commit 339967b974ba4e37d6003638049948a6300b7dbb
Author: Translation commit bot <translation(a)torproject.org>
Date: Tue Nov 26 18:24:16 2019 +0000
https://gitweb.torproject.org/translation.git/commit/?h=support-portal
---
contents+es.po | 10 +++++-----
contents+ro.po | 7 ++++---
contents+tr.po | 32 ++++++++++++++++----------------
contents+zh-CN.po | 13 +++++++------
4 files changed, 32 insertions(+), 30 deletions(-)
diff --git a/contents+es.po b/contents+es.po
index af26086c0..96c4798d9 100644
--- a/contents+es.po
+++ b/contents+es.po
@@ -616,7 +616,7 @@ msgid ""
"recommended](/tbb/tbb-9/)."
msgstr ""
"Usar Tor con otros navegadores es [peligroso y no se "
-"recomienda](/tbb/tbb-9/)."
+"recomienda](/es/tbb/tbb-9/)."
#: https//support.torproject.org/about/distribute-tor/
#: (content/about/distribute-tor/contents+en.lrquestion.title)
@@ -944,8 +944,8 @@ msgid ""
"See this visualization of [Tor and HTTPS](/https/https-1/) to understand how"
" Tor and HTTPS interact."
msgstr ""
-"Mira este gráfico de [Tor y HTTPS](/https/https-1/) para entender cual es la"
-" relación entre Tor y HTTPS."
+"Mira este gráfico de [Tor y HTTPS](/es/https/https-1/) para entender cuál es"
+" la relación entre Tor y HTTPS."
#: https//support.torproject.org/about/no-data-scrubbing/
#: (content/about/no-data-scrubbing/contents+en.lrquestion.title)
@@ -9100,8 +9100,8 @@ msgid ""
"1. Log onto #tor. See [How can I chat with Tor Project teams?](/get-in-touch"
"/irc-help/)"
msgstr ""
-"1. Entra en #tor. Lee [¿cómo puedo charlar con los equipos del Tor Project"
-"?](/get-in-touch/irc-help/)"
+"1. Entra en #tor. Lee [¿cómo puedo charlar con los equipos del Tor "
+"Project?](/es/get-in-touch/irc-help/)"
#: https//support.torproject.org/get-in-touch/why-i-cant-join-tor-channels/
#: (content/get-in-touch/why-i-cant-join-tor-channels/contents+en.lrquestion.description)
diff --git a/contents+ro.po b/contents+ro.po
index 4167d8414..62850b894 100644
--- a/contents+ro.po
+++ b/contents+ro.po
@@ -3887,8 +3887,8 @@ msgid ""
msgstr ""
"GetTor va răspunde cu un e-mail care conține linkuri de pe care puteți "
"descărca pachetul Tor Browser, semnătura criptografică (necesară "
-"[verificării descărcării](/tbb/how-to-verify-signature/)), amprenta cheii "
-"folosite pentru a face semnătura și suma de control a pachetului."
+"[verificării descărcării](/ro/tbb/how-to-verify-signature/)), amprenta cheii"
+" folosite pentru a face semnătura și suma de control a pachetului."
#: https//support.torproject.org/gettor/gettor-2/
#: (content/gettor/gettor-2/contents+en.lrquestion.description)
@@ -6762,7 +6762,8 @@ msgstr ""
#: https//support.torproject.org/misc/bug-or-feedback/
#: (content/misc/bug-or-feedback/contents+en.lrquestion.description)
msgid "Learn how to connect to [OFTC servers](/get-in-touch/irc-help)."
-msgstr "Aflați cum să vă conectați la [servere OFTC](/get-in-touch/irc-help)."
+msgstr ""
+"Aflați cum să vă conectați la [servere OFTC](/ro/get-in-touch/irc-help)."
#: https//support.torproject.org/misc/bug-or-feedback/
#: (content/misc/bug-or-feedback/contents+en.lrquestion.description)
diff --git a/contents+tr.po b/contents+tr.po
index 15a5a2626..028dced69 100644
--- a/contents+tr.po
+++ b/contents+tr.po
@@ -3,8 +3,8 @@
# Cenk Yıldızlı <goncagul(a)national.shitposting.agency>, 2019
# erinm, 2019
# dersteppenwolfx, 2019
-# Emma Peel, 2019
# Kaya Zeren <kayazeren(a)gmail.com>, 2019
+# Emma Peel, 2019
#
msgid ""
msgstr ""
@@ -12,7 +12,7 @@ msgstr ""
"Report-Msgid-Bugs-To: \n"
"POT-Creation-Date: 2019-11-14 16:04+CET\n"
"PO-Revision-Date: 2018-10-02 22:41+0000\n"
-"Last-Translator: Kaya Zeren <kayazeren(a)gmail.com>, 2019\n"
+"Last-Translator: Emma Peel, 2019\n"
"Language-Team: Turkish (https://www.transifex.com/otf/teams/1519/tr/)\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
@@ -544,9 +544,9 @@ msgid ""
"You should also check the [PGP signatures](/tbb/how-to-verify-signature/) on"
" the releases, to make sure nobody messed with the distribution sites."
msgstr ""
-"Bununla birlikte sürümlerin [PGP imzalarını(/tbb/how-to-verify-signature/) "
-"da denetlemelisiniz. Böylece hiç kimsenin dağıtım sitelerine müdahale "
-"etmediğinden emin olabilirsiniz."
+"Bununla birlikte sürümlerin [PGP imzalarını(/tr/tbb/how-to-verify-"
+"signature/) da denetlemelisiniz. Böylece hiç kimsenin dağıtım sitelerine "
+"müdahale etmediğinden emin olabilirsiniz."
#: https//support.torproject.org/about/backdoor/
#: (content/about/backdoor/contents+en.lrquestion.description)
@@ -614,7 +614,7 @@ msgid ""
"recommended](/tbb/tbb-9/)."
msgstr ""
"Tor uygulamasını diğer tarayıcılar ile kullanmak [tehlikeli olabilir ve "
-"önerilmez](/tbb/tbb-9/)."
+"önerilmez](/tr/tbb/tbb-9/)."
#: https//support.torproject.org/about/distribute-tor/
#: (content/about/distribute-tor/contents+en.lrquestion.title)
@@ -944,8 +944,8 @@ msgid ""
"See this visualization of [Tor and HTTPS](/https/https-1/) to understand how"
" Tor and HTTPS interact."
msgstr ""
-"Buradaki [Tor ve HTTPS](/https/https-1/) görselleştirmesine bakarak Tor ile "
-"HTTPS etkileşimini anlayabilirsiniz."
+"Buradaki [Tor ve HTTPS](/tr/https/https-1/) görselleştirmesine bakarak Tor "
+"ile HTTPS etkileşimini anlayabilirsiniz."
#: https//support.torproject.org/about/no-data-scrubbing/
#: (content/about/no-data-scrubbing/contents+en.lrquestion.title)
@@ -2002,7 +2002,7 @@ msgid ""
"website](https://bridges.torproject.org/)."
msgstr ""
"Başka köprüler kullanmanız gerekiyorsa {Köprüler web "
-"sitesinden](https://bridges.torproject.org/) bilgi alabilirsiniz."
+"sitesinden](https://bridges.torproject.org/?lang=tr) bilgi alabilirsiniz."
#: https//support.torproject.org/tbb/tbb-19/
#: (content/tbb/tbb-19/contents+en.lrquestion.description)
@@ -2292,7 +2292,7 @@ msgid ""
"manual.torproject.org/updating/) in the Tor Browser Manual."
msgstr ""
"Lütfen Tor Browser belgelerindeki [güncelleme bölümüne](https://tb-"
-"manual.torproject.org/updating/) bakın."
+"manual.torproject.org/tr/updating/) bakın."
#: https//support.torproject.org/tbb/tbb-28/
#: (content/tbb/tbb-28/contents+en.lrquestion.title)
@@ -2306,7 +2306,7 @@ msgid ""
"manual.torproject.org/uninstalling/) in the Tor Browser Manual."
msgstr ""
"Lütfen Tor belgelerindeki [kaldırma bölümüne](https://tb-"
-"manual.torproject.org/uninstalling/) bakın."
+"manual.torproject.org/tr/uninstalling/) bakın."
#: https//support.torproject.org/tbb/tbb-29/
#: (content/tbb/tbb-29/contents+en.lrquestion.title)
@@ -3124,7 +3124,7 @@ msgid ""
"manual.torproject.org/installation/) section in the Tor Browser Manual."
msgstr ""
"Lütfen Tor belgelerindeki [kurma bölümüne](https://tb-"
-"manual.torproject.org/installation/) bakın."
+"manual.torproject.org/tr/installation/) bakın."
#: https//support.torproject.org/tbb/tbb-47/
#: (content/tbb/tbb-47/contents+en.lrquestion.title)
@@ -3904,7 +3904,7 @@ msgid ""
"to make the signature, and the package’s checksum."
msgstr ""
"GetTor hizmeti, Tor Browser paketini indirebileceğiniz bağlantılar, "
-"şifrelenmiş imza (indirmeyi [doğrulamak](/tbb/how-to-verify-signature) "
+"şifrelenmiş imza (indirmeyi [doğrulamak](/tr/tbb/how-to-verify-signature) "
"için), imzayı oluşturmak için kullanılan parmak izi ve paketin sağlama "
"değerini içeren bir e-posta ile yanıt verir."
@@ -6827,7 +6827,7 @@ msgstr ""
#: (content/misc/bug-or-feedback/contents+en.lrquestion.description)
msgid "Learn how to connect to [OFTC servers](/get-in-touch/irc-help)."
msgstr ""
-"[OFTC sunucularına](/get-in-touch/irc-help) nasıl bağlanabileceğinizi "
+"[OFTC sunucularına](/tr/get-in-touch/irc-help) nasıl bağlanabileceğinizi "
"öğrenin."
#: https//support.torproject.org/misc/bug-or-feedback/
@@ -9750,7 +9750,7 @@ msgid ""
"/irc-help/)"
msgstr ""
"1. #tor kanalında oturum açın. [Tor Projesi ekipleri ile nasıl sohbet "
-"edebilirim?](/get-in-touch/irc-help/) başlığına bakabilirsiniz"
+"edebilirim?](/tr/get-in-touch/irc-help/) başlığına bakabilirsiniz"
#: https//support.torproject.org/get-in-touch/why-i-cant-join-tor-channels/
#: (content/get-in-touch/why-i-cant-join-tor-channels/contents+en.lrquestion.description)
@@ -10146,7 +10146,7 @@ msgstr ""
#: https//support.torproject.org/apt/tor-ubuntu/
#: (content/apt/apt-2/contents+en.lrquestion.description)
msgid "Please, use [Tor Debian repository](/apt/tor-deb-repo)."
-msgstr "Lütfen [Tor Debian deposunu](/apt/tor-deb-repo) kullanın."
+msgstr "Lütfen [Tor Debian deposunu](/tr/apt/tor-deb-repo) kullanın."
#: https//support.torproject.org/apt/apt-over-tor/
#: (content/apt/apt-3/contents+en.lrquestion.title)
diff --git a/contents+zh-CN.po b/contents+zh-CN.po
index d239589c6..a8a49c8c1 100644
--- a/contents+zh-CN.po
+++ b/contents+zh-CN.po
@@ -482,7 +482,8 @@ msgstr "如果我们(或者发行者)拒绝给您源代码,即表明了有
msgid ""
"You should also check the [PGP signatures](/tbb/how-to-verify-signature/) on"
" the releases, to make sure nobody messed with the distribution sites."
-msgstr "您同样应当检查发行版的 [PGP 签名](/tbb/how-to-verify-signature/),以确保无人对发行网站动了手脚。"
+msgstr ""
+"您同样应当检查发行版的 [PGP 签名](/zh-CN/tbb/how-to-verify-signature/),以确保无人对发行网站动了手脚。"
#: https//support.torproject.org/about/backdoor/
#: (content/about/backdoor/contents+en.lrquestion.description)
@@ -538,7 +539,7 @@ msgstr "很多人使用Tor 浏览器,因为使用Tor来浏览网页能够保
msgid ""
"Using Tor with other browsers is [dangerous and not "
"recommended](/tbb/tbb-9/)."
-msgstr "将 Tor 和其他浏览器一起使用是[危险且不推荐的](/tbb/tbb-9/)。"
+msgstr "将 Tor 和其他浏览器一起使用是[危险且不推荐的](/zh-CN/tbb/tbb-9/)。"
#: https//support.torproject.org/about/distribute-tor/
#: (content/about/distribute-tor/contents+en.lrquestion.title)
@@ -815,7 +816,7 @@ msgstr "如果您正在使用加密(例如HTTPS协议),它仅能知道目
msgid ""
"See this visualization of [Tor and HTTPS](/https/https-1/) to understand how"
" Tor and HTTPS interact."
-msgstr "查看关于[Tor与HTTPS](/https/https-1/)的可视化内容来理解Tor是如何与HTTPS交互的。"
+msgstr "查看关于[Tor与HTTPS](/zh-CN/https/https-1/)的可视化内容来理解Tor是如何与HTTPS交互的。"
#: https//support.torproject.org/about/no-data-scrubbing/
#: (content/about/no-data-scrubbing/contents+en.lrquestion.title)
@@ -3174,8 +3175,8 @@ msgid ""
" download](/tbb/how-to-verify-signature/)), the fingerprint of the key used "
"to make the signature, and the package’s checksum."
msgstr ""
-"GetTor 将会给你自动回复一封电子邮件给,信中会带有 Tor 浏览器的下载链接、数字签名(用于[验证下载](/tbb/how-to-verify-"
-"signature/))、签名的指纹和文件的散列值。"
+"GetTor 将会给你自动回复一封电子邮件给,信中会带有 Tor 浏览器的下载链接、数字签名(用于[验证下载](/zh-CN/tbb/how-to-"
+"verify-signature/))、签名的指纹和文件的散列值。"
#: https//support.torproject.org/gettor/gettor-2/
#: (content/gettor/gettor-2/contents+en.lrquestion.description)
@@ -5510,7 +5511,7 @@ msgstr ""
#: https//support.torproject.org/misc/bug-or-feedback/
#: (content/misc/bug-or-feedback/contents+en.lrquestion.description)
msgid "Learn how to connect to [OFTC servers](/get-in-touch/irc-help)."
-msgstr "了解如何连接到 [OFTC 服务器](/get-in-touch/irc-help)."
+msgstr "了解如何连接到 [OFTC 服务器](/zh-CN/get-in-touch/irc-help)."
#: https//support.torproject.org/misc/bug-or-feedback/
#: (content/misc/bug-or-feedback/contents+en.lrquestion.description)
commit 6f9bfb4d705e2dbbd62aa95a95409df3c43d8488
Author: Translation commit bot <translation(a)torproject.org>
Date: Tue Nov 26 18:20:38 2019 +0000
https://gitweb.torproject.org/translation.git/commit/?h=tbmanual-contentspo…
---
contents+tr.po | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
diff --git a/contents+tr.po b/contents+tr.po
index 30c3a32ac..a21a62eeb 100644
--- a/contents+tr.po
+++ b/contents+tr.po
@@ -1987,12 +1987,13 @@ msgid ""
"websites to run scripts in \"Standard\" mode."
msgstr ""
"Web sitelerinde gezinirken yüksek derecede güvenlik isteyen kullanıcılar, "
-"Tor Browser üzerindeki [Güvenlik Düzeyi Ayarını](/security-slider) \"Daha "
-"Güvenli\" (HTTPS olmayan web siteleri için JavaScript devre dışı) ya da \"En"
-" Güvenli\" (tüm web siteleri için JavaScript devre dışı) olarak seçmelidir. "
-"Bununla birlikte, JavaScript devre dışı bırakıldığında birçok web sitesi "
-"düzgün çalışmayabilir. Bu nedenle Tor Browser varsayılan olarak \"Standart\""
-" güvenlik düzeyinde tüm web sitelerinin betikleri çalıştırmasına izin verir."
+"Tor Browser üzerindeki [Güvenlik Düzeyi Ayarını](/tr/security-slider) \"Daha"
+" Güvenli\" (HTTPS olmayan web siteleri için JavaScript devre dışı) ya da "
+"\"En Güvenli\" (tüm web siteleri için JavaScript devre dışı) olarak "
+"seçmelidir. Bununla birlikte, JavaScript devre dışı bırakıldığında birçok "
+"web sitesi düzgün çalışmayabilir. Bu nedenle Tor Browser varsayılan olarak "
+"\"Standart\" güvenlik düzeyinde tüm web sitelerinin betikleri çalıştırmasına"
+" izin verir."
#: https//tb-manual.torproject.org/plugins/
#: (content/plugins/contents+en.lrtopic.body)
commit 4babe1e1e4de890f1ecd57427e8f1c83c1f4ef7e
Author: Translation commit bot <translation(a)torproject.org>
Date: Tue Nov 26 18:20:27 2019 +0000
https://gitweb.torproject.org/translation.git/commit/?h=tbmanual-contentspot
---
contents+es.po | 4 ++--
contents+ro.po | 4 ++--
contents+tr.po | 13 +++++++------
3 files changed, 11 insertions(+), 10 deletions(-)
diff --git a/contents+es.po b/contents+es.po
index 4680cc12f..10634dd61 100644
--- a/contents+es.po
+++ b/contents+es.po
@@ -621,7 +621,7 @@ msgstr ""
"censurado en tu conexión. Si no crees que este sea el caso, selecciona "
"\"No\". Si sabes que tu conexión está censurada, o has intentado conectar a "
"la red Tor y no han funcionado otras soluciones, selecciona \"Sí\", que te "
-"llevará a la pantalla [Evasión](/circumvention) para configurar un "
+"llevará a la pantalla [Evasión](/es/circumvention) para configurar un "
"transporte conectable."
#: https//tb-manual.torproject.org/running-tor-browser/
@@ -1358,7 +1358,7 @@ msgstr ""
#: https//tb-manual.torproject.org/onion-services/
#: (content/onion-services/contents+en.lrtopic.body)
msgid "### HOW TO ACCESS AN ONION SERVICE"
-msgstr "### COMO ACCEDER A UN SERVICIO CEBOLLA"
+msgstr "### CÓMO ACCEDER A UN SERVICIO CEBOLLA"
#: https//tb-manual.torproject.org/onion-services/
#: (content/onion-services/contents+en.lrtopic.body)
diff --git a/contents+ro.po b/contents+ro.po
index e01c57b6b..c3f109c7b 100644
--- a/contents+ro.po
+++ b/contents+ro.po
@@ -1992,8 +1992,8 @@ msgid ""
"websites to run scripts in \"Standard\" mode."
msgstr ""
"Utilizatorii care necesită un grad ridicat de securitate în navigarea lor "
-"web ar trebui să stabilească [cursorul de securitate](/security-slider) Tor "
-"Browser pe „Safer” (care dezactivează JavaScript pentru site-urile non-"
+"web ar trebui să stabilească [cursorul de securitate](/ro/security-slider) "
+"Tor Browser pe „Safer” (care dezactivează JavaScript pentru site-urile non-"
"HTTPS) sau „Safest” (ceea ce face pentru toate site-uri web). Cu toate "
"acestea, dezactivarea JavaScript va împiedica afișarea corectă a multor "
"site-uri web, astfel încât setarea implicită a Tor Browser este de a permite"
diff --git a/contents+tr.po b/contents+tr.po
index 30c3a32ac..a21a62eeb 100644
--- a/contents+tr.po
+++ b/contents+tr.po
@@ -1987,12 +1987,13 @@ msgid ""
"websites to run scripts in \"Standard\" mode."
msgstr ""
"Web sitelerinde gezinirken yüksek derecede güvenlik isteyen kullanıcılar, "
-"Tor Browser üzerindeki [Güvenlik Düzeyi Ayarını](/security-slider) \"Daha "
-"Güvenli\" (HTTPS olmayan web siteleri için JavaScript devre dışı) ya da \"En"
-" Güvenli\" (tüm web siteleri için JavaScript devre dışı) olarak seçmelidir. "
-"Bununla birlikte, JavaScript devre dışı bırakıldığında birçok web sitesi "
-"düzgün çalışmayabilir. Bu nedenle Tor Browser varsayılan olarak \"Standart\""
-" güvenlik düzeyinde tüm web sitelerinin betikleri çalıştırmasına izin verir."
+"Tor Browser üzerindeki [Güvenlik Düzeyi Ayarını](/tr/security-slider) \"Daha"
+" Güvenli\" (HTTPS olmayan web siteleri için JavaScript devre dışı) ya da "
+"\"En Güvenli\" (tüm web siteleri için JavaScript devre dışı) olarak "
+"seçmelidir. Bununla birlikte, JavaScript devre dışı bırakıldığında birçok "
+"web sitesi düzgün çalışmayabilir. Bu nedenle Tor Browser varsayılan olarak "
+"\"Standart\" güvenlik düzeyinde tüm web sitelerinin betikleri çalıştırmasına"
+" izin verir."
#: https//tb-manual.torproject.org/plugins/
#: (content/plugins/contents+en.lrtopic.body)
commit f1cc6bc762c337d9cbc7187d2958dcb54007f9ff
Author: Georg Koppen <gk(a)torproject.org>
Date: Tue Nov 26 18:16:10 2019 +0000
Bug 32556: Keep track of entitlement files and add signing script templates
---
tools/signing/README | 7 ++++
tools/signing/alpha.entitlements.xml | 53 ++++++++++++++++++++++++++++++
tools/signing/authenticode-signing.sh | 48 +++++++++++++++++++++++++++
tools/signing/authenticode-timestamping.sh | 46 ++++++++++++++++++++++++++
tools/signing/gatekeeper-bundling.sh | 49 +++++++++++++++++++++++++++
tools/signing/gatekeeper-signing.sh | 51 ++++++++++++++++++++++++++++
tools/signing/notarization.sh | 50 ++++++++++++++++++++++++++++
tools/signing/stable.entitlements.xml | 53 ++++++++++++++++++++++++++++++
tools/signing/stapler.sh | 47 ++++++++++++++++++++++++++
tools/signing/tbb-signing.sh | 38 +++++++++++++++++++++
10 files changed, 442 insertions(+)
diff --git a/tools/signing/README b/tools/signing/README
new file mode 100644
index 0000000..e18a761
--- /dev/null
+++ b/tools/signing/README
@@ -0,0 +1,7 @@
+The files in this directory are a large part of what we use when signing
+releases. The scripts are meant to be templates, though, at the moment
+omitting specific paths and credential information.
+
+Additionally, when starting to used them for an own signing setup don't forget
+to adapt the locale list if needed. The entitlement files, however, are kept
+up-to-date.
diff --git a/tools/signing/alpha.entitlements.xml b/tools/signing/alpha.entitlements.xml
new file mode 100644
index 0000000..3097c05
--- /dev/null
+++ b/tools/signing/alpha.entitlements.xml
@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!--
+ Entitlements to apply to the .app bundle and all executable files
+ contained within it during codesigning of production channel builds that
+ will be notarized. These entitlements enable hardened runtime protections
+ to the extent possible for Firefox. Some supporting binaries within the
+ bundle could use more restrictive entitlements, but they are launched by
+ the main Firefox process and therefore inherit the parent process
+ entitlements.
+-->
+<plist version="1.0">
+ <dict>
+ <!-- Firefox does not use MAP_JIT for executable mappings -->
+ <key>com.apple.security.cs.allow-jit</key><false/>
+
+ <!-- Firefox needs to create executable pages (without MAP_JIT) -->
+ <key>com.apple.security.cs.allow-unsigned-executable-memory</key><true/>
+
+ <!-- Code paged in from disk should match the signature at page in-time -->
+ <key>com.apple.security.cs.disable-executable-page-protection</key><false/>
+
+ <!-- Allow loading third party libraries. Needed for Flash and CDMs -->
+ <key>com.apple.security.cs.disable-library-validation</key><true/>
+
+ <!-- Allow dyld environment variables. Needed because Firefox uses
+ dyld variables to load libaries from within the .app bundle. -->
+ <key>com.apple.security.cs.allow-dyld-environment-variables</key><true/>
+
+ <!-- Don't allow debugging of the executable. Debuggers will be prevented
+ from attaching to running executables. Notarization does not permit
+ access to get-task-allow (as documented by Apple) so this must be
+ disabled on notarized builds. -->
+ <key>com.apple.security.get-task-allow</key><false/>
+
+ <!-- Firefox needs to access the microphone on sites the user allows -->
+ <key>com.apple.security.device.audio-input</key><true/>
+
+ <!-- Firefox needs to access the camera on sites the user allows -->
+ <key>com.apple.security.device.camera</key><true/>
+
+ <!-- Firefox needs to access the location on sites the user allows -->
+ <key>com.apple.security.personal-information.location</key><true/>
+
+ <!-- Allow Firefox to send Apple events to other applications. Needed
+ for native messaging webextension helper applications launched by
+ Firefox which rely on Apple Events to signal other processes. -->
+ <key>com.apple.security.automation.apple-events</key><true/>
+
+ <!-- For SmartCardServices(7) -->
+ <key>com.apple.security.smartcard</key><true/>
+ </dict>
+</plist>
diff --git a/tools/signing/authenticode-signing.sh b/tools/signing/authenticode-signing.sh
new file mode 100755
index 0000000..7e2e6f0
--- /dev/null
+++ b/tools/signing/authenticode-signing.sh
@@ -0,0 +1,48 @@
+#!/bin/bash
+
+# Copyright (c) 2019, The Tor Project, Inc.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+
+# * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#
+# * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#
+# * Neither the names of the copyright owners nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+set -e
+
+read -sp "Enter passphrase: " pass
+echo
+for i in `find . -name "*.exe" -print`
+do
+ /path/to/patched/osslsigncode/build/osslsigncode \
+ -pkcs11engine /usr/lib/engines/engine_pkcs11.so \
+ -pkcs11module /usr/lib/libeTPkcs11.so \
+ -pass $pass \
+ -h sha256 \
+ -certs $path/to/cert \
+ -key $key \
+ $i $i-signed
+done
+rename -f 's/-signed//' *-signed
diff --git a/tools/signing/authenticode-timestamping.sh b/tools/signing/authenticode-timestamping.sh
new file mode 100755
index 0000000..77973b7
--- /dev/null
+++ b/tools/signing/authenticode-timestamping.sh
@@ -0,0 +1,46 @@
+#!/bin/bash
+
+# Copyright (c) 2019, The Tor Project, Inc.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+
+# * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#
+# * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#
+# * Neither the names of the copyright owners nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+set -e
+
+COUNT=0
+for i in `find . -name "*.exe" -print`
+do
+ /path/to/patched/osslsigncode add \
+ -t http://timestamp.digicert.com \
+ -p socks://127.0.0.1:9050 \
+ $i $i-timestamped
+ COUNT=$((COUNT + 1))
+
+done
+echo "Timestamped $COUNT .exe files, now renaming"
+rename -f 's/-timestamped//' *-timestamped
diff --git a/tools/signing/gatekeeper-bundling.sh b/tools/signing/gatekeeper-bundling.sh
new file mode 100755
index 0000000..742bc61
--- /dev/null
+++ b/tools/signing/gatekeeper-bundling.sh
@@ -0,0 +1,49 @@
+#!/bin/bash
+
+# Copyright (c) 2019, The Tor Project, Inc.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+
+# * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#
+# * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#
+# * Neither the names of the copyright owners nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+TORBROWSER_VERSION=$1
+if [ -z $TORBROWSER_VERSION ];
+then
+ echo "Please call this script with a Tor Browser version!"
+ exit 1
+fi
+BUNDLE_LOCALES="ar ca cs da de el en-US es-AR es-ES fa fr ga-IE he hu id is it ja ka ko mk nb-NO nl pl pt-BR ro ru sv-SE tr vi zh-CN zh-TW"
+builddir=/path/to/the/build/dir
+mkdir $builddir/$TORBROWSER_VERSION-signed
+for LANG in $BUNDLE_LOCALES
+do
+ cd $builddir/dmg
+ unzip -q $builddir/$TORBROWSER_VERSION/tb-${TORBROWSER_VERSION}_$LANG-stapled.zip
+ cd ..
+ $builddir/ddmg.sh $builddir/$TORBROWSER_VERSION-signed/TorBrowser-${TORBROWSER_VERSION}-osx64_$LANG.dmg $builddir/dmg/
+ rm -rf 'dmg/Tor Browser.app'
+done
diff --git a/tools/signing/gatekeeper-signing.sh b/tools/signing/gatekeeper-signing.sh
new file mode 100755
index 0000000..3f31f82
--- /dev/null
+++ b/tools/signing/gatekeeper-signing.sh
@@ -0,0 +1,51 @@
+#!/bin/bash
+
+# Copyright (c) 2019, The Tor Project, Inc.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+
+# * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#
+# * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#
+# * Neither the names of the copyright owners nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+TORBROWSER_VERSION=$1
+if [ -z "$TORBROWSER_VERSION" ];
+then
+ echo "Please call this script with a Tor Browser version!"
+ exit 1
+fi
+ENTITLEMENTS=/path/to/stable.entitlements.xml
+BUNDLE_LOCALES="ar ca cs da de el en-US es-AR es-ES fa fr ga-IE he hu id is it ja ka ko mk nb-NO nl pl pt-BR ro ru sv-SE tr vi zh-CN zh-TW"
+for LANG in $BUNDLE_LOCALES
+do
+ hdiutil attach TorBrowser-${TORBROWSER_VERSION}-osx64_$LANG.dmg
+ cp -rf "/Volumes/Tor Browser/Tor Browser.app" "Tor Browser.app"
+ echo "Signing Tor Browser_$LANG.app"
+ codesign -vvv --deep -o runtime --entitlements="$ENTITLEMENTS" --timestamp -f -s "$ID" "Tor Browser.app/"
+ echo "Zipping up"
+ zip -qr tb-${TORBROWSER_VERSION}_${LANG}.zip "Tor Browser.app"
+ rm -rf "Tor Browser.app"
+ hdiutil detach "/Volumes/Tor Browser"
+done
diff --git a/tools/signing/notarization.sh b/tools/signing/notarization.sh
new file mode 100755
index 0000000..eb29e74
--- /dev/null
+++ b/tools/signing/notarization.sh
@@ -0,0 +1,50 @@
+#!/bin/bash
+
+# Copyright (c) 2019, The Tor Project, Inc.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+
+# * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#
+# * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#
+# * Neither the names of the copyright owners nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+TORBROWSER_VERSION=$1
+if [ -z "$TORBROWSER_VERSION" ];
+then
+ echo "Please call this script with a Tor Browser version!"
+ exit 1
+fi
+BUNDLE_LOCALES="ar ca cs da de el en-US es-AR es-ES fa fr ga-IE he hu id is it ja ka ko mk nb-NO nl pl pt-BR ro ru sv-SE tr vi zh-CN zh-TW"
+for LANG in $BUNDLE_LOCALES
+do
+ mkdir $LANG
+ cd $LANG
+ mv ../tb-${TORBROWSER_VERSION}_$LANG.zip .
+ unzip -q tb-${TORBROWSER_VERSION}_$LANG.zip
+ echo "Notarizing $LANG..."
+ xcrun altool --notarize-app -t osx -f tb-${TORBROWSER_VERSION}_$LANG.zip
+ --primary-bundle-id org.torproject.torbrowser -u USERNAME -p @env:PW --output-format xml
+ cd ..
+done
diff --git a/tools/signing/stable.entitlements.xml b/tools/signing/stable.entitlements.xml
new file mode 100644
index 0000000..3097c05
--- /dev/null
+++ b/tools/signing/stable.entitlements.xml
@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!--
+ Entitlements to apply to the .app bundle and all executable files
+ contained within it during codesigning of production channel builds that
+ will be notarized. These entitlements enable hardened runtime protections
+ to the extent possible for Firefox. Some supporting binaries within the
+ bundle could use more restrictive entitlements, but they are launched by
+ the main Firefox process and therefore inherit the parent process
+ entitlements.
+-->
+<plist version="1.0">
+ <dict>
+ <!-- Firefox does not use MAP_JIT for executable mappings -->
+ <key>com.apple.security.cs.allow-jit</key><false/>
+
+ <!-- Firefox needs to create executable pages (without MAP_JIT) -->
+ <key>com.apple.security.cs.allow-unsigned-executable-memory</key><true/>
+
+ <!-- Code paged in from disk should match the signature at page in-time -->
+ <key>com.apple.security.cs.disable-executable-page-protection</key><false/>
+
+ <!-- Allow loading third party libraries. Needed for Flash and CDMs -->
+ <key>com.apple.security.cs.disable-library-validation</key><true/>
+
+ <!-- Allow dyld environment variables. Needed because Firefox uses
+ dyld variables to load libaries from within the .app bundle. -->
+ <key>com.apple.security.cs.allow-dyld-environment-variables</key><true/>
+
+ <!-- Don't allow debugging of the executable. Debuggers will be prevented
+ from attaching to running executables. Notarization does not permit
+ access to get-task-allow (as documented by Apple) so this must be
+ disabled on notarized builds. -->
+ <key>com.apple.security.get-task-allow</key><false/>
+
+ <!-- Firefox needs to access the microphone on sites the user allows -->
+ <key>com.apple.security.device.audio-input</key><true/>
+
+ <!-- Firefox needs to access the camera on sites the user allows -->
+ <key>com.apple.security.device.camera</key><true/>
+
+ <!-- Firefox needs to access the location on sites the user allows -->
+ <key>com.apple.security.personal-information.location</key><true/>
+
+ <!-- Allow Firefox to send Apple events to other applications. Needed
+ for native messaging webextension helper applications launched by
+ Firefox which rely on Apple Events to signal other processes. -->
+ <key>com.apple.security.automation.apple-events</key><true/>
+
+ <!-- For SmartCardServices(7) -->
+ <key>com.apple.security.smartcard</key><true/>
+ </dict>
+</plist>
diff --git a/tools/signing/stapler.sh b/tools/signing/stapler.sh
new file mode 100755
index 0000000..cdbb466
--- /dev/null
+++ b/tools/signing/stapler.sh
@@ -0,0 +1,47 @@
+#!/bin/bash
+
+# Copyright (c) 2019, The Tor Project, Inc.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+
+# * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#
+# * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#
+# * Neither the names of the copyright owners nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+TORBROWSER_VERSION=$1
+if [ -z "$TORBROWSER_VERSION" ];
+then
+ echo "Please call this script with a Tor Browser version!"
+ exit 1
+fi
+BUNDLE_LOCALES="ar ca cs da de el en-US es-AR es-ES fa fr ga-IE he hu id is it ja ka ko mk nb-NO nl pl pt-BR ro ru sv-SE tr vi zh-CN zh-TW"
+for LANG in $BUNDLE_LOCALES
+do
+ echo "Stapling $LANG..."
+ cd $LANG
+ xcrun stapler staple Tor\ Browser.app
+ zip -qr ../tb-${TORBROWSER_VERSION}_$LANG-stapled.zip Tor\ Browser.app
+ cd ..
+done
diff --git a/tools/signing/tbb-signing.sh b/tools/signing/tbb-signing.sh
new file mode 100755
index 0000000..42ea235
--- /dev/null
+++ b/tools/signing/tbb-signing.sh
@@ -0,0 +1,38 @@
+#!/bin/bash
+
+# Copyright (c) 2019, The Tor Project, Inc.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+
+# * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#
+# * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#
+# * Neither the names of the copyright owners nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+export GNUPGHOME=/path/to/gpg-key
+read -sp "Enter passphrase: " pass
+for i in `find . -name "*.dmg" -o -name "*.exe" -o -name "*.tar.xz" -o -name "*.txt" -o -name "*.zip" -o -name "*.tar.gz" -o -name "*.apk"`
+do
+ echo "$pass" | gpg -absu $key! --passphrase-fd 0 $i
+done