note: we should also export SIGNING_PROJECTNAME and tbb_version in +# the maint-14.5 branch) + +check_installed_packages() { + local packages='unzip openjdk-11-jdk-headless openjdk-11-jre-headless' + for package in $packages + do + dpkg -s "$package" | grep -q '^Status: install ok installed$' || \ + exit_error "package $package is missing" + done +} + +sign_aab() { + sudo -u signing-apk -- /signing/tor-browser-build/tools/signing/wrappers/sign-aab +} + +check_installed_packages + +if [ -z "$KSPASS" ]; then + echo "Enter keystore passphrase" + stty -echo; read KSPASS; stty echo + export KSPASS +fi + +cp -af ~/"$SIGNING_PROJECTNAME-$tbb_version"/$projname-$tbb_version.aab \ + /home/signing-apk/unsigned-files/"$SIGNING_PROJECTNAME-$tbb_version_type.aab" + +sign_aab + +cp /home/signing-apk/signed-files/"$SIGNING_PROJECTNAME-$tbb_version_type.aab" \ + ~/"$SIGNING_PROJECTNAME-$tbb_version"/$projname-$tbb_version.aab +rm /home/signing-apk/signed-files/"$SIGNING_PROJECTNAME-$tbb_version_type.aab" +rm /home/signing-apk/unsigned-files/"$SIGNING_PROJECTNAME-$tbb_version_type.aab" ===================================== tools/signing/linux-signer-sign-android-aab.torvpn ===================================== @@ -0,0 +1 @@ +linux-signer-sign-android-aab \ No newline at end of file ===================================== tools/signing/linux-signer-sign-android-apks ===================================== @@ -7,9 +7,11 @@ source "$script_dir/functions" topdir="$script_dir/../.." ARCHS="armv7 aarch64 x86 x86_64" +test "$SIGNING_PROJECTNAME" = 'torvpn' && ARCHS='multiarch' projname=$(project-name) -# tbb_version_type is used in wrappers/sign-apk, so we export it -export tbb_version_type +# tbb_version_type, tbb_version and SIGNING_PROJECTNAME are used in +# wrappers/sign-apk, so we export them +export tbb_version tbb_version_type SIGNING_PROJECTNAME check_installed_packages() { local packages='unzip openjdk-11-jdk-headless openjdk-11-jre-headless' @@ -21,10 +23,11 @@ check_installed_packages() { } setup_build_tools() { + abt_version=16 build_tools_dir=/signing/android-build-tools - test -f "$build_tools_dir"/android-12/apksigner || \ - exit_error "$build_tools_dir/android-12/apksigner is missing" - export PATH="$build_tools_dir/android-12:${PATH}" + test -f "$build_tools_dir"/android-$abt_version/apksigner || \ + exit_error "$build_tools_dir/android-$abt_version/apksigner is missing" + export PATH="$build_tools_dir/android-$abt_version:${PATH}" } sign_apk() { @@ -36,7 +39,6 @@ verify_apk() { scheme_v1="Verified using v1 scheme (JAR signing): true" scheme_v2="Verified using v2 scheme (APK Signature Scheme v2): true" - # Verify the expected signing key was used, Alpha verses Release based on the filename. if test "$tbb_version_type" = "alpha"; then cert_digest="Signer #1 certificate SHA-256 digest: 15f760b41acbe4783e667102c9f67119be2af62fab07763f9d57f01e5e1074e1" pubkey_digest="Signer #1 public key SHA-256 digest: 4e617e6516f81123ca58e718d617a704ac8365c575bd9e7a731ba5dd0476869d" @@ -44,7 +46,14 @@ verify_apk() { cert_digest="Signer #1 certificate SHA-256 digest: 20061f045e737c67375c17794cfedb436a03cec6bacb7cb9f96642205ca2cec8" pubkey_digest="Signer #1 public key SHA-256 digest: 343ca8a2e5452670bdc335a181a4baed909f868937d68c4653e44ef84de8dfc6" fi + if test "$SIGNING_PROJECTNAME" = "torvpn"; then + # No v1 scheme signature on torvpn apk + scheme_v1='' + cert_digest="Signer #1 certificate SHA-256 digest: c2f6ffa30e56a7c53a226248ef908612ee539df2f52bede5a55037425b83331d" + pubkey_digest="Signer #1 public key SHA-256 digest: fddc5f93ae0bc971e951481b0b5e6b62e47040fe979ff535cf75daade2f13f3d" + fi for digest in "${scheme_v1}" "${scheme_v2}" "${cert_digest}" "${pubkey_digest}"; do + test -z "$digest" && continue if ! echo "${verified}" | grep -q "${digest}"; then echo "Expected digest not found:" echo ${digest} @@ -69,8 +78,10 @@ mkdir -p ~/"$SIGNING_PROJECTNAME-$tbb_version-apks" chgrp signing ~/"$SIGNING_PROJECTNAME-$tbb_version-apks" chmod g+w ~/"$SIGNING_PROJECTNAME-$tbb_version-apks" cp -af ~/"$SIGNING_PROJECTNAME-$tbb_version"/*.apk \ - ~/"$SIGNING_PROJECTNAME-$tbb_version"/*.bspatch \ ~/"$SIGNING_PROJECTNAME-$tbb_version-apks" +test "$SIGNING_PROJECTNAME" != 'torvpn' && \ + cp -af ~/"$SIGNING_PROJECTNAME-$tbb_version"/*.bspatch \ + ~/"$SIGNING_PROJECTNAME-$tbb_version-apks" cd ~/"$SIGNING_PROJECTNAME-$tbb_version-apks" # Sign all packages @@ -79,7 +90,8 @@ for arch in ${ARCHS}; do unsigned_apk=${projname}-qa-unsigned-android-${arch}-${tbb_version}.apk unsigned_apk_bspatch=${projname}-qa-unsign-android-${arch}-${tbb_version}.bspatch signed_apk=${projname}-android-${arch}-${tbb_version}.apk - bspatch "$qa_apk" "$unsigned_apk" "$unsigned_apk_bspatch" + test -f "$unsigned_apk" || \ + bspatch "$qa_apk" "$unsigned_apk" "$unsigned_apk_bspatch" sign_apk "$unsigned_apk" "$signed_apk" verify_apk "$signed_apk" cp -f "$signed_apk" ~/"$SIGNING_PROJECTNAME-$tbb_version" ===================================== tools/signing/linux-signer-sign-android-apks.torvpn ===================================== @@ -0,0 +1 @@ +linux-signer-sign-android-apks \ No newline at end of file ===================================== tools/signing/machines-setup/setup-signing-machine ===================================== @@ -91,6 +91,7 @@ sudoers_file sign-gpg sudoers_file sign-mar sudoers_file sign-exe sudoers_file sign-apk +sudoers_file sign-aab sudoers_file sign-rcodesign sudoers_file sign-rcodesign-128 sudoers_file set-date @@ -105,6 +106,10 @@ authorized_keys ma1 ma1.pub create_user pierov signing authorized_keys pierov pierov.pub +mkdir -p /home/signing-apk/unsigned-files /home/signing-apk/signed-files +chgrp signing /home/signing-apk/unsigned-files /home/signing-apk/signed-files +chmod g+rwx /home/signing-apk/unsigned-files /home/signing-apk/signed-files + # Install rbm deps install_packages libyaml-libyaml-perl libtemplate-perl libdatetime-perl \ libio-handle-util-perl libio-all-perl \ ===================================== tools/signing/machines-setup/sudoers.d/sign-aab ===================================== @@ -0,0 +1,2 @@ +Defaults>signing-apk env_keep += "SIGNING_PROJECTNAME tbb_version tbb_version_type KSPASS" +%signing ALL = (signing-apk) NOPASSWD: /signing/tor-browser-build/tools/signing/wrappers/sign-aab ===================================== tools/signing/machines-setup/sudoers.d/sign-apk ===================================== @@ -1,2 +1,2 @@ -Defaults>signing-apk env_keep += "SIGNING_PROJECTNAME tbb_version_type KSPASS" +Defaults>signing-apk env_keep += "SIGNING_PROJECTNAME tbb_version tbb_version_type KSPASS" %signing ALL = (signing-apk) NOPASSWD: /signing/tor-browser-build/tools/signing/wrappers/sign-apk ===================================== tools/signing/set-config ===================================== @@ -16,6 +16,7 @@ test -n "${SIGNING_PROJECTNAME+x}" \ test "$SIGNING_PROJECTNAME" = 'torbrowser' \ || test "$SIGNING_PROJECTNAME" = 'basebrowser' \ || test "$SIGNING_PROJECTNAME" = 'mullvadbrowser' \ + || test "$SIGNING_PROJECTNAME" = 'torvpn' \ || exit_error "Unknown SIGNING_PROJECTNAME $SIGNING_PROJECTNAME" export SIGNING_PROJECTNAME ===================================== tools/signing/staticiforme-prepare-cdn-dist-upload.torvpn ===================================== @@ -0,0 +1 @@ +staticiforme-prepare-cdn-dist-upload \ No newline at end of file ===================================== tools/signing/sync-builder-to-local.torvpn ===================================== @@ -0,0 +1 @@ +sync-builder-to-local \ No newline at end of file ===================================== tools/signing/sync-builder-to-local.torvpn.dry-run ===================================== @@ -0,0 +1 @@ +sync-builder-to-local \ No newline at end of file ===================================== tools/signing/sync-builder-unsigned-to-local-signed.torvpn ===================================== @@ -0,0 +1 @@ +sync-builder-unsigned-to-local-signed \ No newline at end of file ===================================== tools/signing/sync-builder-unsigned-to-local-signed.torvpn.dry-run ===================================== @@ -0,0 +1 @@ +sync-builder-unsigned-to-local-signed \ No newline at end of file ===================================== tools/signing/sync-linux-signer-to-local.torvpn ===================================== @@ -0,0 +1 @@ +sync-linux-signer-to-local \ No newline at end of file ===================================== tools/signing/sync-linux-signer-to-local.torvpn.dry-run ===================================== @@ -0,0 +1 @@ +sync-linux-signer-to-local \ No newline at end of file ===================================== tools/signing/sync-local-to-builder.torvpn ===================================== @@ -0,0 +1 @@ +sync-local-to-builder \ No newline at end of file ===================================== tools/signing/sync-local-to-builder.torvpn.dry-run ===================================== @@ -0,0 +1 @@ +sync-local-to-builder \ No newline at end of file ===================================== tools/signing/sync-local-to-linux-signer.torvpn ===================================== @@ -0,0 +1 @@ +sync-local-to-linux-signer \ No newline at end of file ===================================== tools/signing/sync-local-to-linux-signer.torvpn.dry-run ===================================== @@ -0,0 +1 @@ +sync-local-to-linux-signer \ No newline at end of file ===================================== tools/signing/sync-local-to-staticiforme.torvpn ===================================== @@ -0,0 +1 @@ +sync-local-to-staticiforme \ No newline at end of file ===================================== tools/signing/sync-local-to-staticiforme.torvpn.dry-run ===================================== @@ -0,0 +1 @@ +sync-local-to-staticiforme \ No newline at end of file ===================================== tools/signing/sync-scripts-to-linux-signer.torvpn ===================================== @@ -0,0 +1 @@ +sync-scripts-to-linux-signer \ No newline at end of file ===================================== tools/signing/sync-scripts-to-linux-signer.torvpn.dry-run ===================================== @@ -0,0 +1 @@ +sync-scripts-to-linux-signer \ No newline at end of file ===================================== tools/signing/wrappers/sign-aab ===================================== @@ -0,0 +1,41 @@ +#!/bin/bash +set -e + +function exit_error { + for msg in "$@" + do + echo "$msg" >&2 + done + exit 1 +} + +case "$SIGNING_PROJECTNAME" in + torbrowser | mullvadbrowser | torvpn) + ;; + *) + exit_error "Unexpected value for SIGNING_PROJECTNAME: $SIGNING_PROJECTNAME" + ;; +esac + +case "$tbb_version_type" in + release | alpha) + ;; + *) + exit_error "Unexpected value for tbb_version_type: $tbb_version_type" + ;; +esac + +android_signing_key_dir=/home/signing-apk/keys +android_signing_key_path="$android_signing_key_dir/torvpn.p12" +test -f "$android_signing_key_path" || exit_error "$android_signing_key_path is missing" + +tmpdir=$(mktemp -d) +cd "$tmpdir" + +jarsigner -keystore "${android_signing_key_path}" -storepass:env KSPASS \ + -signedjar /home/signing-apk/signed-files/"$SIGNING_PROJECTNAME-$tbb_version_type.aab" \ + -verbose /home/signing-apk/unsigned-files/"$SIGNING_PROJECTNAME-$tbb_version_type.aab" \ + tor-vpn + +cd - +rm -Rf "$tmpdir" ===================================== tools/signing/wrappers/sign-apk ===================================== @@ -14,15 +14,30 @@ if test "$tbb_version_type" != 'release' \ exit_error "Unexpected value for tbb_version_type: $tbb_version_type" fi +case "$SIGNING_PROJECTNAME" in + torbrowser | mullvadbrowser | torvpn) + ;; + *) + exit_error "Unexpected value for SIGNING_PROJECTNAME: $SIGNING_PROJECTNAME" + ;; +esac + android_signing_key_dir=/home/signing-apk/keys -android_signing_key_path="$android_signing_key_dir/tba_$tbb_version_type.p12" +android_signing_key_path="$android_signing_key_dir/$pname_$tbb_version_type.p12" +test -n "$SIGNING_PROJECTNAME" && test "$SIGNING_PROJECTNAME" = 'torvpn' && \ + android_signing_key_path="$android_signing_key_dir/torvpn.p12" test -f "$android_signing_key_path" || exit_error "$android_signing_key_path is missing" setup_build_tools() { + abt_version=16 + # If signing 14.5, keep using android-12 build tools + # (we can remove this when 15.0 is the stable release) + ( test -z "$tbb_version" || echo "$tbb_version" | grep -q '^14\.5' ) && \ + abt_version=12 build_tools_dir=/signing/android-build-tools - test -f "$build_tools_dir"/android-12/apksigner || \ - exit_error "$build_tools_dir/android-12/apksigner is missing" - export PATH="$build_tools_dir/android-12:${PATH}" + test -f "$build_tools_dir"/android-$abt_version/apksigner || \ + exit_error "$build_tools_dir/android-$abt_version/apksigner is missing" + export PATH="$build_tools_dir/android-$abt_version:${PATH}" } # Sign individual apk View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/82... -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/82... You're receiving this email because of your account on gitlab.torproject.org.