debian/0000755000000000000000000000000012037332412007163 5ustar debian/gbp.conf0000644000000000000000000000003712037331777010617 0ustar [DEFAULT] pristine-tar = False debian/rules0000755000000000000000000000042712037331777010263 0ustar #!/usr/bin/make -f %: dh --with xul-ext $@ override_dh_auto_build: mkdir -p pkg bash makexpi.sh override_dh_auto_install: install-xpi --remove-license-files pkg/*.xpi override_dh_installchangelogs: dh_installchangelogs src/CHANGELOG override_dh_auto_clean: rm -rf pkg debian/control0000644000000000000000000000336412037331777010611 0ustar Source: torbutton Section: web Priority: optional Maintainer: Jérémy Bobbio Uploaders: Debian Mozilla Extension Maintainers Build-Depends: debhelper (>= 7.0.50~), mozilla-devscripts (>= 0.19~), zip Standards-Version: 3.9.2 DM-Upload-Allowed: yes Homepage: https://www.torproject.org/torbutton/ Vcs-Git: git://git.debian.org/pkg-mozext/torbutton.git Vcs-Browser: http://git.debian.org/?p=pkg-mozext/torbutton.git Package: xul-ext-torbutton Architecture: all Depends: ${misc:Depends} Recommends: tor, ${xpi:Recommends} Suggests: privoxy Provides: ${xpi:Provides} Enhances: ${xpi:Enhances} Breaks: ${xpi:Breaks} Replaces: iceweasel-torbutton (<< 1.2.4-2) Description: Iceweasel/Firefox extension enabling 1-click toggle of Tor usage Torbutton is a 1-click way for Iceweasel/Firefox users to enable or disable the browser's use of Tor (an anynomous communication system). . Torbutton tries to isolate as much as possible Tor sessions from your non-Tor sessions to preserve your anonimity. To achieve the safest possible browsing experience, various browsing features are also reconfigured in Tor sessions (like javascript, cookies and plugins). . It adds a panel to the statusbar that says "Tor Enabled" (in green) or "Tor Disabled" (in red). The user may click on the panel to toggle the status. If the user (or some other extension) changes the settings, the change is automatically reflected in the statusbar. Package: iceweasel-torbutton Architecture: all Depends: xul-ext-torbutton, ${misc:Depends} Description: transitional dummy package This is a transitional dummy package to ease the migration from the iceweasel-torbutton to the new xul-ext-torbutton package. You can remove it safely. debian/NEWS0000644000000000000000000000147312037331777007704 0ustar torbutton (1.4.6.3-1) unstable; urgency=high Security fixes introduced in Iceweasel 10.0.8esr prevents Torbutton from hooking window properties. This means that using this package is no longer substantially different from disabling websockets, disabling plugins, and using Private Browsing Mode to prevent disk leaks. Due to the very strong risk of fingerprinting and the resulting reduction of the anonymity set, it is more than strongly advised to uninstall this package and use the TorBrowserBundle instead. The later can be downloaded at: https://www.torproject.org/projects/torbrowser.html.en The TorBrowser also includes several changes in Firefox itself that address other possible leaks and fingerprinting issues. -- Jérémy Bobbio Tue, 16 Oct 2012 20:33:40 +0200 debian/docs0000644000000000000000000000005312037331777010051 0ustar debian/README.privoxy debian/README.polipo debian/README.privoxy0000644000000000000000000000164012037331777011600 0ustar Tor only provides TCP layer anonymity. It does not do any protocol cleaning, so if you are going to browse the web you still give away a lot of information to servers. The Tor project currently recommends to use Polipo instead of Privoxy. Please look at README.polipo for information on how to configure Polipo for Tor usage. The privoxy package provides a privacy enhancing HTTP proxy, which is good at filtering headers, cookies, and much more. To view the description of the Debian privoxy package just run "apt-cache show privoxy". Please refer to the privoxy documentation for more details. In order to use privoxy over tor, add the following line to the end of the privoxy configuration file: forward-socks4a / localhost:9050 . (the dot is important) Torbutton is configured to use Privoxy by default. If you choose to use Tor directly (which is not recommended), you can uncheck "Use Polipo" in the preferences. debian/compat0000644000000000000000000000000212037331777010376 0ustar 7 debian/xul-ext-torbutton.postrm0000755000000000000000000000042412037331777014115 0ustar #!/bin/sh set -e if [ "$1" = "remove" ]; then # Force a refresh of component registries, see #571596 and # https://bugzilla.mozilla.org/show_bug.cgi?id=602811 for details if [ -f /usr/lib/iceweasel/.autoreg ]; then touch /usr/lib/iceweasel/.autoreg fi fi #DEBHELPER# debian/copyright0000644000000000000000000000633412037331777011141 0ustar This package was debianized by Jérémy Bobbio on Thu, 26 Apr 2007 14:55:15 +0200. It was downloaded from https://torbutton.torproject.org/ and upstream repository available at git://git.torproject.org/git/torbutton -------------------------------------------------------------------------------- Copyright (c) 2006-2008 Scott Squires, Oleg Ivanov, Mike Perry Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. -------------------------------------------------------------------------------- Date: Fri, 3 Mar 2006 03:16:21 +0200 From: Oleg Ivanov To: Scott Squires Subject: Re: ProxyButton licensing question Hello Scott, I'm glad to support your project so you can use the Proxybutton in any way you need under any open source license as it's stated in mozdev's copyright policy. I'll just ask you to put in the Tor or it's source code any credits with references to me and the original Proxybutton. Feel free to ask if you have any questions regarding the extension - I'll be glad to help you. On Thursday 02 March 2006 05:01, you wrote: > Hello, > > I am a volunteer for the Tor project, which is a network proxy with strong > anonymnity. We would like to make it easier for users to install and > configure the software, and would like a firefox button to enable/disable > Tor. Your extension is very close to what we need, our version would just > set the proxy for the user instead of the user needing to enter the > information. So I was wondering what license your software is released under > and whether we can use it as a base for this extension. > > Thanks! > --Scott -- Oleg Ivanov mailto: saruman@unigsm.com ICQ #69991809 -------------------------------------------------------------------------------- Exceptions to the above: * src/components/cookie-jar-selector.js, src/components/ignore-history.js: Copyright (c) 2006 Collin Jackson * src/components/nsSessionStore2.js, src/components/nsSessionStore3.js: Licensed under MPL 1.1/GPL 2.0/LGPL 2.1, available at: /usr/share/doc/iceweasel/MPL.gz, /usr/share/common-licenses/GPL-2 and /usr/share/common-licenses/LGPL-2.1 on a Debian system. Copyright (c) 2006 Simon Bünzli debian/changelog0000644000000000000000000002000012037331777011042 0ustar torbutton (1.4.6.3-1) unstable; urgency=high * New upstream release: - Restore compatibility with Iceweasel 10.0.8esr. Unfortunately, that means that almost all fingerprinting defense are now unapplicable to mainstream Iceweasel. (Closes: #690658) - Refresh debian/patches/restore-status-panel-on-ff4.patch. * Add a NEWS.Debian file: users are now more than strongly encouraged to use the TorBrowserBundle instead of this package. -- Jérémy Bobbio Tue, 16 Oct 2012 11:00:33 +0200 torbutton (1.4.6-1) unstable; urgency=low * New upstream release. * Disable locked_mode in default settings. But Wheezy will be the last release of Debian with a 'toggling' Torbutton. -- Jérémy Bobbio Sat, 23 Jun 2012 15:19:11 +0200 torbutton (1.4.5.1-1) unstable; urgency=low * New upstream release: - Set SOCKS port and host only with recommended settings. (Closes: #648253) -- Jérémy Bobbio Mon, 26 Dec 2011 16:55:59 +0100 torbutton (1.4.4.1-1) unstable; urgency=low * New upstream release: - Drop debian/patches/fix-loading-of-system-homepage.patch; merged upstream. * Add Breaks dynamically generated by mozilla-devscripts. * Fix a typo in debian/README.source. -- Jérémy Bobbio Tue, 18 Oct 2011 22:00:51 +0200 torbutton (1.4.3-1) unstable; urgency=low * New upstream release: * Refresh fix-loading-of-system-homepage.patch. -- Jérémy Bobbio Tue, 13 Sep 2011 23:00:59 +0200 torbutton (1.4.1-1) unstable; urgency=low [ Jérémy Bobbio ] * New upstream release. * Update debian/patches status. * Remove polipo from Recommends, now that Iceweasel can directly use Tor as a SOCKS proxy. -- Jérémy Bobbio Tue, 30 Aug 2011 19:41:10 +0200 torbutton (1.4.0-2) unstable; urgency=low * Add restore-status-panel-on-ff4.patch: Restore status panel visibility on FF4+. (Closes: #634983) * Add debian/patches/fix-loading-of-system-homepage.patch: Fix loading of system homepage when starting with Tor enabled. -- Jérémy Bobbio Fri, 22 Jul 2011 14:54:22 +0200 torbutton (1.4.0-1) unstable; urgency=low * New upstream releases: (Closes: #633723) - Refresh debian/patches/localhost-proxy.patch. - Upload to unstable, Iceweasel 5 has been uploaded there. -- Jérémy Bobbio Tue, 19 Jul 2011 17:01:36 +0200 torbutton (1.3.3~alpha-1) experimental; urgency=low * New upstream alpha release: - Compatible with Firefox 4.x (Closes: #617503) - Remove fix_broken_locale_useragent_string.patch and fix_captcha_detection_for_encrypted_google.patch, both merged upstream. * Fix tag verification step in README.source. * Bump Standards-Version to 3.9.2, no changes required. * Make slight improvements to README.privoxy. (Closes: #619155) -- Jérémy Bobbio Fri, 17 Jun 2011 19:53:43 +0200 torbutton (1.2.5-3) unstable; urgency=low * Force a refresh of Iceweasel component registries when the package is removed. Credits should go to Mike Hommey on how to solve this. (Closes: #571596) * Remove the now useless README.Debian. -- Jérémy Bobbio Fri, 08 Oct 2010 17:15:38 +0200 torbutton (1.2.5-2) unstable; urgency=low [ Benjamin Drung ] * Remove myself from Uploaders. [ Jérémy Bobbio ] * Add fix_broken_locale_useragent_string.patch: using Torbutton with a localized user agent string on Debian resulted in a bad and fingerprintable string. (Closes: #595375) * Add fix_captcha_detection_for_encrypted_google.patch: fix captcha detection for encrypted.google.com. * Document a workaround for #571596 in README.Debian. * Bump Standards-Version to 3.9.1, no changes required. -- Jérémy Bobbio Thu, 07 Oct 2010 23:23:37 +0200 torbutton (1.2.5-1) unstable; urgency=low * New upstream version. * Document how to update the package for a new upstream release in debian/README.source. -- Jérémy Bobbio Sat, 10 Apr 2010 21:45:50 +0200 torbutton (1.2.4-2) unstable; urgency=low * Use mozilla-devscripts 0.19 and dh 7 to build the package. * Mention Firefox in description. * Add myself to uploaders. * Bump Standards-Version to 3.8.4. * Update debian/watch. * Switch to 3.0 (quilt) source format and create localhost-proxy.patch. * Rename binary package from iceweasel-torbutton to xul-ext-torbutton according to new policy. -- Benjamin Drung Thu, 28 Jan 2010 23:42:03 +0100 torbutton (1.2.4-1) unstable; urgency=low * New upstream version. -- Jérémy Bobbio Wed, 23 Dec 2009 18:17:39 +0100 torbutton (1.2.3-1) unstable; urgency=low * New upstream version: - fix test settings issues with dead privoxy. (Closes: #518013) * Upstream has switched to Git. Update README.source, copyright and rules to reflect this. * Recommends polipo on top of privoxy to follow the Tor project directives. * Add README.polipo in order to document how to configure polipo for Tor browsing. -- Jérémy Bobbio Sun, 13 Dec 2009 15:45:56 +0100 torbutton (1.2.2-1) unstable; urgency=low * New upstream Version * Bump Standards-Version to 3.8.3, no changes required. -- Jérémy Bobbio Thu, 20 Aug 2009 01:32:15 +0200 torbutton (1.2.1-1) unstable; urgency=low * New upstream version: - do not resize window when it's maximized, full screen, ratpoisioned/evilwmed, or minimized. (Closes: #525177) * Add a README.privoxy with simple instructions on why and how to use Privoxy. Most of it has been take from the tor package and was written by Peter Palfrader. (Closes: #525178) * As Privoxy in Debian binds on "localhost", defaults Torbutton to use "localhost" instead of "127.0.0.1"; fixing issues when IPv6 is enabled. (Closes: #518371) * Update Homepage. * Bump Standards-Version to 3.8.1, no changes required. * Update Vcs-* field and document Git usage in README.source. * Add pkg-mozext to Uploaders. -- Jérémy Bobbio Sat, 16 May 2009 21:32:48 +0200 torbutton (1.2.0-1) unstable; urgency=low * New upstream version. * Bump Standards-Version to 3.8.0, no further changes required. * Fix upstream version mangling in watch file. (Closes: #493902) * Ship upstream README file. -- Jérémy Bobbio Sun, 10 Aug 2008 20:25:17 +0000 torbutton (1.2.0~rc5-1) unstable; urgency=low * New upstream release: - adds compatibility with iceweasel 3.0 (Closes: #488341) - remove compatibility with icedove, so drop the icedove-torbutton package. * Update get-orig-source target to use the new upstream repository (using svn). * Add a watch file. * Point Homepage to its new location. * Modify the Description to reflect new features. * Add a debian/README.source file describing get-orig-source. * Add XS-Vcs-* fields now that the package is in collab-maint. * Update debian/copyright. * Many thanks to Arnaud Renevier for his work on this release! -- Jérémy Bobbio Fri, 11 Jul 2008 17:39:12 +0000 torbutton (1.0.4-3) unstable; urgency=low * Allow Torbutton to be installed on icedove 2.0. (Closes: #472876) * Disable debugging in torbutton.js. (Closes: #444554) * Promote Homepage pseudo-field as a real source package control field. * Bump Standards-Version to 3.7.3, no changes required. -- Jérémy Bobbio Thu, 27 Mar 2008 16:45:50 +0100 torbutton (1.0.4-2) unstable; urgency=low * Add a short description of Tor in package descriptions (as suggested by Charles Plessy and Ron Johnson). * Make the extension correctly installable on Iceweasel 2.0. * Add Recommends for tor and privoxy. -- Jérémy Bobbio Fri, 11 May 2007 16:24:16 +0200 torbutton (1.0.4-1) unstable; urgency=low * Initial release. (Closes: #421107) -- Jérémy Bobbio Thu, 26 Apr 2007 16:28:58 +0200 debian/source/0000755000000000000000000000000012037331777010500 5ustar debian/source/format0000644000000000000000000000001412037331777011706 0ustar 3.0 (quilt) debian/watch0000644000000000000000000000017312037331777010232 0ustar version=3 opts="uversionmangle=s/rc/~rc/" \ http://ftp.mozilla.org/pub/mozilla.org/addons/2275/torbutton-([\d\.]+).*.xpi debian/patches/0000755000000000000000000000000012037331777010627 5ustar debian/patches/localhost-proxy.patch0000644000000000000000000000252112037331777015017 0ustar Description: Use "localhost" instead of "127.0.0.1" as proxy As Privoxy in Debian binds on "localhost", defaults Torbutton to use "localhost" instead of "127.0.0.1"; fixing issues when IPv6 is enabled. Bug-Debian: http://bugs.debian.org/518371 Author: Jérémy Bobbio diff --git a/src/chrome/content/preferences.js b/src/chrome/content/preferences.js index a926f36..2d90f34 100644 --- a/src/chrome/content/preferences.js +++ b/src/chrome/content/preferences.js @@ -34,7 +34,7 @@ function torbutton_prefs_set_field_attributes(doc) proxy_port = 0; } else { if (doc.getElementById('torbutton_usePrivoxy').checked) { - proxy_host = '127.0.0.1'; + proxy_host = 'localhost'; proxy_port = 8118; } else { proxy_host = ''; diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index 8c905d1..786861e 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -654,7 +654,7 @@ function torbutton_init_prefs() { torprefs.setBoolPref('use_privoxy', true); if (torprefs.getBoolPref('use_privoxy')) { - proxy_host = '127.0.0.1'; + proxy_host = 'localhost'; proxy_port = 8118; } else { proxy_host = ''; debian/patches/disable-locked-mode.patch0000644000000000000000000000375212037331777015443 0ustar Description: disable locked_mode in default settings Upstream now makes Torbutton 'always on' mode the default. This would be surprising for users that would migrate from Squeeze: every Iceweasel profile would always want to go through Tor, unless the extension was explicitly disabled. So let's keep the toggling mode for Wheezy, and work on having Torbrowser in Debian for Wheezy+1. Author: Jérémy Bobbio Forwarded: not-needed diff --git a/src/defaults/preferences/preferences.js b/src/defaults/preferences/preferences.js index 8dd2add..70ad3af 100644 --- a/src/defaults/preferences/preferences.js +++ b/src/defaults/preferences/preferences.js @@ -22,7 +22,7 @@ pref("extensions.torbutton.gopher_port",0); pref("extensions.torbutton.socks_host",""); pref("extensions.torbutton.socks_port",0); pref("extensions.torbutton.socks_version",5); -pref("extensions.torbutton.locked_mode",true); +pref("extensions.torbutton.locked_mode",false); pref("extensions.torbutton.test_url","https://check.torproject.org/?TorButton=true"); pref("extensions.torbutton.test_failed",false); pref("extensions.torbutton.no_proxies_on","127.0.0.1"); @@ -136,7 +136,7 @@ pref("extensions.torbutton.no_search",true); pref("extensions.torbutton.set_uagent",true); pref("extensions.torbutton.notor_sessionstore",true); pref("extensions.torbutton.nonontor_sessionstore",false); -pref("extensions.torbutton.restore_tor",true); +pref("extensions.torbutton.restore_tor",false); pref("extensions.torbutton.reload_crashed_jar",true); pref("extensions.torbutton.spoof_english",true); pref("extensions.torbutton.spoof_charset",'iso-8859-1,*,utf-8'); @@ -220,4 +220,4 @@ pref("extensions.torbutton.useragent_vendorSub",""); pref("extensions.torbutton.safecache",1); // 0=always, 1=during tor, 2=never pref("extensions.torbutton.dual_key_cookies",false); pref("extensions.torbutton.cookie_js_allow", true); -pref("extensions.torbutton.prompt_torbrowser", true); +pref("extensions.torbutton.prompt_torbrowser", false); debian/patches/restore-status-panel-on-ff4.patch0000644000000000000000000000433412037331777017044 0ustar Description: Restore status panel visibility on FF4+ Quoting the bug submitter: "apparrently in new versions of torbutton the popup menu is part of the navbar. This doesn't work well with vimperator, where the navbar is usually disabled, so the menu doesn't appear at all. Please move it back to the statusbar." . So let's restore panel visibility in the status bar, even on FF4+. We also need to ensure that the popup menu is 'visible' in all cases. Bug-Debian: http://bugs.debian.org/634983 Author: Jérémy Bobbio Forwarded: https://trac.torproject.org/projects/tor/ticket/3685 diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index e629102..374f403 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -364,10 +364,18 @@ function torbutton_set_panel_view() { if (!o_statuspanel || !o_prefbranch) return; // Firefox 4 has no toolbar panel - var display_panel = o_prefbranch.getBoolPref('display_panel') - && !m_tb_ff4; + var display_panel = o_prefbranch.getBoolPref('display_panel'); torbutton_log(2, 'setting panel visibility'); o_statuspanel.setAttribute('collapsed', !display_panel); + + // Prevent the FF4 nav bar from making our menu invisible... + var o_toolbutton = torbutton_get_toolbutton(); + if (o_toolbutton) { + var context = document.getElementById('torbutton-context-menu'); + context.style.visibility = "visible"; + context.hidden = false; + torbutton_log(3, "Set new context menu."); + } } // Bug 1506 P1 @@ -485,16 +493,6 @@ function torbutton_init_toolbutton() { try { torbutton_log(3, "Initializing the Torbutton button."); - // Prevent the FF4 status bar from making our menu invisible... - /* Not needed - var o_toolbutton = torbutton_get_toolbutton(); - if (o_toolbutton) { - var context = document.getElementById('torbutton-context-menu'); - context.style.visibility = "visible"; - context.hidden = false; - torbutton_log(3, "Set new context menu."); - } - */ torbutton_update_toolbutton(torbutton_check_status()); } catch(e) { torbutton_log(4, "Error Initializing Torbutton button: "+e); debian/patches/series0000644000000000000000000000012212037331777012037 0ustar localhost-proxy.patch restore-status-panel-on-ff4.patch disable-locked-mode.patch debian/README.source0000644000000000000000000000220312037331777011354 0ustar README.source for the torbutton package ======================================= torbutton upstream does not directly release source tarball. As upstream is using Git, releases are merged into the 'upstream' branch of the Debian package repository. torbutton is managed in a Git repository using git-buildpackage (_without_ pristine-tar). It follows most of the advice provided by Russ Allbery at: http://www.eyrie.org/~eagle/notes/debian/git.html Creating an updated package for a new upstream release goes as: 0. Add a remote with upstream repository if not already done: $ git remote add upstream git://git.torproject.org/torbutton.git 1. Fetch new commits from upstream repository: $ git fetch upstream 2. Verify the tag for the new version: $ git tag -v 3. Merge new upstream version to "upstream" branch: $ git checkout upstream $ git merge upstream $ git tag upstream/ 4. Merge "upstream" branch to "master" branch: $ git checkout master $ git merge upstream/ $ dch -v -1 $ git commit debian/changelog -m "Add new changelog entry for -1" debian/README.polipo0000644000000000000000000000153612037331777011366 0ustar Tor only provides TCP layer anonymity. It does not do any protocol cleaning, so if you are going to browse the web you still give away a lot of information to servers. The polipo package provides a caching web proxy that does http pipelining well, so it's well-suited for Tor's latencies. To view the description of the Debian polipo package just run "apt-cache show polipo". Please refer to the polipo documentation for more details. In order to use polipo over tor, the configuration recommended by the Tor project is available at: https://svn.torproject.org/svn/torbrowser/trunk/build-scripts/config/polipo.conf On a Debian system, this file is intended to be put at /etc/polipo/config. Torbutton is configured to use Polipo by default. If you choose to use Tor directly (which is not recommended), you can uncheck "Use Polipo" in the preferences.