boklm pushed to branch main at The Tor Project / Applications / tor-browser-build

Commits:

30 changed files:

Changes:

  • rbm.conf
    ... ... @@ -97,8 +97,8 @@ var:
    97 97 
         # enable/disable all android or desktop platforms. If you want to
    98 98 
         # check whether a release includes some android or desktop platforms
    99 99 
         # see signing_android and signing_desktop below.
    100 
    -    is_android_release: '[% c("var/tor-browser") %]'
    101 
    -    is_desktop_release: '1'
    100 
    +    is_android_release: '[% c("var/tor-browser") || c("var/tor-vpn") %]'
    101 
    +    is_desktop_release: '[% ! c("var/tor-vpn") %]'
    102 102
    103 103 
         # signing_android is used in signing scripts to check if at least
    104 104 
         # one android platform is being signed/published
    ... ... @@ -328,6 +328,18 @@ targets:
    328 328 
           max_torbrowser_incremental_from: 2
    329 329 
           build_infos_json: 1
    330 330
    331 
    +  torvpn:
    332 
    +    var:
    333 
    +      tor-vpn: 1
    334 
    +      torbrowser_version: '1.0.0Beta'
    335 
    +      torbrowser_build: 'build1'
    336 
    +      browser_release_date: '2025/08/28 15:33:44'
    337 
    +      project-name: tor-vpn
    338 
    +      projectname: torvpn
    339 
    +      Project_Name: 'Tor VPN'
    340 
    +      ProjectName: TorVPN
    341 
    +      project_initials: tv
    342 
    +
    331 343 
       torbrowser:
    332 344 
         var:
    333 345 
           tor-browser: 1

  • tools/signing/do-all-signing
    ... ... @@ -67,7 +67,7 @@ echo
    67 67 
     echo
    68 68
    69 69 
     [ -z "$platform_android" ] || \
    70 
    -  [ -f "$steps_dir/linux-signer-sign-android-apks.done" ] || \
    70 
    +  [ -f "$steps_dir/sync-after-sign-android-apks.done" ] || \
    71 71 
       [ -n "$KSPASS" ] || \
    72 72 
       read -sp "Enter android apk signing password ($tbb_version_type): " KSPASS
    73 73 
     echo
    ... ... @@ -155,6 +155,14 @@ EOF
    155 155 
       unset KSPASS
    156 156 
     }
    157 157
    158 
    +function linux-signer-sign-android-aab {
    159 
    +  ssh "$ssh_host_linux_signer" 'bash -s' << EOF
    160 
    +  export KSPASS=$KSPASS
    161 
    +  ~/signing-$SIGNING_PROJECTNAME-$tbb_version_type/linux-signer-sign-android-aab.$SIGNING_PROJECTNAME
    162 
    +EOF
    163 
    +  unset KSPASS
    164 
    +}
    165 
    +
    158 166 
     function sync-after-sign-android-apks {
    159 167 
       "$script_dir/sync-linux-signer-to-local"
    160 168 
     }
    ... ... @@ -257,6 +265,8 @@ do_step sync-before-linux-signer-signmars
    257 265 
       do_step sync-after-signmars
    258 266 
     [ -n "$platform_android" ] && \
    259 267 
       do_step linux-signer-sign-android-apks
    268 
    +[ "$SIGNING_PROJECTNAME" = 'torvpn' ] && [ -n "$platform_android" ] && \
    269 
    +  do_step linux-signer-sign-android-aab
    260 270 
     [ -n "$platform_android" ] && \
    261 271 
       do_step sync-after-sign-android-apks
    262 272 
     [ -n "$platform_windows" ] && \
    ... ... @@ -275,6 +285,6 @@ do_step download-unsigned-sha256sums-gpg-signatures-from-people-tpo
    275 285 
     do_step sync-local-to-staticiforme
    276 286 
     do_step sync-scripts-to-staticiforme
    277 287 
     do_step staticiforme-prepare-cdn-dist-upload
    278 
    -! is_legacy && \
    288 
    +[ "$SIGNING_PROJECTNAME" != 'torvpn' ] && ! is_legacy \
    279 289 
       do_step upload-update_responses-to-staticiforme
    280 290 
     do_step finished-signing-clean-linux-signer

  • tools/signing/do-all-signing.torvpn
    1 
    +do-all-signing
    \ No newline at end of file

  • tools/signing/functions
    ... ... @@ -14,6 +14,7 @@ function var_is_defined {
    14 14 
     }
    15 15
    16 16 
     function check_update_responses_repository_dir {
    17 
    +  test "$SIGNING_PROJECTNAME" = 'torvpn' && return 0
    17 18 
       if test -z "$update_responses_repository_dir" || ! test -d "$update_responses_repository_dir"
    18 19 
       then
    19 20 
         cat << 'EOF' > /dev/stderr

  • tools/signing/linux-signer-gpg-sign.torvpn
    1 
    +linux-signer-gpg-sign
    \ No newline at end of file

  • tools/signing/linux-signer-sign-android-aab
    1 
    +#!/bin/bash
    2 
    +
    3 
    +set -e
    4 
    +no_generate_config=1
    5 
    +script_dir=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
    6 
    +source "$script_dir/functions"
    7 
    +
    8 
    +topdir="$script_dir/../.."
    9 
    +test "$SIGNING_PROJECTNAME" = 'torvpn'
    10 
    +projname=$(project-name)
    11 
    +# tbb_version_type, tbb_version and SIGNING_PROJECTNAME are used in
    12 
    +# wrappers/sign-apk, so we export them
    13 
    +export tbb_version tbb_version_type SIGNING_PROJECTNAME
    14 
    +# (note: we should also export SIGNING_PROJECTNAME and tbb_version in
    15 
    +# the maint-14.5 branch)
    16 
    +
    17 
    +check_installed_packages() {
    18 
    +  local packages='unzip openjdk-11-jdk-headless openjdk-11-jre-headless'
    19 
    +  for package in $packages
    20 
    +  do
    21 
    +    dpkg -s "$package" | grep -q '^Status: install ok installed$' || \
    22 
    +      exit_error "package $package is missing"
    23 
    +  done
    24 
    +}
    25 
    +
    26 
    +sign_aab() {
    27 
    +  sudo -u signing-apk -- /signing/tor-browser-build/tools/signing/wrappers/sign-aab
    28 
    +}
    29 
    +
    30 
    +check_installed_packages
    31 
    +
    32 
    +if [ -z "$KSPASS" ]; then
    33 
    +    echo "Enter keystore passphrase"
    34 
    +    stty -echo; read KSPASS; stty echo
    35 
    +    export KSPASS
    36 
    +fi
    37 
    +
    38 
    +cp -af ~/"$SIGNING_PROJECTNAME-$tbb_version"/$projname-$tbb_version.aab \
    39 
    +  /home/signing-apk/unsigned-files/"$SIGNING_PROJECTNAME-$tbb_version_type.aab"
    40 
    +
    41 
    +sign_aab
    42 
    +
    43 
    +cp /home/signing-apk/signed-files/"$SIGNING_PROJECTNAME-$tbb_version_type.aab" \
    44 
    +  ~/"$SIGNING_PROJECTNAME-$tbb_version"/$projname-$tbb_version.aab
    45 
    +rm /home/signing-apk/signed-files/"$SIGNING_PROJECTNAME-$tbb_version_type.aab"
    46 
    +rm /home/signing-apk/unsigned-files/"$SIGNING_PROJECTNAME-$tbb_version_type.aab"

  • tools/signing/linux-signer-sign-android-aab.torvpn
    1 
    +linux-signer-sign-android-aab
    \ No newline at end of file

  • tools/signing/linux-signer-sign-android-apks
    ... ... @@ -7,9 +7,11 @@ source "$script_dir/functions"
    7 7
    8 8 
     topdir="$script_dir/../.."
    9 9 
     ARCHS="armv7 aarch64 x86 x86_64"
    10 
    +test "$SIGNING_PROJECTNAME" = 'torvpn' && ARCHS='multiarch'
    10 11 
     projname=$(project-name)
    11 
    -# tbb_version_type is used in wrappers/sign-apk, so we export it
    12 
    -export tbb_version_type
    12 
    +# tbb_version_type, tbb_version and SIGNING_PROJECTNAME are used in
    13 
    +# wrappers/sign-apk, so we export them
    14 
    +export tbb_version tbb_version_type SIGNING_PROJECTNAME
    13 15
    14 16 
     check_installed_packages() {
    15 17 
       local packages='unzip openjdk-11-jdk-headless openjdk-11-jre-headless'
    ... ... @@ -21,10 +23,11 @@ check_installed_packages() {
    21 23 
     }
    22 24
    23 25 
     setup_build_tools() {
    26 
    +  abt_version=16
    24 27 
       build_tools_dir=/signing/android-build-tools
    25 
    -  test -f "$build_tools_dir"/android-12/apksigner || \
    26 
    -    exit_error "$build_tools_dir/android-12/apksigner is missing"
    27 
    -  export PATH="$build_tools_dir/android-12:${PATH}"
    28 
    +  test -f "$build_tools_dir"/android-$abt_version/apksigner || \
    29 
    +    exit_error "$build_tools_dir/android-$abt_version/apksigner is missing"
    30 
    +  export PATH="$build_tools_dir/android-$abt_version:${PATH}"
    28 31 
     }
    29 32
    30 33 
     sign_apk() {
    ... ... @@ -36,7 +39,6 @@ verify_apk() {
    36 39 
       scheme_v1="Verified using v1 scheme (JAR signing): true"
    37 40 
       scheme_v2="Verified using v2 scheme (APK Signature Scheme v2): true"
    38 41
    39 
    -  # Verify the expected signing key was used, Alpha verses Release based on the filename.
    40 42 
       if test "$tbb_version_type" = "alpha"; then
    41 43 
         cert_digest="Signer #1 certificate SHA-256 digest: 15f760b41acbe4783e667102c9f67119be2af62fab07763f9d57f01e5e1074e1"
    42 44 
         pubkey_digest="Signer #1 public key SHA-256 digest: 4e617e6516f81123ca58e718d617a704ac8365c575bd9e7a731ba5dd0476869d"
    ... ... @@ -44,7 +46,14 @@ verify_apk() {
    44 46 
         cert_digest="Signer #1 certificate SHA-256 digest: 20061f045e737c67375c17794cfedb436a03cec6bacb7cb9f96642205ca2cec8"
    45 47 
         pubkey_digest="Signer #1 public key SHA-256 digest: 343ca8a2e5452670bdc335a181a4baed909f868937d68c4653e44ef84de8dfc6"
    46 48 
       fi
    49 
    +  if test "$SIGNING_PROJECTNAME" = "torvpn"; then
    50 
    +    # No v1 scheme signature on torvpn apk
    51 
    +    scheme_v1=''
    52 
    +    cert_digest="Signer #1 certificate SHA-256 digest: c2f6ffa30e56a7c53a226248ef908612ee539df2f52bede5a55037425b83331d"
    53 
    +    pubkey_digest="Signer #1 public key SHA-256 digest: fddc5f93ae0bc971e951481b0b5e6b62e47040fe979ff535cf75daade2f13f3d"
    54 
    +  fi
    47 55 
       for digest in "${scheme_v1}" "${scheme_v2}" "${cert_digest}" "${pubkey_digest}"; do
    56 
    +    test -z "$digest" && continue
    48 57 
         if ! echo "${verified}" | grep -q "${digest}"; then
    49 58 
           echo "Expected digest not found:"
    50 59 
           echo ${digest}
    ... ... @@ -69,8 +78,10 @@ mkdir -p ~/"$SIGNING_PROJECTNAME-$tbb_version-apks"
    69 78 
     chgrp signing ~/"$SIGNING_PROJECTNAME-$tbb_version-apks"
    70 79 
     chmod g+w ~/"$SIGNING_PROJECTNAME-$tbb_version-apks"
    71 80 
     cp -af ~/"$SIGNING_PROJECTNAME-$tbb_version"/*.apk \
    72 
    -  ~/"$SIGNING_PROJECTNAME-$tbb_version"/*.bspatch \
    73 81 
       ~/"$SIGNING_PROJECTNAME-$tbb_version-apks"
    82 
    +test "$SIGNING_PROJECTNAME" != 'torvpn' && \
    83 
    +  cp -af ~/"$SIGNING_PROJECTNAME-$tbb_version"/*.bspatch \
    84 
    +    ~/"$SIGNING_PROJECTNAME-$tbb_version-apks"
    74 85 
     cd ~/"$SIGNING_PROJECTNAME-$tbb_version-apks"
    75 86
    76 87 
     # Sign all packages
    ... ... @@ -79,7 +90,8 @@ for arch in ${ARCHS}; do
    79 90 
       unsigned_apk=${projname}-qa-unsigned-android-${arch}-${tbb_version}.apk
    80 91 
       unsigned_apk_bspatch=${projname}-qa-unsign-android-${arch}-${tbb_version}.bspatch
    81 92 
       signed_apk=${projname}-android-${arch}-${tbb_version}.apk
    82 
    -  bspatch "$qa_apk" "$unsigned_apk" "$unsigned_apk_bspatch"
    93 
    +  test -f "$unsigned_apk" || \
    94 
    +    bspatch "$qa_apk" "$unsigned_apk" "$unsigned_apk_bspatch"
    83 95 
       sign_apk "$unsigned_apk" "$signed_apk"
    84 96 
       verify_apk "$signed_apk"
    85 97 
       cp -f "$signed_apk" ~/"$SIGNING_PROJECTNAME-$tbb_version"

  • tools/signing/linux-signer-sign-android-apks.torvpn
    1 
    +linux-signer-sign-android-apks
    \ No newline at end of file

  • tools/signing/machines-setup/setup-signing-machine
    ... ... @@ -91,6 +91,7 @@ sudoers_file sign-gpg
    91 91 
     sudoers_file sign-mar
    92 92 
     sudoers_file sign-exe
    93 93 
     sudoers_file sign-apk
    94 
    +sudoers_file sign-aab
    94 95 
     sudoers_file sign-rcodesign
    95 96 
     sudoers_file sign-rcodesign-128
    96 97 
     sudoers_file set-date
    ... ... @@ -105,6 +106,10 @@ authorized_keys ma1 ma1.pub
    105 106 
     create_user pierov signing
    106 107 
     authorized_keys pierov pierov.pub
    107 108
    109 
    +mkdir -p /home/signing-apk/unsigned-files /home/signing-apk/signed-files
    110 
    +chgrp signing /home/signing-apk/unsigned-files /home/signing-apk/signed-files
    111 
    +chmod g+rwx /home/signing-apk/unsigned-files /home/signing-apk/signed-files
    112 
    +
    108 113 
     # Install rbm deps
    109 114 
     install_packages libyaml-libyaml-perl libtemplate-perl libdatetime-perl \
    110 115 
                      libio-handle-util-perl libio-all-perl \

  • tools/signing/machines-setup/sudoers.d/sign-aab
    1 
    +Defaults>signing-apk env_keep += "SIGNING_PROJECTNAME tbb_version tbb_version_type KSPASS"
    2 
    +%signing ALL = (signing-apk) NOPASSWD: /signing/tor-browser-build/tools/signing/wrappers/sign-aab

  • tools/signing/machines-setup/sudoers.d/sign-apk
    1 
    -Defaults>signing-apk env_keep += "SIGNING_PROJECTNAME tbb_version_type KSPASS"
    1 
    +Defaults>signing-apk env_keep += "SIGNING_PROJECTNAME tbb_version tbb_version_type KSPASS"
    2 2 
     %signing ALL = (signing-apk) NOPASSWD: /signing/tor-browser-build/tools/signing/wrappers/sign-apk

  • tools/signing/set-config
    ... ... @@ -16,6 +16,7 @@ test -n "${SIGNING_PROJECTNAME+x}" \
    16 16 
     test "$SIGNING_PROJECTNAME" = 'torbrowser' \
    17 17 
       || test "$SIGNING_PROJECTNAME" = 'basebrowser' \
    18 18 
       || test "$SIGNING_PROJECTNAME" = 'mullvadbrowser' \
    19 
    +  || test "$SIGNING_PROJECTNAME" = 'torvpn' \
    19 20 
       || exit_error "Unknown SIGNING_PROJECTNAME $SIGNING_PROJECTNAME"
    20 21
    21 22 
     export SIGNING_PROJECTNAME

  • tools/signing/staticiforme-prepare-cdn-dist-upload.torvpn
    1 
    +staticiforme-prepare-cdn-dist-upload
    \ No newline at end of file

  • tools/signing/sync-builder-to-local.torvpn
    1 
    +sync-builder-to-local
    \ No newline at end of file

  • tools/signing/sync-builder-to-local.torvpn.dry-run
    1 
    +sync-builder-to-local
    \ No newline at end of file

  • tools/signing/sync-builder-unsigned-to-local-signed.torvpn
    1 
    +sync-builder-unsigned-to-local-signed
    \ No newline at end of file

  • tools/signing/sync-builder-unsigned-to-local-signed.torvpn.dry-run
    1 
    +sync-builder-unsigned-to-local-signed
    \ No newline at end of file

  • tools/signing/sync-linux-signer-to-local.torvpn
    1 
    +sync-linux-signer-to-local
    \ No newline at end of file

  • tools/signing/sync-linux-signer-to-local.torvpn.dry-run
    1 
    +sync-linux-signer-to-local
    \ No newline at end of file

  • tools/signing/sync-local-to-builder.torvpn
    1 
    +sync-local-to-builder
    \ No newline at end of file

  • tools/signing/sync-local-to-builder.torvpn.dry-run
    1 
    +sync-local-to-builder
    \ No newline at end of file

  • tools/signing/sync-local-to-linux-signer.torvpn
    1 
    +sync-local-to-linux-signer
    \ No newline at end of file

  • tools/signing/sync-local-to-linux-signer.torvpn.dry-run
    1 
    +sync-local-to-linux-signer
    \ No newline at end of file

  • tools/signing/sync-local-to-staticiforme.torvpn
    1 
    +sync-local-to-staticiforme
    \ No newline at end of file

  • tools/signing/sync-local-to-staticiforme.torvpn.dry-run
    1 
    +sync-local-to-staticiforme
    \ No newline at end of file

  • tools/signing/sync-scripts-to-linux-signer.torvpn
    1 
    +sync-scripts-to-linux-signer
    \ No newline at end of file

  • tools/signing/sync-scripts-to-linux-signer.torvpn.dry-run
    1 
    +sync-scripts-to-linux-signer
    \ No newline at end of file

  • tools/signing/wrappers/sign-aab
    1 
    +#!/bin/bash
    2 
    +set -e
    3 
    +
    4 
    +function exit_error {
    5 
    +  for msg in "$@"
    6 
    +  do
    7 
    +    echo "$msg" >&2
    8 
    +  done
    9 
    +  exit 1
    10 
    +}
    11 
    +
    12 
    +case "$SIGNING_PROJECTNAME" in
    13 
    +  torbrowser | mullvadbrowser | torvpn)
    14 
    +    ;;
    15 
    +  *)
    16 
    +    exit_error "Unexpected value for SIGNING_PROJECTNAME: $SIGNING_PROJECTNAME"
    17 
    +    ;;
    18 
    +esac
    19 
    +
    20 
    +case "$tbb_version_type" in
    21 
    +  release | alpha)
    22 
    +    ;;
    23 
    +  *)
    24 
    +    exit_error "Unexpected value for tbb_version_type: $tbb_version_type"
    25 
    +    ;;
    26 
    +esac
    27 
    +
    28 
    +android_signing_key_dir=/home/signing-apk/keys
    29 
    +android_signing_key_path="$android_signing_key_dir/torvpn.p12"
    30 
    +test -f "$android_signing_key_path" || exit_error "$android_signing_key_path is missing"
    31 
    +
    32 
    +tmpdir=$(mktemp -d)
    33 
    +cd "$tmpdir"
    34 
    +
    35 
    +jarsigner -keystore "${android_signing_key_path}" -storepass:env KSPASS \
    36 
    +  -signedjar /home/signing-apk/signed-files/"$SIGNING_PROJECTNAME-$tbb_version_type.aab" \
    37 
    +  -verbose /home/signing-apk/unsigned-files/"$SIGNING_PROJECTNAME-$tbb_version_type.aab" \
    38 
    +  tor-vpn
    39 
    +
    40 
    +cd -
    41 
    +rm -Rf "$tmpdir"

  • tools/signing/wrappers/sign-apk
    ... ... @@ -14,15 +14,30 @@ if test "$tbb_version_type" != 'release' \
    14 14 
       exit_error "Unexpected value for tbb_version_type: $tbb_version_type"
    15 15 
     fi
    16 16
    17 
    +case "$SIGNING_PROJECTNAME" in
    18 
    +  torbrowser | mullvadbrowser | torvpn)
    19 
    +    ;;
    20 
    +  *)
    21 
    +    exit_error "Unexpected value for SIGNING_PROJECTNAME: $SIGNING_PROJECTNAME"
    22 
    +    ;;
    23 
    +esac
    24 
    +
    17 25 
     android_signing_key_dir=/home/signing-apk/keys
    18 
    -android_signing_key_path="$android_signing_key_dir/tba_$tbb_version_type.p12"
    26 
    +android_signing_key_path="$android_signing_key_dir/$pname_$tbb_version_type.p12"
    27 
    +test -n "$SIGNING_PROJECTNAME" && test "$SIGNING_PROJECTNAME" = 'torvpn' && \
    28 
    +  android_signing_key_path="$android_signing_key_dir/torvpn.p12"
    19 29 
     test -f "$android_signing_key_path" || exit_error "$android_signing_key_path is missing"
    20 30
    21 31 
     setup_build_tools() {
    32 
    +  abt_version=16
    33 
    +  # If signing 14.5, keep using android-12 build tools
    34 
    +  # (we can remove this when 15.0 is the stable release)
    35 
    +  ( test -z "$tbb_version" || echo "$tbb_version" | grep -q '^14\.5' ) && \
    36 
    +    abt_version=12
    22 37 
       build_tools_dir=/signing/android-build-tools
    23 
    -  test -f "$build_tools_dir"/android-12/apksigner || \
    24 
    -    exit_error "$build_tools_dir/android-12/apksigner is missing"
    25 
    -  export PATH="$build_tools_dir/android-12:${PATH}"
    38 
    +  test -f "$build_tools_dir"/android-$abt_version/apksigner || \
    39 
    +    exit_error "$build_tools_dir/android-$abt_version/apksigner is missing"
    40 
    +  export PATH="$build_tools_dir/android-$abt_version:${PATH}"
    26 41 
     }
    27 42
    28 43 
     # Sign individual apk

    • —
    View it on GitLab.
    You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications · Help Notification message regarding https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/821c192ed9def86b92a20bc8878a7c519230996f at 1756464659