July 2026 - tor-commits - lists.torproject.org

[Git][tpo/applications/tor-browser-build] Pushed new tag mb-16.0a8-build1
by Pier Angelo Vendrame (＠pierov) 01 Jul '26

01 Jul '26

Pier Angelo Vendrame pushed new tag mb-16.0a8-build1 at The Tor Project / Applications / tor-browser-build -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/tree/mb-… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser-build] Pushed new tag tbb-16.0a8-build1
by Pier Angelo Vendrame (＠pierov) 01 Jul '26

01 Jul '26

Pier Angelo Vendrame pushed new tag tbb-16.0a8-build1 at The Tor Project / Applications / tor-browser-build -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/tree/tbb… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41811&41812: Prepare Tor&Mullvad Browser 16.0a8 (bumps).
by Pier Angelo Vendrame (＠pierov) 01 Jul '26

01 Jul '26

Pier Angelo Vendrame pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 0ae43031 by Pier Angelo Vendrame at 2026-07-01T10:43:32+02:00 Bug 41811&41812: Prepare Tor&Mullvad Browser 16.0a8 (bumps). Bumped some tags and updated the changelogs. - - - - - 7 changed files: - projects/browser/Bundle-Data/Docs-MB/ChangeLog.txt - projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt - projects/browser/config - projects/firefox/config - projects/tor/config - projects/translation/config - rbm.conf Changes: ===================================== projects/browser/Bundle-Data/Docs-MB/ChangeLog.txt ===================================== @@ -1,7 +1,7 @@ -Mullvad Browser 16.0a8 - June 25 2026 +Mullvad Browser 16.0a8 - July 01 2026 * All Platforms * Updated Firefox to 152.0a1 - * Updated NoScript to 13.6.24.90101984 + * Updated NoScript to 13.6.25.90301984 * Bug 44528: Make sure desktop IP Protection is disabled on desktop [tor-browser] * Bug 44795: Revert BB 27604 patch as not needed anymore [tor-browser] * Bug 44857: Drop `browser.display.use_system_colors` from our preference list [tor-browser] @@ -16,7 +16,7 @@ Mullvad Browser 16.0a8 - June 25 2026 * Bug 45043: Re-add missing changes to settings after 151/152 rebase [tor-browser] * Bug 45047: Cross-site oracle via worklet rejection error in Safer Mode [tor-browser] * Bug 45072: Disable XSLT already for 16.0 [tor-browser] - * Bug 41821: Update gpg subkeys for boklm [tor-browser-build] + * Bug 45083: Error in about:preferences due to ipprotection missing [tor-browser] * Windows * Bug 552: ABI::Windows::Graphics::Capture::IID_IGraphicsCaptureSession2 is used again in wgc_capture_session.cc [mullvad-browser] * macOS @@ -28,6 +28,8 @@ Mullvad Browser 16.0a8 - June 25 2026 * Bug 41802: Remove the tor daemon requirement for signing [tor-browser-build] * Bug 41809: Update toolchains for Firefox 152 [tor-browser-build] * Bug 41813: Disable build artifacts in `make generate_gradle_dependencies_list-geckoview` [tor-browser-build] + * Bug 41821: Update gpg subkeys for boklm [tor-browser-build] + * Bug 41823: Add versions information to the toolchain list update [tor-browser-build] * Bug 41827: Update morgan's keychain with renewed key [tor-browser-build] Mullvad Browser 16.0a7 - June 03 2026 ===================================== projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt ===================================== @@ -1,7 +1,7 @@ -Tor Browser 16.0a8 - June 25 2026 +Tor Browser 16.0a8 - July 01 2026 * All Platforms - * Updated Tor to 0.4.9.10 - * Updated NoScript to 13.6.24.90101984 + * Updated NoScript to 13.6.25.90301984 + * Updated Tor to 0.4.9.11 * Updated OpenSSL to 3.5.7 * Bug 44857: Drop `browser.display.use_system_colors` from our preference list [tor-browser] * Bug 44896: Review Mozilla 2030929: Remove unused pref privacy.partition.network_state [tor-browser] @@ -9,7 +9,6 @@ Tor Browser 16.0a8 - June 25 2026 * Bug 45019: ReportBrokenSite startup error in 152 [tor-browser] * Bug 45047: Cross-site oracle via worklet rejection error in Safer Mode [tor-browser] * Bug 45072: Disable XSLT already for 16.0 [tor-browser] - * Bug 41821: Update gpg subkeys for boklm [tor-browser-build] * Windows + macOS + Linux * Updated Firefox to 152.0a1 * Bug 44528: Make sure desktop IP Protection is disabled on desktop [tor-browser] @@ -22,6 +21,7 @@ Tor Browser 16.0a8 - June 25 2026 * Bug 45017: Wrong letterboxing background in 152 [tor-browser] * Bug 45037: Potential runtime errors in the search service when changing JS status [tor-browser] * Bug 45043: Re-add missing changes to settings after 151/152 rebase [tor-browser] + * Bug 45083: Error in about:preferences due to ipprotection missing [tor-browser] * macOS * Bug 44728: Bundled fonts are broken on macOS when the GPU process is enabled [tor-browser] * Linux @@ -32,16 +32,22 @@ Tor Browser 16.0a8 - June 25 2026 * Bug 44091: Add frequent regions to tor connection assist for android [tor-browser] * Bug 44175: Remove all default browser functionality (Android) [tor-browser] * Bug 44769: TBA crash screen has firefox asset as well as a "Send crash report" button [tor-browser] + * Bug 45052: Initialise Tor modules on android in the same order as desktop [tor-browser] * Build System * All Platforms * Bug 41802: Remove the tor daemon requirement for signing [tor-browser-build] * Bug 41809: Update toolchains for Firefox 152 [tor-browser-build] * Bug 41813: Disable build artifacts in `make generate_gradle_dependencies_list-geckoview` [tor-browser-build] + * Bug 41821: Update gpg subkeys for boklm [tor-browser-build] + * Bug 41823: Add versions information to the toolchain list update [tor-browser-build] * Bug 41827: Update morgan's keychain with renewed key [tor-browser-build] * Windows + Linux + Android * Updated Go to 1.26.4 * Windows * Bug 41810: Define GetAddrInfoExCancel on mingw [tor-browser-build] + * Android + * Bug 45086: Compress omni.ja with xz on Android [tor-browser] + * Bug 41830: Update the browser project to change omni.ja.xz [tor-browser-build] Tor Browser 16.0a7 - June 03 2026 * All Platforms ===================================== projects/browser/config ===================================== @@ -87,9 +87,9 @@ input_files: enable: '[% !c("var/android") %]' - filename: dmg-root enable: '[% c("var/macos") %]' - - URL: https://dist.torproject.org/torbrowser/noscript/noscript-13.6.24.90101984.x… + - URL: https://dist.torproject.org/torbrowser/noscript/noscript-13.6.25.90301984.x… name: noscript - sha256sum: 58df96b190024a33785e5af2281994be65c380674049adeaa2318c11add099ee + sha256sum: 1449e39c15bf00493c274697486fc5f520124d52901fcae696c05083b2c7e921 - URL: https://addons.mozilla.org/firefox/downloads/file/4814095/ublock_origin-1.7… name: ublock-origin sha256sum: 47f788a1fc2c014830b30bb0ef9588615701b98c5265fb19b8cf4ba779849feb ===================================== projects/firefox/config ===================================== @@ -114,7 +114,6 @@ targets: updater_url: 'https://cdn.mullvad.net/browser/update_responses/update_1/' mar_id_prefix: 'mullvadbrowser-mullvad' nightly_updates_publish_dir_prefix: mullvadbrowser- - browser_build: 2 linux-x86_64: var: arch_deps: ===================================== projects/tor/config ===================================== @@ -1,6 +1,6 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.[% c("compress_tar") %]' -version: 0.4.9.10 +version: 0.4.9.11 git_hash: 'tor-[% c("version") %]' git_url: https://gitlab.torproject.org/tpo/core/tor.git git_submodule: 1 ===================================== projects/translation/config ===================================== @@ -12,13 +12,13 @@ compress_tar: 'gz' steps: base-browser: base-browser: '[% INCLUDE build %]' - git_hash: 4432a9ab5c10ba53dc1d3ec9329a73a44446ac4c + git_hash: f214fa73196b8b4ecfd2141ff373ddcbb5edf6b8 targets: nightly: git_hash: 'base-browser' tor-browser: tor-browser: '[% INCLUDE build %]' - git_hash: 565e67ca7ebbf7d1b478bff1a9c6c779023f5211 + git_hash: f1579ea805d3d1af56d394893d26561a2945824c targets: nightly: git_hash: 'tor-browser' @@ -32,7 +32,7 @@ steps: fenix: '[% INCLUDE build %]' # We need to bump the commit before releasing but just pointing to a branch # might cause too much rebuidling of the Firefox part. - git_hash: 41c4edad95ca1dca84f3c8d127956545518e00da + git_hash: 925fa40ece33f0c66b11c41b856fc71a1f8bf25c compress_tar: 'zst' targets: nightly: ===================================== rbm.conf ===================================== @@ -85,7 +85,7 @@ var: torbrowser_build: 'build1' # This should be the date of when the build is started. For the build # to be reproducible, browser_release_date should always be in the past. - browser_release_date: '2026/06/25 10:00:00' + browser_release_date: '2026/07/01 08:30:00' browser_release_date_timestamp: '[% USE date; date.format(c("var/browser_release_date"), "%s") %]' browser_default_channel: alpha browser_platforms: View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/0… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/0… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/mullvad-browser] Pushed new tag mullvad-browser-152.0a1-16.0-2-build3
by Pier Angelo Vendrame (＠pierov) 01 Jul '26

01 Jul '26

Pier Angelo Vendrame pushed new tag mullvad-browser-152.0a1-16.0-2-build3 at The Tor Project / Applications / Mullvad Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/tree/mullv… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser] Pushed new tag tor-browser-152.0a1-16.0-2-build3
by Pier Angelo Vendrame (＠pierov) 01 Jul '26

01 Jul '26

Pier Angelo Vendrame pushed new tag tor-browser-152.0a1-16.0-2-build3 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/tor-brows… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41830: Use omni.ja.xz on Android.
by Pier Angelo Vendrame (＠pierov) 01 Jul '26

01 Jul '26

Pier Angelo Vendrame pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 67b08c8d by Pier Angelo Vendrame at 2026-06-30T15:50:00+02:00 Bug 41830: Use omni.ja.xz on Android. As a workaround to keep our APK size within the Play Store threshold we decided to compress omni.ja with xz (tor-browser#45086). This commit adapts tor-browser-build scripts to that change. - - - - - 2 changed files: - projects/browser/build.android - projects/geckoview/gradle-dependencies-list.txt Changes: ===================================== projects/browser/build.android ===================================== @@ -52,7 +52,8 @@ function generate_apk { $rootdir/sort-baseline.py --apk $apk $sorted_baseline_apk mv $sorted_baseline_apk $apk - unzip -j "$apk" assets/omni.ja + unzip -j "$apk" assets/omni.ja.xz + xz -d omni.ja.xz mkdir omni pushd omni unzip ../omni.ja @@ -72,9 +73,12 @@ function generate_apk { # Be sure to change any `rm` with the appropriate command, shall this change. [% c('zip', { zip_src => [ '.' ], - zip_args => '-0 ../assets/omni.ja', + zip_args => '-0 ../omni.ja', }) %] popd + sha256sum omni.ja | awk '{ print $1 }' > assets/omni.ja.sha256 + xz -9e omni.ja + mv omni.ja.xz assets/ mkdir apk pushd apk @@ -101,7 +105,6 @@ function generate_apk { # Clean up rm -rf omni - rm omni.ja rm -rf apk rm repacked.apk rm $aligned_apk ===================================== projects/geckoview/gradle-dependencies-list.txt ===================================== @@ -1365,6 +1365,8 @@ cc8caa4101a35d0cf0433a63e8ad38911a4c848073fcc94f43ae0251f33e4daf | https://plugi 10d6bd66abb088eca5be360ff72550c96154d2676efedd74af31c450017c3909 | https://plugins.gradle.org/m2/org/gradle/kotlin/gradle-kotlin-dsl-plugins/6… abe9f3960fa7359722a8752e61bfc496761e15d14735e4c6422079707606abbe | https://plugins.gradle.org/m2/org/gradle/kotlin/gradle-kotlin-dsl-plugins/6… 2dd836cc09712cdaddfeefc680d2ea66eb43d8dc63386bd595265813497f472d | https://plugins.gradle.org/m2/org/gradle/kotlin/kotlin-dsl/org.gradle.kotli… +937b44d869c059c39f07ae194d8cd6219f5aebf2200ef9707f0b50b7837da281 | https://plugins.gradle.org/m2/org/tukaani/xz/1.12/xz-1.12.pom +3e158a87bd73d8afb4b6e8239c013b7d049c48563f45860ce99cd2e448cf4a6b | https://plugins.gradle.org/m2/org/tukaani/xz/1.12/xz-1.12.jar 243a64470fda0e86a6fddeb0af4c7aa9426ce84e68cbfe18d75ee5da4b7e0b92 | https://repo.maven.apache.org/maven2/com/almworks/sqlite4java/sqlite4java/1… 139552c586a57bf6d98f87d6b7e23fef4db53cf74097be962f7868e3606c79d2 | https://repo.maven.apache.org/maven2/com/almworks/sqlite4java/sqlite4java/1… 348924b116b7b251113af50c1bf1b57c0df7c89b8f56406c1ff1be2d5b469fbd | https://repo.maven.apache.org/maven2/com/autonomousapps/antlr/4.13.2.0/antl… View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/6… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/6… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser][tor-browser-152.0a1-16.0-2] BB 45086: Make nsZipCursor::Copy return mBuf also when copying a stored file.
by Pier Angelo Vendrame (＠pierov) 01 Jul '26

01 Jul '26

Pier Angelo Vendrame pushed to branch tor-browser-152.0a1-16.0-2 at The Tor Project / Applications / Tor Browser Commits: 6da2dea2 by Pier Angelo Vendrame at 2026-07-01T08:45:26+02:00 BB 45086: Make nsZipCursor::Copy return mBuf also when copying a stored file. - - - - - 1 changed file: - modules/libjar/nsZipArchive.cpp Changes: ===================================== modules/libjar/nsZipArchive.cpp ===================================== @@ -1198,6 +1198,7 @@ uint8_t* nsZipCursor::ReadOrCopy(uint32_t* aBytesRead, bool aCopy) { } else { *aBytesRead = mZs.avail_in > mBufSize ? mBufSize : mZs.avail_in; memcpy(mBuf, mZs.next_in, *aBytesRead); + buf = mBuf; mZs.avail_in -= *aBytesRead; mZs.next_in += *aBytesRead; } View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/6da2dea… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/6da2dea… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0

[Git][tpo/applications/tor-browser][tor-browser-152.0a1-16.0-2] 2 commits: BB 45086: Replace omni.ja URI parsing in GetApkURI with a direct JNI call
by Pier Angelo Vendrame (＠pierov) 01 Jul '26

01 Jul '26

Pier Angelo Vendrame pushed to branch tor-browser-152.0a1-16.0-2 at The Tor Project / Applications / Tor Browser Commits: 5c903fac by Pier Angelo Vendrame at 2026-07-01T08:31:43+02:00 BB 45086: Replace omni.ja URI parsing in GetApkURI with a direct JNI call - - - - - 63c810a9 by Beatriz Rizental at 2026-07-01T08:31:43+02:00 TB 45086: [android] Repack omni.ja file with LZMA - - - - - 16 changed files: - mobile/android/fenix/app/build.gradle - mobile/android/geckoview/build.gradle - + mobile/android/geckoview/omnijar_repack.sh - mobile/android/geckoview/src/main/java/org/mozilla/gecko/GeckoAppShell.java - mobile/android/geckoview/src/main/java/org/mozilla/gecko/GeckoThread.java - + mobile/android/geckoview/src/main/java/org/mozilla/gecko/util/XzExtractor.java - + mobile/android/geckoview/src/test/assets/empty-hash.sha256 - + mobile/android/geckoview/src/test/assets/empty-hash.xz - + mobile/android/geckoview/src/test/assets/no-hash.xz - + mobile/android/geckoview/src/test/assets/test.sha256 - + mobile/android/geckoview/src/test/assets/test.xz - + mobile/android/geckoview/src/test/java/org/mozilla/gecko/util/XzExtractorTest.java - mobile/android/gradle/with_gecko_binaries.gradle - netwerk/protocol/res/nsResProtocolHandler.cpp - python/mozbuild/mozbuild/action/fat_aar.py - python/mozbuild/mozpack/packager/unpack.py Changes: ===================================== mobile/android/fenix/app/build.gradle ===================================== @@ -197,7 +197,7 @@ android { // manifest.template.json is converted to manifest.json at build time. // No need to package the template in the APK. - ignoreAssetsPattern = "manifest.template.json" + ignoreAssetsPattern = "manifest.template.json:omni.ja" } testOptions { ===================================== mobile/android/geckoview/build.gradle ===================================== @@ -82,10 +82,20 @@ android { buildConfigField 'boolean', 'MOZ_ANDROID_CONTENT_SERVICE_ISOLATED_PROCESS', mozconfig.substs.MOZ_ANDROID_CONTENT_SERVICE_ISOLATED_PROCESS ? 'true' : 'false'; } + aaptOptions { + noCompress 'xz' + } + lintOptions { abortOnError = false } + testOptions { + unitTests { + includeAndroidResources = true + } + } + sourceSets { main { java { @@ -194,6 +204,7 @@ dependencies { implementation libs.androidx.lifecycle.common implementation libs.androidx.lifecycle.process implementation libs.play.services.fido + implementation "org.tukaani:xz:1.12" implementation "org.yaml:snakeyaml:2.2" if (mozconfig.substs.MOZ_ANDROID_HLS_SUPPORT) { ===================================== mobile/android/geckoview/omnijar_repack.sh ===================================== @@ -0,0 +1,12 @@ +#!/bin/sh +# Repack a .ja (ZIP) stored uncompressed, compress with XZ, write SHA-256 sidecar. +# Usage: omnijar_repack.sh <src> <dst-file> <dst-tag> +set -e +src="$1" dst_file="$2" dst_tag="$3" +tmp=$(mktemp -d) +trap 'rm -rf "$tmp"' EXIT +cp "$src" "$tmp/omni.ja" +# Repack all entries as ZIP_STORED (strip per-entry deflate) +( cd "$tmp" && unzip -q omni.ja -d unpacked && cd unpacked && zip -q -0 -r ../repacked.ja . ) +xz -9e -k -c "$tmp/repacked.ja" > "$dst_file" +sha256sum -b "$tmp/repacked.ja" | awk '{print $1}' > "$dst_tag" ===================================== mobile/android/geckoview/src/main/java/org/mozilla/gecko/GeckoAppShell.java ===================================== @@ -1761,6 +1761,11 @@ public class GeckoAppShell { return id == 0 ? info.nonLocalizedLabel.toString() : context.getString(id); } + @WrapForJNI + public static String getApkPath() { + return getApplicationContext().getPackageResourcePath(); + } + @WrapForJNI(calledFrom = "gecko") private static int getMemoryUsage(final String stateName) { final Debug.MemoryInfo memInfo = new Debug.MemoryInfo(); ===================================== mobile/android/geckoview/src/main/java/org/mozilla/gecko/GeckoThread.java ===================================== @@ -19,6 +19,8 @@ import android.util.Log; import androidx.annotation.NonNull; import androidx.annotation.Nullable; import androidx.annotation.UiThread; +import java.io.File; +import java.io.IOException; import java.util.ArrayList; import java.util.Arrays; import java.util.LinkedList; @@ -31,6 +33,7 @@ import org.mozilla.gecko.annotation.WrapForJNI; import org.mozilla.gecko.mozglue.GeckoLoader; import org.mozilla.gecko.process.MemoryController; import org.mozilla.gecko.util.GeckoBundle; +import org.mozilla.gecko.util.XzExtractor; import org.mozilla.gecko.util.ThreadUtils; import org.mozilla.geckoview.BuildConfig; import org.mozilla.geckoview.GeckoResult; @@ -329,6 +332,15 @@ public class GeckoThread extends Thread { loadGeckoLibs(context); } + private static File extractOmnijar(final Context context) throws IOException { + return new XzExtractor( + context, + "omni.ja", + context.getNoBackupFilesDir(), + "omni.ja") + .extract(); + } + private String[] getMainProcessArgs() { final Context context = GeckoAppShell.getApplicationContext(); final ArrayList<String> args = new ArrayList<>(); @@ -337,8 +349,13 @@ public class GeckoThread extends Thread { args.add(context.getPackageName()); if (!mInitInfo.xpcshell) { - args.add("-greomni"); - args.add(context.getPackageResourcePath()); + try { + args.add("-greomni"); + String greomni = extractOmnijar(context).getAbsolutePath(); + args.add(greomni); + } catch (final IOException e) { + throw new RuntimeException("Failed to extract omnijar", e); + } } if (mInitInfo.args != null) { ===================================== mobile/android/geckoview/src/main/java/org/mozilla/gecko/util/XzExtractor.java ===================================== @@ -0,0 +1,75 @@ +package org.mozilla.gecko.util; + +import android.content.Context; +import android.content.res.AssetManager; +import android.util.Log; +import java.io.BufferedReader; +import java.io.File; +import java.io.IOException; +import java.io.InputStream; +import java.io.InputStreamReader; +import java.nio.charset.StandardCharsets; +import java.nio.file.Files; +import java.nio.file.StandardCopyOption; +import org.tukaani.xz.XZInputStream; + +public class XzExtractor { + private static final String TAG = "XzExtractor"; + private final Context mContext; + private final String mSource; + private String mSourceHash; + private final File mTarget; + private final File mTargetHash; + + public XzExtractor(Context context, String source, File targetDir, String destination) { + mContext = context; + mSource = source; + mTarget = new File(targetDir, destination); + mTargetHash = new File(targetDir, destination + ".sha256"); + } + + public File extract() throws IOException { + Log.d(TAG, "Extracting " + mSource + " -> " + mTarget.getAbsolutePath()); + readSourceTag(); + if (checkExisting()) { + Log.d(TAG, mSource + ": up to date, skipping extraction"); + } else { + Log.d(TAG, mSource + ": extracting from assets"); + extractFromAssets(); + Log.d(TAG, mSource + ": extraction complete"); + } + return mTarget; + } + + private void readSourceTag() throws IOException { + // We use sha256 because we need a unique deterministic string + // to verify if current resources are up to date or need to be + // re-extracted. THIS IS NOT AN INTEGRITY CHECK. + final String asset = mSource + ".sha256"; + final Context context = mContext; + try (InputStream in = context.getAssets().open(asset, AssetManager.ACCESS_BUFFER); + BufferedReader reader = new BufferedReader(new InputStreamReader(in, StandardCharsets.UTF_8))) { + mSourceHash = reader.readLine(); + } + if (mSourceHash == null || mSourceHash.isEmpty()) { + throw new IOException(asset + " is empty"); + } + } + + private boolean checkExisting() throws IOException { + if (!mTarget.exists() || !mTargetHash.exists()) { + return false; + } + String destHash = new String(Files.readAllBytes(mTargetHash.toPath()), StandardCharsets.UTF_8).trim(); + return destHash.equals(mSourceHash); + } + + private void extractFromAssets() throws IOException { + final Context context = mContext; + try (InputStream assetIn = context.getAssets().open(mSource + ".xz"); + XZInputStream xzIn = new XZInputStream(assetIn)) { + Files.copy(xzIn, mTarget.toPath(), StandardCopyOption.REPLACE_EXISTING); + } + Files.write(mTargetHash.toPath(), mSourceHash.getBytes(StandardCharsets.UTF_8)); + } +} ===================================== mobile/android/geckoview/src/test/assets/empty-hash.sha256 ===================================== ===================================== mobile/android/geckoview/src/test/assets/empty-hash.xz ===================================== Binary files /dev/null and b/mobile/android/geckoview/src/test/assets/empty-hash.xz differ ===================================== mobile/android/geckoview/src/test/assets/no-hash.xz ===================================== Binary files /dev/null and b/mobile/android/geckoview/src/test/assets/no-hash.xz differ ===================================== mobile/android/geckoview/src/test/assets/test.sha256 ===================================== @@ -0,0 +1 @@ +d05557c2592a0b2f4d5553ff10a810168755dd98adfabae60fc055273819fd06 ===================================== mobile/android/geckoview/src/test/assets/test.xz ===================================== Binary files /dev/null and b/mobile/android/geckoview/src/test/assets/test.xz differ ===================================== mobile/android/geckoview/src/test/java/org/mozilla/gecko/util/XzExtractorTest.java ===================================== @@ -0,0 +1,112 @@ +package org.mozilla.gecko.util; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertThrows; +import static org.junit.Assert.assertTrue; + +import android.content.Context; +import android.test.suitebuilder.annotation.SmallTest; +import java.io.File; +import java.io.IOException; +import java.nio.charset.StandardCharsets; +import java.nio.file.Files; +import org.junit.After; +import org.junit.Before; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.robolectric.RobolectricTestRunner; +import org.robolectric.RuntimeEnvironment; + +(a)RunWith(RobolectricTestRunner.class) +@SmallTest +public class XzExtractorTest { + private Context mContext; + private File mTargetDir; + + private String mTestFileContents = "#!/bin/sh\necho hello world"; + + @Before + public void setUp() throws IOException { + mContext = RuntimeEnvironment.getApplication(); + mTargetDir = Files.createTempDirectory("xz-extractor-test").toFile(); + } + + @After + public void tearDown() { + deleteRecursively(mTargetDir); + } + + @Test + public void freshExtraction() throws IOException, InterruptedException { + XzExtractor extractor = new XzExtractor(mContext, "test", mTargetDir, "test"); + File extracted = extractor.extract(); + + assertTrue(extracted.exists()); + assertTrue(new File(mTargetDir, "test.sha256").exists()); + } + + @Test + public void upToDateSkipsExtraction() throws IOException { + XzExtractor extractor = new XzExtractor(mContext, "test", mTargetDir, "test"); + File extracted = extractor.extract(); + assertEquals( + mTestFileContents, + new String(Files.readAllBytes(extracted.toPath()), StandardCharsets.UTF_8).trim()); + + Files.write(extracted.toPath(), "tampered".getBytes(StandardCharsets.UTF_8)); + extractor.extract(); + + assertEquals( + "tampered", + new String(Files.readAllBytes(extracted.toPath()), StandardCharsets.UTF_8)); + } + + @Test + public void staleHashTriggersReExtraction() throws IOException, InterruptedException { + XzExtractor extractor = new XzExtractor(mContext, "test", mTargetDir, "test"); + File extracted = extractor.extract(); + File hashFile = new File(mTargetDir, "test.sha256"); + + assertEquals( + mTestFileContents, + new String(Files.readAllBytes(extracted.toPath()), StandardCharsets.UTF_8).trim()); + + Files.write(hashFile.toPath(), "new-hash".getBytes(StandardCharsets.UTF_8)); + Files.write(extracted.toPath(), "tampered".getBytes(StandardCharsets.UTF_8)); + + extractor.extract(); + assertEquals( + mTestFileContents, + new String(Files.readAllBytes(extracted.toPath()), StandardCharsets.UTF_8).trim()); + } + + @Test + public void missingAssetThrows() { + XzExtractor extractor = new XzExtractor(mContext, "nonexistent", mTargetDir, "test"); + assertThrows(IOException.class, extractor::extract); + } + + @Test + public void missingHashFileThrows() { + XzExtractor extractor = new XzExtractor(mContext, "no-hash", mTargetDir, "test"); + assertThrows(IOException.class, extractor::extract); + } + + @Test + public void emptyHashFileThrows() { + XzExtractor extractor = new XzExtractor(mContext, "empty-hash", mTargetDir, "test"); + assertThrows(IOException.class, extractor::extract); + } + + private void deleteRecursively(final File file) { + if (file.isDirectory()) { + final File[] children = file.listFiles(); + if (children != null) { + for (final File child : children) { + deleteRecursively(child); + } + } + } + file.delete(); + } +} ===================================== mobile/android/gradle/with_gecko_binaries.gradle ===================================== @@ -23,10 +23,27 @@ ext.configureVariantWithGeckoBinaries = { variant -> // the moz.build system and should never be re-entrant in this way. def assetGenTask = tasks.findByName("generate${variant.name.capitalize()}Assets") def jniLibFoldersTask = tasks.findByName("merge${variant.name.capitalize()}JniLibFolders") + + def omnijarName = "omni.ja" + def assetsDir = "${topobjdir}/dist/geckoview/assets" + def compressOmnijarTask = tasks.register("compressOmnijar${variant.name.capitalize()}", Exec) { + inputs.file("${assetsDir}/${omnijarName}") + outputs.files( + "${assetsDir}/${omnijarName}.xz", + "${assetsDir}/${omnijarName}.sha256" + ) + commandLine "sh", + "${topsrcdir}/mobile/android/geckoview/omnijar_repack.sh", + "${assetsDir}/${omnijarName}", + "${assetsDir}/${omnijarName}.xz", + "${assetsDir}/${omnijarName}.sha256" + } + if (!mozconfig.substs.MOZILLA_OFFICIAL && !mozconfig.substs.ENABLE_MOZSEARCH_PLUGIN) { - assetGenTask.dependsOn rootProject.machStagePackage + compressOmnijarTask.configure { dependsOn rootProject.machStagePackage } jniLibFoldersTask.dependsOn rootProject.machStagePackage } + assetGenTask.dependsOn compressOmnijarTask } } ===================================== netwerk/protocol/res/nsResProtocolHandler.cpp ===================================== @@ -14,6 +14,10 @@ #include "mozilla/Omnijar.h" +#ifdef MOZ_WIDGET_ANDROID +# include "mozilla/java/GeckoAppShellWrappers.h" +#endif + using mozilla::LogLevel; using mozilla::dom::ContentParent; @@ -68,29 +72,12 @@ nsresult nsResProtocolHandler::Init() { #ifdef ANDROID nsresult nsResProtocolHandler::GetApkURI(nsACString& aResult) { - nsCString::const_iterator start, iter; - mGREURI.BeginReading(start); - mGREURI.EndReading(iter); - nsCString::const_iterator start_iter = start; - - // This is like jar:jar:file://path/to/apk/base.apk!/path/to/omni.ja!/ - bool found = FindInReadable("!/"_ns, start_iter, iter); - NS_ENSURE_TRUE(found, NS_ERROR_UNEXPECTED); - - // like jar:jar:file://path/to/apk/base.apk!/ - const nsDependentCSubstring& withoutPath = Substring(start, iter); - NS_ENSURE_TRUE(withoutPath.Length() >= 4, NS_ERROR_UNEXPECTED); - - // Let's make sure we're removing what we expect to remove - NS_ENSURE_TRUE(Substring(withoutPath, 0, 4).EqualsLiteral("jar:"), - NS_ERROR_UNEXPECTED); - - // like jar:file://path/to/apk/base.apk!/ - aResult = ToNewCString(Substring(withoutPath, 4)); - - // Remove the trailing / - NS_ENSURE_TRUE(aResult.Length() >= 1, NS_ERROR_UNEXPECTED); - aResult.Truncate(aResult.Length() - 1); + mozilla::jni::String::LocalRef path = + mozilla::java::GeckoAppShell::GetApkPath(); + if (!path) { + return NS_ERROR_UNEXPECTED; + } + aResult = "jar:file://"_ns + path->ToCString() + "!"_ns; return NS_OK; } #endif ===================================== python/mozbuild/mozbuild/action/fat_aar.py ===================================== @@ -90,7 +90,7 @@ def fat_aar(distdir, zip_paths, no_process=False, no_compatibility_check=False): jar_finder = JarFinder( aar_file.file.filename, JarReader(fileobj=aar_file.open()) ) - for path, fileobj in UnpackFinder(jar_finder): + for path, fileobj in UnpackFinder(jar_finder, omnijar_name="assets/omni.ja.xz"): # Native libraries go straight through. if mozpath.match(path, "jni/**"): copier.add(path, fileobj) @@ -130,6 +130,7 @@ def fat_aar(distdir, zip_paths, no_process=False, no_compatibility_check=False): "**/*.ftl", "**/*.dtd", "**/*.properties", + "assets/omni.ja.sha256", } not_allowed = OrderedDict() ===================================== python/mozbuild/mozpack/packager/unpack.py ===================================== @@ -3,6 +3,7 @@ # file, You can obtain one at http://mozilla.org/MPL/2.0/. import codecs +import lzma from urllib.parse import urlparse import mozpack.path as mozpath @@ -143,7 +144,11 @@ class UnpackFinder(BaseFinder): Return a JarReader for the given BaseFile instance, keeping a log of the preloaded entries it has. """ - jar = JarReader(fileobj=file.open()) + if path.endswith(".xz"): + f = lzma.open(file.open()) + else: + f = file.open() + jar = JarReader(fileobj=f) self.compressed = max(self.compressed, jar.compression) if jar.last_preloaded: jarlog = list(jar.entries.keys()) @@ -158,8 +163,17 @@ class UnpackFinder(BaseFinder): """ Return whether the given BaseFile looks like a ZIP/Jar. """ + + def check_header(header): + return len(header) == 8 and (header[0:2] == b"PK" or header[4:6] == b"PK") + header = file.open().read(8) - return len(header) == 8 and (header[0:2] == b"PK" or header[4:6] == b"PK") + if check_header(header): + return True + if header[0:6] == b"\xfd7zXZ\x00": + with lzma.open(file.open()) as f: + return check_header(f.read(8)) + return False def _unjarize(self, entry, relpath): """ View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/5b410a… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/5b410a… You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help

1 0