[pkgsrc/pkgsrc-2020Q4]: pkgsrc/security/tor-browser Pullup ticket #6419 - req...

[bsiegert <bsiegert%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/4bc4487e63cd
branches:  pkgsrc-2020Q4
changeset: 446130:4bc4487e63cd
user:      bsiegert <bsiegert%pkgsrc.org@localhost>
date:      Thu Feb 04 17:25:59 2021 +0000

description:
Pullup ticket #6419 - requested by wiz
security/tor-browser: security fix

Revisions pulled up:
- security/tor-browser/Makefile                                 1.84
- security/tor-browser/PLIST                                    1.11
- security/tor-browser/distinfo                                 1.35
- security/tor-browser/patches/patch-dom_webgpu_ipc_WebGPUParent.cpp deleted
- security/tor-browser/patches/patch-toolkit_moz.configure      1.5

---
   Module Name: pkgsrc
   Committed By:        wiz
   Date:                Thu Feb  4 13:34:16 UTC 2021

   Modified Files:
        pkgsrc/security/tor-browser: Makefile PLIST distinfo
        pkgsrc/security/tor-browser/patches: patch-toolkit_moz.configure
   Removed Files:
        pkgsrc/security/tor-browser/patches:
            patch-dom_webgpu_ipc_WebGPUParent.cpp

   Log Message:
   tor-browser: update to 10.0.10.

   Changes:

   10.0.10:

   Not found.

   10.0.9:

   The full changelog since Desktop and Android Tor Browser 10.0.8 is:

       All Platforms
           Update NoScript to 11.1.9
       Windows + OS X + Linux
           Update Firefox to 78.7.0esr
           Bug 40249: Remove EOY 2020 Campaign
       Build System
           All Platforms
               Update Go to 1.14.14

   10.0.8:

   The full changelog since Desktop and Android Tor Browser 10.0.7 is:

       All Platforms
           Update NoScript to 11.1.7
       Windows + OS X + Linux
           Update Firefox to 78.6.1esr

diffstat:

 security/tor-browser/Makefile                                      |   6 +-
 security/tor-browser/PLIST                                         |   9 +--
 security/tor-browser/distinfo                                      |  21 +++---
 security/tor-browser/patches/patch-dom_webgpu_ipc_WebGPUParent.cpp |  28 ----------
 security/tor-browser/patches/patch-toolkit_moz.configure           |  16 ++++-
 5 files changed, 28 insertions(+), 52 deletions(-)

diffs (161 lines):

diff -r 8040643fc850 -r 4bc4487e63cd security/tor-browser/Makefile
--- a/security/tor-browser/Makefile     Thu Feb 04 15:35:11 2021 +0000
+++ b/security/tor-browser/Makefile     Thu Feb 04 17:25:59 2021 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.81.2.1 2021/01/04 17:22:33 bsiegert Exp $
+# $NetBSD: Makefile,v 1.81.2.2 2021/02/04 17:25:59 bsiegert Exp $
 #
 # How to update this package:
 #
@@ -15,8 +15,8 @@
 # when packaged up, read MESSAGE and test by visiting https://check.torproject.org
 # and https://panopticlick.eff.org
 
-DISTNAME=      src-firefox-tor-browser-78.6.0esr-10.0-1-build1
-PKGNAME=       tor-browser-10.0.7
+DISTNAME=      src-firefox-tor-browser-78.7.0esr-10.0-2-build1
+PKGNAME=       tor-browser-10.0.10
 CATEGORIES=    security www
 MASTER_SITES=  https://dist.torproject.org/torbrowser/${PKGVERSION_NOREV}/
 EXTRACT_SUFX=  .tar.xz
diff -r 8040643fc850 -r 4bc4487e63cd security/tor-browser/PLIST
--- a/security/tor-browser/PLIST        Thu Feb 04 15:35:11 2021 +0000
+++ b/security/tor-browser/PLIST        Thu Feb 04 17:25:59 2021 +0000
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.10 2020/10/31 00:55:27 wiz Exp $
+@comment $NetBSD: PLIST,v 1.10.2.1 2021/02/04 17:25:59 bsiegert Exp $
 bin/tor-browser
 lib/tor-browser/actors/AboutHttpsOnlyErrorChild.jsm
 lib/tor-browser/actors/AboutHttpsOnlyErrorParent.jsm
@@ -718,7 +718,7 @@
 lib/tor-browser/browser/chrome/browser/res/activity-stream/data/content/tippytop/favicons/allegro-pl.ico
 lib/tor-browser/browser/chrome/browser/res/activity-stream/data/content/tippytop/favicons/amazon.ico
 lib/tor-browser/browser/chrome/browser/res/activity-stream/data/content/tippytop/favicons/avito-ru.ico
-lib/tor-browser/browser/chrome/browser/res/activity-stream/data/content/tippytop/favicons/baidu-com.ico
+lib/tor-browser/browser/chrome/browser/res/activity-stream/data/content/tippytop/favicons/baidu-com.png
 lib/tor-browser/browser/chrome/browser/res/activity-stream/data/content/tippytop/favicons/bbc-uk.ico
 lib/tor-browser/browser/chrome/browser/res/activity-stream/data/content/tippytop/favicons/bing-com.ico
 lib/tor-browser/browser/chrome/browser/res/activity-stream/data/content/tippytop/favicons/ctrip-com.ico
@@ -5305,16 +5305,11 @@
 lib/tor-browser/chrome/torbutton/skin/about-wordmark.png
 lib/tor-browser/chrome/torbutton/skin/aboutDialog.css
 lib/tor-browser/chrome/torbutton/skin/aboutTor.css
-lib/tor-browser/chrome/torbutton/skin/aboutTorFonts.css
 lib/tor-browser/chrome/torbutton/skin/forwardArrow.png
 lib/tor-browser/chrome/torbutton/skin/icon-newsletter.png
-lib/tor-browser/chrome/torbutton/skin/illo-purple.svg
-lib/tor-browser/chrome/torbutton/skin/illo.svg
 lib/tor-browser/chrome/torbutton/skin/preferences-mobile.css
 lib/tor-browser/chrome/torbutton/skin/preferences.css
 lib/tor-browser/chrome/torbutton/skin/searchLogo.png
-lib/tor-browser/chrome/torbutton/skin/tape-purple.svg
-lib/tor-browser/chrome/torbutton/skin/tape.svg
 lib/tor-browser/chrome/torbutton/skin/tor-circuit-display.css
 lib/tor-browser/chrome/torbutton/skin/tor-circuit-line-first.svg
 lib/tor-browser/chrome/torbutton/skin/tor-circuit-line-last.svg
diff -r 8040643fc850 -r 4bc4487e63cd security/tor-browser/distinfo
--- a/security/tor-browser/distinfo     Thu Feb 04 15:35:11 2021 +0000
+++ b/security/tor-browser/distinfo     Thu Feb 04 17:25:59 2021 +0000
@@ -1,13 +1,13 @@
-$NetBSD: distinfo,v 1.33.2.1 2021/01/04 17:22:33 bsiegert Exp $
+$NetBSD: distinfo,v 1.33.2.2 2021/02/04 17:26:00 bsiegert Exp $
 
-SHA1 (src-firefox-tor-browser-78.6.0esr-10.0-1-build1.tar.xz) = 42e3a3cc237b6342e6caf681e7d220e99c4ca1e0
-RMD160 (src-firefox-tor-browser-78.6.0esr-10.0-1-build1.tar.xz) = 8c98a6dc820046c2d98911ca6679c67df76b09ef
-SHA512 (src-firefox-tor-browser-78.6.0esr-10.0-1-build1.tar.xz) = 6cec444202e3809cf96d39c3c026a224edc295f76cffcab6d43344c7d75e6a37ba155ed9efa5774f5c2fab092061b621e4025e581e69fccd2ce4bfe1450a9019
-Size (src-firefox-tor-browser-78.6.0esr-10.0-1-build1.tar.xz) = 364785260 bytes
-SHA1 (tor-browser-linux64-10.0.7_en-US.tar.xz) = 3ca1953cd8266ddbb2b0508d91cd3e22a54e2d74
-RMD160 (tor-browser-linux64-10.0.7_en-US.tar.xz) = 1f4f3116aa8416ffebea87c6961b21f821f29651
-SHA512 (tor-browser-linux64-10.0.7_en-US.tar.xz) = fb51e096dff18b5ace323d58ae4f18586de9a7e2caaa7819f0e6fc399815d12d92752b001273df5f6a05664a67832adc2f7131e67ad7d7371c0fc0f3c4c2d5c6
-Size (tor-browser-linux64-10.0.7_en-US.tar.xz) = 85897204 bytes
+SHA1 (src-firefox-tor-browser-78.7.0esr-10.0-2-build1.tar.xz) = 21384fc3d2f94ae852df6c9318a37b640571504a
+RMD160 (src-firefox-tor-browser-78.7.0esr-10.0-2-build1.tar.xz) = 9bd55a80479e266eec4fa5b3721c7956a31876ba
+SHA512 (src-firefox-tor-browser-78.7.0esr-10.0-2-build1.tar.xz) = 63809598d1ecaf02b287ecd6e91e80c2667d0426b3c6cc105e2c492da2be7b83a517a1bc64b80a2629a262d6448c44ff9fda7019955a9138c2202a30e4fe788c
+Size (src-firefox-tor-browser-78.7.0esr-10.0-2-build1.tar.xz) = 364550288 bytes
+SHA1 (tor-browser-linux64-10.0.10_en-US.tar.xz) = 51bf8b9da3ab63e912e1a083ba391a5365251fea
+RMD160 (tor-browser-linux64-10.0.10_en-US.tar.xz) = daf68ee66c6d17365a8f0be92971e1cb1edca817
+SHA512 (tor-browser-linux64-10.0.10_en-US.tar.xz) = efc3470add2dbffe46a6ffe57efb2350daaa0e6f19da48ba7488f55be49ff54b568a0dc91f486826452ac3e1cee649a8658fda61d2c89f85da349872085a3c70
+Size (tor-browser-linux64-10.0.10_en-US.tar.xz) = 85351772 bytes
 SHA1 (patch-.mozconfig) = 949472d011d40b02146c06e90ed07673667d192b
 SHA1 (patch-aa) = 11060461fdaca5661e89651b8ded4a59d2abc4d7
 SHA1 (patch-browser_app_profile_000-tor-browser.js) = 84a0a15605fff0e22f3150bce901a296fc920280
@@ -18,7 +18,6 @@
 SHA1 (patch-configure.in) = b40651b008dcecc49664660ac376df2bd7c2c6be
 SHA1 (patch-dom_base_nsAttrName.h) = ac7ba441a3b27df2855cf2673eea36b1cb44ad49
 SHA1 (patch-dom_media_CubebUtils.cpp) = 226821d961039ae5c9c50d8615757b73c6bcd80a
-SHA1 (patch-dom_webgpu_ipc_WebGPUParent.cpp) = 236743c74610812bb7bdd577112092401dc1e587
 SHA1 (patch-gfx_angle_checkout_src_common_third__party_smhasher_src_PMurHash.cpp) = e458c9c8dc66edc69c1874734af28a77fc5e3993
 SHA1 (patch-gfx_angle_checkout_src_compiler_translator_InfoSink.h) = 2f73c76c48852613e0c55c1680fcc2a9eb3cf4ef
 SHA1 (patch-gfx_cairo_cairo_src_cairo-type1-subset.c) = 89a9d934ef76706c552c0b81e6cbc0f45b1ffd2c
@@ -52,7 +51,7 @@
 SHA1 (patch-third__party_rust_libc_src_unix_bsd_netbsdlike_netbsd_mod.rs) = 3755f32fea84900cc0f00af3d9f53ed5fcfb0b4b
 SHA1 (patch-toolkit_components_terminator_nsTerminator.cpp) = 5a516d377d491e0504aaf2d7aed04bb9ebeccc56
 SHA1 (patch-toolkit_modules_subprocess_subprocess__shared__unix.js) = 22a39e54e042ab2270a3cb54e4e307c8900cad12
-SHA1 (patch-toolkit_moz.configure) = 40ee147cc1d2c62dd6c83b3f67ce9e61f758ea57
+SHA1 (patch-toolkit_moz.configure) = 00bf26bfa813db8e8c9a1d99629ae948874caf30
 SHA1 (patch-toolkit_mozapps_installer_packager.mk) = 706635b76a7b525794aba95e95544f09e18bb662
 SHA1 (patch-widget_gtk_WaylandDMABufSurface.cpp) = 3c556b9321a5045363a1d567ea271c520f585850
 SHA1 (patch-xpcom_base_nscore.h) = 1ac4d34d3c9e80bc1ac966c6c84cb320bc0fa1ec
diff -r 8040643fc850 -r 4bc4487e63cd security/tor-browser/patches/patch-dom_webgpu_ipc_WebGPUParent.cpp
--- a/security/tor-browser/patches/patch-dom_webgpu_ipc_WebGPUParent.cpp        Thu Feb 04 15:35:11 2021 +0000
+++ /dev/null   Thu Jan 01 00:00:00 1970 +0000
@@ -1,28 +0,0 @@
-$NetBSD: patch-dom_webgpu_ipc_WebGPUParent.cpp,v 1.1.2.2 2021/01/04 17:22:33 bsiegert Exp $
-
-* Fix build with devel/cbindgen-0.16.0.
-  From https://bugzilla.mozilla.org/show_bug.cgi?id=1684180
-
---- dom/webgpu/ipc/WebGPUParent.cpp.orig       2020-12-08 01:14:39.000000000 +0000
-+++ dom/webgpu/ipc/WebGPUParent.cpp
-@@ -423,17 +423,15 @@ ipc::IPCResult WebGPUParent::RecvDeviceC
-     switch (entry.mType) {
-       case SerialBindGroupEntryType::Buffer:
-         bgb.resource.tag = ffi::WGPUBindingResource_Buffer;
--        bgb.resource.buffer._0.buffer = entry.mValue;
--        bgb.resource.buffer._0.offset = entry.mBufferOffset;
--        bgb.resource.buffer._0.size = entry.mBufferSize;
-+        bgb.resource.buffer = {entry.mValue, entry.mBufferOffset, entry.mBufferSize};
-         break;
-       case SerialBindGroupEntryType::Texture:
-         bgb.resource.tag = ffi::WGPUBindingResource_TextureView;
--        bgb.resource.texture_view._0 = entry.mValue;
-+        bgb.resource.texture_view = {entry.mValue};
-         break;
-       case SerialBindGroupEntryType::Sampler:
-         bgb.resource.tag = ffi::WGPUBindingResource_Sampler;
--        bgb.resource.sampler._0 = entry.mValue;
-+        bgb.resource.sampler = {entry.mValue};
-         break;
-       default:
-         MOZ_CRASH("unreachable");
diff -r 8040643fc850 -r 4bc4487e63cd security/tor-browser/patches/patch-toolkit_moz.configure
--- a/security/tor-browser/patches/patch-toolkit_moz.configure  Thu Feb 04 15:35:11 2021 +0000
+++ b/security/tor-browser/patches/patch-toolkit_moz.configure  Thu Feb 04 17:25:59 2021 +0000
@@ -1,10 +1,11 @@
-$NetBSD: patch-toolkit_moz.configure,v 1.4 2020/10/07 11:10:35 wiz Exp $
+$NetBSD: patch-toolkit_moz.configure,v 1.4.2.1 2021/02/04 17:26:00 bsiegert Exp $
 
 * skia part: support bigendian architectures
+* second chunk: use bundled fonts to reduce fingerprinting possibilities
 
---- toolkit/moz.configure.orig 2018-05-03 16:58:41.000000000 +0000
+--- toolkit/moz.configure.orig 2021-01-20 21:52:53.000000000 +0000
 +++ toolkit/moz.configure
-@@ -932,11 +932,11 @@ include('nss.configure')
+@@ -804,11 +804,11 @@ set_config('MOZ_IPDL_TESTS',
  # ==============================================================
  option('--disable-skia', help='Disable use of Skia')
  
@@ -21,3 +22,12 @@
          return True
  
  set_config('MOZ_ENABLE_SKIA', skia)
+@@ -1352,7 +1352,7 @@ set_config('MOZ_BITS_DOWNLOAD',
+ 
+ @depends(target)
+ def bundled_fonts_default(target):
+-    return target.os == 'WINNT' or target.kernel == 'Linux'
++    return True
+ 
+ @depends(build_project)
+ def allow_bundled_fonts(project):