commit 9a069e0bc70e905fb44897370f57bb4d1d67a599 Author: Georg Koppen gk@torproject.org Date: Wed May 25 07:59:20 2016 +0000

Release preparations for 6.0

Version bumps, changelog update and config.yml update --- Bundle-Data/Docs/ChangeLog.txt | 91 +++++++++++++++++++++++++++++++++++++++ gitian/versions | 38 ++++++++++------ tools/update-responses/config.yml | 12 +++--- 3 files changed, 121 insertions(+), 20 deletions(-)

diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index b96cb79..fc1a14b 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,94 @@ +Tor Browser 6.0 -- May 30 + * All Platforms + * Update Firefox to 45.1.1esr + * Update OpenSSL to 1.0.1t + * Update Torbutton to 1.9.5.4 + * Bug 18466: Make Torbutton compatible with Firefox ESR 45 + * Bug 18743: Pref to hide 'Sign in to Sync' button in hamburger menu + * Bug 18905: Hide unusable items from help menu + * Bug 16017: Allow users to more easily set a non-tor SSH proxy + * Bug 17599: Provide shortcuts for New Identity and New Circuit + * Translation updates + * Code clean-up + * Update Tor Launcher to 0.2.9.3 + * Bug 13252: Do not store data in the application bundle + * Bug 18947: Tor Browser is not starting on OS X if put into /Applications + * Bug 11773: Setup wizard UI flow improvements + * Translation updates + * Update HTTPS-Everywhere to 5.1.9 + * Update meek to 0.22 (tag 0.22-18371-3) + * Bug 18371: Symlinks are incompatible with Gatekeeper signing + * Bug 18904: Mac OS: meek-http-helper profile not updated + * Bug 15197 and child tickets: Rebase Tor Browser patches to ESR 45 + * Bug 18900: Fix broken updater on Linux + * Bug 18042: Disable SHA1 certificate support + * Bug 18821: Disable libmdns support for desktop and mobile + * Bug 18848: Disable additional welcome URL shown on first start + * Bug 14970: Exempt our extensions from signing requirement + * Bug 16328: Disable MediaDevices.enumerateDevices + * Bug 16673: Disable HTTP Alternative-Services + * Bug 17167: Disable Mozilla's tracking protection + * Bug 18603: Disable performance-based WebGL fingerprinting option + * Bug 18738: Disable Selfsupport and Unified Telemetry + * Bug 18799: Disable Network Tickler + * Bug 18800: Remove DNS lookup in lockfile code + * Bug 18801: Disable dom.push preferences + * Bug 18802: Remove the JS-based Flash VM (Shumway) + * Bug 18863: Disable MozTCPSocket explicitly + * Bug 15640: Place Canvas MediaStream behind site permission + * Bug 16326: Verify cache isolation for Request and Fetch APIs + * Bug 18741: Fix OCSP and favicon isolation for ESR 45 + * Bug 16998: Disable <link rel="preconnect"> for now + * Bug 18898: Exempt the meek extension from the signing requirement as well + * Bug 18899: Don't copy Torbutton, TorLauncher, etc. into meek profile + * Bug 18890: Test importScripts() for cache and network isolation + * Bug 18886: Hide pocket menu items when Pocket is disabled + * Bug 18703: Fix circuit isolation issues on Page Info dialog + * bug 19115: Tor Browser should not fall back to Bing as its search engine + * Bug 18915+19065: Use our search plugins in localized builds + * Bug 18811: Fix first-party isolation for blobs URLs in Workers + * Bug 18950: Disable or audit Reader View + * Bug 18886: Remove Pocket + * Bug 18619: Tor Browser reports "InvalidStateError" in browser console + * Bug 18945: Disable monitoring the connected state of Tor Browser users + * Bug 18855: Don't show error after add-on directory clean-up + * Bug 18885: Disable the option of logging TLS/SSL key material + * Bug 18770: SVGs should not show up on Page Info dialog when disabled + * Bug 18958: Spoof screen.orientation values + * Bug 19047: Disable Heartbeat prompts + * Bug 18914: Use English-only label in <isindex/> tags + * Bug 18996: Investigate server logging in esr45-based Tor Browser + * Bug 17790: Add unit tests for keyboard fingerprinting defenses + * Bug 18995: Regression test to ensure CacheStorage is disabled + * Bug 18912: Add automated tests for updater cert pinning + * Bug 16728: Add test cases for favicon isolation + * Bug 18976: Remove some FTE bridges + * Windows + * Bug 13419: Support ICU in Windows builds + * Bug 16874: Fix broken https://sports.yahoo.com/dailyfantasy page + * Bug 18767: Context menu is broken on Windows in ESR 45 based Tor Browser + * OS X + * Bug 6540: Support OS X Gatekeeper + * Bug 13252: Tor Browser should not store data in the application bundle + * Bug 18951: HTTPS-E is missing after update + * Bug 18904: meek-http-helper profile not updated + * Bug 18928: Upgrade is not smooth (requires another restart) + * Build System + * All Platforms + * Bug 18127: Add LXC support for building with Debian guest VMs + * Bug 16224: Don't use BUILD_HOSTNAME anymore in Firefox builds + * Bug 18919: Remove unused keys and unused dependencies + * Windows + * Bug 17895: Use NSIS 2.51 for installer to avoid DLL hijacking + * Bug 18290: Bump mingw-w64 commit we use + * OS X + * Bug 18331: Update toolchain for Firefox 45 ESR + * Bug 18690: Switch to Debian Wheezy guest VMs + * Linux + * Bug 18699: Stripping fails due to obsolete Browser/components directory + * Bug 18698: Include libgconf2-dev for our Linux builds + * Bug 15578: Switch to Debian Wheezy guest VMs (10.04 LTS is EOL) + Tor Browser 6.0a5-hardened -- April 28 2016 * All Platforms * Update Firefox to 45.1.0esr diff --git a/gitian/versions b/gitian/versions index a18afab..a3b3a1f 100755 --- a/gitian/versions +++ b/gitian/versions @@ -5,29 +5,35 @@ BUNDLE_LOCALES_WIN32="ja" BUNDLE_LOCALES_MAC="ja-JP-mac" BUILD_PT_BUNDLES=1

+# DATA_OUTSIDE_APP_DIR is only implemented for Mac OS. +DATA_OUTSIDE_APP_DIR=1 + VERIFY_TAGS=1

-FIREFOX_VERSION=38.6.0esr +FIREFOX_VERSION=45.1.1esr

TORBROWSER_UPDATE_CHANNEL=release

-TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-5.5-1-build1 +TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-6.0-1-build1 TOR_TAG=tor-0.2.7.6 -TORLAUNCHER_TAG=0.2.7.8 -TORBUTTON_TAG=1.9.4.3 -HTTPSE_TAG=5.1.2 -NSIS_TAG=v0.3 +TORLAUNCHER_TAG=0.2.9.3 +TORBUTTON_TAG=1.9.5.4 +HTTPSE_TAG=5.1.9 +NSIS_TAG=v0.3.1 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.22-stable -MINGW_TAG=a883b47a45ff74ced41dfbd9f748d5c2c61f3c01 # due to bug 1156131 +CMAKE_TAG=v2.8.12.2 +LLVM_TAG=8f188e0ea735ac9383a65a0d1c846eb790c2ec74 # r247539 +CLANG_TAG=592b43b609b42cffd1531a700c140e10766bf049 # r247539 +MINGW_TAG=a0cd5afeb60be3be0860e9a203314c10485bb9b8 PYPTLIB_TAG=pyptlib-0.0.6 OBFSPROXY_TAG=obfsproxy-0.2.12 LIBFTE_TAG=85ef8ae58dbf0d02ea26b627e343784b5574c428 # sketch master with fix FTEPROXY_TAG=597f8378f6f4f3de570b8e1064c2e4cb8d67fbd0 # tag 0.2.19 LIBDMG_TAG=dfd5e5cc3dc1191e37d3c3a6118975afdd1d7014 TXSOCKSX_TAG=216eb0894a1755872f4789f9458aa6cf543b8433 # unsigned habnabit/1.13.0.2 -GOPTLIB_TAG=0.2 -MEEK_TAG=0.20 +GOPTLIB_TAG=0.5 +MEEK_TAG=0.22-18371-3 FAKETIME_TAG=70aa6b394d9341522dffe8a5a5cf5929e82cc6b9 # unsigned v0.9.6 GOED25519_TAG=c4161f4c7483313562781c61b9a20aba73daf9de GOSIPHASH_TAG=42ba037e748c9062a75e0924705c43b893edefcd @@ -36,14 +42,15 @@ GO_X_NET_TAG=7dbad50ab5b31073856416cdcfeb2796d682f844 OBFS4_TAG=obfs4proxy-0.0.5 NOTOFONTS_TAG=720e34851382ee3c1ef024d8dffb68ffbfb234c2

-GITIAN_TAG=tor-browser-builder-3.x-8-gpgsux +GITIAN_TAG=tor-browser-builder-4-1

-OPENSSL_VER=1.0.1q +OPENSSL_VER=1.0.1t GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION FIREFOX_LANG_BUILD=build1 BINUTILS_VER=2.24 GCC_VER=5.1.0 +CLANG_VER=r247539 PYTHON_VER=2.7.5 PYCRYPTO_VER=2.6.1 ARGPARSE_VER=1.2.1 @@ -59,8 +66,9 @@ NSIS_VER=2.51 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 -NOSCRIPT_PACKAGE=noscript_security_suite-2.9.0.2-sm+fx+fn.xpi +NOSCRIPT_PACKAGE=noscript_security_suite-2.9.0.11-fn+sm+fx.xpi TOOLCHAIN4_OLD_PACKAGE=multiarch-darwin11-cctools127.2-gcc42-5666.3-llvmgcc42-2336.1-Linux-120724.tar.xz +CCTOOLS_PACKAGE=cctools.tar.gz OSXSDK_PACKAGE=MacOSX10.7.sdk.tar.gz OSXSDK_OLD_PACKAGE=apple-uni-sdk-10.6_20110407-0.flosoft1_i386.deb MSVCR100_PACKAGE=msvcr100.dll @@ -86,12 +94,13 @@ NOTOSCFONT_PACKAGE=NotoSansSC-Regular.otf NOTOTCFONT_PACKAGE=NotoSansTC-Regular.otf

# Hashes for packages with weak sigs or no sigs -OPENSSL_HASH=b3658b84e9ea606a5ded3c972a5517cd785282e7ea86b20c78aa4b773a047fb7 +OPENSSL_HASH=4a6ee491a2fdb22e519c76fdc2a628bb3cec12762cd456861d207996c8a07088 GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf OSXSDK_OLD_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc TOOLCHAIN4_OLD_HASH=65c1b2d302358a6b95a26c6828a66908a199276193bb0b268f2dcc1a997731e9 -NOSCRIPT_HASH=f3c9dec710e02d809fa85ac76750e5f074656105c1bde03d400cb597b2eb1fba +NOSCRIPT_HASH=fdd965a69188ac651b08a7d3ada54821a89db10a4685aa73ba59edc0b8243390 +CCTOOLS_HASH=e908fdebc2886ee5491ebfc7e7950af451b3c4e2439c2d7a923ed06ad05113e4 MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c ARGPARSE_HASH=ddaf4b0a618335a32b6664d4ae038a1de8fbada3b25033f9021510ed2b3941a4 @@ -116,6 +125,7 @@ NOTOTCFONT_HASH=e6b82f7d3dab605c428161124ceb5e169cde93de632d800297b167cdd88e7baa OPENSSL_URL=https://www.openssl.org/source/$%7BOPENSSL_PACKAGE%7D GMP_URL=https://ftp.gnu.org/gnu/gmp/$%7BGMP_PACKAGE%7D TOOLCHAIN4_OLD_URL=https://people.torproject.org/~mikeperry/mirrors/sources/$%7BTOOLCHAIN4_OLD_... +CCTOOLS_URL=https://people.torproject.org/~gk/mirrors/sources/$%7BCCTOOLS_PACKAGE%7D OSXSDK_URL=https://launchpad.net/~flosoft/+archive/cross-apple/+files/$%7BOSXSDK_PACKAG... BINUTILS_URL=https://ftp.gnu.org/gnu/binutils/$%7BBINUTILS_PACKAGE%7D GCC_URL=https://ftp.gnu.org/gnu/gcc/gcc-$%7BGCC_VER%7D/$%7BGCC_PACKAGE%7D diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index a747fd6..55a767f 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -10,14 +10,14 @@ build_targets: osx64: Darwin_x86_64-gcc3 channels: alpha: 6.0a5 - release: 5.5 + release: 6.0 versions: - 5.5: - platformVersion: 38.6.0 - detailsURL: https://blog.torproject.org/blog/tor-browser-55-released - download_url: https://www.torproject.org/dist/torbrowser/5.5 + 6.0: + platformVersion: 45.1.1 + detailsURL: https://blog.torproject.org/blog/tor-browser-60-released + download_url: https://www.torproject.org/dist/torbrowser/6.0 incremental_from: - - 5.0.7 + - 5.5.5 migrate_archs: osx32: osx64 osx32: