Pier Angelo Vendrame pushed to branch maint-13.5 at The Tor Project / Applications / tor-browser-build

Commits:

3 changed files:

Changes:

  • rbm.conf
    ... ... @@ -79,6 +79,38 @@ var:
    79 79 
       # to be reproducible, browser_release_date should always be in the past.
    80 80 
       browser_release_date: '2025/08/18 19:35:49'
    81 81 
       browser_release_date_timestamp: '[% USE date; date.format(c("var/browser_release_date"), "%s") %]'
    82 
    +    # is_android_release and is_desktop_release are used to quickly
    83 
    +    # enable/disable all android or desktop platforms. If you want to
    84 
    +    # check whether a release includes some android or desktop platforms
    85 
    +    # see signing_android and signing_desktop below.
    86 
    +    is_android_release: '[% c("var/tor-browser") %]'
    87 
    +    is_desktop_release: '1'
    88 
    +
    89 
    +    # signing_android is used in signing scripts to check if at least
    90 
    +    # one android platform is being signed/published
    91 
    +    signing_android: |
    92 
    +      [%-
    93 
    +      c("var/browser_platforms/android-armv7") ||
    94 
    +      c("var/browser_platforms/android-x86") ||
    95 
    +      c("var/browser_platforms/android-x86_64") ||
    96 
    +      c("var/browser_platforms/android-aarch64")
    97 
    +      -%]
    98 
    +    # signing_desktop is used in signing scripts to check if at least
    99 
    +    # one desktop platform is being signed/published
    100 
    +    signing_desktop: |
    101 
    +      [%-
    102 
    +      c("var/browser_platforms/linux-x86_64") ||
    103 
    +      c("var/browser_platforms/linux-i686") ||
    104 
    +      c("var/browser_platforms/linux-aarch64") ||
    105 
    +      c("var/browser_platforms/windows-i686") ||
    106 
    +      c("var/browser_platforms/windows-x86_64") ||
    107 
    +      c("var/browser_platforms/macos")
    108 
    +      -%]
    109 
    +    signing_windows: |
    110 
    +      [%-
    111 
    +      c("var/browser_platforms/windows-i686") ||
    112 
    +      c("var/browser_platforms/windows-x86_64")
    113 
    +      -%]
    82 114 
       updater_enabled: 1
    83 115 
       build_mar: 1
    84 116 
       torbrowser_incremental_from:

  • tools/signing/do-all-signing
    ... ... @@ -19,38 +19,66 @@ if [[ $1 = "-p" ]]; then
    19 19 
       shift
    20 20 
     fi
    21 21
    22 
    +function is_legacy {
    23 
    +  [[ "$tbb_version" = 13.* ]]
    24 
    +}
    25 
    +
    26 
    +if is_legacy; then
    27 
    +  platform_android=
    28 
    +  platform_desktop=1
    29 
    +  platform_macos=1
    30 
    +  platform_windows=1
    31 
    +else
    32 
    +  platform_android=$(rbm_showconf_boolean var/browser_platforms/signing_android)
    33 
    +  platform_desktop=$(rbm_showconf_boolean var/browser_platforms/signing_desktop)
    34 
    +  platform_macos=$(rbm_showconf_boolean var/browser_platforms/macos)
    35 
    +  platform_windows=$(rbm_showconf_boolean var/browser_platforms/signing_windows)
    36 
    +fi
    37 
    +
    22 38 
     is_project torbrowser && nssdb=torbrowser-nssdb7
    23 39 
     is_project mullvadbrowser && nssdb=mullvadbrowser-nssdb1
    24 40
    25 41 
     if [ -f "$passwords_gpg_file" ]; then
    26 42 
       echo "Reading passwords from $passwords_gpg_file"
    27 43 
       SEKRITS=$(gpg --decrypt "$passwords_gpg_file")
    28 
    -  RCODESIGN_PW=$(get_sekrit 'rcodesign')
    29 
    -  NSSPASS=$(get_sekrit "$nssdb (mar signing)")
    30 
    -  KSPASS=$(get_sekrit "android apk ($tbb_version_type)")
    31 
    -  YUBIPASS=$(get_sekrit "windows authenticode")
    44 
    +  [ -n "$platform_macos" ] && \
    45 
    +    RCODESIGN_PW=$(get_sekrit 'rcodesign')
    46 
    +  [ -n "$platform_desktop" ] && \
    47 
    +    NSSPASS=$(get_sekrit "$nssdb (mar signing)")
    48 
    +  [ -n "$platform_android" ] && \
    49 
    +    KSPASS=$(get_sekrit "android apk ($tbb_version_type)")
    50 
    +  [ -n "$platform_windows" ] && \
    51 
    +    YUBIPASS=$(get_sekrit "windows authenticode")
    32 52 
       GPG_PASS=$(get_sekrit "gpg")
    33 53 
     else
    34 54 
       echo "Rather than entering all the password manually, you may want to provide a gpg-encrypted file either on the command line (-p <filepath>) or in set-config.passwords."
    35 55 
     fi
    36 56
    37 
    -test -f "$steps_dir/linux-signer-rcodesign-sign.done" || [ -n "$RCODESIGN_PW" ] ||
    57 
    +[ -z "$platform_macos" ] || \
    58 
    +  [ -f "$steps_dir/linux-signer-rcodesign-sign.done" ] || \
    59 
    +  [ -n "$RCODESIGN_PW" ] || \
    38 60 
       read -sp "Enter rcodesign passphrase for key-1: " RCODESIGN_PW
    39 61 
     echo
    40 62
    41 
    -test -f "$steps_dir/linux-signer-signmars.done" || [ -n "$NSSPASS" ] ||
    63 
    +[ -z "$platform_desktop" ] || \
    64 
    +  [ -f "$steps_dir/linux-signer-signmars.done" ] || \
    65 
    +  [ -n "$NSSPASS" ] || \
    42 66 
       read -sp "Enter $nssdb (mar signing) passphrase: " NSSPASS
    43 67 
     echo
    44 68
    45 
    -if is_project torbrowser; then
    46 
    -  test -f "$steps_dir/linux-signer-sign-android-apks.done" || [ -n "$KSPASS" ] ||
    47 
    -    read -sp "Enter android apk signing password ($tbb_version_type): " KSPASS
    48 
    -  echo
    49 
    -fi
    50 
    -test -f "$steps_dir/linux-signer-authenticode-signing.done" || [ -n "$YUBIPASS" ] ||
    69 
    +[ -z "$platform_android" ] || \
    70 
    +  [ -f "$steps_dir/linux-signer-sign-android-apks.done" ] || \
    71 
    +  [ -n "$KSPASS" ] || \
    72 
    +  read -sp "Enter android apk signing password ($tbb_version_type): " KSPASS
    73 
    +echo
    74 
    +
    75 
    +[ -z "$platform_windows" ] || \
    76 
    +  [ -f "$steps_dir/linux-signer-authenticode-signing.done" ] || \
    77 
    +  [ -n "$YUBIPASS" ] || \
    51 78 
       read -sp "Enter windows authenticode passphrase: " YUBIPASS
    52 79 
     echo
    53 
    -test -f "$steps_dir/linux-signer-gpg-sign.done" || [ -n "$GPG_PASS" ] ||
    80 
    +
    81 
    +[ -f "$steps_dir/linux-signer-gpg-sign.done" ] || [ -n "$GPG_PASS" ] || \
    54 82 
       read -sp "Enter gpg passphrase: " GPG_PASS
    55 83 
     echo
    56 84
    ... ... @@ -199,10 +227,6 @@ function do_step {
    199 227 
       echo "$(date -Iseconds) - Finished step: $1"
    200 228 
     }
    201 229
    202 
    -function is_legacy {
    203 
    -  [[ "$tbb_version" = 13.* ]]
    204 
    -}
    205 
    -
    206 230 
     export SIGNING_PROJECTNAME
    207 231
    208 232 
     do_step set-time-on-signing-machine
    ... ... @@ -210,23 +234,34 @@ do_step wait-for-finished-build
    210 234 
     do_step sync-builder-unsigned-to-local-signed
    211 235 
     do_step sync-scripts-to-linux-signer
    212 236 
     do_step sync-before-linux-signer-rcodesign-sign
    213 
    -do_step linux-signer-rcodesign-sign
    214 
    -do_step sync-linux-signer-macos-signed-tar-to-local
    215 
    -do_step rcodesign-notary-submit
    216 
    -do_step gatekeeper-bundling
    217 
    -do_step dmg2mar
    237 
    +[ -n "$platform_macos" ] && \
    238 
    +  do_step linux-signer-rcodesign-sign
    239 
    +[ -n "$platform_macos" ] && \
    240 
    +  do_step sync-linux-signer-macos-signed-tar-to-local
    241 
    +[ -n "$platform_macos" ] && \
    242 
    +  do_step rcodesign-notary-submit
    243 
    +[ -n "$platform_macos" ] && \
    244 
    +  do_step gatekeeper-bundling
    245 
    +[ -n "$platform_macos" ] && \
    246 
    +  do_step dmg2mar
    218 247 
     do_step sync-scripts-to-linux-signer
    219 248 
     do_step sync-before-linux-signer-signmars
    220 
    -do_step linux-signer-signmars
    221 
    -do_step sync-after-signmars
    222 
    -is_project torbrowser && ! is_legacy && \
    249 
    +[ -n "$platform_desktop" ] && \
    250 
    +  do_step linux-signer-signmars
    251 
    +[ -n "$platform_desktop" ] && \
    252 
    +  do_step sync-after-signmars
    253 
    +[ -n "$platform_android" ] && \
    223 254 
       do_step linux-signer-sign-android-apks
    224 
    -is_project torbrowser && ! is_legacy && \
    255 
    +[ -n "$platform_android" ] && \
    225 256 
       do_step sync-after-sign-android-apks
    226 
    -do_step linux-signer-authenticode-signing
    227 
    -do_step sync-after-authenticode-signing
    228 
    -do_step authenticode-timestamping
    229 
    -do_step sync-after-authenticode-timestamping
    257 
    +[ -n "$platform_windows" ] && \
    258 
    +  do_step linux-signer-authenticode-signing
    259 
    +[ -n "$platform_windows" ] && \
    260 
    +  do_step sync-after-authenticode-signing
    261 
    +[ -n "$platform_windows" ] && \
    262 
    +  do_step authenticode-timestamping
    263 
    +[ -n "$platform_windows" ] && \
    264 
    +  do_step sync-after-authenticode-timestamping
    230 265 
     do_step hash_signed_bundles
    231 266 
     do_step sync-after-hash
    232 267 
     do_step linux-signer-gpg-sign
    ... ... @@ -235,6 +270,6 @@ do_step download-unsigned-sha256sums-gpg-signatures-from-people-tpo
    235 270 
     do_step sync-local-to-staticiforme
    236 271 
     do_step sync-scripts-to-staticiforme
    237 272 
     do_step staticiforme-prepare-cdn-dist-upload
    238 
    -! is_legacy &&
    273 
    +! is_legacy && [ -n "$platform_desktop" ] && \
    239 274 
       do_step upload-update_responses-to-staticiforme
    240 275 
     do_step finished-signing-clean-linux-signer

  • tools/signing/functions
    ... ... @@ -76,5 +76,17 @@ function display_name {
    76 76 
        fi
    77 77 
     }
    78 78
    79 
    +function rbm_showconf {
    80 
    +  "$rbm" showconf release "$1" --target "$SIGNING_PROJECTNAME" \
    81 
    +                   --target "$tbb_version_type"
    82 
    +}
    83 
    +
    84 
    +function rbm_showconf_boolean {
    85 
    +  local res=$(rbm_showconf "$1")
    86 
    +  if [ -z "$res" ] || [ "a$res" = "a0" ]; then
    87 
    +    return
    88 
    +  fi
    89 
    +  echo '1'
    90 
    +}
    79 91
    80 92 
     . "$script_dir/set-config"

    • —
    View it on GitLab.
    You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications · Help Notification message regarding https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/b8e3ec96ce37fb28d1668b4dbf56b5709cdfb016 at 1757974298