Opened 5 months ago

Last modified 2 months ago

#33533 needs_review task

Rebase Tor Browser esr68 patches on top of mozilla-central

Reported by: acat Owned by: acat
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: TorBrowserTeam202006R
Cc: tbb-team Actual Points: 14
Parent ID: #33661 Points:
Reviewer: sysrqb, gk Sponsor: Sponsor58-must

Description


Child Tickets

TicketStatusOwnerSummaryComponent
#33577newtbb-teamPicture-in-Picture not working with dom.w3c_pointer_events.enabled=falseApplications/Tor Browser
#33697newtbb-teamInvestigate new Search Engine configurationApplications/Tor Browser
#33734newtbb-teamConsider setting MOZ_NORMANDY=FalseApplications/Tor Browser
#33737newtbb-teamFix aboutDialog.js error for Firefox nightliesApplications/Tor Browser
#33738newtbb-teamCircuit display broken in onboarding for #33533Applications/Tor Browser
#33856closedmcsSet browser.privatebrowsing.forceMediaMemoryCache=trueApplications/Tor Browser
#33862merge_readytbb-teamFix usages of createTransport APIApplications/Tor Browser
#33890merge_readytbb-teamRename .xul to .xhtmlApplications/Tor Browser
#33892merge_readytbb-teamAdd brandProductName to torbutton brand localization filesApplications/Tor Browser
#34145closedtbb-teamInvestigate fallout from transitioning to 77.0b1Applications/Tor Browser
#34209merge_readymcsabout:tor and about:tbupdate fail to load in debug build of Tor BrowserApplications/Tor Browser

Attachments (1)

4234-fixes.txt (2.0 KB) - added by mcs 4 months ago.

Download all attachments as: .zip

Change History (38)

comment:1 Changed 5 months ago by acat

Keywords: TorBrowserTeam202003R added; TorBrowserTeam202003 removed
Status: assignedneeds_review

Rebased patches for review in https://github.com/acatarineu/tor-browser/commits/33533.

Some changes to torbutton and tor-launcher were needed: https://github.com/acatarineu/torbutton/commit/33533 and https://github.com/acatarineu/tor-launcher/commit/33533

I used commits 7d21cd26ee65..6046d1d58280 from tor-browser-68.5.0esr-9.5-1.

Similarly to #30429, I put the commits/patches in different categories. For some of them I added comments, which I hope will make reviewing slightly easier.

Regarding mobile patches, most of them have empty intersection with the files that are currently in central (all of [mobile-gone], unless I missed any). I only picked the mobile patches in [mobile-picked], most of them just partially as some of the files are not in central anymore. I guess the parts that could not be applied will have to be ported to Fenix.

[mobile-gone]

c2da27fca068 Revert "Bug 1603270 - Add telemetry for FirefoxPromoBannerRow user actions. r=..
eb88d8eea02d Bug #32405: Crash immediately after bootstrap on Android                        
517624ea7f34 Bug 26529 - Prompt before opening external app                                  
9dab64fe2f20 Bug 31144 - Do not switching apps from CustomTabs without consent               
c2cc5044c4ff Bug 31720: Enable website suggestions in address bar                            
e661977d1bb5 Bug 1568521 Tracking protection doorhanger's Enable/Disable states don't work ..
a1d645909b33 Load torbutton in BrowserApp.startup on Android                                 
3e871c620796 Bug 30573 - Sanitize old tabs and wait for tor before opening new tabs          
83137febd5bb Bug 31058: Remove Linus' default bridges                                        
136bd95b705e Bug 24920 - Only create Private tabs if browser.privatebrowsing.autostart is t..
75e9943e8ec9 Continue using non-adaptive icons and don't allow clear-text traffic
a8bcc8eb823e Bug 29238 - Prevent crash on Android after update                               
5a270452946c Bug 26690: Port padlock states for .onion services to mobile                    
  [Part of this is probably in mobile/android/modules/geckoview/GeckoViewProgress.jsm, but I
  guess this would be more like porting rather than cherry-picking patch.]
d479cc5c77e9 Bug 28329 - Part 4. Add new Tor Bootstrapping and configuration screens         
7b18ef3cccbd Bug 28329 - Part 1. Add new Tor resources                                       
2cd5f4f5b512 Bug 25696 - Implement alpha onboarding for Tor Browser for Android              
888a81d2198d Bug 27016 - Create proxy connection during image download                       
16345563997f Orfox: hook up default panic trigger to "quit and clear"                        
a4f9c85167c1 Orfox: quit button added                                                        
5e0596ff3e30 Orfox: disable screenshots and prevent page from being in "recent apps"         
37c77b37cdeb Bug 25741 - TBA: Adjust the User Agent String so it doesn't leak Android version
0e9127b09627 Bug 25741 - TBA: top sites changed, used bookmarks icon temporarily.            
06e93e8c45c7 Bug 25741 - TBA: Always Quit, do not restore the last session                   
1f103a7c4166 Bug 25741 - TBA: Disable all data reporting by default                          
b1349fb511c2 Bug 25741 - TBA: Clear state when the app exits, by default                     
9a6409fa58fb Bug 25741 - TBA: Do not import bookmarks and history from native browser by de..
8b7ae6bcbd5c Bug 25741 - TBA: Do not save browsing history by default                        
81e402b80cc3 Bug 25741 - TBA: Disable QR Code reader by default                              
0f40171a057b Bug 25741 - TBA: Disable the microphone by default                              
268f04897c90 Bug 25741 - TBA: Disable telemetry and experiments                              
3729f4263efe Bug 25741 - TBA: Remove sync option from preferences                            
dda2781bf72e Bug 25741 - TBA: Do not register Stumbler listener at start up                  
4c70c3e1546b Bug 25741 - TBA: Exclude unwanted Stumbler tests                                
66d133b41794 Bug 28640 - Try showing the homepage after the Distribution loads               
94b9527157ed Bug 28640 - Reload distribution preferences on update                           
03b1e4c88e3a Revert "Bug 1570878 - Add sign-in buttons to onboarding. r=petru a=RyanVM"      
c895b8c77c0d Revert "Bug 1576170 - Onboarding Sign up strings. r=flod a=RyanVM"              
d6165a9a6b36 Revert "Bug 1585132 - Fix lint failures from sign up button patches. r=petru, ..
54ab76fb79f6 Revert "Bug 1570880 - Added Sign in buttons in Awesomescreen. r=petru a=RyanVM" 
970ebbc553ab Revert "Bug 1570878 - Update fenenc onboarding content. r=petru a=RyanVM"       
feed391bf77a Revert "Bug 1586205 - Change LP variables to fallback to same nonLP defaults. ..
104889f3a5ec Revert "Bug 1587631 - Add FxA entrypoint option for panel configurations. r=pe..
5c35e3f85a0f Revert "Bug 1603275 - Add a new FirefoxPromoBannerRow for the awesomescreen. r..
7d21cd26ee65 Revert "Bug 1603275 - Restore "Sign up" button shadow. r=VladBaicu, a=RyanVM" 

[mobile-picked]

10a1b7e2d423 Bug 29859: Disable HLS support for now
  [No AppConstants.java anymore...]
557a2fbaf951 Bug 28051 - Integrate Orbot and add dependencies
  [Just a couple of .gradle files are still in central, but not sure about these ones.]
1ecbcdacfdb4 Bug 28125 - Prevent non-Necko network connections
  [Only a couple of GeckoView files.]
cec9e336fe0c Bug 25906 - Imply false both Adjust and Leanplum configure options              
f854bab17858 Bug 26528 - Don't allow Fennec to use UpdateService when installed through the..
24682e24dc49 Bug 25741 - TBA: Disable GeckoNetworkManager                                    
1c0188aa16ca Orfox: Centralized proxy applied to AbstractCommunicator and BaseResources.
  [decodeUrl in BitmapUtils.java does not have the "jar" case anymore, just url.openStream().
  Removed that, so it will always throw.]
5e5fe15af14b Bug 25741 - TBA: Conditionally require WIFI and NETWORK permissions             
  [Not sure if the moz.configure changes (adding MOZ_ANDROID_NETWORK_STATE, MOZ_ANDROID_LOCATION)
  make sense now.]
0d0e301d83fb Bug 25741 - TBA: Add mobile-override of 000-tor-browser prefs
  [Should we put the 000-* prefs in the MOZ_GECKOVIEW_JAR case? (package-manifest.in and moz.build).]
895808b237e4 Bug 25741 - TBA: Add an AppConstant for TOR_BROWSER_VERSION
  [Only took changes from mobile/android/geckoview/build.gradle.]
b3e67b27569a Bug 25741 - TBA: Add default configure options in dedicated file                
  [What about MOZ_NORMANDY? Should we also comment out the imply in moz.configure?]
c6fa170d86dd Bug 25741 - TBA: Disable features at compile-time   
6927a73ee2eb Bug 25741 - TBA: Add mozconfig for Android and pertinent branding files.
  [Dropped changes to mobile/android/base/java/org/mozilla/gecko/BrowserApp.java.]
  [Don't see where  mobile/android/base/moz.build changes apply, dropped these.]
  [Dropped changes to  mobile/android/base/strings.xml.in, it's gone.]
  [Only favicons are there, I dropped the rest of icons from this patch.]
  [generate_strings_xml.py is gone, dropped changes.]
376d3e8b3846 Bug 25741 - TBA: Move GCM Push prefs within preprocessor guard
  [Neither MOZ_ANDROID_GCM nor MOZ_ANDROID_GCM_SENDERID are used anymore, do we need this patch?]

[dropped-included in central]

19fa956d545b Revert "Bug 31764: Fix for error when navigating via 'Paste and go'"
  [Fixed in https://bugzilla.mozilla.org/show_bug.cgi?id=1590538.]
944a06831375 Bug 31573: Catch SessionStore.jsm exception
  [Fixed in https://bugzilla.mozilla.org/show_bug.cgi?id=1591259.]
991ca736be20 Bug 31764: Fix for error when navigating via 'Paste and go'
  [Fixed in https://bugzilla.mozilla.org/show_bug.cgi?id=1590538]
5aff5deef248 Bug 1330467 - part 12. FPI isolation of translation permissions; r=johannh      
a35270cfc712 Bug 1330467 - part 11. Use principal for permissions in webrtc UI; r=johannh    
237353e6979c Bug 1330467 - part 10. Use principal for permissions in browser site-identity;..
0e0410581635 Bug 1330467 - part 9. Use principal with mobile permissions; r=johannh,snorp    
09e3a7e741d2 Bug 1330467 - part 8. Make canvas permission respect FPI; r=johannh,jrmuizel    
3b7c44a13a4b Bug 1330467 - part 7. Confirm FPI in permission manager tests; r=Ehsan          
967603b18514 Bug 1330467 - part 6. Use principal for permissions in sitePermissions.js; r=j..
0295727507bd Bug 1330467 - part 5. Access permissions by principal in PermissionUI.jsm; r=j..
1cdc080d08f1 Bug 1330467 - part 3. Use principal for permissions in pageinfo/permissions.js..
17f811e34af6 Bug 1330467 - part 2. Add SitePermissions APIs functions to accept principal; ..
2ed45e021fe0 Bug 1330467 - part 1. Don't strip first party domain from permissions key; r=j..
767012d2dfae Bug 1474659 Add dedicated AllocKinds just for ArrayBufferObjects. r?sfink       
a2fc76be99de Bug 1561322 - Allow spoofing strings in HTML forms r=baku,Pike   
5705089f0a11 Bug 1560574 - use FormatPRExplodedTime to display GMT; r=kershaw                
8ff568d9f802 Bug 467035 - Avoid leaking browser language via DTD r=Gijs,bzbarsky             
0db2161d0c38 Bug 467035 - Add new internal DTD content types r=ckerschb  
84f9b4ce58f3 Bug 1557729 - Use principal for permission post prompts instead of URI. r=xeon..
b6701121f90c Bug 1573276 - Always allow localization in error pages r=johannh,peterv         
468cb520dc26 Bug 1585351 - Bug 1460357 disabled AVX instructions for the mingw build; this ..
be19b7d3bed7 Bug 1534339 - make OriginAttributes deserializable; r=baku                      
9003a3f749c3 Bug 1546832 - Adjust letterboxing to take the FindBar and Devtools into accoun..
33c51442838a Bug 1556017 - Fixing the off-by-one-pixel issue of find bar and devtool iframe..
4773175a1c43 Bug 1581537 - Avoid several browser language leaks r=smaug
de5a72279416 Bug 1598647 - Set Origin to null with network.http.referer.hideOnionSource r=J..
3f1c2b0337b6 Bug 1554805 - Never set firstPartyDomain on origin attributes for moz-extensio..
e6a7cccd8623 Bug 1467970 - Unsupport cross docGroup adoption r=smaug                         
058f7553389c Bug 1590526 - Temporarily allow node adoption across different docGroups for t..
a83411dfd84f Bug 1590538 - Don't pass an empty object to urlbar-user-start-navigation becau..
ac96b77c70e6 Bug 461204 - Improve the random number generator for the boundaries in multipa..
6c093eda44d7 Bug 29120: Enable media cache in memory 

[dropped-not needed]

d6fc4d6753fd Bug 31344: Actually register SecurityLevelPreference's 'unload' callback in pr..
  [Fixed in securitylevel first patch.]

[dropped-might not be needed]

586218fadcc7 Bug 10280: Don't load any plugins into the address space.                       
  [I think we might be able to drop it. By looking at the patch, it should
  allow enabling plugins in about:addons, but the UI hasn't been working for esr68
  (it must have broken with the esr68 switch, and I think no-one complained). We
  either fix it (so that plugins can actually be enabled), or drop it and maybe
  hide the plugin section in about:addons.]

[new commits]

Partially revert 1564367
  [This was needed for onboarding, should we squash it somewhere?]

[picked]

6046d1d58280 Bug 32493: Disable MOZ_SERVICES_HEALTHREPORT
0f42a8ed2229 Bug 32658: Create a new MAR signing key     
3ad7a3a33364 Bug 32414: Make Services.search.addEngine obey FPI                              
  ["Search:AddEngine" was moved from MainProcessSingleton.jsm to SidebarSearchParent.jsm.]
  [Mobile part (mobile/android/chrome/content/browser.js) is gone.]
82f4dd45e593 Bug 30237: Add v3 onion services client authentication prompt                   
  [Do not see where the changes in NetErrorChild.jsm would apply in central, I think these are not be needed anymore.]
  [Changed `MOZ_FALLTHROUGH -> [[fallthrough]]` (https://bugzilla.mozilla.org/show_bug.cgi?id=1570499).]
ab4f43918f97 Bug 32220: Improve the letterboxing experience
  [tabbrowser.xul is now tabbrowser-tab.js]
3715d8ddf34c Bug 27604: Fix addon issues when moving TB directory
e09af95781b0 Bug 31658: Changed the 'SECURITY LEVEL' text color to builtin --panel-disabled..
327318798382 Bug 32188: Change useLocalProxy string to tor-launcher's torsettings.useProxy...
65885be7714e Bug 31803: Replaced about:debugging logo with flat version                      
2f881b448b36 Bug 31740: Remove some unnecessary RemoteSettings instances                     
f9631627763d Bug 32111: Fixed issue parsing user-provided brige strings                      
0132b5cec95d Bug 31749: Fix security level panel spawning events                             
05bcf4f148da Bug 31920: Fix Security Level panel when its toolbar button moves to overflow   
3c0b609efd77 Bug 31748: Fixed 'Learn More' links in Security Level preferences and panel     
cbefb9395afe Bug 32092: Fix Tor Browser Support link in preferences                          
1227953dfd48 Bug 31286: Implementation of bridge, proxy, and firewall settings in about:pre..
  [xul -> xhtml]
  [textbox -> input]
  [oncommand, onblur moved to addEventListeners due to about:preferences CSP forbidding inline scripts.]
  [fixed menuitems not working -> using createXULElement instead of createElement and appendChild instead
  of append (not sure the latter is relevant though).]
97f167f471d7 Bug 13543: Spoof smooth and powerEfficient for Media Capabilities               
39930b60545c Bug 31607: App menu items stop working on macOS                                 
4425d121c479 Bug 31768: Introduce toolbar and network settings changes in onboarding         
d05bb9a36962 Bug 27511: Add new identity button to toolbar                                   
56aeb90c5f8c Bug 31935: Disable profile downgrade protection.                                
9164924ed4bc Bug 31955: On macOS avoid throwing inside nonBrowserWindowStartup()             
afee3f41ebf8 Bug 28196: preparations for using torbutton tor-browser-brand.ftl               
04c9d203db1a Bug 31575: Replace Firefox Home (newtab) with about:tor                         
86c0cab49810 Bug 31491: clean up the old meek http helper browser profiles                   
f49375aa0e92 Bug 26345: Hide tracking protection UI
  [Changed to hide it programatically in browser-siteIdentity.js (less changed files/lines).]
8e756f67e473 Bug 24653: merge securityLevel.properties into torbutton.dtd                    
fd058cac4895 Bug 31457: disable per-installation profiles                                    
5cb1e00aa039 Revert "Bug 1498378 - Actually remove the old onboarding add-on's prefs r=Gijs" 
5fd783334666 Revert "Bug 1574980 - Fix issues with maintenance service install. r=bytesized..
c5102bdc021c Bug 31563: force reloading search extensions if extensions.enabledScopes has c..
5a7c4b884e8f Bug 31251: Security Level button UI polish                                      
  [GetAnonymousElementByAttribute was removed in https://bugzilla.mozilla.org/show_bug.cgi?id=1591145,
  had to change the way to get the anchor.]
  [So that the popup would have the right anchor I also had to change the toolbarbutton
  "badged-button" class to a "badged=true" attribute.]
a3c829b96487 Bug 30575: Don't allow enterprise policies in Tor Browser                       
ba64f118806c Bug 30631: Blurry Tor Browser icon on macOS app switcher                        
fa7117c03ee2 Bug 30541: Disable WebGL readPixel() for web content    
3810dd36bbb4 Bug 28822: Convert onboarding to webextension           
f3b4af7fd952 Bug 29768: Introduce new features to users                                      
eef30d6c77ef Bug 27486 Avoid about:blank tabs when opening onboarding pages.                 
955dc429ff55 Bug 26962 - implement new features onboarding (part 1).                         
  [#connection-icon -> #identity-icon]
0b7eb3ef0833 Bug 26961: New user onboarding. 
  ["* content/onboarding.js (content/onboarding.js)" -> "content/onboarding.js (content/onboarding.js)"
  because no preprocessor is needed (build failed).
172abb91cd0f Revert "Bug 1462415 - Delete onboarding system add-on r=Standard8,k88hudson"    
7d3475febd37 Bug 23247: Communicating security expectations for .onion                       
  [A few small changes in browser-sideIdentity.js (e.g. the `onionUnknownIdentity`
  case is now caught in a `if (this._isSecureContext...` check.]
  [In security.js: formatStringFromName doesn't take the last length param now.]
  [Some css selectors changed in identity-block.inc.css (e.g. #connection-icon -> #identity-icon).]
4c5242b63ba7 Bug 28369: Stop shipping pingsender executable                                  
e3aff6b24d20 Bug 25658: Replace security slider with security level UI   
  [xul -> xhtml]
  [Fixed TorStrings.securityLevel.securityLevel -> SecurityLevelStrings.securityLevel]
  [Had to fix some things, mainly moving oncommand and onclick from securityLevelPreferences.inc.xhtml to securityLevel.js
  Needed because CSP for about:preferences does not allow inline scripts now.]
a5a3c80e6751 Bug 28885: notify users that update is downloading                              
1939f65209f4 Bug 25702: Update Tor Browser icon to follow design guidelines
  [There are some new icons: content/firefox-wordmark.svg.]
  [Small changes in identity-block.inc.css (some css selectors changed).]
744d84330186 Bug 26048: potentially confusing "restart to update" message                    
f49e606d4785 Bug 27082: enable a limited UITour                                              
b336d5b1ad89 Bug 26353: Prevent speculative connect that violated FPI.                       
369d7566e50f Bug 26045: Add new MAR signing keys        
a92684423c9c Bug 21537: Tests for secure .onion cookies  
8d87d2677b4e Bug 21537: Mark .onion cookies as secure                                        
  [Recent changes (https://bugzilla.mozilla.org/show_bug.cgi?id=1618113) use 
  nsMixedContentBlocker::IsPotentiallyTrustworthyOrigin to check for secure cookies,
  which includes the .onion check.]
  [So now the patch is just one line, a case they didn't patch (should we uplift?).
  I also used nsMixedContentBlocker::IsPotentiallyTrustworthyOrigin instead of the
  previous IsSecureHost.]
  [I undeleted the accumulate telemetry part, is there a reason why we would need to remove this?]
8f0968e43bd5 Bug 22548: Firefox downgrades VP9 videos to VP8.                                
d8ea9020feec Bug 23104: Add a default line height compensation               
d68c705165f5 Bug 21830: Copying large text from web console leaks to /tmp    
285bf92cae76 Bug 21321: Add test for .onion whitelisting                                     
7aeeb1432f49 Bug 21431: Clean-up system extensions shipped in Firefox 52                     
b3116f06a8d3 Bug 16285: Exclude ClearKey system for now                                      
2883354c8375 Bug 21907: Fix runtime error on CentOS 6                                        
228821fbc862 Bug 21849: Don't allow SSL key logging                                          
8cff8a986fbf Bug #5741: Prevent WebSocket DNS leak.                                          
10960d6f2f7b Regression tests for "Omnibox: Add DDG, Startpage, Disconnect, Youtube, Twitte..
db0bb1c10aeb Omnibox: Add DDG, Startpage, Disconnect, Youtube, Twitter; remove Amazon, eBay..
9a8ffa9c8c46 Bug 16940: After update, load local change notes.                               
00c65287ecae Bug 13379: Sign our MAR files.                                                  
  [--enable-signmar is gone, now it's always enabled when mar is built
  (see https://bugzilla.mozilla.org/show_bug.cgi?id=1562952).]
  [Some changes modules/libmar/tool/moz.build, because I'm assuming
  MOZ_ENABLE_SIGNMAR=True there. Now setting MAR_NSS = True if TOR_BROWSER_UPDATE = True.]
de27995dcd23 Bug 4234: Use the Firefox Update Process for Tor Browser.                       
  [Now adding --with-tor-browser-version=dev-build and --disable-tor-browser-update in .mozconfig.]
  [Moved #expand pref("torbrowser.version", __TOR_BROWSER_VERSION_QUOTED__);
  from preferences override commit to here, where it's defined.]
  [Removed some code from UpdateService.jsm (#27828), since PREF_APP_UPDATE_DOORHANGER = app.update.doorhanger
  is not there anymore.]
  [app.update.doorhanger removal and other updater UI changes are from
  https://bugzilla.mozilla.org/show_bug.cgi?id=1515484. I did not verify if the updater
  UI still works for us after those.]
7f2120a412b1 Bug 19121: reinstate the update.xml hash check                                  
9f41b70ff4e0 Bug 19121: reinstate the update.xml hash check  
8249b2d1280f Bug 13252: Do not store data in the app bundle                            
b805a10fff52 Bug 21724: Make Firefox and Tor Browser distinct macOS apps               
aefc3ded8969 Bug 11641: change TBB directory structure to be more like Firefox's       
0da881541339 Bug 9173: Change the default Firefox profile directory to be TBB-relative.
516eeee3f9b0 Bug 19890: Disable installation of system addons                                
136744ea8143 Bug 19273: Avoid JavaScript patching of the external app helper dialog.         
  [Had to do `nsCOMPtr<nsIInterfaceRequestor> dialogParent = GetDialogParent();`
  explicitly, there's a compile error otherwise.]
264721b27eb1 Bug 18923: Add a script to run all Tor Browser specific tests                   
23ef8e43c4f7 Regression tests for #2874: Block Components.interfaces from content            
c28f9ce57818 Bug 18821: Disable libmdns for Android and Desktop                              
a443e520818e Bug 18800: Remove localhost DNS lookup in nsProfileLock.cpp                     
2c4e320e4433 Bug 16620: Clear window.name when no referrer sent                              
  [Using `bool isTopFrame = mBrowsingContext->IsTop();` instead of previous test.]
d354a6fc4e06 Bug 16441: Suppress "Reset Tor Browser" prompt.                     
fce6a9166851 Bug 14392: Make about:tor behave like other initial pages.
14eba607a19b Bug 2176: Rebrand Firefox to TorBrowser           
  [Patched more usages of tor-browser-brand.ftl (perhaps we should find an
  alternative way of doing this so that we can use brand.ftl and not have to patch every new occurrence).]
  [<!ENTITY  vendorShortName       "Tor Project"> and <!ENTITY  trademarkInfo.part1 are not used anymore.]
694351d8bb28 Bug 14631: Improve profile access error msgs (strings).
  [Same as prev commit, just changed FormatStringFromName.]
edcf6fd64ddf Bug 14631: Improve profile access error messages.                               
  [Changed FormatStringFromName, it now takes a AutoTArray as params.]
5c1630a9775a Bug 13028: Prevent potential proxy bypass cases.
eb62fd5b0a3d Bug 16439: Remove screencasting code                                            
9efa856f470f Bug 12974: Disable NTLM and Negotiate HTTP Auth                                 
f1bcded28661 Bug 8312: Remove "This plugin is disabled" barrier.                             
354d974203d5 Bug 3547: Block all plugins except flash.                                       
  [Should we change this one to just "Block all plugins"? It might be a good time to
  get rid of the Flash exception.]
9ebe3228517f Pick up latest Torbutton code                                                   
f98afecb6b08 Bug 10760: Integrate TorButton to TorBrowser core                               
  [xul -> xhtml]
7ee9ac661814 Bug 25013: Add torbutton as a tor-browser submodule                             
f18a9ce2ef5b Bug 28044: Integrate Tor Launcher into tor-browser                              
  [Added `ac_add_options --disable-tor-launcher` in .mozconfig]
94c3978813e6 Bug 14970: Don't block our unsigned extensions                                  
c291f78c26d4 Regression tests for TB4: Tor Browser's Firefox preference overrides.           
e211ef73f044 Regression tests for Bug #2950: Make Permissions Manager memory-only            
5f6e8c6ef711 Bug 12620: TorBrowser regression tests folder                                   
4348eef9818f TB4: Tor Browser's Firefox preference overrides.                                
1db8063f6b25 TB3: Tor Browser's official .mozconfigs.                                        
  [I removed some options which are not implemented at this stage and added
  them later in different commits (with-tor-browser-version, disable-tor-launcher,
  disable-tor-browser-update, enable-signmar, enable-verify-mar).]
  [enable-signmar was actually removed from Firefox and now it
  will always build as if it was enabled.]
ced5d6181017 libvpx provides already cpu_features

comment:2 Changed 5 months ago by acat

Type: defecttask

comment:3 Changed 5 months ago by acat

I tried building with https://github.com/acatarineu/tor-browser-build/commit/33533, but there's an error in the Firefox project:

35:06.18     Finished release [optimized] target(s) in 34m 23s
35:09.04 /var/tmp/build/firefox-07a065df4cae/obj-x86_64-pc-linux-gnu/_virtualenvs/init/bin/python -m mozbuild.action.check_binary --target --networking /var/tmp/build/firefox-07a065df4cae/obj-x86_64-pc-linux-gnu/
x86_64-unknown-linux-gnu/release/libgkrust.a
35:09.30 Traceback (most recent call last):
35:09.30   File "/usr/lib/python2.7/runpy.py", line 162, in _run_module_as_main
35:09.30     "__main__", fname, loader, pkg_name)
35:09.30   File "/usr/lib/python2.7/runpy.py", line 72, in _run_code
35:09.30     exec code in run_globals
35:09.30   File "/var/tmp/build/firefox-07a065df4cae/python/mozbuild/mozbuild/action/check_binary.py", line 359, in <module>
35:09.30     sys.exit(main(sys.argv[1:]))
35:09.30   File "/var/tmp/build/firefox-07a065df4cae/python/mozbuild/mozbuild/action/check_binary.py", line 351, in main
35:09.30     return check_networking(options.binary)
35:09.30   File "/var/tmp/build/firefox-07a065df4cae/python/mozbuild/mozbuild/action/check_binary.py", line 270, in check_networking
35:09.30     for sym in at_least_one(iter_symbols(binary)):
35:09.30   File "/var/tmp/build/firefox-07a065df4cae/python/mozbuild/mozbuild/action/check_binary.py", line 72, in at_least_one
35:09.30     for item in iter:
35:09.30   File "/var/tmp/build/firefox-07a065df4cae/python/mozbuild/mozbuild/action/check_binary.py", line 82, in iter_symbols
35:09.30     ty = get_type(binary)
35:09.30   File "/var/tmp/build/firefox-07a065df4cae/python/mozbuild/mozbuild/util.py", line 1007, in __call__
35:09.30     self[args] = self.func(*args)
35:09.30   File "/var/tmp/build/firefox-07a065df4cae/python/mozbuild/mozpack/executables.py", line 37, in get_type
35:09.30     signature = struct.unpack('>L', signature)[0]
35:09.30 TypeError: Struct() argument 1 must be string, not unicode
35:09.32 make[4]: *** [/var/tmp/build/firefox-07a065df4cae/obj-x86_64-pc-linux-gnu/x86_64-unknown-linux-gnu/release/libgkrust.a] Error 1
35:09.32 make[4]: *** Deleting file `/var/tmp/build/firefox-07a065df4cae/obj-x86_64-pc-linux-gnu/x86_64-unknown-linux-gnu/release/libgkrust.a'
35:09.32 make[4]: Leaving directory `/var/tmp/build/firefox-07a065df4cae/obj-x86_64-pc-linux-gnu/toolkit/library/rust'
35:09.32 make[3]: *** [toolkit/library/rust/target] Error 2
35:09.32 make[3]: *** Waiting for unfinished jobs....

comment:4 Changed 5 months ago by acat

Actual Points: 12

comment:5 Changed 5 months ago by mcs

Cc: tbb-team added

comment:6 Changed 5 months ago by sysrqb

Reviewer: sysrqb, pospeselr

comment:7 Changed 5 months ago by acat

Found out that picture-in-picture is broken, created #33577 for that.

comment:8 Changed 5 months ago by pili

Sponsor: Sponsor58-must

comment:9 Changed 5 months ago by acat

Actual Points: 1214

It seems the build error from comment:3 was fixed in https://bugzilla.mozilla.org/show_bug.cgi?id=1620744. So to get a working tor-browser-build I decided to rebase the patches from 33533 to a recent mozilla-central.
The result of that is in https://github.com/acatarineu/tor-browser/commits/33533+1.

FWIW, these are the conflicts that occurred in the process:

Patch failed at 0011 Bug 10760: Integrate TorButton to TorBrowser core
  browser/base/content/browser-menubar.inc

Patch failed at 0019 Bug 2176: Rebrand Firefox to TorBrowser
  browser/components/enterprisepolicies/content/aboutPolicies.html
  browser/components/privatebrowsing/content/aboutPrivateBrowsing.html

Patch failed at 0035 Bug 4234: Use the Firefox Update Process for Tor Browser.
  toolkit/mozapps/update/updater/moz.build

Patch failed at 0059 Bug 23247: Communicating security expectations for .onion
  browser/base/content/browser-siteIdentity.js
  docshell/base/nsDocShell.cpp
  dom/security/nsMixedContentBlocker.cpp

Patch failed at 0076 Bug 26345: Hide tracking protection UI
  browser/base/content/browser-siteIdentity.js

Patch failed at 0078 Bug 31575: Replace Firefox Home (newtab) with about:tor
  browser/components/newtab/AboutNewTabService.jsm

Patch failed at 0099 Bug 32414: Make Services.search.addEngine obey FPI
  toolkit/components/search/SearchEngine.jsm

Besides, I had to fix a compilation error in Bug 23104: Add a default line height compensation because of a new call to GetNormalLineHeight that needed to be changed (https://bugzilla.mozilla.org/show_bug.cgi?id=1623124).

Most conflicts were straightforward to solve. Perhaps the one that changed a bit more was Bug 31575: Replace Firefox Home (newtab) with about:tor. In https://bugzilla.mozilla.org/show_bug.cgi?id=1619992 AboutNewTab.init was moved to BrowserGlue.jsm, so I had to fix the patch and remove it from there.

Something I did not mention before is the last 4 commits of the branch. One is just to set a temp torbutton submodule on my repo, the others are quick fixes for #33697, #33734 and #33726. I added these to get a better looking build, but these should be probably investigated deeper and solved in the respective tickets.


After rebasing to latest mozilla-central, and a few more changes to tor-browser-build (https://github.com/acatarineu/tor-browser-build/commit/33533+1) I could get a testbuild for linux64 working.

The changes from previous tor-browser-build branch (33533) were due to https://bugzilla.mozilla.org/show_bug.cgi?id=1594933 (libnssdbm3.so is not there by default anymore) and to address_a python3 error complaining about _sqlite3 module not being available (installing libsqlite3-dev before compiling Python solves the issue).

I assume there will be more work needed (e.g. did not try to build mac or win), but I hope having a linux64 build that "seems to work" is useful for now.

comment:10 Changed 5 months ago by acat

I just noticed that I had left a (slightly embarrassing) debugging message in the patch for #31286, removed it in ​https://github.com/acatarineu/tor-browser/commits/33533+2 (that's the only change).

comment:11 Changed 4 months ago by pili

Keywords: TorBrowserTeam202004R added; TorBrowserTeam202003R removed

We are no longer in March

comment:12 Changed 4 months ago by mcs

Kathy and I reviewed the rebased updater patches and some other patches that we worked on in the past. Nice work! Two comments so far:

  1. It looks like the rebased #4234 patch is missing a couple of parts. I will attach a fix to this ticket.
  2. We do not need the patch for #31955. Mozilla fixed that issue in a slightly different way.

Changed 4 months ago by mcs

Attachment: 4234-fixes.txt added

comment:13 Changed 4 months ago by pili

Parent ID: #33661

comment:14 Changed 4 months ago by acat

Thanks for the reviews, and good catches. Here is a a new branch with those changes: https://github.com/acatarineu/tor-browser/commits/33533+3

comment:15 Changed 4 months ago by acat

Working on #31918, I looked a bit more at some patches (especially Android ones), and saw that several could (I think) be dropped. So to make #31918 easier, I made a new branch for this ticket with changes that probably belong here and not in #31918.

The new branch is https://github.com/acatarineu/tor-browser/commits/33533+4. I dropped the temp. fixups at the end of the previous branch, as those should be handled in child tickets and were only added to make a tor-browser-build easier.

The rest of changes from 33533+3 to 33533+4 are:

Bug 28051 - Integrate Orbot and add dependencies
  drop, assuming we do not need anymore.

Bug 25906 - Imply false both Adjust and Leanplum configure options
  drop, don't see this beeing used anymore.

Bug 26528 - Don't allow Fennec to use UpdateService when installed through the app store
  drop, it does not even apply anymore to mozilla-beta, and the
  function was not really used anymore when this was rebased.

Bug 25741 - TBA: Add mobile-override of 000-tor-browser prefs
  Moved `000-tor-browser*` changes from
  `Bug 25741 - TBA: Add mozconfig for Android and pertinent branding files.`
  to this one, since I think it belongs here.
  
  Removed change in browser/app/profile/000-tor-browser.js,
  `forward_oma_android_download_manager` is already false by
  default, and I do not see it being used anymore (this avoids
  a conflict in #31918 when rebasing the branch with autosquash).

  Also, moved `@BINPATH@/@PREF_DIR@/000-tor-browser-android.js`
  line in mobile/android/installer/package-manifest.in to make
  sure it's used in geckoview.

Bug 25741 - TBA: Add mozconfig for Android and pertinent branding files. 
  drop, part of it went to the pref overrides above, and the
  rest (mobile branding) I think it's not needed anymore.

Bug 26045: Add new MAR signing keys
  drop, assuming that it's enough to have `Bug 32658: Create a new MAR signing key.`

Bug 22548: Firefox downgrades VP9 videos to VP8.
  Removed default pref change in StaticPrefList.yaml, which I
  don't think is needed. I think this makes it better for this
  to be squashed with pref overrides.

comment:16 Changed 4 months ago by gk

Keywords: TorBrowserTeam202004 added; TorBrowserTeam202004R removed
Status: needs_reviewneeds_revision

While working on #33626 I realized that 33533+4 needs some changes to build at all for mobile. In bug_33626_v2 there is a mobile-configure.patch (in projects/firefox) that contains changes we need. There are some changes to the mozconfig* files for mobile builds which we should make to .mozconfig-android as well. Could you pick that up during your next rebase?

comment:17 Changed 4 months ago by acat

Note: for next mozilla-beta 77 rebase, remember to drop patch and tests for #21537, since #33964 was done. I'm assuming that I adapted the original patch (8d87d2677b4e) correctly in the first rebase here, but we can hopefully fix it up if reviews find I missed something.

comment:18 Changed 3 months ago by gk

We have 77.0b1 tagged which I think is a good rebase starting point: https://hg.mozilla.org/releases/mozilla-beta/rev/eae58b7bc5654f7cac80985dd647c7558bb88895.

comment:19 Changed 3 months ago by acat

Status: needs_revisionneeds_review

New branch: https://github.com/acatarineu/tor-browser/commits/33533+5.

I cherry picked the commits 0c30acdef6e4da186409a70300a685801b11c02d..e1a0211ded85189c3805451fbe26a13a35dcc43f and 85c9db6a4c74c549e70a04ddf4f94a86f82bf312..3ef48160be35fd86516031b6782b983b91366127 from my squashed branch https://github.com/acatarineu/tor-browser/commits/31918+2 onto https://github.com/mozilla/gecko-dev/commit/2c5ac3b9c8c32957bca822fd92ba04d68e97e087 from the beta branch (that should be FIREFOX_77_0b1_BUILD3). That means all commits from 31918+2 branch except patch and tests for #21537, which were upstreamed.

I also picked changes from bug_33626_v2 to mobile/android/torbrowser.configure and removed --with-android-distribution-directory and --without-google-play-services, in the mozconfigs patch.

Here is the list of conflicts found while cherry-picking:

824f3bf0ba545... TB3: Tor Browser's official .mozconfigs.
  both modified:   toolkit/modules/AppConstants.jsm

afe9769539a39... Bug 10760: Integrate TorButton to TorBrowser core
  both modified:   browser/base/content/browser-doctype.inc

6af5fa32b1c59... Bug 14631: Improve profile access error messages.
  both modified:   toolkit/xre/nsAppRunner.cpp
    restartMessageNoUnlocker -> restartMessageNoUnlocker2

650b1b9a3c093... Bug 2176: Rebrand Firefox to TorBrowser
  deleted by us:   browser/components/preferences/connection.xhtml
    Moved to browser/components/preferences/dialogs/connection.xhtml.
  both modified:   browser/components/preferences/main.js
  both modified:   browser/themes/shared/identity-block/identity-block.inc.css
    #identity-icon-labels -> #identity-icon-label
  
  Had to patch extra instances of brand.ftl -> tor-browser-brand.ftl.
  Having #33954 fixed soonish is worth considering.
  
  Also fixed mistake from 33533 branch, "tor-browser-brand.ftler-brand.ftl" ->
  "tor-browser-brand.ftl"

f9e8153d40012... Bug 4234: Use the Firefox Update Process for Tor Browser.
  both modified:   browser/app/profile/firefox.js
    app.update.url was removed in Bug 1568994, moved to build/application.ini.in.

10cb47918ad67... Bug 16940: After update, load local change notes.
  both modified:   browser/components/BrowserGlue.jsm
    
0eed8e3197782... Bug 25658: Replace security slider with security level UI
  both modified:   browser/base/content/browser.xhtml
  both modified:   browser/components/preferences/preferences.xhtml

  Some #include relative path fixes due to  browser/components/preferences rename
  (#include ../../securitylevel/content/securityLevelPreferences.inc.xhtml ->
  #include ../securitylevel/content/securityLevelPreferences.inc.xhtml).

02ec1955a67b6... Bug 23247: Communicating security expectations for .onion
  both modified:   browser/base/content/browser-siteIdentity.js
    No onionVerifiedIdentity anymore, EV UI was removed. So I removed those parts.
  both modified:   browser/themes/shared/jar.inc.mn
  both modified:   docshell/base/nsDocShell.cpp
    Non-trivial fix. GetAllowMixedContentAndConnectionData is not responsible
    for setting aRootHasSecureConnection anymore (due to Fission?). This is
    now done in https://searchfox.org/mozilla-central/rev/7908ce29657cfd623993046bd8e38664e1c0b28e/dom/security/nsMixedContentBlocker.cpp#835,
    and that `IsSecure` flag is set in https://searchfox.org/mozilla-central/rev/7908ce29657cfd623993046bd8e38664e1c0b28e/dom/base/Document.cpp#3614.
    I patched that last file.

25893a628c702... Bug 31575: Replace Firefox Home (newtab) with about:tor
  both modified:   browser/components/BrowserGlue.jsm
    Simple fix for the already existing changes in BrowserGlue.jsm,
    but I also patched `requestCache` function in `BrowserGlue.jsm`, which
    is a new usage of the removed `AboutNewTab`.
  both modified:   browser/components/newtab/AboutNewTabService.jsm
    Non-trivial fixes: Some script loading was moved to
    `browser/actors/AboutNewTabChild.jsm`: I removed that actor from
    `BrowserGlue.jsm`. 

7da5526ee7604... Bug 27511: Add new identity button to toolbar
  both modified:   browser/themes/shared/jar.inc.mn

fb8f647f8b220... Bug 26961: New user onboarding.
  both modified:   browser/app/permissions
  both modified:   browser/themes/shared/UITour.inc.css
    There was a padding-left + padding-right -> padding-inline change, but simple fix.

9e15f1b6721ba... Bug 31286: Implementation of bridge, proxy, and firewall settings in about:preferences#tor
  both modified:   browser/components/preferences/main.inc.xhtml
  both modified:   browser/components/preferences/main.js
  both modified:   browser/components/preferences/preferences.js

  Several relative path fixes due to browser/components/preferences folder rename.

f5406b841b557... Bug 30237: Add v3 onion services client authentication prompt
  both modified:   dom/ipc/BrowserParent.cpp

comment:20 Changed 3 months ago by gk

FWIW: the new branch fails to compile for mobile what I believe to be a Mozilla bug, https://bugzilla.mozilla.org/show_bug.cgi?id=1636036.

comment:21 in reply to:  20 Changed 3 months ago by gk

Replying to gk:

FWIW: the new branch fails to compile for mobile what I believe to be a Mozilla bug, https://bugzilla.mozilla.org/show_bug.cgi?id=1636036.

Okay, I tracked that down and have a fix for it but there is more. :( I opened #34145 for that to not clutter this bug even more.

comment:22 Changed 3 months ago by gk

Here is my plan for reviewing all the work ("[x]" means I am already done with that step):

1) tor-browser-68.8.0-9.5-1 - acat/33533 [x]
2) acat/33533 - acat/33533+1 [x]
3) acat/33533+1 - acat/33533+2 (leftover debugging message for #31286) [x]
4) acat/33533+2 - acat/33533+3 (just adding mcs's/brade's fixes from comment:12) [x]
5) acat/33533+3 - acat/33533+4 [x]
6) acat/33533+4 - acat/31918 [x]
7) acat/31918 - acat/31918+1 [x]
8) acat/31918+1 - acat/31918+2 [x]
9) acat/31918+2 - acat/33533+5 [x]
10) acat/33533+5 - acat/33533+6

Last edited 2 months ago by gk (previous) (diff)

comment:23 Changed 3 months ago by gk

Keywords: TorBrowserTeam202005R added; TorBrowserTeam202004 removed
Reviewer: sysrqb, pospeselrsysrqb, gk

comment:24 Changed 3 months ago by mcs

Kathy and I noticed today that there is a bug in the rebased #23247 patch (5defe271e8919e77267883f8513cf095451fffd2) that causes the Page Info window's Security panel to not display all of its content. The root cause is that Mozilla removed hostName inside _getSecurityInfo() within browser/base/content/pageinfo/security.js. Here is a fixup patch:

     var isBroken = ui.state & Ci.nsIWebProgressListener.STATE_IS_BROKEN;
     var isMixed =
       ui.state &
       (Ci.nsIWebProgressListener.STATE_LOADED_MIXED_ACTIVE_CONTENT |
         Ci.nsIWebProgressListener.STATE_LOADED_MIXED_DISPLAY_CONTENT);
     var isEV = ui.state & Ci.nsIWebProgressListener.STATE_IDENTITY_EV_TOPLEVEL;
     var isOnion = false;
+    const hostName = this.windowInfo.hostName;
     if (hostName && hostName.endsWith(".onion")) {
       isOnion = true;
     }

     let secInfo = await window.opener.gBrowser.selectedBrowser.browsingContext.currentWindowGlobal.getSecurityInfo();
     if (secInfo) {
       secInfo.QueryInterface(Ci.nsITransportSecurityInfo);
       let cert = secInfo.serverCert;

comment:25 Changed 3 months ago by mcs

One more thing: the patches for #19251 and #19757 are missing from acat's 33533+5 branch. They were done as "squash" commits on top of the original #30237 patch. Maybe there is already a process we are following to pick up such fixes, but I wanted to mention this issue so that the patches do not get lost.

comment:26 in reply to:  24 Changed 3 months ago by acat

Replying to mcs:

Kathy and I noticed today that there is a bug in the rebased #23247 patch (5defe271e8919e77267883f8513cf095451fffd2) that causes the Page Info window's Security panel to not display all of its content. The root cause is that Mozilla removed hostName inside _getSecurityInfo() within browser/base/content/pageinfo/security.js. Here is a fixup patch:

     var isBroken = ui.state & Ci.nsIWebProgressListener.STATE_IS_BROKEN;
     var isMixed =
       ui.state &
       (Ci.nsIWebProgressListener.STATE_LOADED_MIXED_ACTIVE_CONTENT |
         Ci.nsIWebProgressListener.STATE_LOADED_MIXED_DISPLAY_CONTENT);
     var isEV = ui.state & Ci.nsIWebProgressListener.STATE_IDENTITY_EV_TOPLEVEL;
     var isOnion = false;
+    const hostName = this.windowInfo.hostName;
     if (hostName && hostName.endsWith(".onion")) {
       isOnion = true;
     }

     let secInfo = await window.opener.gBrowser.selectedBrowser.browsingContext.currentWindowGlobal.getSecurityInfo();
     if (secInfo) {
       secInfo.QueryInterface(Ci.nsITransportSecurityInfo);
       let cert = secInfo.serverCert;

Thanks, that's a nice catch. A simple eslint would have caught this one, but unfortunately did not check it this time :(

comment:27 in reply to:  25 Changed 3 months ago by acat

Replying to mcs:

One more thing: the patches for #19251 and #19757 are missing from acat's 33533+5 branch. They were done as "squash" commits on top of the original #30237 patch. Maybe there is already a process we are following to pick up such fixes, but I wanted to mention this issue so that the patches do not get lost.

Thanks for the reminder. I was planning (at some point) to start applying the changes that came after 6046d1d58280, which is the last commit I used for rebasing. After taking a look at 9.5 branches >= "tor-browser-68.5", I think currently these are missing:

68.5
squash! Bug 30237: Add v3 onion services client authentication prompt

fixup! Bug 23247: Communicating security expectations for .onion

68.6
Bug 33342: Avoid disconnect search addon error after removal.

Bug 28005: Implement .onion alias urlbar rewrites

squash! Bug 30237: Add v3 onion services client authentication prompt

Bug 21952: Implement Onion-Location

68.7
fixup! Bug 28005: Implement .onion alias urlbar rewrites

fixup! Bug 23247: Communicating security expectations for .onion

fixup! Bug 10760: Integrate TorButton to TorBrowser core

Revert "Bug 30575: Don't allow enterprise policies in Tor Browser"

Bug 32418: Allow updates to be disabled via an enterprise policy.

fixup! Bug 28005: Implement .onion alias urlbar rewrites

68.8
Bug 34196: Update site info URL with the onion name

fixup! Bug 34196: Update site info URL with the onion name

When I start applying these I'll double check with some range-diffs just in case I'm missing something between branches. I think I can do this (and :comment:24 fixup) either on next rebase (68beta?) or when gk finishes the review.

(BTW, when looking at these I thought Bug 1626728 - Normalize shutdown. r=perry,jstutte, a=RyanVM had been backed out from central, since that's the chronologically latest commit: https://github.com/mozilla/gecko-dev/commit/0f9da9eb51280f63b217db92c070ed4456b2fe84. However, there's this commit https://github.com/mozilla/gecko-dev/commit/064b0f9501ad76802853b43f18e33d8713fd54d3
which has 1970 (epoch?) date but comes topologically after the backout commit. Not sure why this happened, maybe it says something in the bug, but I can't see it (sec issue I guess).)

comment:28 Changed 3 months ago by acat

And we'll also have to pick again the #31915 patch, which I missed in the last rebase, if it's not upstreamed eventually.

comment:29 Changed 3 months ago by mcs

Here is a fixup for the #13252 patch to avoid a crash when the browser profile directory is on a read-only file system or if the profile cannot be created due to a lack of permission:
https://gitweb.torproject.org/user/brade/tor-browser.git/commit/?h=bug13252-fixup-03&id=3c07adade5bea4064173fd9e383668e972cf17d1

This problem is not new; it exists in ESR68.

comment:30 Changed 3 months ago by mcs

Mozilla accepted our patch in https://bugzilla.mozilla.org/show_bug.cgi?id=1588549. That means that going forward we no longer need to revert the 1574980 patch (which is done in commit 49a05838bf2d97ec22fe300a29e91cd36d59f92a on 33533+5).

comment:31 Changed 2 months ago by gk

Keywords: TorBrowserTeam202006R added; TorBrowserTeam202005R removed

Moving review tickets.

comment:32 in reply to:  30 Changed 2 months ago by acat

Replying to mcs:

Mozilla accepted our patch in https://bugzilla.mozilla.org/show_bug.cgi?id=1588549. That means that going forward we no longer need to revert the 1574980 patch (which is done in commit 49a05838bf2d97ec22fe300a29e91cd36d59f92a on 33533+5).

Great! Thanks :)

comment:33 Changed 2 months ago by mcs

Here is another small item that Kathy and I stumbled across while working on upstreaming of the #28885 patch: we should remove the app.update.badge value from browser/app/profile/000-tor-browser.js. Mozilla stopped using that pref between ESR 52 and 60; see https://bugzilla.mozilla.org/show_bug.cgi?id=893505). Before it was removed, it needed to be set to true to cause update-related icons to be displayed on the app menu's toolbar item. Now the icons are always displayed (potentially after a delay, but in Tor Browser we eliminate the delay by setting app.update.badgeWaitTime to zero).

On the 33533+5 branch, the app.update.badge value is added by ba68c290d05d5b350f365c284ad0db5e049933df

Last edited 2 months ago by mcs (previous) (diff)

comment:34 in reply to:  1 Changed 2 months ago by gk

Replying to acat:

Rebased patches for review in https://github.com/acatarineu/tor-browser/commits/33533.

Some changes to torbutton and tor-launcher were needed: https://github.com/acatarineu/torbutton/commit/33533 and https://github.com/acatarineu/tor-launcher/commit/33533

I used commits 7d21cd26ee65..6046d1d58280 from tor-browser-68.5.0esr-9.5-1.

Similarly to #30429, I put the commits/patches in different categories. For some of them I added comments, which I hope will make reviewing slightly easier.

Regarding mobile patches, most of them have empty intersection with the files that are currently in central (all of [mobile-gone], unless I missed any). I only picked the mobile patches in [mobile-picked], most of them just partially as some of the files are not in central anymore. I guess the parts that could not be applied will have to be ported to Fenix.

[mobile-gone]

c2da27fca068 Revert "Bug 1603270 - Add telemetry for FirefoxPromoBannerRow user actions. r=..
eb88d8eea02d Bug #32405: Crash immediately after bootstrap on Android
517624ea7f34 Bug 26529 - Prompt before opening external app

I opened #34378 for that.

9dab64fe2f20 Bug 31144 - Do not switching apps from CustomTabs without consent
c2cc5044c4ff Bug 31720: Enable website suggestions in address bar
e661977d1bb5 Bug 1568521 Tracking protection doorhanger's Enable/Disable states don't work ..
a1d645909b33 Load torbutton in BrowserApp.startup on Android
3e871c620796 Bug 30573 - Sanitize old tabs and wait for tor before opening new tabs
83137febd5bb Bug 31058: Remove Linus' default bridges
136bd95b705e Bug 24920 - Only create Private tabs if browser.privatebrowsing.autostart is t..
75e9943e8ec9 Continue using non-adaptive icons and don't allow clear-text traffic
a8bcc8eb823e Bug 29238 - Prevent crash on Android after update
5a270452946c Bug 26690: Port padlock states for .onion services to mobile

[Part of this is probably in mobile/android/modules/geckoview/GeckoViewProgress.jsm, but I
guess this would be more like porting rather than cherry-picking patch.]

Yep. I opened #34377 for that.

d479cc5c77e9 Bug 28329 - Part 4. Add new Tor Bootstrapping and configuration screens
7b18ef3cccbd Bug 28329 - Part 1. Add new Tor resources
2cd5f4f5b512 Bug 25696 - Implement alpha onboarding for Tor Browser for Android
888a81d2198d Bug 27016 - Create proxy connection during image download
16345563997f Orfox: hook up default panic trigger to "quit and clear"
a4f9c85167c1 Orfox: quit button added
5e0596ff3e30 Orfox: disable screenshots and prevent page from being in "recent apps"
37c77b37cdeb Bug 25741 - TBA: Adjust the User Agent String so it doesn't leak Android version
0e9127b09627 Bug 25741 - TBA: top sites changed, used bookmarks icon temporarily.
06e93e8c45c7 Bug 25741 - TBA: Always Quit, do not restore the last session
1f103a7c4166 Bug 25741 - TBA: Disable all data reporting by default
b1349fb511c2 Bug 25741 - TBA: Clear state when the app exits, by default
9a6409fa58fb Bug 25741 - TBA: Do not import bookmarks and history from native browser by de..
8b7ae6bcbd5c Bug 25741 - TBA: Do not save browsing history by default
81e402b80cc3 Bug 25741 - TBA: Disable QR Code reader by default
0f40171a057b Bug 25741 - TBA: Disable the microphone by default
268f04897c90 Bug 25741 - TBA: Disable telemetry and experiments
3729f4263efe Bug 25741 - TBA: Remove sync option from preferences
dda2781bf72e Bug 25741 - TBA: Do not register Stumbler listener at start up
4c70c3e1546b Bug 25741 - TBA: Exclude unwanted Stumbler tests
66d133b41794 Bug 28640 - Try showing the homepage after the Distribution loads
94b9527157ed Bug 28640 - Reload distribution preferences on update
03b1e4c88e3a Revert "Bug 1570878 - Add sign-in buttons to onboarding. r=petru a=RyanVM"
c895b8c77c0d Revert "Bug 1576170 - Onboarding Sign up strings. r=flod a=RyanVM"
d6165a9a6b36 Revert "Bug 1585132 - Fix lint failures from sign up button patches. r=petru, ..
54ab76fb79f6 Revert "Bug 1570880 - Added Sign in buttons in Awesomescreen. r=petru a=RyanVM"
970ebbc553ab Revert "Bug 1570878 - Update fenenc onboarding content. r=petru a=RyanVM"
feed391bf77a Revert "Bug 1586205 - Change LP variables to fallback to same nonLP defaults. ..
104889f3a5ec Revert "Bug 1587631 - Add FxA entrypoint option for panel configurations. r=pe..
5c35e3f85a0f Revert "Bug 1603275 - Add a new FirefoxPromoBannerRow for the awesomescreen. r..
7d21cd26ee65 Revert "Bug 1603275 - Restore "Sign up" button shadow. r=VladBaicu, a=RyanVM"

Not picking all those patches looks good to me.

comment:35 in reply to:  1 Changed 2 months ago by gk

Replying to acat:

[snip]

[dropped-included in central]

19fa956d545b Revert "Bug 31764: Fix for error when navigating via 'Paste and go'"
  [Fixed in https://bugzilla.mozilla.org/show_bug.cgi?id=1590538.]
944a06831375 Bug 31573: Catch SessionStore.jsm exception
  [Fixed in https://bugzilla.mozilla.org/show_bug.cgi?id=1591259.]
991ca736be20 Bug 31764: Fix for error when navigating via 'Paste and go'
  [Fixed in https://bugzilla.mozilla.org/show_bug.cgi?id=1590538]
5aff5deef248 Bug 1330467 - part 12. FPI isolation of translation permissions; r=johannh      
a35270cfc712 Bug 1330467 - part 11. Use principal for permissions in webrtc UI; r=johannh    
237353e6979c Bug 1330467 - part 10. Use principal for permissions in browser site-identity;..
0e0410581635 Bug 1330467 - part 9. Use principal with mobile permissions; r=johannh,snorp    
09e3a7e741d2 Bug 1330467 - part 8. Make canvas permission respect FPI; r=johannh,jrmuizel    
3b7c44a13a4b Bug 1330467 - part 7. Confirm FPI in permission manager tests; r=Ehsan          
967603b18514 Bug 1330467 - part 6. Use principal for permissions in sitePermissions.js; r=j..
0295727507bd Bug 1330467 - part 5. Access permissions by principal in PermissionUI.jsm; r=j..
1cdc080d08f1 Bug 1330467 - part 3. Use principal for permissions in pageinfo/permissions.js..
17f811e34af6 Bug 1330467 - part 2. Add SitePermissions APIs functions to accept principal; ..
2ed45e021fe0 Bug 1330467 - part 1. Don't strip first party domain from permissions key; r=j..
767012d2dfae Bug 1474659 Add dedicated AllocKinds just for ArrayBufferObjects. r?sfink       
a2fc76be99de Bug 1561322 - Allow spoofing strings in HTML forms r=baku,Pike   
5705089f0a11 Bug 1560574 - use FormatPRExplodedTime to display GMT; r=kershaw                
8ff568d9f802 Bug 467035 - Avoid leaking browser language via DTD r=Gijs,bzbarsky             
0db2161d0c38 Bug 467035 - Add new internal DTD content types r=ckerschb  
84f9b4ce58f3 Bug 1557729 - Use principal for permission post prompts instead of URI. r=xeon..
b6701121f90c Bug 1573276 - Always allow localization in error pages r=johannh,peterv         
468cb520dc26 Bug 1585351 - Bug 1460357 disabled AVX instructions for the mingw build; this ..
be19b7d3bed7 Bug 1534339 - make OriginAttributes deserializable; r=baku                      
9003a3f749c3 Bug 1546832 - Adjust letterboxing to take the FindBar and Devtools into accoun..
33c51442838a Bug 1556017 - Fixing the off-by-one-pixel issue of find bar and devtool iframe..
4773175a1c43 Bug 1581537 - Avoid several browser language leaks r=smaug
de5a72279416 Bug 1598647 - Set Origin to null with network.http.referer.hideOnionSource r=J..
3f1c2b0337b6 Bug 1554805 - Never set firstPartyDomain on origin attributes for moz-extensio..
e6a7cccd8623 Bug 1467970 - Unsupport cross docGroup adoption r=smaug                         
058f7553389c Bug 1590526 - Temporarily allow node adoption across different docGroups for t..
a83411dfd84f Bug 1590538 - Don't pass an empty object to urlbar-user-start-navigation becau..
ac96b77c70e6 Bug 461204 - Improve the random number generator for the boundaries in multipa..
6c093eda44d7 Bug 29120: Enable media cache in memory 

This looks good overall. The patch for #29120, though, needs a fixup to set browser.privatebrowsing.forceMediaMemoryCache to true. We have #33856 for that, so this is okay.

[snip]

comment:36 in reply to:  1 Changed 2 months ago by gk

Replying to acat:

[snip]

[dropped-not needed]

d6fc4d6753fd Bug 31344: Actually register SecurityLevelPreference's 'unload' callback in pr..
  [Fixed in securitylevel first patch.]

Looks good to me.

[snip]

comment:37 Changed 2 months ago by acat

Rebased branch to latest beta 78 in https://github.com/acatarineu/tor-browser/commits/33533+6

First, I picked previously rebased commits 989179387d731fcadb4c589c02b87146caed36a2..4ac6652a6a29ca819123d88d69f1cb037d828506.

Then, I picked newer commits, mentioned in comment:27

aed69dc95387429e18b18ad578fb78d4a83d91f2
03101bba2cf4a694deec0b7b040d8141f8c7cf20
69dfbacfa8b3d6abd6eb5e248fcd24a03c30a962
7306a08365be9212f621b396513352d19549c487
e3b4a8bf4a19cee4838a5216a3ef5af58bea6e62
da5513527e50e7f13e3b1c3206ed75ff8fbd76db
e09b2deb216910b26f1ade5882d3c3c07af30652
dcae22191c42bdb1948a6e55c7c50e0ab97dbf70
5a8128b566fab32fa2d97fe7a1a99e761afe77b0
7d0d47db46531a32c88db85323cd771761b8bb5d
e577d655d2044e3b6636b0bccfbb5bd776148582
0052c74b743756dafa4f3614f559dd8f8d1645c2
00f5a4c995a911423e10af5a2bbeceef1ae76be6
052d8a452a92a97b77130e60e28c1c02076d9db3

The result of that is, commit by commit, 5f4f375bd8bdc8b065c3233e0174b3c479fda4ba...051eee13a013cb609998b3c8429d075d1cc3dc53 in the new branch, except e09b2deb216910b26f1ade5882d3c3c07af30652 which I fixed directly in the onion alias patch, and 7d0d47db46531a32c88db85323cd771761b8bb5d, which I dropped together with the reverted one, Bug 30575: Don't allow enterprise policies in Tor Browser.

Some comments regarding conflicts and other changes:

0c30acdef6e4d... libvpx provides already cpu_features
  Picked, had missed it in previous rebases.
ba68c290d05d5... TB4: Tor Browser's Firefox preference overrides.
  Removed `app.update.badge` as suggested in comment:33 (thanks!)
  and added `network.dns.disabled = true`.
29415b682999a... Bug 19273: Avoid JavaScript patching of the external app helper...
  both modified:   uriloader/exthandler/nsExternalHelperAppService.cpp
    Main changes are due to nsIInterfaceRequestor* aWindowContext ->
    BrowsingContext* aBrowsingContext.
    
    For that, I turned GetDialogParent into a more generic GetDialogParentAux
    and used that in nsExternalLoadURIHandler to get aWindowContext from
    mBrowsingContext to call `mWarningDialog->MaybeShow`.
    
    Besides, I noticed that the code removed in nsExternalHelperAppService::LoadURI
    and added in nsExternalLoadURIHandler::ContinueRequest did not exactly match.
    I think the mismatch was introduced in the ESR60 rebase, and I do not see any
    reason for it mentioned in #25543. Might that be the cause of #28375? I changed
    the code to include the part that was omitted, which corresponds to
    https://bugzilla.mozilla.org/show_bug.cgi?id=1408010.
bc35813b6cb9a... Bug 4234: Use the Firefox Update Process for Tor Browser.
  both modified:   browser/branding/official/pref/firefox-branding.js
  both modified:   browser/components/customizableui/content/panelUI.inc.xhtml
    Some modified elements were put inside a <html:template
    id="appMenuNotificationTemplate">, which changed the indentation and resulted
    in a conflict.
  both modified:   toolkit/mozapps/update/UpdateService.jsm
    throw Cr.* -> throw Components.Exception("", Cr.*
  both modified:   tools/update-packaging/common.sh
    Uplifted https://bugzilla.mozilla.org/show_bug.cgi?id=1641329 caused
    conflicts (now our patch is smaller, but I assume we still need it).
  
  Also: moved here the firefox-branding.js changes, from
  the branding patch, for official, nightly and alpha. Given that these are
  not branding related and are common for the three builds, perhaps we could
  move them to a single place?
bfdaa4c3a96ed... Bug 13379: Sign our MAR files.
  Changed the checks for DEFINES['MAR_NSS'] to CONFIG['TOR_BROWSER_UPDATE'],
  that was breaking windows builds without TOR_BROWSER_UPDATE when I tested in 
  #33791.
8e5eb26737bd6... Bug 16940: After update, load local change notes.
  both modified:   browser/components/about/AboutRedirector.cpp
c0bccfc4abbeb... Omnibox: Add DDG, Startpage, Disconnect, Youtube, Twitter...
  both modified:   browser/components/search/extensions/list.json
  deleted by us:   browser/components/search/extensions/twitter/manifest.json
    Apparently, twitter search extension was removed in
    https://bugzilla.mozilla.org/show_bug.cgi?id=1635523 [access denied :) ].
    I re-added the twitter search addon.
b543b4845843b... Bug #5741: Prevent WebSocket DNS leak.
  Dropping for now, uplifted in #33962. Added `network.dns.disabled = true`
  to the pref overrides.
fcd5a66b53e68... Bug 21907: Fix runtime error on CentOS 6
  both modified:   gfx/harfbuzz/src/hb-glib.cc
9e02b93065be8... Bug 16285: Exclude ClearKey system for now
  Another commit I missed from 31918+2 -> 33533+5. I think
  I must have mis-used git cherry-pick, perhaps thinking
  that the range was inclusive, but it needs to start with
  firstcommit~1. In any case, picked from 31918+2.
529c2680065e3... Bug 21321: Add test for .onion whitelisting
  both modified:   dom/security/test/unit/test_isOriginPotentiallyTrustworthy.js
    Uplifted, dropped patch.
85c9db6a4c74c... Bug 26353: Prevent speculative connect that violated FPI.
  I missed this one when while switching from branch 31918+2 to 33533+5.
  Picked from 31918+2.
efd51dca597c4... Bug 28369: Stop shipping pingsender executable
  both modified:   toolkit/components/telemetry/app/TelemetrySend.jsm
    throw Cr.NS_ERROR_NOT_IMPLEMENTED ->
    throw Components.Exception("", Cr.NS_ERROR_NOT_IMPLEMENTED)
5defe271e8919... Bug 23247: Communicating security expectations for .onion
  both modified:   browser/themes/shared/jar.inc.mn
  both modified:   dom/base/Document.cpp
    Changed in https://bugzilla.mozilla.org/show_bug.cgi?id=1635365).
    Moved to `dom/ipc/WindowGlobalChild.cpp`
  deleted by us:   security/manager/ssl/nsSecureBrowserUIImpl.cpp
    Fission... Moved to security/manager/ssl/nsSecureBrowserUI.cpp in
    https://bugzilla.mozilla.org/show_bug.cgi?id=1631405.
    This is the file that probably changed most. I slightly changed the
    logic with respect to the previous patch, before we were replacing
    mState with STATE_IS_SECURE, now I'm unsetting STATE_IS_INSECURE and
    setting the STATE_IS_SECURE flags (therefore preserving all other
    possibly existing flags).
  
  I needed to change setting `IsSecure` in WindowGlobalChild.cpp and 
    WindowGlobalActor.cpp.
  Also: fixed missing `const hostName = this.windowInfo.hostName;` as mcs noted.
  Also: changed nsMixedContentBlocker.cpp to use parentIsOnion =
  IsPotentiallyTrustworthyOnion(innerRequestingLocation); to address GeKo's
  comment in IRC (accept if host can't be retrieved).
49a05838bf2d9... Revert "Bug 1574980 - Fix issues with maintenance...
  Dropped this commit, was uplifted in
  https://bugzilla.mozilla.org/show_bug.cgi?id=1588549, and updated windows
  mozconf with `--disable-maintenance-service`.
7afc3f0f7a290... Bug 31575: Replace Firefox Home (newtab) with about:tor
  both modified:   browser/components/BrowserGlue.jsm
a7711addef65e... Bug 27511: Add new identity button to toolbar
  both modified:   browser/themes/shared/jar.inc.mn
578fa25e92924... Bug 31740: Remove some unnecessary RemoteSettings instances
  both modified:   netwerk/url-classifier/components.conf
  
  Note: There's a new usage of skip-list-service, but it checks whether it exists or
  not, so it should be fine to still remove the component.
ef28e10dbeba3... Bug 30237: Add v3 onion services client authentication prompt
  I had to change
  `this._browser.messageManager.sendAsyncMessage("Browser:Reload", {});` to
  `this._browser.sendMessageToActor("Browser:Reload", {}, "BrowserTab");`.

aed69dc953874... squash! Bug 30237: Add v3 onion services client auth...
  deleted by us:   browser/components/preferences/in-content/preferences.xul
  deleted by us:   browser/components/preferences/in-content/privacy.js
  deleted by us:   browser/components/preferences/in-content/privacy.xul
    The xul -> xhtml renames and privacy.js location change.
    
    Also changed `oncommand` from
    browser/components/onionservices/content/authPreferences.inc.xul
    to addEventListener (about:preferences CSP).
03101bba2cf4a... fixup! Bug 23247: Communicating security expectations for .onion
  both modified:   browser/base/content/browser-siteIdentity.js
  both modified:   browser/themes/shared/identity-block/identity-block.inc.css
  both modified:   browser/themes/shared/jar.inc.mn
7306a08365be9... Bug 28005: Implement .onion alias urlbar rewrites
  In order to not block the rebase too much, I decided to drop the
  "allowOnionUrlbarRewrites" changes (for now). That means that for example,
  if a user goes directly to a .onion for which we have a rule, the url
  will now be rewritten. Given that this simplifies the patch quite a bit,
  it might be worth considering whether this behaviour is acceptable UX-wise
  (sysrqb?, antonela?).
  If we decide it is not, I will bring back the old behaviour, with all the
  `allowOnionUrlbarRewrites` logic.

  both modified:   browser/actors/ClickHandlerParent.jsm
  both modified:   browser/actors/ContextMenuChild.jsm
  both modified:   browser/base/content/browser.js
    URLBarSetURI moved to URLBarInput.jsm:
    https://bugzilla.mozilla.org/show_bug.cgi?id=1610475    
    So, URLBarSetURI -> gURLBar.setURI and move the changes in
    URLBarSetURI to URLBarInput.jsm.

  both modified:   browser/base/content/tabbrowser.js
  both modified:   browser/components/BrowserGlue.jsm
  both modified:   docshell/base/nsDocShell.cpp
  both modified:   docshell/base/nsDocShell.h
  both modified:   docshell/base/nsIDocShell.idl
  both modified:   docshell/base/nsIWebNavigation.idl
  both modified:   docshell/shistory/nsSHEntry.cpp
  deleted by us:   modules/libpref/init/StaticPrefList.h
    Removed browser.urlbar.onionRewrites.enabled from StaticPrefs and
    changed it into browser.urlbar.onionRewrites.disabled. Now checking it in
    browser.js
  both modified:   toolkit/components/remotebrowserutils/RemoteWebNavigation.jsm
  both modified:   toolkit/content/widgets/browser-custom-element.js
  both modified:   toolkit/modules/RemoteWebProgress.jsm
  deleted by us:   toolkit/modules/WebProgressChild.jsm
e3b4a8bf4a19c... squash! Bug 30237: Add v3 onion services client auth...
  both modified:   browser/actors/NetErrorChild.jsm
    It seems the UI code moved to aboutNetError.js, without XPCOM APIs. I
    added a RPMGetTorStrings to be able to port the code there. Since
    it's an object being passed, we need to do
    `Cu.cloneInto(result, this.contentWindow)`, see
    https://searchfox.org/mozilla-beta/rev/b6fff7b865952bf31cd86e59d4df550b9d1c4dc1/browser/actors/AboutNewInstallChild.jsm#34
    I also renamed onionNetError.jsm -> onionNetError.js.
    
    Another issue was that there are several async functions in
    aboutNetError.js initPage(), such as `setErrorPageStrings`. This one in
    particular ends up replacing the title with the default "Oops" after
    it's set in onionNetError.js. So now I check if it's an onion error
    there, and avoid calling `setErrorPageStrings` if so.
  both modified:   docshell/base/nsDocShell.cpp
  both modified:   dom/ipc/BrowserParent.cpp
da5513527e50e... Bug 21952: Implement Onion-Location
  both modified:   browser/base/content/browser.js
  deleted by us:   browser/base/content/browser.xul
    xul -> xhtml
  both modified:   browser/components/BrowserGlue.jsm
  both modified:   browser/components/onionservices/jar.mn
  both modified:   browser/components/onionservices/moz.build
  both modified:   dom/base/Document.cpp
  deleted by us:   modules/libpref/init/StaticPrefList.h
  
  Due to Fission, it seems most Actors were converted to
  JSWindowActors (see https://bugzilla.mozilla.org/show_bug.cgi?id=1591469).
  For now, we should still be able to use
  LEGACY_ACTORS in BrowserGlue.jsm, and keep the current code.
  https://hg.mozilla.org/mozilla-central/rev/217394da44ac
dcae22191c42b... fixup! Bug 23247: Communicating security expectations for .onion
  both modified:   dom/security/nsMixedContentBlocker.cpp
052d8a452a92a... fixup! Bug 34196: Update site info URL with the onion name
  both modified:   browser/base/content/pageinfo/pageInfo.js
  deleted by us:   browser/base/content/pageinfo/pageInfo.xul
    xul -> xhtml, and adapted markup (tr + th + td being used now).
  both modified:   browser/base/content/pageinfo/security.js
e892c4b9649c2... squash! TB4: Tor Browser's Firefox preference overrides.
  (Bug 29120: Use the in-memory media cache and increase its maximum size.)
    Picked this one from #33856.
3c07adade5bea... fixup! Bug 13252: Do not store data in the app bundle
  Picked fixup from :comment29.

I also addressed the comments from https://trac.torproject.org/projects/tor/ticket/31918#comment:28 and https://trac.torproject.org/projects/tor/ticket/31918#comment:29

Note: See TracTickets for help on using tickets.