Update Tor, zlib, OpenSSL and GnuPG #85
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This release only includes minor bugfixes: https://gitweb.torproject.org/tor.git/plain/ChangeLog?h=tor-0.4.6.10
There is a rather long list of changes in this release: https://www.zlib.net/ChangeLog.txt The most important being https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-25032
This resolves two security issues: - https://www.openssl.org/news/secadv/20220315.txt (High) - https://www.openssl.org/news/secadv/20220128.txt (moderate) though the latter is only relevant on MIPS architectures which we don't support in Brave.
fmarier
force-pushed
the
update-all-the-things-82
branch
from
cf2b250 to
e06d128
Compare
Verified on a Linux machine using: ``` $ curl --tlsv1.2 --proto '=https' -fsSL https://gnupg.org/signature_key.asc | gpg --import gpg: key BCEF7E294B092E28: 1 signature not checked due to a missing key gpg: key BCEF7E294B092E28: public key "Andre Heinecke (Release Signing Key)" imported gpg: key 528897B826403ADA: 4 signatures not checked due to missing keys gpg: key 528897B826403ADA: public key "Werner Koch (dist signing 2020)" imported gpg: key E98E9B2D19C6C8BD: 2 signatures not checked due to missing keys gpg: key E98E9B2D19C6C8BD: public key "Niibe Yutaka (GnuPG Release Key)" imported gpg: key 549E695E905BA208: 1 signature not checked due to a missing key gpg: key 549E695E905BA208: public key "GnuPG.com (Release Signing Key 2021)" imported gpg: Total number processed: 4 gpg: imported: 4 gpg: marginals needed: 3 completes needed: 1 trust model: pgp gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u gpg: next trustdb check due at 2025-01-14 $ gpg --verify gnupg-2.3.4.tar.bz2.sig gnupg-2.3.4.tar.bz2 gpg: Signature made Mon 20 Dec 2021 01:52:45 PM PST gpg: using EDDSA key 6DAA6E64A76D2840571B4902528897B826403ADA gpg: Good signature from "Werner Koch (dist signing 2020)" [unknown] gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: 6DAA 6E64 A76D 2840 571B 4902 5288 97B8 2640 3ADA gpg: Signature made Mon 20 Dec 2021 10:20:39 PM PST gpg: using EDDSA key AC8E115BF73E2D8D47FA9908E98E9B2D19C6C8BD gpg: Good signature from "Niibe Yutaka (GnuPG Release Key)" [unknown] gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: AC8E 115B F73E 2D8D 47FA 9908 E98E 9B2D 19C6 C8BD ``` https://www.gnupg.org/download/integrity_check.html https://www.gnupg.org/signature_key.html
We disable them explicitly on Mac and we don't actually download the necessary libraries on Linux.
fmarier
force-pushed
the
update-all-the-things-82
branch
from
e06d128 to
7ebaffb
Compare
fmarier
force-pushed
the
update-all-the-things-82
branch
2 times, most recently
from
20bf429 to
d28e20e
Compare
This also merges in the changes made to the Linux builds: - enforcement of strong TLS parameters (limited by the Mac support) - update Tor URLs to avoid redirects - update the Tor daemon signature workflow
fmarier
force-pushed
the
update-all-the-things-82
branch
from
d28e20e to
4f2ad77
Compare
|
The Linux builds sometimes fail to complete within the allowed time due to the libevent test suite taking so long. I started a Slack thread about bumping the timeout value. The Mac build is flaky because sometimes the libevent tests fail: I think we'll need disable these tests like what PJ did in the past though that's pretty high maintenance and maybe we should just disable the tests entirely on Mac? |
This was reported on #80.
This follows the Debian DEP-3 metadata format: https://dep-team.pages.debian.net/deps/dep3/
This follows the Debian DEP-3 metadata format: https://dep-team.pages.debian.net/deps/dep3/
fmarier
force-pushed
the
update-all-the-things-82
branch
from
731e725 to
a6d3775
Compare
fmarier
force-pushed
the
update-all-the-things-82
branch
from
a6d3775 to
4147598
Compare
|
@diracdeltas This is ready to be reviewed. Builds are passing on all platforms. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #82.