April 2025 - tor-commits - lists.torproject.org

[Git][tpo/applications/tor-browser][tor-browser-128.9.0esr-14.5-1] 2 commits: fixup! TB 40597: Implement TorSettings module
by Pier Angelo Vendrame (＠pierov) 07 Apr '25

07 Apr '25

Pier Angelo Vendrame pushed to branch tor-browser-128.9.0esr-14.5-1 at The Tor Project / Applications / Tor Browser Commits: 9cf6d8e3 by Pier Angelo Vendrame at 2025-04-07T15:02:22+02:00 fixup! TB 40597: Implement TorSettings module Sync pt_config.json after tor-browser-build#41425. - - - - - 9461cc74 by Pier Angelo Vendrame at 2025-04-07T15:09:32+02:00 fixup! TB 41878: [android] Add standalone Tor Bootstrap TB 43611: Move Snowflake to a group of PTs on its own. - - - - - 2 changed files: - mobile/android/fenix/app/src/main/assets/common/torrc-defaults - toolkit/content/pt_config.json Changes: ===================================== mobile/android/fenix/app/src/main/assets/common/torrc-defaults ===================================== @@ -4,5 +4,6 @@ AvoidDiskWrites 1 Log notice stdout CookieAuthentication 1 DormantCanceledByStartup 1 -ClientTransportPlugin meek_lite,obfs2,obfs3,obfs4,scramblesuit,snowflake,webtunnel exec ./libLyrebird.so +ClientTransportPlugin meek_lite,obfs2,obfs3,obfs4,scramblesuit,webtunnel exec ./libLyrebird.so +ClientTransportPlugin snowflake exec ./libLyrebird.so ClientTransportPlugin conjure exec ./libConjure.so -registerURL https://registration.refraction.network/api ===================================== toolkit/content/pt_config.json ===================================== @@ -1,8 +1,9 @@ { - "_comment": "Used for dev build, replaced for release builds in tor-browser-build. This file is copied from tor-browser-build efdc0f34475ac8e4df241d3c8ff7253e8470019f:projects/tor-expert-bundle/pt_config.json", + "_comment": "Used for dev build, replaced for release builds in tor-browser-build. This file is copied from tor-browser-build 284a73809600e16c11982fc41b4b3ccba6d564ec:projects/tor-expert-bundle/pt_config.json", "recommendedDefault" : "obfs4", "pluggableTransports" : { - "lyrebird" : "ClientTransportPlugin meek_lite,obfs2,obfs3,obfs4,scramblesuit,snowflake,webtunnel exec ${pt_path}lyrebird${pt_extension}", + "lyrebird" : "ClientTransportPlugin meek_lite,obfs2,obfs3,obfs4,scramblesuit,webtunnel exec ${pt_path}lyrebird${pt_extension}", + "snowflake": "ClientTransportPlugin snowflake exec ${pt_path}lyrebird${pt_extension}", "conjure" : "ClientTransportPlugin conjure exec ${pt_path}conjure-client${pt_extension} -registerURL https://registration.refraction.network/api" }, "bridges" : { View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/1c2cd6… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/1c2cd6… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41425: Move Snowflake to a ClientTransportPlugin on its own.
by Pier Angelo Vendrame (＠pierov) 07 Apr '25

07 Apr '25

Pier Angelo Vendrame pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 284a7380 by Pier Angelo Vendrame at 2025-04-07T14:57:55+02:00 Bug 41425: Move Snowflake to a ClientTransportPlugin on its own. It seems tor passes all the transport it expects a certain PT to provide. For this reason, Lyrebird disabled proxy support also when running in obfs4 or meek mode. Moving Snowflake to another ClientTransportPlugin solves the issue. - - - - - 1 changed file: - projects/tor-expert-bundle/pt_config.json Changes: ===================================== projects/tor-expert-bundle/pt_config.json ===================================== @@ -1,7 +1,8 @@ { "recommendedDefault" : "obfs4", "pluggableTransports" : { - "lyrebird" : "ClientTransportPlugin meek_lite,obfs2,obfs3,obfs4,scramblesuit,snowflake,webtunnel exec ${pt_path}lyrebird${pt_extension}", + "lyrebird" : "ClientTransportPlugin meek_lite,obfs2,obfs3,obfs4,scramblesuit,webtunnel exec ${pt_path}lyrebird${pt_extension}", + "snowflake": "ClientTransportPlugin snowflake exec ${pt_path}lyrebird${pt_extension}", "conjure" : "ClientTransportPlugin conjure exec ${pt_path}conjure-client${pt_extension} -registerURL https://registration.refraction.network/api" }, "bridges" : { View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/2… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/2… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][base-browser-128.9.0esr-14.5-1] BB 43544: DoH pane undefined error in Privacy and Security
by ma1 (＠ma1) 04 Apr '25

04 Apr '25

ma1 pushed to branch base-browser-128.9.0esr-14.5-1 at The Tor Project / Applications / Tor Browser Commits: 770f769b by Dan Ballard at 2025-04-03T10:48:25-07:00 BB 43544: DoH pane undefined error in Privacy and Security From: Sarah Jamie Lewis <sarah(a)openprivacy.ca> Date: Fri, 28 Feb 2025 09:30:45 -0800 Subject: [PATCH 1/1] DoH Settings: Check for nulll gParentalControlsService When the parental controls service is disabled in a build, the DoH settings now display the correct stauts when Increased or Max Protection is enabled. Previously, selecting either of these options would cause DoH to be enabled, but the "Status" and "Provider" fields would not be properly populated, due to a check on the gParentalControlsService causing an error. This check is now identical to the same check in DownloadIntegration.sys.mjs Apply 1 suggestion(s) to 1 file(s) Co-authored-by: ma1 <giorgio(a)maone.net> - - - - - 1 changed file: - browser/components/preferences/privacy.js Changes: ===================================== browser/components/preferences/privacy.js ===================================== @@ -54,11 +54,12 @@ ChromeUtils.defineLazyGetter(lazy, "AboutLoginsL10n", () => { return new Localization(["branding/brand.ftl", "browser/aboutLogins.ftl"]); }); -XPCOMUtils.defineLazyServiceGetter( - lazy, - "gParentalControlsService", - "@mozilla.org/parental-controls-service;1", - "nsIParentalControlsService" +ChromeUtils.defineLazyGetter(lazy, "gParentalControlsService", () => + "@mozilla.org/parental-controls-service;1" in Cc + ? Cc["@mozilla.org/parental-controls-service;1"].createInstance( + Ci.nsIParentalControlsService + ) + : null ); // TODO: module import via ChromeUtils.defineModuleGetter @@ -735,7 +736,7 @@ var gPrivacyPane = { mode == Ci.nsIDNSService.MODE_TRRFIRST || mode == Ci.nsIDNSService.MODE_TRRONLY ) { - if (lazy.gParentalControlsService.parentalControlsEnabled) { + if (lazy.gParentalControlsService?.parentalControlsEnabled) { return "preferences-doh-status-not-active"; } let confirmationState = Services.dns.currentTrrConfirmationState; @@ -758,7 +759,7 @@ var gPrivacyPane = { if ( (mode == Ci.nsIDNSService.MODE_TRRFIRST || mode == Ci.nsIDNSService.MODE_TRRONLY) && - lazy.gParentalControlsService.parentalControlsEnabled + lazy.gParentalControlsService?.parentalControlsEnabled ) { errReason = Services.dns.getTRRSkipReasonName( Ci.nsITRRSkipReason.TRR_PARENTAL_CONTROL View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/770f769… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/770f769… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-128.9.0esr-14.5-1] fixup! [android] Modify build system
by Dan Ballard (＠dan) 03 Apr '25

03 Apr '25

Dan Ballard pushed to branch tor-browser-128.9.0esr-14.5-1 at The Tor Project / Applications / Tor Browser Commits: 1c2cd6e8 by Dan Ballard at 2025-04-03T18:17:41+00:00 fixup! [android] Modify build system Always set gradle pref for nimbusFml as tbb's env var NIMBUS_FML supercedes it - - - - - 1 changed file: - mobile/android/fenix/app/build.gradle Changes: ===================================== mobile/android/fenix/app/build.gradle ===================================== @@ -311,12 +311,14 @@ android.applicationVariants.configureEach { variant -> def isDebugOrDCD = isDebug || isDataCollectionDisabled def useReleaseVersioning = variant.buildType.buildConfigFields['USE_RELEASE_VERSIONING']?.value ?: false - // only set this property to pass to our patched application-service if it's defined in - // local.poperties, indicating this is a local dev build, - // otherwise we are in a TBB build env and the env var should be set and will be picked up - if (gradle.hasProperty('localProperties.dependencySubstitutions.geckoviewTopsrcdir')) { - System.setProperty("nimbusFml", "${topsrcdir}/mobile/android/fenix/tools/nimbus-fml") - } + // env var NIMBUS_FML always overrides this in the tbb built patched application services + // https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/blob/mai… + // so safe to have always set so local builds and supply their expected location as fetched by + // fenix/tools/tba-fetch-deps.sh + // We normalize the path because it is valid to open/build from both tb and fenix roots + def normalizedTBPath = rootProject.projectDir.absolutePath.minus("mobile/android/fenix") + System.setProperty("nimbusFml", normalizedTBPath + "/mobile/android/fenix/tools/nimbus-fml") + def disableTor = false if (project.hasProperty("disableTor")) { View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/1c2cd6e… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/1c2cd6e… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41422: Disable viaduct.
by Pier Angelo Vendrame (＠pierov) 03 Apr '25

03 Apr '25

Pier Angelo Vendrame pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 400bfa13 by Pier Angelo Vendrame at 2025-04-03T18:38:46+02:00 Bug 41422: Disable viaduct. Viaduct is an application services component for doing HTTP requests. We do not want to use any online service in Tor Browser, but to be on the safe side, we return an error shall even a request be attempted. - - - - - 3 changed files: - + projects/application-services/41422-disable-viaduct.diff - projects/application-services/build - projects/application-services/config Changes: ===================================== projects/application-services/41422-disable-viaduct.diff ===================================== @@ -0,0 +1,13 @@ +diff --git a/components/viaduct/src/backend/ffi.rs b/components/viaduct/src/backend/ffi.rs +index cca6bc68f..5d11eb026 100644 +--- a/components/viaduct/src/backend/ffi.rs ++++ b/components/viaduct/src/backend/ffi.rs +@@ -37,6 +37,8 @@ macro_rules! backend_error { + pub struct FfiBackend; + impl Backend for FfiBackend { + fn send(&self, request: crate::Request) -> Result<crate::Response, Error> { ++ return Err(backend_error!("Viaduct is disabled in Tor Browser.")); ++ + use ffi_support::IntoFfi; + use prost::Message; + super::note_backend("FFI (trusted)"); ===================================== projects/application-services/build ===================================== @@ -107,6 +107,7 @@ popd patch -p1 < $rootdir/ohttp-no-git.diff patch -p1 < $rootdir/bug40485-nimbus-fml-reproducibility.diff patch -p1 < $rootdir/offline-nimbus-fml.diff + patch -p1 < $rootdir/41422-disable-viaduct.diff gradle_flags="--offline --no-daemon" gradle $gradle_flags assembleRelease gradle $gradle_flags publish ===================================== projects/application-services/config ===================================== @@ -82,6 +82,7 @@ steps: - filename: glean-noop.diff - filename: a-s-noop.diff - filename: cargo-no-build.sh + - filename: 41422-disable-viaduct.diff list_toolchain_updates: git_hash: 'v[% c("version") %]' View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/4… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/4… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41424: Add missing definition for llvm_version in clang-linux
by brizental (＠brizental) 03 Apr '25

03 Apr '25

brizental pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 86e9af38 by Beatriz Rizental at 2025-04-03T14:42:28+00:00 Bug 41424: Add missing definition for llvm_version in clang-linux - - - - - 1 changed file: - projects/clang-linux/config Changes: ===================================== projects/clang-linux/config ===================================== @@ -4,6 +4,9 @@ filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.[% c("co container: use_container: 1 +var: + llvm_version: '[% pc("llvm-project", "version") %]' + input_files: - project: container-image - name: clang View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/8… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/8… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser] Pushed new tag mullvad-browser-132.0a1-15.0-2-build1
by Pier Angelo Vendrame (＠pierov) 03 Apr '25

03 Apr '25

Pier Angelo Vendrame pushed new tag mullvad-browser-132.0a1-15.0-2-build1 at The Tor Project / Applications / Mullvad Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/tree/mullv… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-132.0a1-15.0-2] 32 commits: MB 38: Mullvad Browser configuration
by Pier Angelo Vendrame (＠pierov) 03 Apr '25

03 Apr '25

Pier Angelo Vendrame pushed to branch mullvad-browser-132.0a1-15.0-2 at The Tor Project / Applications / Mullvad Browser Commits: 5a4da045 by Pier Angelo Vendrame at 2025-03-13T11:06:53+01:00 MB 38: Mullvad Browser configuration - - - - - fed04993 by Pier Angelo Vendrame at 2025-03-13T11:06:54+01:00 MB 1: Mullvad Browser branding See also: mullvad-browser#5: Product name and directory customization mullvad-browser#12: Create new branding directories and integrate Mullvad icons+branding mullvad-browser#14: Remove Default Built-in bookmarks mullvad-browser#35: Add custom PDF icons for Windows builds mullvad-browser#48: Replace Mozilla copyright and legal trademarks in mullvadbrowser.exe metadata mullvad-browser#51: Update trademark string mullvad-browser#104: Update shipped dll metadata copyright/licensing info mullvad-browser#107: Add alpha and nightly icons - - - - - 06c566d2 by Henry Wilkes at 2025-03-13T11:13:28+01:00 fixup! MB 1: Mullvad Browser branding MB 312: Differentiate between release channels. We update the brand.ftl and brand.properties files to add "Alpha" and "Nightly" to the brand names. We update about-wordmark.svg to be different between channels and use context-fill to allow us to customise the appearance in about:mullvad-browser. We add mullvad-about-wordmark-en.ftl to provide the English text equivalent for the wordmark, to be used by screen readers in about:mullvad-browser. We add mullvad-branding.css to provide branding colors for about:mullvad-browser. We drop firefox-wordmark.svg changes since the asset should be unused in Mullvad Browser now that about:mullvad-browser uses about-wordmark instead. We drop unnecessary rules from branding aboutDialog.css and make sure the dialog is large enough to show the wordmark for alpha and nightly. - - - - - def514c7 by Henry Wilkes at 2025-03-13T11:13:28+01:00 Mullvad Browser strings This commit adds strings needed by the following Mullvad Browser patches. - - - - - d4e45856 by Henry Wilkes at 2025-03-13T11:18:27+01:00 fixup! Mullvad Browser strings MB 312: Drop mullvad-browser string which has been replaced with mullvad-about-wordmark-en. - - - - - f8c38460 by Pier Angelo Vendrame at 2025-03-13T11:18:27+01:00 MB 20: Allow packaged-addons in PBM. We install a few addons from the distribution directory, but they are not automatically enabled for PBM mode. This commit modifies the code that installs them to also add the PBM permission to the known ones. - - - - - 3444152e by Pier Angelo Vendrame at 2025-03-13T11:18:27+01:00 MB 63: Customize some about pages for Mullvad Browser Also: mullvad-browser#57: Purge unneeded about: pages - - - - - 9a0a0c0f by Pier Angelo Vendrame at 2025-03-13T11:18:27+01:00 MB 37: Customization for the about dialog - - - - - 75861a93 by Henry Wilkes at 2025-03-13T11:18:28+01:00 MB 39: Add home page about:mullvad-browser - - - - - 9bab5a17 by Henry Wilkes at 2025-03-13T11:18:28+01:00 fixup! MB 39: Add home page about:mullvad-browser MB 312: Update the home page for different release channels. We use about-wordmark.svg instead of firefox-wordmark.svg. We use the colors from the mullvad-branding.css sheet to colour the background, link text and outline colors. We now properly support contrast themes, where we do not apply the branding colors. We tweak the sizing and spacing. We switch from XHTML to HTML. We consistently use kebab case for the DOM IDs, rather than camel case. We drop the Open Sans font. - - - - - 2a84dd87 by Pier Angelo Vendrame at 2025-03-13T14:40:20+01:00 fixup! MB 39: Add home page about:mullvad-browser Fix linting. - - - - - f667cd75 by hackademix at 2025-03-13T14:40:20+01:00 MB 97: Remove UI cues to install new extensions. - - - - - 83d2eb98 by hackademix at 2025-03-13T14:40:20+01:00 MB 47: uBlock Origin customization - - - - - 8c5ccd18 by Pier Angelo Vendrame at 2025-03-13T14:40:21+01:00 MB 21: Disable the password manager This commit disables the about:login page and removes the "Login and Password" section of about:preferences. We do not do anything to the real password manager of Firefox, that is in toolkit: it contains C++ parts that make it difficult to actually prevent it from being built.. Finally, we modify the the function that opens about:login to report an error in the console so that we can quickly get a backtrace to the code that tries to use it. - - - - - 5244dae7 by Pier Angelo Vendrame at 2025-03-13T14:40:21+01:00 MB 112: Updater customization for Mullvad Browser MB 71: Set the updater base URL to Mullvad domain - - - - - 66af1d9a by Nicolas Vigier at 2025-03-13T14:40:21+01:00 MB 79: Add Mullvad Browser MAR signing keys MB 256: Add mullvad-browser nightly mar signing key - - - - - 6de09a1e by Pier Angelo Vendrame at 2025-03-13T14:40:21+01:00 MB 34: Hide unsafe and unwanted preferences UI about:preferences allow to override some of our defaults, that could be fingeprintable or have some other unwanted consequences. - - - - - 3533d775 by Pier Angelo Vendrame at 2025-03-13T14:40:22+01:00 MB 160: Disable the cookie exceptions button Besides disabling the "Delete on close checkbox", disable also the "Manage Exceptions" button when always using PBM. - - - - - 845cf1ee by hackademix at 2025-03-13T14:40:22+01:00 MB 163: prevent uBlock Origin from being uninstalled/disabled - - - - - 60eb5c43 by Richard Pospesel at 2025-03-13T14:40:22+01:00 MB 188: Customize Gitlab Issue and Merge templates - - - - - dd1353ac by Morgan at 2025-03-13T14:40:22+01:00 fixup! MB 188: Customize Gitlab Issue and Merge templates add rebase template for rapid channel - - - - - 7bf24bbf by Morgan at 2025-03-13T14:40:23+01:00 fixup! MB 188: Customize Gitlab Issue and Merge templates tweak backport temlpate for mullvad-browser - - - - - 89cf8ea3 by Morgan at 2025-03-13T14:40:23+01:00 fixup! MB 188: Customize Gitlab Issue and Merge templates add /label Apps::Type::Rebase to rebase issue template - - - - - a5ba5037 by Morgan at 2025-03-13T14:40:23+01:00 fixup! MB 188: Customize Gitlab Issue and Merge templates add backport template and tweak the uplift template - - - - - fb1385db by hackademix at 2025-03-13T14:40:23+01:00 fixup! MB 188: Customize Gitlab Issue and Merge templates TBB 41382: Replace gitlab templates ReleasePrep label references with Apps::Type::ReleasePreparation - - - - - 90f99943 by rui hildt at 2025-03-13T14:40:23+01:00 MB 213: Customize the search engines list MB 328: Refactor the search engine patch. Upstream switched to a completely different search engine configuration between ESR 115 and ESR 128. We moved our configuration to a couple of JSON files that do not follow upstream's schemas, as they are overcomplicated for our needs. Also, we keep the old search engine extensions for now, as upstream also kept them, and planned of removing them with Bug 1885953. - - - - - 2c6f85b8 by Pier Angelo Vendrame at 2025-03-13T14:40:24+01:00 fixup! MB 213: Customize the search engines list MB 395: Make Leta the default search engine. - - - - - 7ac5cb4e by hackademix at 2025-03-13T14:40:24+01:00 MB 214: Enable cross-tab identity leak protection in "quiet" mode - - - - - 37c5c589 by Pier Angelo Vendrame at 2025-03-13T14:40:24+01:00 MB 80: Enable Mullvad Browser as a default browser - - - - - 2582cc80 by Pier Angelo Vendrame at 2025-03-13T14:40:24+01:00 MB 320: Temporarily disable WebRTC and WDBA on Windows. WebRTC should be re-enabled when tor-browser#42758 is resolved, and and the default browser agent when in general we make this feature work again. - - - - - 10554634 by Henry Wilkes at 2025-03-13T14:40:25+01:00 MB 329: Customize toolbar for mullvad-browser. - - - - - b2cf35cb by Henry Wilkes at 2025-03-13T14:40:25+01:00 Add CI for Mullvad Browser - - - - - 261 changed files: - .gitlab/ci/jobs/update-translations.yml - .gitlab/issue_templates/Backport.md - .gitlab/issue_templates/Emergency Security Issue.md - + .gitlab/issue_templates/Rebase Browser - Alpha.md - + .gitlab/issue_templates/Rebase Browser - Rapid.md - + .gitlab/issue_templates/Rebase Browser - Stable.md - .gitlab/merge_request_templates/default.md - browser/app/Makefile.in - browser/app/macbuild/Contents/Info.plist.in - browser/app/module.ver - browser/app/firefox.exe.manifest → browser/app/mullvadbrowser.exe.manifest - + browser/app/profile/000-mullvad-browser.js - browser/app/profile/001-base-profile.js - browser/base/content/aboutDialog.xhtml - browser/base/content/appmenu-viewcache.inc.xhtml - browser/base/content/browser-menubar.inc - browser/base/content/browser-places.js - browser/base/content/browser.js - browser/base/content/default-bookmarks.html - browser/base/content/nsContextMenu.sys.mjs - browser/base/content/overrides/app-license.html - browser/base/content/pageinfo/pageInfo.xhtml - browser/base/content/utilityOverlay.js - browser/branding/branding-common.mozbuild - + browser/branding/mb-alpha/VisualElements_150.png - + browser/branding/mb-alpha/VisualElements_70.png - + browser/branding/mb-alpha/configure.sh - + browser/branding/mb-alpha/content/about-logo.png - + browser/branding/mb-alpha/content/about-logo.svg - + browser/branding/mb-alpha/content/about-logo(a)2x.png - + browser/branding/mb-alpha/content/about-wordmark.svg - + browser/branding/mb-alpha/content/about.png - + browser/branding/mb-alpha/content/aboutDialog.css - + browser/branding/mb-alpha/content/firefox-wordmark.svg - + browser/branding/mb-alpha/content/icon128.png - + browser/branding/mb-alpha/content/icon16.png - + browser/branding/mb-alpha/content/icon256.png - + browser/branding/mb-alpha/content/icon32.png - + browser/branding/mb-alpha/content/icon48.png - + browser/branding/mb-alpha/content/icon64.png - + browser/branding/mb-alpha/content/jar.mn - + browser/branding/mb-alpha/content/moz.build - + browser/branding/mb-alpha/content/mullvad-branding.css - + browser/branding/mb-alpha/default128.png - + browser/branding/mb-alpha/default16.png - + browser/branding/mb-alpha/default22.png - + browser/branding/mb-alpha/default24.png - + browser/branding/mb-alpha/default256.png - + browser/branding/mb-alpha/default32.png - + browser/branding/mb-alpha/default48.png - + browser/branding/mb-alpha/default64.png - + browser/branding/mb-alpha/document.icns - + browser/branding/mb-alpha/document.ico - + browser/branding/mb-alpha/document_pdf.ico - + browser/branding/mb-alpha/firefox.icns - + browser/branding/mb-alpha/firefox.ico - + browser/branding/mb-alpha/firefox.svg - + browser/branding/mb-alpha/locales/en-US/brand.ftl - + browser/branding/mb-alpha/locales/en-US/brand.properties - + browser/branding/mb-alpha/locales/jar.mn - + browser/branding/mb-alpha/locales/moz.build - + browser/branding/mb-alpha/locales/mullvad-about-wordmark-en.ftl - + browser/branding/mb-alpha/moz.build - + browser/branding/mb-alpha/mullvadbrowser.VisualElementsManifest.xml - + browser/branding/mb-alpha/newtab.ico - + browser/branding/mb-alpha/newwindow.ico - + browser/branding/mb-alpha/pbmode.ico - + browser/branding/mb-alpha/pref/firefox-branding.js - + browser/branding/mb-nightly/VisualElements_150.png - + browser/branding/mb-nightly/VisualElements_70.png - + browser/branding/mb-nightly/configure.sh - + browser/branding/mb-nightly/content/about-logo.png - + browser/branding/mb-nightly/content/about-logo.svg - + browser/branding/mb-nightly/content/about-logo(a)2x.png - + browser/branding/mb-nightly/content/about-wordmark.svg - + browser/branding/mb-nightly/content/about.png - + browser/branding/mb-nightly/content/aboutDialog.css - + browser/branding/mb-nightly/content/firefox-wordmark.svg - + browser/branding/mb-nightly/content/icon128.png - + browser/branding/mb-nightly/content/icon16.png - + browser/branding/mb-nightly/content/icon256.png - + browser/branding/mb-nightly/content/icon32.png - + browser/branding/mb-nightly/content/icon48.png - + browser/branding/mb-nightly/content/icon64.png - + browser/branding/mb-nightly/content/jar.mn - + browser/branding/mb-nightly/content/moz.build - + browser/branding/mb-nightly/content/mullvad-branding.css - + browser/branding/mb-nightly/default128.png - + browser/branding/mb-nightly/default16.png - + browser/branding/mb-nightly/default22.png - + browser/branding/mb-nightly/default24.png - + browser/branding/mb-nightly/default256.png - + browser/branding/mb-nightly/default32.png - + browser/branding/mb-nightly/default48.png - + browser/branding/mb-nightly/default64.png - + browser/branding/mb-nightly/document.icns - + browser/branding/mb-nightly/document.ico - + browser/branding/mb-nightly/document_pdf.ico - + browser/branding/mb-nightly/firefox.icns - + browser/branding/mb-nightly/firefox.ico - + browser/branding/mb-nightly/firefox.svg - + browser/branding/mb-nightly/locales/en-US/brand.ftl - + browser/branding/mb-nightly/locales/en-US/brand.properties - + browser/branding/mb-nightly/locales/jar.mn - + browser/branding/mb-nightly/locales/moz.build - + browser/branding/mb-nightly/locales/mullvad-about-wordmark-en.ftl - + browser/branding/mb-nightly/moz.build - + browser/branding/mb-nightly/mullvadbrowser.VisualElementsManifest.xml - + browser/branding/mb-nightly/newtab.ico - + browser/branding/mb-nightly/newwindow.ico - + browser/branding/mb-nightly/pbmode.ico - + browser/branding/mb-nightly/pref/firefox-branding.js - + browser/branding/mb-release/VisualElements_150.png - + browser/branding/mb-release/VisualElements_70.png - + browser/branding/mb-release/configure.sh - + browser/branding/mb-release/content/about-logo.png - + browser/branding/mb-release/content/about-logo.svg - + browser/branding/mb-release/content/about-logo(a)2x.png - + browser/branding/mb-release/content/about-wordmark.svg - + browser/branding/mb-release/content/about.png - + browser/branding/mb-release/content/aboutDialog.css - + browser/branding/mb-release/content/firefox-wordmark.svg - + browser/branding/mb-release/content/icon128.png - + browser/branding/mb-release/content/icon16.png - + browser/branding/mb-release/content/icon256.png - + browser/branding/mb-release/content/icon32.png - + browser/branding/mb-release/content/icon48.png - + browser/branding/mb-release/content/icon64.png - + browser/branding/mb-release/content/jar.mn - + browser/branding/mb-release/content/moz.build - + browser/branding/mb-release/content/mullvad-branding.css - + browser/branding/mb-release/default128.png - + browser/branding/mb-release/default16.png - + browser/branding/mb-release/default22.png - + browser/branding/mb-release/default24.png - + browser/branding/mb-release/default256.png - + browser/branding/mb-release/default32.png - + browser/branding/mb-release/default48.png - + browser/branding/mb-release/default64.png - + browser/branding/mb-release/document.icns - + browser/branding/mb-release/document.ico - + browser/branding/mb-release/document_pdf.ico - + browser/branding/mb-release/firefox.icns - + browser/branding/mb-release/firefox.ico - + browser/branding/mb-release/firefox.svg - + browser/branding/mb-release/locales/en-US/brand.ftl - + browser/branding/mb-release/locales/en-US/brand.properties - + browser/branding/mb-release/locales/jar.mn - + browser/branding/mb-release/locales/moz.build - + browser/branding/mb-release/locales/mullvad-about-wordmark-en.ftl - + browser/branding/mb-release/moz.build - + browser/branding/mb-release/mullvadbrowser.VisualElementsManifest.xml - + browser/branding/mb-release/newtab.ico - + browser/branding/mb-release/newwindow.ico - + browser/branding/mb-release/pbmode.ico - + browser/branding/mb-release/pref/firefox-branding.js - browser/components/BrowserContentHandler.sys.mjs - browser/components/BrowserGlue.sys.mjs - browser/components/about/AboutRedirector.cpp - browser/components/about/components.conf - browser/components/customizableui/CustomizableUI.sys.mjs - browser/components/moz.build - + browser/components/mullvad-browser/AboutMullvadBrowserChild.sys.mjs - + browser/components/mullvad-browser/AboutMullvadBrowserParent.sys.mjs - + browser/components/mullvad-browser/content/2728-sparkles.svg - + browser/components/mullvad-browser/content/aboutMullvadBrowser.css - + browser/components/mullvad-browser/content/aboutMullvadBrowser.html - + browser/components/mullvad-browser/content/aboutMullvadBrowser.js - + browser/components/mullvad-browser/jar.mn - + browser/components/mullvad-browser/moz.build - browser/components/newtab/AboutNewTabService.sys.mjs - browser/components/preferences/home.inc.xhtml - browser/components/preferences/main.js - browser/components/preferences/preferences.xhtml - browser/components/preferences/privacy.inc.xhtml - browser/components/preferences/privacy.js - browser/components/preferences/search.inc.xhtml - + browser/components/search/extensions/brave/favicon.svg - + browser/components/search/extensions/brave/manifest.json - + browser/components/search/extensions/ddg-html/favicon.ico - + browser/components/search/extensions/ddg-html/manifest.json - browser/components/search/extensions/ddg/manifest.json - + browser/components/search/extensions/metager/favicon.ico - + browser/components/search/extensions/metager/manifest.json - + browser/components/search/extensions/mojeek/favicon.ico - + browser/components/search/extensions/mojeek/manifest.json - + browser/components/search/extensions/mullvad-leta/favicon.svg - + browser/components/search/extensions/mullvad-leta/manifest.json - + browser/components/search/extensions/startpage/favicon.png - + browser/components/search/extensions/startpage/manifest.json - browser/components/shell/ShellService.sys.mjs - browser/components/shell/WindowsDefaultBrowser.cpp - browser/components/shell/nsWindowsShellService.cpp - browser/config/mozconfigs/base-browser - + browser/config/mozconfigs/mullvad-browser - browser/confvars.sh - browser/installer/package-manifest.in - browser/installer/windows/nsis/updater_append.ini - browser/modules/HomePage.sys.mjs - browser/moz.build - browser/moz.configure - config/create_rc.py - devtools/client/aboutdebugging/src/actions/runtimes.js - devtools/client/aboutdebugging/src/components/sidebar/Sidebar.js - devtools/client/jar.mn - devtools/client/themes/images/aboutdebugging-firefox-aurora.svg - devtools/client/themes/images/aboutdebugging-firefox-beta.svg - devtools/client/themes/images/aboutdebugging-firefox-logo.svg - devtools/client/themes/images/aboutdebugging-firefox-nightly.svg - devtools/client/themes/images/aboutdebugging-firefox-release.svg - + devtools/client/themes/images/aboutdebugging-mullvadbrowser-logo.svg - docshell/base/nsAboutRedirector.cpp - docshell/build/components.conf - moz.configure - mozconfig-linux-aarch64 - mozconfig-linux-aarch64-dev - mozconfig-linux-x86_64 - mozconfig-linux-x86_64-asan - mozconfig-linux-x86_64-dev - mozconfig-macos - mozconfig-macos-dev - mozconfig-windows-x86_64 - + other-licenses/nsis/Contrib/ApplicationID/Makefile - + other-licenses/nsis/Contrib/CityHash/Makefile - toolkit/components/extensions/child/ext-storage.js - toolkit/components/extensions/parent/ext-storage.js - toolkit/components/passwordmgr/LoginHelper.sys.mjs - toolkit/components/search/AppProvidedSearchEngine.sys.mjs - toolkit/components/search/SearchService.sys.mjs - + toolkit/components/search/content/brave.svg - + toolkit/components/search/content/duckduckgo.ico - + toolkit/components/search/content/metager.ico - + toolkit/components/search/content/mojeek.ico - + toolkit/components/search/content/mullvad-leta.svg - + toolkit/components/search/content/mullvadBrowserSearchEngineIcons.json - + toolkit/components/search/content/mullvadBrowserSearchEngines.json - + toolkit/components/search/content/startpage.png - + toolkit/components/search/jar.mn - toolkit/components/search/moz.build - toolkit/components/securitylevel/SecurityLevel.sys.mjs - + toolkit/content/aboutRightsMullvad.xhtml - + toolkit/content/aboutTelemetryMullvad.xhtml - toolkit/content/jar.mn - toolkit/content/widgets/moz-support-link/moz-support-link.mjs - + toolkit/locales/en-US/toolkit/global/mullvad-browser.ftl - toolkit/mozapps/defaultagent/EventLog.h - toolkit/mozapps/defaultagent/SetDefaultBrowser.cpp - toolkit/mozapps/extensions/AddonManager.sys.mjs - toolkit/mozapps/extensions/content/aboutaddons.css - toolkit/mozapps/extensions/internal/XPIDatabase.sys.mjs - toolkit/mozapps/extensions/internal/XPIProvider.sys.mjs - toolkit/mozapps/update/updater/nightly_aurora_level3_primary.der - toolkit/mozapps/update/updater/nightly_aurora_level3_secondary.der - toolkit/mozapps/update/updater/release_primary.der - toolkit/mozapps/update/updater/release_secondary.der - + toolkit/themes/shared/icons/mullvadbrowser.png - toolkit/themes/shared/minimal-toolkit.jar.inc.mn - toolkit/xre/nsAppRunner.cpp - tools/lint/fluent-lint/exclusions.yml - widget/windows/WinTaskbar.cpp - widget/windows/moz.build The diff was not included because it is too large. View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/compare/74… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/compare/74… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] 2 commits: Bug 41423: Partially revert 9345a6ea
by brizental (＠brizental) 03 Apr '25

03 Apr '25

brizental pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: f455533a by Beatriz Rizental at 2025-04-03T09:20:42+02:00 Bug 41423: Partially revert 9345a6ea We revert the removal of NSS and other things that allowed building the rust libraries in the application-services project. - - - - - db912ff7 by Beatriz Rizental at 2025-04-03T09:20:52+02:00 Bug 41423: Update a-s noop patch to build places component The places component is responsible for the backend of Bookmarks. We cannot make it a no-op like the other components because we actually want the bookmarks feature in our browsers. - - - - - 8 changed files: - projects/application-services/README.md - projects/application-services/a-s-noop.diff - + projects/application-services/apply-bug-13028.diff - + projects/application-services/bug_13028.patch - projects/application-services/build - projects/application-services/config - projects/application-services/list_toolchain_updates_checks - + projects/application-services/no-ndk-lookup.diff Changes: ===================================== projects/application-services/README.md ===================================== @@ -46,6 +46,15 @@ We keep the list of files to download in `gradle-dependencies-list.txt`. A procedure to create this file is documented in [tor-browser-build#40855](https://gitlab.torproject.org/tpo/applications/tor…. +## Other dependencies + +Finally, Application Services depends on +[NSS](https://firefox-source-docs.mozilla.org/security/nss/index.html). +We used to have a separate tor-browser-build project for it, but it was +almost an exact copy of the script included in this repository. +Keeping it updated wasn't trivial, so we decided to run Mozilla's scripts +instead. + # Caveats ## Git repository information ===================================== projects/application-services/a-s-noop.diff ===================================== @@ -1,5 +1,5 @@ diff --git a/components/fxa-client/android/src/main/java/mozilla/appservices/fxaclient/Config.kt b/components/fxa-client/android/src/main/java/mozilla/appservices/fxaclient/Config.kt -index 78c16dd0..d2615fa7 100644 +index 78c16dd0a..d2615fa74 100644 --- a/components/fxa-client/android/src/main/java/mozilla/appservices/fxaclient/Config.kt +++ b/components/fxa-client/android/src/main/java/mozilla/appservices/fxaclient/Config.kt @@ -13,4 +13,5 @@ fun FxaServer.contentUrl() = when (this) { @@ -9,7 +9,7 @@ index 78c16dd0..d2615fa7 100644 + is FxaServer.__NOOP -> "" } diff --git a/components/nimbus/android/src/main/java/org/mozilla/experiments/nimbus/Nimbus.kt b/components/nimbus/android/src/main/java/org/mozilla/experiments/nimbus/Nimbus.kt -index 8c05be9c..6bf2ec15 100644 +index 8c05be9cf..6bf2ec15d 100644 --- a/components/nimbus/android/src/main/java/org/mozilla/experiments/nimbus/Nimbus.kt +++ b/components/nimbus/android/src/main/java/org/mozilla/experiments/nimbus/Nimbus.kt @@ -532,6 +532,8 @@ open class Nimbus( @@ -21,41 +21,97 @@ index 8c05be9c..6bf2ec15 100644 } } } -diff --git a/components/places/android/src/main/java/mozilla/appservices/places/PlacesConnection.kt b/components/places/android/src/main/java/mozilla/appservices/places/PlacesConnection.kt -index 282f4e90..db8b00a3 100644 ---- a/components/places/android/src/main/java/mozilla/appservices/places/PlacesConnection.kt -+++ b/components/places/android/src/main/java/mozilla/appservices/places/PlacesConnection.kt -@@ -289,6 +289,7 @@ internal fun VisitType.toInt(): Int { - VisitType.FRAMED_LINK -> 8 - VisitType.RELOAD -> 9 - VisitType.UPDATE_PLACE -> 10 -+ VisitType.__NOOP -> -1 - } - } +diff --git a/megazords/full/Cargo.toml b/megazords/full/Cargo.toml +index 75f44a812..a51c0643b 100644 +--- a/megazords/full/Cargo.toml ++++ b/megazords/full/Cargo.toml +@@ -9,21 +9,21 @@ license = "MPL-2.0"9345a6ea + crate-type = ["cdylib"] -diff --git a/megazords/full/android/build.gradle b/megazords/full/android/build.gradle -index 822ce180..ccdc6c8a 100644 ---- a/megazords/full/android/build.gradle -+++ b/megazords/full/android/build.gradle -@@ -54,6 +54,8 @@ configurations { - } + [dependencies] +-fxa-client = { path = "../../components/fxa-client" } +-logins = { path = "../../components/logins" } +-tabs = { path = "../../components/tabs/" } +-sync_manager = { path = "../../components/sync_manager/" } ++# fxa-client = { path = "../../components/fxa-client" } ++# logins = { path = "../../components/logins" } ++# tabs = { path = "../../components/tabs/" } ++# sync_manager = { path = "../../components/sync_manager/" } + # TODO: Uncomment this code when webext-storage component is integrated in android + # webext-storage = { path = "../../components/webext-storage/" } + places = { path = "../../components/places" } +-push = { path = "../../components/push" } +-remote_settings = { path = "../../components/remote_settings" } +-rust-log-forwarder = { path = "../../components/support/rust-log-forwarder" } +-viaduct = { path = "../../components/viaduct" } +-nimbus-sdk = { path = "../../components/nimbus" } +-autofill = { path = "../../components/autofill" } +-crashtest = { path = "../../components/crashtest" } +-error-support = { path = "../../components/support/error" } +-suggest = { path = "../../components/suggest" } ++# push = { path = "../../components/push" } ++# remote_settings = { path = "../../components/remote_settings" } ++# rust-log-forwarder = { path = "../../components/support/rust-log-forwarder" } ++# viaduct = { path = "../../components/viaduct" } ++# nimbus-sdk = { path = "../../components/nimbus" } ++# autofill = { path = "../../components/autofill" } ++# crashtest = { path = "../../components/crashtest" } ++# error-support = { path = "../../components/support/error" } ++# suggest = { path = "../../components/suggest" } - cargo { -+ cargoCommand = "${rootDir}/megazords/full/android/cargo-no-build.sh" -+ - // The directory of the Cargo.toml to build. - module = '..' + lazy_static = "1.4" +diff --git a/megazords/full/src/lib.rs b/megazords/full/src/lib.rs +index 01d1be98b..a68eb647f 100644 +--- a/megazords/full/src/lib.rs ++++ b/megazords/full/src/lib.rs +@@ -8,20 +8,20 @@ + use std::ffi::CString; + use std::os::raw::c_char; + +-pub use autofill; +-pub use crashtest; +-pub use error_support; +-pub use fxa_client; +-pub use logins; +-pub use nimbus; ++// pub use autofill; ++// pub use crashtest; ++// pub use error_support; ++// pub use fxa_client; ++// pub use logins; ++// pub use nimbus; + pub use places; +-pub use push; +-pub use remote_settings; +-pub use rust_log_forwarder; +-pub use suggest; +-pub use sync_manager; +-pub use tabs; +-pub use viaduct; ++// pub use push; ++// pub use remote_settings; ++// pub use rust_log_forwarder; ++// pub use suggest; ++// pub use sync_manager; ++// pub use tabs; ++// pub use viaduct; + // TODO: Uncomment this code when webext-storage component is integrated in android + // pub use webext_storage; diff --git a/publish.gradle b/publish.gradle -index 71f5d55b..027665ff 100644 +index 71f5d55b9..659e26489 100644 --- a/publish.gradle +++ b/publish.gradle -@@ -194,7 +194,7 @@ ext.configureUniFFIBindgen = { udlFilePath -> +@@ -194,7 +194,11 @@ ext.configureUniFFIBindgen = { udlFilePath -> def uniffiGeneratedPath = "generated/source/uniffi/${variant.name}/java" def t = tasks.register("generate${variant.name.capitalize()}UniFFIBindings", Exec) { workingDir project.rootDir - commandLine '/usr/bin/env', 'cargo', 'uniffi-bindgen', 'generate', "${project.projectDir}/${udlFilePath}", '--language', 'kotlin', '--out-dir', "${buildDir}/${uniffiGeneratedPath}" -+ commandLine '/usr/bin/env', "${rootProject.projectDir}/uniffi-rs/uniffi-bindgen", 'generate', "${project.projectDir}/${udlFilePath}", '--language', 'kotlin', '--out-dir', "${buildDir}/${uniffiGeneratedPath}" ++ if (udlFilePath.contains("places")) { ++ commandLine '/usr/bin/env', 'cargo', 'uniffi-bindgen', 'generate', "${project.projectDir}/${udlFilePath}", '--language', 'kotlin', '--out-dir', "${buildDir}/${uniffiGeneratedPath}" ++ } else { ++ commandLine '/usr/bin/env', "${rootProject.projectDir}/uniffi-rs/uniffi-bindgen", 'generate', "${project.projectDir}/${udlFilePath}", '--language', 'kotlin', '--out-dir', "${buildDir}/${uniffiGeneratedPath}" ++ } outputs.dir "${buildDir}/${uniffiGeneratedPath}" // Re-generate if the interface definition changes. inputs.file "${project.projectDir}/${udlFilePath}" ===================================== projects/application-services/apply-bug-13028.diff ===================================== @@ -0,0 +1,20 @@ +diff --git a/libs/build-all.sh b/libs/build-all.sh +index 650c1299..6c4e5404 100755 +--- a/libs/build-all.sh ++++ b/libs/build-all.sh +@@ -128,6 +128,15 @@ echo $'\ + fi + ' | patch "${NSS_SRC_PATH}/nspr/configure" + ++rm -f python ++ln -s /usr/bin/python3 python ++export PATH=$(pwd):$PATH ++patch_13028=$(realpath bug_13028.patch) ++pushd $NSS_SRC_PATH ++# Apply our proxy bypass defense-in-depth here as well to be on the safe side. ++patch -p2 < $patch_13028 ++popd ++ + if [[ "${PLATFORM}" == "ios" ]] + then + ./build-all-ios.sh "${SQLCIPHER_SRC_PATH}" "${NSS_SRC_PATH}" ===================================== projects/application-services/bug_13028.patch ===================================== @@ -0,0 +1,79 @@ +From 2f0888c348561249d3083555db33c5619840dbfa Mon Sep 17 00:00:00 2001 +From: Mike Perry <mikeperry-git(a)torproject.org> +Date: Mon, 29 Sep 2014 14:30:19 -0700 +Subject: [PATCH] Bug 13028: Prevent potential proxy bypass cases. + +It looks like these cases should only be invoked in the NSS command line +tools, and not the browser, but I decided to patch them anyway because there +literally is a maze of network function pointers being passed around, and it's +very hard to tell if some random code might not pass in the proper proxied +versions of the networking code here by accident. + +diff --git a/security/nss/lib/certhigh/ocsp.c b/security/nss/lib/certhigh/ocsp.c +index cea8456606bf..86fa971cfbef 100644 +--- a/security/nss/lib/certhigh/ocsp.c ++++ b/security/nss/lib/certhigh/ocsp.c +@@ -2932,6 +2932,14 @@ ocsp_ConnectToHost(const char *host, PRUint16 port) + PRNetAddr addr; + char *netdbbuf = NULL; + ++ // XXX: Do we need a unittest ifdef here? We don't want to break the tests, but ++ // we want to ensure nothing can ever hit this code in production. ++#if 1 ++ printf("Tor Browser BUG: Attempted OSCP direct connect to %s, port %u\n", host, ++ port); ++ goto loser; ++#endif ++ + sock = PR_NewTCPSocket(); + if (sock == NULL) + goto loser; +diff --git a/security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_socket.c b/security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_socket.c +index e8698376b5be..85791d84a932 100644 +--- a/security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_socket.c ++++ b/security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_socket.c +@@ -1334,6 +1334,13 @@ pkix_pl_Socket_Create( + plContext), + PKIX_COULDNOTCREATESOCKETOBJECT); + ++ // XXX: Do we need a unittest ifdef here? We don't want to break the tests, but ++ // we want to ensure nothing can ever hit this code in production. ++#if 1 ++ printf("Tor Browser BUG: Attempted pkix direct socket connect\n"); ++ PKIX_ERROR(PKIX_PRNEWTCPSOCKETFAILED); ++#endif ++ + socket->isServer = isServer; + socket->timeout = timeout; + socket->clientSock = NULL; +@@ -1433,6 +1440,13 @@ pkix_pl_Socket_CreateByName( + + localCopyName = PL_strdup(serverName); + ++ // XXX: Do we need a unittest ifdef here? We don't want to break the tests, but ++ // we want to ensure nothing can ever hit this code in production. ++#if 1 ++ printf("Tor Browser BUG: Attempted pkix direct connect to %s\n", serverName); ++ PKIX_ERROR(PKIX_PRNEWTCPSOCKETFAILED); ++#endif ++ + sepPtr = strchr(localCopyName, ':'); + /* First strip off the portnum, if present, from the end of the name */ + if (sepPtr) { +@@ -1582,6 +1596,13 @@ pkix_pl_Socket_CreateByHostAndPort( + PKIX_ENTER(SOCKET, "pkix_pl_Socket_CreateByHostAndPort"); + PKIX_NULLCHECK_THREE(hostname, pStatus, pSocket); + ++ // XXX: Do we need a unittest ifdef here? We don't want to break the tests, but ++ // we want to ensure nothing can ever hit this code in production. ++#if 1 ++ printf("Tor Browser BUG: Attempted pkix direct connect to %s, port %u\n", hostname, ++ portnum); ++ PKIX_ERROR(PKIX_PRNEWTCPSOCKETFAILED); ++#endif + + prstatus = PR_GetHostByName(hostname, buf, sizeof(buf), &hostent); + +-- +2.27.0 + ===================================== projects/application-services/build ===================================== @@ -83,6 +83,15 @@ cp $builddir/uniffi-rs/uniffi-bindgen glean-core/android-native/ patch -p1 < $rootdir/glean-noop.diff popd +pushd libs +ln -s $rootdir/[% c("input_files_by_name/nss") %] ./ +ln -s $rootdir/bug_13028.patch +patch -p2 < $rootdir/apply-bug-13028.diff +patch -p2 < $rootdir/no-ndk-lookup.diff +./build-all.sh desktop +./build-all.sh android +popd + [% IF c('var/fetch_gradle_dependencies') %] # XXX: `assemble` is still not enough to see all fetched dependencies via # Gradle's --debug. See: tor-browser-build#40056. ===================================== projects/application-services/config ===================================== @@ -11,8 +11,8 @@ var: gradle_dependencies_version: 11 gradle_version: 8.8 glean_parser: 14.0.1 - # This is the only project for which the rust lib will actually be built - cargo_vendor_subdir: components/support/nimbus-fml + nss_version: '3.101' + nspr_version: '4.35' steps: build: @@ -22,6 +22,9 @@ steps: # builds when build time differ a lot, we need to do periodic rebuilds: # https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/merge_re… rebuild_date: '2024-09-12' + arch_deps: + # Needed to build NSS + - gyp input_files: - project: container-image pkg_type: build @@ -46,6 +49,10 @@ steps: - URL: 'https://dl.google.com/android/repository/build-tools_r30.0.3-linux.zip' name: build_tools_30 sha256sum: 24593500aa95d2f99fb4f10658aae7e65cb519be6cd33fa164f15f27f3c4a2d6 + # NSS version ans sha256 are in libs/build-all.sh. + - URL: 'https://ftp.mozilla.org/pub/security/nss/releases/NSS_[% c("var/nss_version") | replace("\\.", "_") %]_RTM/src/nss-[% c("var/nss_version") %]-with-nspr-[% c("var/nspr_version") %].tar.gz' + name: nss + sha256sum: 566faa9283ff3d9a7d6c44272df6e4330e3e06ca4e841a68840d31b27c9161c4 - filename: 'gradle-dependencies-[% c("var/gradle_dependencies_version") %]' name: gradle-dependencies exec: '[% INCLUDE "fetch-gradle-dependencies" %]' @@ -63,10 +70,11 @@ steps: enable: '[% !c("var/fetch_gradle_dependencies") %]' - filename: gen_gradle_deps_file.sh enable: '[% c("var/fetch_gradle_dependencies") %]' - # tor-browser-build#40485: Make sure the Kotlin output of nimbus-fml - # has deterministic order for reproducibility. - # Delete when this patch is included upstream. + - filename: bug_13028.patch + - filename: apply-bug-13028.diff + # Delete when this patch is included upstream - filename: bug40485-nimbus-fml-reproducibility.diff + - filename: no-ndk-lookup.diff # as-ohttp-client lists both the version for ohttp and a git repo + rev, # but this breaks the vendoring for offline builds. - filename: ohttp-no-git.diff ===================================== projects/application-services/list_toolchain_updates_checks ===================================== @@ -36,6 +36,17 @@ current='[% c("var/gradle_version") %]' check_update_needed gradle "$needed" "$current" +# nss-nspr +read -d '' p << 'EOF' || true +if (m/NSS_ARCHIVE="nss-(.*-with-nspr-.*)\\.tar\\.gz"/) { + print $1; + exit; +} +EOF +needed=$(cat libs/build-all.sh | perl -ne "$p") +current='[% c("var/nss_version") %]-with-nspr-[% c("var/nspr_version") %]' +check_update_needed nss-nspr "$needed" "$current" + # uniffi read -d '' p << 'EOF' || true if (m/^\\s*uniffi\\s*=\\s*"([^"]*)"/) { ===================================== projects/application-services/no-ndk-lookup.diff ===================================== @@ -0,0 +1,18 @@ +diff --git a/libs/android_defaults.sh b/libs/android_defaults.sh +index 2cfcc4206..9e3d3de97 100755 +--- a/libs/android_defaults.sh ++++ b/libs/android_defaults.sh +@@ -1,11 +1,7 @@ + #!/usr/bin/env bash + +-# Find the NDK. +-pushd .. +-NDK_VERSION=$(./gradlew -q printNdkVersion | tail -1) +-export ANDROID_NDK_HOME="$ANDROID_HOME/ndk/$NDK_VERSION" +-export ANDROID_NDK_ROOT="$ANDROID_NDK_HOME" +-popd || exit ++# Do not try to find the NDK, as it does not work offline. ++# We already define the needed variables in our environment. + + if [[ -z "${ANDROID_NDK_API_VERSION:-}" ]]; then + export ANDROID_NDK_API_VERSION=21 View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/compare/… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/compare/… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-128.9.0esr-14.5-1] fixup! TB 3455: Add DomainIsolator, for isolating circuit by domain.
by Pier Angelo Vendrame (＠pierov) 03 Apr '25

03 Apr '25

Pier Angelo Vendrame pushed to branch tor-browser-128.9.0esr-14.5-1 at The Tor Project / Applications / Tor Browser Commits: 9e832b90 by Pier Angelo Vendrame at 2025-04-03T09:05:32+02:00 fixup! TB 3455: Add DomainIsolator, for isolating circuit by domain. TB 43604: fix DomainIsolator.#clearKnownCircuits on Android. Window type "navigator:browser" does not match GeckoView sessions. So, in addition to that, we iterate on "navigator:geckoview" windows. - - - - - 1 changed file: - toolkit/components/tor-launcher/TorDomainIsolator.sys.mjs Changes: ===================================== toolkit/components/tor-launcher/TorDomainIsolator.sys.mjs ===================================== @@ -543,11 +543,12 @@ class TorDomainIsolatorImpl { return; } + const circuit = this.#knownCircuits.get(id); logger.debug( - `Found new credentials ${username} ${password} for browser`, - browser + `Found new credentials ${username} ${password} for browser ${browser.browserId}.`, + browser, + circuit ); - const circuit = this.#knownCircuits.get(id); if (circuit?.length) { circuitIds.current = id; if (circuitIds.pending === id) { @@ -634,15 +635,23 @@ class TorDomainIsolatorImpl { */ #clearKnownCircuits() { logger.info("Running the circuit cleanup"); - const windows = []; - const enumerator = Services.wm.getEnumerator("navigator:browser"); - while (enumerator.hasMoreElements()) { - windows.push(enumerator.getNext()); - } - const browsers = windows - .flatMap(win => win.gBrowser.browsers.map(b => b.browserId)) - .filter(id => this.#browsers.has(id)); - this.#browsers = new Map(browsers.map(id => [id, this.#browsers.get(id)])); + const getWindows = type => { + const windows = []; + const enumerator = Services.wm.getEnumerator(type); + while (enumerator.hasMoreElements()) { + windows.push(enumerator.getNext()); + } + return windows; + }; + const browserIds = [ + ...getWindows("navigator:browser").flatMap(win => + win.gBrowser.browsers.map(b => b.browserId) + ), + ...getWindows("navigator:geckoview").map(gv => gv.browser.browserId), + ].filter(id => this.#browsers.has(id)); + this.#browsers = new Map( + browserIds.map(id => [id, this.#browsers.get(id)]) + ); this.#knownCircuits = new Map( Array.from(this.#browsers.values(), circuits => Array.from(circuits.values(), ids => { View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/9e832b9… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/9e832b9… You're receiving this email because of your account on gitlab.torproject.org.

1 0