boklm pushed to branch main at The Tor Project / Applications / tor-browser-build

Commits:

6 changed files:

Changes:

  • projects/release/update_responses_config.yml
    1 1 
     ---
    2 2 
     tmp_dir: '[% c("tmp_dir") %]'
    3 3 
     create_downloads_json: 1
    4 
    +[% IF !c("var/browser_platforms/signing_desktop") -%]
    5 
    +create_downloads_json_only: 1
    6 
    +[% END -%]
    4 7 
     appname_marfile: '[% c("var/project-name") %]'
    5 8 
     appname_bundle: '[% c("var/project-name") %]'
    6 9 
     releases_dir: [% path(c('output_dir')) %][% IF ! c("var/nightly") %]/[% IF c("var/unsigned_releases_dir") -%]un[% END %]signed[% END %]

  • rbm.conf
    ... ... @@ -81,8 +81,6 @@ var:
    81 81 
       browser_release_date_timestamp: '[% USE date; date.format(c("var/browser_release_date"), "%s") %]'
    82 82 
       browser_default_channel: alpha
    83 83 
       browser_platforms:
    84 
    -    is_android_release: '[% c("var/tor-browser") %]'
    85 
    -    is_desktop_release: '1'
    86 84 
         android-armv7: '[% c("var/browser_platforms/is_android_release") %]'
    87 85 
         android-x86: '[% c("var/browser_platforms/is_android_release") %]'
    88 86 
         android-x86_64: '[% c("var/browser_platforms/is_android_release") %]'
    ... ... @@ -93,6 +91,39 @@ var:
    93 91 
         windows-i686: '[% c("var/browser_platforms/is_desktop_release") && c("var/tor-browser") %]'
    94 92 
         windows-x86_64: '[% c("var/browser_platforms/is_desktop_release") %]'
    95 93 
         macos: '[% c("var/browser_platforms/is_desktop_release") %]'
    94 
    +
    95 
    +    # is_android_release and is_desktop_release are used to quickly
    96 
    +    # enable/disable all android or desktop platforms. If you want to
    97 
    +    # check whether a release includes some android or desktop platforms
    98 
    +    # see signing_android and signing_desktop below.
    99 
    +    is_android_release: '[% c("var/tor-browser") %]'
    100 
    +    is_desktop_release: '1'
    101 
    +
    102 
    +    # signing_android is used in signing scripts to check if at least
    103 
    +    # one android platform is being signed/published
    104 
    +    signing_android: |
    105 
    +      [%-
    106 
    +      c("var/browser_platforms/android-armv7") ||
    107 
    +      c("var/browser_platforms/android-x86") ||
    108 
    +      c("var/browser_platforms/android-x86_64") ||
    109 
    +      c("var/browser_platforms/android-aarch64")
    110 
    +      -%]
    111 
    +    # signing_desktop is used in signing scripts to check if at least
    112 
    +    # one desktop platform is being signed/published
    113 
    +    signing_desktop: |
    114 
    +      [%-
    115 
    +      c("var/browser_platforms/linux-x86_64") ||
    116 
    +      c("var/browser_platforms/linux-i686") ||
    117 
    +      c("var/browser_platforms/linux-aarch64") ||
    118 
    +      c("var/browser_platforms/windows-i686") ||
    119 
    +      c("var/browser_platforms/windows-x86_64") ||
    120 
    +      c("var/browser_platforms/macos")
    121 
    +      -%]
    122 
    +    signing_windows: |
    123 
    +      [%-
    124 
    +      c("var/browser_platforms/windows-i686") ||
    125 
    +      c("var/browser_platforms/windows-x86_64")
    126 
    +      -%]
    96 127 
       updater_enabled: 1
    97 128 
       build_mar: 1
    98 129 
       torbrowser_incremental_from:

  • tools/signing/do-all-signing
    ... ... @@ -19,38 +19,66 @@ if [[ $1 = "-p" ]]; then
    19 19 
       shift
    20 20 
     fi
    21 21
    22 
    +function is_legacy {
    23 
    +  [[ "$tbb_version" = 13.* ]]
    24 
    +}
    25 
    +
    26 
    +if is_legacy; then
    27 
    +  platform_android=
    28 
    +  platform_desktop=1
    29 
    +  platform_macos=1
    30 
    +  platform_windows=1
    31 
    +else
    32 
    +  platform_android=$(rbm_showconf_boolean var/browser_platforms/signing_android)
    33 
    +  platform_desktop=$(rbm_showconf_boolean var/browser_platforms/signing_desktop)
    34 
    +  platform_macos=$(rbm_showconf_boolean var/browser_platforms/macos)
    35 
    +  platform_windows=$(rbm_showconf_boolean var/browser_platforms/signing_windows)
    36 
    +fi
    37 
    +
    22 38 
     is_project torbrowser && nssdb=torbrowser-nssdb7
    23 39 
     is_project mullvadbrowser && nssdb=mullvadbrowser-nssdb1
    24 40
    25 41 
     if [ -f "$passwords_gpg_file" ]; then
    26 42 
       echo "Reading passwords from $passwords_gpg_file"
    27 43 
       SEKRITS=$(gpg --decrypt "$passwords_gpg_file")
    28 
    -  RCODESIGN_PW=$(get_sekrit 'rcodesign')
    29 
    -  NSSPASS=$(get_sekrit "$nssdb (mar signing)")
    30 
    -  KSPASS=$(get_sekrit "android apk ($tbb_version_type)")
    31 
    -  YUBIPASS=$(get_sekrit "windows authenticode")
    44 
    +  [ -n "$platform_macos" ] && \
    45 
    +    RCODESIGN_PW=$(get_sekrit 'rcodesign')
    46 
    +  [ -n "$platform_desktop" ] && \
    47 
    +    NSSPASS=$(get_sekrit "$nssdb (mar signing)")
    48 
    +  [ -n "$platform_android" ] && \
    49 
    +    KSPASS=$(get_sekrit "android apk ($tbb_version_type)")
    50 
    +  [ -n "$platform_windows" ] && \
    51 
    +    YUBIPASS=$(get_sekrit "windows authenticode")
    32 52 
       GPG_PASS=$(get_sekrit "gpg")
    33 53 
     else
    34 54 
       echo "Rather than entering all the password manually, you may want to provide a gpg-encrypted file either on the command line (-p <filepath>) or in set-config.passwords."
    35 55 
     fi
    36 56
    37 
    -test -f "$steps_dir/linux-signer-rcodesign-sign.done" || [ -n "$RCODESIGN_PW" ] ||
    57 
    +[ -z "$platform_macos" ] || \
    58 
    +  [ -f "$steps_dir/linux-signer-rcodesign-sign.done" ] || \
    59 
    +  [ -n "$RCODESIGN_PW" ] || \
    38 60 
       read -sp "Enter rcodesign passphrase for key-1: " RCODESIGN_PW
    39 61 
     echo
    40 62
    41 
    -test -f "$steps_dir/linux-signer-signmars.done" || [ -n "$NSSPASS" ] ||
    63 
    +[ -z "$platform_desktop" ] || \
    64 
    +  [ -f "$steps_dir/linux-signer-signmars.done" ] || \
    65 
    +  [ -n "$NSSPASS" ] || \
    42 66 
       read -sp "Enter $nssdb (mar signing) passphrase: " NSSPASS
    43 67 
     echo
    44 68
    45 
    -if is_project torbrowser; then
    46 
    -  test -f "$steps_dir/linux-signer-sign-android-apks.done" || [ -n "$KSPASS" ] ||
    47 
    -    read -sp "Enter android apk signing password ($tbb_version_type): " KSPASS
    48 
    -  echo
    49 
    -fi
    50 
    -test -f "$steps_dir/linux-signer-authenticode-signing.done" || [ -n "$YUBIPASS" ] ||
    69 
    +[ -z "$platform_android" ] || \
    70 
    +  [ -f "$steps_dir/linux-signer-sign-android-apks.done" ] || \
    71 
    +  [ -n "$KSPASS" ] || \
    72 
    +  read -sp "Enter android apk signing password ($tbb_version_type): " KSPASS
    73 
    +echo
    74 
    +
    75 
    +[ -z "$platform_windows" ] || \
    76 
    +  [ -f "$steps_dir/linux-signer-authenticode-signing.done" ] || \
    77 
    +  [ -n "$YUBIPASS" ] || \
    51 78 
       read -sp "Enter windows authenticode passphrase: " YUBIPASS
    52 79 
     echo
    53 
    -test -f "$steps_dir/linux-signer-gpg-sign.done" || [ -n "$GPG_PASS" ] ||
    80 
    +
    81 
    +[ -f "$steps_dir/linux-signer-gpg-sign.done" ] || [ -n "$GPG_PASS" ] || \
    54 82 
       read -sp "Enter gpg passphrase: " GPG_PASS
    55 83 
     echo
    56 84
    ... ... @@ -203,10 +231,6 @@ function do_step {
    203 231 
       echo "$(date -Iseconds) - Finished step: $1"
    204 232 
     }
    205 233
    206 
    -function is_legacy {
    207 
    -  [[ "$tbb_version" = 13.* ]]
    208 
    -}
    209 
    -
    210 234 
     export SIGNING_PROJECTNAME
    211 235
    212 236 
     do_step set-time-on-signing-machine
    ... ... @@ -215,23 +239,34 @@ do_step sync-builder-unsigned-to-local-signed
    215 239 
     do_step clean-build-artifacts
    216 240 
     do_step sync-scripts-to-linux-signer
    217 241 
     do_step sync-before-linux-signer-rcodesign-sign
    218 
    -do_step linux-signer-rcodesign-sign
    219 
    -do_step sync-linux-signer-macos-signed-tar-to-local
    220 
    -do_step rcodesign-notary-submit
    221 
    -do_step gatekeeper-bundling
    222 
    -do_step dmg2mar
    242 
    +[ -n "$platform_macos" ] && \
    243 
    +  do_step linux-signer-rcodesign-sign
    244 
    +[ -n "$platform_macos" ] && \
    245 
    +  do_step sync-linux-signer-macos-signed-tar-to-local
    246 
    +[ -n "$platform_macos" ] && \
    247 
    +  do_step rcodesign-notary-submit
    248 
    +[ -n "$platform_macos" ] && \
    249 
    +  do_step gatekeeper-bundling
    250 
    +[ -n "$platform_macos" ] && \
    251 
    +  do_step dmg2mar
    223 252 
     do_step sync-scripts-to-linux-signer
    224 253 
     do_step sync-before-linux-signer-signmars
    225 
    -do_step linux-signer-signmars
    226 
    -do_step sync-after-signmars
    227 
    -is_project torbrowser && ! is_legacy && \
    254 
    +[ -n "$platform_desktop" ] && \
    255 
    +  do_step linux-signer-signmars
    256 
    +[ -n "$platform_desktop" ] && \
    257 
    +  do_step sync-after-signmars
    258 
    +[ -n "$platform_android" ] && \
    228 259 
       do_step linux-signer-sign-android-apks
    229 
    -is_project torbrowser && ! is_legacy && \
    260 
    +[ -n "$platform_android" ] && \
    230 261 
       do_step sync-after-sign-android-apks
    231 
    -do_step linux-signer-authenticode-signing
    232 
    -do_step sync-after-authenticode-signing
    233 
    -do_step authenticode-timestamping
    234 
    -do_step sync-after-authenticode-timestamping
    262 
    +[ -n "$platform_windows" ] && \
    263 
    +  do_step linux-signer-authenticode-signing
    264 
    +[ -n "$platform_windows" ] && \
    265 
    +  do_step sync-after-authenticode-signing
    266 
    +[ -n "$platform_windows" ] && \
    267 
    +  do_step authenticode-timestamping
    268 
    +[ -n "$platform_windows" ] && \
    269 
    +  do_step sync-after-authenticode-timestamping
    235 270 
     do_step hash_signed_bundles
    236 271 
     do_step sync-after-hash
    237 272 
     do_step linux-signer-gpg-sign
    ... ... @@ -240,6 +275,6 @@ do_step download-unsigned-sha256sums-gpg-signatures-from-people-tpo
    240 275 
     do_step sync-local-to-staticiforme
    241 276 
     do_step sync-scripts-to-staticiforme
    242 277 
     do_step staticiforme-prepare-cdn-dist-upload
    243 
    -! is_legacy &&
    278 
    +! is_legacy && \
    244 279 
       do_step upload-update_responses-to-staticiforme
    245 280 
     do_step finished-signing-clean-linux-signer

  • tools/signing/functions
    ... ... @@ -69,5 +69,17 @@ function display_name {
    69 69 
       echo "${SIGNING_PROJECTNAMES[3]}"
    70 70 
     }
    71 71
    72 
    +function rbm_showconf {
    73 
    +  "$rbm" showconf release "$1" --target "$SIGNING_PROJECTNAME" \
    74 
    +                   --target "$tbb_version_type"
    75 
    +}
    76 
    +
    77 
    +function rbm_showconf_boolean {
    78 
    +  local res=$(rbm_showconf "$1")
    79 
    +  if [ -z "$res" ] || [ "a$res" = "a0" ]; then
    80 
    +    return
    81 
    +  fi
    82 
    +  echo '1'
    83 
    +}
    72 84
    73 85 
     . "$script_dir/set-config"

  • tools/signing/upload-update_responses-to-staticiforme
    ... ... @@ -56,7 +56,8 @@ do
    56 56 
         git commit -m "$tbb_version_type: new version, $tbb_version ($file)"
    57 57 
     done
    58 58
    59 
    -if is_project torbrowser; then
    59 
    +platform_android=$(rbm_showconf_boolean var/browser_platforms/signing_android)
    60 
    +if [ -n "$platform_android" ]; then
    60 61 
       git add "$tbb_version_type"/download-android-*.json
    61 62 
       git diff --quiet  --cached --exit-code || \
    62 63 
         git commit -m "$tbb_version_type: new version, $tbb_version (android)"

  • tools/update-responses/update_responses
    ... ... @@ -464,14 +464,16 @@ sub write_downloads_json {
    464 464 
         my $versions = as_array($config->{channels}{$channel});
    465 465 
         my ($version) = @$versions;
    466 466 
         my $tag = get_config($config, $version, 'any', 'tag');
    467 
    -    my $data = {
    468 
    -        version => "$version",
    469 
    -        tag => "$tag",
    470 
    -        downloads => get_version_downloads($config, $version),
    471 
    -        comment => 'This file is deprecated and should not be used. Please use the files download-$platform.json instead.',
    472 
    -    };
    473 
    -    write_htdocs($channel, '.', 'downloads.json',
    474 
    -        JSON->new->utf8->canonical->pretty->encode($data));
    467 
    +    if (!$config->{create_downloads_json_only}) {
    468 
    +        my $data = {
    469 
    +            version => "$version",
    470 
    +            tag => "$tag",
    471 
    +            downloads => get_version_downloads($config, $version),
    472 
    +            comment => 'This file is deprecated and should not be used. Please use the files download-$platform.json instead.',
    473 
    +        };
    474 
    +        write_htdocs($channel, '.', 'downloads.json',
    475 
    +            JSON->new->utf8->canonical->pretty->encode($data));
    476 
    +    }
    475 477 
         my $pp_downloads = get_perplatform_downloads($config, $version, $tag);
    476 478 
         foreach my $os (keys %{$pp_downloads}) {
    477 479 
             write_htdocs($channel, '.', "download-$os.json",
    ... ... @@ -634,8 +636,10 @@ my %actions = (
    634 636 
             exit_error "Wrong arguments" unless @ARGV == 1;
    635 637 
             my $channel = $ARGV[0];
    636 638 
             exit_error "Unknown channel $channel" unless $config->{channels}{$channel};
    637 
    -        write_responses($config, $channel);
    638 
    -        write_htaccess($config, $channel);
    639 
    +        if (!$config->{create_downloads_json_only}) {
    640 
    +          write_responses($config, $channel);
    641 
    +          write_htaccess($config, $channel);
    642 
    +        }
    639 643 
             write_downloads_json($config, $channel);
    640 644 
         },
    641 645 
         gen_incrementals => sub {

    • —
    View it on GitLab.
    You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications · Help