Verified Commit 9f004ec7 authored by Kathleen Brade's avatar Kathleen Brade Committed by Richard Pospesel
Browse files

Bug 13379: Sign our MAR files. 

Configure with --enable-verify-mar (when updating, require a valid
  signature on the MAR file before it is applied).
Use the Tor Browser version instead of the Firefox version inside the
  MAR file info block (necessary to prevent downgrade attacks).
Use NSS on all platforms for checking MAR signatures (instead of using
  OS-native APIs, which Mozilla does on Mac OS and Windows). So that the
  NSS and NSPR libraries the updater depends on can be found at runtime,
  we add the firefox directory to the shared library search path on macOS.
  On Linux, rpath is used by Mozilla to solve that problem, but that
  approach won't work on macOS because the updater executable is copied
  during the update process to a location that is under TorBrowser-Data,
  and the location of TorBrowser-Data varies.

Also includes the fix for bug 18900.

Bug 19121: reinstate the update.xml hash check

Revert most changes from Mozilla Bug 1373267 "Remove hashFunction and
hashValue attributes from nsIUpdatePatch and code related to these
attributes." Changes to the tests were not reverted; the tests have
been changed significantly and we do not run automated updater tests
for Tor Browser at this time.

Also partial revert of commit f1241db6.

Revert the nsUpdateService.js changes from Mozilla Bug 862173 "don't
verify mar file hash when using mar signing to verify the mar file
(lessens main thread I/O)."

Changes to the tests were not reverted; the tests have been changed
significantly and we do not run automated updater tests for
Tor Browser at this time.

We kept the addition to the AppConstants API in case other JS code
references it in the future.
parent a931af71

.mozconfig

+1 −0
Original line number Diff line number Diff line
@@ -37,3 +37,4 @@ ac_add_options MOZ_TELEMETRY_REPORTING= 
ac_add_options --enable-tor-launcher

ac_add_options --with-tor-browser-version=dev-build

ac_add_options --disable-tor-browser-update

ac_add_options --enable-verify-mar

.mozconfig-asan

+1 −0
Original line number Diff line number Diff line
@@ -30,6 +30,7 @@ ac_add_options --enable-official-branding 
ac_add_options --enable-default-toolkit=cairo-gtk3



ac_add_options --enable-tor-browser-update

ac_add_options --enable-verify-mar



ac_add_options --disable-strip

ac_add_options --disable-install-strip

.mozconfig-mac

+1 −0
Original line number Diff line number Diff line
@@ -43,6 +43,7 @@ ac_add_options --disable-debug 


ac_add_options --enable-tor-browser-data-outside-app-dir

ac_add_options --enable-tor-browser-update

ac_add_options --enable-verify-mar



ac_add_options --disable-crashreporter

ac_add_options --disable-webrtc

.mozconfig-mingw

+1 −0
Original line number Diff line number Diff line
@@ -15,6 +15,7 @@ ac_add_options --enable-strip 
ac_add_options --enable-official-branding



ac_add_options --enable-tor-browser-update

ac_add_options --enable-verify-mar

ac_add_options --disable-bits-download



# Let's make sure no preference is enabling either Adobe's or Google's CDM.

modules/libmar/tool/mar.c

+3 −3
Original line number Diff line number Diff line
@@ -65,7 +65,7 @@ static void print_usage() { 
      "signed_input_archive.mar base_64_encoded_signature_file "

      "changed_signed_output.mar\n");

  printf("(i) is the index of the certificate to extract\n");

#  if defined(XP_MACOSX) || (defined(XP_WIN) && !defined(MAR_NSS))

#  if (defined(XP_MACOSX) || defined(XP_WIN)) && !defined(MAR_NSS)

  printf("Verify a MAR file:\n");

  printf("  mar [-C workingDir] -D DERFilePath -v signed_archive.mar\n");

  printf(
@@ -149,7 +149,7 @@ int main(int argc, char** argv) { 
  memset((void*)certBuffers, 0, sizeof(certBuffers));

#endif

#if !defined(NO_SIGN_VERIFY) && \

    ((!defined(MAR_NSS) && defined(XP_WIN)) || defined(XP_MACOSX))

    (!defined(MAR_NSS) && (defined(XP_WIN) || defined(XP_MACOSX)))

  memset(DERFilePaths, 0, sizeof(DERFilePaths));

  memset(fileSizes, 0, sizeof(fileSizes));

#endif
@@ -181,7 +181,7 @@ int main(int argc, char** argv) { 
      argc -= 2;

    }

#if !defined(NO_SIGN_VERIFY)

#  if (!defined(MAR_NSS) && defined(XP_WIN)) || defined(XP_MACOSX)

#  if (!defined(MAR_NSS) && (defined(XP_WIN) || defined(XP_MACOSX)))

    /* -D DERFilePath, also matches -D[index] DERFilePath

       We allow an index for verifying to be symmetric

       with the import and export command line arguments. */