- tor-commits - lists.torproject.org

[Git][tpo/applications/tor-browser-build][main] Bug 41097: authenticode-timestamping.sh: create $tmp_dir with mktemp -d
by richard (＠richard) 29 Feb '24

29 Feb '24

richard pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 800e2fff by Nicolas Vigier at 2024-02-29T12:37:42+00:00 Bug 41097: authenticode-timestamping.sh: create $tmp_dir with mktemp -d - - - - - 1 changed file: - tools/signing/authenticode-timestamping.sh Changes: ===================================== tools/signing/authenticode-timestamping.sh ===================================== @@ -46,8 +46,8 @@ test -f "$osslsigncode_file" || which rename > /dev/null 2>&1 || exit_error '`rename` is missing.' -tmp_dir="$signed_dir/$tbb_version/tmp-timestamp" -mkdir "$tmp_dir" +tmp_dir=$(mktemp -d) +trap "rm -Rf $tmp_dir" EXIT tar -C "$tmp_dir" -xf "$osslsigncode_file" export PATH="$PATH:$tmp_dir/osslsigncode/bin" @@ -64,5 +64,3 @@ do done echo "Timestamped $COUNT .exe files, now renaming" rename -f 's/-timestamped//' *-timestamped - -rm -Rf "$tmp_dir" View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/8… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/8… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-115.8.0esr-13.5-1] fixup! Firefox preference overrides.
by Pier Angelo Vendrame (＠pierov) 29 Feb '24

29 Feb '24

Pier Angelo Vendrame pushed to branch mullvad-browser-115.8.0esr-13.5-1 at The Tor Project / Applications / Mullvad Browser Commits: 3b8bacb8 by Pier Angelo Vendrame at 2024-02-29T10:05:37+01:00 fixup! Firefox preference overrides. Bug 41676: Set privacy.resistFingerprinting.testing.setTZtoUTC as a defense-in-depth. We will have to revert this during the ESR-transition. - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -406,6 +406,9 @@ pref("browser.display.use_system_colors", false); // Enforce non-native widget theme (true by default, defense in depth). // Provides a uniform look and feel across platforms. Added with tor-browser#41496. pref("widget.non-native-theme.enabled", true); +// tor-browser#41676: Set the TZ environment variable as a defense-in-depth. +// TODO: Remove this in ESR-128, as it has been removed in 116 with Bug 1837582. +pref("privacy.resistFingerprinting.testing.setTZtoUTC", true); // tor-browser#41943: lock and revisit after it gets flipped to true in stable Firefox pref("javascript.options.spectre.disable_for_isolated_content", false, locked); View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/3b8… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/3b8… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][base-browser-115.8.0esr-13.5-1] fixup! Firefox preference overrides.
by Pier Angelo Vendrame (＠pierov) 29 Feb '24

29 Feb '24

Pier Angelo Vendrame pushed to branch base-browser-115.8.0esr-13.5-1 at The Tor Project / Applications / Tor Browser Commits: 4c125e5a by Pier Angelo Vendrame at 2024-02-29T10:05:12+01:00 fixup! Firefox preference overrides. Bug 41676: Set privacy.resistFingerprinting.testing.setTZtoUTC as a defense-in-depth. We will have to revert this during the ESR-transition. - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -407,6 +407,9 @@ pref("browser.display.use_system_colors", false); // Enforce non-native widget theme (true by default, defense in depth). // Provides a uniform look and feel across platforms. Added with tor-browser#41496. pref("widget.non-native-theme.enabled", true); +// tor-browser#41676: Set the TZ environment variable as a defense-in-depth. +// TODO: Remove this in ESR-128, as it has been removed in 116 with Bug 1837582. +pref("privacy.resistFingerprinting.testing.setTZtoUTC", true); // tor-browser#41943: lock and revisit after it gets flipped to true in stable Firefox pref("javascript.options.spectre.disable_for_isolated_content", false, locked); View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/4c125e5… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/4c125e5… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41082: Tor Expert Bundle android builds create .aar file
by Pier Angelo Vendrame (＠pierov) 28 Feb '24

28 Feb '24

Pier Angelo Vendrame pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: b5acc813 by Dan Ballard at 2024-02-28T12:59:28-08:00 Bug 41082: Tor Expert Bundle android builds create .aar file - - - - - 7 changed files: - projects/browser/build - projects/browser/build.android - projects/tor-android-service/build - + projects/tor-expert-bundle/AndroidManifest.xml - projects/tor-expert-bundle/build - projects/tor-expert-bundle/config - projects/tor-onion-proxy-library/build Changes: ===================================== projects/browser/build ===================================== @@ -90,10 +90,10 @@ mv [% c('input_files_by_name/noscript') %] "$TBDIR/$EXTSPATH/{73a6fe31-595d-460b [% END -%] } - tar -xvf [% c('input_files_by_name/tor-expert-bundle') %] + tar -xvf [% c('input_files_by_name/tor-expert-bundle') %]/tor-expert-bundle.tar.gz [% IF c("var/macos_universal") -%] mkdir aarch64 - tar -C aarch64 -xf [% c('input_files_by_name/tor-expert-bundle-aarch64') %] + tar -C aarch64 -xf [% c('input_files_by_name/tor-expert-bundle-aarch64') %]/tor-expert-bundle.tar.gz [% END -%] # geoip(6) and anything else that belongs in the data dir from the expert bundle @@ -451,13 +451,13 @@ fi [%IF c("var/tor-browser") -%] tor_expert_bundle_src="[% c("input_files_by_name/tor-expert-bundle") %]" # strip off trailing "$buildid.tar.gz" - tor_expert_bundle_dest=${tor_expert_bundle_src:0:-14}.tar.gz - cp $rootdir/[% c("input_files_by_name/tor-expert-bundle") %] "$OUTDIR"/$tor_expert_bundle_dest + tor_expert_bundle_dest=${tor_expert_bundle_src:0:-7}.tar.gz + cp $rootdir/[% c("input_files_by_name/tor-expert-bundle") %]/tor-expert-bundle.tar.gz "$OUTDIR"/$tor_expert_bundle_dest [% IF c("var/macos_universal") %] tor_expert_bundle_src="[% c('input_files_by_name/tor-expert-bundle-aarch64') %]" # strip off trailing "$buildid.tar.gz" - tor_expert_bundle_dest=${tor_expert_bundle_src:0:-14}.tar.gz - cp $rootdir/[% c('input_files_by_name/tor-expert-bundle-aarch64') %] "$OUTDIR"/$tor_expert_bundle_dest + tor_expert_bundle_dest=${tor_expert_bundle_src:0:-7}.tar.gz + cp $rootdir/[% c('input_files_by_name/tor-expert-bundle-aarch64') %]/tor-expert-bundle.tar.gz "$OUTDIR"/$tor_expert_bundle_dest [% END -%] [% END -%] [% IF c("var/build_infos_json") -%] ===================================== projects/browser/build.android ===================================== @@ -24,7 +24,7 @@ cd /var/tmp/build mv $rootdir/[% c('input_files_by_name/noscript') %] "$noscript_path" [%IF c("var/tor-browser") -%] - tar -xaf "$rootdir/[% c("input_files_by_name/tor-expert-bundle") %]" tor/pluggable_transports/pt_config.json + tar -xaf "$rootdir/[% c("input_files_by_name/tor-expert-bundle") %]/tor-expert-bundle.tar.gz" tor/pluggable_transports/pt_config.json [% END -%] unzip -j "$apk" assets/omni.ja mkdir omni @@ -70,8 +70,8 @@ unsign_patch="[% dest_dir %]/[% c('filename') %]/[% c('var/project-name') %]-qa- bsdiff $qa_apk $aligned_apk $unsign_patch [%IF c("var/tor-browser") -%] - tor_expert_bundle_src="[% c("input_files_by_name/tor-expert-bundle") %]" + tor_expert_bundle_src="[% c('input_files_by_name/tor-expert-bundle') %]" # strip off trailing "$buildid.tar.gz" - tor_expert_bundle_dest=${tor_expert_bundle_src:0:-14}.tar.gz - cp $rootdir/$tor_expert_bundle_src [% dest_dir %]/[% c('filename') %]/$tor_expert_bundle_dest + tor_expert_bundle_dest=${tor_expert_bundle_src:0:-7}.tar.gz + cp "$rootdir/[% c("input_files_by_name/tor-expert-bundle") %]/tor-expert-bundle.tar.gz" [% dest_dir %]/[% c('filename') %]/$tor_expert_bundle_dest [% END -%] ===================================== projects/tor-android-service/build ===================================== @@ -35,7 +35,7 @@ rm -fR service/src/main/jniLibs/* # Extract tor-expert-bundle tebdir=$rootdir/tor-expert-bundle-[% arch %] mkdir $tebdir - tar -C $tebdir -xf $rootdir/[% c('input_files_by_name/tor-expert-bundle-' _ arch) %] + tar -C $tebdir -xf $rootdir/[% c('input_files_by_name/tor-expert-bundle-' _ arch) %]/tor-expert-bundle.tar.gz # Figure out our android abi from our arch [% IF arch == "armv7" -%] ===================================== projects/tor-expert-bundle/AndroidManifest.xml ===================================== @@ -0,0 +1,16 @@ +<?xml version="1.0" encoding="utf-8"?> +<manifest xmlns:android="http://schemas.android.com/apk/res/android" + package="org.torproject.torExpertBundle" + android:versionCode="1" + android:versionName="0.0.1" > + + <uses-sdk + android:minSdkVersion="16" + android:targetSdkVersion="29" /> + + <uses-permission android:name="android.permission.INTERNET" /> + + <application android:allowBackup="false" > + </application> + +</manifest> \ No newline at end of file ===================================== projects/tor-expert-bundle/build ===================================== @@ -2,6 +2,10 @@ [% c("var/set_default_env") -%] distdir=/var/tmp/dist/[% project %] mkdir -p $distdir + +output_dir=[% dest_dir %]/[% c('filename') %] +mkdir -p $output_dir + cd $distdir tar -xkf $rootdir/[% c('input_files_by_name/tor') %] @@ -18,6 +22,32 @@ tar -xkf $rootdir/[% c('input_files_by_name/conjure') %] awk '{gsub(/\$\{pt_extension\}/, "[% c("var/pt_extension") %]"); print}' $rootdir/pt_config.json > pt_config.json cd $distdir + +# package a .aar on android +[% IF c("var/android") -%] + aar_file=torExpertBundle-[% c('arch') %].aar + + mkdir aar + mkdir -p aar/jni/[% c('arch') %] + mkdir -p aar/assets/common + + cp -a tor/libTor.so aar/jni/[% c('arch') %]/ + cp -a tor/pluggable_transports/conjure-client aar/jni/[% c('arch') %]/libConjure.so + cp -a tor/pluggable_transports/lyrebird aar/jni/[% c('arch') %]/Lyrebird.so + cp -a tor/pluggable_transports/snowflake-client aar/jni/[% c('arch') %]/libSnowflake.so + cp -a tor/pluggable_transports/webtunnel-client aar/jni/[% c('arch') %]/libWebtunnel.so + + cp -a data/* aar/assets/common/ + + cp -a tor/pluggable_transports/pt_config.json aar/assets/common/ + + cp -a $rootdir/AndroidManifest.xml aar/ + + cd aar + jar -cvf $output_dir/tor-expert-bundle-[% c('arch') %].aar * + cd .. +[% END %] + [% SET tar_src = [ "tor", "data" ]; IF c("var/linux"); @@ -25,6 +55,6 @@ cd $distdir END; c('tar', { tar_src => tar_src, - tar_args => '-czvf' _ dest_dir _ '/' _ c('filename'), + tar_args => '-czvf' _ dest_dir _ '/' _ c('filename') _ '/tor-expert-bundle.tar.gz', }); -%] +%] \ No newline at end of file ===================================== projects/tor-expert-bundle/config ===================================== @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -filename: '[% project %]-[% c("var/osname") %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' +filename: '[% project %]-[% c("var/osname") %]-[% c("version") %]-[% c("var/build_id") %]' version: '[% c("var/torbrowser_version") %]' container: @@ -23,3 +23,4 @@ input_files: - name: conjure project: conjure - filename: pt_config.json + - filename: AndroidManifest.xml ===================================== projects/tor-onion-proxy-library/build ===================================== @@ -43,7 +43,7 @@ patch -p1 < $rootdir/0001-Bug-40800-Add-WebTunnel-support.patch # Extract tor-expert-bundle tebdir=$rootdir/tor-expert-bundle-[% arch %] mkdir $tebdir - tar -C $tebdir -xf $rootdir/[% c('input_files_by_name/tor-expert-bundle-' _ arch) %] + tar -C $tebdir -xf $rootdir/[% c('input_files_by_name/tor-expert-bundle-' _ arch) %]/tor-expert-bundle.tar.gz ptdir=$tebdir/tor/pluggable_transports # Overwrite the obfs4proxy binary provided by Pluto and add Snowflake View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/b… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/b… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-update-responses][main] alpha: new version, 13.5a5
by boklm (＠boklm) 28 Feb '24

28 Feb '24

boklm pushed to branch main at The Tor Project / Applications / Tor Browser update responses Commits: db64cd7d by Nicolas Vigier at 2024-02-28T17:02:15+01:00 alpha: new version, 13.5a5 - - - - - 30 changed files: - update_3/alpha/.htaccess - − update_3/alpha/13.5a1-13.5a4-linux-i686-ALL.xml - − update_3/alpha/13.5a1-13.5a4-linux-x86_64-ALL.xml - − update_3/alpha/13.5a1-13.5a4-macos-ALL.xml - − update_3/alpha/13.5a1-13.5a4-windows-i686-ALL.xml - − update_3/alpha/13.5a1-13.5a4-windows-x86_64-ALL.xml - − update_3/alpha/13.5a2-13.5a4-linux-i686-ALL.xml - − update_3/alpha/13.5a2-13.5a4-linux-x86_64-ALL.xml - − update_3/alpha/13.5a2-13.5a4-macos-ALL.xml - − update_3/alpha/13.5a2-13.5a4-windows-i686-ALL.xml - − update_3/alpha/13.5a2-13.5a4-windows-x86_64-ALL.xml - + update_3/alpha/13.5a2-13.5a5-linux-i686-ALL.xml - + update_3/alpha/13.5a2-13.5a5-linux-x86_64-ALL.xml - + update_3/alpha/13.5a2-13.5a5-macos-ALL.xml - + update_3/alpha/13.5a2-13.5a5-windows-i686-ALL.xml - + update_3/alpha/13.5a2-13.5a5-windows-x86_64-ALL.xml - − update_3/alpha/13.5a3-13.5a4-linux-i686-ALL.xml - − update_3/alpha/13.5a3-13.5a4-linux-x86_64-ALL.xml - − update_3/alpha/13.5a3-13.5a4-macos-ALL.xml - − update_3/alpha/13.5a3-13.5a4-windows-i686-ALL.xml - − update_3/alpha/13.5a3-13.5a4-windows-x86_64-ALL.xml - + update_3/alpha/13.5a3-13.5a5-linux-i686-ALL.xml - + update_3/alpha/13.5a3-13.5a5-linux-x86_64-ALL.xml - + update_3/alpha/13.5a3-13.5a5-macos-ALL.xml - + update_3/alpha/13.5a3-13.5a5-windows-i686-ALL.xml - + update_3/alpha/13.5a3-13.5a5-windows-x86_64-ALL.xml - + update_3/alpha/13.5a4-13.5a5-linux-i686-ALL.xml - + update_3/alpha/13.5a4-13.5a5-linux-x86_64-ALL.xml - + update_3/alpha/13.5a4-13.5a5-macos-ALL.xml - + update_3/alpha/13.5a4-13.5a5-windows-i686-ALL.xml The diff was not included because it is too large. View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-update-responses… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-update-responses… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-115.8.0esr-13.5-1] fixup! Firefox preference overrides.
by Pier Angelo Vendrame (＠pierov) 28 Feb '24

28 Feb '24

Pier Angelo Vendrame pushed to branch tor-browser-115.8.0esr-13.5-1 at The Tor Project / Applications / Tor Browser Commits: 5bb3b747 by Pier Angelo Vendrame at 2024-02-28T11:26:08+01:00 fixup! Firefox preference overrides. Bug 41676: Set privacy.resistFingerprinting.testing.setTZtoUTC as a defense-in-depth. We will have to revert this during the ESR-transition. - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -407,6 +407,9 @@ pref("browser.display.use_system_colors", false); // Enforce non-native widget theme (true by default, defense in depth). // Provides a uniform look and feel across platforms. Added with tor-browser#41496. pref("widget.non-native-theme.enabled", true); +// tor-browser#41676: Set the TZ environment variable as a defense-in-depth. +// TODO: Remove this in ESR-128, as it has been removed in 116 with Bug 1837582. +pref("privacy.resistFingerprinting.testing.setTZtoUTC", true); // tor-browser#41943: lock and revisit after it gets flipped to true in stable Firefox pref("javascript.options.spectre.disable_for_isolated_content", false, locked); View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/5bb3b74… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/5bb3b74… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41093: Unsign APKs before signing them
by boklm (＠boklm) 28 Feb '24

28 Feb '24

boklm pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: 7c9183b0 by Nicolas Vigier at 2024-02-28T16:17:42+01:00 Bug 41093: Unsign APKs before signing them Use the bspatch file we create during the build to unsign the apk (which was signed by the QA key) before signing it with the release key. - - - - - 2 changed files: - tools/signing/linux-signer-sign-android-apks - tools/signing/machines-setup/setup-signing-machine Changes: ===================================== tools/signing/linux-signer-sign-android-apks ===================================== @@ -68,14 +68,19 @@ setup_build_tools mkdir -p ~/"$SIGNING_PROJECTNAME-$tbb_version-apks" chgrp signing ~/"$SIGNING_PROJECTNAME-$tbb_version-apks" chmod g+w ~/"$SIGNING_PROJECTNAME-$tbb_version-apks" -cp -af ~/"$SIGNING_PROJECTNAME-$tbb_version"/*.apk ~/"$SIGNING_PROJECTNAME-$tbb_version-apks" +cp -af ~/"$SIGNING_PROJECTNAME-$tbb_version"/*.apk \ + ~/"$SIGNING_PROJECTNAME-$tbb_version"/*.bspatch \ + ~/"$SIGNING_PROJECTNAME-$tbb_version-apks" cd ~/"$SIGNING_PROJECTNAME-$tbb_version-apks" # Sign all packages for arch in ${ARCHS}; do qa_apk=${projname}-qa-android-${arch}-${tbb_version}.apk + unsigned_apk=${projname}-qa-unsigned-android-${arch}-${tbb_version}.apk + unsigned_apk_bspatch=${projname}-qa-unsign-android-${arch}-${tbb_version}.bspatch signed_apk=${projname}-android-${arch}-${tbb_version}.apk - sign_apk "$qa_apk" "$signed_apk" + bspatch "$qa_apk" "$unsigned_apk" "$unsigned_apk_bspatch" + sign_apk "$unsigned_apk" "$signed_apk" verify_apk "$signed_apk" cp -f "$signed_apk" ~/"$SIGNING_PROJECTNAME-$tbb_version" done ===================================== tools/signing/machines-setup/setup-signing-machine ===================================== @@ -116,7 +116,7 @@ install_packages opensc libengine-pkcs11-openssl install_packages cmake libusb-1.0-0-dev libedit-dev gengetopt libpcsclite-dev help2man chrpath dh-exec # Install deps for android/apk signing -install_packages unzip openjdk-11-jdk-headless openjdk-11-jre-headless +install_packages unzip openjdk-11-jdk-headless openjdk-11-jre-headless bsdiff # Install deps for macos-rcodesign signing install_packages p7zip-full zstd View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/7… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/7… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build] Pushed new tag tbb-13.5a5-build2
by Pier Angelo Vendrame (＠pierov) 27 Feb '24

27 Feb '24

Pier Angelo Vendrame pushed new tag tbb-13.5a5-build2 at The Tor Project / Applications / tor-browser-build -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/tree/tbb… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41075: Prepare Tor Browser 13.5a5 (build2).
by Pier Angelo Vendrame (＠pierov) 27 Feb '24

27 Feb '24

Pier Angelo Vendrame pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: b1728edd by Pier Angelo Vendrame at 2024-02-27T12:28:41+01:00 Bug 41075: Prepare Tor Browser 13.5a5 (build2). This build fixes a crash on Android and has a couple of other Android improvements. - - - - - 3 changed files: - projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt - projects/firefox-android/config - rbm.conf Changes: ===================================== projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt ===================================== @@ -1,4 +1,4 @@ -Tor Browser 13.5a5 - February 27 2024 +Tor Browser 13.5a5 - February 28 2024 * All Platforms * Updated OpenSSL to 3.0.13 * Updated Snowflake to 2.9.0 @@ -43,6 +43,8 @@ Tor Browser 13.5a5 - February 27 2024 * Android * Bug 42399: Re-enable minimization of JS for Android [tor-browser] * Bug 41080: Re-pack omni.ja with 7-zip on Android [tor-browser-build] + * Bug 41092: Use an uncompressed omni.ja to improve final apk compression. [tor-browser-build] + * Bug 41093: Sign unsigned APKs instead of the QA-signed ones [tor-browser-build] Tor Browser 13.0.10 - February 20 2024 * All Platforms ===================================== projects/firefox-android/config ===================================== @@ -16,7 +16,7 @@ container: var: fenix_version: 115.2.1 browser_branch: 13.5-1 - browser_build: 6 + browser_build: 7 variant: Beta # This should be updated when the list of gradle dependencies is changed. gradle_dependencies_version: 1 ===================================== rbm.conf ===================================== @@ -82,7 +82,7 @@ buildconf: var: torbrowser_version: '13.5a5' - torbrowser_build: 'build1' + torbrowser_build: 'build2' torbrowser_incremental_from: - '13.5a4' - '13.5a3' View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/b… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/b… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41093: Add a patch to unsign APKs.
by Pier Angelo Vendrame (＠pierov) 27 Feb '24

27 Feb '24

Pier Angelo Vendrame pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: ede46581 by Pier Angelo Vendrame at 2024-02-27T12:27:17+01:00 Bug 41093: Add a patch to unsign APKs. Currently, we sign the APKs that were already signed with the QA key. However, this makes it impossible to copy our signature on top of APKs built independently, which would be the last step to reproduce our builds. With this commit, we provide a patch to go back to the unsigned (but already aligned) APK, so that we can keep shipping QA-signed APKs for testers, but we can go back to the unsigned APK for the final signing. The changes to apply this patch in the signing scripts will be part of another commit. - - - - - 4 changed files: - README - projects/browser/build.android - projects/browser/config - projects/release/build Changes: ===================================== README ===================================== @@ -54,7 +54,7 @@ If you are running Fedora, CentOS or RHEL, you can install them with: "perl(Template)" "perl(IO::Handle)" "perl(Capture::Tiny)" \ "perl(JSON)" "perl(File::Temp)" "perl(Path::Tiny)" \ "perl(File::Path)" "perl(File::Slurp)" \ - "perl(File::Copy::Recursive)" "perl(String::ShellQuote)" + "perl(File::Copy::Recursive)" "perl(String::ShellQuote)" \ "perl(Sort::Versions)" "perl(Digest::SHA)" "perl(Data::UUID)" \ "perl(Data::Dump)" "perl(DateTime)" "perl(XML::Writer)" \ "perl(Parallel::ForkManager)" perl-ph mercurial git zstd @@ -237,11 +237,12 @@ builds, and will require that you run Debian Bullseye or Bookworm and install build dependencies for all the components that are built. This can be done with the following command: - # apt-get install build-essential python3 automake libtool zip unzip \ - autoconf2.13 openjdk-11-jdk gettext-base autotools-dev \ - automake autoconf libtool autopoint libssl-dev pkg-config \ - zlib1g-dev libparallel-forkmanager-perl libfile-slurp-perl bzip2 \ - xz-utils apksigner yasm wget bison gyp tcl python3-venv 7zip jq + # apt-get install 7zip apksigner autoconf autoconf2.13 automake autopoint \ + autotools-dev bison bsdiff build-essential bzip2 \ + gettext-base gyp jq libfile-slurp-perl \ + libparallel-forkmanager-perl libssl-dev libtool libtool \ + openjdk-11-jdk pkg-config python3 python3-venv tcl unzip \ + wget xz-utils yasm zip zlib1g-dev Note that Debian Bullseye requires the bullseye-backports repository to get the 7zip package. ===================================== projects/browser/build.android ===================================== @@ -66,6 +66,9 @@ zipalign -vp 4 repacked.apk $aligned_apk # flag in the manifest. apksigner sign --verbose --min-sdk-version [% c("var/android_min_api") %] --ks $rootdir/android-qa.keystore --out $qa_apk --in $aligned_apk --ks-key-alias androidqakey --key-pass pass:android --ks-pass pass:android +unsign_patch="[% dest_dir %]/[% c('filename') %]/[% c('var/project-name') %]-qa-unsign-[% c('var/osname') %]-[% c('version') %].bspatch" +bsdiff $qa_apk $aligned_apk $unsign_patch + [%IF c("var/tor-browser") -%] tor_expert_bundle_src="[% c("input_files_by_name/tor-expert-bundle") %]" # strip off trailing "$buildid.tar.gz" ===================================== projects/browser/config ===================================== @@ -48,6 +48,7 @@ targets: arch_deps: - 7zip - openjdk-17-jdk-headless + - bsdiff container: # 7zip is in backports in bullseye, and we can already use Java 17 for # apksigner. ===================================== projects/release/build ===================================== @@ -59,7 +59,7 @@ EOF # empty any existing sh256sums file echo -n > sha256sums-unsigned-build.txt # concat sha256sum entry for each file in set -for i in $(ls -1 *.exe *.tar.xz *.dmg *.mar *.zip *.tar.gz *.apk *.json | grep -v '\.incremental\.mar$' | sort) +for i in $(ls -1 *.exe *.tar.xz *.dmg *.mar *.zip *.tar.gz *.apk *.bspatch *.json | grep -v '\.incremental\.mar$' | sort) do sha256sum $i >> sha256sums-unsigned-build.txt done View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/e… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/e… You're receiving this email because of your account on gitlab.torproject.org.

1 0