[tor-bugs] #20210 [Applications/Tor Browser]: Update from 6.5a2 to 6.5a3 on OSX breaks Tor Browser

[Tor Bug Tracker & Wiki]

#20210: Update from 6.5a2 to 6.5a3 on OSX breaks Tor Browser
--------------------------------------+--------------------------
 Reporter:  mrphs                     |          Owner:  tbb-team
     Type:  defect                    |         Status:  new
 Priority:  Very High                 |      Milestone:
Component:  Applications/Tor Browser  |        Version:
 Severity:  Major                     |     Resolution:
 Keywords:  TorBrowserTeam201609      |  Actual Points:
Parent ID:                            |         Points:
 Reviewer:                            |        Sponsor:
--------------------------------------+--------------------------

Comment (by gk):

 Replying to [comment:24 boklm]:
 > Replying to [comment:23 mcs]:
 > > Replying to [comment:20 gk]:
 > > > We set them already before creating the .dmg file with the `ddmg.sh`
 script, no?
 > >
 > > I might be overlooking something, but it looks like ddmg.sh relies on
 some of the mode bits being correct in order to determine which files
 should have mode 0755, etc. Since the exec bits are lost during the 7z
 extraction process, I don't think ddmg.sh will work as-is (but I have not
 tried it).
 >
 > I think you are right, `ddmg.sh` is using `find $@ -executable` to find
 which files to change.
 >
 > I can see two options to fix this permissions problem:
 > - generate the new mar files using the `*-signed.tar.bz2` files instead
 of the .dmg files
 > - generate them from the .dmg files, and extract the old mar file to
 replicate the file permissions from the old mar file to the new one

 So, I really like to avoid roping the .bz2 files in as this adds an
 additional kludge to this signing nightmare. Two additional options:

 - maybe we can look at Mozilla code checking how the correct permission
 are set in the first place and replicate that
 - fix `7z` as this seems clearly to be a bug that deserves to get fixed
 upstream

 My hope is that fixing the permission problem in `7z` is not that hard
 which is why I would start with that one first. Otherwise taking the
 option that consumes the least amount of time to implement and test seems
 to be a good heuristic. If it turns out to include the .bz2 files I guess
 I'd bite that bullet.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/20210#comment:25>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online