code:
#!/usr/bin/env ./Browser/execdesktop
#
# This file is a self-modifying .desktop file that can be run from the shell.
# It preserves arguments and environment for the start-[% c("var/project-name") %] script.
#
# Run './start-[% c("var/project-name") %].desktop --help' to display the full set of options.
#
# When invoked from the shell, this file must always be in a [% c("var/Project_Name") %] root
# directory. When run from the file manager or desktop GUI, it is relocatable.
#
# After first invocation, it will update itself with the absolute path to the
# current [% c("var/Project_Name") %] location, to support relocation of this .desktop file for GUI
# invocation. You can also add [% c("var/Project_Name") %] to your desktop's application menu
# by running './start-[% c("var/project-name") %].desktop --register-app'
#
# If you use --register-app, and then relocate your [% c("var/Project_Name") %] directory, [% c("var/Project_Name") %]
# will no longer launch from your desktop's app launcher/dock. However, if you
# re-run --register-app from inside that new directory, the script
# will correct the absolute paths and re-register itself.
#
# This file will also still function if the path changes when [% c("var/Project_Name") %] is used as a
# portable app, so long as it is run directly from that new directory, either
# via the shell or via the file manager.

[Desktop Entry]
Type=Application
Name=[% c("var/Project_Name") %] Setup
GenericName=Web Browser
Comment=[% c("var/Project_Name") %]  is +1 for privacy and −1 for mass surveillance
Categories=Network;WebBrowser;Security;
Exec=sh -c '"$(dirname "$*")"/Browser/start-[% c("var/project-name") %]  --detach || ([ ! -x "$(dirname "$*")"/Browser/start-[% c("var/project-name") %] ] && "$(dirname "$*")"/start-[% c("var/project-name") %] --detach)' dummy %k
X-[% c("var/ProjectName") %]-ExecShell=./Browser/start-[% c("var/project-name") %] --detach
Icon=web-browser
StartupWMClass=[% c("var/Project_Name") %]


code:
#!/bin/bash
[% c("var/set_default_env") -%]
distdir=/var/tmp/dist/[% project %]
export TORBROWSER_VERSION='[% c("version") %]'

mkdir -p $distdir

scripts_dir=/var/tmp/build_scripts
mkdir -p "$scripts_dir"

OUTDIR='[% dest_dir _ "/" _ c("filename") %]'
mkdir -p $OUTDIR

# When we build with MULTI_LINGUAL=1, the browser will be packaged inside a
# directory named tor-browser (instead of tor-browser_en-US). Therefore we
# stage everything under tor-browser-stage to avoid a conflict.
TB_STAGE_DIR=$distdir/tor-browser-stage
GENERATEDPREFSPATH=$rootdir/Bundle-Data/PTConfigs/generated-prefs.js
# Create initially empty prefs file where we can dump our conditionally included/genetered prefs
touch "$GENERATEDPREFSPATH"

[% IF c("var/osx") %]
  TBDIR="$TB_STAGE_DIR/[% c("var/Project_Name") %].app"

  DOCSPATH=Contents/Resources/[% c('var/ProjectName') %]/Docs
  EXTSPATH=Contents/Resources/distribution/extensions
  TORBINPATH=Contents/MacOS/Tor
  TORCONFIGPATH=Contents/Resources/TorBrowser/Tor

  tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/libdmg') %]
  export PATH=/var/tmp/dist/libdmg-hfsplus:$PATH
[% ELSE %]
  TBDIR=$TB_STAGE_DIR/Browser

  DOCSPATH=[% c('var/ProjectName') %]/Docs
  EXTSPATH=[% c('var/ProjectName') %]/Data/Browser/profile.default/extensions
  TORCONFIGPATH=TorBrowser/Data/Tor

  mkdir -p "$TBDIR/[% c('var/ProjectName') %]/Data/Browser/Caches"
[% END %]

mkdir -p "$TBDIR/$EXTSPATH"

# Extract the MAR tools.
unzip -d $rootdir $rootdir/[% c('input_files_by_name/firefox') %]/mar-tools-*.zip
MARTOOLS=$rootdir/mar-tools

mv [% c('input_files_by_name/noscript') %] "$TBDIR/$EXTSPATH/{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi"

[% IF c("var/tor-browser") -%]
  tar -C "$TBDIR" -xf [% c('input_files_by_name/obfs4') %]
  tar -C "$TBDIR" -xf [% c('input_files_by_name/snowflake') -%]
[% END -%]

tar -C "$TBDIR[% IF c("var/osx") %]/Contents/Resources[% END %]" -xf [% c('input_files_by_name/fonts') %]

[% IF c("var/linux") %]
  cat > ${TB_STAGE_DIR}/start-[% c("var/project-name") %].desktop << 'RBM_TB_EOF'
[% INCLUDE 'RelativeLink/start-browser.desktop' -%]
RBM_TB_EOF
  cat > ${TB_STAGE_DIR}/Browser/start-[% c("var/project-name") %] << 'RBM_TB_EOF'
[% INCLUDE 'RelativeLink/start-browser' -%]
RBM_TB_EOF
  cat > ${TB_STAGE_DIR}/Browser/execdesktop << 'RBM_TB_EOF'
[% INCLUDE 'RelativeLink/execdesktop' -%]
RBM_TB_EOF
  chmod +x ${TB_STAGE_DIR}/start-[% c("var/project-name") %].desktop \
           ${TB_STAGE_DIR}/Browser/start-[% c("var/project-name") %] \
           ${TB_STAGE_DIR}/Browser/execdesktop
  cp ${TB_STAGE_DIR}/start-[% c("var/project-name") %].desktop \
     ${TB_STAGE_DIR}/Browser
  [% IF c("var/namecoin") %]
    pushd ${TB_STAGE_DIR}/Browser/
    patch -p1 < $rootdir/namecoin.patch
    popd
  [% END %]
  # Make sure we get the desired scrollbar behavior with Gtk3, see bug 27546.
  GTK_SETTINGS_DIR=${TB_STAGE_DIR}/Browser/.config/gtk-3.0
  mkdir -p $GTK_SETTINGS_DIR
  cp $rootdir/gtk3-settings.ini $GTK_SETTINGS_DIR/settings.ini
[% END %]

tar -C ${TB_STAGE_DIR} -xf [% c('input_files_by_name/firefox') %]/browser.tar.gz

[% IF c("var/tor-browser") -%]
  # Include the Tor Browser manual
  TMP_MANUAL_PATH=$rootdir/tmp_manual/
  mkdir $TMP_MANUAL_PATH
  pushd $TMP_MANUAL_PATH
  tar -xf $rootdir/[% c('input_files_by_name/manual') %]
  find . -exec [% c("touch") %] {} \;
  find chrome/ | sort | zip -X -@ "$TBDIR[% IF c("var/osx") %]/Contents/Resources[% END %]/browser/omni.ja"
  popd
  rm -rf $TMP_MANUAL_PATH
[% END -%]

[% IF c("var/tor-browser") -%]
  tar -C "$TBDIR[% IF ! c("var/osx") %]/TorBrowser[% END %]" -xf [% c('input_files_by_name/tor') %]/tor.tar.gz
[% END -%]

[% IF c("var/namecoin") %]
  # Extract Electrum-NMC
  tar -C "$TBDIR/TorBrowser" -xf [% c('input_files_by_name/electrum-nmc') %]

  # Extract ncprop279
  mkdir "$TBDIR/TorBrowser/ncprop279"
  tar -C "$TBDIR/TorBrowser/ncprop279" -xf [% c('input_files_by_name/ncprop279') %]

  # Extract StemNS
  tar -C "$TBDIR/TorBrowser" -xf [% c('input_files_by_name/stemns') %]
[% END %]

[% IF c("var/linux");
     SET bundledata_osname = 'linux';
   ELSIF c("var/osx");
     SET bundledata_osname = 'mac';
   ELSIF c("var/windows");
     SET bundledata_osname = 'windows';
   END; %]

[% IF c("var/osx") %]
  # The Bundle-Data is designed for embedded data, so we need to modify
  # the structure when we want the data to be outside the app directory.
  # We also create an override.ini file to disable the profile migrator.
  SKELETON_TMP=$rootdir/Bundle-Data/mac-skeleton-tmp
  SKELETON_TMP_RESOURCES=$SKELETON_TMP/Contents/Resources
  mkdir -p $SKELETON_TMP_RESOURCES/browser
  echo "[XRE]" > $SKELETON_TMP_RESOURCES/browser/override.ini
  echo "EnableProfileMigrator=0" >> $SKELETON_TMP_RESOURCES/browser/override.ini
  [% IF c("var/tor-browser") -%]
    mkdir -p $SKELETON_TMP_RESOURCES/TorBrowser/Tor
    cp -p Bundle-Data/mac/TorBrowser/Data/Tor/torrc-defaults $SKELETON_TMP_RESOURCES/TorBrowser/Tor/
  [% END -%]
  # Place a copy of the bookmarks.html file at the top. It will be moved into
  # browser/omni.ja later
  cp -p Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/bookmarks.html $rootdir
  rm -Rf Bundle-Data/mac
  mv $SKELETON_TMP Bundle-Data/mac

  [% IF c("var/tor-browser") -%]
    # Install a "tor" shim that sets the working directory. See #10030.
    mv "$TBDIR/$TORBINPATH/tor" "$TBDIR/$TORBINPATH/tor.real"
    cp Bundle-Data/mac-tor.sh "$TBDIR/$TORCONFIGPATH/tor"
  [% END -%]

  tar -C Bundle-Data/mac-applications.dmg -c . | tar -C $TB_STAGE_DIR -x
[% END %]

mkdir -p "$TBDIR/$DOCSPATH"
cp -a Bundle-Data/Docs/* "$TBDIR/$DOCSPATH"
tar -C Bundle-Data/[% bundledata_osname %] [% IF ! c("var/namecoin") %]--exclude=*Electrum-NMC* --exclude=*ncprop279*[% END %] -c . | tar -C "$TBDIR[% IF ! c("var/osx") %]/[% c('var/ProjectName') %][% END %]" -x

[% IF c("var/tor-browser") -%]
  cat Bundle-Data/PTConfigs/[% bundledata_osname %]/torrc-defaults-appendix >> "$TBDIR/$TORCONFIGPATH/torrc-defaults"
  cat Bundle-Data/PTConfigs/bridge_prefs.js >> "$GENERATEDPREFSPATH"

  function bridges_conf {
    local pt="$1"
    local i=1
    while read -r line
    do
      echo "pref(\"extensions.torlauncher.default_bridge.$pt.$i\", \"$line\");" >> "$GENERATEDPREFSPATH"
      i=$((i + 1))
    done < "$rootdir/bridges_list.$pt.txt"
  }
  bridges_conf obfs4
  bridges_conf meek-azure
  bridges_conf snowflake
[% END -%]

[% IF ! c("var/multi_lingual") && c("var/tor-browser") %]
  echo 'pref("extensions.torlauncher.prompt_for_locale", false);' >> "$GENERATEDPREFSPATH"
[% END %]

[% IF c("var/linux") %]
  chmod 700 ${TB_STAGE_DIR}/Browser/[% c('var/ProjectName') %]/Data/Browser
  [% IF c("var/tor-browser") -%]
    chmod 700 ${TB_STAGE_DIR}/Browser/TorBrowser/Data/Tor
  [% END -%]
[% END %]

[% IF c("var/multi_lingual") %]
  # If we are building a multi-lingual package, use "ALL" in the package name
  # and as the locale for update purposes. We do not include "ALL" in the name
  # of the directory that is inside the package (in other words, users will
  # not see tor-browser_ALL after they install Tor Browser).
  PKG_LOCALE="ALL"
  PKG_DIR='[% c("var/project-name") %]'
[% ELSE %]
  PKG_LOCALE="en-US"
  PKG_DIR="[% c('var/project-name') %]_${PKG_LOCALE}"
[% END %]

pushd "$TBDIR[% IF c("var/osx") %]/Contents/Resources[% END %]/browser/"
unzip omni.ja defaults/preferences/[% c("var/prefs_file") %] || [ $? -lt 3 ]
# Append our built extension-overrides.js to 000-tor-browser.js
cat "$GENERATEDPREFSPATH" >> defaults/preferences/[% c("var/prefs_file") %]
cp defaults/preferences/[% c("var/prefs_file") %] $rootdir
[% IF c("var/osx") %]
  # Embed our default bookmarks within the en-US locale.
  mkdir -p chrome/en-US/locale/browser
  cp -p $rootdir/bookmarks.html chrome/en-US/locale/browser/
  [% c("touch") %] chrome/en-US/locale/browser/bookmarks.html
  chmod 600 chrome/en-US/locale/browser/bookmarks.html
  zip -Xm omni.ja chrome/en-US/locale/browser/bookmarks.html
  rm -rf chrome
[% END %]
# Set the locale of the bundle.
echo "pref(\"intl.locale.requested\", \"en-US\");" >> defaults/preferences/[% c("var/prefs_file") %]
[% c("touch") %] defaults/preferences/[% c("var/prefs_file") %]
zip -Xm omni.ja defaults/preferences/[% c("var/prefs_file") %]
rm -rf defaults
# create tbb_version.json file for #25020
echo '{"version":"[% c("var/torbrowser_version") %]","architecture":"[% c("var/mar_osname") %]","channel":"[% c("var/channel") %]","locale":"en-US"}' > ../tbb_version.json
popd

[% IF c("var/osx") || c("var/multi_lingual") -%]
  # Prepare our language packs to embed our default bookmarks.
  # See bug 21879 for more details.
  [% SET locales = c("var/testbuild") ? [] : c("var/locales") -%]
  [% FOREACH lang = locales %]
  [% SET lang = tmpl(lang);
     SET xpi = '$rootdir/' _ c('input_files_by_name/firefox-langpacks') _ '/' _ lang _ '.xpi';
     %]
    [% IF c("var/osx") -%]
      unzip -d prep_[% lang %] [% xpi %]
      cp $rootdir/bookmarks.html prep_[% lang %]/browser/chrome/[% lang %]/locale/browser/
      rm [% xpi %]
      cd prep_[% lang %]
      [% c('zip', {
              zip_src => [ '.' ],
              zip_args => xpi,
          }) %]
    [% END -%]
    # If we are building a multi-lingual package, add all of the language packs.
    [% IF c("var/multi_lingual") %]
      cp [% xpi %] "$TBDIR/$EXTSPATH/langpack-[% lang %]@firefox.mozilla.org.xpi"
    [% END %]
    cd ..
    rm -rf prep_[% lang %]
  [% END %]
[% END %]

[% IF c("var/multi_lingual") %]
  # Set the update.locale (it is used to replace %LOCALE% within
  # app.update.url).
  pushd "$TBDIR[% IF c("var/osx") %]/Contents/Resources/[% END %]"
  echo ${PKG_LOCALE} > update.locale
  [% c("touch") %] update.locale
  zip -Xm omni.ja update.locale
  popd
[% END %]

[% IF c("var/windows") %]
  tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/nsis') %]
  export PATH="/var/tmp/dist/nsis/bin:$PATH"

  mv $rootdir/windows-installer $distdir/windows-installer
  mv ${TB_STAGE_DIR} $distdir/windows-installer/"[% c('var/Project_Name') %]"
  mv $distdir/windows-installer ${TB_STAGE_DIR}
[% END %]

[% IF c("var/windows") %]
  TBDIR="$distdir/$PKG_DIR/[% c("var/Project_Name") %]/Browser"
[% ELSIF c("var/osx") %]
  TBDIR="$distdir/$PKG_DIR/[% c("var/Project_Name") %].app"
[% ELSE %]
  TBDIR="$distdir/$PKG_DIR/Browser"
[% END %]

cat > "$scripts_dir/create-$PKG_DIR" << SCRIPT_EOF
#!/bin/bash
set -e
cp -a ${TB_STAGE_DIR} $distdir/$PKG_DIR

pushd "$TBDIR[% IF c("var/osx") %]/Contents/Resources/[% END %]"
rm -f precomplete
python $MARTOOLS/createprecomplete.py
popd

cd $distdir

[% IF c("var/build_mar") -%]
  # Create full MAR file and compressed package.
  [% SET mar_file = c("var/project-name") _ '-' _ c("var/mar_osname") _ '-' _ c("var/torbrowser_version") _ '_${PKG_LOCALE}.mar' %]
  MAR=$MARTOOLS/mar \
  MOZ_PRODUCT_VERSION=[% c("var/torbrowser_version") %] \
  MAR_CHANNEL_ID=torbrowser-torproject-[% c("var/channel") %] \
  $MARTOOLS/make_full_update.sh -q $OUTDIR/[% mar_file %] "$TBDIR"
[% END -%]

[% IF c("var/linux") %]
  [% c('tar', {
        tar_src => [ '$PKG_DIR' ],
        tar_args => '-cJf $OUTDIR/' _ c("var/project-name") _ '-' _ c("var/mar_osname") _ '-' _ c("var/torbrowser_version") _ '_${PKG_LOCALE}.tar.xz',
    }) %]
[% ELSIF c("var/osx") %]
  [% c('var/ddmg', {
        dmg_src => '"$PKG_DIR"',
        dmg_out => '$OUTDIR/' _ c('var/ProjectName') _ '-' _ c("var/torbrowser_version") _ '-osx64_${PKG_LOCALE}.dmg',
    }) %]
[% ELSIF c("var/windows") %]
  find "$PKG_DIR" -exec [% c("touch") %] {} \;
  pushd "$PKG_DIR"
  makensis [% c("var/projectname") %].nsi
  # Working around NSIS braindamage
  mv [% c("var/projectname") %]-install.exe browser-install-tmp.exe
  python3 $rootdir/pe_checksum_fix.py
  mv browser-install-tmp2.exe [% c("var/projectname") %]-install.exe
  rm browser-install-tmp.exe
  mv [% c("var/projectname") %]-install.exe $OUTDIR/[% c("var/projectname") %]-install[% IF c("var/windows-x86_64") %]-win64[% END %]-[% c("var/torbrowser_version") %]_${PKG_LOCALE}.exe
  popd
[% END %]
rm -rf $distdir/${PKG_DIR}
SCRIPT_EOF

cp $rootdir/[% c('input_files_by_name/firefox') %]/mar-tools-*.zip "$OUTDIR"/
[% IF c("var/linux-x86_64") -%]
  [% IF c("var/tor-browser") -%]
    cp $rootdir/[% c('input_files_by_name/firefox') %]/browser-debug.tar.xz "$OUTDIR"/[% c("var/project-name") %]-[% c("var/mar_osname") %]-debug.tar.xz
  [% END -%]
  [% IF !c("var/asan") -%]
    cp $rootdir/[% c('input_files_by_name/firefox') %]/geckodriver-linux64.tar.xz "$OUTDIR"/
  [% END -%]
[% END -%]
[% IF c("var/linux") && c("var/tor-browser") -%]
  cp $rootdir/[% c('input_files_by_name/tor') %]/tor-debug.tar.xz "$OUTDIR"/tor-[% c("var/mar_osname") %]-debug.tar.xz
[% END -%]
[% IF c("var/build_infos_json") -%]
  cp $rootdir/[% c('input_files_by_name/firefox') %]/build-infos.json "$OUTDIR"/build-infos-[% c("var/mar_osname") %].json
[% END -%]

# Create a tarball with all Linux x86_64 language packs (Bug 32676)
[% IF c("var/tor-browser") && c("var/linux-x86_64") && ! c("var/multi_lingual") && ! c("var/testbuild") -%]
  pushd $rootdir/[% c('input_files_by_name/firefox-langpacks') %]
  [% c('tar', {
           tar_src => [ '.' ],
           tar_args => '-cJf $OUTDIR/langpacks-tor-browser-linux64-' _ c("var/torbrowser_version") _ '.tar.xz',
     })
  %]
  popd
[% END -%]

# If we did not create a multi-lingual package above, create a package for
# each locale.
[% IF ! c("var/multi_lingual") %]
  [% SET locales = c("var/testbuild") ? [] : c("var/locales") -%]
  [% FOREACH lang = locales %]
    [% SET lang = tmpl(lang);
       SET xpi = '$rootdir/' _ c('input_files_by_name/firefox-langpacks') _ '/' _ lang _ '.xpi';
       SET tbdir = '$distdir/' _ c("var/project-name") _ '_' _ lang;
       SET mar_file = c("var/project-name") _ '-' _ c("var/mar_osname") _ '-' _ c("var/torbrowser_version") _ '_' _ lang _ '.mar';
       IF c("var/osx");
         SET browserdir = tbdir _ '/' _ c("var/Project_Name") _ '.app';
       ELSIF c("var/windows");
         SET browserdir = tbdir _ '/' _ c("var/Project_Name") _ '/Browser';
       ELSE;
         SET browserdir = tbdir _ '/Browser';
       END;
       SET build_mar = c("var/build_mar");
       # On nightly we only build mar files for some locales
       IF c("var/nightly") && c("var/build_mar");
         build_mar = 0;
         FOREACH mar_lang = c("var/mar_locales");
           mar_lang = tmpl(mar_lang);
           IF mar_lang == lang;
             build_mar = 1;
           END;
         END;
       END;
    %]
      cat > "$scripts_dir/create-browser_[% lang %]" << SCRIPT_EOF
#!/bin/bash
      set -e
      cp -a ${TB_STAGE_DIR} [% tbdir %]
      cp [% xpi %] "[% browserdir %]/$EXTSPATH/langpack-[% lang %]@firefox.mozilla.org.xpi"

      pushd "[% browserdir %]/[% IF c("var/osx") %]Contents/Resources/[% END %]browser/"
      mkdir -p defaults/preferences
      cp $rootdir/[% c("var/prefs_file") %] defaults/preferences/
      # Set the locale of the bundle.
      echo "pref(\"intl.locale.requested\", \"[% lang %]\");" >> defaults/preferences/[% c("var/prefs_file") %]
      [% c("touch") %] defaults/preferences/[% c("var/prefs_file") %]
      zip -Xm omni.ja defaults/preferences/[% c("var/prefs_file") %]
      rm -rf defaults
      # create tbb_version.json file for #25020
      echo '{"version":"[% c("var/torbrowser_version") %]","architecture":"[% c("var/mar_osname") %]","channel":"[% c("var/channel") %]","locale":"[% lang %]"}' > ../tbb_version.json
      popd

      # Set the update.locale (it is used to replace %LOCALE% within
      # app.update.url), remove the en-US spellchecking dictionary, and
      # recreate precomplete file (needs to be accurate for full MAR updates).
      pushd "[% browserdir %]/[% IF c("var/osx") %]Contents/Resources/[% END %]"
      echo "[% lang %]" > update.locale
      [% c("touch") %] update.locale
      zip -Xm omni.ja update.locale
      rm -rf dictionaries
      rm -f precomplete
      python $MARTOOLS/createprecomplete.py
      popd

      cd $distdir

      [% IF build_mar -%]
        # Create full MAR file and compressed package for this locale.
        MAR=$MARTOOLS/mar \
        MOZ_PRODUCT_VERSION=[% c("var/torbrowser_version") %] \
        MAR_CHANNEL_ID=torbrowser-torproject-[% c("var/channel") %] \
        $MARTOOLS/make_full_update.sh -q $OUTDIR/[% mar_file %] "[% browserdir %]"
      [% END -%]

      [% IF c("var/linux") %]
        [% SET tardir = c("var/project-name") _ '_' _ lang;
          c('tar', {
                tar_src => [ tardir ],
                tar_args => '-cJf $OUTDIR/' _ c("var/project-name") _ '-' _ c("var/mar_osname") _ '-' _ c("var/torbrowser_version") _ '_' _ lang _ '.tar.xz',
            }) %]
      [% ELSIF c("var/osx") %]
        [% # Rename the Japanese bundle to not confuse users
           IF lang == 'ja-JP-mac';
             SET lang = 'ja';
           END; -%]
        [% c('var/ddmg', {
          dmg_src => tbdir,
          dmg_out => '$OUTDIR/' _ c('var/ProjectName') _ '-' _ c("var/torbrowser_version") _ '-osx64_' _ lang _ '.dmg',
        }) %]
      [% ELSIF c("var/windows") %]
        find "[% tbdir %]" -exec [% c("touch") %] {} \;
        pushd "[% tbdir %]"
        makensis [% c("var/projectname") %].nsi
        # Working around NSIS braindamage
        mv [% c("var/projectname") %]-install.exe browser-install-tmp.exe
        python3 $rootdir/pe_checksum_fix.py
        mv browser-install-tmp2.exe [% c("var/projectname") %]-install.exe
        rm browser-install-tmp.exe
        mv [% c("var/projectname") %]-install.exe $OUTDIR/[% c("var/projectname") %]-install[% IF c("var/windows-x86_64") %]-win64[% END %]-[% c("var/torbrowser_version") %]_[% lang %].exe
        popd
      [% END %]
      rm -rf [% tbdir %]
SCRIPT_EOF
  [% END %]
[% END %]

chmod 775 $rootdir/run_scripts "$scripts_dir"/*
$rootdir/run_scripts [% c("num_procs") %] "$scripts_dir"

repo_name: JeremyRand/tor

path: projects/browser/build

license: mit


code:
#!/bin/bash
[% c("var/set_default_env") -%]
[% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %]
assets_dir=assets
ext_dir=$assets_dir/extensions
qa_apk=[% dest_dir %]/[% c('filename') %]/[% c("var/project-name") %]-[% c("version") %]-[% c("var/osname") %]-multi-qa.apk
apk=$rootdir/fenix/app-[% c("var/abi") %]-*.apk
test_out_apk=[% dest_dir %]/[% c('filename') %]/[% c("var/project-name") %]-[% c("version") %]-[% c("var/osname") %]-androidTest.apk
test_in_apk=$rootdir/fenix/app-*-androidTest.apk

tar xavf $rootdir/[% c('input_files_by_name/fenix') %]

# Bundle our extensions. We treat HTTPS-Everywhere and NoScript differently as
# the former should be an internal extension without getting any updates besides
# from Tor Browser releases. NoScript will be copied over to the profile folder
# being a "regular" browser extension.
mkdir -p /var/tmp/build/$ext_dir [% dest_dir _ '/' _ c('filename') %]
cd /var/tmp/build
unzip -d $ext_dir/https-everywhere $rootdir/[% c('input_files_by_name/https-everywhere') %]
mv $rootdir/[% c('input_files_by_name/noscript') %] $ext_dir/{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi

[% IF c("var/verify_allowed_addons") %]
  # Check that allowed_addons.json contains the right versions of NoScript and HTTPS Everywhere
  # If so, replace the default allowed_addons.json by ours in the apk assets folder.
  $rootdir/verify_allowed_addons.py "$rootdir/allowed_addons.json" "$ext_dir/{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi" "$rootdir/[% c('input_files_by_name/https-everywhere') %]"
[% END %]

mv $rootdir/allowed_addons.json $assets_dir/allowed_addons.json

[% c('zip', {
        zip_src => [ '$assets_dir' ],
        zip_args => '$apk',
    }) %]

aligned_apk=$(basename $apk .apk)_aligned.apk
zipalign -vp 4 $apk $aligned_apk

# Sign a QA build. This .apk is not a debug version and doesn't contain a debug
# flag in the manifest.
apksigner sign --verbose --min-sdk-version [% c("var/android_min_api") %] --ks $rootdir/android-qa.keystore --out $qa_apk --in $aligned_apk --ks-key-alias androidqakey --key-pass pass:android --ks-pass pass:android

apksigner sign --verbose --min-sdk-version [% c("var/android_min_api") %] --ks $rootdir/android-qa.keystore --out $test_out_apk --in $test_in_apk  --ks-key-alias androidqakey --key-pass pass:android --ks-pass pass:android


code:
# vim: filetype=yaml sw=2
version: '[% c("var/torbrowser_version") %]'
filename: '[% c("var/project-name") %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]'
container:
  use_container: 1

var:
  ddmg: '[% INCLUDE ddmg.sh %]'
  deps:
    - python
    - libparallel-forkmanager-perl
    - libfile-slurp-perl
    - zip
    - unzip
    - bzip2
    - xz-utils
    - patch

targets:
  linux-i686:
    var:
      mar_osname: linux32
      arch_deps:
        # Install libc6-i386 to be able to run 32bit mar tools (bug 29812)
        - libc6-i386
  linux-x86_64:
    var:
      mar_osname: linux64
  osx-x86_64:
    var:
      mar_osname: osx64
      arch_deps:
        - genisoimage
        - faketime
  windows:
    var:
      arch_deps:
        - python3-pefile
  windows-i686:
    var:
      mar_osname: win32
  windows-x86_64:
    var:
      mar_osname: win64
  android:
    build: '[% INCLUDE build.android %]'
    var:
      verify_allowed_addons: 1
  torbrowser:
    var:
      prefs_file: 000-tor-browser.js
  basebrowser:
    var:
      prefs_file: 001-base-profile.js

input_files:
  - project: container-image
  - filename: run_scripts
    enable: '[% ! c("var/android") %]'
  - project: firefox
    name: firefox
    enable: '[% ! c("var/android") %]'
  - project: fenix
    name: fenix
    enable: '[% c("var/android") %]'
  - project: tor
    name: tor
    enable: '[% ! c("var/android") && c("var/tor-browser") %]'
  - project: firefox-langpacks
    name: firefox-langpacks
    enable: '[% ! c("var/testbuild") && ! c("var/android") %]'
  - project: https-everywhere
    name: https-everywhere
    enable: '[% c("var/android") %]'
  - project: fonts
    name: fonts
    enable: '[% ! c("var/android") %]'
  - project: obfs4
    name: obfs4
    enable: '[% ! c("var/android") && c("var/tor-browser") %]'
  - project: snowflake
    name: snowflake
    enable: '[% ! c("var/android") && c("var/tor-browser") %]'
  - filename: Bundle-Data
    enable: '[% ! c("var/android") %]'
  - URL: https://addons.mozilla.org/firefox/downloads/file/3954910/noscript-11.4.6.xpi
    name: noscript
    sha256sum: 5f917e54a52d7269959976ebb6eb41f1a14c047c30d5f7bd6a401fe4126f0b3a
  - filename: 'gtk3-settings.ini'
    enable: '[% c("var/linux") %]'
  - project: libdmg-hfsplus
    name: libdmg
    enable: '[% c("var/osx") %]'
  - project: nsis
    name: nsis
    enable: '[% c("var/windows") %]'
  - filename: windows-installer
    enable: '[% c("var/windows") %]'
  - filename: pe_checksum_fix.py
    enable: '[% c("var/windows") %]'
  # To generate a new keystore, see how-to-generate-keystore.txt
  - filename: android-qa.keystore
    enable: '[% c("var/android") %]'
  - name: '[% c("var/compiler") %]'
    project: '[% c("var/compiler") %]'
    enable: '[% c("var/android") %]'
  - name: electrum-nmc
    project: electrum-nmc
    enable: '[% c("var/namecoin") %]'
  - name: ncprop279
    project: ncprop279
    enable: '[% c("var/namecoin") %]'
  - name: stemns
    project: stemns
    enable: '[% c("var/namecoin") %]'
  - filename: namecoin.patch
    enable: '[% c("var/namecoin") %]'
  - filename: allowed_addons.json
    enable: '[% c("var/android") %]'
  - filename: verify_allowed_addons.py
    enable: '[% c("var/android") && c("var/verify_allowed_addons") %]'
  - filename: bridges_list.obfs4.txt
    enable: '[% ! c("var/android") && c("var/tor-browser") %]'
  - filename: bridges_list.meek-azure.txt
    enable: '[% ! c("var/android") && c("var/tor-browser") %]'
  - filename: bridges_list.snowflake.txt
    enable: '[% ! c("var/android") && c("var/tor-browser") %]'
  - project: manual
    name: manual
    enable: '[% ! c("var/android") && c("var/tor-browser") %]'

path: projects/browser/config


code:
[% SET src = c('dmg_src', { error_if_undef => 1 }) -%]
find [% src %] -executable -exec chmod 0755 {} \;
find [% src %] ! -executable -exec chmod 0644 {} \;

find [% src %] -exec [% c("touch") %] {} \;

dmg_tmpdir=\$(mktemp -d)
[% SET filelist = '"\$dmg_tmpdir/filelist.txt"' %]
pushd [% src %]
find . -type f | sed -e 's/^\.\///' | sort | xargs -i echo "{}={}" > [% filelist %]
find . -type l | sed -e 's/^\.\///' | sort | xargs -i echo "{}={}" >> [% filelist %]

export LD_PRELOAD=[% c("var/faketime_path") %]
export FAKETIME="[% USE date; GET date.format(c('timestamp'), format = '%Y-%m-%d %H:%M:%S') %]"

genisoimage -D -V "Tor Browser" -no-pad -R -apple -o "\$dmg_tmpdir/tbb-uncompressed.dmg" -path-list [% filelist %] -graft-points -gid 20 -dir-mode 0755 -new-dir-mode 0755

dmg dmg "\$dmg_tmpdir/tbb-uncompressed.dmg" [% c('dmg_out', { error_if_undef => 1 }) %]
popd

rm -Rf "\$dmg_tmpdir"


code:
[Settings]
gtk-primary-button-warps-slider = false


code:
To generate a new keystore, type the following command:

keytool -genkey -v -keystore android-qa.keystore -storepass android -alias androidqakey -keypass android -keyalg RSA -keysize 2048 -validity 10000 -dname "CN=Android Tor QA,O=Tor,C=US"


code:
diff -ru RelativeLink/start-tor-browser RelativeLinkNamecoin/start-tor-browser
--- RelativeLink/start-tor-browser	2019-11-03 06:56:36.062938844 +0000
+++ RelativeLinkNamecoin/start-tor-browser	2019-12-13 12:00:58.000000000 +0000
@@ -169,6 +169,11 @@
     detach=0
 fi

+# We can't detach and enable Namecoin at the same time..
+if [ "$TOR_ENABLE_NAMECOIN" = 1 -a "$detach" -eq 1 ]; then
+    detach=0
+fi
+
 if [ "$show_output" -eq 0 ]; then
     # If the user hasn't requested 'debug mode' or --help, close stdout and stderr,
     # to keep Firefox and the stuff loaded by/for it (including the
@@ -352,6 +357,55 @@
 #
 # The --class parameter was added to fix bug 11102.

+# The Namecoin support in this script is a placeholder proof-of-concept only.
+# In the real world this would be moved to Tor Launcher.
+terminate_namecoin () {
+    echo "Terminating Namecoin..."
+    kill ${ELECTRUM_NMC_PID}
+    kill -s SIGKILL ${STEM_NS_PID}
+    echo "Terminated Namecoin."
+}
+if [ "${TOR_ENABLE_NAMECOIN}" = 1 ]; then
+    python3 -c 'import sys; exit(0) if sys.version_info[:2] >= (3, 6) else exit(1)'
+    if [ "$?" -ne 0 ]; then
+        complain "Namecoin requires at least Python 3.6."
+        exit 1
+    fi
+
+    if [ "$show_usage" -eq 1 ]; then
+        # No help exists for Namecoin
+        TOR_ENABLE_NAMECOIN=0
+    elif [ "$detach" -eq 1 ] ; then
+        # No support yet for detached Namecoin
+        TOR_ENABLE_NAMECOIN=0
+    elif [ "$log_output" -eq 1 -a "$show_output" -eq 1 ]; then
+        # No support yet for logging Namecoin
+        TOR_ENABLE_NAMECOIN=0
+    elif [ "$show_output" -eq 1 ]; then
+        # Launch Namecoin in verbose mode
+        echo "Launching Namecoin..."
+        trap terminate_namecoin SIGINT SIGTERM
+        grep --quiet "__LeaveStreamsUnattached 1" TorBrowser/Data/Tor/torrc-defaults || echo "__LeaveStreamsUnattached 1" >> TorBrowser/Data/Tor/torrc-defaults
+        TorBrowser/Electrum-NMC/run_electrum_nmc daemon -v --dir "TorBrowser/Data/Electrum-NMC/" &
+        ELECTRUM_NMC_PID=$!
+        python3 TorBrowser/StemNS/poc.py &
+        STEM_NS_PID=$!
+        echo "Launched Namecoin."
+    else
+        # Launch Namecoin
+        trap terminate_namecoin SIGINT SIGTERM
+        grep --quiet "__LeaveStreamsUnattached 1" TorBrowser/Data/Tor/torrc-defaults || echo "__LeaveStreamsUnattached 1" >> TorBrowser/Data/Tor/torrc-defaults
+        TorBrowser/Electrum-NMC/run_electrum_nmc daemon --dir "TorBrowser/Data/Electrum-NMC/" &
+        ELECTRUM_NMC_PID=$!
+        python3 TorBrowser/StemNS/poc.py &
+        STEM_NS_PID=$!
+    fi
+fi
+
+if [ "${TOR_ENABLE_NAMECOIN}" != 1 ]; then
+    perl -i -p -e 's/__LeaveStreamsUnattached 1\n//' TorBrowser/Data/Tor/torrc-defaults
+fi
+
 if [ "$show_usage" -eq 1 ]; then
     # Display Firefox help, then our help
     TOR_CONTROL_PASSWD=${TOR_CONTROL_PASSWD} ./firefox --class "Tor Browser" \
@@ -373,4 +427,10 @@
         -profile TorBrowser/Data/Browser/profile.default "${@}" > "$logfile" 2>&1 </dev/null
 fi

-exit $?
+FIREFOX_EXIT_CODE=$?
+
+if [ "${TOR_ENABLE_NAMECOIN}" = 1 ]; then
+    terminate_namecoin
+fi
+
+exit ${FIREFOX_EXIT_CODE}


code:
#!/usr/bin/env python3

# Copyright (c) 2015-2017, The Tor Project, Inc.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are
# met:
#
#     * Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
#
#     * Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following disclaimer
# in the documentation and/or other materials provided with the
# distribution.
#
#     * Neither the names of the copyright owners nor the names of its
# contributors may be used to endorse or promote products derived from
# this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

"""
NSIS is neither padding nor calculating the PE-file checksum. But the tool
we use for signing and the tools for stripping the signature do which leads to a
SHA256 mismatch if one tries to check that the binary we offer is actually the
the one we got from our reproducible builds.

This small Python snippet does both things: It pads the .exe if necessary and it
recalculates the PE-file checksum. Details of the discussion can be found in bug
15339: https://bugs.torproject.org/15539.

Thanks to a cypherpunk for this workaround idea.
"""

import pefile;

f = open('browser-install-tmp.exe', 'rb')
exe = f.read()
f.close()
remainder = len(exe) % 8
if remainder > 0:
    exe += bytes('\0' * (8 - remainder), 'utf-8')
pef = pefile.PE(data=exe, fast_load=True)
pef.OPTIONAL_HEADER.CheckSum = pef.generate_checksum()
pef.write(filename='browser-install-tmp2.exe')


code:
#!/usr/bin/perl -w
use strict;

use Parallel::ForkManager;
use File::Slurp;

sub exit_error {
    print STDERR "Error: ", $_[0], "\n";
    chdir '/';
    exit (exists $_[1] ? $_[1] : 1);
}

exit_error "Wrong number of arguments" unless @ARGV == 2;
my ($nb_threads, $scripts_dir) = @ARGV;
exit_error "Could not enter $scripts_dir" unless chdir $scripts_dir;
my $pm = Parallel::ForkManager->new($nb_threads);
$pm->run_on_finish(
    sub {
        my ($pid, $exit, $id) = @_;
        exit_error "Error running $id" unless $exit == 0;
        print "Finished $id\n";
    }
);
foreach my $script (sort(read_dir($scripts_dir))) {
    $pm->start($script) and next;
    print "Running $script\n";
    exit_error "Error running $script" unless system("./$script") == 0;
    $pm->finish;
}
$pm->wait_all_children;


code:
#!/usr/bin/env python

import json
import sys
import hashlib
import zipfile

def find_addon(addons, addon_id):
  results = addons['results']
  for x in results:
    addon = x['addon']
    if addon['guid'] == addon_id:
      return addon
  sys.exit("Error: cannot find addon " + addon_id)

def verify_extension_version(addons, addon_id, version):
  addon = find_addon(addons, addon_id)
  expected_version = addon['current_version']['version']
  if version != expected_version:
    sys.exit("Error: version " + version + " != " + expected_version)

def verify_extension_hash(addons, addon_id, hash):
  addon = find_addon(addons, addon_id)
  expected_hash = addon["current_version"]["files"][0]["hash"]
  if hash != expected_hash:
    sys.exit("Error: hash " + hash + " != " + expected_hash)

def read_extension_manifest(path):
  return json.loads(zipfile.ZipFile(path, 'r').read('manifest.json'))

def main(argv):
  allowed_addons_path = argv[0]
  noscript_path = argv[1]
  https_everywhere_path = argv[2]

  addons = None
  with open(allowed_addons_path, 'r') as file:
    addons = json.loads(file.read())

  noscript_hash = None
  with open(noscript_path, 'rb') as file:
    noscript_hash = "sha256:" + hashlib.sha256(file.read()).hexdigest()

  noscript_version = read_extension_manifest(noscript_path)["version"]
  https_everywhere_version = read_extension_manifest(https_everywhere_path)["version"]

  verify_extension_hash(addons, '{73a6fe31-595d-460b-a920-fcc0f8843232}', noscript_hash)
  verify_extension_version(addons, '{73a6fe31-595d-460b-a920-fcc0f8843232}', noscript_version)
  verify_extension_version(addons, 'https-everywhere-eff@eff.org', https_everywhere_version)

if __name__ == "__main__":
   main(sys.argv[1:])


code:
;NSIS Installer for Base Browser Bundle
;Written by Moritz Bartl
;released under Public Domain

;--------------------------------
;Modern" UI

  !include "MUI2.nsh"
  !include "LogicLib.nsh"
  !include "WinVer.nsh"

;--------------------------------
;General

  ; location of Base Browser bundle to put into installer
  !define TBBSOURCE ".\Base Browser\"

  Name "Base Browser"
  OutFile "basebrowser-install.exe"

  ;Default installation folder
  InstallDir "$DESKTOP\Base Browser"

  ;Best (but slowest) compression
  SetCompressor /SOLID lzma
  SetCompressorDictSize 32

  ;Request application privileges for Windows Vista
  RequestExecutionLevel user

;--------------------------------
;Interface Configuration

  !define MUI_ICON   "basebrowser.ico"
  !define MUI_ABORTWARNING

;--------------------------------
;Modern UI settings
  !define MUI_FINISHPAGE_NOREBOOTSUPPORT     ; we don't require a reboot
  !define MUI_FINISHPAGE_RUN
  !define MUI_FINISHPAGE_RUN_FUNCTION "StartBaseBrowser"
  !define MUI_FINISHPAGE_SHOWREADME ; misuse for option to create shortcut; less ugly than MUI_PAGE_COMPONENTS
  !define MUI_FINISHPAGE_SHOWREADME_TEXT "&Add Start Menu && Desktop shortcuts"
  !define MUI_FINISHPAGE_SHOWREADME_FUNCTION "CreateShortCuts"
;--------------------------------
;Pages

  !define MUI_PAGE_CUSTOMFUNCTION_LEAVE CheckIfTargetDirectoryExists
  !insertmacro MUI_PAGE_DIRECTORY
  !insertmacro MUI_PAGE_INSTFILES
  !insertmacro MUI_PAGE_FINISH

;--------------------------------
;Languages

  !insertmacro MUI_LANGUAGE "English" ;first language is the default language
  !insertmacro MUI_LANGUAGE "French"
  !insertmacro MUI_LANGUAGE "German"
  !insertmacro MUI_LANGUAGE "Spanish"
  !insertmacro MUI_LANGUAGE "SpanishInternational"
  !insertmacro MUI_LANGUAGE "SimpChinese"
  !insertmacro MUI_LANGUAGE "TradChinese"
  !insertmacro MUI_LANGUAGE "Japanese"
  !insertmacro MUI_LANGUAGE "Korean"
  !insertmacro MUI_LANGUAGE "Italian"
  !insertmacro MUI_LANGUAGE "Dutch"
  !insertmacro MUI_LANGUAGE "Danish"
  !insertmacro MUI_LANGUAGE "Swedish"
  !insertmacro MUI_LANGUAGE "Norwegian"
  !insertmacro MUI_LANGUAGE "NorwegianNynorsk"
  !insertmacro MUI_LANGUAGE "Finnish"
  !insertmacro MUI_LANGUAGE "Greek"
  !insertmacro MUI_LANGUAGE "Russian"
  !insertmacro MUI_LANGUAGE "Portuguese"
  !insertmacro MUI_LANGUAGE "PortugueseBR"
  !insertmacro MUI_LANGUAGE "Polish"
  !insertmacro MUI_LANGUAGE "Ukrainian"
  !insertmacro MUI_LANGUAGE "Czech"
  !insertmacro MUI_LANGUAGE "Slovak"
  !insertmacro MUI_LANGUAGE "Croatian"
  !insertmacro MUI_LANGUAGE "Bulgarian"
  !insertmacro MUI_LANGUAGE "Hungarian"
  !insertmacro MUI_LANGUAGE "Thai"
  !insertmacro MUI_LANGUAGE "Romanian"
  !insertmacro MUI_LANGUAGE "Latvian"
  !insertmacro MUI_LANGUAGE "Macedonian"
  !insertmacro MUI_LANGUAGE "Estonian"
  !insertmacro MUI_LANGUAGE "Turkish"
  !insertmacro MUI_LANGUAGE "Lithuanian"
  !insertmacro MUI_LANGUAGE "Slovenian"
  !insertmacro MUI_LANGUAGE "Serbian"
  !insertmacro MUI_LANGUAGE "SerbianLatin"
  !insertmacro MUI_LANGUAGE "Arabic"
  !insertmacro MUI_LANGUAGE "Farsi"
  !insertmacro MUI_LANGUAGE "Hebrew"
  !insertmacro MUI_LANGUAGE "Indonesian"
  !insertmacro MUI_LANGUAGE "Mongolian"
  !insertmacro MUI_LANGUAGE "Luxembourgish"
  !insertmacro MUI_LANGUAGE "Albanian"
  !insertmacro MUI_LANGUAGE "Breton"
  !insertmacro MUI_LANGUAGE "Belarusian"
  !insertmacro MUI_LANGUAGE "Icelandic"
  !insertmacro MUI_LANGUAGE "Malay"
  !insertmacro MUI_LANGUAGE "Bosnian"
  !insertmacro MUI_LANGUAGE "Kurdish"
  !insertmacro MUI_LANGUAGE "Irish"
  !insertmacro MUI_LANGUAGE "Uzbek"
  !insertmacro MUI_LANGUAGE "Galician"
  !insertmacro MUI_LANGUAGE "Afrikaans"
  !insertmacro MUI_LANGUAGE "Catalan"
  !insertmacro MUI_LANGUAGE "Esperanto"

;--------------------------------
;Multi Language support: Read strings from separate file

; !include torbrowser-langstrings.nsi

;--------------------------------
;Reserve Files

  ;If you are using solid compression, files that are required before
  ;the actual installation should be stored first in the data block,
  ;because this will make your installer start faster.

  !insertmacro MUI_RESERVEFILE_LANGDLL

;--------------------------------
;Installer Sections

Section "Base Browser Bundle" SecTBB

  SetOutPath "$INSTDIR"
  File /r "${TBBSOURCE}\*.*"
  SetOutPath "$INSTDIR\Browser"
  CreateShortCut "$INSTDIR\Start Base Browser.lnk" "$INSTDIR\Browser\firefox.exe"

SectionEnd

Function CreateShortcuts

  CreateShortCut "$SMPROGRAMS\Start Base Browser.lnk" "$INSTDIR\Browser\firefox.exe"
  CreateShortCut "$DESKTOP\Start Base Browser.lnk" "$INSTDIR\Browser\firefox.exe"

FunctionEnd
;--------------------------------
;Installer Functions

Function .onInit

  ${IfNot} ${AtLeastWin7}
    MessageBox MB_USERICON|MB_OK "Base Browser requires at least Windows 7"
    SetErrorLevel 1
    Quit
  ${EndIf}

  ; Don't install on systems that don't support SSE2. The parameter value of
  ; 10 is for PF_XMMI64_INSTRUCTIONS_AVAILABLE which will check whether the
  ; SSE2 instruction set is available.
  System::Call "kernel32::IsProcessorFeaturePresent(i 10)i .R7"

  ${If} "$R7" == "0"
    MessageBox MB_OK|MB_ICONSTOP "Sorry, Base Browser can't be installed. This version of Base Browser requires a processor with SSE2 support."
    Abort
  ${EndIf}

  !insertmacro MUI_LANGDLL_DISPLAY

FunctionEnd

;--------------------------------
;Helper Functions

Function CheckIfTargetDirectoryExists
${If} ${FileExists} "$INSTDIR\*.*"
 MessageBox MB_YESNO "The destination directory already exists. You can try to upgrade the Base Browser Bundle, but if you run into any problems, use a new directory instead. Continue?" IDYES NoAbort
   Abort
 NoAbort:
${EndIf}
FunctionEnd

Function StartBaseBrowser
ExecShell "open" "$INSTDIR/Start Base Browser.lnk"
FunctionEnd


code:
;NSIS Installer for Tor Browser Bundle
;Written by Moritz Bartl
;released under Public Domain

;--------------------------------
;Modern" UI

  !include "MUI2.nsh"
  !include "LogicLib.nsh"
  !include "WinVer.nsh"

;--------------------------------
;General

  ; location of Tor Browser bundle to put into installer
  !define TBBSOURCE ".\Tor Browser\"

  Name "Tor Browser"
  OutFile "torbrowser-install.exe"

  ;Default installation folder
  InstallDir "$DESKTOP\Tor Browser"

  ;Best (but slowest) compression
  SetCompressor /SOLID lzma
  SetCompressorDictSize 32

  ;Request application privileges for Windows Vista
  RequestExecutionLevel user

;--------------------------------
;Interface Configuration

  !define MUI_ICON   "torbrowser.ico"
  !define MUI_ABORTWARNING

;--------------------------------
;Modern UI settings
  !define MUI_FINISHPAGE_NOREBOOTSUPPORT     ; we don't require a reboot
  !define MUI_FINISHPAGE_RUN
  !define MUI_FINISHPAGE_RUN_FUNCTION "StartTorBrowser"
  !define MUI_FINISHPAGE_SHOWREADME ; misuse for option to create shortcut; less ugly than MUI_PAGE_COMPONENTS
  !define MUI_FINISHPAGE_SHOWREADME_TEXT "&Add Start Menu && Desktop shortcuts"
  !define MUI_FINISHPAGE_SHOWREADME_FUNCTION "CreateShortCuts"
;--------------------------------
;Pages

  !define MUI_PAGE_CUSTOMFUNCTION_LEAVE CheckIfTargetDirectoryExists
  !insertmacro MUI_PAGE_DIRECTORY
  !insertmacro MUI_PAGE_INSTFILES
  !insertmacro MUI_PAGE_FINISH

;--------------------------------
;Languages

  !insertmacro MUI_LANGUAGE "English" ;first language is the default language
  !insertmacro MUI_LANGUAGE "French"
  !insertmacro MUI_LANGUAGE "German"
  !insertmacro MUI_LANGUAGE "Spanish"
  !insertmacro MUI_LANGUAGE "SpanishInternational"
  !insertmacro MUI_LANGUAGE "SimpChinese"
  !insertmacro MUI_LANGUAGE "TradChinese"
  !insertmacro MUI_LANGUAGE "Japanese"
  !insertmacro MUI_LANGUAGE "Korean"
  !insertmacro MUI_LANGUAGE "Italian"
  !insertmacro MUI_LANGUAGE "Dutch"
  !insertmacro MUI_LANGUAGE "Danish"
  !insertmacro MUI_LANGUAGE "Swedish"
  !insertmacro MUI_LANGUAGE "Norwegian"
  !insertmacro MUI_LANGUAGE "NorwegianNynorsk"
  !insertmacro MUI_LANGUAGE "Finnish"
  !insertmacro MUI_LANGUAGE "Greek"
  !insertmacro MUI_LANGUAGE "Russian"
  !insertmacro MUI_LANGUAGE "Portuguese"
  !insertmacro MUI_LANGUAGE "PortugueseBR"
  !insertmacro MUI_LANGUAGE "Polish"
  !insertmacro MUI_LANGUAGE "Ukrainian"
  !insertmacro MUI_LANGUAGE "Czech"
  !insertmacro MUI_LANGUAGE "Slovak"
  !insertmacro MUI_LANGUAGE "Croatian"
  !insertmacro MUI_LANGUAGE "Bulgarian"
  !insertmacro MUI_LANGUAGE "Hungarian"
  !insertmacro MUI_LANGUAGE "Thai"
  !insertmacro MUI_LANGUAGE "Romanian"
  !insertmacro MUI_LANGUAGE "Latvian"
  !insertmacro MUI_LANGUAGE "Macedonian"
  !insertmacro MUI_LANGUAGE "Estonian"
  !insertmacro MUI_LANGUAGE "Turkish"
  !insertmacro MUI_LANGUAGE "Lithuanian"
  !insertmacro MUI_LANGUAGE "Slovenian"
  !insertmacro MUI_LANGUAGE "Serbian"
  !insertmacro MUI_LANGUAGE "SerbianLatin"
  !insertmacro MUI_LANGUAGE "Arabic"
  !insertmacro MUI_LANGUAGE "Farsi"
  !insertmacro MUI_LANGUAGE "Hebrew"
  !insertmacro MUI_LANGUAGE "Indonesian"
  !insertmacro MUI_LANGUAGE "Mongolian"
  !insertmacro MUI_LANGUAGE "Luxembourgish"
  !insertmacro MUI_LANGUAGE "Albanian"
  !insertmacro MUI_LANGUAGE "Breton"
  !insertmacro MUI_LANGUAGE "Belarusian"
  !insertmacro MUI_LANGUAGE "Icelandic"
  !insertmacro MUI_LANGUAGE "Malay"
  !insertmacro MUI_LANGUAGE "Bosnian"
  !insertmacro MUI_LANGUAGE "Kurdish"
  !insertmacro MUI_LANGUAGE "Irish"
  !insertmacro MUI_LANGUAGE "Uzbek"
  !insertmacro MUI_LANGUAGE "Galician"
  !insertmacro MUI_LANGUAGE "Afrikaans"
  !insertmacro MUI_LANGUAGE "Catalan"
  !insertmacro MUI_LANGUAGE "Esperanto"

;--------------------------------
;Multi Language support: Read strings from separate file

; !include torbrowser-langstrings.nsi

;--------------------------------
;Reserve Files

  ;If you are using solid compression, files that are required before
  ;the actual installation should be stored first in the data block,
  ;because this will make your installer start faster.

  !insertmacro MUI_RESERVEFILE_LANGDLL

;--------------------------------
;Installer Sections

Section "Tor Browser Bundle" SecTBB

  SetOutPath "$INSTDIR"
  File /r "${TBBSOURCE}\*.*"
  SetOutPath "$INSTDIR\Browser"
  CreateShortCut "$INSTDIR\Start Tor Browser.lnk" "$INSTDIR\Browser\firefox.exe"

SectionEnd

Function CreateShortcuts

  CreateShortCut "$SMPROGRAMS\Start Tor Browser.lnk" "$INSTDIR\Browser\firefox.exe"
  CreateShortCut "$DESKTOP\Start Tor Browser.lnk" "$INSTDIR\Browser\firefox.exe"

FunctionEnd
;--------------------------------
;Installer Functions

Function .onInit

  ${IfNot} ${AtLeastWin7}
    MessageBox MB_USERICON|MB_OK "Tor Browser requires at least Windows 7"
    SetErrorLevel 1
    Quit
  ${EndIf}

  ; Don't install on systems that don't support SSE2. The parameter value of
  ; 10 is for PF_XMMI64_INSTRUCTIONS_AVAILABLE which will check whether the
  ; SSE2 instruction set is available.
  System::Call "kernel32::IsProcessorFeaturePresent(i 10)i .R7"

  ${If} "$R7" == "0"
    MessageBox MB_OK|MB_ICONSTOP "Sorry, Tor Browser can't be installed. This version of Tor Browser requires a processor with SSE2 support."
    Abort
  ${EndIf}

  !insertmacro MUI_LANGDLL_DISPLAY

FunctionEnd

;--------------------------------
;Helper Functions

Function CheckIfTargetDirectoryExists
${If} ${FileExists} "$INSTDIR\*.*"
 MessageBox MB_YESNO "The destination directory already exists. You can try to upgrade the Tor Browser Bundle, but if you run into any problems, use a new directory instead. Continue?" IDYES NoAbort
   Abort
 NoAbort:
${EndIf}
FunctionEnd

Function StartTorBrowser
ExecShell "open" "$INSTDIR/Start Tor Browser.lnk"
FunctionEnd


code:
#!/bin/bash
[% c("var/set_default_env") -%]
distdir=/var/tmp/dist
builddir=/var/tmp/build/[% project %]
mkdir -p $distdir/[% project %]
tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/rust') %]
export PATH="/var/tmp/dist/rust/bin:$PATH"
mkdir -p /var/tmp/build
tar -C /var/tmp/build -xf [% project %]-[% c('version') %].tar.gz

# Now prepare the offline build
# Move the directory for hardcoding the path in .cargo/config
mv /var/tmp/build/[% project %]-[% c('version') %] $builddir
tar -C $builddir -xjf cbindgen-vendor-[% c('version') %].tar.bz2
cd $builddir
mkdir .cargo
cat > .cargo/config << 'EOF'
[source.crates-io]
replace-with = "vendored-sources"

[source.vendored-sources]
directory = "/var/tmp/build/cbindgen/vendor"
EOF

cargo build --release --frozen --target x86_64-unknown-linux-gnu
mv target/x86_64-unknown-linux-gnu/release/cbindgen $distdir/[% project %]

cd $distdir
[% c('tar', {
        tar_src => [ project ],
        tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'),
    }) %]

path: projects/cbindgen/build


code:
# vim: filetype=yaml sw=2
version: '[% c("var/cbindgen_version") %]'
git_url: https://github.com/eqrion/cbindgen
git_hash: '[% c("var/cbindgen_hash") %]'
filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1

var:
  cbindgen_version: 0.19.0
  cbindgen_hash: d9e490ce8b836194595bd30611253a7028059da2
  cbindgen_vendor_hash: 7d99c195b180e28ca7499d8744d020b864f952a5ba699716707aec9a06b4ee8b
  cbindgen_vendor_people_tpo_user: boklm

input_files:
  - project: container-image
  - name: rust
    project: rust
  # `cargo vendor vendor` in the `cbindgen` directory has vendored the sources.
  # Use `make cargo_vendor-cbindgen` or `make cargo_vendor-cbindgen-android`
  # (for the Android version) to re-generate the vendor tarball
  - URL: https://people.torproject.org/~[% c('var/cbindgen_vendor_people_tpo_user') %]/mirrors/sources/cbindgen-vendor-[% c('version') %].tar.bz2
    sha256sum: '[% c("var/cbindgen_vendor_hash") %]'

steps:
  cargo_vendor:
    filename: '[% project %]-vendor-[% c("version") %].tar.bz2'
    input_files:
      - project: container-image
        pkg_type: build
      - project: rust
        name: rust
        pkg_type: build

path: projects/cbindgen/config


code:
#!/bin/bash
[% c("var/set_default_env") -%]
distdir=/var/tmp/dist/[% project %]
mkdir -p $distdir
tar -C /var/tmp/dist -xf [% c('input_files_by_name/clang') %]
tar -C /var/tmp/dist -xf [% c('input_files_by_name/libtapi') %]
mv /var/tmp/dist/libtapi/* $distdir
export CLANG_DIR=/var/tmp/dist/clang
mkdir -p /var/tmp/build
tar -C /var/tmp/build -xf [% project %]-[% c('version') %].tar.gz
cd /var/tmp/build/[% project %]-[% c('version') %]/cctools

export CC=$CLANG_DIR/bin/clang
export CXX=$CLANG_DIR/bin/clang++
export LDFLAGS="-lpthread -Wl,-rpath-link,$CLANG_DIR/lib -Wl,-rpath,\\\$\$ORIGIN/../lib,-rpath,\\\$\$ORIGIN/../../clang/lib"
# Force re-libtoolization to overwrite files with the new libtool bits.
perl -pi -e 's/(LIBTOOLIZE -c)/\1 -f/' autogen.sh
./autogen.sh
./configure \
    --prefix=$distdir \
    --target=x86_64-apple-darwin \
    --with-llvm-config=$CLANG_DIR/bin/llvm-config \
    --enable-lto-support \
    --enable-tapi-support \
    --with-libtapi=$distdir

make -j[% c("num_procs") %] install
strip $distdir/bin/*
# cctools doesn't include dsymutil but clang will need to find it.
cp $CLANG_DIR/bin/dsymutil $distdir/bin/x86_64-apple-darwin-dsymutil
# various build scripts based on cmake want to find `lipo` without a prefix
cp $distdir/bin/x86_64-apple-darwin-lipo $distdir/bin/lipo

cd /var/tmp/dist
[% c('tar', {
        tar_src => [ project ],
        tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'),
    }) %]

path: projects/cctools/build


code:
# vim: filetype=yaml sw=2
filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz'
version: '[% c("abbrev") %]'
# This can be found in
# taskcluster/ci/fetch/toolchains.yml
git_hash: 30518813875aed656aa7f18b6d485feee25f8f87
git_url: https://github.com/tpoechtrager/cctools-port
container:
  use_container: 1

input_files:
  - project: container-image
  - name: clang
    project: clang
  - name: libtapi
    project: libtapi

path: projects/cctools/config


code:
#!/bin/bash
[% c("var/set_default_env") -%]

tar xvf [% project %]-[% c('version') %].tar.gz

mkdir -p /var/tmp/dist/
cd /var/tmp/dist/

cp -a $rootdir/[% project %]*/[% project %] ./[% project %]

cp $rootdir/roots_of_top_10_issuers.pem ./[% project %]/cacert.pem

[% c('tar', {
        tar_src => '.',
        tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'),
        }) %]

path: projects/certifi/build


code:
# vim: filetype=yaml sw=2
version: 2019.3.9
filename: "[% project %]-[% c('version') %]-[% c('var/build_id') %].tar.gz"
container:
  use_container: 1

input_files:
  - project: container-image
  - URL: https://files.pythonhosted.org/packages/source/c/certifi/certifi-[% c("version") %].tar.gz
    sha256sum: b26104d6835d1f5e49452a26eb2ff87fe7090b89dfcaee5ea2212697e1e1d7ae
    # TODO: This package uses GPG sigs; we should switch from SHA256 hash to GPG verification.
  - filename: roots_of_top_10_issuers.pem

path: projects/certifi/config


code:
# This file contains the root CA's used by the top 10 HTTPS cert issuers for
# the Alexa Top 1 Million as of February 2019, according to Scott Helme's HTTPS
# issuer list and crt.sh's root CA database.  Each root CA is copied verbatim
# from cacert.pem from certifi-2019.3.9.

# Issuer: CN=DST Root CA X3 O=Digital Signature Trust Co.
# Subject: CN=DST Root CA X3 O=Digital Signature Trust Co.
# Label: "DST Root CA X3"
# Serial: 91299735575339953335919266965803778155
# MD5 Fingerprint: 41:03:52:dc:0f:f7:50:1b:16:f0:02:8e:ba:6f:45:c5
# SHA1 Fingerprint: da:c9:02:4f:54:d8:f6:df:94:93:5f:b1:73:26:38:ca:6a:d7:7c:13
# SHA256 Fingerprint: 06:87:26:03:31:a7:24:03:d9:09:f1:05:e6:9b:cf:0d:32:e1:bd:24:93:ff:c6:d9:20:6d:11:bc:d6:77:07:39
-----BEGIN CERTIFICATE-----
MIIDSjCCAjKgAwIBAgIQRK+wgNajJ7qJMDmGLvhAazANBgkqhkiG9w0BAQUFADA/
MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT
DkRTVCBSb290IENBIFgzMB4XDTAwMDkzMDIxMTIxOVoXDTIxMDkzMDE0MDExNVow
PzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMRcwFQYDVQQD
Ew5EU1QgUm9vdCBDQSBYMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
AN+v6ZdQCINXtMxiZfaQguzH0yxrMMpb7NnDfcdAwRgUi+DoM3ZJKuM/IUmTrE4O
rz5Iy2Xu/NMhD2XSKtkyj4zl93ewEnu1lcCJo6m67XMuegwGMoOifooUMM0RoOEq
OLl5CjH9UL2AZd+3UWODyOKIYepLYYHsUmu5ouJLGiifSKOeDNoJjj4XLh7dIN9b
xiqKqy69cK3FCxolkHRyxXtqqzTWMIn/5WgTe1QLyNau7Fqckh49ZLOMxt+/yUFw
7BZy1SbsOFU5Q9D8/RhcQPGX69Wam40dutolucbY38EVAjqr2m7xPi71XAicPNaD
aeQQmxkqtilX4+U9m5/wAl0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNV
HQ8BAf8EBAMCAQYwHQYDVR0OBBYEFMSnsaR7LHH62+FLkHX/xBVghYkQMA0GCSqG
SIb3DQEBBQUAA4IBAQCjGiybFwBcqR7uKGY3Or+Dxz9LwwmglSBd49lZRNI+DT69
ikugdB/OEIKcdBodfpga3csTS7MgROSR6cz8faXbauX+5v3gTt23ADq1cEmv8uXr
AvHRAosZy5Q6XkjEGB5YGV8eAlrwDPGxrancWYaLbumR9YbK+rlmM6pZW87ipxZz
R8srzJmwN0jP41ZL9c8PDHIyh8bwRLtTcm1D9SZImlJnt1ir/md2cXjbDaJWFBM5
JDGFoqgCWjBH4d1QB7wCCZAA62RjYJsWvIjJEubSfZGL+T0yjWW06XyxV3bqxbYo
Ob8VZRzI9neWagqNdwvYkQsEjgfbKbYK7p2CNTUQ
-----END CERTIFICATE-----

# Issuer: CN=COMODO RSA Certification Authority O=COMODO CA Limited
# Subject: CN=COMODO RSA Certification Authority O=COMODO CA Limited
# Label: "COMODO RSA Certification Authority"
# Serial: 101909084537582093308941363524873193117
# MD5 Fingerprint: 1b:31:b0:71:40:36:cc:14:36:91:ad:c4:3e:fd:ec:18
# SHA1 Fingerprint: af:e5:d2:44:a8:d1:19:42:30:ff:47:9f:e2:f8:97:bb:cd:7a:8c:b4
# SHA256 Fingerprint: 52:f0:e1:c4:e5:8e:c6:29:29:1b:60:31:7f:07:46:71:b8:5d:7e:a8:0d:5b:07:27:34:63:53:4b:32:b4:02:34
-----BEGIN CERTIFICATE-----
MIIF2DCCA8CgAwIBAgIQTKr5yttjb+Af907YWwOGnTANBgkqhkiG9w0BAQwFADCB
hTELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
A1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNV
BAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMTE5
MDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBhTELMAkGA1UEBhMCR0IxGzAZBgNVBAgT
EkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UEChMR
Q09NT0RPIENBIExpbWl0ZWQxKzApBgNVBAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNh
dGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCR
6FSS0gpWsawNJN3Fz0RndJkrN6N9I3AAcbxT38T6KhKPS38QVr2fcHK3YX/JSw8X
pz3jsARh7v8Rl8f0hj4K+j5c+ZPmNHrZFGvnnLOFoIJ6dq9xkNfs/Q36nGz637CC
9BR++b7Epi9Pf5l/tfxnQ3K9DADWietrLNPtj5gcFKt+5eNu/Nio5JIk2kNrYrhV
/erBvGy2i/MOjZrkm2xpmfh4SDBF1a3hDTxFYPwyllEnvGfDyi62a+pGx8cgoLEf
Zd5ICLqkTqnyg0Y3hOvozIFIQ2dOciqbXL1MGyiKXCJ7tKuY2e7gUYPDCUZObT6Z
+pUX2nwzV0E8jVHtC7ZcryxjGt9XyD+86V3Em69FmeKjWiS0uqlWPc9vqv9JWL7w
qP/0uK3pN/u6uPQLOvnoQ0IeidiEyxPx2bvhiWC4jChWrBQdnArncevPDt09qZah
SL0896+1DSJMwBGB7FY79tOi4lu3sgQiUpWAk2nojkxl8ZEDLXB0AuqLZxUpaVIC
u9ffUGpVRr+goyhhf3DQw6KqLCGqR84onAZFdr+CGCe01a60y1Dma/RMhnEw6abf
Fobg2P9A3fvQQoh/ozM6LlweQRGBY84YcWsr7KaKtzFcOmpH4MN5WdYgGq/yapiq
crxXStJLnbsQ/LBMQeXtHT1eKJ2czL+zUdqnR+WEUwIDAQABo0IwQDAdBgNVHQ4E
FgQUu69+Aj36pvE8hI6t7jiY7NkyMtQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB
/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAArx1UaEt65Ru2yyTUEUAJNMnMvl
wFTPoCWOAvn9sKIN9SCYPBMtrFaisNZ+EZLpLrqeLppysb0ZRGxhNaKatBYSaVqM
4dc+pBroLwP0rmEdEBsqpIt6xf4FpuHA1sj+nq6PK7o9mfjYcwlYRm6mnPTXJ9OV
2jeDchzTc+CiR5kDOF3VSXkAKRzH7JsgHAckaVd4sjn8OoSgtZx8jb8uk2Intzna
FxiuvTwJaP+EmzzV1gsD41eeFPfR60/IvYcjt7ZJQ3mFXLrrkguhxuhoqEwWsRqZ
CuhTLJK7oQkYdQxlqHvLI7cawiiFwxv/0Cti76R7CZGYZ4wUAc1oBmpjIXUDgIiK
boHGhfKppC3n9KUkEEeDys30jXlYsQab5xoq2Z0B15R97QNKyvDb6KkBPvVWmcke
jkk9u+UJueBPSZI9FoJAzMxZxuY67RIuaTxslbH9qh17f4a+Hg4yRvv7E491f0yL
S0Zj/gA0QHDBw7mh3aZw4gSzQbzpgJHqZJx64SIDqZxubw5lT2yHh17zbqD5daWb
QOhTsiedSrnAdyGN/4fy3ryM7xfft0kL0fJuMAsaDk527RH89elWsn2/x20Kk4yl
0MC2Hb46TpSi125sC8KKfPog88Tk5c0NqMuRkrF8hey1FGlmDoLnzc7ILaZRfyHB
NVOFBkpdn627G190
-----END CERTIFICATE-----

# Issuer: CN=COMODO ECC Certification Authority O=COMODO CA Limited
# Subject: CN=COMODO ECC Certification Authority O=COMODO CA Limited
# Label: "COMODO ECC Certification Authority"
# Serial: 41578283867086692638256921589707938090
# MD5 Fingerprint: 7c:62:ff:74:9d:31:53:5e:68:4a:d5:78:aa:1e:bf:23
# SHA1 Fingerprint: 9f:74:4e:9f:2b:4d:ba:ec:0f:31:2c:50:b6:56:3b:8e:2d:93:c3:11
# SHA256 Fingerprint: 17:93:92:7a:06:14:54:97:89:ad:ce:2f:8f:34:f7:f0:b6:6d:0f:3a:e3:a3:b8:4d:21:ec:15:db:ba:4f:ad:c7
-----BEGIN CERTIFICATE-----
MIICiTCCAg+gAwIBAgIQH0evqmIAcFBUTAGem2OZKjAKBggqhkjOPQQDAzCBhTEL
MAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UE
BxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNVBAMT
IkNPTU9ETyBFQ0MgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDgwMzA2MDAw
MDAwWhcNMzgwMTE4MjM1OTU5WjCBhTELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdy
ZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09N
T0RPIENBIExpbWl0ZWQxKzApBgNVBAMTIkNPTU9ETyBFQ0MgQ2VydGlmaWNhdGlv
biBBdXRob3JpdHkwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQDR3svdcmCFYX7deSR
FtSrYpn1PlILBs5BAH+X4QokPB0BBO490o0JlwzgdeT6+3eKKvUDYEs2ixYjFq0J
cfRK9ChQtP6IHG4/bC8vCVlbpVsLM5niwz2J+Wos77LTBumjQjBAMB0GA1UdDgQW
BBR1cacZSBm8nZ3qQUfflMRId5nTeTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/
BAUwAwEB/zAKBggqhkjOPQQDAwNoADBlAjEA7wNbeqy3eApyt4jf/7VGFAkK+qDm
fQjGGoe9GKhzvSbKYAydzpmfz1wPMOG+FDHqAjAU9JM8SaczepBGR7NjfRObTrdv
GDeAU/7dIOA1mjbRxwG55tzd8/8dLDoWV9mSOdY=
-----END CERTIFICATE-----

# Issuer: CN=Go Daddy Root Certificate Authority - G2 O=GoDaddy.com, Inc.
# Subject: CN=Go Daddy Root Certificate Authority - G2 O=GoDaddy.com, Inc.
# Label: "Go Daddy Root Certificate Authority - G2"
# Serial: 0
# MD5 Fingerprint: 80:3a:bc:22:c1:e6:fb:8d:9b:3b:27:4a:32:1b:9a:01
# SHA1 Fingerprint: 47:be:ab:c9:22:ea:e8:0e:78:78:34:62:a7:9f:45:c2:54:fd:e6:8b
# SHA256 Fingerprint: 45:14:0b:32:47:eb:9c:c8:c5:b4:f0:d7:b5:30:91:f7:32:92:08:9e:6e:5a:63:e2:74:9d:d3:ac:a9:19:8e:da
-----BEGIN CERTIFICATE-----
MIIDxTCCAq2gAwIBAgIBADANBgkqhkiG9w0BAQsFADCBgzELMAkGA1UEBhMCVVMx
EDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxGjAYBgNVBAoT
EUdvRGFkZHkuY29tLCBJbmMuMTEwLwYDVQQDEyhHbyBEYWRkeSBSb290IENlcnRp
ZmljYXRlIEF1dGhvcml0eSAtIEcyMB4XDTA5MDkwMTAwMDAwMFoXDTM3MTIzMTIz
NTk1OVowgYMxCzAJBgNVBAYTAlVTMRAwDgYDVQQIEwdBcml6b25hMRMwEQYDVQQH
EwpTY290dHNkYWxlMRowGAYDVQQKExFHb0RhZGR5LmNvbSwgSW5jLjExMC8GA1UE
AxMoR28gRGFkZHkgUm9vdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkgLSBHMjCCASIw
DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL9xYgjx+lk09xvJGKP3gElY6SKD
E6bFIEMBO4Tx5oVJnyfq9oQbTqC023CYxzIBsQU+B07u9PpPL1kwIuerGVZr4oAH
/PMWdYA5UXvl+TW2dE6pjYIT5LY/qQOD+qK+ihVqf94Lw7YZFAXK6sOoBJQ7Rnwy
DfMAZiLIjWltNowRGLfTshxgtDj6AozO091GB94KPutdfMh8+7ArU6SSYmlRJQVh
GkSBjCypQ5Yj36w6gZoOKcUcqeldHraenjAKOc7xiID7S13MMuyFYkMlNAJWJwGR
tDtwKj9useiciAF9n9T521NtYJ2/LOdYq7hfRvzOxBsDPAnrSTFcaUaz4EcCAwEA
AaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYE
FDqahQcQZyi27/a9BUFuIMGU2g/eMA0GCSqGSIb3DQEBCwUAA4IBAQCZ21151fmX
WWcDYfF+OwYxdS2hII5PZYe096acvNjpL9DbWu7PdIxztDhC2gV7+AJ1uP2lsdeu
9tfeE8tTEH6KRtGX+rcuKxGrkLAngPnon1rpN5+r5N9ss4UXnT3ZJE95kTXWXwTr
gIOrmgIttRD02JDHBHNA7XIloKmf7J6raBKZV8aPEjoJpL1E/QYVN8Gb5DKj7Tjo
2GTzLH4U/ALqn83/B2gX2yKQOC16jdFU8WnjXzPKej17CuPKf1855eJ1usV2GDPO
LPAvTK33sefOT6jEm0pUBsV/fdUID+Ic/n4XuKxe9tQWskMJDE32p2u0mYRlynqI
4uJEvlz36hz1
-----END CERTIFICATE-----

# Issuer: CN=Baltimore CyberTrust Root O=Baltimore OU=CyberTrust
# Subject: CN=Baltimore CyberTrust Root O=Baltimore OU=CyberTrust
# Label: "Baltimore CyberTrust Root"
# Serial: 33554617
# MD5 Fingerprint: ac:b6:94:a5:9c:17:e0:d7:91:52:9b:b1:97:06:a6:e4
# SHA1 Fingerprint: d4:de:20:d0:5e:66:fc:53:fe:1a:50:88:2c:78:db:28:52:ca:e4:74
# SHA256 Fingerprint: 16:af:57:a9:f6:76:b0:ab:12:60:95:aa:5e:ba:de:f2:2a:b3:11:19:d6:44:ac:95:cd:4b:93:db:f3:f2:6a:eb
-----BEGIN CERTIFICATE-----
MIIDdzCCAl+gAwIBAgIEAgAAuTANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJJ
RTESMBAGA1UEChMJQmFsdGltb3JlMRMwEQYDVQQLEwpDeWJlclRydXN0MSIwIAYD
VQQDExlCYWx0aW1vcmUgQ3liZXJUcnVzdCBSb290MB4XDTAwMDUxMjE4NDYwMFoX
DTI1MDUxMjIzNTkwMFowWjELMAkGA1UEBhMCSUUxEjAQBgNVBAoTCUJhbHRpbW9y
ZTETMBEGA1UECxMKQ3liZXJUcnVzdDEiMCAGA1UEAxMZQmFsdGltb3JlIEN5YmVy
VHJ1c3QgUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKMEuyKr
mD1X6CZymrV51Cni4eiVgLGw41uOKymaZN+hXe2wCQVt2yguzmKiYv60iNoS6zjr
IZ3AQSsBUnuId9Mcj8e6uYi1agnnc+gRQKfRzMpijS3ljwumUNKoUMMo6vWrJYeK
mpYcqWe4PwzV9/lSEy/CG9VwcPCPwBLKBsua4dnKM3p31vjsufFoREJIE9LAwqSu
XmD+tqYF/LTdB1kC1FkYmGP1pWPgkAx9XbIGevOF6uvUA65ehD5f/xXtabz5OTZy
dc93Uk3zyZAsuT3lySNTPx8kmCFcB5kpvcY67Oduhjprl3RjM71oGDHweI12v/ye
jl0qhqdNkNwnGjkCAwEAAaNFMEMwHQYDVR0OBBYEFOWdWTCCR1jMrPoIVDaGezq1
BE3wMBIGA1UdEwEB/wQIMAYBAf8CAQMwDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3
DQEBBQUAA4IBAQCFDF2O5G9RaEIFoN27TyclhAO992T9Ldcw46QQF+vaKSm2eT92
9hkTI7gQCvlYpNRhcL0EYWoSihfVCr3FvDB81ukMJY2GQE/szKN+OMY3EU/t3Wgx
jkzSswF07r51XgdIGn9w/xZchMB5hbgF/X++ZRGjD8ACtPhSNzkE1akxehi/oCr0
Epn3o0WC4zxe9Z2etciefC7IpJ5OCBRLbf1wbWsaY71k5h+3zvDyny67G7fyUIhz
ksLi4xaNmjICq44Y3ekQEe5+NauQrz4wlHrQMz2nZQ/1/I6eYs9HRCwBXbsdtTLS
R9I4LtD+gdwyah617jzV/OeBHRnDJELqYzmp
-----END CERTIFICATE-----

# Issuer: CN=Amazon Root CA 1 O=Amazon
# Subject: CN=Amazon Root CA 1 O=Amazon
# Label: "Amazon Root CA 1"
# Serial: 143266978916655856878034712317230054538369994
# MD5 Fingerprint: 43:c6:bf:ae:ec:fe:ad:2f:18:c6:88:68:30:fc:c8:e6
# SHA1 Fingerprint: 8d:a7:f9:65:ec:5e:fc:37:91:0f:1c:6e:59:fd:c1:cc:6a:6e:de:16
# SHA256 Fingerprint: 8e:cd:e6:88:4f:3d:87:b1:12:5b:a3:1a:c3:fc:b1:3d:70:16:de:7f:57:cc:90:4f:e1:cb:97:c6:ae:98:19:6e
-----BEGIN CERTIFICATE-----
MIIDQTCCAimgAwIBAgITBmyfz5m/jAo54vB4ikPmljZbyjANBgkqhkiG9w0BAQsF
ADA5MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6
b24gUm9vdCBDQSAxMB4XDTE1MDUyNjAwMDAwMFoXDTM4MDExNzAwMDAwMFowOTEL
MAkGA1UEBhMCVVMxDzANBgNVBAoTBkFtYXpvbjEZMBcGA1UEAxMQQW1hem9uIFJv
b3QgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALJ4gHHKeNXj
ca9HgFB0fW7Y14h29Jlo91ghYPl0hAEvrAIthtOgQ3pOsqTQNroBvo3bSMgHFzZM
9O6II8c+6zf1tRn4SWiw3te5djgdYZ6k/oI2peVKVuRF4fn9tBb6dNqcmzU5L/qw
IFAGbHrQgLKm+a/sRxmPUDgH3KKHOVj4utWp+UhnMJbulHheb4mjUcAwhmahRWa6
VOujw5H5SNz/0egwLX0tdHA114gk957EWW67c4cX8jJGKLhD+rcdqsq08p8kDi1L
93FcXmn/6pUCyziKrlA4b9v7LWIbxcceVOF34GfID5yHI9Y/QCB/IIDEgEw+OyQm
jgSubJrIqg0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC
AYYwHQYDVR0OBBYEFIQYzIU07LwMlJQuCFmcx7IQTgoIMA0GCSqGSIb3DQEBCwUA
A4IBAQCY8jdaQZChGsV2USggNiMOruYou6r4lK5IpDB/G/wkjUu0yKGX9rbxenDI
U5PMCCjjmCXPI6T53iHTfIUJrU6adTrCC2qJeHZERxhlbI1Bjjt/msv0tadQ1wUs
N+gDS63pYaACbvXy8MWy7Vu33PqUXHeeE6V/Uq2V8viTO96LXFvKWlJbYK8U90vv
o/ufQJVtMVT8QtPHRh8jrdkPSHCa2XV4cdFyQzR1bldZwgJcJmApzyMZFo6IQ6XU
5MsI+yMRQ+hDKXJioaldXgjUkK642M4UwtBV8ob2xJNDd2ZhwLnoQdeXeGADbkpy
rqXRfboQnoZsG4q5WTP468SQvvG5
-----END CERTIFICATE-----

# Issuer: CN=DigiCert Global Root CA O=DigiCert Inc OU=www.digicert.com
# Subject: CN=DigiCert Global Root CA O=DigiCert Inc OU=www.digicert.com
# Label: "DigiCert Global Root CA"
# Serial: 10944719598952040374951832963794454346
# MD5 Fingerprint: 79:e4:a9:84:0d:7d:3a:96:d7:c0:4f:e2:43:4c:89:2e
# SHA1 Fingerprint: a8:98:5d:3a:65:e5:e5:c4:b2:d7:d6:6d:40:c6:dd:2f:b1:9c:54:36
# SHA256 Fingerprint: 43:48:a0:e9:44:4c:78:cb:26:5e:05:8d:5e:89:44:b4:d8:4f:96:62:bd:26:db:25:7f:89:34:a4:43:c7:01:61
-----BEGIN CERTIFICATE-----
MIIDrzCCApegAwIBAgIQCDvgVpBCRrGhdWrJWZHHSjANBgkqhkiG9w0BAQUFADBh
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD
QTAeFw0wNjExMTAwMDAwMDBaFw0zMTExMTAwMDAwMDBaMGExCzAJBgNVBAYTAlVT
MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j
b20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IENBMIIBIjANBgkqhkiG
9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4jvhEXLeqKTTo1eqUKKPC3eQyaKl7hLOllsB
CSDMAZOnTjC3U/dDxGkAV53ijSLdhwZAAIEJzs4bg7/fzTtxRuLWZscFs3YnFo97
nh6Vfe63SKMI2tavegw5BmV/Sl0fvBf4q77uKNd0f3p4mVmFaG5cIzJLv07A6Fpt
43C/dxC//AH2hdmoRBBYMql1GNXRor5H4idq9Joz+EkIYIvUX7Q6hL+hqkpMfT7P
T19sdl6gSzeRntwi5m3OFBqOasv+zbMUZBfHWymeMr/y7vrTC0LUq7dBMtoM1O/4
gdW7jVg/tRvoSSiicNoxBN33shbyTApOB6jtSj1etX+jkMOvJwIDAQABo2MwYTAO
BgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUA95QNVbR
TLtm8KPiGxvDl7I90VUwHwYDVR0jBBgwFoAUA95QNVbRTLtm8KPiGxvDl7I90VUw
DQYJKoZIhvcNAQEFBQADggEBAMucN6pIExIK+t1EnE9SsPTfrgT1eXkIoyQY/Esr
hMAtudXH/vTBH1jLuG2cenTnmCmrEbXjcKChzUyImZOMkXDiqw8cvpOp/2PV5Adg
06O/nVsJ8dWO41P0jmP6P6fbtGbfYmbW0W5BjfIttep3Sp+dWOIrWcBAI+0tKIJF
PnlUkiaY4IBIqDfv8NZ5YBberOgOzW6sRBc4L0na4UU+Krk2U886UAb3LujEV0ls
YSEY1QSteDwsOoBrp+uvFRTp2InBuThs4pFsiv9kuXclVzDAGySj4dzp30d8tbQk
CAUw7C29C79Fv1C5qfPrmAESrciIxpg0X40KPMbp1ZWVbd4=
-----END CERTIFICATE-----


code:
#!/bin/bash
[% c("var/set_default_env") -%]

tar xvf [% project %]-[% c('version') %].tar.gz

mkdir -p /var/tmp/dist/
cd /var/tmp/dist/

cp -a $rootdir/[% project %]*/[% project %] ./[% project %]

[% c('tar', {
        tar_src => '.',
        tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'),
        }) %]

path: projects/chardet/build


code:
# vim: filetype=yaml sw=2
version: 3.0.4
git_url: https://github.com/chardet/chardet.git
git_hash: 9b8c5c2fb118d76c6beeab9affd01c332732a530
# TODO: This Git repo doesn't use GPG sigs.  We should pester them about that.
filename: "[% project %]-[% c('version') %]-[% c('var/build_id') %].tar.gz"
container:
  use_container: 1
input_files:
  - project: container-image

path: projects/chardet/config


code:
#!/bin/bash
[% c("var/set_default_env") -%]
distdir=/var/tmp/dist/[% project %]
mkdir -p /var/tmp/dist
tar -C /var/tmp/dist -xf [% c('input_files_by_name/cmake') %]
export PATH="/var/tmp/dist/cmake/bin:$PATH"
[% IF c("var/linux") %]
  # We need a link to our GCC, otherwise the system cc gets used which points
  # to /usr/bin/gcc.
  [% pc('gcc', 'var/setup', { compiler_tarfile => c('input_files_by_name/gcc'),
                              hardened_gcc => 0 }) %]
  ln -s gcc /var/tmp/dist/gcc/bin/cc
  [% pc('python', 'var/setup', { python_tarfile => c('input_files_by_name/python') }) %]
[% END -%]
[% IF c("var/android") %]
  [% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %]
[% END -%]
[% IF c("var/linux") || c("var/android") -%]
  tar -C /var/tmp/dist -xf [% c('input_files_by_name/binutils') %]
  export PATH="/var/tmp/dist/binutils/bin:$PATH"
[% END -%]
mkdir -p /var/tmp/build
cd /var/tmp/build
tar -xf $rootdir/[% c('input_files_by_name/clang-source') %]
cd clang-source
export LLVM_HOME=$(pwd)
mkdir build
cd build
cmake ../llvm -G "Unix Makefiles" -DCMAKE_INSTALL_PREFIX=$distdir \
                                  -DCMAKE_BUILD_TYPE=Release \
            [% IF c("var/android") -%]
                                  -DLLVM_TARGETS_TO_BUILD="X86;ARM;AArch64" \
            [% END -%]
            [% IF c("var/rlbox") -%]-DLLVM_EXPERIMENTAL_TARGETS_TO_BUILD=WebAssembly[% END %] \
                                  -DLLVM_ENABLE_PROJECTS="clang;clang-tools-extra;compiler-rt;libcxx;libcxxabi;lld"
make -j[% c("num_procs") %]
make install

[% IF c("var/android") -%]
  rtdistdir=/var/tmp/build/rtdist
  mkdir $rtdistdir

  make_compilerrt () {
    cd ..
    mkdir "build-compilerrt-$1"
    cd "build-compilerrt-$1"
    cmake ../compiler-rt/ -G "Unix Makefiles" \
      -DCMAKE_INSTALL_PREFIX=$rtdistdir \
      -DCMAKE_SYSTEM_NAME=Android \
      -DCMAKE_ANDROID_ARCH_ABI=$1 \
      -DCMAKE_ANDROID_NDK="/var/tmp/dist/android-toolchain/android-sdk-linux/ndk/android-ndk-r21d" \
      -DCMAKE_C_FLAGS="$3 -fuse-ld=lld --rtlib=compiler-rt" \
      -DCMAKE_CXX_FLAGS="$3 -fuse-ld=lld --rtlib=compiler-rt" \
      -DCMAKE_EXE_LINKER_FLAGS="-L/var/tmp/dist/android-toolchain/android-sdk-linux/ndk/android-ndk-r21d/toolchains/llvm/prebuilt/linux-x86_64/$2" \
      -DCOMPILER_RT_BUILD_BUILTINS=ON \
      -DCOMPILER_RT_BUILD_LIBFUZZER=OFF \
      -DCOMPILER_RT_BUILD_MEMPROF=OFF \
      -DCOMPILER_RT_BUILD_PROFILE=OFF \
      -DCOMPILER_RT_BUILD_SANITIZERS=OFF \
      -DCOMPILER_RT_BUILD_XRAY=OFF
    make -j[% c("num_procs") %]
    make install
  }

  make_compilerrt "armeabi-v7a" "arm-linux-androideabi/lib" "-DARMEABI_V7A"
  make_compilerrt "arm64-v8a" "aarch64-linux-android/lib64"
  make_compilerrt "x86" "i686-linux-android/lib"
  make_compilerrt "x86_64" "x86_64-linux-android/lib64"

  mv $rtdistdir/lib/android/*.a $distdir/lib/clang/[% c("var/llvm_version") %]/lib/linux/
[% END -%]

cd /var/tmp/dist
[% c('tar', {
        tar_src => [ project ],
        tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'),
    }) %]

path: projects/clang/build


code:
# vim: filetype=yaml sw=2
version: '[% c("var/llvm_version") %]'
filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1

var:
  llvm_version: '[% pc("llvm-project", "version") %]'

input_files:
  - project: container-image
  - name: '[% c("var/compiler") %]'
    project: '[% c("var/compiler") %]'
    enable: '[% c("var/linux") || c("var/android") %]'
  - name: binutils
    project: binutils
    enable: '[% c("var/linux") || c("var/android") %]'
  - project: cmake
    name: cmake
  - project: llvm-project
    name: clang-source
  - project: python
    name: python
    enable: '[% c("var/linux") %]'

path: projects/clang/config


code:
#!/bin/bash
[% c("var/set_default_env") -%]
distdir=/var/tmp/dist/[% project %]
[% IF c("var/linux") %]
  [% pc('gcc', 'var/setup', { compiler_tarfile => c('input_files_by_name/gcc'),
                              hardened_gcc => 0 }) %]
[% END -%]
mkdir /var/tmp/build
tar -C /var/tmp/build -xf [% project %]-[% c('version') %].tar.gz
cd /var/tmp/build/[% project %]-[% c('version') %]
./bootstrap --prefix=$distdir
make -j[% c("num_procs") %]
make install
cd /var/tmp/dist
[% c('tar', {
        tar_src => [ project ],
        tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'),
    }) %]

path: projects/cmake/build


code:
# vim: filetype=yaml sw=2
version: 3.15.3
git_url: https://gitlab.kitware.com/cmake/cmake.git
git_hash: 'v[% c("version") %]'
tag_gpg_id: 1
gpg_keyring: cmake.gpg
filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1

input_files:
  - project: container-image
  - name: '[% c("var/compiler") %]'
    project: '[% c("var/compiler") %]'
    enable: '[% c("var/linux") %]'

path: projects/cmake/config


code: meek_lite 192.0.2.2:2 97700DFE9F483596DDA6264C4D7DF7641E1E39CE url=https://meek.azureedge.net/ front=ajax.aspnetcdn.com


code:
obfs4 192.95.36.142:443 CDF2E852BF539B82BD10E27E9115A31734E378C2 cert=qUVQ0srL1JI/vO6V6m/24anYXiJD3QP2HgzUKQtQ7GRqqUvs7P+tG43RtAqdhLOALP7DJQ iat-mode=1
obfs4 38.229.1.78:80 C8CBDB2464FC9804A69531437BCF2BE31FDD2EE4 cert=Hmyfd2ev46gGY7NoVxA9ngrPF2zCZtzskRTzoWXbxNkzeVnGFPWmrTtILRyqCTjHR+s9dg iat-mode=1
obfs4 38.229.33.83:80 0BAC39417268B96B9F514E7F63FA6FBA1A788955 cert=VwEFpk9F/UN9JED7XpG1XOjm/O8ZCXK80oPecgWnNDZDv5pdkhq1OpbAH0wNqOT6H6BmRQ iat-mode=1
obfs4 37.218.245.14:38224 D9A82D2F9C2F65A18407B1D2B764F130847F8B5D cert=bjRaMrr1BRiAW8IE9U5z27fQaYgOhX1UCmOpg2pFpoMvo6ZgQMzLsaTzzQNTlm7hNcb+Sg iat-mode=0
obfs4 85.31.186.98:443 011F2599C0E9B27EE74B353155E244813763C3E5 cert=ayq0XzCwhpdysn5o0EyDUbmSOx3X/oTEbzDMvczHOdBJKlvIdHHLJGkZARtT4dcBFArPPg iat-mode=0
obfs4 85.31.186.26:443 91A6354697E6B02A386312F68D82CF86824D3606 cert=PBwr+S8JTVZo6MPdHnkTwXJPILWADLqfMGoVvhZClMq/Urndyd42BwX9YFJHZnBB3H0XCw iat-mode=0
obfs4 193.11.166.194:27015 2D82C2E354D531A68469ADF7F878FA6060C6BACA cert=4TLQPJrTSaDffMK7Nbao6LC7G9OW/NHkUwIdjLSS3KYf0Nv4/nQiiI8dY2TcsQx01NniOg iat-mode=0
obfs4 193.11.166.194:27020 86AC7B8D430DAC4117E9F42C9EAED18133863AAF cert=0LDeJH4JzMDtkJJrFphJCiPqKx7loozKN7VNfuukMGfHO0Z8OGdzHVkhVAOfo1mUdv9cMg iat-mode=0
obfs4 193.11.166.194:27025 1AE2C08904527FEA90C4C4F8C1083EA59FBC6FAF cert=ItvYZzW5tn6v3G4UnQa6Qz04Npro6e81AP70YujmK/KXwDFPTs3aHXcHp4n8Vt6w/bv8cA iat-mode=0
obfs4 209.148.46.65:443 74FAD13168806246602538555B5521A0383A1875 cert=ssH+9rP8dG2NLDN2XuFw63hIO/9MNNinLmxQDpVa+7kTOa9/m+tGWT1SmSYpQ9uTBGa6Hw iat-mode=0
obfs4 146.57.248.225:22 10A6CD36A537FCE513A322361547444B393989F0 cert=K1gDtDAIcUfeLqbstggjIw2rtgIKqdIhUlHp82XRqNSq/mtAjp1BIC9vHKJ2FAEpGssTPw iat-mode=0
obfs4 45.145.95.6:27015 C5B7CD6946FF10C5B3E89691A7D3F2C122D2117C cert=TD7PbUO0/0k6xYHMPW3vJxICfkMZNdkRrb63Zhl5j9dW3iRGiCx0A7mPhe5T2EDzQ35+Zw iat-mode=0
obfs4 [2a0c:4d80:42:702::1]:27015 C5B7CD6946FF10C5B3E89691A7D3F2C122D2117C cert=TD7PbUO0/0k6xYHMPW3vJxICfkMZNdkRrb63Zhl5j9dW3iRGiCx0A7mPhe5T2EDzQ35+Zw iat-mode=0
obfs4 51.222.13.177:80 5EDAC3B810E12B01F6FD8050D2FD3E277B289A08 cert=2uplIpLQ0q9+0qMFrK5pkaYRDOe460LL9WHBvatgkuRr/SL31wBOEupaMMJ6koRE6Ld0ew iat-mode=0


code:
#!/bin/bash
set -e
# Bug 28117: setting LC_ALL=C is causing wget to fail downloading some URLs
unset LC_ALL
cd "[% dest_dir %]"
m2dir="$(mktemp -d)"
[% USE artifacts = datafile(c('basedir') _ '/projects/' _ project _ '/gradle-dependencies-list.txt', delim = '|') %]
[% FOREACH artifact = artifacts %]
    artifact_path=$(echo "[% artifact.url %]" | sed 's|^https://[^/]\+/||')
    artifact_filename=$(basename "$artifact_path")
    artifact_dirname=$(dirname "$artifact_path")
    [% GET c("urlget", { filename => 'downloaded_file', URL => artifact.url}); %]
    # .pom files may be modified after a version is published, therefore verify
    # the hash only if the file name does not end with '.pom'.
    if ! echo "$artifact_filename" | grep -q '\.pom$'; then
        echo "[% artifact.sha256sum %]  downloaded_file" | sha256sum -c
    fi
    mkdir -p "$m2dir/$artifact_dirname"
    mv -f downloaded_file "$m2dir/$artifact_dirname/$artifact_filename"
[% END -%]
echo "Finished downloading gradle dependencies"
mkdir -p "[% dest_dir %]"
mv -f "$m2dir" "[% dest_dir %]/gradle-dependencies-[% c("var/gradle_dependencies_version") %]"


code:
#!/bin/bash

# Copyright (c) 2020, The Tor Project, Inc.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are
# met:
#
#     * Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
#
#     * Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following disclaimer
# in the documentation and/or other materials provided with the
# distribution.
#
#     * Neither the names of the copyright owners nor the names of its
# contributors may be used to endorse or promote products derived from
# this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

# Usage:
# 1) Point to a log file with all the dependency download attempts (for its
#    generation see: doc/how-to-create-gradle-dependencies-list.txt)
# 2) Double-check that you get the same SHA-256 sums when downloaded from a
#    different network location. E.g. by using `torsocks` with this script after
#    having made a copy of `gradle-dependencies-list.txt` from 1) and comparing
#    the two .txt files.

export LC_ALL=C
log="$1"

# Step 1: Extract all the download attempts out of the log file, ignore the ones
# for maven-metadata.xml and module files. We don't need those.
cat $log | grep "Performing HTTP" | grep -o "https://.*" | \
  grep -vE "\.module|maven-metadata\.xml" | sort | uniq > dl-attempts

# Step 2: Fetch all the dependencies and calculate the SHA-256 sum
declare -A URLs
function dl_url {
  local url="$1"
  test -n "${URLs[$url]}" && return 0
  URLs[$url]=1
  wget -U "" $url
  test $? -eq 0 || return 1
  local fn=$(basename "$url")
  local sha256=`sha256sum $fn | cut -d ' ' -f 1`
  echo "$sha256 | $url" >> deps
  rm $fn
}

while read line
do
  dl_url "$line"
  # If we downloaded a .pom file, also try to get corresponding .jar and
  # .aar files
  bname=$(basename "$line" .pom)
  dname=$(dirname "$line")
  if test "$line" != "$dname/$bname"
  then
    dl_url "$dname/$bname.aar"
    dl_url "$dname/$bname.jar"
  fi
done < dl-attempts

# Step 3: Add the header at the beginning of the final dependency file.
echo "# On how to update dependencies see doc/how-to-create-gradle\
-dependencies-list.txt" > gradle-dependencies-list.txt
echo "# Don't forget to update var/gradle_dependencies_version when modifying \
this file" >> gradle-dependencies-list.txt
echo "sha256sum | url" >> gradle-dependencies-list.txt

# Step 4: Keep only successfully downloaded artifacts, remove duplicates, and
# sort based on download URL.
grep ^[a-f0-9] deps | rev | sort -t/ -u -k1,4 | rev | \
  sort -k 3 >> gradle-dependencies-list.txt

# Step 5: Clean up
rm dl-attempts
rm deps

exit 0


code:
#!/usr/bin/perl -w
# Generate a MOZ_BUILD_DATE based on Tor Browser version number

use strict;

die "wrong number of arguments" unless @ARGV == 2;
my ($year, $version) = @ARGV;
my $date;
if ($version =~ m/^tbb-nightly\.([^\.]+)\.([^\.]+)\.([^\.]+)$/) {
  $date = sprintf("%d%02d%02d010101", $1, $2, $3);
} elsif ($version eq 'testbuild') {
  # There is no need for an increasing build date in test builds. Just hardcode
  # it to a value that is compatible with the v1 versionCode scheme on Android,
  # see: #34163. We adjust the date to the new cutoff according to
  # https://github.com/mozilla-mobile/fenix/pull/14952, following Mozilla.
  # This should be unproblematic for test builds anyway.
  $date = 20141228000000;
} else {
  my @v = split(/[\.ab]/, $version);
  push @v, '0' if @v < 4;
  push @v, '0' if @v < 4;
  # When MOZ_BUILD_DATE was based on the firefox version, with
  # Tor Browser 8.0.6 and firefox 60.5.1 it was 20190204060201
  # We can remove 5 from the month, while keeping it increasing.
  my $month = $v[0] - 5;
  $date = 1010101 + $year * 10000000000 + $month * 100000000
             + $v[1] * 1000000 + $v[2] * 10000 + $v[3];
  $date += 1000000 unless $version =~ m/[ab]/;
}
print "export MOZ_BUILD_DATE=$date\n";

path: projects/common/get-moz-build-date


code:
#!/bin/bash

set -e

rootdir="$(pwd)"
no_updates="$rootdir/no_updates.txt"
updates="$rootdir/updates.txt"

tar -xf [% project %]-[% c('version') %].tar.gz
cd [% project %]-[% c('version') %]

function check_update_needed() {
  name="$1"
  v1="$2"
  v2="$3"
  if test "$v1" = "$v2"
  then
    echo "* $name ($v1)" >> "$no_updates"
  else
    echo "* $name needs to be updated to $v1 (currently at $v2)" >> "$updates"
  fi
}

[% INCLUDE list_toolchain_updates_checks %]

echo '### Component: [% project %] ([% c("git_hash") %])'

if test -f "$updates"
then
  echo "The following components need to be updated:"
  cat "$updates"
  echo
fi
if test -f "$no_updates"
then
  echo "The following components don't need to be updated:"
  cat "$no_updates"
fi


code:
#!/bin/sh
set -e
# Doing nothing

path: projects/container-image/build


code:
# vim: filetype=yaml sw=2
filename: 'container-image_[% c("var/container/suite") %]-[% c("var/container/arch") %]-[% sha256(c("pre")).substr(0, 12) %].tar.gz'
pkg_type: build
container:
  use_container: 1

var:
  container:
    suite: '[% pc(c("origin_project"), "var/container/suite", { step => c("origin_step") }) %]'
    arch: '[% pc(c("origin_project"), "var/container/arch", { step => c("origin_step") }) %]'

lsb_release:
  id: Debian
  codename: jessie
  release: 8.11

targets:
  no_containers:
    filename: containers_disabled
    pre: ''
    input_files: []
    build: |
      mkdir -p [% dest_dir %]
      touch [% dest_dir _ '/' _ c('filename') %]

pre: |
  #!/bin/sh
  # Version: 2
  # [% c('var/container/suite') %]
  set -e
  export DEBIAN_FRONTEND=noninteractive
  # Update the package cache so the container installs the most recent
  # version of required packages.
  apt-get update -y -q
  [% IF pc(c('origin_project'), 'var/pre_pkginst', { step => c('origin_step') }) -%]
  [% pc(c('origin_project'), 'var/pre_pkginst', { step => c('origin_step') }) %]
  [% IF c("var/linux-cross") -%]
    dpkg --add-architecture [% c("var/arch_debian") %]
  [% END -%]
  # Update the package cache again because `pre_pkginst` may change the
  # package manager configuration.
  apt-get update -y -q
  [% END -%]
  apt-get upgrade -y -q
  [%
     deps = [];
     IF pc(c('origin_project'), 'var/deps', { step => c('origin_step') });
       CALL deps.import(pc(c('origin_project'), 'var/deps', { step => c('origin_step') }));
     END;
     IF pc(c('origin_project'), 'var/arch_deps', { step => c('origin_step') });
       CALL deps.import(pc(c('origin_project'), 'var/arch_deps', { step => c('origin_step') }));
     END;
     IF deps.size;
       IF pc(c('origin_project'), 'var/sort_deps', { step => c('origin_step') });
         deps = deps.sort;
       END;
       FOREACH pkg IN deps;
         SET p = tmpl(pkg);
         IF p;
           GET c('install_package', { pkg_name => p });
           GET "\n";
         END;
       END;
     END;
  -%]
  [% IF pc(c('origin_project'), 'var/post_pkginst', { step => c('origin_step') }) -%]
  [% pc(c('origin_project'), 'var/post_pkginst', { step => c('origin_step') }) %]
  [% END -%]

remote_get: |
  #!/bin/sh
  set -e
  [%
    SET src = shell_quote(c('get_src', { error_if_undef => 1 }));
    SET dst = shell_quote(c('get_dst', { error_if_undef => 1 }));
  -%]
  mkdir -p "[% dst %]"
  [% c("rbmdir") %]/container archive '[% c("container/dir") %]' "[% dst %]/[% c("filename") %]"

input_files:
  - project: mmdebstrap-image
    target:
      - '[% c("var/container/suite") %]-[% c("var/container/arch") %]'

path: projects/container-image/config


code:
#!/bin/bash
[% c("var/set_default_env") -%]

shopt -s globstar

unzip dnspython-[% c('version') %].zip

mkdir -p /var/tmp/dist/[% project %]

cd $rootdir/dnspython*/[% project %]
cp --parents **/*.py /var/tmp/dist/[% project %]/

cd /var/tmp/dist/
[% c('tar', {
        tar_src => '.',
        tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'),
        }) %]

path: projects/dns/build


code:
# vim: filetype=yaml sw=2
version: 1.16.0
filename: "[% project %]-[% c('version') %]-[% c('var/build_id') %].tar.gz"
container:
  use_container: 1
input_files:
  - project: container-image
  - URL: https://files.pythonhosted.org/packages/source/d/dnspython/dnspython-[% c("version") %].zip
    sha256sum: 36c5e8e38d4369a08b6780b7f27d790a292b2b08eea01607865bf0936c558e01
    # TODO: This package uses GPG sigs; we should switch from SHA256 hash to GPG verification.

path: projects/dns/config


path: projects/ecdsa/build


code:
# vim: filetype=yaml sw=2
version: 0.13.2
git_url: https://github.com/warner/python-ecdsa.git
git_hash: bb359d32e93acc3eb4d216aff4ba0e7531599cfb
# TODO: This Git repo doesn't use GPG sigs.  We should pester them about that.
filename: "[% project %]-[% c('version') %]-[% c('var/build_id') %].tar.gz"
container:
  use_container: 1
input_files:
  - project: container-image

path: projects/ecdsa/config


code:
# vim: filetype=yaml sw=2
version: '[% c("abbrev") %]'
git_url: https://gitlab.com/yawning/edwards25519-extra.git
git_hash: 2f91fcc9fbdb888f3c795849b6777940135559b7
filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1

build: '[% c("projects/go/var/build_go_lib") %]'

var:
  go_lib: gitlab.com/yawning/edwards25519-extra.git
  go_lib_deps:
    - goxcrypto
    - edwards25519
  go_lib_install:
    - gitlab.com/yawning/edwards25519-extra.git/elligator2
    - gitlab.com/yawning/edwards25519-extra.git/h2c
    - gitlab.com/yawning/edwards25519-extra.git/vrf

input_files:
  - project: container-image
  - name: go
    project: go
  - name: goxcrypto
    project: goxcrypto
  - name: edwards25519
    project: edwards25519
  - name: '[% c("var/compiler") %]'
    project: '[% c("var/compiler") %]'
    enable: '[% c("var/android") %]'


code:
# vim: filetype=yaml sw=2
version: '[% c("abbrev") %]'
git_url: https://github.com/FiloSottile/edwards25519.git
git_hash: 390f27c3be2014e4912ce88c6a1fff52ec60428b
filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz'
container:
  use_container: 1

build: '[% c("projects/go/var/build_go_lib") %]'

var:
  go_lib: filippo.io/edwards25519

input_files:
  - project: container-image
  - name: go
    project: go


code:
#!/bin/sh
[% c("var/set_default_env") -%]
mkdir -p /var/tmp/build/[% project %]
tar -C /var/tmp/build/[% project %] -xf [% project %]-[% c("version") %].tar.gz

cd /var/tmp/build/[% project %]/[% project %]-*

mkdir packages
cd packages

[% FOREACH dep = ['aiohttp', 'aiohttp_socks', 'aiorpcx', 'async_timeout', 'attr', 'certifi', 'chardet', 'dns', 'ecdsa', 'idna', 'idna_ssl', 'jsonrpclib', 'multidict', 'pyaes', 'six', 'typing_extensions', 'yarl'] -%]
  tar -C . -xf $rootdir/[% c('input_files_by_name/' _ dep) %]
[% END -%]

mkdir -p /var/tmp/dist/
cd /var/tmp/dist/

cp -a /var/tmp/build/[% project %]/[% project %]* ./Electrum-NMC

cd ./Electrum-NMC
# Remove GUI, since it's not used in Tor Browser.
rm -r electrum_nmc/electrum/gui/
# Remove plugins, since they're not used in Tor Browser.
rm -r electrum_nmc/electrum/plugins/*/
# Remove wallet functionality, since it's not used in Tor Browser.
mv electrum_nmc/electrum/null_impl/null_wallet/*.py electrum_nmc/electrum/
rm -r electrum_nmc/electrum/null_impl/
# Remove some other files that aren't needed.  We have to leave
# electrum-nmc.desktop there, because it's used in run_electrum_nmc's is_local
# detection.
rm -r .git*
rm -r .travis*
rm -r contrib/
rm -r electrum_nmc/electrum/tests/
rm -r pubkeys
rm -r tox.ini
cd ../

[% c('tar', {
        tar_src => '.',
        tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'),
        }) %]

path: projects/electrum-nmc/build


code:
# vim: filetype=yaml sw=2
filename: 'Electrum-NMC-[% c("version") %]-[% c("var/build_id") %].tar.gz'
version: 3.3.11
git_url: https://github.com/namecoin/electrum-nmc.git
git_hash: dc366a9cfedac24c0fd12d493f25ed058cf38271
# TODO: This Git repo uses GPG sigs; we should switch from commit hash to GPG verification.
container:
  use_container: 1

input_files:
  - project: container-image
  - project: aiohttp
    name: aiohttp
  - project: aiohttp_socks
    name: aiohttp_socks
  - project: aiorpcx
    name: aiorpcx
  - project: async_timeout
    name: async_timeout
  - project: attr
    name: attr
  - project: certifi
    name: certifi
  - project: chardet
    name: chardet
  - project: dns
    name: dns
  - project: ecdsa
    name: ecdsa
  - project: idna
    name: idna
  - project: idna_ssl
    name: idna_ssl
  - project: jsonrpclib
    name: jsonrpclib
  - project: multidict
    name: multidict
  - project: pyaes
    name: pyaes
  - project: six
    name: six
  - project: typing_extensions
    name: typing_extensions
  - project: yarl
    name: yarl

path: projects/electrum-nmc/config


code:
#!/bin/bash
[% c("var/set_default_env") -%]
[% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %]
distdir=/var/tmp/dist
builddir=/var/tmp/build/[% project %]
mkdir -p $distdir/[% project %]
mkdir -p /var/tmp/build

tar -C $GRADLE_HOME -xf $rootdir/[% c('input_files_by_name/gradle') %]

cat > get-moz-build-date << "EOF"
[% INCLUDE "get-moz-build-date" %]
EOF

[% IF !c("var/fetch_gradle_dependencies") %]
  tar -C $distdir -xf [% c('input_files_by_name/geckoview') %]
  gradle_repo=$rootdir/[% c('input_files_by_name/gradle-dependencies') %]
  # This overwrites the release, beta, and nightly geckoview .aar files in our
  # gradle-dependencies directory to be sure that only the one we provide is
  # getting used when building beta/release code.
  find $gradle_repo -type f -name geckoview*omni*.aar -exec cp -f $distdir/geckoview/geckoview*omni*.aar {} \;
  cp -r $gradle_repo/dl/android/maven2/* $gradle_repo
  cp -r $gradle_repo/maven2/* $gradle_repo
  cp -r $gradle_repo/m2/* $gradle_repo
  tar -C $distdir -xf [% c('input_files_by_name/application-services') %]
  # XXX: We could be smarter (both for a-s and a-c) and just copy over the
  # projects that are needed according to the Gradle dependencies list.
  cp -rf $distdir/application-services/maven/org $gradle_repo
  tar -C $distdir -xf [% c('input_files_by_name/android-components') %]
  cp -rf $distdir/android-components/maven/org $gradle_repo
  nimbusdir=$builddir-[% c("version") %]/app/build/bin/nimbus
  mkdir -p $nimbusdir
  cp $distdir/application-services/nimbus-fml $nimbusdir/
  tar -C $distdir -xf $rootdir/[% c('input_files_by_name/tba-translation') %]
[% END %]
tar -C /var/tmp/build -xf [% project %]-[% c('version') %].tar.gz

cd $builddir-[% c("version") %]

# Move Android library dependencies so they will be included in the apk during the build
cp $rootdir/[% c('input_files_by_name/topl') %]/* app/
cp $rootdir/[% c('input_files_by_name/tor-android-service') %]/* app/

# Avoid call to `getGitHash()`, which will fail b/c it invokes git, which is absent in
# the build container. Instead just inject the commit hash, which we know!
sed -i 's/\\"${Config.getGitHash()}\\"/\\"[% c('abbrev') %]\\"/' app/build.gradle

# XXX We need the build variant in lower case. Do something smarter here.
v=[% c("variant") %]
[% IF c("var/fetch_gradle_dependencies") %]
  $GRADLE_HOME/gradle/bin/gradle --debug --no-daemon app:assemble[% c('variant') %] \
    app:assembleAndroidTest -x lint -PtestBuildType=${v,} -PdisableOptimization \
    > gradle.log 2>&1 \
    || ( cat gradle.log; exit 1 )
  $rootdir/gen_gradle_deps_file.sh gradle.log
  mv gradle-dependencies-list.txt '[% dest_dir _ "/" _ c("filename") %]'
[% ELSE %]
  # Add our localized strings
  [% FOREACH lang = c('var/locales_mobile');
    SET lang = tmpl(lang); %]
    # Copy our torbrowser_strings.xml at the right place
    cp /var/tmp/dist/tba-translation/[% lang %]/torbrowser_strings.xml app/src/main/res/values-[% lang %]/
  [% END %]

  # Prepare Glean dependencies for offline build
  tar -xf $rootdir/[% c('input_files_by_name/glean') %]
  # We need to set `LC_ALL` and `LANG` to something that is not ASCII as encoding
  # otherwise `click` barfs. See: https://click.palletsprojects.com/python3/
  export LC_ALL=C.UTF-8
  export LANG=C.UTF-8
  patch -p1 < $rootdir/mavenLocal.patch

  eval $(perl $rootdir/get-moz-build-date [% c("var/copyright_year") %] [% c("var/torbrowser_version") %])
  if [ -z $MOZ_BUILD_DATE ]
  then
    echo "MOZ_BUILD_DATE is not set"
    exit 1
  fi

  # Bug 40485: Inject deterministic build date into Glean.
  echo "ext.gleanBuildDate = \"0\"" >> app/build.gradle

  # We put the tor-browser version last to avoid int-parsing errors when consumers of project.versionName
  # assume it starts with a major version number, as it does for all Mozilla version names.
  version_name='[% c("var/fenix_version") %]-[% c("variant") %] ([% c("var/torbrowser_version") %])'
  # We need -PdisableOptimization for building tests. See:
  # https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/40259#note_2732325
  $GRADLE_HOME/gradle/bin/gradle --offline --no-daemon -PversionName="$version_name" -Dmaven.repo.local=$gradle_repo app:assemble[% c('variant') %] -x lint -PtestBuildType=${v,}
  $GRADLE_HOME/gradle/bin/gradle --offline --no-daemon -PversionName="$version_name" -Dmaven.repo.local=$gradle_repo app:assembleAndroidTest -x lint -PtestBuildType=${v,} -PdisableOptimization
  cp app/build/outputs/apk/${v,}/*.apk $distdir/[% project %]
  cp app/build/outputs/apk/androidTest/${v,}/app-${v,}-androidTest.apk $distdir/[% project %]

  cd $distdir
  [% c('tar', {
          tar_src => [ project ],
          tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'),
      }) %]
[% END %]

path: projects/fenix/build


code:
# vim: filetype=yaml sw=2
version: '[% c("abbrev") %]'
filename: 'fenix-[% c("version") %]-[% c("var/build_id") %].tar.gz'
git_hash: 'tor-browser-[% c("var/fenix_version") %]-[% c("var/torbrowser_branch") %]-1-build3'
git_url: https://gitlab.torproject.org/tpo/applications/fenix.git
tag_gpg_id: 1
gpg_keyring: torbutton.gpg
variant: Beta
container:
  use_container: 1

var:
  fenix_version: 99.0.0b3
  torbrowser_branch: 11.5
  git_branch: 'tor-browser-[% c("var/fenix_version") %]-[% c("var/torbrowser_branch") %]-1'
  copyright_year: '[% exec("git show -s --format=%ci").remove("-.*") %]'
  # This should be updated when the list of gradle dependencies is changed.
  gradle_dependencies_version: 35
  gradle_version: 7.0.2
  glean_parser: 5.0.1
  arch_deps:
    - python3-venv

targets:
  release:
    variant: Release
  nightly:
    git_hash: '[% c("var/git_branch") %]'
    tag_gpg_id: 0
    variant: Nightly

input_files:
  - project: container-image
  - name: '[% c("var/compiler") %]'
    project: '[% c("var/compiler") %]'
  - project: gradle
    name: gradle
  - name: android-components
    project: android-components
  - name: application-services
    project: application-services
  - name: geckoview
    project: geckoview
    enable: '[% c("var/android_single_arch") %]'
  - name: geckoview
    project: geckoview
    pkg_type: merge_aars
    enable: '[% !c("var/android_single_arch") %]'
  - name: tba-translation
    project: tba-translation
  - filename: 'gradle-dependencies-[% c("var/gradle_dependencies_version") %]'
    name: gradle-dependencies
    exec: '[% INCLUDE "fetch-gradle-dependencies" %]'
  - URL: '[% pc("glean", "var/glean_wheels_url/" _ c("var/glean_parser"), { error_if_undef => 1 }) %]'
    name: glean
    sha256sum: '[% pc("glean", "var/glean_wheels_sha256sum/" _ c("var/glean_parser"), { error_if_undef => 1 }) %]'
  - filename: mavenLocal.patch
  - project: tor-android-service
    name: tor-android-service
  - project: tor-onion-proxy-library
    name: topl

steps:
  list_toolchain_updates:
    git_url: https://github.com/mozilla-mobile/fenix.git
    git_hash: releases_v99.0.0
    #tag_gpg_id: 0
    input_files: []
    container:
      use_container: 0

  get_gradle_dependencies_list:
    git_hash: '[% c("var/git_branch") %]^{/Add Tor integration and UI}'
    filename: 'gradle-dependencies-list-[% c("var/fenix_version") %].txt'
    get_gradle_dependencies_list: '[% INCLUDE build %]'
    var:
      fetch_gradle_dependencies: 1
    input_files:
      - project: container-image
        pkg_type: build
      - filename: gen_gradle_deps_file.sh
      - name: '[% c("var/compiler") %]'
        project: '[% c("var/compiler") %]'
        pkg_type: build
      - project: gradle
        name: gradle
        pkg_type: build
      - project: tor-android-service
        name: tor-android-service
        pkg_type: build
      - project: tor-onion-proxy-library
        name: topl
        pkg_type: build

path: projects/fenix/config