bug#47092: Icecat sandbox causes issues with fonts in --pure env

bug#47092: Icecat sandbox causes issues with fonts in --pure env

[Martin via Bug reports for GNU Guix]

Hello,
whenever I'm trying to run 'guix environment --pure --ad-hoc icecat -- 
icecat' or similar commands in a --container I'm ending up with some 
tofu ugly font fallback box glyphs in the app. However everything works 
fine running 'guix environment --ad-hoc icecat -- icecat'. Moreover I've 
noticed that when I edit the default value of 
"security.sandbox.content.level" from 4 to 2 in "about:config" then the 
problem disappear and the fonts are properly displayed in --pure and 
--container env. I was trying to install all possible fonts, running 
'fc-cache -rfv' and analyze the icecat logs with "MOZ_SANDBOX_LOGGING=1" 
to include blocking paths into the 
"security.sandbox.content.read_path_whitelist" but still I couldn't fix 
this issue with the icecat default sandbox level. Any ideas how to solve 
it in Guix System and what are the side effects of using 
"security.sandbox.content.level=2" in --pure env?

Kind regards!
Martin

security.sandbox.content.read_path_whitelist

bug#47092: Icecat sandbox causes issues with fonts in --pure env

[zimoun]

Hi,

The example about ’eolie’ adapted to your usecase, does it not work?

See:
<https://guix.gnu.org/manual/devel/en/guix.html#Invoking-guix-environment>


All the best,
simon

bug#47092: Icecat sandbox causes issues with fonts in --pure env

[Martin via Bug reports for GNU Guix]

Hi Simon,
no it doesn't help in this case and in general eolie package seems to be 
broken because it doesn't work even with the simple 'guix environment 
--ad-hoc eolie --  eolie':

Traceback (most recent call last):
   File 
"/gnu/store/w47sa5q3vki5siwk5lb62ld4ksxa5gcn-eolie-0.9.101/bin/.eolie-real", 
line 20, in <module>
     from eolie.application import Application
   File 
"/gnu/store/w47sa5q3vki5siwk5lb62ld4ksxa5gcn-eolie-0.9.101/lib/python3.8/site-packages/eolie/application.py", 
line 19, in <module>
     gi.require_version("Handy", "1")
   File 
"/gnu/store/597f7p79vyxjhwsv2qqnn76hx107xgj1-python-pygobject-3.34.0/lib/python3.8/site-packages/gi/__init__.py", 
line 129, in require_version
     raise ValueError('Namespace %s not available' % namespace)
ValueError: Namespace Handy not available

Kind regards!
Martin

On 3/12/21 9:53 AM, zimoun wrote:
> Hi,
>
> The example about ’eolie’ adapted to your usecase, does it not work?
>
> See:
> <https://guix.gnu.org/manual/devel/en/guix.html#Invoking-guix-environment>
>
>
> All the best,
> simon

bug#47092: Icecat sandbox causes issues with fonts in --pure env

[zimoun]

Hi,

On Fri, 12 Mar 2021 at 10:15, Martin via Bug reports for GNU Guix <bug-guix@gnu.org> wrote:
> no it doesn't help in this case and in general eolie package seems to be 
> broken because it doesn't work even with the simple 'guix environment 
> --ad-hoc eolie --  eolie':

Indeed, the package eolie is broken; which is another issue–and BTW
thanks for pointing this out.  Back to your initial report about icecat,
what about something like that:

--8<---------------cut here---------------start------------->8---
   guix environment --preserve='^DISPLAY$' --container --network \
     --expose=/etc/machine-id \
     --expose=/etc/ssl/certs/ \
     --share=$HOME/.local/share/icecat/=$HOME/.local/share/icecat/ \
     --ad-hoc icecat nss-certs dbus --  icecat
--8<---------------cut here---------------end--------------->8---


All the best,
simon

bug#47092: Icecat sandbox causes issues with fonts in --pure env

[Martin via Bug reports for GNU Guix]

On 3/12/21 10:51 AM, zimoun wrote:
> Indeed, the package eolie is broken; which is another issue–and BTW
> thanks for pointing this out.  Back to your initial report about icecat,
> what about something like that:
>
> --8<---------------cut here---------------start------------->8---
>     guix environment --preserve='^DISPLAY$' --container --network \
>       --expose=/etc/machine-id \
>       --expose=/etc/ssl/certs/ \
>       --share=$HOME/.local/share/icecat/=$HOME/.local/share/icecat/ \
>       --ad-hoc icecat nss-certs dbus --  icecat
> --8<---------------cut here---------------end--------------->8---
It's still not relevant to my issue. To run icecat using your example 
you should change one parameter to 
"--share=$HOME/.mozilla=$HOME/.mozilla" but again with the default 
"security.sandbox.content.level=4" the fonts will be tofued. I think 
once the issue could be fixed with simpler command, i.e. 'guix 
environment --pure --ad-hoc icecat -- icecat' than it would be easier to 
port the solution on the --container case.

Kind regards!
Martin

bug#47092: Icecat sandbox causes issues with fonts in --pure env

[zimoun]

Hi,

For discussion, please CC the bug.


On Fri, 12 Mar 2021 at 10:14, Martin <smartin@disroot.org> wrote:
> Hi Simon,
> no it doesn't help in this case and in general eolie package seems to be 
> broken because it doesn't work even with the simple 'guix environment 
> --ad-hoc eolie --  eolie':

The manual example is:

--8<---------------cut here---------------start------------->8---
guix environment --preserve='^DISPLAY$' --container --network \
  --expose=/etc/machine-id \
  --expose=/etc/ssl/certs/ \
  --share=$HOME/.local/share/eolie/=$HOME/.local/share/eolie/ \
  --ad-hoc eolie nss-certs dbus --  eolie
--8<---------------cut here---------------end--------------->8---

from <https://guix.gnu.org/manual/devel/en/guix.html#Invoking-guix-environment>


Does it not work for you?

Then it should be adapted for your use-case.



All the best,
simon

bug#47092: Icecat sandbox causes issues with fonts in --pure env

[Martin via Bug reports for GNU Guix]

Problem fixed with the newest IceCat v91.2.0-guix0-preview1 in the
  guix c1ca853
     repository URL: https://git.savannah.gnu.org/git/guix.git
     branch: master
     commit: c1ca85323d5246fc805a31e03b4164b8da08e930

bug#47092: Icecat sandbox causes issues with fonts in --pure env

[Mark H Weaver]

Hi,

Martin via Bug reports for GNU Guix <bug-guix@gnu.org> writes:

> Problem fixed with the newest IceCat v91.2.0-guix0-preview1 in the
>   guix c1ca853
>      repository URL: https://git.savannah.gnu.org/git/guix.git
>      branch: master
>      commit: c1ca85323d5246fc805a31e03b4164b8da08e930

Thanks for letting us know!  I'm closing this bug now.

     Regards,
       Mark

-- 
Disinformation flourishes because many people care deeply about injustice
but very few check the facts.  Ask me about <https://stallmansupport.org>.