This reverts commit a11a8b30.

We do the right thing and get the patch via the tor-brower repo. No need
to use this workaround anymore which was there for our emergency
release.

This reverts commit 332c5b6c.

Part three of selfrando removal for maint-7.0

We don't ship the clearkey DRM system yet, thus we don't need to strip
the respective binaries.

boklm authored 7 years ago and Georg Koppen committed 7 years ago

ESR52 includes this commit:
https://hg.mozilla.org/mozilla-central/rev/f8cf0fe7c810
which changes the compiler used from 'c++' to 'g++'.

Selfrando is a new defense against code reuse attacks developed by the
Redactor and Readactor++ people. We should give it a wider testing
audience by including it in the alpha series.

This is currently only available for 64bit Linux builds, though.
Supporting other platforms and architectures is work in progress.

Kathleen Brade authored 7 years ago and Georg Koppen committed 7 years ago

The Linux sigmar program needs libfreeblpriv3.so and libsoftokn3.so,
so include them in the mar-tools archive.

This reverts commit 0ea68f84.

Selfrando does not cope with ESR52 yet it seems, back this out.

Selfrando is a new defense against code reuse attacks developed by the
Redactor and Readactor++ people. We should give it a wider testing
audience by including it in the alpha series.

This is currently only available for 64bit Linux builds, though.
Supporting other platforms and architectures is work in progress.

Kathleen Brade authored 8 years ago and Georg Koppen committed 7 years ago

Use org.torproject as the MOZ_DISTRIBUTION_ID.
This results in a bundle ID of org.torproject.torbrowser.

Additionally, we make get-moz-build-date fail with an error if it was not
possible to get the year from git.

The MOZ_BUILD_DATE environment variable is used as the build id.

boklm authored 8 years ago and Georg Koppen committed 8 years ago

Completely stop using libfaketime for Linux builds. For Windows builds
we have to keep using it for the tor, pluggable-transports and bundle
steps. For OSX builds, we keep it in the bundle steps for the timestamp
added when creating the dmg file with genisoimage.

Mozilla got rid of exposing the hostname of the machine that built
Firefox in https://bugzilla.mozilla.org/show_bug.cgi?id=1168316. We
therefore don't need to set it anymore to avoid reproducibility issues.

After switching to Debian Wheezy, we don't need to build Python since
the version provided by the distribution is recent enough.

Georg Koppen authored 9 years ago and boklm committed 9 years ago

Besides using Wheezy for building Linux bundles this patch cleans up our
usage of libfaketime as well to make it obvious where exactly we still
need it.

In addition to fixing broken paths and stripping Linux binaries we
exempt |python 2.7| from libfaketime due to #13877, too.

It turned out that setting the timestamp to 2000-01-01 00:00:00 is
breaking with Firefox 38 ESR as we have files with whitespaces there
for the first time.

The conversion was done with the following Perl snippet:

perl -p -i -e 's/find -type f \| xargs/find -type f -print0 \| xargs -0/g' \
  `find ./ -name *.yml`

Use dzip.sh to create the mar-tools-*.zip files.

In the Linux mar-tools package, include certutil, signmar, and the required
  NSS and NSPR libraries.
Change update_responses to select the action to be done based on the
  program name, thereby separating the incremental MAR file generation (done
  via a new 'gen_incrementals' symlink) from the htdocs generation.  Also added
  an 'update_responses' make target.  Thanks to boklm for help with this.
Add a series of 'signmar' make targets which run a new signmars.sh script,
which does the following:
  1. Prompts for an NSS password (the script assumes that an nssdb directory
     exists that contains the signing key/cert).
  2. Moves original (unsigned) MAR files to a TORBROWSER_VERSION-unsigned/
     directory.
  3. Signs each of the MAR files, placing the signed files in the
     TORBROWSER_VERSION/ directory.
  You may set NSS_DB_DIR and/or NSS_CERTNAME before running signmars.sh; the
  defaults are ./nssdb and marsigner

Amending the LD_LIBRARY_PATH in our start script breaks the update from
a Tor Browser with the older value to a Tor Browser requiring the new
one. We therefore move the libstdc++ to the directory with the libraries
tor depends upon and LD_LIBRARY_PATH used to point to and change the
LD_LIBRARY_PATH value back to the old one.

libfaketime 0.8 breaks the ESR 31 build (see #12461 comment 8 and later
and #12812 comment 8 for the gory details). We therefore use a newer
version that provides us with an environment variable to skip certain
processes when faking time.

Tor Browser based on Firefox ESR 31 needs a newer compiler. GCC 4.4 is
not supported anymore. We chose the latest GCC (4.9.1) as we don't want
to bump the version again when we start deploying hardened builds.

Thanks to a patch by a cypherpunk we have now full RELRO protection when
using gold as our linker.

We removed the build-id from browser binaries in bug 11042 as it turned
out that despite the contents being exactly the same the build-id was
not occasionally. But doing that with bjcopy destroyed RELRO protections
as well. Having the build-id non-deterministic seems to be an ld issue
as switching to gold solves this.

Create and deliver complete MAR files for each platform/locale combination..
Deliver a set of MAR file creation tools for Linux (32 and 64-bit).  Just in
  case someone wants to skip the Linux build, we build these tools (which are
  host tools) during the Windows and Mac builds as well.
Use the new --with-tor-browser-version configure option to pass the
  Tor Browser version to the Firefox build process.
Pass the correct update channel to the Firefox build process via the
  --enable-update-channel configure option.

We build the tools needed for the Linux descriptors separately and
preserve them. This does not (yet) include the tools in the Pluggable
Transports descriptor which will happen in an other commit.

Additonally, we enhance our clean targets in the Makefile containing not
only a target for the newly created utils component now but for the
other components as well.

We used to set the bundle version in the browser descriptor which had
the bad side-effect that we needed to rebuild the whole Tor Browser just
in order to change the bundle version. We do that now in the bundle
descriptor instead.