July 2013 - tor-commits - lists.torproject.org

[tor-browser-bundle/master] Bump gitian-builder to the new version.
by mikeperry＠torproject.org 16 Jul '13

16 Jul '13

commit b866b945a00c4702e9b3b78a33778b19d65d2d28 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Tue Jul 16 16:38:21 2013 -0700 Bump gitian-builder to the new version. --- gitian/versions | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gitian/versions b/gitian/versions index bee45b7..4f971e1 100755 --- a/gitian/versions +++ b/gitian/versions @@ -13,7 +13,7 @@ ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.21-stable MINGW_REV=5830 -GITIAN_TAG=tor-browser-builder-3.0-1 +GITIAN_TAG=tor-browser-builder-3.0-2 OPENSSL_VER=1.0.1e FIREFOX_LANG_VER=17.0.7esr

1 0

[gitian-builder/tor-browser-builder-2] Don't sanitize git commit names. They are authenticated for us.
by mikeperry＠torproject.org 16 Jul '13

16 Jul '13

commit e8ce3082e47ef30f7a195aa7f1ddf04d195188bb Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Jul 16 15:58:23 2013 -0700 Don't sanitize git commit names. They are authenticated for us. Also, we need to specify absolute paths like refs/tags/tagname, to avoid ambiguity between actual tags and other refs. --- bin/gbuild | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bin/gbuild b/bin/gbuild index 9c13704..e78e8a2 100755 --- a/bin/gbuild +++ b/bin/gbuild @@ -204,7 +204,7 @@ build_desc["remotes"].each do |remote| system!("git init inputs/#{dir}") end system!("cd inputs/#{dir} && git fetch --update-head-ok #{sanitize_path(remote["url"], remote["url"])} +refs/tags/*:refs/tags/* +refs/heads/*:refs/heads/*") - commit = sanitize(remote["commit"], remote["commit"]) + commit = remote["commit"] #sanitize(remote["commit"], remote["commit"]) commit = `cd inputs/#{dir} && git log --format=%H -1 #{commit}`.strip raise "error looking up commit for tag #{remote["commit"]}" unless $?.exitstatus == 0 system!("cd inputs/#{dir} && git checkout -q #{commit}")

1 0

[tor-browser-bundle/master] Fix a path error with gitian-builder in verify-tags.sh
by mikeperry＠torproject.org 16 Jul '13

16 Jul '13

commit 4988cad2583f3e9ac876da80d14549332b18d562 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Tue Jul 16 15:40:57 2013 -0700 Fix a path error with gitian-builder in verify-tags.sh --- gitian/verify-tags.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gitian/verify-tags.sh b/gitian/verify-tags.sh index 76e1668..9621065 100755 --- a/gitian/verify-tags.sh +++ b/gitian/verify-tags.sh @@ -60,7 +60,7 @@ tor tor.gpg $TOR_TAG https-everywhere https-everywhere.gpg $HTTPSE_TAG EOF -cd "$WRAPPER_DIR" -verify_git "." "gpg/torbutton.gpg" "$GITIAN_TAG" +cd "$INPUTS_DIR" +verify_git "." "$WRAPPER_DIR/gpg/torbutton.gpg" "$GITIAN_TAG" git checkout "$GITIAN_TAG"

1 0

[tor-browser-bundle/master] Attempt to check out mingw-w64 deterministically and record its hash.
by mikeperry＠torproject.org 16 Jul '13

16 Jul '13

commit 885242b3c1fc14d2318afaa6297feeedb254136b Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Tue Jul 16 15:34:54 2013 -0700 Attempt to check out mingw-w64 deterministically and record its hash. --- gitian/descriptors/windows/gitian-firefox.yml | 2 +- gitian/fetch-inputs.sh | 18 +++++++++--------- gitian/record-inputs.sh | 2 +- gitian/versions | 3 +++ 4 files changed, 14 insertions(+), 11 deletions(-) diff --git a/gitian/descriptors/windows/gitian-firefox.yml b/gitian/descriptors/windows/gitian-firefox.yml index af827c9..f23bd10 100644 --- a/gitian/descriptors/windows/gitian-firefox.yml +++ b/gitian/descriptors/windows/gitian-firefox.yml @@ -21,7 +21,7 @@ remotes: "dir": "tor-browser" files: # XXX: we need to make this input tarball deterministic :/ -- "mingw-w64-svn-snapshot-r5830.zip" +- "mingw-w64-svn-snapshot.zip" - "torbrowser.version" - "re-dzip.sh" - "dzip.sh" diff --git a/gitian/fetch-inputs.sh b/gitian/fetch-inputs.sh index 8fd4725..0526d37 100755 --- a/gitian/fetch-inputs.sh +++ b/gitian/fetch-inputs.sh @@ -142,9 +142,17 @@ cd .. wget -N https://addons.mozilla.org/firefox/downloads/latest/722/addon-722-latest.xpi wget -N https://addons.mozilla.org/firefox/downloads/latest/352704/addon-352704-lat… +# So is mingw: +if [ ! -f mingw-w64-svn-snapshot.zip ]; +then + svn co -r $MINGW_REV https://mingw-w64.svn.sourceforge.net/svnroot/mingw-w64/trunk mingw-w64-svn || exit 1 + # XXX: Path + ZIPOPTS="-x*/.svn/*" faketime -f "2000-01-01 00:00:00" "$WRAPPER_DIR/build-helpers/dzip.sh" mingw-w64-svn-snapshot.zip mingw-w64-svn +fi + # Verify packages with weak or no signatures via direct sha256 check # (OpenSSL is signed with MD5, and OSXSDK is not signed at all) -for i in OPENSSL OSXSDK TOOLCHAIN4 NOSCRIPT PDFJS +for i in OPENSSL OSXSDK TOOLCHAIN4 NOSCRIPT PDFJS MINGW do PACKAGE="${i}_PACKAGE" HASH="${i}_HASH" @@ -154,14 +162,6 @@ do fi done -# So is mingw: -if [ ! -f mingw-w64-svn-snapshot-r5830.zip ]; -then - svn co -r 5830 https://mingw-w64.svn.sourceforge.net/svnroot/mingw-w64/trunk mingw-w64-svn || exit 1 - # XXX: Path - ZIPOPTS="-x*/.svn/*" "$WRAPPER_DIR/build-helpers/dzip.sh" mingw-w64-svn-snapshot-r5830.zip mingw-w64-svn -fi - mkdir -p linux-langpacks mkdir -p win32-langpacks mkdir -p mac-langpacks diff --git a/gitian/record-inputs.sh b/gitian/record-inputs.sh index 4e723b0..d63465b 100755 --- a/gitian/record-inputs.sh +++ b/gitian/record-inputs.sh @@ -16,7 +16,7 @@ rm -f bundle.inputs sha256sum apple* >> bundle.inputs sha256sum multiarch-darwin* >> bundle.inputs -#sha256sum mingw*.zip >> bundle.inputs +sha256sum mingw*.zip >> bundle.inputs echo >> bundle.inputs #sha256sum relativelink-src.zip >> bundle.inputs #sha256sum *-langpacks.zip >> bundle.inputs diff --git a/gitian/versions b/gitian/versions index 7ecf6be..bee45b7 100755 --- a/gitian/versions +++ b/gitian/versions @@ -11,6 +11,7 @@ HTTPSE_TAG=3.2.2 NSIS_TAG=v0.1 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.21-stable +MINGW_REV=5830 GITIAN_TAG=tor-browser-builder-3.0-1 @@ -23,6 +24,7 @@ NOSCRIPT_PACKAGE=addon-722-latest.xpi PDFJS_PACKAGE=addon-352704-latest.xpi TOOLCHAIN4_PACKAGE=multiarch-darwin11-cctools127.2-gcc42-5666.3-llvmgcc42-2336.1-Linux-120724.tar.xz OSXSDK_PACKAGE=apple-uni-sdk-10.6_20110407-0.flosoft1_i386.deb +MINGW_PACKAGE=mingw-w64-svn-snapshot.zip # Hashes for things with weak sigs or no sigs OPENSSL_HASH=f74f15e8c8ff11aa3d5bb5f276d202ec18d7246e95f961db76054199c69c1ae3 @@ -30,6 +32,7 @@ OSXSDK_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc TOOLCHAIN4_HASH=65c1b2d302358a6b95a26c6828a66908a199276193bb0b268f2dcc1a997731e9 NOSCRIPT_HASH=6d5d50dea791dd52caf41ea28199743591776ecd7dd88bcccfcfb7e8de32386d PDFJS_HASH=2e3e6811f5294b24aafeba44e8206ddc81fb15e5934e5166a2c7df3a4405020b +MINGW_HASH=457f11d29f6e95425d190711a73955fa54a98a2113ce2c2bfd76291be71e3e2b OPENSSL_URL=https://www.openssl.org/source/${OPENSSL_PACKAGE} TOOLCHAIN4_URL=https://mingw-and-ndk.googlecode.com/files/${TOOLCHAIN4_PACK…

1 0

[tor-browser-bundle/master] Make dtar.sh less sensitive to weird character input.
by mikeperry＠torproject.org 16 Jul '13

16 Jul '13

commit 8868ff86a0c5e5afe20327520b1b955e3c8754a4 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Tue Jul 16 15:23:59 2013 -0700 Make dtar.sh less sensitive to weird character input. --- gitian/build-helpers/dtar.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gitian/build-helpers/dtar.sh b/gitian/build-helpers/dtar.sh index bc2d89c..282ec2d 100755 --- a/gitian/build-helpers/dtar.sh +++ b/gitian/build-helpers/dtar.sh @@ -8,4 +8,4 @@ shift find $@ -executable -exec chmod 700 {} \; find $@ ! -executable -exec chmod 600 {} \; -tar --no-recursion -Jcvf $TARFILE `find $@ | sort` +find $@ | sort | tar --no-recursion -Jcvf $TARFILE -T -

1 0

[tor-browser-bundle/master] Record and check explicit hashes for stuff without sigs.
by mikeperry＠torproject.org 16 Jul '13

16 Jul '13

commit 71357fc57a1ac014e947a68c74b41a4a6c4412fe Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Tue Jul 16 15:09:05 2013 -0700 Record and check explicit hashes for stuff without sigs. --- gitian/fetch-inputs.sh | 32 ++++++++++++++++++-------------- gitian/versions | 7 +++++++ 2 files changed, 25 insertions(+), 14 deletions(-) diff --git a/gitian/fetch-inputs.sh b/gitian/fetch-inputs.sh index 46a0ca5..8fd4725 100755 --- a/gitian/fetch-inputs.sh +++ b/gitian/fetch-inputs.sh @@ -109,17 +109,17 @@ do fi done -# XXX: This doesn't cover everything. See #8525 for i in TOOLCHAIN4 OSXSDK do PACKAGE="${i}_PACKAGE" URL="${MIRROR_URL}${!PACKAGE}" get "${!PACKAGE}" "${MIRROR_URL}${!PACKAGE}" - echo >&2 "Warning, not verifying signature for $i" done # Verify packages with weak or no signatures via multipath downloads # (OpenSSL is signed with MD5, and OSXSDK is not signed at all) +# XXX: Google won't allow wget -N.. We need to re-download the whole +# TOOLCHAIN4 each time. Rely only on SHA256 for now.. mkdir -p verify cd verify for i in OPENSSL OSXSDK @@ -131,18 +131,10 @@ do mv "${!PACKAGE}" "${!PACKAGE}.removed" exit 1 fi -done -# XXX: Google won't allow wget -N.. We need to re-download the whole -# TOOLCHAIN4 each time :/ -rm -f "$TOOLCHAIN4_PACKAGE" -wget "$TOOLCHAIN4_URL" -for i in OPENSSL OSXSDK TOOLCHAIN4 -do - PACKAGE="${i}_PACKAGE" - if ! diff "${!PACKAGE}" "../${!PACKAGE}"; then - echo "Package ${!PACKAGE} differs from our mirror's version!" - exit 1 - fi + if ! diff "${!PACKAGE}" "../${!PACKAGE}"; then + echo "Package ${!PACKAGE} differs from our mirror's version!" + exit 1 + fi done cd .. @@ -150,6 +142,18 @@ cd .. wget -N https://addons.mozilla.org/firefox/downloads/latest/722/addon-722-latest.xpi wget -N https://addons.mozilla.org/firefox/downloads/latest/352704/addon-352704-lat… +# Verify packages with weak or no signatures via direct sha256 check +# (OpenSSL is signed with MD5, and OSXSDK is not signed at all) +for i in OPENSSL OSXSDK TOOLCHAIN4 NOSCRIPT PDFJS +do + PACKAGE="${i}_PACKAGE" + HASH="${i}_HASH" + if ! echo "${!HASH} ${!PACKAGE}" | sha256sum -c -; then + echo "Package hash for ${!PACKAGE} differs from our locally stored sha256!" + exit 1 + fi +done + # So is mingw: if [ ! -f mingw-w64-svn-snapshot-r5830.zip ]; then diff --git a/gitian/versions b/gitian/versions index 58870ef..7ecf6be 100755 --- a/gitian/versions +++ b/gitian/versions @@ -24,6 +24,13 @@ PDFJS_PACKAGE=addon-352704-latest.xpi TOOLCHAIN4_PACKAGE=multiarch-darwin11-cctools127.2-gcc42-5666.3-llvmgcc42-2336.1-Linux-120724.tar.xz OSXSDK_PACKAGE=apple-uni-sdk-10.6_20110407-0.flosoft1_i386.deb +# Hashes for things with weak sigs or no sigs +OPENSSL_HASH=f74f15e8c8ff11aa3d5bb5f276d202ec18d7246e95f961db76054199c69c1ae3 +OSXSDK_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc +TOOLCHAIN4_HASH=65c1b2d302358a6b95a26c6828a66908a199276193bb0b268f2dcc1a997731e9 +NOSCRIPT_HASH=6d5d50dea791dd52caf41ea28199743591776ecd7dd88bcccfcfb7e8de32386d +PDFJS_HASH=2e3e6811f5294b24aafeba44e8206ddc81fb15e5934e5166a2c7df3a4405020b + OPENSSL_URL=https://www.openssl.org/source/${OPENSSL_PACKAGE} TOOLCHAIN4_URL=https://mingw-and-ndk.googlecode.com/files/${TOOLCHAIN4_PACK… OSXSDK_URL=https://launchpad.net/~flosoft/+archive/cross-apple/+files/${OSX…

1 0

[tor-browser-bundle/master] Fix a build error: explicitly list automake when we need it.
by mikeperry＠torproject.org 16 Jul '13

16 Jul '13

commit 44df35a89a521fa647a075741b17851cdf52b0a4 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Tue Jul 16 14:14:36 2013 -0700 Fix a build error: explicitly list automake when we need it. Automake disappeared from the base package list in the gitian rebase, I guess? --- gitian/descriptors/linux/gitian-tor.yml | 1 + gitian/descriptors/mac/gitian-tor.yml | 1 + gitian/descriptors/windows/gitian-tor.yml | 1 + 3 files changed, 3 insertions(+) diff --git a/gitian/descriptors/linux/gitian-tor.yml b/gitian/descriptors/linux/gitian-tor.yml index 4a4f7e4..d8f4460 100644 --- a/gitian/descriptors/linux/gitian-tor.yml +++ b/gitian/descriptors/linux/gitian-tor.yml @@ -11,6 +11,7 @@ packages: - "zip" - "autoconf" - "autoconf2.13" +- "automake" - "faketime" - "libtool" - "hardening-wrapper" diff --git a/gitian/descriptors/mac/gitian-tor.yml b/gitian/descriptors/mac/gitian-tor.yml index f3f5b91..4d14c71 100644 --- a/gitian/descriptors/mac/gitian-tor.yml +++ b/gitian/descriptors/mac/gitian-tor.yml @@ -10,6 +10,7 @@ packages: - "zip" - "autoconf" - "autoconf2.13" +- "automake" - "faketime" - "libtool" #- "libssl0.9.8" diff --git a/gitian/descriptors/windows/gitian-tor.yml b/gitian/descriptors/windows/gitian-tor.yml index e0cb3b5..799456b 100644 --- a/gitian/descriptors/windows/gitian-tor.yml +++ b/gitian/descriptors/windows/gitian-tor.yml @@ -9,6 +9,7 @@ packages: - "unzip" - "zip" - "autoconf" +- "automake" - "autoconf2.13" - "mingw-w64" - "faketime"

1 0

[tor-browser/tor-browser-17.0.7esr-2] Prevent an exception due to disabling ctypes at compile-time.
by mikeperry＠torproject.org 16 Jul '13

16 Jul '13

commit a230b064a7240c8e799f049157b790a829962825 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Tue Jul 16 14:03:51 2013 -0700 Prevent an exception due to disabling ctypes at compile-time. Telemetry will still be broken if it is enabled, but at least an uncaught exception isn't thrown by default. --- toolkit/components/telemetry/TelemetryPing.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/toolkit/components/telemetry/TelemetryPing.js b/toolkit/components/telemetry/TelemetryPing.js index d1ccc3e..412ffcd 100644 --- a/toolkit/components/telemetry/TelemetryPing.js +++ b/toolkit/components/telemetry/TelemetryPing.js @@ -12,7 +12,8 @@ Cu.import("resource://gre/modules/Services.jsm"); Cu.import("resource://gre/modules/XPCOMUtils.jsm"); Cu.import("resource://gre/modules/NetUtil.jsm"); Cu.import("resource://gre/modules/LightweightThemeManager.jsm"); -Cu.import("resource://gre/modules/ctypes.jsm"); +// ctypes can be disabled at compiletime.. +try { Cu.import("resource://gre/modules/ctypes.jsm"); } catch (e) { } // When modifying the payload in incompatible ways, please bump this version number const PAYLOAD_VERSION = 1;

1 0

[tor-launcher/master] Wrap Ctypes import in a try/catch.
by mikeperry＠torproject.org 16 Jul '13

16 Jul '13

commit 23f662965c7f6c9bc24cb3fd3c06848a2d41498c Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Tue Jul 16 13:27:08 2013 -0700 Wrap Ctypes import in a try/catch. It throws an exception if ctypes is disabled during FF build. --- src/components/tl-process.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/components/tl-process.js b/src/components/tl-process.js index 91a5ec2..c4906e1 100644 --- a/src/components/tl-process.js +++ b/src/components/tl-process.js @@ -8,7 +8,8 @@ const Ci = Components.interfaces; const Cr = Components.results; const Cu = Components.utils; -Cu.import("resource://gre/modules/ctypes.jsm"); +// ctypes can be disabled at build time +try { Cu.import("resource://gre/modules/ctypes.jsm"); } catch(e) {} Cu.import("resource://gre/modules/XPCOMUtils.jsm"); XPCOMUtils.defineLazyModuleGetter(this, "TorLauncherUtil",

1 0

[tor/master] A python script to combin gcov output with git blame
by nickm＠torproject.org 16 Jul '13

16 Jul '13

commit dd44ff663e074d07a8bf8b94dc5d8b9d8dc3fb32 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jul 16 15:31:07 2013 -0400 A python script to combin gcov output with git blame --- contrib/cov-blame | 48 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) diff --git a/contrib/cov-blame b/contrib/cov-blame new file mode 100755 index 0000000..601f211 --- /dev/null +++ b/contrib/cov-blame @@ -0,0 +1,48 @@ +#!/usr/bin/python + +import os +import re +import subprocess +import sys + +def handle_file(source_fname, cov_fname): + + lines_blm = subprocess.Popen(["git", "blame", source_fname], stdout=subprocess.PIPE).stdout.readlines() + lines_cov = open(cov_fname).readlines() + + # XXXX expensive! + while re.match(r'\s*-:\s*0:', lines_cov[0]): + del lines_cov[0] + + if len(lines_blm) != len(lines_cov): + print >>sys.stderr, "MISMATCH IN NUMBER OF LINES in",source_fname + + for b,c in zip(lines_blm, lines_cov): + m = re.match(r'\s*([^\s:]+):', c) + if not m: + print >>sys.stderr, "CONFUSING LINE %r"% c + cov = 'X' + elif m.group(1) == '-': + cov = '-' + elif m.group(1)[0] == '#': + cov = '#' + elif m.group(1)[0].isdigit(): + cov = '1' + else: + print >>sys.stderr, "CONFUSING LINE %r"% c + cov = 'X' + + print cov, b, + +COV_DIR = sys.argv[1] +SOURCES = sys.argv[2:] + +for fn in SOURCES: + _, base = os.path.split(fn) + cfn = os.path.join(COV_DIR, base) + cfn += ".gcov" + if os.path.exists(cfn): + handle_file(fn, cfn) + else: + print >>sys.stderr, "NO FILE EXISTS CALLED ",cfn +

1 0