April 2017 - tor-commits - lists.torproject.org

[tor-browser-bundle/master] Bug 20683: Integrate Selfrando into alpha Linux builds
by gk＠torproject.org 07 Apr '17

07 Apr '17

commit 0ea68f848f54aaeceeeed22dc1496d3723cbe128 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Apr 7 16:50:29 2017 +0000 Bug 20683: Integrate Selfrando into alpha Linux builds Selfrando is a new defense against code reuse attacks developed by the Redactor and Readactor++ people. We should give it a wider testing audience by including it in the alpha series. This is currently only available for 64bit Linux builds, though. Supporting other platforms and architectures is work in progress. --- RelativeLink/start-tor-browser | 1 + gitian/descriptors/linux/gitian-firefox.yml | 17 +++++++++++++ gitian/descriptors/linux/gitian-utils.yml | 38 ++++++++++++++++++++++++++++ gitian/fetch-inputs.sh | 4 ++- gitian/gpg/ELFUTILS.gpg | Bin 0 -> 10483 bytes gitian/mkbundle-linux.sh | 13 ++++++---- gitian/verify-tags.sh | 3 ++- gitian/versions.alpha | 4 +++ gitian/versions.nightly | 4 +++ 9 files changed, 77 insertions(+), 7 deletions(-) diff --git a/RelativeLink/start-tor-browser b/RelativeLink/start-tor-browser index a78b367..2dd40fc 100755 --- a/RelativeLink/start-tor-browser +++ b/RelativeLink/start-tor-browser @@ -270,6 +270,7 @@ fi LD_LIBRARY_PATH="${HOME}/TorBrowser/Tor/" export LD_LIBRARY_PATH +export SELFRANDO_write_layout_file= function setControlPortPasswd() { local ctrlPasswd=$1 diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index d607f6a..b20941a 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -27,6 +27,8 @@ reference_datetime: "2000-01-01 00:00:00" remotes: - "url": "https://git.torproject.org/tor-browser.git" "dir": "tor-browser" +- "url": "https://github.com/immunant/selfrando.git" + "dir": "selfrando" files: - "binutils-linux32-utils.zip" - "binutils-linux64-utils.zip" @@ -36,6 +38,8 @@ files: - "re-dzip.sh" - "dzip.sh" - "versions" +# XXX: 64bits only for now :(, see #20683. +- "selfrando-linux64-utils.zip" script: | source versions INSTDIR="$HOME/install" @@ -53,6 +57,11 @@ script: | export DEB_BUILD_HARDENING_FORMAT=1 export DEB_BUILD_HARDENING_PIE=1 # + # XXX: 64bits only for now :(, see #20683. + if [ $GBUILD_BITS == "64" ]; + then + unzip -d $INSTDIR selfrando-linux64-utils.zip + fi # Preparing Binutils and GCC for Tor Browser unzip -d $INSTDIR binutils-linux$GBUILD_BITS-utils.zip # Make sure gold is used with the hardening wrapper for full RELRO, see @@ -94,6 +103,14 @@ script: | find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" rm -f configure rm -f js/src/configure + # XXX: 64bits only for now :(, see #20683. + if [ $GBUILD_BITS == "64" ]; + then + # Selfrando wrapper + export PATH="$HOME/build/selfrando/Tools/TorBrowser/tc-wrapper/:$PATH" + # We need to avoid the shuffling while building as this breaks compilation + export SELFRANDO_skip_shuffle= + fi make -f client.mk configure CONFIGURE_ARGS="--with-tor-browser-version=${TORBROWSER_VERSION} --with-distribution-id=org.torproject --enable-update-channel=${TORBROWSER_UPDATE_CHANNEL} --enable-bundled-fonts" find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" make $MAKEOPTS -f client.mk build diff --git a/gitian/descriptors/linux/gitian-utils.yml b/gitian/descriptors/linux/gitian-utils.yml index d10422b..1cadb61 100644 --- a/gitian/descriptors/linux/gitian-utils.yml +++ b/gitian/descriptors/linux/gitian-utils.yml @@ -24,10 +24,14 @@ packages: - "libssl-dev" # Needed for binutils (64bit) as we are building with PIE enabled. - "libstdc++6-4.7-pic" +# Needed for Selfrando +- "scons" reference_datetime: "2000-01-01 00:00:00" remotes: - "url": "https://github.com/libevent/libevent.git" "dir": "libevent" +- "url": "https://github.com/immunant/selfrando.git" + "dir": "selfrando" files: - "binutils.tar.bz2" - "gcc.tar.bz2" @@ -37,6 +41,7 @@ files: - "go.tar.gz" - "versions" - "dzip.sh" +- "elfutils.tar.bz2" script: | INSTDIR="$HOME/install" source versions @@ -52,6 +57,12 @@ script: | export DEB_BUILD_HARDENING_FORMAT=1 export DEB_BUILD_HARDENING_PIE=1 + ARCH="" + if [ $GBUILD_BITS == "64" ]; + then + ARCH="64" + fi + # Building Binutils tar xjf binutils.tar.bz2 # The libstdc++ shipped by default is non-PIC which breaks the binutils build @@ -86,6 +97,28 @@ script: | cd .. export DEB_BUILD_HARDENING_FORMAT=1 + export PATH="$INSTDIR/binutils/bin:$INSTDIR/gcc/bin:$PATH" + export LD_LIBRARY_PATH="$INSTDIR/gcc/lib$ARCH" + + # XXX: 64bits only for now :(, see #20683. + if [ $GBUILD_BITS == "64" ]; + then + # Building Elfutils + tar xjf elfutils.tar.bz2 + cd elfutils*/ + ./configure --prefix=$INSTDIR/elfutils + make $MAKEOPTS + make install + cd .. + + # Building Selfrando + cd selfrando + scons -Q arch=x86_64 LIBELF_PATH="$INSTDIR/elfutils" FORCE_INPLACE=1 DEBUG_LEVEL=env WRITE_LAYOUTS=env LOG=console + mkdir -p $INSTDIR/selfrando + cp out/x86_64/bin/* $INSTDIR/selfrando/ + cd .. + fi + # Building Libevent cd libevent ./autogen.sh @@ -157,4 +190,9 @@ script: | ~/build/dzip.sh libevent-${LIBEVENT_TAG#release-}-linux$GBUILD_BITS-utils.zip libevent ~/build/dzip.sh gmp-$GMP_VER-linux$GBUILD_BITS-utils.zip gmp ~/build/dzip.sh go-$GO_VER-linux$GBUILD_BITS-utils.zip go + # XXX: 64bits only for now :(, see #20683. + if [ $GBUILD_BITS == "64" ]; + then + ~/build/dzip.sh selfrando-$SELFRANDO_TAG-linux$GBUILD_BITS-utils.zip selfrando + fi cp *utils.zip $OUTDIR/ diff --git a/gitian/fetch-inputs.sh b/gitian/fetch-inputs.sh index b7fcf36..c110eb8 100755 --- a/gitian/fetch-inputs.sh +++ b/gitian/fetch-inputs.sh @@ -113,7 +113,7 @@ update_git() { ############################################################################## # Get+verify sigs that exist -for i in OPENSSL BINUTILS GCC PYTHON_MSI GMP LLVM CFE LIBCXX LIBCXXABI +for i in OPENSSL BINUTILS GCC PYTHON_MSI GMP LLVM CFE LIBCXX LIBCXXABI ELFUTILS do PACKAGE="${i}_PACKAGE" URL="${i}_URL" @@ -252,6 +252,7 @@ ln -sf "$GO_PACKAGE" go.tar.gz ln -sf "$NSIS_PACKAGE" nsis.tar.bz2 ln -sf "$NSIS_DEBIAN_PACKAGE" nsis-debian.tar.xz ln -sf "$YASM_PACKAGE" yasm.tar.gz +ln -sf "$ELFUTILS_PACKAGE" elfutils.tar.bz2 # Fetch latest gitian-builder itself # XXX - this is broken if a non-standard inputs dir is selected using the command line flag. @@ -303,6 +304,7 @@ depot_tools https://chromium.googlesource.com/chromium/tools/depot_too go-webrtc https://github.com/keroserene/go-webrtc $GO_WEBRTC_TAG snowflake https://git.torproject.org/pluggable-transports/snowflake.git $SNOWFLAKE_TAG uniuri https://github.com/dchest/uniuri $UNIURI_TAG +selfrando https://github.com/immunant/selfrando.git $SELFRANDO_TAG EOF # HTTPS-Everywhere is special, too. We need to initialize the git submodules and diff --git a/gitian/gpg/ELFUTILS.gpg b/gitian/gpg/ELFUTILS.gpg new file mode 100644 index 0000000..f1cd4b3 Binary files /dev/null and b/gitian/gpg/ELFUTILS.gpg differ diff --git a/gitian/mkbundle-linux.sh b/gitian/mkbundle-linux.sh index 6dbbe51..0a1613f 100755 --- a/gitian/mkbundle-linux.sh +++ b/gitian/mkbundle-linux.sh @@ -35,7 +35,7 @@ fi if [ -z "$VM_MEMORY" ]; then - export VM_MEMORY=4000 + export VM_MEMORY=6000 fi ./make-vms.sh @@ -99,7 +99,7 @@ then fi cd $GITIAN_DIR - +# XXX: 64bits selfrando only for now :(, see #20683. if [ ! -f inputs/binutils-$BINUTILS_VER-linux32-utils.zip -o \ ! -f inputs/binutils-$BINUTILS_VER-linux64-utils.zip -o \ ! -f inputs/gcc-$GCC_VER-linux32-utils.zip -o \ @@ -111,13 +111,14 @@ if [ ! -f inputs/binutils-$BINUTILS_VER-linux32-utils.zip -o \ ! -f inputs/gmp-$GMP_VER-linux32-utils.zip -o \ ! -f inputs/gmp-$GMP_VER-linux64-utils.zip -o \ ! -f inputs/go-$GO_VER-linux32-utils.zip -o \ - ! -f inputs/go-$GO_VER-linux64-utils.zip ]; + ! -f inputs/go-$GO_VER-linux64-utils.zip -o \ + ! -f inputs/selfrando-$SELFRANDO_TAG-linux64-utils.zip ]; then echo echo "****** Starting Utilities Component of Linux Bundle (1/7 for Linux) ******" echo - ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit libevent=$LIBEVENT_TAG $DESCRIPTOR_DIR/linux/gitian-utils.yml + ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit libevent=$LIBEVENT_TAG,selfrando=$SELFRANDO_TAG $DESCRIPTOR_DIR/linux/gitian-utils.yml if [ $? -ne 0 ]; then #mv var/build.log ./utils-fail-linux.log.`date +%Y%m%d%H%M%S` @@ -138,6 +139,7 @@ then ln -sf gmp-$GMP_VER-linux64-utils.zip gmp-linux64-utils.zip ln -sf go-$GO_VER-linux32-utils.zip go-linux32-utils.zip ln -sf go-$GO_VER-linux64-utils.zip go-linux64-utils.zip + ln -sf selfrando-$SELFRANDO_TAG-linux64-utils.zip selfrando-linux64-utils.zip cd .. #cp -a result/utils-linux-res.yml inputs/ else @@ -159,6 +161,7 @@ else ln -sf gmp-$GMP_VER-linux64-utils.zip gmp-linux64-utils.zip ln -sf go-$GO_VER-linux32-utils.zip go-linux32-utils.zip ln -sf go-$GO_VER-linux64-utils.zip go-linux64-utils.zip + ln -sf selfrando-$SELFRANDO_TAG-linux64-utils.zip selfrando-linux64-utils.zip cd .. fi @@ -193,7 +196,7 @@ then echo "****** Starting TorBrowser Component of Linux Bundle (3/7 for Linux) ******" echo - ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit tor-browser=$TORBROWSER_TAG,faketime=$FAKETIME_TAG $DESCRIPTOR_DIR/linux/gitian-firefox.yml + ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit tor-browser=$TORBROWSER_TAG,faketime=$FAKETIME_TAG,selfrando=$SELFRANDO_TAG $DESCRIPTOR_DIR/linux/gitian-firefox.yml if [ $? -ne 0 ]; then #mv var/build.log ./firefox-fail-linux.log.`date +%Y%m%d%H%M%S` diff --git a/gitian/verify-tags.sh b/gitian/verify-tags.sh index dc207f5..7d551b8 100755 --- a/gitian/verify-tags.sh +++ b/gitian/verify-tags.sh @@ -125,10 +125,11 @@ depot_tools $DEPOT_TOOLS_TAG go-webrtc $GO_WEBRTC_TAG snowflake $SNOWFLAKE_TAG uniuri $UNIURI_TAG +selfrando $SELFRANDO_TAG EOF # Verify signatures on signed packages -for i in OPENSSL BINUTILS GCC PYTHON_MSI GMP LLVM CFE LIBCXX LIBCXXABI +for i in OPENSSL BINUTILS GCC PYTHON_MSI GMP LLVM CFE LIBCXX LIBCXXABI ELFUTILS do PACKAGE="${i}_PACKAGE" URL="${i}_URL" diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 2e6fb2c..be79310 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -47,6 +47,7 @@ WEBRTC_TAG=c279861207c5b15fc51069e96595782350e0ac12 # https://chromium.googlesou GO_WEBRTC_TAG=ab1b64862e0c4b4182010699911c2c5818f0a101 SNOWFLAKE_TAG=9f2e9a6ecb696149708716ca06ce842df03cf492 UNIURI_TAG=8902c56451e9b58ff940bbe5fec35d5f9c04584a +SELFRANDO_TAG=40bfacc7175301bcb9e01d2ad05e72c0e35291c8 GITIAN_TAG=tor-browser-builder-4-2 @@ -71,6 +72,7 @@ GO14_VER=1.4.3 GO_VER=1.7.5 NSIS_VER=2.51 YASM_VER=1.2.0 +ELFUTILS_VER=0.160 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz @@ -105,6 +107,7 @@ NOTOKRFONT_PACKAGE=NotoSansKR-Regular.otf NOTOSCFONT_PACKAGE=NotoSansSC-Regular.otf NOTOTCFONT_PACKAGE=NotoSansTC-Regular.otf YASM_PACKAGE=yasm-${YASM_VER}.tar.gz +ELFUTILS_PACKAGE=elfutils-${ELFUTILS_VER}.tar.bz2 # Hashes for packages with weak sigs or no sigs OPENSSL_HASH=6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 @@ -167,3 +170,4 @@ NOTOKRFONT_URL=${NOTOCJKBASE_URL}/${NOTOKRFONT_PACKAGE} NOTOSCFONT_URL=${NOTOCJKBASE_URL}/${NOTOSCFONT_PACKAGE} NOTOTCFONT_URL=${NOTOCJKBASE_URL}/${NOTOTCFONT_PACKAGE} YASM_URL=https://www.tortall.net/projects/yasm/releases/${YASM_PACKAGE} +ELFUTILS_URL=https://fedorahosted.org/releases/e/l/elfutils/${ELFUTILS_VER}/${ELFUTILS_PACKAGE} diff --git a/gitian/versions.nightly b/gitian/versions.nightly index b45e7d6..43c5234 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -54,6 +54,7 @@ WEBRTC_TAG=c279861207c5b15fc51069e96595782350e0ac12 # https://chromium.googlesou GO_WEBRTC_TAG=master SNOWFLAKE_TAG=master UNIURI_TAG=master +SELFRANDO_TAG=62932627f30551e7b0b8e12d0453100f0eede017 GITIAN_TAG=tor-browser-builder-4 @@ -78,6 +79,7 @@ GO14_VER=1.4.3 GO_VER=1.7.5 NSIS_VER=2.51 YASM_VER=1.2.0 +ELFUTILS_VER=0.166 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz @@ -112,6 +114,7 @@ NOTOKRFONT_PACKAGE=NotoSansKR-Regular.otf NOTOSCFONT_PACKAGE=NotoSansSC-Regular.otf NOTOTCFONT_PACKAGE=NotoSansTC-Regular.otf YASM_PACKAGE=yasm-${YASM_VER}.tar.gz +ELFUTILS_PACKAGE=elfutils-${ELFUTILS_VER}.tar.bz2 # Hashes for packages with weak sigs or no sigs OPENSSL_HASH=6b3977c61f2aedf0f96367dcfb5c6e578cf37e7b8d913b4ecb6643c3cb88d8c0 @@ -174,3 +177,4 @@ NOTOKRFONT_URL=${NOTOCJKBASE_URL}/${NOTOKRFONT_PACKAGE} NOTOSCFONT_URL=${NOTOCJKBASE_URL}/${NOTOSCFONT_PACKAGE} NOTOTCFONT_URL=${NOTOCJKBASE_URL}/${NOTOTCFONT_PACKAGE} YASM_URL=https://www.tortall.net/projects/yasm/releases/${YASM_PACKAGE} +ELFUTILS_URL=https://fedorahosted.org/releases/e/l/elfutils/${ELFUTILS_VER}/${ELFUTILS_PACKAGE}

1 0

[tor/master] Merge remote-tracking branch 'dgoulet/ticket21893_031_01'
by nickm＠torproject.org 07 Apr '17

07 Apr '17

commit 506b4bfabaf823225c34172fae6dd405cfe1b58e Merge: d33c362 dff5000 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Apr 7 11:04:06 2017 -0400 Merge remote-tracking branch 'dgoulet/ticket21893_031_01' src/or/or.h | 10 ++++++++++ src/or/routerparse.c | 4 ++++ 2 files changed, 14 insertions(+)

1 0

[tor/master] prop224: Flag router with HSIntro/HSDir using protover
by nickm＠torproject.org 07 Apr '17

07 Apr '17

commit dff50001ec9b805f169a7b1eacb9e45a6490f98a Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Feb 14 10:45:19 2017 -0500 prop224: Flag router with HSIntro/HSDir using protover Note down in the routerstatus_t of a node if the router supports the HSIntro=4 version for the ed25519 authentication key and HSDir=2 version for the v3 descriptor supports. Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/or/or.h | 10 ++++++++++ src/or/routerparse.c | 4 ++++ 2 files changed, 14 insertions(+) diff --git a/src/or/or.h b/src/or/or.h index 8a73cc2..f36b12b 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -2278,6 +2278,16 @@ typedef struct routerstatus_t { * ed25519 identity keys on a link handshake. */ unsigned int supports_ed25519_link_handshake:1; + /** True iff this router has a protocol list that allows it to be an + * introduction point supporting ed25519 authentication key which is part of + * the v3 protocol detailed in proposal 224. This requires HSIntro=4. */ + unsigned int supports_ed25519_hs_intro : 1; + + /** True iff this router has a protocol list that allows it to be an hidden + * service directory supporting version 3 as seen in proposal 224. This + * requires HSDir=2. */ + unsigned int supports_v3_hsdir : 1; + unsigned int has_bandwidth:1; /**< The vote/consensus had bw info */ unsigned int has_exitsummary:1; /**< The vote/consensus had exit summaries */ unsigned int bw_is_unmeasured:1; /**< This is a consensus entry, with diff --git a/src/or/routerparse.c b/src/or/routerparse.c index 7220b99..fc0a4ab 100644 --- a/src/or/routerparse.c +++ b/src/or/routerparse.c @@ -2667,6 +2667,10 @@ routerstatus_parse_entry_from_string(memarea_t *area, protocol_list_supports_protocol(tok->args[0], PRT_RELAY, 2); rs->supports_ed25519_link_handshake = protocol_list_supports_protocol(tok->args[0], PRT_LINKAUTH, 3); + rs->supports_ed25519_hs_intro = + protocol_list_supports_protocol(tok->args[0], PRT_HSINTRO, 4); + rs->supports_v3_hsdir = + protocol_list_supports_protocol(tok->args[0], PRT_HSDIR, 2); } if ((tok = find_opt_by_keyword(tokens, K_V))) { tor_assert(tok->n_args == 1);

1 0

[torbutton/master] Revert "Bug 21201.1: Use new svg.disabled pref"
by gk＠torproject.org 07 Apr '17

07 Apr '17

commit de57f2c4ef125ca1334e83efa1949770a87e7c38 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Apr 7 08:26:32 2017 +0000 Revert "Bug 21201.1: Use new svg.disabled pref" This reverts commit 1b7ce9f53f6a27e8684fdcda0b3be086a914d054. We did not backport Mozilla's patch which uses the new preference. Thus we need to stick to the old one for now. Closes #21885. --- src/modules/security-prefs.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/modules/security-prefs.js b/src/modules/security-prefs.js index f508b87..4a39ca8 100644 --- a/src/modules/security-prefs.js +++ b/src/modules/security-prefs.js @@ -29,7 +29,7 @@ const kSecuritySettings = { "noscript.global" : [, false, false, false, true ], "noscript.globalHttpsWhitelist" : [, false, true, true, false], "noscript.forbidFonts" : [, true, false, false, false], - "svg.disabled" : [, true, false, false, false], + "svg.in-content.enabled" : [, false, true, true, true ], }; // The Security Settings prefs in question.

1 0

[tor-browser-build/master] Bug 21239: Adapt Linux Firefox descriptor to ESR52
by boklm＠torproject.org 07 Apr '17

07 Apr '17

commit 67fbf56501a186f0934db144c7087834229d5da4 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri Apr 7 13:33:19 2017 +0200 Bug 21239: Adapt Linux Firefox descriptor to ESR52 tor-browser-bundle.git commit: f279b94f424c1c7eeabaa0119ccfc8fea326bed6 --- projects/firefox/build | 8 +++----- projects/firefox/config | 9 ++++----- 2 files changed, 7 insertions(+), 10 deletions(-) diff --git a/projects/firefox/build b/projects/firefox/build index 1dce495..8b36428 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -35,8 +35,7 @@ mkdir -p $distdir/Browser [% END %] [% IF c("var/linux") %] -mkdir -p $distdir/Debug/Browser/components -mkdir -p $distdir/Debug/Browser/browser/components +mkdir -p $distdir/Debug/Browser/gmp-clearkey/0.1 [% END %] cd /var/tmp/build/[% project %]-[% c("version") %] @@ -124,7 +123,7 @@ cp -p obj-*/dist/host/bin/mbsdiff $MARTOOLS/ [% IF c("var/linux") %] cp -p obj-*/modules/libmar/tool/signmar $MARTOOLS/ cp -p obj-*/security/nss/cmd/certutil/certutil $MARTOOLS/ -NSS_LIBS="libfreebl3.so libmozsqlite3.so libnss3.so libnssdbm3.so libnssutil3.so libsmime3.so libsoftokn3.so libssl3.so" +NSS_LIBS="libmozsqlite3.so libnss3.so libnssdbm3.so libnssutil3.so libsmime3.so libssl3.so" NSPR_LIBS="libnspr4.so libplc4.so libplds4.so" for LIB in $NSS_LIBS $NSPR_LIBS; do cp -p obj-*/dist/bin/$LIB $MARTOOLS/ @@ -136,7 +135,7 @@ cd $distdir [% IF c("var/linux") %] # Strip and generate debuginfo for the firefox binary that we keep, all *.so # files, the plugin-container, and the updater (see ticket #10126) -for LIB in Browser/*.so Browser/webapprt-stub Browser/firefox Browser/plugin-container Browser/browser/components/*.so Browser/updater +for LIB in Browser/*.so Browser/firefox Browser/plugin-container Browser/gmp-clearkey/0.1/*.so Browser/updater do objcopy --only-keep-debug $LIB Debug/$LIB strip $LIB @@ -151,7 +150,6 @@ done [% IF c("var/windows") || c("var/linux") %] [% c("var/rezip", { rezip_file => 'Browser/omni.ja' }) %] [% c("var/rezip", { rezip_file => 'Browser/browser/omni.ja' }) %] - [% IF c("var/linux") %][% c("var/rezip", { rezip_file => 'Browser/webapprt/omni.ja' }) %][% END %] [% ELSIF c("var/osx") %] [% c("var/rezip", { rezip_file => 'TorBrowser.app/Contents/Resources/omni.ja' }) %] [% c("var/rezip", { rezip_file => 'TorBrowser.app/Contents/Resources/webapprt/omni.ja' }) %] diff --git a/projects/firefox/config b/projects/firefox/config index c71025d..83307d0 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -33,14 +33,14 @@ targets: arch_deps: - libgtk2.0-dev - libdbus-glib-1-dev - - libasound2-dev - - libgstreamer-plugins-base0.10-dev - libxt-dev - hardening-wrapper # To pass configure since ESR 31. - libpulse-dev # To pass configure since ESR 45. - libgconf2-dev + # To pass configure since ESR 52 + - libx11-xcb-dev # We built GCC but not the libmpc2, thus we need to install it - libmpc2 @@ -52,14 +52,13 @@ targets: - libc6-dev-i386 - libgtk2.0-dev:i386 - libdbus-glib-1-dev:i386 - - lib32asound2-dev - - libasound2-dev:i386 - - libgstreamer-plugins-base0.10-dev:i386 - libxt-dev:i386 # To pass configure since ESR 31. - libpulse-dev:i386 # To pass configure since ESR 45. - libgconf2-dev:i386 + # To pass configure since ESR 52 + - libx11-xcb-dev:i386 # We built GCC but not the libmpc2, thus we need to install it - libmpc2 - hardening-wrapper

1 0

[tor-browser-build/master] Bug 18831: Use own Yasm for Firefox cross-compilation
by boklm＠torproject.org 07 Apr '17

07 Apr '17

commit f9b9039a8b7f5ed8b1bd823f4f3a9f8fc6302287 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri Apr 7 13:22:31 2017 +0200 Bug 18831: Use own Yasm for Firefox cross-compilation Starting with Firefox ESR52 Yasm < 1.2.0 is not sufficient anymore to compile our browser part for Windows. Ubuntu Precise still ships with such a version, though. We compile our own version until we get off of Precise. tor-browser-bundle.git commit: 910094fc33ae4e75e10fee754bec106e83e0eac5 --- projects/firefox/build | 4 ++++ projects/firefox/config | 3 +++ projects/yasm/build | 14 ++++++++++++++ projects/yasm/config | 10 ++++++++++ 4 files changed, 31 insertions(+) diff --git a/projects/firefox/build b/projects/firefox/build index abd699b..1dce495 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -11,6 +11,10 @@ # compiler setup so that mingw is first in the PATH. export LD_LIBRARY_PATH=$hgccdir/lib64 export PATH=$hgccdir/bin:$PATH + + # Firefox ESR52 needs Yasm >= 1.2.0 which Ubuntu Precise does not ship. + tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/yasm') %] + export PATH="/var/tmp/dist/yasm/bin:$PATH" [% END -%] [% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] distdir=/var/tmp/dist/[% project %] diff --git a/projects/firefox/config b/projects/firefox/config index f7e89e5..c71025d 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -92,3 +92,6 @@ input_files: - project: gcc name: gcc enable: '[% c("var/windows") %]' + - project: yasm + name: yasm + enable: '[% c("var/windows") %]' diff --git a/projects/yasm/build b/projects/yasm/build new file mode 100644 index 0000000..82d037a --- /dev/null +++ b/projects/yasm/build @@ -0,0 +1,14 @@ +#!/bin/bash +[% c("var/set_default_env") -%] +distdir=/var/tmp/dist/[% project %] +mkdir -p /var/tmp/build +tar -C /var/tmp/build -xf $rootdir/[% c('input_files_by_name/yasm') %] +cd /var/tmp/build/yasm-[% c("version") %] +./configure --prefix="$distdir" +make -j4 +make install +cd /var/tmp/dist +[% c('tar', { + tar_src => [ project ], + tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'), + }) %] diff --git a/projects/yasm/config b/projects/yasm/config new file mode 100644 index 0000000..3d8a28a --- /dev/null +++ b/projects/yasm/config @@ -0,0 +1,10 @@ +# vim: filetype=yaml sw=2 +version: 1.2.0 +filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' +remote_docker: 1 + +input_files: + - project: docker-image + - URL: 'https://www.tortall.net/projects/yasm/releases/yasm-[% c("version") %].tar.gz' + name: yasm + sha256sum: 768ffab457b90a20a6d895c39749adb547c1b7cb5c108e84b151a838a23ccf31

1 0

[tor-browser-build/master] Bug 21723: Fix inconsistent generation of MOZ_MACBUNDLE_ID
by boklm＠torproject.org 07 Apr '17

07 Apr '17

commit ec86de4f618aa28c3694a5af1fb941cde802cae6 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri Apr 7 13:12:44 2017 +0200 Bug 21723: Fix inconsistent generation of MOZ_MACBUNDLE_ID Use org.torproject as the MOZ_DISTRIBUTION_ID. This results in a bundle ID of org.torproject.torbrowser. tor-browser-bundle.git commit: 50b6e6fff4a535044f9b506854535df757125267 --- projects/firefox/build | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/firefox/build b/projects/firefox/build index 496c215..abd699b 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -73,7 +73,7 @@ export CC='gcc -m32' rm -f configure rm -f js/src/configure -make -f client.mk configure CONFIGURE_ARGS="--with-tor-browser-version=[% c("var/torbrowser_version") %] --enable-update-channel=[% c("var/torbrowser_update_channel") %] --enable-bundled-fonts" +make -f client.mk configure CONFIGURE_ARGS="--with-tor-browser-version=[% c("var/torbrowser_version") %] --with-distribution-id=org.torproject --enable-update-channel=[% c("var/torbrowser_update_channel") %] --enable-bundled-fonts" make -j8 -f client.mk build make -C obj-* package INNER_MAKE_PACKAGE=true

1 0

[tor-browser-build/master] Adapt OSX Firefox descriptor to ESR52
by boklm＠torproject.org 07 Apr '17

07 Apr '17

commit 449a330e2cb43e6eb9420987cf68fdd87561ff75 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri Apr 7 13:34:52 2017 +0200 Adapt OSX Firefox descriptor to ESR52 In tor-browser-bundle.git this change was done as part of commit cd4465477ac10d2b740d5a32505cdab5a197e405. --- projects/firefox/build | 1 - 1 file changed, 1 deletion(-) diff --git a/projects/firefox/build b/projects/firefox/build index 8b36428..4d83b28 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -152,7 +152,6 @@ done [% c("var/rezip", { rezip_file => 'Browser/browser/omni.ja' }) %] [% ELSIF c("var/osx") %] [% c("var/rezip", { rezip_file => 'TorBrowser.app/Contents/Resources/omni.ja' }) %] - [% c("var/rezip", { rezip_file => 'TorBrowser.app/Contents/Resources/webapprt/omni.ja' }) %] [% c("var/rezip", { rezip_file => 'TorBrowser.app/Contents/Resources/browser/omni.ja' }) %] [% END %]

1 0

[tor-browser-build/master] Switch to ESR52
by boklm＠torproject.org 07 Apr '17

07 Apr '17

commit cd08d1ab0fb638daed52ee5e7452dd78b07591c6 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri Apr 7 15:53:53 2017 +0200 Switch to ESR52 --- projects/firefox-langpacks/config | 2 +- projects/firefox/config | 10 ++++++---- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/projects/firefox-langpacks/config b/projects/firefox-langpacks/config index dd96dcd..a645b92 100644 --- a/projects/firefox-langpacks/config +++ b/projects/firefox-langpacks/config @@ -4,7 +4,7 @@ filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/buil var: ff_version: '[% pc("firefox", "var/firefox_version") %]' - ff_build: build2 + ff_build: build1 ff_arch: linux-i686 input_filename: 'dl-langpack-[% c("var/ff_arch") %]-[% c("version") %]' diff --git a/projects/firefox/config b/projects/firefox/config index 83307d0..7e685e7 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -1,14 +1,16 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' filename: 'firefox-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build1' +## There is no signed tag yet, so we use a fixed commit +git_hash: 47fa36dc780f4962102205b390e18ce9ef74b1b9 +#git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build1' +#tag_gpg_id: 1 git_url: https://git.torproject.org/tor-browser.git -tag_gpg_id: 1 gpg_keyring: torbutton.gpg remote_docker: 1 var: - firefox_version: 45.8.0esr + firefox_version: 52.0.2esr torbrowser_branch: 7.0 torbrowser_update_channel: alpha copyright_year: '[% exec("git show -s --format=%ci").remove("-.*") %]' @@ -22,7 +24,7 @@ var: targets: nightly: - git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1' + git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-2' tag_gpg_id: 0 var: torbrowser_update_channel: default

1 0

[tor-browser-build/master] Bug 21709: Upgrade Go to 1.7.5.
by boklm＠torproject.org 07 Apr '17

07 Apr '17

commit 949c0d9e83d911b2fa80279edddb06c7e6299c80 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri Apr 7 13:11:41 2017 +0200 Bug 21709: Upgrade Go to 1.7.5. tor-browser-bundle.git commit: 1942f7b2f6e5f82c64dcfeab82713604866cb26f --- projects/go/config | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/projects/go/config b/projects/go/config index dbd7aab..89b4b45 100644 --- a/projects/go/config +++ b/projects/go/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 1.7.4 +version: 1.7.5 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' remote_docker: 1 @@ -75,7 +75,7 @@ input_files: enable: '[% c("var/windows") || c("var/osx") %]' - URL: 'https://golang.org/dl/go[% c("version") %].src.tar.gz' name: go - sha256sum: 4c189111e9ba651a2bb3ee868aa881fab36b2f2da3409e80885ca758a6b614cc + sha256sum: 4e834513a2079f8cbbd357502cccaac9507fd00a1efe672375798858ff291815 - URL: 'https://golang.org/dl/go[% c("var/go14_version") %].src.tar.gz' name: go14 sha256sum: 9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959

1 0