[bug#71782] [PATCH v5 3/4] gnu: torbrowser: Update to 13.5.3 [security fixes].

["André Batista" <nandre@riseup.net>]

Hi Ian,

sex 06 set 2024 às 08:05:28 (1725620728), ian@retrospec.tv enviou:
> 
> This all looks good to me.  I built and ran both browsers and they seem to
> be working how I’d expect.

Great, thanks!

> My only question is around the locale handling -- (gnu packages gnuzilla)
> has a setup for these which I was able to reuse for LibreWolf.  Is that
> possible for mullvad and torbrowser?  It would be nice to have a unified way
> of handling this, instead of each browser implementing its own strategy.
> 

I'm not sure I understand why you think this to be desirable, could you
elaborate?

I'm also not sure if this is possible (without incuring in glitches) and
in my opinion this is not desirable for both torbrowser and mullvad
because:

I. Both these browsers have modified pristine firefox in a number of
non-trivial ways. Eg.: if you go to about:preferences you will see that
there are various user settings which are specific to this browsers or
even when you first launch torbrowser the connection settings page is
unknown to firefox. I believe that's the reason why these browsers do
not support 'all-mozilla-locales', but just a subset which has been
worked upon by the torproject.

II. In order to avoid guix users having a different fingerprint, we try
to be as close as possible to what upstream does. I'm not sure if locale
version could be somehow infered from the network, but I guess using the
same version is the safest bet;

III. Currently on guix master, these browsers are using code copied from
gnuzilla.scm, but with a subset of locales and different changesets
that are based on torproject settings. However, torproject has moved
from mercurial to the unified github firefox locales[1] which has
immensily simplified the work required to update the changesets (now
actually commits) and all locales supported on those browsers now have
only one commit, instead of various changesets on single locale repos;

IV. Moreover, I believe mozilla itself is on the way of deprecating
mercurial l10n-central in favor of firefox-locales git repo, since
this is where all work has been happening[2], while l10n-central has
stopped at 2024-07-10[2]. So probably in a not so distant future
gnuzilla will have to move on to that as well.

So I stand by the changes proposed on this patch series, at least as
things stand.

Thanks!

1. https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/55ad6ca216c086fb297af456ed0606ab88c1acdc
2. https://github.com/mozilla-l10n/firefox-l10n
3. https://hg.mozilla.org/l10n-central/