[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

[tor-commits] [Git][tpo/applications/tor-browser][tor-browser-102.8.0esr-12.5-1] 7 commits: Revert "Bug 13379: Sign our MAR files."

Title: GitLab

Pier Angelo Vendrame pushed to branch tor-browser-102.8.0esr-12.5-1 at The Tor Project / Applications / Tor Browser

Commits:

  • bd011d63
    by Pier Angelo Vendrame at 2023-03-10T10:39:17+01:00 
    Revert "Bug 13379: Sign our MAR files."

This reverts commit 778aa6cfc77d6b747bc7be1cd2d421861265d68d.
  • 1a81a5cc
    by Pier Angelo Vendrame at 2023-03-10T10:39:17+01:00 
    fixup! Bug 4234: Use the Firefox Update Process for Tor Browser.

Bug 41668: Port some updater patches to Base Browser

Move the check on the update package version to this other commit.
  • fcf0e668
    by Kathy Brade at 2023-03-10T10:39:17+01:00 
    Bug 13379: Allow using NSS to sign and verify MAR signatures

Allow using NSS on all platforms for checking MAR signatures (instead
  of using OS-native APIs, the default on Mac OS and Windows).
  So that the NSS and NSPR libraries the updater depends on can be
  found at runtime, we add the firefox directory to the shared library
  search path on macOS.
  On Linux, rpath is used to solve that problem, but that approach
  won't work on macOS because the updater executable is copied during
  the update process to a location that can vary.
  • 6209ee94
    by Kathy Brade at 2023-03-10T10:39:18+01:00 
    Bug 19121: reinstate the update.xml hash check

This is a partial revert of commit f1241db6986e4b54473a1ed870f7584c75d51122.

Revert most changes from Mozilla Bug 862173 "don't verify mar file hash
when using mar signing to verify the mar file (lessens main thread I/O)."

We kept the addition to the AppConstants API in case other JS code
references it in the future.
  • 7e05454e
    by Pier Angelo Vendrame at 2023-03-10T10:39:18+01:00 
    fixup! Bug 19121: reinstate the update.xml hash check

Bug 41668: Port some updater patches to Base Browser

Modernize the way to compute the hash digest.
  • 5f27ed12
    by Pier Angelo Vendrame at 2023-03-10T10:39:19+01:00 
    fixup! Bug 13379: Allow using NSS to sign and verify MAR signatures

Bug 41668: Port some updater patches to Base Browser

Use a configure-time flag to force using NSS for MARs signatures.
  • 7caf293f
    by Pier Angelo Vendrame at 2023-03-10T10:39:19+01:00 
    fixup! Base Browser's .mozconfigs.

Bug 41668: Port some updater patches to Base Browser

10 changed files:

Changes:

  • browser/config/mozconfigs/base-browser
    ... ... @@ -14,6 +14,10 @@ export MOZILLA_OFFICIAL=1
    14 14 
     ac_add_options --enable-optimize
    15 15 
     ac_add_options --enable-rust-simd
    16 16
    17 
    +# Bug 13379: Sign our MAR files.
    18 
    +ac_add_options --enable-verify-mar
    19 
    +ac_add_options --enable-nss-mar
    20 
    +
    17 21 
     ac_add_options --enable-bundled-fonts
    18 22
    19 23 
     ac_add_options --disable-tests

  • browser/config/mozconfigs/tor-browser
    ... ... @@ -11,6 +11,5 @@ ac_add_options --with-relative-data-dir=TorBrowser/Data/Browser
    11 11 
     # ac_add_options --with-user-appdir=.torproject
    12 12
    13 13 
     ac_add_options --enable-tor-browser-update
    14 
    -ac_add_options --enable-verify-mar
    15 14
    16 15 
     ac_add_options --with-distribution-id=org.torproject

  • build/moz.configure/update-programs.configure
    ... ... @@ -32,6 +32,14 @@ set_config(
    32 32 
         "MOZ_VERIFY_MAR_SIGNATURE", depends_if("--enable-verify-mar")(lambda _: True)
    33 33 
     )
    34 34
    35 
    +# Use NSS for MAR signatures even on platforms where system libraries are
    36 
    +# supported (currently Windows and macOS).
    37 
    +# ==============================================================
    38 
    +
    39 
    +option("--enable-nss-mar", help="Always use NSS for MAR signatures")
    40 
    +
    41 
    +set_config("MOZ_USE_NSS_FOR_MAR", True, when="--enable-nss-mar")
    42 
    +
    35 43 
     # Maintenance service (Windows only)
    36 44 
     # ==============================================================
    37 45

  • modules/libmar/tool/moz.build
    ... ... @@ -43,7 +43,7 @@ if CONFIG["MOZ_BUILD_APP"] != "tools/update-packaging":
    43 43 
             "verifymar",
    44 44 
         ]
    45 45
    46 
    -    if CONFIG["TOR_BROWSER_UPDATE"]:
    46 
    +    if CONFIG["MOZ_USE_NSS_FOR_MAR"]:
    47 47 
             DEFINES["MAR_NSS"] = True
    48 48
    49 49 
         if CONFIG["OS_ARCH"] == "WINNT":
    ... ... @@ -52,12 +52,12 @@ if CONFIG["MOZ_BUILD_APP"] != "tools/update-packaging":
    52 52 
             OS_LIBS += [
    53 53 
                 "ws2_32",
    54 54 
             ]
    55 
    -        if not CONFIG["TOR_BROWSER_UPDATE"]:
    55 
    +        if not CONFIG["MOZ_USE_NSS_FOR_MAR"]:
    56 56 
                 OS_LIBS += [
    57 57 
                     "crypt32",
    58 58 
                     "advapi32",
    59 59 
                 ]
    60 
    -    elif CONFIG["OS_ARCH"] == "Darwin" and not CONFIG["TOR_BROWSER_UPDATE"]:
    60 
    +    elif CONFIG["OS_ARCH"] == "Darwin" and not CONFIG["MOZ_USE_NSS_FOR_MAR"]:
    61 61 
             OS_LIBS += [
    62 62 
                 "-framework CoreFoundation",
    63 63 
                 "-framework Security",

  • modules/libmar/verify/moz.build
    ... ... @@ -15,12 +15,15 @@ FORCE_STATIC_LIB = True
    15 15
    16 16 
     if CONFIG["OS_ARCH"] == "WINNT":
    17 17 
         USE_STATIC_LIBS = True
    18 
    -elif CONFIG["OS_ARCH"] == "Darwin":
    19 
    -    USE_LIBS += [
    20 
    -        "nspr",
    21 
    -        "nss",
    22 
    -        "signmar",
    18 
    +    use_nss = CONFIG["MOZ_USE_NSS_FOR_MAR"]
    19 
    +elif CONFIG["OS_ARCH"] == "Darwin" and not CONFIG["MOZ_USE_NSS_FOR_MAR"]:
    20 
    +    UNIFIED_SOURCES += [
    21 
    +        "MacVerifyCrypto.cpp",
    23 22 
         ]
    23 
    +    OS_LIBS += [
    24 
    +        "-framework Security",
    25 
    +    ]
    26 
    +    use_nss = False
    24 27 
     else:
    25 28 
         USE_LIBS += [
    26 29 
             "nspr",
    ... ... @@ -34,14 +37,16 @@ else:
    34 37 
         OS_LIBS += [
    35 38 
             "-Wl,-rpath=\\$$ORIGIN",
    36 39 
         ]
    37 
    -
    38 
    -DEFINES["MAR_NSS"] = True
    39 
    -LOCAL_INCLUDES += ["../sign"]
    40 
    +    use_nss = True
    40 41
    41 42 
     LOCAL_INCLUDES += [
    42 43 
         "../src",
    43 44 
     ]
    44 45
    46 
    +if use_nss:
    47 
    +    LOCAL_INCLUDES += ["../sign"]
    48 
    +    DEFINES["MAR_NSS"] = True
    49 
    +
    45 50 
     # C11 for static_assert
    46 51 
     c11_flags = ["-std=gnu11"]
    47 52 
     if CONFIG["CC_TYPE"] == "clang-cl":

  • toolkit/mozapps/update/UpdateService.jsm
    ... ... @@ -996,21 +996,6 @@ function LOG(string) {
    996 996 
       }
    997 997 
     }
    998 998
    999 
    -/**
    1000 
    - * Convert a string containing binary values to hex.
    1001 
    - */
    1002 
    -function binaryToHex(input) {
    1003 
    -  var result = "";
    1004 
    -  for (var i = 0; i < input.length; ++i) {
    1005 
    -    var hex = input.charCodeAt(i).toString(16);
    1006 
    -    if (hex.length == 1) {
    1007 
    -      hex = "0" + hex;
    1008 
    -    }
    1009 
    -    result += hex;
    1010 
    -  }
    1011 
    -  return result;
    1012 
    -}
    1013 
    -
    1014 999 
     /**
    1015 1000 
      * Gets the specified directory at the specified hierarchy under the
    1016 1001 
      * update root directory and creates it if it doesn't exist.
    ... ... @@ -5204,7 +5189,13 @@ Downloader.prototype = {
    5204 5189 
           // encoded binary (such as what is typically output by programs like
    5205 5190 
           // sha1sum).  In the future, this may change to base64 depending on how
    5206 5191 
           // we choose to compute these hashes.
    5207 
    -      digest = binaryToHex(hash.finish(false));
    5192 
    +      hash = hash.finish(false);
    5193 
    +      digest = Array.from(hash, (c, i) =>
    5194 
    +        hash
    5195 
    +          .charCodeAt(i)
    5196 
    +          .toString(16)
    5197 
    +          .padStart(2, "0")
    5198 
    +      ).join("");
    5208 5199 
         } catch (e) {
    5209 5200 
           LOG(
    5210 5201 
             "Downloader:_verifyDownload - failed to compute hash of the downloaded update archive"

  • toolkit/mozapps/update/updater/updater-common.build
    ... ... @@ -4,9 +4,11 @@
    4 4 
     # License, v. 2.0. If a copy of the MPL was not distributed with this
    5 5 
     # file, You can obtain one at http://mozilla.org/MPL/2.0/.
    6 6
    7 
    -DEFINES["MAR_NSS"] = True
    8 
    -
    9 
    -link_with_nss = DEFINES["MAR_NSS"] or (CONFIG["OS_ARCH"] == "Linux" and CONFIG["MOZ_VERIFY_MAR_SIGNATURE"])
    7 
    +link_with_nss = CONFIG["MOZ_USE_NSS_FOR_MAR"] or (
    8 
    +    CONFIG["OS_ARCH"] == "Linux" and CONFIG["MOZ_VERIFY_MAR_SIGNATURE"]
    9 
    +)
    10 
    +if link_with_nss:
    11 
    +    DEFINES["MAR_NSS"] = True
    10 12
    11 13 
     srcs = [
    12 14 
         "archivereader.cpp",

  • toolkit/mozapps/update/updater/updater.cpp
    ... ... @@ -2809,7 +2809,8 @@ static void UpdateThreadFunc(void* param) {
    2809 2809 
             if (ReadMARChannelIDs(updateSettingsPath, &MARStrings) != OK) {
    2810 2810 
               rv = UPDATE_SETTINGS_FILE_CHANNEL;
    2811 2811 
             } else {
    2812 
    -#  ifdef TOR_BROWSER_UPDATE
    2812 
    +#  ifdef BASE_BROWSER_VERSION_QUOTED
    2813 
    +          // Use the base browser version to prevent downgrade attacks.
    2813 2814 
               const char* appVersion = BASE_BROWSER_VERSION_QUOTED;
    2814 2815 
     #  else
    2815 2816 
               const char* appVersion = MOZ_APP_VERSION;

  • toolkit/xre/moz.build
    ... ... @@ -232,8 +232,8 @@ for var in ("APP_VERSION", "APP_ID"):
    232 232 
     if CONFIG["MOZ_BUILD_APP"] == "browser":
    233 233 
         DEFINES["MOZ_BUILD_APP_IS_BROWSER"] = True
    234 234
    235 
    -if CONFIG['TOR_BROWSER_UPDATE']:
    236 
    -    DEFINES['MAR_NSS'] = True
    235 
    +if CONFIG["MOZ_USE_NSS_FOR_MAR"]:
    236 
    +    DEFINES["MAR_NSS"] = True
    237 237
    238 238 
     LOCAL_INCLUDES += [
    239 239 
         "../../other-licenses/nsis/Contrib/CityHash/cityhash",

  • toolkit/xre/nsUpdateDriver.cpp
    ... ... @@ -342,8 +342,7 @@ static bool IsOlderVersion(nsIFile* versionFile, const char* appVersion) {
    342 342 
       return mozilla::Version(appVersion) > buf;
    343 343 
     }
    344 344
    345 
    -#if defined(TOR_BROWSER_UPDATE) && defined(MOZ_VERIFY_MAR_SIGNATURE) && \
    346 
    -    defined(MAR_NSS) && defined(XP_MACOSX)
    345 
    +#if defined(MOZ_VERIFY_MAR_SIGNATURE) && defined(MAR_NSS) && defined(XP_MACOSX)
    347 346 
     /**
    348 347 
      * Ideally we would save and restore the original library path value after
    349 348 
      * the updater finishes its work (and before firefox is re-launched).
    ... ... @@ -656,8 +655,7 @@ static void ApplyUpdate(nsIFile* greDir, nsIFile* updateDir, nsIFile* appDir,
    656 655 
         PR_SetEnv("MOZ_SAFE_MODE_RESTART=1");
    657 656 
       }
    658 657
    659 
    -#if defined(TOR_BROWSER_UPDATE) && defined(MOZ_VERIFY_MAR_SIGNATURE) && \
    660 
    -    defined(MAR_NSS) && defined(XP_MACOSX)
    658 
    +#if defined(MOZ_VERIFY_MAR_SIGNATURE) && defined(MAR_NSS) && defined(XP_MACOSX)
    661 659 
       // On macOS, append the app directory to the shared library search path
    662 660 
       // so the system can locate the shared libraries that are needed by the
    663 661 
       // updater, e.g., libnss3.dylib).

    • —
    View it on GitLab.
    You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications · Help 

    _______________________________________________
tor-commits mailing list
tor-commits@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits