ma1 pushed to branch main at The Tor Project / Applications / tor-browser-build

Commits:

7 changed files:

Changes:

  • .gitlab/issue_templates/Release Prep - Mullvad Browser Alpha.md
    ... ... @@ -208,7 +208,7 @@ Mullvad Browser Alpha (and Nightly) are on the `main` branch
    208 208 
         ```
    209 209 
       - **Subject**
    210 210 
         ```
    211 
    -    New build: Mullvad Browser ${MULLVAD_BROWSER_VERION} (signed)
    211 
    +    New build: Mullvad Browser ${MULLVAD_BROWSER_VERSION} (signed)
    212 212 
         ```
    213 213 
       - **Body**
    214 214 
         ```
    ... ... @@ -219,6 +219,8 @@ Mullvad Browser Alpha (and Nightly) are on the `main` branch
    219 219 
         - signed builds: https://dist.torproject.org/mullvadbrowser/${MULLVAD_BROWSER_VERSION}
    220 220 
         - update_response hashes: ${MULLVAD_UPDATE_RESPONSES_HASH}
    221 221
    222 
    +    * https://gitlab.torproject.org/tpo/applications/mullvad-browser-update-responses
    223 
    +
    222 224 
         changelog:
    223 225 
         # paste changelog as quote here
    224 226 
         ...

  • .gitlab/issue_templates/Release Prep - Mullvad Browser Stable.md
    ... ... @@ -208,7 +208,7 @@ Mullvad Browser Stable is on the `maint-${MULLVAD_BROWSER_MAJOR}.${MULLVAD_BROWS
    208 208 
         ```
    209 209 
       - **Subject**
    210 210 
         ```
    211 
    -    New build: Mullvad Browser ${MULLVAD_BROWSER_VERION} (signed)
    211 
    +    New build: Mullvad Browser ${MULLVAD_BROWSER_VERSION} (signed)
    212 212 
         ```
    213 213 
       - **Body**
    214 214 
         ```
    ... ... @@ -217,7 +217,9 @@ Mullvad Browser Stable is on the `maint-${MULLVAD_BROWSER_MAJOR}.${MULLVAD_BROWS
    217 217 
         Branch+Tags have been pushed to Mullvad's GitHub repo.
    218 218
    219 219 
         - signed builds: https://dist.torproject.org/mullvadbrowser/${MULLVAD_BROWSER_VERSION}
    220 
    -    - update_response hashes: ${MULLVAD_UPDATE_RESPONSES_HASH}
    220 
    +    - update_response hashes: ${MULLVAD_UPDATE_RESPONSES_HASH}*
    221 
    +
    222 
    +    * https://gitlab.torproject.org/tpo/applications/mullvad-browser-update-responses
    221 223
    222 224 
         changelog:
    223 225 
         # paste changelog as quote here

  • .gitlab/issue_templates/Release Prep - Tor Browser Alpha.md
    ... ... @@ -223,9 +223,9 @@ Tor Browser Alpha (and Nightly) are on the `main` branch
    223 223
    224 224 
     ```bash
    225 225 
     # Point OSSLSIGNCODE to your osslsigncode binary
    226 
    -pushd tor-browser-build/${channel}/signed/$TORBROWSER_VERSION
    226 
    +pushd tor-browser-build/torbrowser/${channel}/signed/$TORBROWSER_VERSION
    227 227 
     OSSLSIGNCODE=/path/to/osslsigncode
    228 
    -../../../tools/authenticode_check.sh
    228 
    +../../../../tools/authenticode_check.sh
    229 229 
     popd
    230 230 
     ```
    231 231
    ... ... @@ -234,14 +234,15 @@ popd
    234 234 
         <summary>Check whether the MAR files got properly signed</summary>
    235 235
    236 236 
     ```bash
    237 
    -# Point NSSDB to your nssdb containing the mar signing certificate
    237 
    +# Point NSS_DB_DIR to your nssdb dir containing the mar signing certificate
    238 
    +# (check tools/marsigning_check.sh source code for details)
    238 239 
     # Point SIGNMAR to your signmar binary
    239 240 
     # Point LD_LIBRARY_PATH to your mar-tools directory
    240 
    -pushd tor-browser-build/${channel}/signed/$TORBROWSER_VERSION
    241 
    +pushd tor-browser-build/torbrowser/${channel}/signed/$TORBROWSER_VERSION
    241 242 
     NSSDB=/path/to/nssdb
    242 243 
     SIGNMAR=/path/to/mar-tools/signmar
    243 244 
     LD_LIBRARY_PATH=/path/to/mar-tools/
    244 
    -../../../tools/marsigning_check.sh
    245 
    +../../../../tools/marsigning_check.sh
    245 246 
     popd
    246 247 
     ```
    247 248

  • .gitlab/issue_templates/Release Prep - Tor Browser Legacy.md
    ... ... @@ -203,9 +203,9 @@ Tor Browser Legacy is on the `maint-13.5` branch
    203 203
    204 204 
     ```bash
    205 205 
     # Point OSSLSIGNCODE to your osslsigncode binary
    206 
    -pushd tor-browser-build/${channel}/signed/$TORBROWSER_VERSION
    206 
    +pushd tor-browser-build/torbrowser/${channel}/signed/$TORBROWSER_VERSION
    207 207 
     OSSLSIGNCODE=/path/to/osslsigncode
    208 
    -../../../tools/authenticode_check.sh
    208 
    +../../../../tools/authenticode_check.sh
    209 209 
     popd
    210 210 
     ```
    211 211
    ... ... @@ -217,11 +217,11 @@ popd
    217 217 
     # Point NSSDB to your nssdb containing the mar signing certificate
    218 218 
     # Point SIGNMAR to your signmar binary
    219 219 
     # Point LD_LIBRARY_PATH to your mar-tools directory
    220 
    -pushd tor-browser-build/${channel}/signed/$TORBROWSER_VERSION
    220 
    +pushd tor-browser-build/torbrowser/${channel}/signed/$TORBROWSER_VERSION
    221 221 
     NSSDB=/path/to/nssdb
    222 222 
     SIGNMAR=/path/to/mar-tools/signmar
    223 223 
     LD_LIBRARY_PATH=/path/to/mar-tools/
    224 
    -../../../tools/marsigning_check.sh
    224 
    +../../../../tools/marsigning_check.sh
    225 225 
     popd
    226 226 
     ```
    227 227

  • .gitlab/issue_templates/Release Prep - Tor Browser Stable.md
    ... ... @@ -228,9 +228,9 @@ Tor Browser Stable is on the `maint-${TOR_BROWSER_MAJOR}.${TOR_BROWSER_MINOR}` b
    228 228
    229 229 
     ```bash
    230 230 
     # Point OSSLSIGNCODE to your osslsigncode binary
    231 
    -pushd tor-browser-build/${channel}/signed/$TORBROWSER_VERSION
    231 
    +pushd tor-browser-build/torbrowser/${channel}/signed/$TORBROWSER_VERSION
    232 232 
     OSSLSIGNCODE=/path/to/osslsigncode
    233 
    -../../../tools/authenticode_check.sh
    233 
    +../../../../tools/authenticode_check.sh
    234 234 
     popd
    235 235 
     ```
    236 236
    ... ... @@ -242,11 +242,11 @@ popd
    242 242 
     # Point NSSDB to your nssdb containing the mar signing certificate
    243 243 
     # Point SIGNMAR to your signmar binary
    244 244 
     # Point LD_LIBRARY_PATH to your mar-tools directory
    245 
    -pushd tor-browser-build/${channel}/signed/$TORBROWSER_VERSION
    245 
    +pushd tor-browser-build/torbrowser/${channel}/signed/$TORBROWSER_VERSION
    246 246 
     NSSDB=/path/to/nssdb
    247 247 
     SIGNMAR=/path/to/mar-tools/signmar
    248 248 
     LD_LIBRARY_PATH=/path/to/mar-tools/
    249 
    -../../../tools/marsigning_check.sh
    249 
    +../../../../tools/marsigning_check.sh
    250 250 
     popd
    251 251 
     ```
    252 252

  • tools/signing/do-all-signing
    ... ... @@ -3,34 +3,59 @@ set -e
    3 3 
     script_dir=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
    4 4 
     source "$script_dir/functions"
    5 5 
     source "$script_dir/set-config.update-responses"
    6 
    -
    7 6 
     NON_INTERACTIVE=1
    8 7 
     steps_dir="$signed_version_dir.steps"
    9 8 
     test -d "$steps_dir" || mkdir -p "$steps_dir"
    10 9
    11 
    -test -f "$steps_dir/linux-signer-rcodesign-sign.done" ||
    10 
    +function get_sekrit {
    11 
    +  echo "$SEKRITS" | grep -A1 "$1:" | tail -n1
    12 
    +}
    13 
    +
    14 
    +[ -f "$script_dir/set-config.passwords" ] && . "$script_dir/set-config.passwords" 2>/dev/null
    15 
    +
    16 
    +if [[ $1 = "-p" ]]; then
    17 
    +  shift
    18 
    +  passwords_gpg_file="$1"
    19 
    +  shift
    20 
    +fi
    21 
    +
    22 
    +is_project torbrowser && nssdb=torbrowser-nssdb7
    23 
    +is_project mullvadbrowser && nssdb=mullvadbrowser-nssdb1
    24 
    +
    25 
    +if [ -f "$passwords_gpg_file" ]; then
    26 
    +  echo "Reading passwords from $passwords_gpg_file"
    27 
    +  SEKRITS=$(gpg --decrypt "$passwords_gpg_file")
    28 
    +  RCODESIGN_PW=$(get_sekrit 'rcodesign')
    29 
    +  NSSPASS=$(get_sekrit "$nssdb (mar signing)")
    30 
    +  KSPASS=$(get_sekrit "android apk ($tbb_version_type)")
    31 
    +  YUBIPASS=$(get_sekrit "windows authenticode")
    32 
    +  GPG_PASS=$(get_sekrit "gpg")
    33 
    +else
    34 
    +  echo "Rather than entering all the password manually, you may want to provide a gpg-encrypted file either on the command line (-p <filepath>) or in set-config.passwords."
    35 
    +fi
    36 
    +
    37 
    +test -f "$steps_dir/linux-signer-rcodesign-sign.done" || [ -n "$RCODESIGN_PW" ] ||
    12 38 
       read -sp "Enter rcodesign passphrase for key-1: " RCODESIGN_PW
    13 39 
     echo
    14 
    -is_project torbrowser && nssdb=torbrowser-nssdb7
    15 
    -is_project mullvadbrowser && nssdb=mullvadbrowser-nssdb-1
    16 
    -test -f "$steps_dir/linux-signer-signmars.done" ||
    40 
    +
    41 
    +test -f "$steps_dir/linux-signer-signmars.done" || [ -n "$NSSPASS" ] ||
    17 42 
       read -sp "Enter $nssdb (mar signing) passphrase: " NSSPASS
    18 43 
     echo
    19 44
    20 45 
     if is_project torbrowser; then
    21 
    -  test -f "$steps_dir/linux-signer-sign-android-apks.done" ||
    46 
    +  test -f "$steps_dir/linux-signer-sign-android-apks.done" || [ -n "$KSPASS" ] ||
    22 47 
         read -sp "Enter android apk signing password ($tbb_version_type): " KSPASS
    23 48 
       echo
    24 49 
     fi
    25 
    -test -f "$steps_dir/linux-signer-authenticode-signing.done" ||
    50 
    +test -f "$steps_dir/linux-signer-authenticode-signing.done" || [ -n "$YUBIPASS" ] ||
    26 51 
       read -sp "Enter windows authenticode passphrase: " YUBIPASS
    27 52 
     echo
    28 
    -test -f "$steps_dir/linux-signer-gpg-sign.done" ||
    53 
    +test -f "$steps_dir/linux-signer-gpg-sign.done" || [ -n "$GPG_PASS" ] ||
    29 54 
       read -sp "Enter gpg passphrase: " GPG_PASS
    30 55 
     echo
    31 56
    32 57 
     function set-time-on-signing-machine {
    33 
    -  local current_time=$(date -u)
    58 
    +  local current_time=$(date -u -Iseconds)
    34 59 
       ssh "$ssh_host_linux_signer" sudo /usr/bin/date -s "'$current_time'"
    35 60 
     }
    36 61
    ... ... @@ -178,6 +203,10 @@ function do_step {
    178 203 
       echo "$(date -Iseconds) - Finished step: $1"
    179 204 
     }
    180 205
    206 
    +function is_legacy {
    207 
    +  [[ "$tbb_version" = 13.* ]]
    208 
    +}
    209 
    +
    181 210 
     export SIGNING_PROJECTNAME
    182 211
    183 212 
     do_step set-time-on-signing-machine
    ... ... @@ -195,9 +224,9 @@ do_step sync-scripts-to-linux-signer
    195 224 
     do_step sync-before-linux-signer-signmars
    196 225 
     do_step linux-signer-signmars
    197 226 
     do_step sync-after-signmars
    198 
    -is_project torbrowser && \
    227 
    +is_project torbrowser && ! is_legacy && \
    199 228 
       do_step linux-signer-sign-android-apks
    200 
    -is_project torbrowser && \
    229 
    +is_project torbrowser && ! is_legacy && \
    201 230 
       do_step sync-after-sign-android-apks
    202 231 
     do_step linux-signer-authenticode-signing
    203 232 
     do_step sync-after-authenticode-signing
    ... ... @@ -211,5 +240,6 @@ do_step download-unsigned-sha256sums-gpg-signatures-from-people-tpo
    211 240 
     do_step sync-local-to-staticiforme
    212 241 
     do_step sync-scripts-to-staticiforme
    213 242 
     do_step staticiforme-prepare-cdn-dist-upload
    214 
    -do_step upload-update_responses-to-staticiforme
    243 
    +! is_legacy &&
    244 
    +  do_step upload-update_responses-to-staticiforme
    215 245 
     do_step finished-signing-clean-linux-signer

  • tools/signing/set-config.passwords
    1 
    +# Path to a gpg-encrypted cache of passwords not to be asked on each run
    2 
    +passwords_gpg_file=~/.tor-browser-signing/tor-browser-passwords.txt.gpg

    • —
    View it on GitLab.
    You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications · Help