August 2016 - tor-commits - lists.torproject.org

[tor-browser-bundle/hardened-builds] Release preparations for 6.5a2-hardened
by gk＠torproject.org 01 Aug '16

01 Aug '16

commit 4daeed06ac415ba19617cebfb41b5fe7d26c1fcd Author: Georg Koppen <gk(a)torproject.org> Date: Mon Aug 1 09:44:41 2016 +0000 Release preparations for 6.5a2-hardened Changelog update, versions bumps, config.yml update --- Bundle-Data/Docs/ChangeLog.txt | 33 +++++++++++++++++++++++++++++++++ gitian/versions.alpha | 14 +++++++------- tools/update-responses/config.yml | 12 ++++++------ 3 files changed, 46 insertions(+), 13 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 40a36c9..2cdc4b7 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,36 @@ +Tor Browser 6.5a2-hardened -- August 3 + * All Platforms + * Update Firefox to 45.3.0esr + * Update Tor to tor-0.2.8.5-rc + * Update Torbutton to 1.9.6.1 + * Bug 19689: Use proper parent window for plugin prompt + * Bug 19206: Avoid SOCKS auth and NEWNYM collisions when sharing a tor client + * Bug 19417: Disable asm.js (but add code to clear on New Identity if enabled) + * Bug 19273: Improve external app launch handling and associated warnings + * Bug 8725: Block addon resource and url fingerprinting with nsIContentPolicy + * Update HTTPS-Everywhere to 5.2.1 + * Update NoScript to 2.9.0.12 + * Bug 17406: Include Selfrando into our hardened builds + * Bug 19417: Disable asmjs for now + * Bug 19715: Disable the meek-google pluggable transport option + * Bug 19714: Remove mercurius4 obfs4 bridge + * Bug 19585: Fix regression test for keyboard layout fingerprinting + * Bug 19515: Tor Browser is crashing in graphics code + * Bug 18513: Favicon requests can bypass New Identity + * Bug 19273: Write C++ patch for external app launch handling + * Bug 16998: Isolate preconnect requests to URL bar domain + * Bug 18923: Add script to run all Tor Browser regression tests + * Bug 19478: Prevent millisecond resolution leaks in File API + * Bug 19401: Fix broken PDF download button + * Bug 19411: Don't show update icon if a partial update failed + * Bug 19400: Back out GCC bug workaround to avoid asmjs crash + * Bug 19735: Switch default search engine to DuckDuckGo + * Bug 19276: Disable Xrender due to possible performance regressions + * Bug 19725: Remove old updater files left on disk after upgrade to 6.x + * Build System + * All Platforms + * Bug 19703: Upgrade Go to 1.6.3 + Tor Browser 6.5a1-hardened -- June 8 * All Platforms * Update Firefox to 45.2.0esr diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 29595cc..dba74e7 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -14,15 +14,15 @@ DATA_OUTSIDE_APP_DIR=1 VERIFY_TAGS=1 -FIREFOX_VERSION=45.2.0esr +FIREFOX_VERSION=45.3.0esr TORBROWSER_UPDATE_CHANNEL=hardened TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-6.5-1-build1 -TOR_TAG=tor-0.2.8.3-alpha +TOR_TAG=tor-0.2.8.5-rc TORLAUNCHER_TAG=0.2.8.5 -TORBUTTON_TAG=1.9.6 -HTTPSE_TAG=5.1.9 +TORBUTTON_TAG=1.9.6.1 +HTTPSE_TAG=5.2.1 NSIS_TAG=v0.3.1 ZLIB_TAG=v1.2.8 LIBEVENT_TAG=release-2.0.22-stable @@ -51,7 +51,7 @@ GITIAN_TAG=tor-browser-builder-4-1 OPENSSL_VER=1.0.1t GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION -FIREFOX_LANG_BUILD=build2 +FIREFOX_LANG_BUILD=build1 BINUTILS_VER=2.24 GCC_VER=5.2.0 CLANG_VER=r247539 @@ -72,7 +72,7 @@ NSIS_VER=2.51 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 -NOSCRIPT_PACKAGE=noscript_security_suite-2.9.0.11-fn+sm+fx.xpi +NOSCRIPT_PACKAGE=noscript_security_suite-2.9.0.12-fx+fn+sm.xpi TOOLCHAIN4_OLD_PACKAGE=multiarch-darwin11-cctools127.2-gcc42-5666.3-llvmgcc42-2336.1-Linux-120724.tar.xz CCTOOLS_PACKAGE=cctools.tar.gz OSXSDK_PACKAGE=MacOSX10.7.sdk.tar.gz @@ -106,7 +106,7 @@ GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf OSXSDK_OLD_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc TOOLCHAIN4_OLD_HASH=65c1b2d302358a6b95a26c6828a66908a199276193bb0b268f2dcc1a997731e9 -NOSCRIPT_HASH=fdd965a69188ac651b08a7d3ada54821a89db10a4685aa73ba59edc0b8243390 +NOSCRIPT_HASH=3fa641dcb60455c950cef0c15effa8ca060b3b05405f46f55cbdb922929027e7 CCTOOLS_HASH=e908fdebc2886ee5491ebfc7e7950af451b3c4e2439c2d7a923ed06ad05113e4 MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index 179f882..8eaeae6 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -12,7 +12,7 @@ build_targets: osx32: Darwin_x86-gcc3 osx64: Darwin_x86_64-gcc3 channels: - hardened: 6.5a1-hardened + hardened: 6.5a2-hardened release: 6.0.1 versions: 6.0.1: @@ -26,12 +26,12 @@ versions: osx32: minSupportedOSVersion: 10.8 detailsURL: https://blog.torproject.org/blog/end-life-plan-tor-browser-32-bit-macs#upda… - 6.5a1-hardened: - platformVersion: 45.2.0 - detailsURL: https://blog.torproject.org/blog/tor-browser-65a1-hardened-released - download_url: https://cdn.torproject.org/aus1/torbrowser/6.5a1-hardened + 6.5a2-hardened: + platformVersion: 45.3.0 + detailsURL: https://blog.torproject.org/blog/tor-browser-65a2-hardened-released + download_url: https://cdn.torproject.org/aus1/torbrowser/6.5a2-hardened incremental_from: - - 6.0a5-hardened + - 6.5a1-hardened migrate_archs: osx32: osx64 osx32:

1 0

[tor-browser-bundle/hardened-builds] Update gk's key
by gk＠torproject.org 01 Aug '16

01 Aug '16

commit 61f56b3022059f79246306d8aff6e71fd04c6802 Author: Georg Koppen <gk(a)torproject.org> Date: Sat Jul 30 09:29:24 2016 +0000 Update gk's key --- gitian/gpg/gk.gpg | Bin 33866 -> 72418 bytes gitian/gpg/torbutton.gpg | Bin 55562 -> 94114 bytes 2 files changed, 0 insertions(+), 0 deletions(-) diff --git a/gitian/gpg/gk.gpg b/gitian/gpg/gk.gpg index ad731ca..2f78b14 100644 Binary files a/gitian/gpg/gk.gpg and b/gitian/gpg/gk.gpg differ diff --git a/gitian/gpg/torbutton.gpg b/gitian/gpg/torbutton.gpg index e4a03dd..da40f76 100644 Binary files a/gitian/gpg/torbutton.gpg and b/gitian/gpg/torbutton.gpg differ

1 0

[metrics-lib/master] Adapt to CollecTor's new date format.
by karsten＠torproject.org 01 Aug '16

01 Aug '16

commit 17943b0b5ebe2b66686447fcb9e355173cdac950 Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Sun Jul 31 10:24:18 2016 +0200 Adapt to CollecTor's new date format. We're parsing dates from the CollecTor's Apache directory listings to decide whether or not to fetch a remote file. The CollecTor host was recently upgraded from wheezy to jessie, which apparently changed the date format from dd-MMM-yyyy to yyyy-MM-dd. Adapt to this change. Obviously, parsing dates like this is very fragile. We should soon switch to using CollecTor's index.json file instead, ideally before the next release. --- .../java/org/torproject/descriptor/impl/DescriptorCollectorImpl.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/main/java/org/torproject/descriptor/impl/DescriptorCollectorImpl.java b/src/main/java/org/torproject/descriptor/impl/DescriptorCollectorImpl.java index 9aa3e62..1b35d5f 100644 --- a/src/main/java/org/torproject/descriptor/impl/DescriptorCollectorImpl.java +++ b/src/main/java/org/torproject/descriptor/impl/DescriptorCollectorImpl.java @@ -141,13 +141,13 @@ public class DescriptorCollectorImpl implements DescriptorCollector { final Pattern directoryListingLinePattern = Pattern.compile(".* href=\"([^\"/]+)\"" /* filename */ - + ".*>(\\d{2}-\\w{3}-\\d{4} \\d{2}:\\d{2})\\s*<.*"); /* dateTime */ + + ".*>(\\d{4}-\\w{2}-\\d{2} \\d{2}:\\d{2})\\s*<.*"); /* dateTime */ SortedMap<String, Long> parseDirectoryListing( String remoteDirectory, String directoryListing) { SortedMap<String, Long> remoteFiles = new TreeMap<>(); DateFormat dateTimeFormat = ParseHelper.getDateFormat( - "dd-MMM-yyyy HH:mm"); + "yyyy-MM-dd HH:mm"); try { Scanner scanner = new Scanner(directoryListing); scanner.useDelimiter("\n");

1 0

[translation-tools/master] Removing gettor and gettor_completed
by colin＠torproject.org 01 Aug '16

01 Aug '16

commit 7df4fc1d5f7d761878e43d41d8155d5620a08c78 Author: Colin Childs <colin(a)torproject.org> Date: Sun Jul 31 22:35:03 2016 -0500 Removing gettor and gettor_completed --- config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config b/config index ba731d6..39e9651 100644 --- a/config +++ b/config @@ -7,7 +7,7 @@ TRANSLATION_REPO=/srv/translation.torproject.org/translations/ TX=/usr/bin/tx -PROJECTS="bridgedb bridgedb_completed gettor gettor_completed +PROJECTS="bridgedb bridgedb_completed torcheck torcheck_completed whisperback whisperback_completed https_everywhere https_everywhere_completed liveusb-creator liveusb-creator_completed tails-persistence-setup

1 0