Skip to content

Commit bd19c46

Browse files
HainishHainish
committed
Updating the make script to reflect changes in the CRX signing process
1 parent bcbfbed commit bd19c46

File tree

7 files changed

+124
-107
lines changed

7 files changed

+124
-107
lines changed

‎.build_exclusions‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,7 @@ chrome/content/rules/validity-*
1010
chrome/content/rules/make-*
1111
*.xcf.gz
1212
.gitignore
13-
webextension/.gitignore
14-
chrome-resources/update-from-chrome-svn.sh
15-
webextension/chrome-resources/update-from-chrome-svn.sh
1613
.eslintrc.json
17-
webextension/.eslintrc.json
1814
.eslintignore
1915
node_modules
2016
package-lock.json

‎chromium/manifest.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,4 +55,4 @@
5555
"web_accessible_resources": [
5656
"/pages/cancel/index.html"
5757
]
58-
}
58+
}

‎chromium/updates-master.xml‎

Lines changed: 0 additions & 6 deletions
This file was deleted.

‎dummy-chromium.pem‎

Lines changed: 13 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,13 @@
1-
-----BEGIN RSA PRIVATE KEY-----
2-
MIIEogIBAAKCAQEAt4ew59KRXh6f9/sk4gbt5LqO5+yOGwEw6kwZxZl66BdZZyg5
3-
lFIt7je6s/OmEPpq4pHZ7cROfckYnOacFHYng68ZvYY2/0l7iBY1CjKMwe9TFoYv
4-
uqG6dCC2h4sbzikTO2dvarxptnSVm5Zbuw6mQTmCRKUzcey/njPq49nu0RcKvm+c
5-
NVRZCLofKHrioQcVt+9ig9I390Z9sF7l1uNy7IVdRw4B8KMJT22ghEGusYmFioHR
6-
jzVpTSetxcEfznJVzZWLfKqU45CY+ggDy2MhNVRFvTlFkENJoOtKRj/Xp6/0FqY4
7-
FqhglMdQI6cmhQibmQdzv9Q39P3lGRU3AEVJawIDAQABAoIBADEk75UUCIMIdlOD
8-
95tiuZ8O6adm66KFjiCfIiOMdqHhZro9xjVWUCBC4ga/zo8rTyW+YnnNoCsEh0e0
9-
ZMUB4pDbeWwLnXx8o8yMDcXeRVzFBh247tzt46ym+dmPwXFSBGlayDXvn+sQiuMv
10-
vv527MP4b06MYhs2hxUI1/QNbmqkaZNlJVaXlVjdNGjbdsEy8rVQIxdKkEG0qVKN
11-
4wH7aVmRTAYDJedDc+8eePviCYfthr1/1qX7Wj/sY+rKQFoxwTRhTs2hRwV0U0Wl
12-
1Gmk2Gz07l1M2mY+cImowOPYZT1jwiFSwoOczJNEmupH/F1VLomH12bkcb2l2lwi
13-
Ne1JubECgYEA5zYUfdm1/5SBnAmONcReos6w3CjzxlD7dcaFx1XIaGSfGU+H7MO7
14-
tdQfMVsAq+6SoO+DRBDS3Dn/2/imFxQ+2dYpuJvbQOzNKLqLU9M7LF8kBJFxP35C
15-
8GVhe6l+c8Csl4nK/bllzLsxtCatzL+cs7TNCvZUeQD6G86PoM1zH8MCgYEAyzTu
16-
y0UgG67a+MFcVdngRwcFIX06YeQSxAEkRFULaa/Yh6KEwaeYhTPv8rGIPJLAS8T7
17-
5UVJ4T3yVCPQBZ0Y11tLvh7onRTeEKevihBEDSSIsf020mYwgX5F3TD6JlwjVIpV
18-
k96AtDRcd27Y5eznCu94QyPbjUQbegWHNH9LfTkCgYBvIHwK3PfvpmYBJEqYpxBB
19-
OgyhVIGOQOALhGZKH33aRvp9BM+0yYLP6usvIqkY+eq5tUSnE1r1hF7oUAMsNova
20-
0WduFmL0OpyExdwvZuga9INwOqNuu/Xaay/GavmfEu0hTJYnCtPV6ecCylBgh3v+
21-
l5ixeyGwovqTIN3BkN2TVwKBgDighJcCqWLthDnj8G5AK/6/Fw/xDM7wtsYGJ2wf
22-
YvHNvgJ2KJaqtJcSFSDFlliC8LFssGGAwIjTMW9/F14pHB4PY/kUNfBoO0Xa5NEN
23-
nVkoQCuRi7BwJ74+SQvNtTfxXysU7aoqTCVrngTuT+Uq8muatiHHoUwpmZqUZcwc
24-
WRYJAoGACI3XKiDqhbVoDOvyTkDP1Fo651OH6z/6XTBEYB4ICoY7O2kL4BUwnUkh
25-
uzDVkAi5XrztUKZPE/HISTgq09umkrw4taFAXs3cBbLSns0C32SggNZGUCSfFScx
26-
hys49ypF5iddhaMBD5WtUMhrWTc1rUUQGaOlQ10xmAy1yCA2VK0=
27-
-----END RSA PRIVATE KEY-----
1+
-----BEGIN PRIVATE KEY-----
2+
MIIB5gIBADANBgkqhkiG9w0BAQEFAASCAdAwggHMAgEAAmEA3BZGOZsEWGEc82Yz
3+
Ddrey4Vp8dV4AQZPu2tM32Z6ZEx2538G3bWu5g0OPzX8Oqvzqr8ZRIvxcBbL3kgZ
4+
5wnhjVRTlWy0jxZDHCvVsATzhbhAt505zljHaRS1PrCYfV/nAgMBAAECYCQpRMCS
5+
R9R9oFQdpqXQIGswMIgbmuwQLWmN58ONAu8X4TGIHYiwIVyLKJwaMqcxOTn753Us
6+
7vFbGwoMnO3Krzh1Xn9z6uKnB7dDotgc9ZIQ5Ja8ExjJhl5iBMSWePYWAQIxAPRo
7+
yZ+JdWu+/y+/F6KsiCDx8EmdV8Dd09BogXH31S2VtSUEfZd/UDUPgbRgo+c9dwIx
8+
AOaGNJyJbHY4UCxC2hRBRZGNlic8SaFKEQAtN28gMWMDMgAh0ik8YtrPffBed+bN
9+
EQIxAOwTAx0MItTt6YLu6x9/0wUva89PIWHzYhKdvtqcbdbYEd4tljntCUYXMktO
10+
RUKoRQIxAL/3PHKqoc6kwGbLWO2LGVLHNCYCN1J/6j5aaRI6HcZVD9s6TteV+MA8
11+
D6UOFgz18QIxAJKXHDXXF+LXGsOwRMcp8nqg9Ri9daWW74JWyozFRqIsRhnhDhw9
12+
8f4cUAPw7BquBw==
13+
-----END PRIVATE KEY-----

‎make.sh‎

Lines changed: 95 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,63 @@
1919
# but these .crx files won't detect and upgrade to official HTTPS Everywhere
2020
# releases signed by EFF :/. We should find a more elegant arrangement.
2121

22+
! getopt --test > /dev/null
23+
if [[ ${PIPESTATUS[0]} -ne 4 ]]; then
24+
echo 'I’m sorry, `getopt --test` failed in this environment.'
25+
exit 1
26+
fi
27+
28+
OPTIONS=eck:
29+
LONGOPTS=remove-extension-update,remove-update-channels,key:
30+
! PARSED=$(getopt --options=$OPTIONS --longoptions=$LONGOPTS --name "$0" -- "$@")
31+
if [[ ${PIPESTATUS[0]} -ne 0 ]]; then
32+
# e.g. return value is 1
33+
# then getopt has complained about wrong arguments to stdout
34+
exit 2
35+
fi
36+
37+
# read getopt’s output this way to handle the quoting right:
38+
eval set -- "$PARSED"
39+
40+
REMOVE_EXTENSION_UPDATE=false
41+
REMOVE_UPDATE_CHANNELS=false
42+
KEY=$(pwd)/dummy-chromium.pem
43+
while true; do
44+
case "$1" in
45+
-e|--remove-extension-update)
46+
REMOVE_EXTENSION_UPDATE=true
47+
shift
48+
;;
49+
-c|--remove-update-channels)
50+
REMOVE_UPDATE_CHANNELS=true
51+
shift
52+
;;
53+
-k|--key)
54+
KEY="$2"
55+
shift 2
56+
;;
57+
--)
58+
shift
59+
break
60+
;;
61+
*)
62+
echo "Programming error"
63+
exit 3
64+
;;
65+
esac
66+
done
67+
68+
if [ "${KEY:0:1}" != "/" ]; then
69+
echo "Key must be specified as an absolute path."
70+
exit 4
71+
fi
72+
73+
74+
75+
2276
cd $(dirname $0)
2377

24-
if [ -n "$1" -a "$1" != "--remove-extension-update" -a "$1" != "--remove-update-channels" ]; then
78+
if [ -n "$1" ]; then
2579
BRANCH=`git branch | head -n 1 | cut -d \ -f 2-`
2680
SUBDIR=checkout
2781
[ -d $SUBDIR ] || mkdir $SUBDIR
@@ -36,17 +90,16 @@ VERSION=`python3.6 -c "import json ; print(json.loads(open('chromium/manifest.js
3690
echo "Building version" $VERSION
3791

3892
[ -d pkg ] || mkdir -p pkg
39-
[ -e pkg/crx ] && rm -rf pkg/crx
93+
[ -e pkg/crx-cws ] && rm -rf pkg/crx-cws
94+
[ -e pkg/crx-eff ] && rm -rf pkg/crx-eff
4095
[ -e pkg/xpi-amo ] && rm -rf pkg/xpi-amo
4196
[ -e pkg/xpi-eff ] && rm -rf pkg/xpi-eff
4297

4398
# Clean up obsolete ruleset databases, just in case they still exist.
4499
rm -f src/chrome/content/rules/default.rulesets src/defaults/rulesets.sqlite
45100

46-
sed -e "s/VERSION/$VERSION/g" chromium/updates-master.xml > chromium/updates.xml
47-
48-
mkdir -p pkg/crx/rules
49-
cd pkg/crx
101+
mkdir -p pkg/crx-cws/rules
102+
cd pkg/crx-cws
50103
cp -a ../../chromium/* ./
51104
# Turn the Firefox translations into the appropriate Chrome format:
52105
rm -rf _locales/
@@ -57,97 +110,73 @@ do_not_ship="*.py *.xml"
57110
rm -f $do_not_ship
58111
cd ../..
59112

60-
python3.6 ./utils/merge-rulesets.py || exit 1
113+
python3.6 ./utils/merge-rulesets.py || exit 5
114+
115+
cp src/chrome/content/rules/default.rulesets pkg/crx-cws/rules/default.rulesets
61116

62-
cp src/chrome/content/rules/default.rulesets pkg/crx/rules/default.rulesets
117+
sed -i -e "s/VERSION/$VERSION/g" pkg/crx-cws/manifest.json
63118

64-
sed -i -e "s/VERSION/$VERSION/g" pkg/crx/manifest.json
119+
for x in `cat .build_exclusions`; do
120+
rm -rf pkg/crx-cws/$x
121+
done
65122

66-
cp -a pkg/crx pkg/xpi-amo
67-
cp -a pkg/crx pkg/xpi-eff
123+
cp -a pkg/crx-cws pkg/crx-eff
124+
cp -a pkg/crx-cws pkg/xpi-amo
125+
cp -a pkg/crx-cws pkg/xpi-eff
68126
cp -a src/META-INF pkg/xpi-amo
69127
cp -a src/META-INF pkg/xpi-eff
70128

71129
# Remove the 'applications' manifest key from the crx version of the extension, change the 'author' string to a hash, and add the "update_url" manifest key
72130
# "update_url" needs to be present to avoid problems reported in https://bugs.chromium.org/p/chromium/issues/detail?id=805755
73-
python3.6 -c "import json; m=json.loads(open('pkg/crx/manifest.json').read()); m['author']={'email': 'eff.software.projects@gmail.com'}; del m['applications']; m['update_url'] = 'https://clients2.google.com/service/update2/crx'; open('pkg/crx/manifest.json','w').write(json.dumps(m,indent=4,sort_keys=True))"
131+
python3.6 -c "import json; m=json.loads(open('pkg/crx-cws/manifest.json').read()); m['author']={'email': 'eff.software.projects@gmail.com'}; del m['applications']; m['update_url'] = 'https://clients2.google.com/service/update2/crx'; open('pkg/crx-cws/manifest.json','w').write(json.dumps(m,indent=4,sort_keys=True))"
132+
python3.6 -c "import json; m=json.loads(open('pkg/crx-eff/manifest.json').read()); m['author']={'email': 'eff.software.projects@gmail.com'}; del m['applications']; open('pkg/crx-eff/manifest.json','w').write(json.dumps(m,indent=4,sort_keys=True))"
74133
# Remove the 'update_url' manifest key from the xpi version of the extension delivered to AMO
75134
python3.6 -c "import json; m=json.loads(open('pkg/xpi-amo/manifest.json').read()); del m['applications']['gecko']['update_url']; m['applications']['gecko']['id'] = 'https-everywhere@eff.org'; open('pkg/xpi-amo/manifest.json','w').write(json.dumps(m,indent=4,sort_keys=True))"
76135

77136
# If the --remove-extension-update flag is set, ensure the extension is unable to update
78-
if [ "$1" == "--remove-extension-update" -o "$2" == "--remove-extension-update" -o "$3" == "--remove-extension-update" ]; then
137+
if $REMOVE_EXTENSION_UPDATE; then
79138
echo "Flag --remove-extension-update specified. Removing the XPI extensions' ability to update."
80139
python3.6 -c "import json; m=json.loads(open('pkg/xpi-amo/manifest.json').read()); m['applications']['gecko']['update_url'] = 'data:text/plain,'; open('pkg/xpi-amo/manifest.json','w').write(json.dumps(m,indent=4,sort_keys=True))"
81140
python3.6 -c "import json; m=json.loads(open('pkg/xpi-eff/manifest.json').read()); m['applications']['gecko']['update_url'] = 'data:text/plain,'; open('pkg/xpi-eff/manifest.json','w').write(json.dumps(m,indent=4,sort_keys=True))"
82141
fi
83142

84143
# If the --remove-update-channels flag is set, remove all out-of-band update channels
85-
if [ "$1" == "--remove-update-channels" -o "$2" == "--remove-update-channels" -o "$3" == "--remove-update-channels" ]; then
144+
if $REMOVE_UPDATE_CHANNELS; then
86145
echo "Flag --remove-update-channels specified. Removing all out-of-band update channels."
87-
echo "require.scopes.update_channels.update_channels = [];" >> pkg/crx/background-scripts/update_channels.js
146+
echo "require.scopes.update_channels.update_channels = [];" >> pkg/crx-cws/background-scripts/update_channels.js
147+
echo "require.scopes.update_channels.update_channels = [];" >> pkg/crx-eff/background-scripts/update_channels.js
88148
echo "require.scopes.update_channels.update_channels = [];" >> pkg/xpi-amo/background-scripts/update_channels.js
89149
echo "require.scopes.update_channels.update_channels = [];" >> pkg/xpi-eff/background-scripts/update_channels.js
90150
fi
91151

92152
if [ -n "$BRANCH" ] ; then
93-
crx="pkg/https-everywhere-$VERSION.crx"
153+
crx_cws="pkg/https-everywhere-$VERSION-cws.crx"
154+
crx_eff="pkg/https-everywhere-$VERSION-eff.crx"
94155
xpi_amo="pkg/https-everywhere-$VERSION-amo.xpi"
95156
xpi_eff="pkg/https-everywhere-$VERSION-eff.xpi"
96-
key=../dummy-chromium.pem
97157
else
98-
crx="pkg/https-everywhere-$VERSION~pre.crx"
158+
crx_cws="pkg/https-everywhere-$VERSION~pre-cws.crx"
159+
crx_eff="pkg/https-everywhere-$VERSION~pre-eff.crx"
99160
xpi_amo="pkg/https-everywhere-$VERSION~pre-amo.xpi"
100161
xpi_eff="pkg/https-everywhere-$VERSION~pre-eff.xpi"
101-
key=dummy-chromium.pem
102162
fi
103-
if ! [ -f "$key" ] ; then
163+
if ! [ -f "$KEY" ] ; then
104164
echo "Making a dummy signing key for local build purposes"
105-
openssl genrsa 2048 > "$key"
165+
openssl genrsa -out /tmp/dummy-chromium.pem 768
166+
openssl pkcs8 -topk8 -nocrypt -in /tmp/dummy-chromium.pem -out $KEY
106167
fi
107168

108169

109-
## Based on https://code.google.com/chrome/extensions/crx.html
110-
111-
dir=pkg/crx
112-
name=pkg/crx
113-
pub="$name.pub"
114-
sig="$name.sig"
115-
zip="$name.zip"
116-
trap 'rm -f "$pub" "$sig" "$zip"' EXIT
117-
118-
# zip up the crx dir
119-
cwd=$(pwd -P)
120-
(cd "$dir" && ../../utils/create_zip.py -n "$cwd/$zip" -x "../../.build_exclusions" .)
121-
echo >&2 "CWS crx package has sha256sum: `openssl dgst -sha256 -binary "$cwd/$zip" | xxd -p`"
122-
123-
# signature
124-
openssl sha1 -sha1 -binary -sign "$key" < "$zip" > "$sig"
125-
126-
# public key
127-
openssl rsa -pubout -outform DER < "$key" > "$pub" 2>/dev/null
128-
129-
byte_swap () {
130-
# Take "abcdefgh" and return it as "ghefcdab"
131-
echo "${1:6:2}${1:4:2}${1:2:2}${1:0:2}"
132-
}
133-
134-
crmagic_hex="4372 3234" # Cr24
135-
version_hex="0200 0000" # 2
136-
pub_len_hex=$(byte_swap $(printf '%08x\n' $(ls -l "$pub" | awk '{print $5}')))
137-
sig_len_hex=$(byte_swap $(printf '%08x\n' $(ls -l "$sig" | awk '{print $5}')))
138-
139-
# Case-insensitive matching is a GNU extension unavailable when using BSD sed.
140-
if [[ "$(sed --version 2>&1)" =~ "GNU" ]]; then
141-
sed="sed"
142-
elif [[ "$(gsed --version 2>&1)" =~ "GNU" ]]; then
143-
sed="gsed"
144-
fi
145-
146-
(
147-
echo "$crmagic_hex $version_hex $pub_len_hex $sig_len_hex" | $sed -e 's/\s//g' -e 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/gI' | xargs printf
148-
cat "$pub" "$sig" "$zip"
149-
) > "$crx"
170+
# now pack the crx'es
171+
BROWSER="chromium-browser"
172+
which $BROWSER || BROWSER="chromium"
150173

174+
$BROWSER --no-message-box --pack-extension="pkg/crx-cws" --pack-extension-key="$KEY" 2> /dev/null
175+
$BROWSER --no-message-box --pack-extension="pkg/crx-eff" --pack-extension-key="$KEY" 2> /dev/null
176+
mv pkg/crx-cws.crx $crx_cws
177+
mv pkg/crx-eff.crx $crx_eff
178+
echo >&2 "CWS crx package has sha256sum: `openssl dgst -sha256 -binary "$crx_cws" | xxd -p`"
179+
echo >&2 "EFF crx package has sha256sum: `openssl dgst -sha256 -binary "$crx_eff" | xxd -p`"
151180

152181

153182
# now zip up the xpi AMO dir
@@ -185,11 +214,13 @@ echo >&2 "Rules disabled by default: `find src/chrome/content/rules -name "*.xml
185214
# see test/selenium/shim.py
186215
echo "Created $xpi_amo"
187216
echo "Created $xpi_eff"
188-
echo "Created $crx"
217+
echo "Created $crx_cws"
218+
echo "Created $crx_eff"
189219

190220
if [ -n "$BRANCH" ]; then
191221
cd ..
192-
cp $SUBDIR/$crx pkg
222+
cp $SUBDIR/$crx_cws pkg
223+
cp $SUBDIR/$crx_eff pkg
193224
cp $SUBDIR/$xpi_amo pkg
194225
cp $SUBDIR/$xpi_eff pkg
195226
rm -rf $SUBDIR

‎test/chromium.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ if [ "$1" == "--justrun" ]; then
3131
which $BROWSER || BROWSER="chromium"
3232
$BROWSER \
3333
--user-data-dir="$PROFILE_DIRECTORY" \
34-
--load-extension=pkg/crx/ \
34+
--load-extension=pkg/crx-cws/ \
3535
"$@"
3636
else
3737
./make.sh

‎test/selenium/shim.py‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,14 @@
33
from collections import namedtuple
44
import subprocess
55
import time
6+
import shutil
67

78
from selenium import webdriver
89
from selenium.webdriver import DesiredCapabilities
910
from selenium.webdriver.chrome.options import Options
1011

1112
firefox_info = {'extension_id': 'https-everywhere-eff@eff.org', 'uuid': 'd56a5b99-51b6-4e83-ab23-796216679614'}
12-
chrome_info = {'extension_id': 'nmleinhehnmmepmdbjddclicgpfhbdjo'}
13+
chrome_info = {'extension_id': 'kofalhllfompobhklifpbealgeckijek'}
1314

1415

1516
BROWSER_TYPES = ['chrome', 'firefox']
@@ -53,12 +54,21 @@ def get_browser_name(string):
5354
def build_crx():
5455
'''Builds the .crx file for Chrome and returns the path to it'''
5556
cmd = [os.path.join(get_git_root(), 'make.sh'), '--remove-update-channels']
56-
return os.path.join(get_git_root(), run_shell_command(cmd).split()[-1])
57+
run_shell_command(cmd)
58+
59+
# Since this is an unpacked extension we're loading, the extension ID is
60+
# determined by the below `crx_dir` path alone. Don't alter it without
61+
# changing the corresponding ID at the top of this file.
62+
63+
crx_dir = os.path.join(os.sep, 'tmp','https-everywhere-test')
64+
shutil.rmtree(crx_dir, True)
65+
shutil.copytree(os.path.join(get_git_root(), 'pkg', 'crx-cws'), crx_dir)
66+
return crx_dir
5767

5868

5969
def build_xpi():
6070
cmd = [os.path.join(get_git_root(), 'make.sh'), '--remove-update-channels']
61-
return os.path.join(get_git_root(), run_shell_command(cmd).split()[-3])
71+
return os.path.join(get_git_root(), run_shell_command(cmd).split()[-5])
6272

6373

6474
def install_ext_on_ff(driver, extension_path):
@@ -149,7 +159,7 @@ def chrome_manager(self):
149159
opts = Options()
150160
if self.on_travis: # github.com/travis-ci/travis-ci/issues/938
151161
opts.add_argument("--no-sandbox")
152-
opts.add_extension(self.extension_path)
162+
opts.add_argument("--load-extension=" + self.extension_path)
153163
opts.binary_location = self.browser_path
154164
opts.add_experimental_option("prefs", {"profile.block_third_party_cookies": False})
155165

0 commit comments

Comments
 (0)