boklm pushed to branch main at The Tor Project / Applications / tor-browser-build
Commits:
-
f11c6a41
by Nicolas Vigier at 2026-04-02T16:02:11+02:00
-
8d52f71d
by Nicolas Vigier at 2026-04-02T16:02:11+02:00
-
00735068
by Nicolas Vigier at 2026-04-02T16:02:11+02:00
-
f8e22809
by Nicolas Vigier at 2026-04-02T16:02:11+02:00
-
2b885eeb
by Nicolas Vigier at 2026-04-02T16:02:11+02:00
-
3e7a89e1
by Nicolas Vigier at 2026-04-02T16:02:11+02:00
-
a9325827
by Nicolas Vigier at 2026-04-02T16:02:11+02:00
14 changed files:
- .gitlab/issue_templates/010 Backport.md
- .gitlab/issue_templates/041 Release Prep - Tor Browser Stable.md
- .gitlab/merge_request_templates/relprep.md
- projects/release/update_responses_config.yml
- rbm.conf
- tools/browser/README.md
- tools/browser/sign-tag
- − tools/signing/alpha.entitlements.xml
- tools/signing/do-all-signing
- tools/signing/machines-setup/setup-signing-machine
- − tools/signing/machines-setup/sudoers.d/sign-rcodesign
- − tools/signing/release.entitlements.xml
- − tools/signing/wrappers/sign-rcodesign
- tools/update-responses/update_responses
Changes:
| ... | ... | @@ -20,7 +20,6 @@ This is an issue for tracking back-porting a patch-set (e.g. from main to maint- |
| 20 | 20 | ### Target Channels
|
| 21 | 21 | |
| 22 | 22 | - [ ] maint-15.0
|
| 23 | -- [ ] maint-13.5
|
|
| 24 | 23 | |
| 25 | 24 | ## Notes
|
| 26 | 25 |
| ... | ... | @@ -68,8 +68,6 @@ Tor Browser Stable is on the `maint-${TOR_BROWSER_MAJOR}.${TOR_BROWSER_MINOR}` b |
| 68 | 68 | - [ ] ***(Desktop Only)*** `var/torbrowser_incremental_from`: updated to previous Desktop version
|
| 69 | 69 | - **NOTE**: We try to build incrementals for the previous 3 desktop versions
|
| 70 | 70 | - **⚠️ WARNING**: Really *actually* make sure this is the previous Desktop version or else the `make torbrowser-incrementals-*` step will fail
|
| 71 | - - [ ] `var/torbrowser_legacy_version`: updated to latest legacy Tor Browser version
|
|
| 72 | - - [ ] `var/torbrowser_legacy_platform_version`: updated to latest legacy Tor Browser ESR version
|
|
| 73 | 71 | - [ ] `projects/firefox/config`
|
| 74 | 72 | - [ ] `var/browser_build`: updated to match `tor-browser` tag
|
| 75 | 73 | - [ ] ***(Optional)*** `var/firefox_platform_version`: updated to latest `${ESR_VERSION}` if rebased
|
| ... | ... | @@ -211,9 +209,6 @@ Tor Browser Stable is on the `maint-${TOR_BROWSER_MAJOR}.${TOR_BROWSER_MINOR}` b |
| 211 | 209 | Changelog:
|
| 212 | 210 | # paste changelog as quote here
|
| 213 | 211 | ```
|
| 214 | -- [ ] Verify the associated legacy `maint-13.5` release has been signed and deployed
|
|
| 215 | - - **⚠️ WARNING**: Do not continue if the legacy channel has not been fully signed and published yet; it is needed for update-response generation!
|
|
| 216 | - - **NOTE** Stable releases without a corresponding legacy release may ignore this
|
|
| 217 | 212 | - [ ] On `${STAGING_SERVER}`, ensure updated:
|
| 218 | 213 | - **NOTE** Having a local git branch with `maint-15.0` as the upstream branch with these values saved means you only need to periodically `git pull --rebase`
|
| 219 | 214 | - [ ] `tor-browser-build` is on the right commit: `git tag -v tbb-${TOR_BROWSER_VERSION}-${TOR_BROWSER_BUILD_N} && git checkout tbb-${TOR_BROWSER_VERSION}-${TOR_BROWSER_BUILD_N}`
|
| ... | ... | @@ -20,8 +20,6 @@ |
| 20 | 20 | - [ ] `var/torbrowser_build`: should be `build1`, unless bumping a previous release preparation
|
| 21 | 21 | - [ ] `var/browser_release_date`: must not be in the future when we start building
|
| 22 | 22 | - [ ] `var/torbrowser_incremental_from` (not needed for Android-only releases)
|
| 23 | - - [ ] `var/torbrowser_legacy_version` (For Tor Browser 14.0.x stable releases only)
|
|
| 24 | - - [ ] `var/torbrowser_legacy_platform_version` (For Tor Browser 14.0.x stable releases only)
|
|
| 25 | 23 | - [ ] Tag updates:
|
| 26 | 24 | - [ ] [Firefox](https://gitlab.torproject.org/tpo/applications/tor-browser/-/tags)
|
| 27 | 25 | - [ ] Geckoview - should match Firefox
|
| ... | ... | @@ -32,9 +32,6 @@ build_targets: |
| 32 | 32 | channels:
|
| 33 | 33 | [% c('var/channel') %]:
|
| 34 | 34 | - [% c("var/torbrowser_version") %]
|
| 35 | -[% IF c("var/tor-browser") && c("var/torbrowser_legacy_version") -%]
|
|
| 36 | - - [% c("var/torbrowser_legacy_version") %]
|
|
| 37 | -[% END -%]
|
|
| 38 | 35 | versions:
|
| 39 | 36 | [% c("var/torbrowser_version") %]:
|
| 40 | 37 | [% IF c("var/create_unsigned_incrementals") -%]
|
| ... | ... | @@ -70,25 +67,6 @@ versions: |
| 70 | 67 | minSupportedOSVersion: 10.0
|
| 71 | 68 | linux-x86_64:
|
| 72 | 69 | minSupportedInstructionSet: SSE2
|
| 73 | -[% IF c("var/tor-browser") && c("var/torbrowser_legacy_version") -%]
|
|
| 74 | - [% c("var/torbrowser_legacy_version") %]:
|
|
| 75 | - mar_channel_id: [% c('var/mar_channel_id') %]
|
|
| 76 | - platformVersion: [% c('var/torbrowser_legacy_platform_version') %]
|
|
| 77 | - detailsURL: https://blog.torproject.org/new[% IF c("var/alpha") %]-alpha[% END %]-release-tor-browser-[% c("var/torbrowser_legacy_version") FILTER remove('\.') %]
|
|
| 78 | - # minSupportedOsVersion on macOS corresponds to the Darwin version ( https://en.wikipedia.org/wiki/Darwin_(operating_system) )
|
|
| 79 | - macos:
|
|
| 80 | - # macOS v10.12.0
|
|
| 81 | - minSupportedOSVersion: 16.0.0
|
|
| 82 | - # minSupportedOsVersion on Windows corresponds to the operating system version ( https://docs.microsoft.com/en-us/windows/win32/sysinfo/operating-system-version )
|
|
| 83 | - windows-i686:
|
|
| 84 | - # Windows 7
|
|
| 85 | - minSupportedOSVersion: 6.1
|
|
| 86 | - minSupportedInstructionSet: SSE2
|
|
| 87 | - windows-x86_64:
|
|
| 88 | - # Windows 7
|
|
| 89 | - minSupportedOSVersion: 6.1
|
|
| 90 | - minSupportedInstructionSet: SSE2
|
|
| 91 | -[% END -%]
|
|
| 92 | 70 | mar_compression: xz
|
| 93 | 71 | [% IF c("var/tor-browser") -%]
|
| 94 | 72 | tag: 'tbb-[% c("var/torbrowser_version") %]-[% c("var/torbrowser_build") %]'
|
| ... | ... | @@ -136,9 +136,6 @@ var: |
| 136 | 136 | - 16.0a2
|
| 137 | 137 | mar_channel_id: '[% c("var/projectname") %]-torproject-[% c("var/channel") %]'
|
| 138 | 138 | |
| 139 | -# torbrowser_legacy_version: 13.5.22
|
|
| 140 | -# torbrowser_legacy_platform_version: 115.28.0
|
|
| 141 | - |
|
| 142 | 139 | # By default, we sort the list of installed packages. This allows sharing
|
| 143 | 140 | # containers with identical list of packages, even if they are not listed
|
| 144 | 141 | # in the same order. In the cases where the installation order is
|
| ... | ... | @@ -50,8 +50,7 @@ This script gpg signs a git tag associated with a particular browser commit in t |
| 50 | 50 | usage: ./tools/browser/sign-tag.<browser> <channel> <build-number> [commit]
|
| 51 | 51 | |
| 52 | 52 | browser one of basebrowser, torbrowser, or mullvadbrowser
|
| 53 | -channel the release channel of the commit to sign (e.g. alpha, stable,
|
|
| 54 | - or legacy)
|
|
| 53 | +channel the release channel of the commit to sign (e.g. alpha, or stable)
|
|
| 55 | 54 | build-number the build number portion of a browser build tag (e.g. build2)
|
| 56 | 55 | commit optional git commit, HEAD is used if argument not present
|
| 57 | 56 | ```
|
| ... | ... | @@ -71,18 +70,6 @@ Invoke the relevant soft-link'd version of this script to sign a particular brow |
| 71 | 70 | message: Tagging build1 for 128.4.0esr-based alpha
|
| 72 | 71 | ```
|
| 73 | 72 | |
| 74 | - - ##### `tor-browser-115.17.0esr-13.5-1-build2`
|
|
| 75 | - After checking out `tor-browser-115.17.0esr-13.5-1` branch in linked tor-browser.git
|
|
| 76 | - ```bash
|
|
| 77 | - ./sign-tag.torbrowser legacy build2 8e9e58fe400291f20be5712d057ad0b5fc4d70c1
|
|
| 78 | - ```
|
|
| 79 | - **output**:
|
|
| 80 | - ```
|
|
| 81 | - Tag commit 8e9e58fe4002 in tor-browser-115.17.0esr-13.5-1
|
|
| 82 | - tag: tor-browser-115.17.0esr-13.5-1-build2
|
|
| 83 | - message: Tagging build2 for 115.17.0esr-based legacy
|
|
| 84 | - ```
|
|
| 85 | - |
|
| 86 | 73 | - ##### `mullvad-browser-128.4.0esr-14.0-1-build2`
|
| 87 | 74 | After checking out `mullvad-browser-128.4.0esr-14.0-1` branch in linked mullvad-browser.git
|
| 88 | 75 | ```bash
|
| ... | ... | @@ -80,11 +80,10 @@ commit=$(git rev-parse --short ${3:-HEAD}) |
| 80 | 80 | # channel validation
|
| 81 | 81 | if [[ "${project}" == "mullvad-browser" ]]; then
|
| 82 | 82 | repo="$project"
|
| 83 | - valid_channels=("rapid" "alpha" "stable")
|
|
| 84 | 83 | else
|
| 85 | 84 | repo="tor-browser"
|
| 86 | - valid_channels=("rapid" "alpha" "stable" "legacy")
|
|
| 87 | 85 | fi
|
| 86 | +valid_channels=("alpha" "stable")
|
|
| 88 | 87 | channel_valid=false
|
| 89 | 88 | for value in "${valid_channels[@]}"; do
|
| 90 | 89 | if [[ "${channel}" == "${value}" ]]; then
|
| 1 | -<?xml version="1.0" encoding="UTF-8"?>
|
|
| 2 | -<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
|
| 3 | -<!--
|
|
| 4 | - Entitlements to apply during codesigning of production builds.
|
|
| 5 | --->
|
|
| 6 | -<plist version="1.0">
|
|
| 7 | - <dict>
|
|
| 8 | - <!-- Firefox needs to create executable pages (without MAP_JIT) -->
|
|
| 9 | - <key>com.apple.security.cs.allow-unsigned-executable-memory</key><true/>
|
|
| 10 | - |
|
| 11 | - <!-- Allow loading third party libraries. Needed for Flash and CDMs -->
|
|
| 12 | - <key>com.apple.security.cs.disable-library-validation</key><true/>
|
|
| 13 | - |
|
| 14 | - <!-- Firefox needs to access the microphone on sites the user allows -->
|
|
| 15 | - <key>com.apple.security.device.audio-input</key><true/>
|
|
| 16 | - |
|
| 17 | - <!-- Firefox needs to access the camera on sites the user allows -->
|
|
| 18 | - <key>com.apple.security.device.camera</key><true/>
|
|
| 19 | - |
|
| 20 | - <!-- Firefox needs to access the location on sites the user allows -->
|
|
| 21 | - <key>com.apple.security.personal-information.location</key><true/>
|
|
| 22 | - |
|
| 23 | - <!-- For SmartCardServices(7) -->
|
|
| 24 | - <key>com.apple.security.smartcard</key><true/>
|
|
| 25 | - </dict>
|
|
| 26 | -</plist> |
| ... | ... | @@ -19,21 +19,10 @@ if [[ $1 = "-p" ]]; then |
| 19 | 19 | shift
|
| 20 | 20 | fi
|
| 21 | 21 | |
| 22 | -function is_legacy {
|
|
| 23 | - [[ "$tbb_version" = 13.* ]]
|
|
| 24 | -}
|
|
| 25 | - |
|
| 26 | -if is_legacy; then
|
|
| 27 | - platform_android=
|
|
| 28 | - platform_desktop=1
|
|
| 29 | - platform_macos=1
|
|
| 30 | - platform_windows=1
|
|
| 31 | -else
|
|
| 32 | - platform_android=$(rbm_showconf_boolean var/browser_platforms/signing_android)
|
|
| 33 | - platform_desktop=$(rbm_showconf_boolean var/browser_platforms/signing_desktop)
|
|
| 34 | - platform_macos=$(rbm_showconf_boolean var/browser_platforms/macos)
|
|
| 35 | - platform_windows=$(rbm_showconf_boolean var/browser_platforms/signing_windows)
|
|
| 36 | -fi
|
|
| 22 | +platform_android=$(rbm_showconf_boolean var/browser_platforms/signing_android)
|
|
| 23 | +platform_desktop=$(rbm_showconf_boolean var/browser_platforms/signing_desktop)
|
|
| 24 | +platform_macos=$(rbm_showconf_boolean var/browser_platforms/macos)
|
|
| 25 | +platform_windows=$(rbm_showconf_boolean var/browser_platforms/signing_windows)
|
|
| 37 | 26 | |
| 38 | 27 | is_project torbrowser && nssdb=torbrowser-nssdb7
|
| 39 | 28 | is_project mullvadbrowser && nssdb=mullvadbrowser-nssdb1
|
| ... | ... | @@ -293,6 +282,6 @@ do_step download-unsigned-sha256sums-gpg-signatures-from-people-tpo |
| 293 | 282 | do_step sync-local-to-staticiforme
|
| 294 | 283 | do_step sync-scripts-to-staticiforme
|
| 295 | 284 | do_step staticiforme-prepare-cdn-dist-upload
|
| 296 | -[ "$SIGNING_PROJECTNAME" != 'torvpn' ] && ! is_legacy && \
|
|
| 285 | +[ "$SIGNING_PROJECTNAME" != 'torvpn' ] && \
|
|
| 297 | 286 | do_step upload-update_responses-to-staticiforme
|
| 298 | 287 | do_step finished-signing-clean-linux-signer |
| ... | ... | @@ -41,6 +41,12 @@ function authorized_keys { |
| 41 | 41 | chmod 600 "$authkeysfile"
|
| 42 | 42 | }
|
| 43 | 43 | |
| 44 | +function remove_sudoers_file {
|
|
| 45 | + # Remove a sudoers file that previously existed but is no longer used
|
|
| 46 | + sfile="$1"
|
|
| 47 | + rm -f "/etc/sudoers.d/$sfile"
|
|
| 48 | +}
|
|
| 49 | + |
|
| 44 | 50 | function sudoers_file {
|
| 45 | 51 | sfile="$1"
|
| 46 | 52 | cp "$script_dir/sudoers.d/$sfile" "/etc/sudoers.d/$sfile"
|
| ... | ... | @@ -91,7 +97,8 @@ sudoers_file sign-mar |
| 91 | 97 | sudoers_file sign-exe
|
| 92 | 98 | sudoers_file sign-apk
|
| 93 | 99 | sudoers_file sign-aab
|
| 94 | -sudoers_file sign-rcodesign
|
|
| 100 | +# sign-rcodesign is removed - tor-browser-build#41476
|
|
| 101 | +remove_sudoers_file sign-rcodesign
|
|
| 95 | 102 | sudoers_file sign-rcodesign-128
|
| 96 | 103 | sudoers_file sign-rcodesign-146
|
| 97 | 104 | sudoers_file set-date
|
| 1 | -Defaults>signing-macos env_keep += "SIGNING_PROJECTNAME tbb_version_type RCODESIGN_PW"
|
|
| 2 | -%signing ALL = (signing-macos) NOPASSWD: /signing/tor-browser-build/tools/signing/wrappers/sign-rcodesign |
| 1 | -<?xml version="1.0" encoding="UTF-8"?>
|
|
| 2 | -<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
|
| 3 | -<!--
|
|
| 4 | - Entitlements to apply during codesigning of production builds.
|
|
| 5 | --->
|
|
| 6 | -<plist version="1.0">
|
|
| 7 | - <dict>
|
|
| 8 | - <!-- Firefox needs to create executable pages (without MAP_JIT) -->
|
|
| 9 | - <key>com.apple.security.cs.allow-unsigned-executable-memory</key><true/>
|
|
| 10 | - |
|
| 11 | - <!-- Allow loading third party libraries. Needed for Flash and CDMs -->
|
|
| 12 | - <key>com.apple.security.cs.disable-library-validation</key><true/>
|
|
| 13 | - |
|
| 14 | - <!-- Firefox needs to access the microphone on sites the user allows -->
|
|
| 15 | - <key>com.apple.security.device.audio-input</key><true/>
|
|
| 16 | - |
|
| 17 | - <!-- Firefox needs to access the camera on sites the user allows -->
|
|
| 18 | - <key>com.apple.security.device.camera</key><true/>
|
|
| 19 | - |
|
| 20 | - <!-- Firefox needs to access the location on sites the user allows -->
|
|
| 21 | - <key>com.apple.security.personal-information.location</key><true/>
|
|
| 22 | - |
|
| 23 | - <!-- For SmartCardServices(7) -->
|
|
| 24 | - <key>com.apple.security.smartcard</key><true/>
|
|
| 25 | - </dict>
|
|
| 26 | -</plist> |
| 1 | -#!/bin/bash
|
|
| 2 | -set -e
|
|
| 3 | - |
|
| 4 | -function exit_error {
|
|
| 5 | - for msg in "$@"
|
|
| 6 | - do
|
|
| 7 | - echo "$msg" >&2
|
|
| 8 | - done
|
|
| 9 | - exit 1
|
|
| 10 | -}
|
|
| 11 | - |
|
| 12 | -test $# -eq 2 || exit_error "Wrong number of arguments"
|
|
| 13 | -dmg_file="$1"
|
|
| 14 | -display_name="$2"
|
|
| 15 | - |
|
| 16 | -output_file="/home/signing-macos/last-signed-$display_name.tar.zst"
|
|
| 17 | -rm -f "$output_file"
|
|
| 18 | - |
|
| 19 | -rcodesign_signing_p12_file=/home/signing-macos/keys/key-1.p12
|
|
| 20 | -test -f "$rcodesign_signing_p12_file" || exit_error "$rcodesign_signing_p12_file is missing"
|
|
| 21 | - |
|
| 22 | -tmpdir=$(mktemp -d)
|
|
| 23 | -trap "rm -Rf $tmpdir" EXIT
|
|
| 24 | -cd "$tmpdir"
|
|
| 25 | -7z x "$dmg_file"
|
|
| 26 | - |
|
| 27 | -# Fix permission on files:
|
|
| 28 | -# https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/29815#note_2957050
|
|
| 29 | -# FIXME: Maybe we should extract the .mar file instead of the .dmg to
|
|
| 30 | -# preserve permissions
|
|
| 31 | -chmod ugo+x "$display_name/$display_name.app/Contents/MacOS"/* \
|
|
| 32 | - "$display_name/$display_name.app/Contents/MacOS/updater.app/Contents/MacOS"/* \
|
|
| 33 | - "$display_name/$display_name.app/Contents/MacOS/plugin-container.app/Contents/MacOS"/*
|
|
| 34 | -test -d "$display_name/$display_name.app/Contents/MacOS/Tor" && \
|
|
| 35 | - chmod -R ugo+x "$display_name/$display_name.app/Contents/MacOS/Tor"
|
|
| 36 | - |
|
| 37 | -pwdir=/run/lock/rcodesign-pw
|
|
| 38 | -trap "rm -Rf $pwdir" EXIT
|
|
| 39 | -rm -Rf "$pwdir"
|
|
| 40 | -mkdir "$pwdir"
|
|
| 41 | -chmod 700 "$pwdir"
|
|
| 42 | -cat > "$pwdir/rcodesign-pw-2" << EOF
|
|
| 43 | -$RCODESIGN_PW
|
|
| 44 | -EOF
|
|
| 45 | -tr -d '\n' < "$pwdir/rcodesign-pw-2" > "$pwdir/rcodesign-pw"
|
|
| 46 | -rm "$pwdir/rcodesign-pw-2"
|
|
| 47 | - |
|
| 48 | -rcodesign_opts="
|
|
| 49 | - --code-signature-flags runtime
|
|
| 50 | - --timestamp-url http://timestamp.apple.com:8080/ts01
|
|
| 51 | - --p12-file $rcodesign_signing_p12_file
|
|
| 52 | - --p12-password-file $pwdir/rcodesign-pw
|
|
| 53 | - "
|
|
| 54 | - |
|
| 55 | -# sign updater.app and plugin-container.app separately
|
|
| 56 | -echo '**** Signing updater.app ****'
|
|
| 57 | -/signing/rcodesign/rcodesign sign \
|
|
| 58 | - $rcodesign_opts \
|
|
| 59 | - --info-plist-path "$display_name/$display_name.app/Contents/MacOS/updater.app/Contents/Info.plist" \
|
|
| 60 | - -- \
|
|
| 61 | - "$display_name/$display_name.app/Contents/MacOS/updater.app"
|
|
| 62 | -echo '**** Signing plugin-container.app ****'
|
|
| 63 | -/signing/rcodesign/rcodesign sign \
|
|
| 64 | - $rcodesign_opts \
|
|
| 65 | - --entitlements-xml-path /signing/tor-browser-build/tools/signing/${tbb_version_type}.entitlements.xml \
|
|
| 66 | - -- \
|
|
| 67 | - "$display_name/$display_name.app/Contents/MacOS/plugin-container.app"
|
|
| 68 | - |
|
| 69 | -# Setting binary-identifier on some files, to avoid signature errors. See:
|
|
| 70 | -# https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/29815#note_2956149
|
|
| 71 | -pushd "$display_name/$display_name.app/Contents/MacOS/"
|
|
| 72 | -for lib in *.dylib
|
|
| 73 | -do
|
|
| 74 | - binident=$(echo $lib | sed 's/\.dylib$//')
|
|
| 75 | - binident="--binary-identifier Contents/MacOS/$lib:$binident"
|
|
| 76 | - echo "Adding option $binident"
|
|
| 77 | - rcodesign_opts="$rcodesign_opts $binident"
|
|
| 78 | -done
|
|
| 79 | -popd
|
|
| 80 | - |
|
| 81 | -if test -d "$display_name/$display_name.app/Contents/MacOS/Tor/PluggableTransports/"
|
|
| 82 | -then
|
|
| 83 | - pushd "$display_name/$display_name.app/Contents/MacOS/Tor/PluggableTransports/"
|
|
| 84 | - for file in echo *
|
|
| 85 | - do
|
|
| 86 | - binident="--binary-identifier Contents/MacOS/Tor/PluggableTransports/$file:$file"
|
|
| 87 | - echo "Adding option $binident"
|
|
| 88 | - rcodesign_opts="$rcodesign_opts $binident"
|
|
| 89 | - done
|
|
| 90 | - popd
|
|
| 91 | -fi
|
|
| 92 | - |
|
| 93 | -echo "**** Signing main bundle ($display_name.app) ****"
|
|
| 94 | -# We use `--exclude '**'` to avoid re-signing nested bundles
|
|
| 95 | -/signing/rcodesign/rcodesign sign \
|
|
| 96 | - $rcodesign_opts \
|
|
| 97 | - --entitlements-xml-path /signing/tor-browser-build/tools/signing/${tbb_version_type}.entitlements.xml \
|
|
| 98 | - --exclude '**' \
|
|
| 99 | - -- \
|
|
| 100 | - "$display_name/$display_name.app"
|
|
| 101 | - |
|
| 102 | -rm -f "$pwdir/rcodesign-pw"
|
|
| 103 | -rmdir "$pwdir"
|
|
| 104 | -tar -C "$display_name" -caf "$output_file" "$display_name.app"
|
|
| 105 | -cd -
|
|
| 106 | -rm -Rf "$tmpdir" |
| ... | ... | @@ -87,33 +87,6 @@ sub get_sha512_hex_of_file { |
| 87 | 87 | return $sha->hexdigest;
|
| 88 | 88 | }
|
| 89 | 89 | |
| 90 | -# With release 15.0 _ALL is being removed from mar file names.
|
|
| 91 | -# However we need to be able to generate incrementals from versions
|
|
| 92 | -# using the old filenames. As a workaround, if the old filename is
|
|
| 93 | -# found we create a symlink to the new file name.
|
|
| 94 | -# The symlinks are used in `create_incremental_mar` and `get_buildinfos`,
|
|
| 95 | -# where supporting both file names would complexify things. The symlinks
|
|
| 96 | -# are ignored in `get_version_files` where the regexp used support both
|
|
| 97 | -# old and new filenames.
|
|
| 98 | -# We can remove this once we don't need to generate incrementals from
|
|
| 99 | -# versions with the old file names.
|
|
| 100 | -sub symlink_ALL {
|
|
| 101 | - my ($config, $version) = @_;
|
|
| 102 | - my $vdir = version_dir($config, $version);
|
|
| 103 | - opendir(my $d, $vdir) or exit_error "Error opening directory $vdir";
|
|
| 104 | - foreach my $file (readdir $d) {
|
|
| 105 | - next unless -f "$vdir/$file";
|
|
| 106 | - if ($file =~ m/^(.+)_ALL\.mar$/) {
|
|
| 107 | - next if -f "$vdir/$1.mar";
|
|
| 108 | - symlink $file, "$vdir/$1.mar";
|
|
| 109 | - }
|
|
| 110 | - if ($file =~ m/^(.+)_ALL\.incremental\.mar$/) {
|
|
| 111 | - next if -f "$vdir/$1.incremental.mar";
|
|
| 112 | - symlink $file, "$vdir/$1.incremental.mar";
|
|
| 113 | - }
|
|
| 114 | - }
|
|
| 115 | -}
|
|
| 116 | - |
|
| 117 | 90 | sub get_version_files {
|
| 118 | 91 | my ($config, $version) = @_;
|
| 119 | 92 | return if $config->{versions}{$version}{files};
|
| ... | ... | @@ -124,13 +97,8 @@ sub get_version_files { |
| 124 | 97 | opendir(my $d, $vdir) or exit_error "Error opening directory $vdir";
|
| 125 | 98 | foreach my $file (readdir $d) {
|
| 126 | 99 | next unless -f "$vdir/$file";
|
| 127 | - # Ignore the symlinks created by `symlink_ALL` to avoid adding the files
|
|
| 128 | - # twice.
|
|
| 129 | - # We can remove this line once we don't need to support the legacy channel with
|
|
| 130 | - # with the old file names.
|
|
| 131 | - next if -l "$vdir/$file";
|
|
| 132 | 100 | if ($file !~ m/incremental\.mar$/ &&
|
| 133 | - $file =~ m/^$appname-(.+)-${version}(_ALL)?\.mar$/) {
|
|
| 101 | + $file =~ m/^$appname-(.+)-${version}\.mar$/) {
|
|
| 134 | 102 | my $os = $1;
|
| 135 | 103 | $files->{$os}{complete} = {
|
| 136 | 104 | type => 'complete',
|
| ... | ... | @@ -143,7 +111,7 @@ sub get_version_files { |
| 143 | 111 | };
|
| 144 | 112 | next;
|
| 145 | 113 | }
|
| 146 | - if ($file =~ m/^$appname-(.+)--(.+)-${version}(_ALL)?\.incremental\.mar$/) {
|
|
| 114 | + if ($file =~ m/^$appname-(.+)--(.+)-${version}\.incremental\.mar$/) {
|
|
| 147 | 115 | my ($os, $from_version) = ($1, $2);
|
| 148 | 116 | $files->{$os}{partial}{$from_version} = {
|
| 149 | 117 | type => 'partial',
|
| ... | ... | @@ -320,7 +288,6 @@ sub create_incremental_mars_for_version { |
| 320 | 288 | my $v = $config->{versions}{$version};
|
| 321 | 289 | foreach my $from_version (@{$v->{incremental_from}}) {
|
| 322 | 290 | $config->{versions}{$from_version} //= {};
|
| 323 | - symlink_ALL($config, $from_version);
|
|
| 324 | 291 | get_version_files($config, $from_version);
|
| 325 | 292 | my $from_v = $config->{versions}{$from_version};
|
| 326 | 293 | foreach my $os (keys %{$v->{files}}) {
|
| ... | ... | @@ -430,7 +397,6 @@ sub write_responses { |
| 430 | 397 | my (%oses, %from_versions);
|
| 431 | 398 | foreach my $version (@$versions) {
|
| 432 | 399 | get_version_files($config, $version);
|
| 433 | - symlink_ALL($config, $version);
|
|
| 434 | 400 | get_buildinfos($config, $version);
|
| 435 | 401 | my $files = $config->{versions}{$version}{files};
|
| 436 | 402 | foreach my $os (keys %$files) {
|