- tor-packagers - lists.torproject.org

New stable Tor releases: 0.4.1.8 and 0.4.2.6
by Nick Mathewson 30 Jan '20

30 Jan '20

Hello! I've just tagged, signed, and uploaded two new stable releases: Tor 0.4.1.8 and Tor 0.4.2.6. They are available at https://dist.torproject.org/ . Please be sure to check the signatures! These releases backport bugfixes from later releases; they should be mainly of interest to users who are using the Linux seccomp2 sandbox, or who are running Windows Services (formerly NT services). These users will probably have been experiencing crashes on startup. Other users should be fine with the previous stable releases in these series. You can read the changelogs here: https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.4.1.8 https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.4.2.6 Please also note that the Tor 0.2.9.x series reached end-of-life on 1 January of this year, and Tor 0.4.0.x is about to be end-of-life (in 3 days from today). The supported stable series are now 0.3.5.x (LTS), 0.4.1.x, and 0.4.2.x. For updates on how long they will be supported, please see https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/CoreTor… . I'll post official announcements in a couple of hours. Many thanks, and happy hacking! -- Nick

1 0

Proposal: Removal of unmaintained service files
by teor 24 Jan '20

24 Jan '20

Dear Tor Packagers, The tor developers are considering removing the following unmaintained files: contrib/dist * rc.subr - script * tor.service.in - systemd service ini file Do any of your distribution packages use these files? If you only use one of them, please let us know which one. We're aware that these files don't work for some users. But we don't know which changes we should be making to these files, so they work for most users. Please open tickets to upstream any changes that you've made for your distribution: https://trac.torproject.org/projects/tor If there are multiple conflicting changes, we'll consult this list to work out which changes to apply upstream. For context, see: https://trac.torproject.org/projects/tor/ticket/30797 https://trac.torproject.org/projects/tor/ticket/31576 T -- teor ----------------------------------------------------------------------

4 3

New alpha release: Tor 0.4.3.1-alpha
by Nick Mathewson 23 Jan '20

23 Jan '20

Hi! There's a new alpha release (0.4.3.1-alpha) for download at the usual place at https://dist.torproject.org/ . Please remember to check the signature! I'll be sending out an official announcement later tonight. If this alpha doesn't turn up any big bugs, we'll be putting out a stable 0.4.2.x and 0.4.1.x updates some time next week. You can read the changelog at https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.4.3.1-alpha best wishes, -- Nick

1 0

Fwd: Stem Release 1.8
by Damian Johnson 29 Dec '19

29 Dec '19

Hi lovely packaging community. Just a quick head's up that there is a new release of Stem (version 1.8). If you spot any issues please let me know! ---------- Forwarded message --------- From: Damian Johnson <atagar(a)torproject.org> Date: Sun, Dec 29, 2019 at 3:25 PM Subject: Stem Release 1.8 To: tor-project <tor-project(a)lists.torproject.org> Hi all, I'm delighted to announce Stem 1.8! https://blog.atagar.com/stem-release-1-8/ This is the final release in Stem’s 1.x series and with it Python 2.x support [1]. Over a year in the making, this introduces CollecTor, bandwidth metric, and HSv3 descriptor support. For a list of everything that's changed please see... https://stem.torproject.org/change_log.html#version-1-8 Cheers! -Damian [1] https://www.python.org/doc/sunset-python-2/

1 0

New stable Tor releases: 0.4.2.5, 0.4.1.7, 0.4.0.6, and 0.3.5.9
by Nick Mathewson 09 Dec '19

09 Dec '19

Hello! There are new stable releases available at https://dist.torproject.org/. They include the first stable release in the 0.4.2.x series, and updates for the series 0.4.1.x, 0.4.0.x, and 0.3.5.x series. As ever, see https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/CoreTor… for our support schedule. Note in particular: * if you want a long-term supported series, you will need 0.3.5.x. * The 0.4.0.x and 0.2.9.x series will soon reach end-of-life, in the early months of 2020. * Now that 0.4.2.x is stable, we will support it for nine months, or until three months after 0.4.3.x is stable: whichever is longer. Here are the changelogs for today's releases: https://gitweb.torproject.org/tor.git/plain/ChangeLog?h=tor-0.4.2.5 https://gitweb.torproject.org/tor.git/plain/ChangeLog?h=tor-0.4.1.7 https://gitweb.torproject.org/tor.git/plain/ChangeLog?h=tor-0.4.0.6 https://gitweb.torproject.org/tor.git/plain/ChangeLog?h=tor-0.3.5.9 Official announcements will follow later today. best wishes, -- Nick

1 0

torbrowser: problems with 9.0.1 source tarball
by Thomas Klausner 15 Nov '19

15 Nov '19

Hi! I wanted to build firefox-tor-browser-68.2.0esr-9.0-1-build2 (torbrowser 9.0.1) on NetBSD from the source tarball, but I stumbled over a couple problems. The first one, .mozconfig contains --disable-eme but configure doesn't like it: mozbuild.configure.options.InvalidOptionError: --disable-eme is not available in this configuration Is this a NetBSD-specific issue or more general? The second one: --- begin --- The error occurred while processing the following file: /scratch/security/tor-browser/work/firefox-tor-browser-68.2.0esr-9.0-1-build2/browser/extensions/moz.build The underlying problem is we referenced a path that does not exist. That path is: /scratch/security/tor-browser/work/firefox-tor-browser-68.2.0esr-9.0-1-build2/browser/extensions/tor-launcher/moz.build Either create the file if it needs to exist or do not reference it. --- end --- The directory browser/extensions/tor-launcher does not exist in the tarball, which looks like a problem with the tarball to me. Suggestions? Thanks, Thomas

1 0

Tor 0.4.2.4-rc is released!
by Nick Mathewson 15 Nov '19

15 Nov '19

Hi, all! There's a new release candidate in the 0.4.2.x series. You can get it from the usual place at https://dist.torproject.org/ . Since this is a release candidate, we'd really like to know about any bugs you run into here, so we can fix them before we call this series stable. Here's the changelog: Changes in version 0.4.2.4-rc - 2019-11-15 Tor 0.4.2.4-rc is the first release candidate in its series. It fixes several bugs from earlier versions, including a few that would result in stack traces or incorrect behavior. o Minor features (build system): - Make pkg-config use --prefix when cross-compiling, if PKG_CONFIG_PATH is not set. Closes ticket 32191. o Minor features (geoip): - Update geoip and geoip6 to the November 6 2019 Maxmind GeoLite2 Country database. Closes ticket 32440. o Minor bugfixes (client, onion service v3): - Fix a BUG() assertion that occurs within a very small race window between when a client intro circuit opens and when its descriptor gets cleaned up from the cache. The circuit is now closed early, which will trigger a re-fetch of the descriptor and continue the connection. Fixes bug 28970; bugfix on 0.3.2.1-alpha. o Minor bugfixes (code quality): - Fix "make check-includes" so it runs correctly on out-of-tree builds. Fixes bug 31335; bugfix on 0.3.5.1-alpha. o Minor bugfixes (configuration): - Log the option name when skipping an obsolete option. Fixes bug 32295; bugfix on 0.4.2.1-alpha. o Minor bugfixes (crash): - When running Tor with an option like --verify-config or --dump-config that does not start the event loop, avoid crashing if we try to exit early because of an error. Fixes bug 32407; bugfix on 0.3.3.1-alpha. o Minor bugfixes (directory): - When checking if a directory connection is anonymous, test if the circuit was marked for close before looking at its channel. This avoids a BUG() stacktrace if the circuit was previously closed. Fixes bug 31958; bugfix on 0.4.2.1-alpha. o Minor bugfixes (shellcheck): - Fix minor shellcheck errors in the git-*.sh scripts. Fixes bug 32402; bugfix on 0.4.2.1-alpha. - Start checking most scripts for shellcheck errors again. Fixes bug 32402; bugfix on 0.4.2.1-alpha. o Testing (continuous integration): - Use Ubuntu Bionic images for our Travis CI builds, so we can get a recent version of coccinelle. But leave chutney on Ubuntu Trusty, until we can fix some Bionic permissions issues (see ticket 32240). Related to ticket 31919. - Install the mingw OpenSSL package in Appveyor. This makes sure that the OpenSSL headers and libraries match in Tor's Appveyor builds. (This bug was triggered by an Appveyor image update.) Fixes bug 32449; bugfix on 0.3.5.6-rc. - In Travis, use Xcode 11.2 on macOS 10.14. Closes ticket 32241.

1 0

Tor 0.4.2.3-alpha is released!
by Nick Mathewson 24 Oct '19

24 Oct '19

Hi! I've just put out 0.4.2.3-alpha. It fixes a few bugs, so if you build alphas, you'll want to update to this one. (And if you don't build alphas, then how will you know if we've broken something that your platform cares about?) This also fixes some bugs that we plan to backport, so it would be good to get feedback about issues there, too. https://dist.torproject.org/ has the source and the signature, as usual. Here's the changelog: Changes in version 0.4.2.3-alpha - 2019-10-24 This release fixes several bugs from the previous alpha release, and from earlier versions of Tor. o Major bugfixes (relay): - Relays now respect their AccountingMax bandwidth again. When relays entered "soft" hibernation (which typically starts when we've hit 90% of our AccountingMax), we had stopped checking whether we should enter hard hibernation. Soft hibernation refuses new connections and new circuits, but the existing circuits can continue, meaning that relays could have exceeded their configured AccountingMax. Fixes bug 32108; bugfix on 0.4.0.1-alpha. o Major bugfixes (v3 onion services): - Onion services now always use the exact number of intro points configured with the HiddenServiceNumIntroductionPoints option (or fewer if nodes are excluded). Before, a service could sometimes pick more intro points than configured. Fixes bug 31548; bugfix on 0.3.2.1-alpha. o Minor feature (onion services, control port): - The ADD_ONION command's keyword "BEST" now defaults to ED25519-V3 (v3) onion services. Previously it defaulted to RSA1024 (v2). Closes ticket 29669. o Minor features (testing): - When running tests that attempt to look up hostnames, replace the libc name lookup functions with ones that do not actually touch the network. This way, the tests complete more quickly in the presence of a slow or missing DNS resolver. Closes ticket 31841. o Minor features (testing, continuous integration): - Disable all but one Travis CI macOS build, to mitigate slow scheduling of Travis macOS jobs. Closes ticket 32177. - Run the chutney IPv6 networks as part of Travis CI. Closes ticket 30860. - Simplify the Travis CI build matrix, and optimise for build time. Closes ticket 31859. - Use Windows Server 2019 instead of Windows Server 2016 in our Appveyor builds. Closes ticket 32086. o Minor bugfixes (build system): - Interpret "--disable-module-dirauth=no" correctly. Fixes bug 32124; bugfix on 0.3.4.1-alpha. - Interpret "--with-tcmalloc=no" correctly. Fixes bug 32124; bugfix on 0.2.0.20-rc. - Stop failing when jemalloc is requested, but tcmalloc is not found. Fixes bug 32124; bugfix on 0.3.5.1-alpha. - When pkg-config is not installed, or a library that depends on pkg-config is not found, tell the user what to do to fix the problem. Fixes bug 31922; bugfix on 0.3.1.1-alpha. o Minor bugfixes (connections): - Avoid trying to read data from closed connections, which can cause needless loops in Libevent and infinite loops in Shadow. Fixes bug 30344; bugfix on 0.1.1.1-alpha. o Minor bugfixes (error handling): - Always lock the backtrace buffer before it is used. Fixes bug 31734; bugfix on 0.2.5.3-alpha. o Minor bugfixes (mainloop, periodic events, in-process API): - Reset the periodic events' "enabled" flag when Tor is shut down cleanly. Previously, this flag was left on, which caused periodic events not to be re-enabled when Tor was relaunched in-process with tor_api.h after a shutdown. Fixes bug 32058; bugfix on 0.3.3.1-alpha. o Minor bugfixes (process management): - Remove overly strict assertions that triggered when a pluggable transport failed to launch. Fixes bug 31091; bugfix on 0.4.0.1-alpha. - Remove an assertion in the Unix process backend. This assertion would trigger when we failed to find the executable for a child process. Fixes bug 31810; bugfix on 0.4.0.1-alpha. o Minor bugfixes (testing): - Avoid intermittent test failures due to a test that had relied on inconsistent timing sources. Fixes bug 31995; bugfix on 0.3.1.3-alpha. - When testing port rebinding, don't busy-wait for tor to log. Instead, actually sleep for a short time before polling again. Also improve the formatting of control commands and log messages. Fixes bug 31837; bugfix on 0.3.5.1-alpha. o Minor bugfixes (tls, logging): - Log bugs about the TLS read buffer's length only once, rather than filling the logs with similar warnings. Fixes bug 31939; bugfix on 0.3.0.4-rc. o Minor bugfixes (v3 onion services): - Fix an implicit conversion from ssize_t to size_t discovered by Coverity. Fixes bug 31682; bugfix on 0.4.2.1-alpha. - Fix a memory leak in an unlikely error code path when encoding HS DoS establish intro extension cell. Fixes bug 32063; bugfix on 0.4.2.1-alpha. - When cleaning up intro circuits for a v3 onion service, don't remove circuits that have an established or pending circuit, even if they ran out of retries. This way, we don't remove a circuit on its last retry. Fixes bug 31652; bugfix on 0.3.2.1-alpha. o Documentation: - Correct the description of "GuardLifetime". Fixes bug 31189; bugfix on 0.3.0.1-alpha. - Make clear in the man page, in both the bandwidth section and the AccountingMax section, that Tor counts in powers of two, not powers of ten: 1 GByte is 1024*1024*1024 bytes, not one billion bytes. Resolves ticket 32106.

1 0

Tor 0.4.2.2-alpha released!
by Nick Mathewson 07 Oct '19

07 Oct '19

Hi! I've just put out 0.4.2.2-alpha. It fixes a few bugs, so if you build alphas, you'll want to update to this one. (And if you don't build alphas, then how will you know if we've broken something that your platform cares about?) https://dist.torproject.org/ has the source and the signature, as usual. Here's the changelog: Changes in version 0.4.2.2-alpha - 2019-10-07 This release fixes several bugs from the previous alpha release, and from earlier versions. It also includes a change in authorities, so that they begin to reject the currently unsupported release series. o Major features (directory authorities): - Directory authorities now reject relays running all currently deprecated release series. The currently supported release series are: 0.2.9, 0.3.5, 0.4.0, 0.4.1, and 0.4.2. Closes ticket 31549. o Major bugfixes (embedded Tor): - Avoid a possible crash when restarting Tor in embedded mode and enabling a different set of publish/subscribe messages. Fixes bug 31898; bugfix on 0.4.1.1-alpha. o Major bugfixes (torrc parsing): - Stop ignoring torrc options after an %include directive, when the included directory ends with a file that does not contain any config options (but does contain comments or whitespace). Fixes bug 31408; bugfix on 0.3.1.1-alpha. o Minor features (auto-formatting scripts): - When annotating C macros, never generate a line that our check- spaces script would reject. Closes ticket 31759. - When annotating C macros, try to remove cases of double-negation. Closes ticket 31779. o Minor features (continuous integration): - When building on Appveyor and Travis, pass the "-k" flag to make, so that we are informed of all compilation failures, not just the first one or two. Closes ticket 31372. o Minor features (geoip): - Update geoip and geoip6 to the October 1 2019 Maxmind GeoLite2 Country database. Closes ticket 31931. o Minor features (maintenance scripts): - Add a Coccinelle script to detect bugs caused by incrementing or decrementing a variable inside a call to log_debug(). Since log_debug() is a macro whose arguments are conditionally evaluated, it is usually an error to do this. One such bug was 30628, in which SENDME cells were miscounted by a decrement operator inside a log_debug() call. Closes ticket 30743. o Minor features (onion services v3): - Assist users who try to setup v2 client authorization in v3 onion services by pointing them to the right documentation. Closes ticket 28966. o Minor bugfixes (Appveyor continuous integration): - Avoid spurious errors when Appveyor CI fails before the install step. Fixes bug 31884; bugfix on 0.3.4.2-alpha. o Minor bugfixes (best practices tracker): - When listing overbroad exceptions, do not also list problems, and do not list insufficiently broad exceptions. Fixes bug 31338; bugfix on 0.4.2.1-alpha. o Minor bugfixes (controller protocol): - Fix the MAPADDRESS controller command to accept one or more arguments. Previously, it required two or more arguments, and ignored the first. Fixes bug 31772; bugfix on 0.4.1.1-alpha. o Minor bugfixes (logging): - Add a missing check for HAVE_PTHREAD_H, because the backtrace code uses mutexes. Fixes bug 31614; bugfix on 0.2.5.2-alpha. - Disable backtrace signal handlers when shutting down tor. Fixes bug 31614; bugfix on 0.2.5.2-alpha. - Rate-limit our the logging message about the obsolete .exit notation. Previously, there was no limit on this warning, which could potentially be triggered many times by a hostile website. Fixes bug 31466; bugfix on 0.2.2.1-alpha. - When initialising log domain masks, only set known log domains. Fixes bug 31854; bugfix on 0.2.1.1-alpha. o Minor bugfixes (logging, protocol violations): - Do not log a nonfatal assertion failure when receiving a VERSIONS cell on a connection using the obsolete v1 link protocol. Log a protocol_warn instead. Fixes bug 31107; bugfix on 0.2.4.4-alpha. o Minor bugfixes (modules): - Explain what the optional Directory Authority module is, and what happens when it is disabled. Fixes bug 31825; bugfix on 0.3.4.1-alpha. o Minor bugfixes (multithreading): - Avoid some undefined behaviour when freeing mutexes. Fixes bug 31736; bugfix on 0.0.7. o Minor bugfixes (relay): - Avoid crashing when starting with a corrupt keys directory where the old ntor key and the new ntor key are identical. Fixes bug 30916; bugfix on 0.2.4.8-alpha. o Minor bugfixes (tests, SunOS): - Avoid a map_anon_nofork test failure due to a signed/unsigned integer comparison. Fixes bug 31897; bugfix on 0.4.1.1-alpha. o Code simplification and refactoring: - Refactor connection_control_process_inbuf() to reduce the size of a practracker exception. Closes ticket 31840. - Refactor the microdescs_parse_from_string() function into smaller pieces, for better comprehensibility. Closes ticket 31675. - Use SEVERITY_MASK_IDX() to find the LOG_* mask indexes in the unit tests and fuzzers, rather than using hard-coded values. Closes ticket 31334. - Interface for function `decrypt_desc_layer` cleaned up. Closes ticket 31589. o Documentation: - Document the signal-safe logging behaviour in the tor man page. Also add some comments to the relevant functions. Closes ticket 31839. - Explain why we can't destroy the backtrace buffer mutex. Explain why we don't need to destroy the log mutex. Closes ticket 31736. - The Tor source code repository now includes a (somewhat dated) description of Tor's modular architecture, in doc/HACKING/design. This is based on the old "tor-guts.git" repository, which we are adopting and superseding. Closes ticket 31849.

1 0

New stable release: 0.4.1.6
by Nick Mathewson 19 Sep '19

19 Sep '19

Hi, folks! There is a new stable release available at https://dist.torproject.org/ . It fixes a few regressions, irritations, and compilation bugs. You can read the changelog at https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.4.1.6 I'll send an official announcement after the website has updated. Also, a reminder for anybody still shipping them: 0.2.9.x will reach end-of-life in January 2020, and 0.4.0.x will reach end-of-life in February 2020. You can find the latest version of our release/support plan at https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/CoreTor… . 0.3.5.x is the current LTS series, and 0.4.1.x is the latest stable series. cheers, -- Nick

1 0