July 2016 - tor-commits - lists.torproject.org

[tor-messenger-build/updater] Replace Firefox with Instantbird in aboutDialog.js
by sukhbir＠torproject.org 29 Jul '16

29 Jul '16

commit af33c3fef7e05c4330b2decb7702639c4d71e564 Author: Sukhbir Singh <sukhbir(a)torproject.org> Date: Mon Jul 18 22:12:45 2016 -0400 Replace Firefox with Instantbird in aboutDialog.js --- projects/instantbird/aboutDialog.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/instantbird/aboutDialog.js b/projects/instantbird/aboutDialog.js index 25b2793..9cfecd1 100644 --- a/projects/instantbird/aboutDialog.js +++ b/projects/instantbird/aboutDialog.js @@ -56,7 +56,7 @@ function init(aEvent) let versionElem = document.getElementById("version"); if (versionElem) { versionElem.textContent = TOR_BROWSER_VERSION + - " (based on Mozilla Firefox " + + " (based on Instantbird " + versionElem.textContent + ")"; } #endif

1 0

[tor-messenger-build/updater] Disable redundant font fingerprinting in start-tor-messenger
by sukhbir＠torproject.org 29 Jul '16

29 Jul '16

commit 1b4692aab5b706a8a02856ae5ebfc464824e0e4e Author: Sukhbir Singh <sukhbir(a)torproject.org> Date: Thu Jul 21 13:47:47 2016 -0400 Disable redundant font fingerprinting in start-tor-messenger --- projects/tor-messenger/start-tor-messenger | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/projects/tor-messenger/start-tor-messenger b/projects/tor-messenger/start-tor-messenger index a1bbb05..dce5411 100755 --- a/projects/tor-messenger/start-tor-messenger +++ b/projects/tor-messenger/start-tor-messenger @@ -332,8 +332,9 @@ EOF setControlPortPasswd ${TOR_CONTROL_PASSWD:='"secret"'} # Set up custom bundled fonts. See fonts-conf(5). -export FONTCONFIG_PATH="${HOME}/TorBrowser/Data/fontconfig" -export FONTCONFIG_FILE="fonts.conf" +# We don't need to prevent font fingerprinting for Tor Messenger. +# export FONTCONFIG_PATH="${HOME}/TorBrowser/Data/fontconfig" +# export FONTCONFIG_FILE="fonts.conf" cd "${HOME}"

1 0

[tor-messenger-build/updater] Add browserMountPoints.inc for aboutDialog.xul on OS X
by sukhbir＠torproject.org 29 Jul '16

29 Jul '16

commit fde79846b12b26249b4d325872943638e6cc7e00 Author: Sukhbir Singh <sukhbir(a)torproject.org> Date: Fri Jul 22 11:31:38 2016 -0400 Add browserMountPoints.inc for aboutDialog.xul on OS X --- projects/instantbird/browserMountPoints.inc | 12 ++++++++++++ projects/instantbird/build | 1 + projects/instantbird/config | 2 ++ 3 files changed, 15 insertions(+) diff --git a/projects/instantbird/browserMountPoints.inc b/projects/instantbird/browserMountPoints.inc new file mode 100644 index 0000000..e4315b0 --- /dev/null +++ b/projects/instantbird/browserMountPoints.inc @@ -0,0 +1,12 @@ +<stringbundleset id="stringbundleset"/> + +<commandset id="mainCommandSet"/> +<commandset id="baseMenuCommandSet"/> +<commandset id="placesCommands"/> + +<broadcasterset id="mainBroadcasterSet"/> + +<keyset id="mainKeyset"/> +<keyset id="baseMenuKeyset"/> + +<menubar id="main-menubar"/> \ No newline at end of file diff --git a/projects/instantbird/build b/projects/instantbird/build index 29f6124..2701591 100644 --- a/projects/instantbird/build +++ b/projects/instantbird/build @@ -54,6 +54,7 @@ done [% IF c("var/osx") -%] cp $rootdir/cert_override.txt im/app/profile +cp $rootdir/browserMountPoints.inc im/content/ [% END -%] cp $rootdir/xmppRegister* im/content/ diff --git a/projects/instantbird/config b/projects/instantbird/config index fe98a83..2e53a6a 100644 --- a/projects/instantbird/config +++ b/projects/instantbird/config @@ -134,6 +134,8 @@ input_files: - filename: trac-16475.mozpatch - filename: OSX-package-as-tar.bz2.mozpatch enable: '[% c("var/osx") %]' + - filename: browserMountPoints.inc + enable: '[% c("var/osx") %]' - filename: 'mozconfig-[% c("var/osname") %]' name: mozconfig - name: python

1 0

[tor-messenger-build/updater] Patch for #13252 is only for OS X
by sukhbir＠torproject.org 29 Jul '16

29 Jul '16

commit a55cf751cb3169712d72b543b18ced84124976a0 Author: Sukhbir Singh <sukhbir(a)torproject.org> Date: Thu Jul 21 13:47:06 2016 -0400 Patch for #13252 is only for OS X --- projects/instantbird/config | 1 + 1 file changed, 1 insertion(+) diff --git a/projects/instantbird/config b/projects/instantbird/config index f6db253..fe98a83 100644 --- a/projects/instantbird/config +++ b/projects/instantbird/config @@ -126,6 +126,7 @@ input_files: - filename: Improve-profile-access-bug-14631-first.mozpatch - filename: Improve-profile-access-bug-14631-second.mozpatch - filename: Mac-outside-app-data-bug-13252.mozpatch + enable: '[% c("var/osx") %]' - filename: Sign-MAR-files-bug-13379.mozpatch - filename: Update-load-local-changes-bug-14392-first.mozpatch - filename: Update-load-local-changes-bug-16940-second.mozpatch

1 0

[tor-messenger-build/updater] Add patch for disabling Tor Launcher locale prompt
by sukhbir＠torproject.org 29 Jul '16

29 Jul '16

commit 4dc992312bdf098d5a8adbec9d05165269eaf670 Author: Sukhbir Singh <sukhbir(a)torproject.org> Date: Thu Jul 21 16:01:12 2016 -0400 Add patch for disabling Tor Launcher locale prompt --- projects/tor-launcher/build | 1 + projects/tor-launcher/config | 1 + projects/tor-launcher/locale-disable.patch | 12 ++++++++++++ 3 files changed, 14 insertions(+) diff --git a/projects/tor-launcher/build b/projects/tor-launcher/build index 8735d33..5b11d89 100644 --- a/projects/tor-launcher/build +++ b/projects/tor-launcher/build @@ -13,5 +13,6 @@ cp ../messenger.png src/chrome/skin/tbb-logo.png cp ../default48.png src/chrome/skin/default48.png [% END -%] patch -p1 < ../logo.patch +patch -p1 < ../locale-disable.patch make package mv pkg/*.xpi [% dest_dir _ '/' _ c('filename') %] diff --git a/projects/tor-launcher/config b/projects/tor-launcher/config index 5b108b7..fac0888 100644 --- a/projects/tor-launcher/config +++ b/projects/tor-launcher/config @@ -10,6 +10,7 @@ input_files: - filename: messenger.png - filename: default48.png - filename: logo.patch + - filename: locale-disable.patch - filename: controlport.patch content: '[% INCLUDE controlport.patch.tmpl -%]' refresh_input: 1 diff --git a/projects/tor-launcher/locale-disable.patch b/projects/tor-launcher/locale-disable.patch new file mode 100644 index 0000000..c076262 --- /dev/null +++ b/projects/tor-launcher/locale-disable.patch @@ -0,0 +1,12 @@ +diff --git a/src/defaults/preferences/prefs.js b/src/defaults/preferences/prefs.js +index 2c0a95e..0a0c299 100644 +--- a/src/defaults/preferences/prefs.js ++++ b/src/defaults/preferences/prefs.js +@@ -1,6 +1,6 @@ + // When presenting the setup wizard, first prompt for locale. + pref("intl.locale.matchOS", true); +-pref("extensions.torlauncher.prompt_for_locale", true); ++pref("extensions.torlauncher.prompt_for_locale", false); + + pref("extensions.torlauncher.loglevel", 4); // 1=verbose, 2=debug, 3=info, 4=note, 5=warn + pref("extensions.torlauncher.logmethod", 1); // 0=stdout, 1=errorconsole, 2=debuglog

1 0

[tor-messenger-build/updater] Outside app directory should be Tor Messenger (#4234)
by sukhbir＠torproject.org 29 Jul '16

29 Jul '16

commit 091f8f9238a72c8943847ba61e1fb2ed15ed15b9 Author: Sukhbir Singh <sukhbir(a)torproject.org> Date: Thu Jul 21 13:46:15 2016 -0400 Outside app directory should be Tor Messenger (#4234) --- projects/instantbird/Firefox-update-process-bug-4234.mozpatch | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/instantbird/Firefox-update-process-bug-4234.mozpatch b/projects/instantbird/Firefox-update-process-bug-4234.mozpatch index 8df0b37..86e527d 100644 --- a/projects/instantbird/Firefox-update-process-bug-4234.mozpatch +++ b/projects/instantbird/Firefox-update-process-bug-4234.mozpatch @@ -1575,7 +1575,7 @@ index 831a373..403e820 100644 + nsCOMPtr<nsIFile> localDir; + rv = appRootDir->GetParent(getter_AddRefs(localDir)); + NS_ENSURE_SUCCESS(rv, rv); -+ rv = localDir->AppendRelativeNativePath(NS_LITERAL_CSTRING("TorBrowser-Data" ++ rv = localDir->AppendRelativeNativePath(NS_LITERAL_CSTRING("TorMessenger-Data" + XPCOM_FILE_PATH_SEPARATOR "UpdateInfo")); +#else + // For Tor Browser, we cannot store update history, etc. under the user's home directory.

1 0

[tor-messenger-build/updater] Outside app directory should be Tor Messenger (#13252)
by sukhbir＠torproject.org 29 Jul '16

29 Jul '16

commit 945735a389a2993b70d84254c2898fc71df21529 Author: Sukhbir Singh <sukhbir(a)torproject.org> Date: Thu Jul 21 13:46:31 2016 -0400 Outside app directory should be Tor Messenger (#13252) --- projects/instantbird/Mac-outside-app-data-bug-13252.mozpatch | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/projects/instantbird/Mac-outside-app-data-bug-13252.mozpatch b/projects/instantbird/Mac-outside-app-data-bug-13252.mozpatch index a68f446..4ddb4c0 100644 --- a/projects/instantbird/Mac-outside-app-data-bug-13252.mozpatch +++ b/projects/instantbird/Mac-outside-app-data-bug-13252.mozpatch @@ -697,7 +697,7 @@ index 403e820..e3c1449 100644 - nsCOMPtr<nsIFile> localDir; - rv = appRootDir->GetParent(getter_AddRefs(localDir)); - NS_ENSURE_SUCCESS(rv, rv); -- rv = localDir->AppendRelativeNativePath(NS_LITERAL_CSTRING("TorBrowser-Data" +- rv = localDir->AppendRelativeNativePath(NS_LITERAL_CSTRING("TorMessenger-Data" - XPCOM_FILE_PATH_SEPARATOR "UpdateInfo")); -#else - // For Tor Browser, we cannot store update history, etc. under the user's home directory. @@ -862,7 +862,7 @@ index 0000000..2b0b100 + nsCOMPtr<nsIFile> tbDataDir; + +#ifdef TOR_BROWSER_DATA_OUTSIDE_APP_DIR -+ nsAutoCString tbDataLeafName(NS_LITERAL_CSTRING("TorBrowser-Data")); ++ nsAutoCString tbDataLeafName(NS_LITERAL_CSTRING("TorMessenger-Data")); + nsCOMPtr<nsIFile> appRootDir; + nsresult rv = GetAppRootDir(aExeFile, getter_AddRefs(appRootDir)); + NS_ENSURE_SUCCESS(rv, rv);

1 0

[tor-messenger-build/updater] Update build.osx to reflect changes in Tor Browser Bundle
by sukhbir＠torproject.org 29 Jul '16

29 Jul '16

commit 2600de07f355ea5e544c5ec338f13cd6c1649f23 Author: Sukhbir Singh <sukhbir(a)torproject.org> Date: Thu Jul 21 13:47:27 2016 -0400 Update build.osx to reflect changes in Tor Browser Bundle --- projects/tor-messenger/build.osx | 33 +++++++++++++++++---------------- 1 file changed, 17 insertions(+), 16 deletions(-) diff --git a/projects/tor-messenger/build.osx b/projects/tor-messenger/build.osx index 99dc5a2..c7f46c7 100755 --- a/projects/tor-messenger/build.osx +++ b/projects/tor-messenger/build.osx @@ -2,7 +2,6 @@ set -e rootdir=$(pwd) tar xf [% c('input_files_by_name/instantbird') %] -mv TorMessenger.app Tor\ Messenger.app tar xf [% c('input_files_by_name/libdmg') %] export PATH="$(pwd)/libdmg-hfsplus:$PATH" @@ -18,36 +17,38 @@ cat $rootdir/Bundle-Data/PTConfigs/bridge_prefs.js >> \ tor-launcher(a)torproject.org/defaults/preferences/prefs.js 7z x $rootdir/[% c('input_files_by_name/tor-browser') %] bsdtar xf '0.unknown partition' -sed -i 's/^SocksPort .*/SocksPort [% c("var/tor_socks_port") %]/' TorBrowser.app/TorBrowser/Data/Tor/torrc-defaults -sed -i 's/^ControlPort .*/ControlPort [% c("var/tor_control_port") %]/' TorBrowser.app/TorBrowser/Data/Tor/torrc-defaults +sed -i 's/^SocksPort .*/SocksPort [% c("var/tor_socks_port") %]/' TorBrowser.app/Contents/Resources/TorBrowser/Tor/torrc-defaults +sed -i 's/^ControlPort .*/ControlPort [% c("var/tor_control_port") %]/' TorBrowser.app/Contents/Resources/TorBrowser/Tor/torrc-defaults # use meek in standalone mode: https://lists.torproject.org/pipermail/tor-dev/2015-November/009887.html -sed -i 's/$ClientTransportPlugin meek exec$ [^ ]\+ -- /\1 /' TorBrowser.app/TorBrowser/Data/Tor/torrc-defaults -mkdir -p tor-launcher(a)torproject.org/TorBrowser/Data +sed -i 's/$ClientTransportPlugin meek exec$ [^ ]\+ -- /\1 /' TorBrowser.app/Contents/Resources/TorBrowser/Tor/torrc-defaults + # trac 17476 -rm -Rf TorBrowser.app/TorBrowser/Tor/PluggableTransports/TorBrowser.app.meek-http-helper/ -rm -f TorBrowser.app/TorBrowser/Tor/PluggableTransports/meek-client-torbrowser -mv TorBrowser.app/TorBrowser/Tor tor-launcher(a)torproject.org/TorBrowser/Tor -mv TorBrowser.app/TorBrowser/Data/Tor tor-launcher(a)torproject.org/TorBrowser/Data/Tor -mv tor-launcher(a)torproject.org $rootdir/Tor\ Messenger.app/Contents/Resources/extensions/ +rm -Rf TorBrowser.app/Contents/Resources/TorBrowser/Tor/PluggableTransports/TorBrowser.app.meek-http-helper/ +rm -f TorBrowser.app/Contents/Resources/TorBrowser/Tor/PluggableTransports/meek-client-torbrowser + +mkdir -p $rootdir/TorMessenger.app/Contents/Resources/distribution/extensions/ +mv tor-launcher(a)torproject.org $rootdir/TorMessenger.app/Contents/Resources/distribution/extensions/ cd .. mkdir ctypes-otr cd ctypes-otr tar xf $rootdir/[% c('input_files_by_name/ctypes-otr') %] -mv ctypes-otr* $rootdir/Tor\ Messenger.app/Contents/Resources/extensions/ctypes-otr@tormessenger +mv ctypes-otr* $rootdir/TorMessenger.app/Contents/Resources/distribution/extensions/ctypes-otr@tormessenger cd .. -mkdir Tor\ Messenger.app/TorMessenger -mv Bundle-Data/mac/TorBrowser/* Tor\ Messenger.app/TorMessenger/ +mkdir TorMessenger.app/TorBrowser/ +mv torbrowser/TorBrowser.app/Contents/Resources/TorBrowser/ $rootdir/TorMessenger.app/Contents/Resources/ + +mv torbrowser/TorBrowser.app/Contents/MacOS/Tor/ $rootdir/TorMessenger.app/Contents/MacOS/ mkdir dmg -mv Tor\ Messenger.app dmg +mv TorMessenger.app dmg cd dmg find . -executable -exec chmod 750 {} \; find . ! -executable -exec chmod 640 {} \; find . -type f | sed -e 's/^\.\///' | sort | xargs -i echo "{}={}" > ../filelist.txt find . -type l | sed -e 's/^\.\///' | sort | xargs -i echo "{}={}" >> ../filelist.txt -mkisofs -D -V "Tor Messenger" -no-pad -R -apple -o ../Tor\ Messenger-uncompressed.dmg -path-list ../filelist.txt -graft-points -gid 20 -dir-mode 0750 -new-dir-mode 0750 +mkisofs -D -V "Tor Messenger" -no-pad -R -apple -o ../TorMessenger-uncompressed.dmg -path-list ../filelist.txt -graft-points -gid 20 -dir-mode 0750 -new-dir-mode 0750 cd .. -dmg dmg Tor\ Messenger-uncompressed.dmg [% dest_dir _ '/' _ c('filename') %] +dmg dmg TorMessenger-uncompressed.dmg [% dest_dir _ '/' _ c('filename') %]

1 0

[tor-messenger-build/updater] Update aboutDialog.js (add Instantbird text)
by sukhbir＠torproject.org 29 Jul '16

29 Jul '16

commit 02d9428a60593788f7a8395b346f73a7a21bf625 Author: Sukhbir Singh <sukhbir(a)torproject.org> Date: Tue Jul 19 14:14:35 2016 -0400 Update aboutDialog.js (add Instantbird text) --- projects/instantbird/aboutDialog.js | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/projects/instantbird/aboutDialog.js b/projects/instantbird/aboutDialog.js index 9cfecd1..b3ae0de 100644 --- a/projects/instantbird/aboutDialog.js +++ b/projects/instantbird/aboutDialog.js @@ -56,8 +56,7 @@ function init(aEvent) let versionElem = document.getElementById("version"); if (versionElem) { versionElem.textContent = TOR_BROWSER_VERSION + - " (based on Instantbird " + - versionElem.textContent + ")"; + " (based on Instantbird Nightly)"; } #endif

1 0

[tor-messenger-build/updater] Add patch for signing MAR files (#13379)
by sukhbir＠torproject.org 29 Jul '16

29 Jul '16

commit df4695f356a3369ef448b8c923c7b9bec4f77f18 Author: Sukhbir Singh <sukhbir(a)torproject.org> Date: Tue Jul 19 14:13:24 2016 -0400 Add patch for signing MAR files (#13379) --- .../instantbird/Sign-MAR-files-bug-13379.mozpatch | 616 +++++++++++++++++++++ projects/instantbird/config | 1 + 2 files changed, 617 insertions(+) diff --git a/projects/instantbird/Sign-MAR-files-bug-13379.mozpatch b/projects/instantbird/Sign-MAR-files-bug-13379.mozpatch new file mode 100644 index 0000000..bfc1e64 --- /dev/null +++ b/projects/instantbird/Sign-MAR-files-bug-13379.mozpatch @@ -0,0 +1,616 @@ +From 94882047c2de9160fd08f33ee2d5541df7baff4d Mon Sep 17 00:00:00 2001 +From: Kathy Brade <brade(a)pearlcrescent.com> +Date: Wed, 17 Dec 2014 16:37:11 -0500 +Subject: Bug 13379: Sign our MAR files. + +Replace Mozilla's MAR signing certificates with our own. +Configure with --enable-signmar (build the signmar tool). +Configure with --enable-verify-mar (when updating, require a valid signature + on the MAR file before it is applied). +Use the Tor Browser version instead of the Firefox version inside the + MAR file info block (necessary to prevent downgrade attacks). +Use NSS on all platforms for checking MAR signatures (Mozilla plans to use + OS-native APIs on Mac OS and they already do so on Windows). So that the + NSS and NSPR libraries the updater depends on can be found at runtime, we + add the firefox directory to the shared library search path on all platforms. +Use SHA512-based MAR signatures instead of the SHA1-based ones that Mozilla + uses. This is implemented inside MAR_USE_SHA512_RSA_SIG #ifdef's and with + a signature algorithm ID of 512 to help avoid collisions with future work + Mozilla might do in this area. + See: https://bugzilla.mozilla.org/show_bug.cgi?id=1105689 + +diff --git a/config/external/nss/Makefile.in b/config/external/nss/Makefile.in +index c91bf5b..e636fa0 100644 +--- a/config/external/nss/Makefile.in ++++ b/config/external/nss/Makefile.in +@@ -283,11 +283,11 @@ endif + NSS_DIRS += \ + nss/cmd/lib \ + nss/cmd/shlibsign \ ++ nss/cmd/certutil \ + $(NULL) + + ifdef ENABLE_TESTS + NSS_DIRS += \ +- nss/cmd/certutil \ + nss/cmd/pk12util \ + nss/cmd/modutil \ + $(NULL) +diff --git a/modules/libmar/sign/mar_sign.c b/modules/libmar/sign/mar_sign.c +index 2a08abf..902c6f2 100644 +--- a/modules/libmar/sign/mar_sign.c ++++ b/modules/libmar/sign/mar_sign.c +@@ -95,7 +95,12 @@ NSSSignBegin(const char *certName, + return -1; + } + +- *ctx = SGN_NewContext (SEC_OID_ISO_SHA1_WITH_RSA_SIGNATURE, *privKey); ++#ifdef MAR_USE_SHA512_RSA_SIG ++ SECOidTag sigAlg = SEC_OID_PKCS1_SHA512_WITH_RSA_ENCRYPTION; ++#else ++ SECOidTag sigAlg = SEC_OID_ISO_SHA1_WITH_RSA_SIGNATURE; ++#endif ++ *ctx = SGN_NewContext(sigAlg, *privKey); + if (!*ctx) { + fprintf(stderr, "ERROR: Could not create signature context\n"); + return -1; +@@ -994,8 +999,12 @@ mar_repackage_and_sign(const char *NSSConfigDir, + signaturePlaceholderOffset = ftello(fpDest); + + for (k = 0; k < certCount; k++) { +- /* Write out the signature algorithm ID, Only an ID of 1 is supported */ +- signatureAlgorithmID = htonl(1); ++ /* Write out the signature algorithm ID. */ ++#ifdef MAR_USE_SHA512_RSA_SIG ++ signatureAlgorithmID = htonl(SIGNATURE_ALGORITHM_ID_SHA512_RSA); ++#else ++ signatureAlgorithmID = htonl(SIGNATURE_ALGORITHM_ID_SHA1_RSA); ++#endif + if (WriteAndUpdateSignatures(fpDest, &signatureAlgorithmID, + sizeof(signatureAlgorithmID), + ctxs, certCount, "num signatures")) { +diff --git a/modules/libmar/sign/moz.build b/modules/libmar/sign/moz.build +index d7b8d1f..849deff 100644 +--- a/modules/libmar/sign/moz.build ++++ b/modules/libmar/sign/moz.build +@@ -19,6 +19,7 @@ LOCAL_INCLUDES += [ + ] + + DEFINES['MAR_NSS'] = True ++DEFINES['MAR_USE_SHA512_RSA_SIG'] = True + + if CONFIG['OS_ARCH'] == 'WINNT': + USE_STATIC_LIBS = True +diff --git a/modules/libmar/src/mar_private.h b/modules/libmar/src/mar_private.h +index e0c2632..add03f5 100644 +--- a/modules/libmar/src/mar_private.h ++++ b/modules/libmar/src/mar_private.h +@@ -21,6 +21,14 @@ + which is 16 bytes */ + #define SIGNATURE_BLOCK_OFFSET 16 + ++/* Signature algorithm IDs. */ ++#define SIGNATURE_ALGORITHM_ID_SHA1_RSA 1 ++#ifdef MAR_USE_SHA512_RSA_SIG ++/* Use 512 as the algorithm ID so it is less likely that we will conflict with ++ whatever Mozilla chooses when they add support for a stronger signature. */ ++#define SIGNATURE_ALGORITHM_ID_SHA512_RSA 512 ++#endif ++ + /* Make sure the file is less than 500MB. We do this to protect against + invalid MAR files. */ + #define MAX_SIZE_OF_MAR_FILE ((int64_t)524288000) +diff --git a/modules/libmar/tool/mar.c b/modules/libmar/tool/mar.c +index 5011c88..ef0a3eb 100644 +--- a/modules/libmar/tool/mar.c ++++ b/modules/libmar/tool/mar.c +@@ -31,7 +31,11 @@ int mar_repackage_and_sign(const char *NSSConfigDir, + const char * dest); + + static void print_version() { ++#ifdef TOR_BROWSER_UPDATE ++ printf("Version: %s\n", TOR_BROWSER_VERSION); ++#else + printf("Version: %s\n", MOZ_APP_VERSION); ++#endif + printf("Default Channel ID: %s\n", MAR_CHANNEL_ID); + } + +@@ -61,7 +65,7 @@ static void print_usage() { + "signed_input_archive.mar base_64_encoded_signature_file " + "changed_signed_output.mar\n"); + printf("(i) is the index of the certificate to extract\n"); +-#if defined(XP_MACOSX) || (defined(XP_WIN) && !defined(MAR_NSS)) ++#if (defined(XP_MACOSX) || defined(XP_WIN)) && !defined(MAR_NSS) + printf("Verify a MAR file:\n"); + printf(" mar [-C workingDir] -D DERFilePath -v signed_archive.mar\n"); + printf("At most %d signature certificate DER files are specified by " +@@ -116,7 +120,11 @@ int main(int argc, char **argv) { + char *NSSConfigDir = NULL; + const char *certNames[MAX_SIGNATURES]; + char *MARChannelID = MAR_CHANNEL_ID; ++#ifdef TOR_BROWSER_UPDATE ++ char *productVersion = TOR_BROWSER_VERSION; ++#else + char *productVersion = MOZ_APP_VERSION; ++#endif + uint32_t k; + int rv = -1; + uint32_t certCount = 0; +@@ -135,8 +143,8 @@ int main(int argc, char **argv) { + #if defined(XP_WIN) && !defined(MAR_NSS) && !defined(NO_SIGN_VERIFY) + memset((void*)certBuffers, 0, sizeof(certBuffers)); + #endif +-#if !defined(NO_SIGN_VERIFY) && ((!defined(MAR_NSS) && defined(XP_WIN)) || \ +- defined(XP_MACOSX)) ++#if !defined(NO_SIGN_VERIFY) && (!defined(MAR_NSS) && (defined(XP_WIN) || \ ++ defined(XP_MACOSX))) + memset(DERFilePaths, 0, sizeof(DERFilePaths)); + memset(fileSizes, 0, sizeof(fileSizes)); + #endif +@@ -167,8 +175,8 @@ int main(int argc, char **argv) { + argv += 2; + argc -= 2; + } +-#if !defined(NO_SIGN_VERIFY) && ((!defined(MAR_NSS) && defined(XP_WIN)) || \ +- defined(XP_MACOSX)) ++#if !defined(NO_SIGN_VERIFY) && (!defined(MAR_NSS) && (defined(XP_WIN) || \ ++ defined(XP_MACOSX))) + /* -D DERFilePath, also matches -D[index] DERFilePath + We allow an index for verifying to be symmetric + with the import and export command line arguments. */ +@@ -343,6 +351,10 @@ int main(int argc, char **argv) { + #if (defined(XP_WIN) || defined(XP_MACOSX)) && !defined(MAR_NSS) + rv = mar_read_entire_file(DERFilePaths[k], MAR_MAX_CERT_SIZE, + &certBuffers[k], &fileSizes[k]); ++ if (rv) { ++ fprintf(stderr, "ERROR: could not read file %s", DERFilePaths[k]); ++ break; ++ } + #else + /* It is somewhat circuitous to look up a CERTCertificate and then pass + * in its DER encoding just so we can later re-create that +@@ -359,11 +371,11 @@ int main(int argc, char **argv) { + } else { + rv = -1; + } +-#endif + if (rv) { +- fprintf(stderr, "ERROR: could not read file %s", DERFilePaths[k]); ++ fprintf(stderr, "ERROR: no certificate named %s", certNames[k]); + break; + } ++#endif + } + + if (!rv) { +diff --git a/modules/libmar/tool/moz.build b/modules/libmar/tool/moz.build +index 5b52124..9fa982e 100644 +--- a/modules/libmar/tool/moz.build ++++ b/modules/libmar/tool/moz.build +@@ -29,7 +29,13 @@ for var in ('MAR_CHANNEL_ID', 'MOZ_APP_VERSION'): + DEFINES[var] = '"%s"' % CONFIG[var] + HOST_DEFINES[var] = DEFINES[var] + ++if CONFIG['TOR_BROWSER_UPDATE']: ++ DEFINES['TOR_BROWSER_UPDATE'] = '%s' % CONFIG['TOR_BROWSER_UPDATE'] ++if CONFIG['TOR_BROWSER_VERSION']: ++ DEFINES['TOR_BROWSER_VERSION'] = '"%s"' % CONFIG['TOR_BROWSER_VERSION'] ++ + if CONFIG['MOZ_ENABLE_SIGNMAR']: ++ DEFINES['MAR_NSS'] = True + USE_LIBS += [ + 'nspr', + 'nss', +@@ -43,12 +49,12 @@ if CONFIG['OS_ARCH'] == 'WINNT': + OS_LIBS += [ + 'ws2_32', + ] +- if CONFIG['MOZ_ENABLE_SIGNMAR']: ++ if CONFIG['MOZ_ENABLE_SIGNMAR'] and not DEFINES['MAR_NSS']: + OS_LIBS += [ + 'crypt32', + 'advapi32', + ] +-elif CONFIG['OS_ARCH'] == 'Darwin': ++elif CONFIG['OS_ARCH'] == 'Darwin' and not DEFINES['MAR_NSS']: + OS_LIBS += [ + '-framework Security', + ] +diff --git a/modules/libmar/verify/cryptox.c b/modules/libmar/verify/cryptox.c +index af34210..f39669b 100644 +--- a/modules/libmar/verify/cryptox.c ++++ b/modules/libmar/verify/cryptox.c +@@ -64,8 +64,12 @@ NSS_VerifyBegin(VFYContext **ctx, + return CryptoX_Error; + } + +- *ctx = VFY_CreateContext(*publicKey, NULL, +- SEC_OID_ISO_SHA1_WITH_RSA_SIGNATURE, NULL); ++#ifdef MAR_USE_SHA512_RSA_SIG ++ SECOidTag sigAlg = SEC_OID_PKCS1_SHA512_WITH_RSA_ENCRYPTION; ++#else ++ SECOidTag sigAlg = SEC_OID_ISO_SHA1_WITH_RSA_SIGNATURE; ++#endif ++ *ctx = VFY_CreateContext(*publicKey, NULL, sigAlg, NULL); + if (*ctx == NULL) { + return CryptoX_Error; + } +diff --git a/modules/libmar/verify/cryptox.h b/modules/libmar/verify/cryptox.h +index 2296b81..ab9b5a3 100644 +--- a/modules/libmar/verify/cryptox.h ++++ b/modules/libmar/verify/cryptox.h +@@ -59,6 +59,10 @@ CryptoX_Result NSS_VerifySignature(VFYContext * const *ctx , + + #elif XP_MACOSX + ++#ifdef MAR_USE_SHA512_RSA_SIG ++#error MAR_USE_SHA512_RSA_SIG is not implemented. ++#endif ++ + #define CryptoX_InvalidHandleValue NULL + #define CryptoX_ProviderHandle void* + #define CryptoX_SignatureHandle void* +@@ -106,6 +110,11 @@ void CryptoMac_FreePublicKey(CryptoX_PublicKey* aPublicKey); + + #elif defined(XP_WIN) + ++#ifdef MAR_USE_SHA512_RSA_SIG ++#error MAR_USE_SHA512_RSA_SIG is not implemented. ++#endif ++ ++ + #include <windows.h> + #include <wincrypt.h> + +diff --git a/modules/libmar/verify/mar_verify.c b/modules/libmar/verify/mar_verify.c +index 07e4354..a9ecaa8 100644 +--- a/modules/libmar/verify/mar_verify.c ++++ b/modules/libmar/verify/mar_verify.c +@@ -277,8 +277,25 @@ mar_extract_and_verify_signatures_fp(FILE *fp, + } + + /* We don't try to verify signatures we don't know about */ +- if (signatureAlgorithmIDs[i] != 1) { +- fprintf(stderr, "ERROR: Unknown signature algorithm ID.\n"); ++#ifdef MAR_USE_SHA512_RSA_SIG ++ const uint32_t kSupportedAlgID = SIGNATURE_ALGORITHM_ID_SHA512_RSA; ++#else ++ const uint32_t kSupportedAlgID = SIGNATURE_ALGORITHM_ID_SHA1_RSA; ++#endif ++ ++ if (signatureAlgorithmIDs[i] != kSupportedAlgID) { ++#ifdef MAR_USE_SHA512_RSA_SIG ++ if (signatureAlgorithmIDs[i] == SIGNATURE_ALGORITHM_ID_SHA1_RSA) { ++ fprintf(stderr, ++ "ERROR: Unsupported signature algorithm (SHA1 with RSA).\n"); ++ } else { ++ fprintf(stderr, "ERROR: Unknown signature algorithm ID %u.\n", ++ signatureAlgorithmIDs[i]); ++ } ++#else ++ fprintf(stderr, "ERROR: Unknown signature algorithm ID %u.\n", ++ signatureAlgorithmIDs[i]); ++#endif + for (i = 0; i < signatureCount; ++i) { + free(extractedSignatures[i]); + } +diff --git a/modules/libmar/verify/moz.build b/modules/libmar/verify/moz.build +index 89f7323..735cf7c 100644 +--- a/modules/libmar/verify/moz.build ++++ b/modules/libmar/verify/moz.build +@@ -15,16 +15,10 @@ FORCE_STATIC_LIB = True + + if CONFIG['OS_ARCH'] == 'WINNT': + USE_STATIC_LIBS = True +-elif CONFIG['OS_ARCH'] == 'Darwin': +- UNIFIED_SOURCES += [ +- 'MacVerifyCrypto.cpp', +- ] +- OS_LIBS += [ +- '-framework Security', +- ] +-else: +- DEFINES['MAR_NSS'] = True +- LOCAL_INCLUDES += ['../sign'] ++ ++DEFINES['MAR_NSS'] = True ++DEFINES['MAR_USE_SHA512_RSA_SIG'] = True ++LOCAL_INCLUDES += ['../sign'] + + LOCAL_INCLUDES += [ + '../src', +diff --git a/toolkit/mozapps/update/updater/Makefile.in b/toolkit/mozapps/update/updater/Makefile.in +index d216298..f2c7540 100644 +--- a/toolkit/mozapps/update/updater/Makefile.in ++++ b/toolkit/mozapps/update/updater/Makefile.in +@@ -15,7 +15,7 @@ endif + + include $(topsrcdir)/config/rules.mk + +-ifneq (,$(filter beta release esr,$(MOZ_UPDATE_CHANNEL))) ++ifneq (,$(filter alpha beta hardened release esr,$(MOZ_UPDATE_CHANNEL))) + PRIMARY_CERT = release_primary.der + SECONDARY_CERT = release_secondary.der + else ifneq (,$(filter nightly aurora nightly-elm nightly-profiling nightly-oak nightly-ux,$(MOZ_UPDATE_CHANNEL))) +diff --git a/toolkit/mozapps/update/updater/release_primary.der b/toolkit/mozapps/update/updater/release_primary.der +index 11417c3..542fb24 100644 +Binary files a/toolkit/mozapps/update/updater/release_primary.der and b/toolkit/mozapps/update/updater/release_primary.der differ +diff --git a/toolkit/mozapps/update/updater/updater-common.build b/toolkit/mozapps/update/updater/updater-common.build +index a39d47d88..a9699c23 100644 +--- a/toolkit/mozapps/update/updater/updater-common.build ++++ b/toolkit/mozapps/update/updater/updater-common.build +@@ -4,6 +4,10 @@ + # License, v. 2.0. If a copy of the MPL was not distributed with this + # file, You can obtain one at http://mozilla.org/MPL/2.0/. + ++DEFINES['MAR_NSS'] = True ++ ++link_with_nss = DEFINES['MAR_NSS'] or (CONFIG['OS_ARCH'] == 'Linux' and CONFIG['MOZ_VERIFY_MAR_SIGNATURE']) ++ + srcs = [ + 'archivereader.cpp', + 'bspatch.cpp', +@@ -41,19 +45,23 @@ if CONFIG['OS_ARCH'] == 'WINNT': + 'ws2_32', + 'shell32', + 'shlwapi', +- 'crypt32', +- 'advapi32', + ] +-elif CONFIG['OS_ARCH'] == 'Linux' and CONFIG['MOZ_VERIFY_MAR_SIGNATURE']: ++ ++ if not link_with_nss: ++ OS_LIBS += [ ++ 'crypt32', ++ 'advapi32', ++ ] ++else: + USE_LIBS += [ +- 'nss', +- 'signmar', + 'updatecommon', + ] +- OS_LIBS += CONFIG['NSPR_LIBS'] +-else: ++ ++if link_with_nss: + USE_LIBS += [ +- 'updatecommon', ++ 'nspr', ++ 'nss', ++ 'signmar', + ] + + USE_LIBS += [ +@@ -81,8 +89,12 @@ if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'cocoa': + ] + OS_LIBS += [ + '-framework Cocoa', +- '-framework Security', + ] ++ ++ if not link_with_nss: ++ OS_LIBS += [ ++ '-framework Security', ++ ] + elif CONFIG['MOZ_WIDGET_TOOLKIT'] == 'gonk': + have_progressui = 1 + srcs += [ +diff --git a/toolkit/mozapps/update/updater/updater.cpp b/toolkit/mozapps/update/updater/updater.cpp +index f362292..2d205a8 100644 +--- a/toolkit/mozapps/update/updater/updater.cpp ++++ b/toolkit/mozapps/update/updater/updater.cpp +@@ -120,11 +120,13 @@ static bool sUseHardLinks = true; + # define MAYBE_USE_HARD_LINKS 0 + #endif + +-#if defined(MOZ_VERIFY_MAR_SIGNATURE) && !defined(XP_WIN) && \ +- !defined(XP_MACOSX) && !defined(MOZ_WIDGET_GONK) ++#if defined(MOZ_VERIFY_MAR_SIGNATURE) ++#if defined(MAR_NSS) || (!defined(XP_WIN) && !defined(XP_MACOSX) && \ ++ !defined(MOZ_WIDGET_GONK)) + #include "nss.h" + #include "prerror.h" + #endif ++#endif + + #ifdef XP_WIN + #ifdef MOZ_MAINTENANCE_SERVICE +@@ -2635,8 +2637,13 @@ UpdateThreadFunc(void *param) + MARStrings.MARChannelID[0] = '\0'; + } + ++#ifdef TOR_BROWSER_UPDATE ++ const char *appVersion = TOR_BROWSER_VERSION; ++#else ++ const char *appVersion = MOZ_APP_VERSION; ++#endif + rv = gArchiveReader.VerifyProductInformation(MARStrings.MARChannelID, +- MOZ_APP_VERSION); ++ appVersion); + } + } + #endif +@@ -2722,12 +2729,11 @@ int NS_main(int argc, NS_tchar **argv) + } + #endif + +-#if defined(MOZ_VERIFY_MAR_SIGNATURE) && !defined(XP_WIN) && \ +- !defined(XP_MACOSX) && !defined(MOZ_WIDGET_GONK) +- // On Windows and Mac we rely on native APIs to do verifications so we don't +- // need to initialize NSS at all there. +- // Otherwise, minimize the amount of NSS we depend on by avoiding all the NSS +- // databases. ++#if defined(MOZ_VERIFY_MAR_SIGNATURE) ++#if defined(MAR_NSS) || (!defined(XP_WIN) && !defined(XP_MACOSX) && \ ++ !defined(MOZ_WIDGET_GONK)) ++ // If using NSS for signature verification, initialize NSS but minimize ++ // the portion we depend on by avoiding all of the NSS databases. + if (NSS_NoDB_Init(NULL) != SECSuccess) { + PRErrorCode error = PR_GetError(); + fprintf(stderr, "Could not initialize NSS: %s (%d)", +@@ -2735,6 +2741,7 @@ int NS_main(int argc, NS_tchar **argv) + _exit(1); + } + #endif ++#endif + + InitProgressUI(&argc, &argv); + +diff --git a/toolkit/xre/moz.build b/toolkit/xre/moz.build +index 3e6a3b6..7d46dfd 100644 +--- a/toolkit/xre/moz.build ++++ b/toolkit/xre/moz.build +@@ -149,6 +149,9 @@ for var in ('APP_VERSION', 'APP_ID'): + if CONFIG['MOZ_BUILD_APP'] == 'browser': + DEFINES['MOZ_BUILD_APP_IS_BROWSER'] = True + ++if CONFIG['MOZ_ENABLE_SIGNMAR'] and CONFIG['TOR_BROWSER_UPDATE']: ++ DEFINES['MAR_NSS'] = True ++ + LOCAL_INCLUDES += [ + '../profile', + '/config', +diff --git a/toolkit/xre/nsUpdateDriver.cpp b/toolkit/xre/nsUpdateDriver.cpp +index ee60aee..0c7b6b0 100644 +--- a/toolkit/xre/nsUpdateDriver.cpp ++++ b/toolkit/xre/nsUpdateDriver.cpp +@@ -39,7 +39,6 @@ + # include <windows.h> + # include <shlwapi.h> + # include "nsWindowsHelpers.h" +-# include "prprf.h" + # define getcwd(path, size) _getcwd(path, size) + # define getpid() GetCurrentProcessId() + #elif defined(XP_UNIX) +@@ -169,36 +168,6 @@ GetInstallDirPath(nsIFile *appDir, nsACString& installDirPath) + return NS_OK; + } + +-#if defined(TOR_BROWSER_UPDATE) && defined(XP_WIN) +-#define PATH_SEPARATOR ";" +- +-// In Tor Browser, updater.exe depends on some DLLs that are located in the +-// app directory. To allow the updater to run when it has been copied into +-// the update directory, we append the app directory to the PATH. +-static nsresult +-AdjustPathForUpdater(nsIFile *appDir) +-{ +- nsAutoCString appPath; +- nsresult rv = appDir->GetNativePath(appPath); +- NS_ENSURE_SUCCESS(rv, rv); +- +- char *s = nullptr; +- char *pathValue = PR_GetEnv("PATH"); +- if ((nullptr == pathValue) || ('\0' == *pathValue)) { +- s = PR_smprintf("PATH=%s", appPath.get()); +- } else { +- s = PR_smprintf("PATH=%s" PATH_SEPARATOR "%s", pathValue, appPath.get()); +- } +- +- // We intentionally leak the value that is passed into PR_SetEnv() because +- // the environment will hold a pointer to it. +- if ((nullptr == s) || (PR_SUCCESS != PR_SetEnv(s))) +- return NS_ERROR_FAILURE; +- +- return NS_OK; +-} +-#endif +- + #ifdef DEBUG + static void + dump_argv(const char *aPrefix, char **argv, int argc) +@@ -500,13 +469,22 @@ CopyUpdaterIntoUpdateDir(nsIFile *greDir, nsIFile *appDir, nsIFile *updateDir, + * Appends the specified path to the library path. + * This is used so that updater can find libmozsqlite3.so and other shared libs. + * +- * @param pathToAppend A new library path to prepend to LD_LIBRARY_PATH ++ * @param pathToAppend A new library path to prepend to the dynamic linker's search path. + */ +-#if defined(MOZ_VERIFY_MAR_SIGNATURE) && !defined(XP_WIN) && \ +- !defined(XP_MACOSX) && !defined(MOZ_WIDGET_GONK) ++#if defined(MOZ_VERIFY_MAR_SIGNATURE) && (defined(MAR_NSS) || \ ++ (!defined(XP_WIN) && !defined(XP_MACOSX) && !defined(MOZ_WIDGET_GONK))) + #include "prprf.h" ++#if defined(XP_WIN) ++#define PATH_SEPARATOR ";" ++#define LD_LIBRARY_PATH_ENVVAR_NAME "PATH" ++#else + #define PATH_SEPARATOR ":" ++#if defined(XP_MACOSX) ++#define LD_LIBRARY_PATH_ENVVAR_NAME "DYLD_LIBRARY_PATH" ++#else + #define LD_LIBRARY_PATH_ENVVAR_NAME "LD_LIBRARY_PATH" ++#endif ++#endif + static void + AppendToLibPath(const char *pathToAppend) + { +@@ -732,16 +710,20 @@ SwitchToUpdatedApp(nsIFile *greDir, nsIFile *updateDir, + if (gSafeMode) { + PR_SetEnv("MOZ_SAFE_MODE_RESTART=1"); + } +-#if defined(MOZ_VERIFY_MAR_SIGNATURE) && !defined(XP_WIN) && \ +- !defined(XP_MACOSX) && !defined(MOZ_WIDGET_GONK) +- AppendToLibPath(installDirPath.get()); +-#endif + +-#if defined(TOR_BROWSER_UPDATE) && defined(XP_WIN) +- nsresult rv2 = AdjustPathForUpdater(appDir); +- if (NS_FAILED(rv2)) { +- LOG(("SwitchToUpdatedApp -- AdjustPathForUpdater failed (0x%x)\n", rv2)); ++#if defined(MOZ_VERIFY_MAR_SIGNATURE) && (defined(MAR_NSS) || \ ++ (!defined(XP_WIN) && !defined(XP_MACOSX) && !defined(MOZ_WIDGET_GONK))) ++#ifdef TOR_BROWSER_UPDATE ++ nsAutoCString appPath; ++ nsresult rv2 = appDir->GetNativePath(appPath); ++ if (NS_SUCCEEDED(rv2)) { ++ AppendToLibPath(appPath.get()); ++ } else { ++ LOG(("SwitchToUpdatedApp -- appDir->GetNativePath() failed (0x%x)\n", rv2)); + } ++#else ++ AppendToLibPath(installDirPath.get()); ++#endif + #endif + + LOG(("spawning updater process for replacing [%s]\n", updaterPath.get())); +@@ -1020,22 +1002,25 @@ ApplyUpdate(nsIFile *greDir, nsIFile *updateDir, nsIFile *statusFile, + if (gSafeMode) { + PR_SetEnv("MOZ_SAFE_MODE_RESTART=1"); + } +-#if defined(MOZ_VERIFY_MAR_SIGNATURE) && !defined(XP_WIN) && \ +- !defined(XP_MACOSX) && !defined(MOZ_WIDGET_GONK) ++#if defined(MOZ_VERIFY_MAR_SIGNATURE) && (defined(MAR_NSS) || \ ++ (!defined(XP_WIN) && !defined(XP_MACOSX) && !defined(MOZ_WIDGET_GONK))) ++#ifdef TOR_BROWSER_UPDATE ++ nsAutoCString appPath; ++ nsresult rv2 = appDir->GetNativePath(appPath); ++ if (NS_SUCCEEDED(rv2)) { ++ AppendToLibPath(appPath.get()); ++ } else { ++ LOG(("ApplyUpdate -- appDir->GetNativePath() failed (0x%x)\n", rv2)); ++ } ++#else + AppendToLibPath(installDirPath.get()); + #endif ++#endif + + if (isOSUpdate) { + PR_SetEnv("MOZ_OS_UPDATE=1"); + } + +-#if defined(TOR_BROWSER_UPDATE) && defined(XP_WIN) +- nsresult rv2 = AdjustPathForUpdater(appDir); +- if (NS_FAILED(rv2)) { +- LOG(("ApplyUpdate -- AdjustPathForUpdater failed (0x%x)\n", rv2)); +- } +-#endif +- + #if defined(MOZ_WIDGET_GONK) + // We want the updater to be CPU friendly and not subject to being killed by + // the low memory killer, so we pass in some preferences to allow it to +-- +cgit v0.10.2 + diff --git a/projects/instantbird/config b/projects/instantbird/config index 3c5871d..f6db253 100644 --- a/projects/instantbird/config +++ b/projects/instantbird/config @@ -126,6 +126,7 @@ input_files: - filename: Improve-profile-access-bug-14631-first.mozpatch - filename: Improve-profile-access-bug-14631-second.mozpatch - filename: Mac-outside-app-data-bug-13252.mozpatch + - filename: Sign-MAR-files-bug-13379.mozpatch - filename: Update-load-local-changes-bug-14392-first.mozpatch - filename: Update-load-local-changes-bug-16940-second.mozpatch - filename: aboutTBUpdateLogo.png

1 0