* [bug#71832] [PATCH 0/2] Add nss-latest; updte Librewolf to 127.0.2-2.
@ 2024-06-29 3:57 Ian Eure
2024-06-29 3:59 ` [bug#71832] [PATCH 1/2] gnu: Add nss-latest Ian Eure
` (7 more replies)
0 siblings, 8 replies; 33+ messages in thread
From: Ian Eure @ 2024-06-29 3:57 UTC (permalink / raw)
To: 71832; +Cc: Ian Eure
This patch series begins implementing my proposal for nss[1], by adding
nss-latest (at version 3.101). When the next ESR is out, I’ll update and
ungraft the other nss, as proposed.
It also updates Librewolf to 127.0.2-2, the latest version. Librewolf 127.x
requires nss >= 3.100, so both patches are combined in this series. LW also
builds with Rust 1.77 now, since that’s the new minimum version (and the
default version used by upstream Firefox builds).
[1]: https://lists.gnu.org/archive/html/guix-devel/2024-06/msg00318.html
Ian Eure (2):
gnu: Add nss-latest.
gnu: librewolf: Update to 127.0.2-1.
gnu/packages/librewolf.scm | 1039 ++++++++++++++++++------------------
gnu/packages/nss.scm | 67 ++-
2 files changed, 587 insertions(+), 519 deletions(-)
--
2.45.1
^ permalink raw reply [flat|nested] 33+ messages in thread* [bug#71832] [PATCH 1/2] gnu: Add nss-latest. 2024-06-29 3:57 [bug#71832] [PATCH 0/2] Add nss-latest; updte Librewolf to 127.0.2-2 Ian Eure @ 2024-06-29 3:59 ` Ian Eure 2024-06-29 3:59 ` [bug#71832] [PATCH 2/2] gnu: librewolf: Update to 127.0.2-1 Ian Eure 2024-06-29 17:22 ` [bug#71832] [PATCH v2 0/2] Add nss-latest; update Librewolf to 127.0.2-2 Ian Eure ` (6 subsequent siblings) 7 siblings, 1 reply; 33+ messages in thread From: Ian Eure @ 2024-06-29 3:59 UTC (permalink / raw) To: 71832; +Cc: Ian Eure * gnu/packages/nss.scm (nss-latest): New variable. Change-Id: Ifdc215090a20dee1bde83013852ef21b6cfd9979 --- gnu/packages/nss.scm | 67 ++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 61 insertions(+), 6 deletions(-) diff --git a/gnu/packages/nss.scm b/gnu/packages/nss.scm index d558079f44..6b45e59ea8 100644 --- a/gnu/packages/nss.scm +++ b/gnu/packages/nss.scm @@ -106,6 +106,9 @@ (define-public nspr-4.32 (base32 "0v3zds1id71j5a5si42a658fjz8nv2f6zp6w4gqrqmdr6ksz8sxv")))))) +;; nss should track ESRs, but currently doesn't. When the next ESR it out, it +;; should get updated. + (define-public nss (package (name "nss") @@ -153,13 +156,13 @@ (define-public nss ;; Ensure we are building for the (%current-target-system). #$@(if (%current-target-system) #~((string-append - "OS_TEST=" - (string-take #$(%current-target-system) - (string-index #$(%current-target-system) #\-))) + "OS_TEST=" + (string-take #$(%current-target-system) + (string-index #$(%current-target-system) #\-))) (string-append - "KERNEL=" (cond (#$(target-hurd?) "gnu") - (#$(target-linux?) "linux") - (else "")))) + "KERNEL=" (cond (#$(target-hurd?) "gnu") + (#$(target-linux?) "linux") + (else "")))) #~()) #$@(if (%current-target-system) #~("CROSS_COMPILE=1") @@ -303,6 +306,58 @@ (define-public nss/fixed (invoke "faketime" "2024-01-23" "./nss/tests/all.sh")) (format #t "test suite not run~%")))))))))))) +;; nss-latest tracks the latest released version. + +(define-public nss-latest + (package + (inherit nss) + (name "nss-latest") + (version "3.101") + (source (origin + (inherit (package-source nss)) + (uri (let ((version-with-underscores + (string-join (string-split version #\.) "_"))) + (string-append + "https://ftp.mozilla.org/pub/mozilla.org/security/nss/" + "releases/NSS_" version-with-underscores "_RTM/src/" + "nss-" version ".tar.gz"))) + (sha256 + (base32 + "1rw5xpclsy174znvxcb4d4zgjwadxy45mbh0wvkm3fxpnkq4i5w5")))) + (arguments + (substitute-keyword-arguments (package-arguments nss) + ((#:phases phases) + #~(modify-phases #$phases + (replace 'check + (lambda* (#:key tests? #:allow-other-keys) + (if tests? + (begin + ;; Use 127.0.0.1 instead of $HOST.$DOMSUF as HOSTADDR for + ;; testing. The latter requires a working DNS or /etc/hosts. + (setenv "DOMSUF" "localdomain") + (setenv "USE_IP" "TRUE") + (setenv "IP_ADDRESS" "127.0.0.1") + + ;; This specific test is looking at performance "now + ;; verify that we can quickly dump a database", and + ;; we're not testing performance here (especially + ;; since we're using faketime), so raise the + ;; threshold + (substitute* "nss/tests/dbtests/dbtests.sh" + ((" -lt 5") " -lt 50")) + + ;; Since the test suite is very lengthy, run the test + ;; suite once, not thrice as done by default, by + ;; selecting only the 'standard' cycle. + (setenv "NSS_CYCLES" "standard") + + ;; The "PayPalEE.cert" certificate expires every six months, + ;; leading to test failures: + ;; <https://bugzilla.mozilla.org/show_bug.cgi?id=609734>. To + ;; work around that, set the time to roughly the release date. + (invoke "faketime" "2024-01-23" "./nss/tests/all.sh")) + (format #t "test suite not run~%")))))))))) + (define-public nsncd (package (name "nsncd") -- 2.45.1 ^ permalink raw reply related [flat|nested] 33+ messages in thread
* [bug#71832] [PATCH 2/2] gnu: librewolf: Update to 127.0.2-1. 2024-06-29 3:59 ` [bug#71832] [PATCH 1/2] gnu: Add nss-latest Ian Eure @ 2024-06-29 3:59 ` Ian Eure 0 siblings, 0 replies; 33+ messages in thread From: Ian Eure @ 2024-06-29 3:59 UTC (permalink / raw) To: 71832; +Cc: Ian Eure * gnu/packages/librewolf.scm (librewolf): Update to 127.0.2-1. Reorganize module to improve usability and reduce duplication. The Rust package and build ID are now at the top of the file. The librewolf-source variable has been replaced with the make-librewolf-source procedure, centralizing versions & hashes in the librewolf package definition. Dedent some of the package’s arguments to improve readability. Change-Id: I15f8a2aa1fae07e0497ab5511d10af0c1f70cc2e --- gnu/packages/librewolf.scm | 1039 ++++++++++++++++++------------------ 1 file changed, 526 insertions(+), 513 deletions(-) diff --git a/gnu/packages/librewolf.scm b/gnu/packages/librewolf.scm index c84bcaf3ce..7f8579e8dd 100644 --- a/gnu/packages/librewolf.scm +++ b/gnu/packages/librewolf.scm @@ -93,6 +93,18 @@ (define-module (gnu packages librewolf) #:use-module (gnu packages xdisorg) #:use-module (gnu packages xorg)) +;; Define the versions of rust needed to build librewolf, trying to match +;; upstream. See the file taskcluster/kinds/toolchain/rust.yml at +;; https://searchfox.org under the particular firefox release, like +;; mozilla-esr102. +;; 1.75 is the default in Guix, 1.77 is the minimum for Librewolf. +(define rust-librewolf rust-1.77) + +;; Update this id with every update to its release date. +;; It's used for cache validation and therefore can lead to strange bugs. +;; ex: date '+%Y%m%d%H%M%S' +(define %librewolf-build-id "20240626133423") + (define (firefox-source-origin version hash) (origin (method url-fetch) @@ -114,11 +126,14 @@ (define (librewolf-source-origin version hash) (define computed-origin-method (@@ (guix packages) computed-origin-method)) -(define librewolf-source - (let* ((ff-src (firefox-source-origin "126.0.1" "0fr679rcwshwpfxidc55b2xsn4pmrr7p9ix4rr2mv2k7kwsjcc7n")) - (version "126.0.1-1") - (lw-src (librewolf-source-origin version "0cac80073vkzd85ai9rbnwixs1h9bpy4dj2ri6jxdlqsy5d663km"))) - +(define* (make-librewolf-source version #:key firefox-hash librewolf-hash) + (let* ((ff-src (firefox-source-origin + (car (string-split version #\-)) + firefox-hash)) + (version version) + (lw-src (librewolf-source-origin + version + librewolf-hash))) (origin (method computed-origin-method) (file-name (string-append "librewolf-" version ".source.tar.gz")) @@ -204,523 +219,521 @@ (define librewolf-source ".source.tar.gz") #$output)))))))) -;; Define the versions of rust needed to build librewolf, trying to match -;; upstream. See the file taskcluster/ci/toolchain/rust.yml at -;; https://searchfox.org under the particular firefox release, like -;; mozilla-esr102. -(define rust-librewolf rust) ; 1.75 is the default in Guix, 1.65 is the minimum. - -;; Update this id with every update to its release date. -;; It's used for cache validation and therefore can lead to strange bugs. -;; ex: date '+%Y%m%d%H%M%S' -(define %librewolf-build-id "20240607212143") - (define-public librewolf - (package - (name "librewolf") - (version "126.0.1-1") - (source librewolf-source) - (build-system gnu-build-system) - (arguments - (list - #:configure-flags #~(let ((clang #$(this-package-native-input "clang"))) - `("--enable-application=browser" - - ;; Configuration - "--without-wasm-sandboxed-libraries" - "--with-system-jpeg" - "--with-system-zlib" - "--with-system-png" - "--with-system-webp" - "--with-system-icu" - "--with-system-libvpx" - "--with-system-libevent" - "--with-system-ffi" - "--enable-system-pixman" - "--enable-jemalloc" - - ;; see https://bugs.gnu.org/32833 - "--with-system-nspr" - "--with-system-nss" - - ,(string-append "--with-clang-path=" clang - "/bin/clang") - ,(string-append "--with-libclang-path=" clang - "/lib") - - ;; Distribution - "--with-distribution-id=org.guix" - "--with-app-name=librewolf" - "--with-app-basename=LibreWolf" - "--with-branding=browser/branding/librewolf" - - ;; Features - "--disable-tests" - "--disable-updater" - "--enable-pulseaudio" - "--disable-crashreporter" - "--allow-addon-sideload" - "--with-unsigned-addon-scopes=app,system" - "--disable-eme" - - ;; Build details - "--disable-debug" - "--enable-rust-simd" - "--enable-release" - "--enable-optimize" - "--enable-strip" - "--enable-hardening" - "--disable-elf-hack")) - #:imported-modules %cargo-utils-modules - #:modules `((ice-9 regex) - (ice-9 string-fun) - (ice-9 ftw) - (srfi srfi-1) - (srfi srfi-26) - (rnrs bytevectors) - (rnrs io ports) - (guix elf) - (guix build gremlin) - ,@%gnu-build-system-modules) - #:phases #~(modify-phases %standard-phases - (add-after 'unpack 'fix-preferences - (lambda* (#:key inputs #:allow-other-keys) - (let ((port (open-file "browser/app/profile/firefox.js" - "a"))) - (define (write-setting key value) - (format port "~%pref(\"~a\", ~a);~%" key value) - (format #t + (let ((version "127.0.2-2")) + (package + (name "librewolf") + (version version) + (source (make-librewolf-source + version + #:firefox-hash + "1s73fdp7k60058ylyvlixq13k5hfbmj6k1y42fmzqlpg7n62lyqb" + #:librewolf-hash + "1f4xz496x1nf7lmvk50hakj9p6q0kzxl5f9s2k0b6kczvyc8gw5n")) + + (build-system gnu-build-system) + (arguments + (list + #:configure-flags + #~(let ((clang #$(this-package-native-input "clang"))) + `("--enable-application=browser" + + ;; Configuration + "--without-wasm-sandboxed-libraries" + "--with-system-jpeg" + "--with-system-zlib" + "--with-system-png" + "--with-system-webp" + "--with-system-icu" + "--with-system-libvpx" + "--with-system-libevent" + "--with-system-ffi" + "--enable-system-pixman" + "--enable-jemalloc" + + ;; see https://bugs.gnu.org/32833 + "--with-system-nspr" + "--with-system-nss" + + ,(string-append "--with-clang-path=" clang + "/bin/clang") + ,(string-append "--with-libclang-path=" clang + "/lib") + + ;; Distribution + "--with-distribution-id=org.guix" + "--with-app-name=librewolf" + "--with-app-basename=LibreWolf" + "--with-branding=browser/branding/librewolf" + + ;; Features + "--disable-tests" + "--disable-updater" + "--enable-pulseaudio" + "--disable-crashreporter" + "--allow-addon-sideload" + "--with-unsigned-addon-scopes=app,system" + "--disable-eme" + + ;; Build details + "--disable-debug" + "--enable-rust-simd" + "--enable-release" + "--enable-optimize" + "--enable-strip" + "--enable-hardening" + "--disable-elf-hack")) + #:imported-modules %cargo-utils-modules + #:modules `((ice-9 regex) + (ice-9 string-fun) + (ice-9 ftw) + (srfi srfi-1) + (srfi srfi-26) + (rnrs bytevectors) + (rnrs io ports) + (guix elf) + (guix build gremlin) + ,@%gnu-build-system-modules) + #:phases + #~(modify-phases %standard-phases + (add-after 'unpack 'fix-preferences + (lambda* (#:key inputs #:allow-other-keys) + (let ((port (open-file "browser/app/profile/firefox.js" + "a"))) + (define (write-setting key value) + (format port "~%pref(\"~a\", ~a);~%" key value) + (format #t "fix-preferences: setting value of ~a to ~a~%" key value)) - ;; We should allow the sandbox to read the store directory, - ;; because the sandbox has access to /usr on FHS distros. - (write-setting - "security.sandbox.content.read_path_whitelist" - (string-append "\"" - (%store-directory) "/\"")) - - ;; XDG settings should be managed by Guix. - (write-setting "browser.shell.checkDefaultBrowser" - "false") - (close-port port)))) - (add-after 'fix-preferences 'fix-ffmpeg-runtime-linker - (lambda* (#:key inputs #:allow-other-keys) - (let* ((ffmpeg (assoc-ref inputs "ffmpeg")) - (libavcodec (string-append ffmpeg - "/lib/libavcodec.so"))) - ;; Arrange to load libavcodec.so by its absolute file name. - (substitute* "dom/media/platforms/ffmpeg/FFmpegRuntimeLinker.cpp" - (("libavcodec\\.so") - libavcodec))))) - (add-after 'patch-source-shebangs 'patch-cargo-checksums - (lambda _ - (use-modules (guix build cargo-utils)) - (let ((null-hash - ;; This is the SHA256 output of an empty string. - (string-append - "e3b0c44298fc1c149afbf4c8996fb924" - "27ae41e4649b934ca495991b7852b855"))) - (for-each (lambda (file) - (format #t + ;; We should allow the sandbox to read the store directory, + ;; because the sandbox has access to /usr on FHS distros. + (write-setting + "security.sandbox.content.read_path_whitelist" + (string-append "\"" + (%store-directory) "/\"")) + + ;; XDG settings should be managed by Guix. + (write-setting "browser.shell.checkDefaultBrowser" + "false") + (close-port port)))) + (add-after 'fix-preferences 'fix-ffmpeg-runtime-linker + (lambda* (#:key inputs #:allow-other-keys) + (let* ((ffmpeg (assoc-ref inputs "ffmpeg")) + (libavcodec (string-append ffmpeg + "/lib/libavcodec.so"))) + ;; Arrange to load libavcodec.so by its absolute file name. + (substitute* "dom/media/platforms/ffmpeg/FFmpegRuntimeLinker.cpp" + (("libavcodec\\.so") + libavcodec))))) + (add-after 'patch-source-shebangs 'patch-cargo-checksums + (lambda _ + (use-modules (guix build cargo-utils)) + (let ((null-hash + ;; This is the SHA256 output of an empty string. + (string-append + "e3b0c44298fc1c149afbf4c8996fb924" + "27ae41e4649b934ca495991b7852b855"))) + (for-each (lambda (file) + (format #t "patch-cargo-checksums: patching checksums in ~a~%" file) - (substitute* file - (("(checksum = )\".*\"" all name) - (string-append name "\"" null-hash - "\"")))) - (find-files "." "Cargo\\.lock$")) - (for-each generate-all-checksums - '("build" - "dom/media" - "dom/webauthn" - "gfx" - "intl" - "js" - "media" - "modules" - "mozglue/static/rust" - "netwerk" - "remote" - "security/manager/ssl" - "servo" - "storage" - "third_party/rust" - "toolkit" - "xpcom/rust" - "services"))))) - (add-after 'patch-cargo-checksums 'remove-cargo-frozen-flag - (lambda _ - ;; Remove --frozen flag from cargo invokation, otherwise it'll - ;; complain that it's not able to change Cargo.lock. - ;; https://bugzilla.mozilla.org/show_bug.cgi?id=1726373 - (substitute* "build/RunCbindgen.py" - (("args.append\\(\"--frozen\"\\)") "pass")))) - (delete 'bootstrap) - (add-before 'configure 'patch-SpeechDispatcherService.cpp - (lambda _ - (let* ((lib "libspeechd.so.2") - (file (string-append - "dom/media/webspeech/synth/" - "speechd/SpeechDispatcherService.cpp")) - (old-content (call-with-input-file file - get-string-all))) - (substitute - file - `((,(format #f "~s" lib) unquote - (lambda (line _) - (string-replace-substring - line lib - (string-append #$speech-dispatcher - "/lib/" lib)))))) - (if (string=? old-content - (call-with-input-file file - get-string-all)) - (error - "substitute did nothing, phase requires an update"))))) - (add-before 'configure 'set-build-id - ;; Build will write the timestamp to output, which is harmful - ;; for reproducibility, so change it to a fixed date. Use a - ;; separate phase for easier modification with inherit. - (lambda _ - (setenv "MOZ_BUILD_DATE" - #$%librewolf-build-id))) - (replace 'configure - (lambda* (#:key inputs outputs configure-flags - #:allow-other-keys) - (setenv "AUTOCONF" - (string-append (assoc-ref inputs "autoconf") - "/bin/autoconf")) - (setenv "SHELL" - (which "bash")) - (setenv "CONFIG_SHELL" - (which "bash")) - (setenv "MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE" - "system") - ;; This should use the host info probably (does it - ;; build on non-x86_64 though?) - (setenv "GUIX_PYTHONPATH" - (string-append (getcwd) - "/obj-x86_64-pc-linux-gnu/_virtualenvs/build")) - - ;; Use Clang, Clang is 2x faster than GCC - (setenv "AR" "llvm-ar") - (setenv "NM" "llvm-nm") - (setenv "CC" "clang") - (setenv "CXX" "clang++") - (setenv "MOZ_NOSPAM" "1") - (setenv "MOZ_APP_NAME" "librewolf") - - (setenv "MOZBUILD_STATE_PATH" - (getcwd)) - - (let* ((mozconfig (string-append (getcwd) "/mozconfig")) - (out (assoc-ref outputs "out")) - (flags (cons (string-append "--prefix=" out) - configure-flags))) - (format #t "build directory: ~s~%" - (getcwd)) - (format #t "configure flags: ~s~%" flags) - - (define write-flags - (lambda flags - (display (string-join (map (cut string-append - "ac_add_options " <>) - flags) "\n")) - (display "\n"))) - (with-output-to-file mozconfig - (lambda () - (apply write-flags flags) - ;; The following option unsets Telemetry - ;; Reporting. With the Addons Fiasco, - ;; Mozilla was found to be collecting - ;; user's data, including saved passwords - ;; and web form data, without users - ;; consent. Mozilla was also found - ;; shipping updates to systems without - ;; the user's knowledge or permission. - ;; As a result of this, use the following - ;; command to permanently disable - ;; telemetry reporting. - (display "unset MOZ_TELEMETRY_REPORTING\n") - (display "mk_add_options MOZ_CRASHREPORTER=0\n") - (display "mk_add_options MOZ_DATA_REPORTING=0\n") - (display - "mk_add_options MOZ_SERVICES_HEALTHREPORT=0") - (display - "mk_add_options MOZ_TELEMETRY_REPORTING=0"))) - (setenv "MOZCONFIG" mozconfig)) - (invoke "./mach" "configure"))) - (add-before 'build 'fix-addons-placeholder - (lambda _ - (substitute* "toolkit/locales/en-US/toolkit/about/aboutAddons.ftl" - (("addons.mozilla.org") - "gnuzilla.gnu.org")))) - (replace 'build - (lambda* (#:key (make-flags '()) - (parallel-build? #t) #:allow-other-keys) - (apply invoke "./mach" "build" - ;; mach will use parallel build if possible by default - `(,@(if parallel-build? - '() - '("-j1")) ,@make-flags)))) - (add-after 'build 'neutralise-store-references - (lambda _ - ;; Mangle the store references to compilers & - ;; other build tools in about:buildconfig, - ;; reducing the package's closure by 1 GiB on - ;; x86-64. - (let* ((build-dir (car (scandir "." - (cut string-prefix? - "obj-" <>)))) - (file (string-append build-dir - "/dist/bin/chrome/toolkit/" - "content/global/buildconfig.html"))) - (substitute* file - (((format #f "(~a/)([0-9a-df-np-sv-z]{32})" - (regexp-quote (%store-directory))) - _ store hash) - (string-append store - (string-take hash 8) - "<!-- Guix: not a runtime dependency -->" - (string-drop hash 8))))))) - (replace 'install - (lambda _ - (invoke "./mach" "install"))) - (add-after 'install 'remove-duplicate-bin - (lambda* (#:key outputs #:allow-other-keys) - (delete-file (string-append #$output - "/lib/librewolf/librewolf-bin")))) - (add-after 'install 'wrap-glxtest - ;; glxtest uses dlopen() to load mesa and pci - ;; libs, wrap it to set LD_LIBRARY_PATH. - (lambda* (#:key inputs outputs #:allow-other-keys) - (let* ((out (assoc-ref outputs "out")) - (lib (string-append out "/lib")) - (libs (map - (lambda (lib-name) - (string-append (assoc-ref inputs - lib-name) - "/lib")) - '("mesa" "pciutils")))) - (wrap-program (car (find-files lib "^glxtest$")) - `("LD_LIBRARY_PATH" prefix ,libs))))) - (add-after 'install 'patch-config - (lambda* (#:key inputs #:allow-other-keys) - (let ((lib (string-append #$output "/lib/librewolf")) - (config-file "librewolf.cfg")) - - ;; Required for Guix packaged extensions - ;; SCOPE_PROFILE=1, SCOPE_APPLICATION=4, SCOPE_SYSTEM=8 - ;; Default is 5. - (substitute* (in-vicinity lib config-file) - (("defaultPref\\(\"extensions.enabledScopes\", 5\\)") - "defaultPref(\"extensions.enabledScopes\", 13)")) - ;; Use Mozzarella addons repo. - (call-with-port - (open-file - (in-vicinity lib config-file) - "a") - (lambda (port) - ;; Add-ons panel (see settings.js in Icecat source). - (for-each - (lambda (pref) - (format port - "defaultPref(~s, ~s);~%" - (car pref) - (cdr pref))) - `(("extensions.getAddons.search.browseURL" - ,(string-append - "https://gnuzilla.gnu.org/mozzarella/" - "search.php?q=%TERMS%")) - ("extensions.getAddons.get.url" . - "https://gnuzilla.gnu.org/mozzarella") - ("extensions.getAddons.link.url" . - "https://gnuzilla.gnu.org/mozzarella") - ("extensions.getAddons.discovery.api_url" . - "https://gnuzilla.gnu.org/mozzarella") - ("extensions.getAddons.langpacks.url" . - "https://gnuzilla.gnu.org/mozzarella") - ("lightweightThemes.getMoreURL" . - "https://gnuzilla.gnu.org/mozzarella")))))))) - (add-after 'install 'wrap-program - (lambda* (#:key inputs outputs #:allow-other-keys) - ;; The following two functions are from Guix's icecat package in - ;; (gnu packages gnuzilla). See commit - ;; b7a0935420ee630a29b7e5ac73a32ba1eb24f00b. - (define (runpath-of lib) - (call-with-input-file lib - (compose elf-dynamic-info-runpath elf-dynamic-info - parse-elf get-bytevector-all))) - (define (runpaths-of-input label) - (let* ((dir (string-append (assoc-ref inputs label) - "/lib")) - (libs (find-files dir "\\.so$"))) - (append-map runpath-of libs))) - (let* ((out (assoc-ref outputs "out")) - (lib (string-append out "/lib")) - (libs (map - (lambda (lib-name) - (string-append (assoc-ref inputs - lib-name) - "/lib")) - '("mesa" "libpng-apng" "libnotify" "libva" - "pulseaudio" "gtk+" "pipewire" - ;; For U2F and WebAuthn - "eudev"))) - - ;; VA-API is run in the RDD (Remote Data Decoder) sandbox - ;; and must be explicitly given access to files it needs. - ;; Rather than adding the whole store (as Nix had - ;; upstream do, see - ;; <https://github.com/NixOS/nixpkgs/pull/165964> and - ;; linked upstream patches), we can just follow the - ;; runpaths of the needed libraries to add everything to - ;; LD_LIBRARY_PATH. These will then be accessible in the - ;; RDD sandbox. - (rdd-whitelist (map (cut string-append <> "/") - (delete-duplicates (append-map - runpaths-of-input - '("mesa" - "ffmpeg"))))) - (gtk-share (string-append (assoc-ref inputs - "gtk+") - "/share"))) - (wrap-program (car (find-files lib "^librewolf$")) - `("LD_LIBRARY_PATH" prefix - (,@libs ,@rdd-whitelist)) - `("XDG_DATA_DIRS" prefix - (,gtk-share)) - `("MOZ_LEGACY_PROFILES" = - ("1")) - `("MOZ_ALLOW_DOWNGRADE" = - ("1")))))) - (add-after 'wrap-program 'install-desktop-entry - (lambda* (#:key outputs #:allow-other-keys) - (let* ((desktop-file - "taskcluster/docker/firefox-snap/firefox.desktop") - (applications (string-append #$output - "/share/applications"))) - (substitute* desktop-file - (("^Exec=firefox") - (string-append "Exec=" - #$output "/bin/librewolf")) - ;; "Firefox" -> "LibreWolf" everywhere - (("Firefox") - "LibreWolf") - ;; Remove non-Latin translations. - (("^Name\\[(ar|bn)\\].*$") - "") - (("^Icon=.*") - (string-append "Icon=" - #$output - "/share/icons/hicolor/128x128/apps/librewolf.png + (substitute* file + (("(checksum = )\".*\"" all name) + (string-append name "\"" null-hash + "\"")))) + (find-files "." "Cargo\\.lock$")) + (for-each generate-all-checksums + '("build" + "dom/media" + "dom/webauthn" + "gfx" + "intl" + "js" + "media" + "modules" + "mozglue/static/rust" + "netwerk" + "remote" + "security/manager/ssl" + "servo" + "storage" + "third_party/rust" + "toolkit" + "xpcom/rust" + "services"))))) + (add-after 'patch-cargo-checksums 'remove-cargo-frozen-flag + (lambda _ + ;; Remove --frozen flag from cargo invokation, otherwise it'll + ;; complain that it's not able to change Cargo.lock. + ;; https://bugzilla.mozilla.org/show_bug.cgi?id=1726373 + (substitute* "build/RunCbindgen.py" + (("args.append\\(\"--frozen\"\\)") "pass")))) + (delete 'bootstrap) + (add-before 'configure 'patch-SpeechDispatcherService.cpp + (lambda _ + (let* ((lib "libspeechd.so.2") + (file (string-append + "dom/media/webspeech/synth/" + "speechd/SpeechDispatcherService.cpp")) + (old-content (call-with-input-file file + get-string-all))) + (substitute + file + `((,(format #f "~s" lib) unquote + (lambda (line _) + (string-replace-substring + line lib + (string-append #$speech-dispatcher + "/lib/" lib)))))) + (if (string=? old-content + (call-with-input-file file + get-string-all)) + (error + "substitute did nothing, phase requires an update"))))) + (add-before 'configure 'set-build-id + ;; Build will write the timestamp to output, which is harmful + ;; for reproducibility, so change it to a fixed date. Use a + ;; separate phase for easier modification with inherit. + (lambda _ + (setenv "MOZ_BUILD_DATE" + #$%librewolf-build-id))) + (replace 'configure + (lambda* (#:key inputs outputs configure-flags + #:allow-other-keys) + (setenv "AUTOCONF" + (string-append (assoc-ref inputs "autoconf") + "/bin/autoconf")) + (setenv "SHELL" + (which "bash")) + (setenv "CONFIG_SHELL" + (which "bash")) + (setenv "MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE" + "system") + ;; This should use the host info probably (does it + ;; build on non-x86_64 though?) + (setenv "GUIX_PYTHONPATH" + (string-append (getcwd) + "/obj-x86_64-pc-linux-gnu/_virtualenvs/build")) + + ;; Use Clang, Clang is 2x faster than GCC + (setenv "AR" "llvm-ar") + (setenv "NM" "llvm-nm") + (setenv "CC" "clang") + (setenv "CXX" "clang++") + (setenv "MOZ_NOSPAM" "1") + (setenv "MOZ_APP_NAME" "librewolf") + + (setenv "MOZBUILD_STATE_PATH" + (getcwd)) + + (let* ((mozconfig (string-append (getcwd) "/mozconfig")) + (out (assoc-ref outputs "out")) + (flags (cons (string-append "--prefix=" out) + configure-flags))) + (format #t "build directory: ~s~%" + (getcwd)) + (format #t "configure flags: ~s~%" flags) + + (define write-flags + (lambda flags + (display (string-join (map (cut string-append + "ac_add_options " <>) + flags) "\n")) + (display "\n"))) + (with-output-to-file mozconfig + (lambda () + (apply write-flags flags) + ;; The following option unsets Telemetry + ;; Reporting. With the Addons Fiasco, + ;; Mozilla was found to be collecting + ;; user's data, including saved passwords + ;; and web form data, without users + ;; consent. Mozilla was also found + ;; shipping updates to systems without + ;; the user's knowledge or permission. + ;; As a result of this, use the following + ;; command to permanently disable + ;; telemetry reporting. + (display "unset MOZ_TELEMETRY_REPORTING\n") + (display "mk_add_options MOZ_CRASHREPORTER=0\n") + (display "mk_add_options MOZ_DATA_REPORTING=0\n") + (display + "mk_add_options MOZ_SERVICES_HEALTHREPORT=0") + (display + "mk_add_options MOZ_TELEMETRY_REPORTING=0"))) + (setenv "MOZCONFIG" mozconfig)) + (invoke "./mach" "configure"))) + (add-before 'build 'fix-addons-placeholder + (lambda _ + (substitute* "toolkit/locales/en-US/toolkit/about/aboutAddons.ftl" + (("addons.mozilla.org") + "gnuzilla.gnu.org")))) + (replace 'build + (lambda* (#:key (make-flags '()) + (parallel-build? #t) #:allow-other-keys) + (apply invoke "./mach" "build" + ;; mach will use parallel build if possible by default + `(,@(if parallel-build? + '() + '("-j1")) ,@make-flags)))) + (add-after 'build 'neutralise-store-references + (lambda _ + ;; Mangle the store references to compilers & + ;; other build tools in about:buildconfig, + ;; reducing the package's closure by 1 GiB on + ;; x86-64. + (let* ((build-dir (car (scandir "." + (cut string-prefix? + "obj-" <>)))) + (file (string-append build-dir + "/dist/bin/chrome/toolkit/" + "content/global/buildconfig.html"))) + (substitute* file + (((format #f "(~a/)([0-9a-df-np-sv-z]{32})" + (regexp-quote (%store-directory))) + _ store hash) + (string-append store + (string-take hash 8) + "<!-- Guix: not a runtime dependency -->" + (string-drop hash 8))))))) + (replace 'install + (lambda _ + (invoke "./mach" "install"))) + (add-after 'install 'remove-duplicate-bin + (lambda* (#:key outputs #:allow-other-keys) + (delete-file (string-append #$output + "/lib/librewolf/librewolf-bin")))) + (add-after 'install 'wrap-glxtest + ;; glxtest uses dlopen() to load mesa and pci + ;; libs, wrap it to set LD_LIBRARY_PATH. + (lambda* (#:key inputs outputs #:allow-other-keys) + (let* ((out (assoc-ref outputs "out")) + (lib (string-append out "/lib")) + (libs (map + (lambda (lib-name) + (string-append (assoc-ref inputs + lib-name) + "/lib")) + '("mesa" "pciutils")))) + (wrap-program (car (find-files lib "^glxtest$")) + `("LD_LIBRARY_PATH" prefix ,libs))))) + (add-after 'install 'patch-config + (lambda* (#:key inputs #:allow-other-keys) + (let ((lib (string-append #$output "/lib/librewolf")) + (config-file "librewolf.cfg")) + + ;; Required for Guix packaged extensions + ;; SCOPE_PROFILE=1, SCOPE_APPLICATION=4, SCOPE_SYSTEM=8 + ;; Default is 5. + (substitute* (in-vicinity lib config-file) + (("defaultPref\\(\"extensions.enabledScopes\", 5\\)") + "defaultPref(\"extensions.enabledScopes\", 13)")) + ;; Use Mozzarella addons repo. + (call-with-port + (open-file + (in-vicinity lib config-file) + "a") + (lambda (port) + ;; Add-ons panel (see settings.js in Icecat source). + (for-each + (lambda (pref) + (format port + "defaultPref(~s, ~s);~%" + (car pref) + (cdr pref))) + `(("extensions.getAddons.search.browseURL" + ,(string-append + "https://gnuzilla.gnu.org/mozzarella/" + "search.php?q=%TERMS%")) + ("extensions.getAddons.get.url" . + "https://gnuzilla.gnu.org/mozzarella") + ("extensions.getAddons.link.url" . + "https://gnuzilla.gnu.org/mozzarella") + ("extensions.getAddons.discovery.api_url" . + "https://gnuzilla.gnu.org/mozzarella") + ("extensions.getAddons.langpacks.url" . + "https://gnuzilla.gnu.org/mozzarella") + ("lightweightThemes.getMoreURL" . + "https://gnuzilla.gnu.org/mozzarella")))))))) + (add-after 'install 'wrap-program + (lambda* (#:key inputs outputs #:allow-other-keys) + ;; The following two functions are from Guix's icecat package in + ;; (gnu packages gnuzilla). See commit + ;; b7a0935420ee630a29b7e5ac73a32ba1eb24f00b. + (define (runpath-of lib) + (call-with-input-file lib + (compose elf-dynamic-info-runpath elf-dynamic-info + parse-elf get-bytevector-all))) + (define (runpaths-of-input label) + (let* ((dir (string-append (assoc-ref inputs label) + "/lib")) + (libs (find-files dir "\\.so$"))) + (append-map runpath-of libs))) + (let* ((out (assoc-ref outputs "out")) + (lib (string-append out "/lib")) + (libs (map + (lambda (lib-name) + (string-append (assoc-ref inputs + lib-name) + "/lib")) + '("mesa" "libpng-apng" "libnotify" "libva" + "pulseaudio" "gtk+" "pipewire" + ;; For U2F and WebAuthn + "eudev"))) + + ;; VA-API is run in the RDD (Remote Data Decoder) sandbox + ;; and must be explicitly given access to files it needs. + ;; Rather than adding the whole store (as Nix had + ;; upstream do, see + ;; <https://github.com/NixOS/nixpkgs/pull/165964> and + ;; linked upstream patches), we can just follow the + ;; runpaths of the needed libraries to add everything to + ;; LD_LIBRARY_PATH. These will then be accessible in the + ;; RDD sandbox. + (rdd-whitelist (map (cut string-append <> "/") + (delete-duplicates (append-map + runpaths-of-input + '("mesa" + "ffmpeg"))))) + (gtk-share (string-append (assoc-ref inputs + "gtk+") + "/share"))) + (wrap-program (car (find-files lib "^librewolf$")) + `("LD_LIBRARY_PATH" prefix + (,@libs ,@rdd-whitelist)) + `("XDG_DATA_DIRS" prefix + (,gtk-share)) + `("MOZ_LEGACY_PROFILES" = + ("1")) + `("MOZ_ALLOW_DOWNGRADE" = + ("1")))))) + (add-after 'wrap-program 'install-desktop-entry + (lambda* (#:key outputs #:allow-other-keys) + (let* ((desktop-file + "taskcluster/docker/firefox-snap/firefox.desktop") + (applications (string-append #$output + "/share/applications"))) + (substitute* desktop-file + (("^Exec=firefox") + (string-append "Exec=" + #$output "/bin/librewolf")) + ;; "Firefox" -> "LibreWolf" everywhere + (("Firefox") + "LibreWolf") + ;; Remove non-Latin translations. + (("^Name\\[(ar|bn)\\].*$") + "") + (("^Icon=.*") + (string-append "Icon=" + #$output + "/share/icons/hicolor/128x128/apps/librewolf.png ")) - ;; These commands were changed. - (("-NewWindow") - "-new-window") - (("-NewPrivateWindow") - "-new-private-window") - (("StartupNotify=true") - "StartupNotify=true + ;; These commands were changed. + (("-NewWindow") + "-new-window") + (("-NewPrivateWindow") + "-new-private-window") + (("StartupNotify=true") + "StartupNotify=true StartupWMClass=Navigator")) - (copy-file desktop-file "librewolf.desktop") - (install-file "librewolf.desktop" applications)))) - (add-after 'install-desktop-entry 'install-icons - (lambda* (#:key outputs #:allow-other-keys) - (let ((icon-source-dir (string-append #$output - "/lib/librewolf/browser/" - "chrome/icons/default"))) - (for-each (lambda (size) - (let ((dest (string-append #$output - "/share/icons/hicolor/" - size - "x" - size - "/apps"))) - (mkdir-p dest) - (symlink (string-append icon-source-dir - "/default" size ".png") - (string-append dest - "/librewolf.png")))) - '("16" "32" "48" "64" "128")))))) - - ;; Test will significantly increase build time but with little rewards. - #:tests? #f - - ;; WARNING: Parallel build will consume lots of memory! - ;; If you have encountered OOM issue in build phase, try disable it. - #:parallel-build? #t - - ;; Some dynamic lib was determined at runtime, so rpath check may fail. - #:validate-runpath? #f)) - (inputs (list bash-minimal - bzip2 - cairo - cups - dbus-glib - freetype - ffmpeg - gdk-pixbuf - glib - gtk+ - gtk+-2 - hunspell - icu4c-73 - jemalloc - libcanberra - libevent - libffi - libgnome - libjpeg-turbo - libnotify - libpng-apng - libva - libvpx - libwebp - libxcomposite - libxft - libxinerama - libxscrnsaver - libxt - mesa - mit-krb5 - nspr - nss/fixed - pango - pciutils - pipewire - pixman - pulseaudio - speech-dispatcher - sqlite - startup-notification - eudev - unzip - zip - zlib)) - (native-inputs (list alsa-lib - autoconf-2.13 - `(,rust-librewolf "cargo") - clang-18 - llvm-18 - m4 - nasm - node-lts - perl - pkg-config - python - rust-librewolf - rust-cbindgen-0.26 - which - yasm)) - (home-page "https://librewolf.net/") - (synopsis - "Custom version of Firefox, focused on privacy, security and freedom") - (description - "LibreWolf is designed to increase protection against tracking and + (copy-file desktop-file "librewolf.desktop") + (install-file "librewolf.desktop" applications)))) + (add-after 'install-desktop-entry 'install-icons + (lambda* (#:key outputs #:allow-other-keys) + (let ((icon-source-dir (string-append #$output + "/lib/librewolf/browser/" + "chrome/icons/default"))) + (for-each (lambda (size) + (let ((dest (string-append #$output + "/share/icons/hicolor/" + size + "x" + size + "/apps"))) + (mkdir-p dest) + (symlink (string-append icon-source-dir + "/default" size ".png") + (string-append dest + "/librewolf.png")))) + '("16" "32" "48" "64" "128")))))) + + ;; Test will significantly increase build time but with little rewards. + #:tests? #f + + ;; WARNING: Parallel build will consume lots of memory! + ;; If you have encountered OOM issue in build phase, try disable it. + #:parallel-build? #t + + ;; Some dynamic lib was determined at runtime, so rpath check may fail. + #:validate-runpath? #f)) + (inputs (list bash-minimal + bzip2 + cairo + cups + dbus-glib + freetype + ffmpeg + gdk-pixbuf + glib + gtk+ + gtk+-2 + hunspell + icu4c-73 + jemalloc + libcanberra + libevent + libffi + libgnome + libjpeg-turbo + libnotify + libpng-apng + libva + libvpx + libwebp + libxcomposite + libxft + libxinerama + libxscrnsaver + libxt + mesa + mit-krb5 + nspr + nss-latest + pango + pciutils + pipewire + pixman + pulseaudio + speech-dispatcher + sqlite + startup-notification + eudev + unzip + zip + zlib)) + (native-inputs (list alsa-lib + autoconf-2.13 + `(,rust-librewolf "cargo") + clang-18 + llvm-18 + m4 + nasm + node-lts + perl + pkg-config + python + rust-librewolf + rust-cbindgen-0.26 + which + yasm)) + (home-page "https://librewolf.net/") + (synopsis + "Custom version of Firefox, focused on privacy, security and freedom") + (description + "LibreWolf is designed to increase protection against tracking and fingerprinting techniques, while also including a few security improvements. This is achieved through our privacy and security oriented settings and patches. LibreWolf also aims to remove all the telemetry, data collection and annoyances, as well as disabling anti-freedom features like DRM.") - (license license:mpl2.0))) + (license license:mpl2.0)))) -- 2.45.1 ^ permalink raw reply related [flat|nested] 33+ messages in thread
* [bug#71832] [PATCH v2 0/2] Add nss-latest; update Librewolf to 127.0.2-2 2024-06-29 3:57 [bug#71832] [PATCH 0/2] Add nss-latest; updte Librewolf to 127.0.2-2 Ian Eure 2024-06-29 3:59 ` [bug#71832] [PATCH 1/2] gnu: Add nss-latest Ian Eure @ 2024-06-29 17:22 ` Ian Eure 2024-06-29 17:22 ` [bug#71832] [PATCH v2 1/2] gnu: Add nss-latest Ian Eure 2024-06-29 17:22 ` [bug#71832] [PATCH v2 2/2] gnu: librewolf: Update to 127.0.2-1 Ian Eure 2024-07-02 0:21 ` [bug#71832] [PATCH v3 0/2] Add nss-rapid; updte Librewolf to 127.0.2-2 Ian Eure ` (5 subsequent siblings) 7 siblings, 2 replies; 33+ messages in thread From: Ian Eure @ 2024-06-29 17:22 UTC (permalink / raw) To: 71832; +Cc: Ian Eure Realized that I didn't remove the backout of the encoding_rs patch which was added for 126.x. The browser built and worked, but that change isn’t needed anymore; remove it. Ian Eure (2): gnu: Add nss-latest. gnu: librewolf: Update to 127.0.2-1. gnu/packages/librewolf.scm | 1044 ++++++++++++++++++------------------ gnu/packages/nss.scm | 67 ++- 2 files changed, 587 insertions(+), 524 deletions(-) -- 2.45.1 ^ permalink raw reply [flat|nested] 33+ messages in thread
* [bug#71832] [PATCH v2 1/2] gnu: Add nss-latest. 2024-06-29 17:22 ` [bug#71832] [PATCH v2 0/2] Add nss-latest; update Librewolf to 127.0.2-2 Ian Eure @ 2024-06-29 17:22 ` Ian Eure 2024-06-29 17:22 ` [bug#71832] [PATCH v2 2/2] gnu: librewolf: Update to 127.0.2-1 Ian Eure 1 sibling, 0 replies; 33+ messages in thread From: Ian Eure @ 2024-06-29 17:22 UTC (permalink / raw) To: 71832; +Cc: Ian Eure * gnu/packages/nss.scm (nss-latest): New variable. Change-Id: Ifdc215090a20dee1bde83013852ef21b6cfd9979 --- gnu/packages/nss.scm | 67 ++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 61 insertions(+), 6 deletions(-) diff --git a/gnu/packages/nss.scm b/gnu/packages/nss.scm index d558079f44..6b45e59ea8 100644 --- a/gnu/packages/nss.scm +++ b/gnu/packages/nss.scm @@ -106,6 +106,9 @@ (define-public nspr-4.32 (base32 "0v3zds1id71j5a5si42a658fjz8nv2f6zp6w4gqrqmdr6ksz8sxv")))))) +;; nss should track ESRs, but currently doesn't. When the next ESR it out, it +;; should get updated. + (define-public nss (package (name "nss") @@ -153,13 +156,13 @@ (define-public nss ;; Ensure we are building for the (%current-target-system). #$@(if (%current-target-system) #~((string-append - "OS_TEST=" - (string-take #$(%current-target-system) - (string-index #$(%current-target-system) #\-))) + "OS_TEST=" + (string-take #$(%current-target-system) + (string-index #$(%current-target-system) #\-))) (string-append - "KERNEL=" (cond (#$(target-hurd?) "gnu") - (#$(target-linux?) "linux") - (else "")))) + "KERNEL=" (cond (#$(target-hurd?) "gnu") + (#$(target-linux?) "linux") + (else "")))) #~()) #$@(if (%current-target-system) #~("CROSS_COMPILE=1") @@ -303,6 +306,58 @@ (define-public nss/fixed (invoke "faketime" "2024-01-23" "./nss/tests/all.sh")) (format #t "test suite not run~%")))))))))))) +;; nss-latest tracks the latest released version. + +(define-public nss-latest + (package + (inherit nss) + (name "nss-latest") + (version "3.101") + (source (origin + (inherit (package-source nss)) + (uri (let ((version-with-underscores + (string-join (string-split version #\.) "_"))) + (string-append + "https://ftp.mozilla.org/pub/mozilla.org/security/nss/" + "releases/NSS_" version-with-underscores "_RTM/src/" + "nss-" version ".tar.gz"))) + (sha256 + (base32 + "1rw5xpclsy174znvxcb4d4zgjwadxy45mbh0wvkm3fxpnkq4i5w5")))) + (arguments + (substitute-keyword-arguments (package-arguments nss) + ((#:phases phases) + #~(modify-phases #$phases + (replace 'check + (lambda* (#:key tests? #:allow-other-keys) + (if tests? + (begin + ;; Use 127.0.0.1 instead of $HOST.$DOMSUF as HOSTADDR for + ;; testing. The latter requires a working DNS or /etc/hosts. + (setenv "DOMSUF" "localdomain") + (setenv "USE_IP" "TRUE") + (setenv "IP_ADDRESS" "127.0.0.1") + + ;; This specific test is looking at performance "now + ;; verify that we can quickly dump a database", and + ;; we're not testing performance here (especially + ;; since we're using faketime), so raise the + ;; threshold + (substitute* "nss/tests/dbtests/dbtests.sh" + ((" -lt 5") " -lt 50")) + + ;; Since the test suite is very lengthy, run the test + ;; suite once, not thrice as done by default, by + ;; selecting only the 'standard' cycle. + (setenv "NSS_CYCLES" "standard") + + ;; The "PayPalEE.cert" certificate expires every six months, + ;; leading to test failures: + ;; <https://bugzilla.mozilla.org/show_bug.cgi?id=609734>. To + ;; work around that, set the time to roughly the release date. + (invoke "faketime" "2024-01-23" "./nss/tests/all.sh")) + (format #t "test suite not run~%")))))))))) + (define-public nsncd (package (name "nsncd") -- 2.45.1 ^ permalink raw reply related [flat|nested] 33+ messages in thread
* [bug#71832] [PATCH v2 2/2] gnu: librewolf: Update to 127.0.2-1. 2024-06-29 17:22 ` [bug#71832] [PATCH v2 0/2] Add nss-latest; update Librewolf to 127.0.2-2 Ian Eure 2024-06-29 17:22 ` [bug#71832] [PATCH v2 1/2] gnu: Add nss-latest Ian Eure @ 2024-06-29 17:22 ` Ian Eure 1 sibling, 0 replies; 33+ messages in thread From: Ian Eure @ 2024-06-29 17:22 UTC (permalink / raw) To: 71832; +Cc: Ian Eure * gnu/packages/librewolf.scm (librewolf): Update to 127.0.2-1. Reorganize module to improve usability and reduce duplication. The Rust package and build ID are now at the top of the file. The librewolf-source variable has been replaced with the make-librewolf-source procedure, centralizing versions & hashes in the librewolf package definition. Dedent some of the package’s arguments to improve readability. Change-Id: I15f8a2aa1fae07e0497ab5511d10af0c1f70cc2e --- gnu/packages/librewolf.scm | 1044 ++++++++++++++++++------------------ 1 file changed, 526 insertions(+), 518 deletions(-) diff --git a/gnu/packages/librewolf.scm b/gnu/packages/librewolf.scm index c84bcaf3ce..a400080dcb 100644 --- a/gnu/packages/librewolf.scm +++ b/gnu/packages/librewolf.scm @@ -93,6 +93,18 @@ (define-module (gnu packages librewolf) #:use-module (gnu packages xdisorg) #:use-module (gnu packages xorg)) +;; Define the versions of rust needed to build librewolf, trying to match +;; upstream. See the file taskcluster/kinds/toolchain/rust.yml at +;; https://searchfox.org under the particular firefox release, like +;; mozilla-esr102. +;; 1.75 is the default in Guix, 1.77 is the minimum for Librewolf. +(define rust-librewolf rust-1.77) + +;; Update this id with every update to its release date. +;; It's used for cache validation and therefore can lead to strange bugs. +;; ex: date '+%Y%m%d%H%M%S' +(define %librewolf-build-id "20240626133423") + (define (firefox-source-origin version hash) (origin (method url-fetch) @@ -114,11 +126,14 @@ (define (librewolf-source-origin version hash) (define computed-origin-method (@@ (guix packages) computed-origin-method)) -(define librewolf-source - (let* ((ff-src (firefox-source-origin "126.0.1" "0fr679rcwshwpfxidc55b2xsn4pmrr7p9ix4rr2mv2k7kwsjcc7n")) - (version "126.0.1-1") - (lw-src (librewolf-source-origin version "0cac80073vkzd85ai9rbnwixs1h9bpy4dj2ri6jxdlqsy5d663km"))) - +(define* (make-librewolf-source version #:key firefox-hash librewolf-hash) + (let* ((ff-src (firefox-source-origin + (car (string-split version #\-)) + firefox-hash)) + (version version) + (lw-src (librewolf-source-origin + version + librewolf-hash))) (origin (method computed-origin-method) (file-name (string-append "librewolf-" version ".source.tar.gz")) @@ -162,11 +177,6 @@ (define librewolf-source (("^ff_source_tarball:=.*") (string-append "ff_source_tarball:=" #+ff-src))) - ;; Remove encoding_rs patch, it doesn't build with Rust 1.75. - (substitute* '("assets/patches.txt") - (("patches/encoding_rs.patch\\\n$") - "")) - ;; Stage locales. (begin (format #t "Staging locales...~%") @@ -204,523 +214,521 @@ (define librewolf-source ".source.tar.gz") #$output)))))))) -;; Define the versions of rust needed to build librewolf, trying to match -;; upstream. See the file taskcluster/ci/toolchain/rust.yml at -;; https://searchfox.org under the particular firefox release, like -;; mozilla-esr102. -(define rust-librewolf rust) ; 1.75 is the default in Guix, 1.65 is the minimum. - -;; Update this id with every update to its release date. -;; It's used for cache validation and therefore can lead to strange bugs. -;; ex: date '+%Y%m%d%H%M%S' -(define %librewolf-build-id "20240607212143") - (define-public librewolf - (package - (name "librewolf") - (version "126.0.1-1") - (source librewolf-source) - (build-system gnu-build-system) - (arguments - (list - #:configure-flags #~(let ((clang #$(this-package-native-input "clang"))) - `("--enable-application=browser" - - ;; Configuration - "--without-wasm-sandboxed-libraries" - "--with-system-jpeg" - "--with-system-zlib" - "--with-system-png" - "--with-system-webp" - "--with-system-icu" - "--with-system-libvpx" - "--with-system-libevent" - "--with-system-ffi" - "--enable-system-pixman" - "--enable-jemalloc" - - ;; see https://bugs.gnu.org/32833 - "--with-system-nspr" - "--with-system-nss" - - ,(string-append "--with-clang-path=" clang - "/bin/clang") - ,(string-append "--with-libclang-path=" clang - "/lib") - - ;; Distribution - "--with-distribution-id=org.guix" - "--with-app-name=librewolf" - "--with-app-basename=LibreWolf" - "--with-branding=browser/branding/librewolf" - - ;; Features - "--disable-tests" - "--disable-updater" - "--enable-pulseaudio" - "--disable-crashreporter" - "--allow-addon-sideload" - "--with-unsigned-addon-scopes=app,system" - "--disable-eme" - - ;; Build details - "--disable-debug" - "--enable-rust-simd" - "--enable-release" - "--enable-optimize" - "--enable-strip" - "--enable-hardening" - "--disable-elf-hack")) - #:imported-modules %cargo-utils-modules - #:modules `((ice-9 regex) - (ice-9 string-fun) - (ice-9 ftw) - (srfi srfi-1) - (srfi srfi-26) - (rnrs bytevectors) - (rnrs io ports) - (guix elf) - (guix build gremlin) - ,@%gnu-build-system-modules) - #:phases #~(modify-phases %standard-phases - (add-after 'unpack 'fix-preferences - (lambda* (#:key inputs #:allow-other-keys) - (let ((port (open-file "browser/app/profile/firefox.js" - "a"))) - (define (write-setting key value) - (format port "~%pref(\"~a\", ~a);~%" key value) - (format #t + (let ((version "127.0.2-2")) + (package + (name "librewolf") + (version version) + (source (make-librewolf-source + version + #:firefox-hash + "1s73fdp7k60058ylyvlixq13k5hfbmj6k1y42fmzqlpg7n62lyqb" + #:librewolf-hash + "1f4xz496x1nf7lmvk50hakj9p6q0kzxl5f9s2k0b6kczvyc8gw5n")) + + (build-system gnu-build-system) + (arguments + (list + #:configure-flags + #~(let ((clang #$(this-package-native-input "clang"))) + `("--enable-application=browser" + + ;; Configuration + "--without-wasm-sandboxed-libraries" + "--with-system-jpeg" + "--with-system-zlib" + "--with-system-png" + "--with-system-webp" + "--with-system-icu" + "--with-system-libvpx" + "--with-system-libevent" + "--with-system-ffi" + "--enable-system-pixman" + "--enable-jemalloc" + + ;; see https://bugs.gnu.org/32833 + "--with-system-nspr" + "--with-system-nss" + + ,(string-append "--with-clang-path=" clang + "/bin/clang") + ,(string-append "--with-libclang-path=" clang + "/lib") + + ;; Distribution + "--with-distribution-id=org.guix" + "--with-app-name=librewolf" + "--with-app-basename=LibreWolf" + "--with-branding=browser/branding/librewolf" + + ;; Features + "--disable-tests" + "--disable-updater" + "--enable-pulseaudio" + "--disable-crashreporter" + "--allow-addon-sideload" + "--with-unsigned-addon-scopes=app,system" + "--disable-eme" + + ;; Build details + "--disable-debug" + "--enable-rust-simd" + "--enable-release" + "--enable-optimize" + "--enable-strip" + "--enable-hardening" + "--disable-elf-hack")) + #:imported-modules %cargo-utils-modules + #:modules `((ice-9 regex) + (ice-9 string-fun) + (ice-9 ftw) + (srfi srfi-1) + (srfi srfi-26) + (rnrs bytevectors) + (rnrs io ports) + (guix elf) + (guix build gremlin) + ,@%gnu-build-system-modules) + #:phases + #~(modify-phases %standard-phases + (add-after 'unpack 'fix-preferences + (lambda* (#:key inputs #:allow-other-keys) + (let ((port (open-file "browser/app/profile/firefox.js" + "a"))) + (define (write-setting key value) + (format port "~%pref(\"~a\", ~a);~%" key value) + (format #t "fix-preferences: setting value of ~a to ~a~%" key value)) - ;; We should allow the sandbox to read the store directory, - ;; because the sandbox has access to /usr on FHS distros. - (write-setting - "security.sandbox.content.read_path_whitelist" - (string-append "\"" - (%store-directory) "/\"")) - - ;; XDG settings should be managed by Guix. - (write-setting "browser.shell.checkDefaultBrowser" - "false") - (close-port port)))) - (add-after 'fix-preferences 'fix-ffmpeg-runtime-linker - (lambda* (#:key inputs #:allow-other-keys) - (let* ((ffmpeg (assoc-ref inputs "ffmpeg")) - (libavcodec (string-append ffmpeg - "/lib/libavcodec.so"))) - ;; Arrange to load libavcodec.so by its absolute file name. - (substitute* "dom/media/platforms/ffmpeg/FFmpegRuntimeLinker.cpp" - (("libavcodec\\.so") - libavcodec))))) - (add-after 'patch-source-shebangs 'patch-cargo-checksums - (lambda _ - (use-modules (guix build cargo-utils)) - (let ((null-hash - ;; This is the SHA256 output of an empty string. - (string-append - "e3b0c44298fc1c149afbf4c8996fb924" - "27ae41e4649b934ca495991b7852b855"))) - (for-each (lambda (file) - (format #t + ;; We should allow the sandbox to read the store directory, + ;; because the sandbox has access to /usr on FHS distros. + (write-setting + "security.sandbox.content.read_path_whitelist" + (string-append "\"" + (%store-directory) "/\"")) + + ;; XDG settings should be managed by Guix. + (write-setting "browser.shell.checkDefaultBrowser" + "false") + (close-port port)))) + (add-after 'fix-preferences 'fix-ffmpeg-runtime-linker + (lambda* (#:key inputs #:allow-other-keys) + (let* ((ffmpeg (assoc-ref inputs "ffmpeg")) + (libavcodec (string-append ffmpeg + "/lib/libavcodec.so"))) + ;; Arrange to load libavcodec.so by its absolute file name. + (substitute* "dom/media/platforms/ffmpeg/FFmpegRuntimeLinker.cpp" + (("libavcodec\\.so") + libavcodec))))) + (add-after 'patch-source-shebangs 'patch-cargo-checksums + (lambda _ + (use-modules (guix build cargo-utils)) + (let ((null-hash + ;; This is the SHA256 output of an empty string. + (string-append + "e3b0c44298fc1c149afbf4c8996fb924" + "27ae41e4649b934ca495991b7852b855"))) + (for-each (lambda (file) + (format #t "patch-cargo-checksums: patching checksums in ~a~%" file) - (substitute* file - (("(checksum = )\".*\"" all name) - (string-append name "\"" null-hash - "\"")))) - (find-files "." "Cargo\\.lock$")) - (for-each generate-all-checksums - '("build" - "dom/media" - "dom/webauthn" - "gfx" - "intl" - "js" - "media" - "modules" - "mozglue/static/rust" - "netwerk" - "remote" - "security/manager/ssl" - "servo" - "storage" - "third_party/rust" - "toolkit" - "xpcom/rust" - "services"))))) - (add-after 'patch-cargo-checksums 'remove-cargo-frozen-flag - (lambda _ - ;; Remove --frozen flag from cargo invokation, otherwise it'll - ;; complain that it's not able to change Cargo.lock. - ;; https://bugzilla.mozilla.org/show_bug.cgi?id=1726373 - (substitute* "build/RunCbindgen.py" - (("args.append\\(\"--frozen\"\\)") "pass")))) - (delete 'bootstrap) - (add-before 'configure 'patch-SpeechDispatcherService.cpp - (lambda _ - (let* ((lib "libspeechd.so.2") - (file (string-append - "dom/media/webspeech/synth/" - "speechd/SpeechDispatcherService.cpp")) - (old-content (call-with-input-file file - get-string-all))) - (substitute - file - `((,(format #f "~s" lib) unquote - (lambda (line _) - (string-replace-substring - line lib - (string-append #$speech-dispatcher - "/lib/" lib)))))) - (if (string=? old-content - (call-with-input-file file - get-string-all)) - (error - "substitute did nothing, phase requires an update"))))) - (add-before 'configure 'set-build-id - ;; Build will write the timestamp to output, which is harmful - ;; for reproducibility, so change it to a fixed date. Use a - ;; separate phase for easier modification with inherit. - (lambda _ - (setenv "MOZ_BUILD_DATE" - #$%librewolf-build-id))) - (replace 'configure - (lambda* (#:key inputs outputs configure-flags - #:allow-other-keys) - (setenv "AUTOCONF" - (string-append (assoc-ref inputs "autoconf") - "/bin/autoconf")) - (setenv "SHELL" - (which "bash")) - (setenv "CONFIG_SHELL" - (which "bash")) - (setenv "MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE" - "system") - ;; This should use the host info probably (does it - ;; build on non-x86_64 though?) - (setenv "GUIX_PYTHONPATH" - (string-append (getcwd) - "/obj-x86_64-pc-linux-gnu/_virtualenvs/build")) - - ;; Use Clang, Clang is 2x faster than GCC - (setenv "AR" "llvm-ar") - (setenv "NM" "llvm-nm") - (setenv "CC" "clang") - (setenv "CXX" "clang++") - (setenv "MOZ_NOSPAM" "1") - (setenv "MOZ_APP_NAME" "librewolf") - - (setenv "MOZBUILD_STATE_PATH" - (getcwd)) - - (let* ((mozconfig (string-append (getcwd) "/mozconfig")) - (out (assoc-ref outputs "out")) - (flags (cons (string-append "--prefix=" out) - configure-flags))) - (format #t "build directory: ~s~%" - (getcwd)) - (format #t "configure flags: ~s~%" flags) - - (define write-flags - (lambda flags - (display (string-join (map (cut string-append - "ac_add_options " <>) - flags) "\n")) - (display "\n"))) - (with-output-to-file mozconfig - (lambda () - (apply write-flags flags) - ;; The following option unsets Telemetry - ;; Reporting. With the Addons Fiasco, - ;; Mozilla was found to be collecting - ;; user's data, including saved passwords - ;; and web form data, without users - ;; consent. Mozilla was also found - ;; shipping updates to systems without - ;; the user's knowledge or permission. - ;; As a result of this, use the following - ;; command to permanently disable - ;; telemetry reporting. - (display "unset MOZ_TELEMETRY_REPORTING\n") - (display "mk_add_options MOZ_CRASHREPORTER=0\n") - (display "mk_add_options MOZ_DATA_REPORTING=0\n") - (display - "mk_add_options MOZ_SERVICES_HEALTHREPORT=0") - (display - "mk_add_options MOZ_TELEMETRY_REPORTING=0"))) - (setenv "MOZCONFIG" mozconfig)) - (invoke "./mach" "configure"))) - (add-before 'build 'fix-addons-placeholder - (lambda _ - (substitute* "toolkit/locales/en-US/toolkit/about/aboutAddons.ftl" - (("addons.mozilla.org") - "gnuzilla.gnu.org")))) - (replace 'build - (lambda* (#:key (make-flags '()) - (parallel-build? #t) #:allow-other-keys) - (apply invoke "./mach" "build" - ;; mach will use parallel build if possible by default - `(,@(if parallel-build? - '() - '("-j1")) ,@make-flags)))) - (add-after 'build 'neutralise-store-references - (lambda _ - ;; Mangle the store references to compilers & - ;; other build tools in about:buildconfig, - ;; reducing the package's closure by 1 GiB on - ;; x86-64. - (let* ((build-dir (car (scandir "." - (cut string-prefix? - "obj-" <>)))) - (file (string-append build-dir - "/dist/bin/chrome/toolkit/" - "content/global/buildconfig.html"))) - (substitute* file - (((format #f "(~a/)([0-9a-df-np-sv-z]{32})" - (regexp-quote (%store-directory))) - _ store hash) - (string-append store - (string-take hash 8) - "<!-- Guix: not a runtime dependency -->" - (string-drop hash 8))))))) - (replace 'install - (lambda _ - (invoke "./mach" "install"))) - (add-after 'install 'remove-duplicate-bin - (lambda* (#:key outputs #:allow-other-keys) - (delete-file (string-append #$output - "/lib/librewolf/librewolf-bin")))) - (add-after 'install 'wrap-glxtest - ;; glxtest uses dlopen() to load mesa and pci - ;; libs, wrap it to set LD_LIBRARY_PATH. - (lambda* (#:key inputs outputs #:allow-other-keys) - (let* ((out (assoc-ref outputs "out")) - (lib (string-append out "/lib")) - (libs (map - (lambda (lib-name) - (string-append (assoc-ref inputs - lib-name) - "/lib")) - '("mesa" "pciutils")))) - (wrap-program (car (find-files lib "^glxtest$")) - `("LD_LIBRARY_PATH" prefix ,libs))))) - (add-after 'install 'patch-config - (lambda* (#:key inputs #:allow-other-keys) - (let ((lib (string-append #$output "/lib/librewolf")) - (config-file "librewolf.cfg")) - - ;; Required for Guix packaged extensions - ;; SCOPE_PROFILE=1, SCOPE_APPLICATION=4, SCOPE_SYSTEM=8 - ;; Default is 5. - (substitute* (in-vicinity lib config-file) - (("defaultPref\\(\"extensions.enabledScopes\", 5\\)") - "defaultPref(\"extensions.enabledScopes\", 13)")) - ;; Use Mozzarella addons repo. - (call-with-port - (open-file - (in-vicinity lib config-file) - "a") - (lambda (port) - ;; Add-ons panel (see settings.js in Icecat source). - (for-each - (lambda (pref) - (format port - "defaultPref(~s, ~s);~%" - (car pref) - (cdr pref))) - `(("extensions.getAddons.search.browseURL" - ,(string-append - "https://gnuzilla.gnu.org/mozzarella/" - "search.php?q=%TERMS%")) - ("extensions.getAddons.get.url" . - "https://gnuzilla.gnu.org/mozzarella") - ("extensions.getAddons.link.url" . - "https://gnuzilla.gnu.org/mozzarella") - ("extensions.getAddons.discovery.api_url" . - "https://gnuzilla.gnu.org/mozzarella") - ("extensions.getAddons.langpacks.url" . - "https://gnuzilla.gnu.org/mozzarella") - ("lightweightThemes.getMoreURL" . - "https://gnuzilla.gnu.org/mozzarella")))))))) - (add-after 'install 'wrap-program - (lambda* (#:key inputs outputs #:allow-other-keys) - ;; The following two functions are from Guix's icecat package in - ;; (gnu packages gnuzilla). See commit - ;; b7a0935420ee630a29b7e5ac73a32ba1eb24f00b. - (define (runpath-of lib) - (call-with-input-file lib - (compose elf-dynamic-info-runpath elf-dynamic-info - parse-elf get-bytevector-all))) - (define (runpaths-of-input label) - (let* ((dir (string-append (assoc-ref inputs label) - "/lib")) - (libs (find-files dir "\\.so$"))) - (append-map runpath-of libs))) - (let* ((out (assoc-ref outputs "out")) - (lib (string-append out "/lib")) - (libs (map - (lambda (lib-name) - (string-append (assoc-ref inputs - lib-name) - "/lib")) - '("mesa" "libpng-apng" "libnotify" "libva" - "pulseaudio" "gtk+" "pipewire" - ;; For U2F and WebAuthn - "eudev"))) - - ;; VA-API is run in the RDD (Remote Data Decoder) sandbox - ;; and must be explicitly given access to files it needs. - ;; Rather than adding the whole store (as Nix had - ;; upstream do, see - ;; <https://github.com/NixOS/nixpkgs/pull/165964> and - ;; linked upstream patches), we can just follow the - ;; runpaths of the needed libraries to add everything to - ;; LD_LIBRARY_PATH. These will then be accessible in the - ;; RDD sandbox. - (rdd-whitelist (map (cut string-append <> "/") - (delete-duplicates (append-map - runpaths-of-input - '("mesa" - "ffmpeg"))))) - (gtk-share (string-append (assoc-ref inputs - "gtk+") - "/share"))) - (wrap-program (car (find-files lib "^librewolf$")) - `("LD_LIBRARY_PATH" prefix - (,@libs ,@rdd-whitelist)) - `("XDG_DATA_DIRS" prefix - (,gtk-share)) - `("MOZ_LEGACY_PROFILES" = - ("1")) - `("MOZ_ALLOW_DOWNGRADE" = - ("1")))))) - (add-after 'wrap-program 'install-desktop-entry - (lambda* (#:key outputs #:allow-other-keys) - (let* ((desktop-file - "taskcluster/docker/firefox-snap/firefox.desktop") - (applications (string-append #$output - "/share/applications"))) - (substitute* desktop-file - (("^Exec=firefox") - (string-append "Exec=" - #$output "/bin/librewolf")) - ;; "Firefox" -> "LibreWolf" everywhere - (("Firefox") - "LibreWolf") - ;; Remove non-Latin translations. - (("^Name\\[(ar|bn)\\].*$") - "") - (("^Icon=.*") - (string-append "Icon=" - #$output - "/share/icons/hicolor/128x128/apps/librewolf.png + (substitute* file + (("(checksum = )\".*\"" all name) + (string-append name "\"" null-hash + "\"")))) + (find-files "." "Cargo\\.lock$")) + (for-each generate-all-checksums + '("build" + "dom/media" + "dom/webauthn" + "gfx" + "intl" + "js" + "media" + "modules" + "mozglue/static/rust" + "netwerk" + "remote" + "security/manager/ssl" + "servo" + "storage" + "third_party/rust" + "toolkit" + "xpcom/rust" + "services"))))) + (add-after 'patch-cargo-checksums 'remove-cargo-frozen-flag + (lambda _ + ;; Remove --frozen flag from cargo invokation, otherwise it'll + ;; complain that it's not able to change Cargo.lock. + ;; https://bugzilla.mozilla.org/show_bug.cgi?id=1726373 + (substitute* "build/RunCbindgen.py" + (("args.append\\(\"--frozen\"\\)") "pass")))) + (delete 'bootstrap) + (add-before 'configure 'patch-SpeechDispatcherService.cpp + (lambda _ + (let* ((lib "libspeechd.so.2") + (file (string-append + "dom/media/webspeech/synth/" + "speechd/SpeechDispatcherService.cpp")) + (old-content (call-with-input-file file + get-string-all))) + (substitute + file + `((,(format #f "~s" lib) unquote + (lambda (line _) + (string-replace-substring + line lib + (string-append #$speech-dispatcher + "/lib/" lib)))))) + (if (string=? old-content + (call-with-input-file file + get-string-all)) + (error + "substitute did nothing, phase requires an update"))))) + (add-before 'configure 'set-build-id + ;; Build will write the timestamp to output, which is harmful + ;; for reproducibility, so change it to a fixed date. Use a + ;; separate phase for easier modification with inherit. + (lambda _ + (setenv "MOZ_BUILD_DATE" + #$%librewolf-build-id))) + (replace 'configure + (lambda* (#:key inputs outputs configure-flags + #:allow-other-keys) + (setenv "AUTOCONF" + (string-append (assoc-ref inputs "autoconf") + "/bin/autoconf")) + (setenv "SHELL" + (which "bash")) + (setenv "CONFIG_SHELL" + (which "bash")) + (setenv "MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE" + "system") + ;; This should use the host info probably (does it + ;; build on non-x86_64 though?) + (setenv "GUIX_PYTHONPATH" + (string-append (getcwd) + "/obj-x86_64-pc-linux-gnu/_virtualenvs/build")) + + ;; Use Clang, Clang is 2x faster than GCC + (setenv "AR" "llvm-ar") + (setenv "NM" "llvm-nm") + (setenv "CC" "clang") + (setenv "CXX" "clang++") + (setenv "MOZ_NOSPAM" "1") + (setenv "MOZ_APP_NAME" "librewolf") + + (setenv "MOZBUILD_STATE_PATH" + (getcwd)) + + (let* ((mozconfig (string-append (getcwd) "/mozconfig")) + (out (assoc-ref outputs "out")) + (flags (cons (string-append "--prefix=" out) + configure-flags))) + (format #t "build directory: ~s~%" + (getcwd)) + (format #t "configure flags: ~s~%" flags) + + (define write-flags + (lambda flags + (display (string-join (map (cut string-append + "ac_add_options " <>) + flags) "\n")) + (display "\n"))) + (with-output-to-file mozconfig + (lambda () + (apply write-flags flags) + ;; The following option unsets Telemetry + ;; Reporting. With the Addons Fiasco, + ;; Mozilla was found to be collecting + ;; user's data, including saved passwords + ;; and web form data, without users + ;; consent. Mozilla was also found + ;; shipping updates to systems without + ;; the user's knowledge or permission. + ;; As a result of this, use the following + ;; command to permanently disable + ;; telemetry reporting. + (display "unset MOZ_TELEMETRY_REPORTING\n") + (display "mk_add_options MOZ_CRASHREPORTER=0\n") + (display "mk_add_options MOZ_DATA_REPORTING=0\n") + (display + "mk_add_options MOZ_SERVICES_HEALTHREPORT=0") + (display + "mk_add_options MOZ_TELEMETRY_REPORTING=0"))) + (setenv "MOZCONFIG" mozconfig)) + (invoke "./mach" "configure"))) + (add-before 'build 'fix-addons-placeholder + (lambda _ + (substitute* "toolkit/locales/en-US/toolkit/about/aboutAddons.ftl" + (("addons.mozilla.org") + "gnuzilla.gnu.org")))) + (replace 'build + (lambda* (#:key (make-flags '()) + (parallel-build? #t) #:allow-other-keys) + (apply invoke "./mach" "build" + ;; mach will use parallel build if possible by default + `(,@(if parallel-build? + '() + '("-j1")) ,@make-flags)))) + (add-after 'build 'neutralise-store-references + (lambda _ + ;; Mangle the store references to compilers & + ;; other build tools in about:buildconfig, + ;; reducing the package's closure by 1 GiB on + ;; x86-64. + (let* ((build-dir (car (scandir "." + (cut string-prefix? + "obj-" <>)))) + (file (string-append build-dir + "/dist/bin/chrome/toolkit/" + "content/global/buildconfig.html"))) + (substitute* file + (((format #f "(~a/)([0-9a-df-np-sv-z]{32})" + (regexp-quote (%store-directory))) + _ store hash) + (string-append store + (string-take hash 8) + "<!-- Guix: not a runtime dependency -->" + (string-drop hash 8))))))) + (replace 'install + (lambda _ + (invoke "./mach" "install"))) + (add-after 'install 'remove-duplicate-bin + (lambda* (#:key outputs #:allow-other-keys) + (delete-file (string-append #$output + "/lib/librewolf/librewolf-bin")))) + (add-after 'install 'wrap-glxtest + ;; glxtest uses dlopen() to load mesa and pci + ;; libs, wrap it to set LD_LIBRARY_PATH. + (lambda* (#:key inputs outputs #:allow-other-keys) + (let* ((out (assoc-ref outputs "out")) + (lib (string-append out "/lib")) + (libs (map + (lambda (lib-name) + (string-append (assoc-ref inputs + lib-name) + "/lib")) + '("mesa" "pciutils")))) + (wrap-program (car (find-files lib "^glxtest$")) + `("LD_LIBRARY_PATH" prefix ,libs))))) + (add-after 'install 'patch-config + (lambda* (#:key inputs #:allow-other-keys) + (let ((lib (string-append #$output "/lib/librewolf")) + (config-file "librewolf.cfg")) + + ;; Required for Guix packaged extensions + ;; SCOPE_PROFILE=1, SCOPE_APPLICATION=4, SCOPE_SYSTEM=8 + ;; Default is 5. + (substitute* (in-vicinity lib config-file) + (("defaultPref\\(\"extensions.enabledScopes\", 5\\)") + "defaultPref(\"extensions.enabledScopes\", 13)")) + ;; Use Mozzarella addons repo. + (call-with-port + (open-file + (in-vicinity lib config-file) + "a") + (lambda (port) + ;; Add-ons panel (see settings.js in Icecat source). + (for-each + (lambda (pref) + (format port + "defaultPref(~s, ~s);~%" + (car pref) + (cdr pref))) + `(("extensions.getAddons.search.browseURL" + ,(string-append + "https://gnuzilla.gnu.org/mozzarella/" + "search.php?q=%TERMS%")) + ("extensions.getAddons.get.url" . + "https://gnuzilla.gnu.org/mozzarella") + ("extensions.getAddons.link.url" . + "https://gnuzilla.gnu.org/mozzarella") + ("extensions.getAddons.discovery.api_url" . + "https://gnuzilla.gnu.org/mozzarella") + ("extensions.getAddons.langpacks.url" . + "https://gnuzilla.gnu.org/mozzarella") + ("lightweightThemes.getMoreURL" . + "https://gnuzilla.gnu.org/mozzarella")))))))) + (add-after 'install 'wrap-program + (lambda* (#:key inputs outputs #:allow-other-keys) + ;; The following two functions are from Guix's icecat package in + ;; (gnu packages gnuzilla). See commit + ;; b7a0935420ee630a29b7e5ac73a32ba1eb24f00b. + (define (runpath-of lib) + (call-with-input-file lib + (compose elf-dynamic-info-runpath elf-dynamic-info + parse-elf get-bytevector-all))) + (define (runpaths-of-input label) + (let* ((dir (string-append (assoc-ref inputs label) + "/lib")) + (libs (find-files dir "\\.so$"))) + (append-map runpath-of libs))) + (let* ((out (assoc-ref outputs "out")) + (lib (string-append out "/lib")) + (libs (map + (lambda (lib-name) + (string-append (assoc-ref inputs + lib-name) + "/lib")) + '("mesa" "libpng-apng" "libnotify" "libva" + "pulseaudio" "gtk+" "pipewire" + ;; For U2F and WebAuthn + "eudev"))) + + ;; VA-API is run in the RDD (Remote Data Decoder) sandbox + ;; and must be explicitly given access to files it needs. + ;; Rather than adding the whole store (as Nix had + ;; upstream do, see + ;; <https://github.com/NixOS/nixpkgs/pull/165964> and + ;; linked upstream patches), we can just follow the + ;; runpaths of the needed libraries to add everything to + ;; LD_LIBRARY_PATH. These will then be accessible in the + ;; RDD sandbox. + (rdd-whitelist (map (cut string-append <> "/") + (delete-duplicates (append-map + runpaths-of-input + '("mesa" + "ffmpeg"))))) + (gtk-share (string-append (assoc-ref inputs + "gtk+") + "/share"))) + (wrap-program (car (find-files lib "^librewolf$")) + `("LD_LIBRARY_PATH" prefix + (,@libs ,@rdd-whitelist)) + `("XDG_DATA_DIRS" prefix + (,gtk-share)) + `("MOZ_LEGACY_PROFILES" = + ("1")) + `("MOZ_ALLOW_DOWNGRADE" = + ("1")))))) + (add-after 'wrap-program 'install-desktop-entry + (lambda* (#:key outputs #:allow-other-keys) + (let* ((desktop-file + "taskcluster/docker/firefox-snap/firefox.desktop") + (applications (string-append #$output + "/share/applications"))) + (substitute* desktop-file + (("^Exec=firefox") + (string-append "Exec=" + #$output "/bin/librewolf")) + ;; "Firefox" -> "LibreWolf" everywhere + (("Firefox") + "LibreWolf") + ;; Remove non-Latin translations. + (("^Name\\[(ar|bn)\\].*$") + "") + (("^Icon=.*") + (string-append "Icon=" + #$output + "/share/icons/hicolor/128x128/apps/librewolf.png ")) - ;; These commands were changed. - (("-NewWindow") - "-new-window") - (("-NewPrivateWindow") - "-new-private-window") - (("StartupNotify=true") - "StartupNotify=true + ;; These commands were changed. + (("-NewWindow") + "-new-window") + (("-NewPrivateWindow") + "-new-private-window") + (("StartupNotify=true") + "StartupNotify=true StartupWMClass=Navigator")) - (copy-file desktop-file "librewolf.desktop") - (install-file "librewolf.desktop" applications)))) - (add-after 'install-desktop-entry 'install-icons - (lambda* (#:key outputs #:allow-other-keys) - (let ((icon-source-dir (string-append #$output - "/lib/librewolf/browser/" - "chrome/icons/default"))) - (for-each (lambda (size) - (let ((dest (string-append #$output - "/share/icons/hicolor/" - size - "x" - size - "/apps"))) - (mkdir-p dest) - (symlink (string-append icon-source-dir - "/default" size ".png") - (string-append dest - "/librewolf.png")))) - '("16" "32" "48" "64" "128")))))) - - ;; Test will significantly increase build time but with little rewards. - #:tests? #f - - ;; WARNING: Parallel build will consume lots of memory! - ;; If you have encountered OOM issue in build phase, try disable it. - #:parallel-build? #t - - ;; Some dynamic lib was determined at runtime, so rpath check may fail. - #:validate-runpath? #f)) - (inputs (list bash-minimal - bzip2 - cairo - cups - dbus-glib - freetype - ffmpeg - gdk-pixbuf - glib - gtk+ - gtk+-2 - hunspell - icu4c-73 - jemalloc - libcanberra - libevent - libffi - libgnome - libjpeg-turbo - libnotify - libpng-apng - libva - libvpx - libwebp - libxcomposite - libxft - libxinerama - libxscrnsaver - libxt - mesa - mit-krb5 - nspr - nss/fixed - pango - pciutils - pipewire - pixman - pulseaudio - speech-dispatcher - sqlite - startup-notification - eudev - unzip - zip - zlib)) - (native-inputs (list alsa-lib - autoconf-2.13 - `(,rust-librewolf "cargo") - clang-18 - llvm-18 - m4 - nasm - node-lts - perl - pkg-config - python - rust-librewolf - rust-cbindgen-0.26 - which - yasm)) - (home-page "https://librewolf.net/") - (synopsis - "Custom version of Firefox, focused on privacy, security and freedom") - (description - "LibreWolf is designed to increase protection against tracking and + (copy-file desktop-file "librewolf.desktop") + (install-file "librewolf.desktop" applications)))) + (add-after 'install-desktop-entry 'install-icons + (lambda* (#:key outputs #:allow-other-keys) + (let ((icon-source-dir (string-append #$output + "/lib/librewolf/browser/" + "chrome/icons/default"))) + (for-each (lambda (size) + (let ((dest (string-append #$output + "/share/icons/hicolor/" + size + "x" + size + "/apps"))) + (mkdir-p dest) + (symlink (string-append icon-source-dir + "/default" size ".png") + (string-append dest + "/librewolf.png")))) + '("16" "32" "48" "64" "128")))))) + + ;; Test will significantly increase build time but with little rewards. + #:tests? #f + + ;; WARNING: Parallel build will consume lots of memory! + ;; If you have encountered OOM issue in build phase, try disable it. + #:parallel-build? #t + + ;; Some dynamic lib was determined at runtime, so rpath check may fail. + #:validate-runpath? #f)) + (inputs (list bash-minimal + bzip2 + cairo + cups + dbus-glib + freetype + ffmpeg + gdk-pixbuf + glib + gtk+ + gtk+-2 + hunspell + icu4c-73 + jemalloc + libcanberra + libevent + libffi + libgnome + libjpeg-turbo + libnotify + libpng-apng + libva + libvpx + libwebp + libxcomposite + libxft + libxinerama + libxscrnsaver + libxt + mesa + mit-krb5 + nspr + nss-latest + pango + pciutils + pipewire + pixman + pulseaudio + speech-dispatcher + sqlite + startup-notification + eudev + unzip + zip + zlib)) + (native-inputs (list alsa-lib + autoconf-2.13 + `(,rust-librewolf "cargo") + clang-18 + llvm-18 + m4 + nasm + node-lts + perl + pkg-config + python + rust-librewolf + rust-cbindgen-0.26 + which + yasm)) + (home-page "https://librewolf.net/") + (synopsis + "Custom version of Firefox, focused on privacy, security and freedom") + (description + "LibreWolf is designed to increase protection against tracking and fingerprinting techniques, while also including a few security improvements. This is achieved through our privacy and security oriented settings and patches. LibreWolf also aims to remove all the telemetry, data collection and annoyances, as well as disabling anti-freedom features like DRM.") - (license license:mpl2.0))) + (license license:mpl2.0)))) -- 2.45.1 ^ permalink raw reply related [flat|nested] 33+ messages in thread
* [bug#71832] [PATCH v3 0/2] Add nss-rapid; updte Librewolf to 127.0.2-2. 2024-06-29 3:57 [bug#71832] [PATCH 0/2] Add nss-latest; updte Librewolf to 127.0.2-2 Ian Eure 2024-06-29 3:59 ` [bug#71832] [PATCH 1/2] gnu: Add nss-latest Ian Eure 2024-06-29 17:22 ` [bug#71832] [PATCH v2 0/2] Add nss-latest; update Librewolf to 127.0.2-2 Ian Eure @ 2024-07-02 0:21 ` Ian Eure 2024-07-02 0:21 ` [bug#71832] [PATCH v3 1/2] gnu: Add nss-rapid Ian Eure 2024-07-02 0:21 ` [bug#71832] [PATCH v3 2/2] gnu: librewolf: Update to 127.0.2-1 Ian Eure 2024-07-08 8:55 ` [bug#71832] Closing one bug Andreas Enge ` (4 subsequent siblings) 7 siblings, 2 replies; 33+ messages in thread From: Ian Eure @ 2024-07-02 0:21 UTC (permalink / raw) To: 71832; +Cc: Ian Eure Updated with discussion from guix-devel: - nss rapid release package is now named `nss-rapid'. - Synposis and description clarify what this means. - Comments added above nss-rapid with packager guidance. Ian Eure (2): gnu: Add nss-rapid. gnu: librewolf: Update to 127.0.2-1. gnu/packages/librewolf.scm | 1044 ++++++++++++++++++------------------ gnu/packages/nss.scm | 80 ++- 2 files changed, 600 insertions(+), 524 deletions(-) -- 2.45.1 ^ permalink raw reply [flat|nested] 33+ messages in thread
* [bug#71832] [PATCH v3 1/2] gnu: Add nss-rapid. 2024-07-02 0:21 ` [bug#71832] [PATCH v3 0/2] Add nss-rapid; updte Librewolf to 127.0.2-2 Ian Eure @ 2024-07-02 0:21 ` Ian Eure 2024-07-02 0:21 ` [bug#71832] [PATCH v3 2/2] gnu: librewolf: Update to 127.0.2-1 Ian Eure 1 sibling, 0 replies; 33+ messages in thread From: Ian Eure @ 2024-07-02 0:21 UTC (permalink / raw) To: 71832; +Cc: Ian Eure * gnu/packages/nss.scm (nss-rapid): New variable. Change-Id: I2bdd2119fb0c857feae9eb2e47a28909b8228cd7 --- gnu/packages/nss.scm | 80 ++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 74 insertions(+), 6 deletions(-) diff --git a/gnu/packages/nss.scm b/gnu/packages/nss.scm index d558079f44..4e892ce649 100644 --- a/gnu/packages/nss.scm +++ b/gnu/packages/nss.scm @@ -106,6 +106,9 @@ (define-public nspr-4.32 (base32 "0v3zds1id71j5a5si42a658fjz8nv2f6zp6w4gqrqmdr6ksz8sxv")))))) +;; nss should track ESRs, but currently doesn't. When the next ESR it out, it +;; should get updated. + (define-public nss (package (name "nss") @@ -153,13 +156,13 @@ (define-public nss ;; Ensure we are building for the (%current-target-system). #$@(if (%current-target-system) #~((string-append - "OS_TEST=" - (string-take #$(%current-target-system) - (string-index #$(%current-target-system) #\-))) + "OS_TEST=" + (string-take #$(%current-target-system) + (string-index #$(%current-target-system) #\-))) (string-append - "KERNEL=" (cond (#$(target-hurd?) "gnu") - (#$(target-linux?) "linux") - (else "")))) + "KERNEL=" (cond (#$(target-hurd?) "gnu") + (#$(target-linux?) "linux") + (else "")))) #~()) #$@(if (%current-target-system) #~("CROSS_COMPILE=1") @@ -303,6 +306,71 @@ (define-public nss/fixed (invoke "faketime" "2024-01-23" "./nss/tests/all.sh")) (format #t "test suite not run~%")))))))))))) +;; nss-rapid tracks the rapid release channel. Unless your package requires a +;; newer version, you should prefer the `nss' package, which tracks the ESR +;; channel. +;; +;; See https://wiki.mozilla.org/NSS:Release_Versions +;; and https://wiki.mozilla.org/Rapid_Release_Model + +(define-public nss-rapid + (package + (inherit nss) + (name "nss-rapid") + (version "3.101") + (source (origin + (inherit (package-source nss)) + (uri (let ((version-with-underscores + (string-join (string-split version #\.) "_"))) + (string-append + "https://ftp.mozilla.org/pub/mozilla.org/security/nss/" + "releases/NSS_" version-with-underscores "_RTM/src/" + "nss-" version ".tar.gz"))) + (sha256 + (base32 + "1rw5xpclsy174znvxcb4d4zgjwadxy45mbh0wvkm3fxpnkq4i5w5")))) + (arguments + (substitute-keyword-arguments (package-arguments nss) + ((#:phases phases) + #~(modify-phases #$phases + (replace 'check + (lambda* (#:key tests? #:allow-other-keys) + (if tests? + (begin + ;; Use 127.0.0.1 instead of $HOST.$DOMSUF as HOSTADDR for + ;; testing. The latter requires a working DNS or /etc/hosts. + (setenv "DOMSUF" "localdomain") + (setenv "USE_IP" "TRUE") + (setenv "IP_ADDRESS" "127.0.0.1") + + ;; This specific test is looking at performance "now + ;; verify that we can quickly dump a database", and + ;; we're not testing performance here (especially + ;; since we're using faketime), so raise the + ;; threshold + (substitute* "nss/tests/dbtests/dbtests.sh" + ((" -lt 5") " -lt 50")) + + ;; Since the test suite is very lengthy, run the test + ;; suite once, not thrice as done by default, by + ;; selecting only the 'standard' cycle. + (setenv "NSS_CYCLES" "standard") + + ;; The "PayPalEE.cert" certificate expires every six months, + ;; leading to test failures: + ;; <https://bugzilla.mozilla.org/show_bug.cgi?id=609734>. To + ;; work around that, set the time to roughly the release date. + (invoke "faketime" "2024-01-23" "./nss/tests/all.sh")) + (format #t "test suite not run~%")))))))) + (synopsis "Network Security Services (Rapid Release)") + (description + "Network Security Services (@dfn{NSS}) is a set of libraries designed to +support cross-platform development of security-enabled client and server +applications. Applications built with NSS can support SSL v2 and v3, TLS, +PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other +security standards. + +This package tracks the Rapid Release channel, which updates frequently."))) (define-public nsncd (package (name "nsncd") -- 2.45.1 ^ permalink raw reply related [flat|nested] 33+ messages in thread
* [bug#71832] [PATCH v3 2/2] gnu: librewolf: Update to 127.0.2-1. 2024-07-02 0:21 ` [bug#71832] [PATCH v3 0/2] Add nss-rapid; updte Librewolf to 127.0.2-2 Ian Eure 2024-07-02 0:21 ` [bug#71832] [PATCH v3 1/2] gnu: Add nss-rapid Ian Eure @ 2024-07-02 0:21 ` Ian Eure 1 sibling, 0 replies; 33+ messages in thread From: Ian Eure @ 2024-07-02 0:21 UTC (permalink / raw) To: 71832; +Cc: Ian Eure * gnu/packages/librewolf.scm (librewolf): Update to 127.0.2-1. Reorganize module to improve usability and reduce duplication. The Rust package and build ID are now at the top of the file. The librewolf-source variable has been replaced with the make-librewolf-source procedure, centralizing versions & hashes in the librewolf package definition. Dedent some of the package’s arguments to improve readability. Change-Id: I15f8a2aa1fae07e0497ab5511d10af0c1f70cc2e --- gnu/packages/librewolf.scm | 1044 ++++++++++++++++++------------------ 1 file changed, 526 insertions(+), 518 deletions(-) diff --git a/gnu/packages/librewolf.scm b/gnu/packages/librewolf.scm index c84bcaf3ce..a400080dcb 100644 --- a/gnu/packages/librewolf.scm +++ b/gnu/packages/librewolf.scm @@ -93,6 +93,18 @@ (define-module (gnu packages librewolf) #:use-module (gnu packages xdisorg) #:use-module (gnu packages xorg)) +;; Define the versions of rust needed to build librewolf, trying to match +;; upstream. See the file taskcluster/kinds/toolchain/rust.yml at +;; https://searchfox.org under the particular firefox release, like +;; mozilla-esr102. +;; 1.75 is the default in Guix, 1.77 is the minimum for Librewolf. +(define rust-librewolf rust-1.77) + +;; Update this id with every update to its release date. +;; It's used for cache validation and therefore can lead to strange bugs. +;; ex: date '+%Y%m%d%H%M%S' +(define %librewolf-build-id "20240626133423") + (define (firefox-source-origin version hash) (origin (method url-fetch) @@ -114,11 +126,14 @@ (define (librewolf-source-origin version hash) (define computed-origin-method (@@ (guix packages) computed-origin-method)) -(define librewolf-source - (let* ((ff-src (firefox-source-origin "126.0.1" "0fr679rcwshwpfxidc55b2xsn4pmrr7p9ix4rr2mv2k7kwsjcc7n")) - (version "126.0.1-1") - (lw-src (librewolf-source-origin version "0cac80073vkzd85ai9rbnwixs1h9bpy4dj2ri6jxdlqsy5d663km"))) - +(define* (make-librewolf-source version #:key firefox-hash librewolf-hash) + (let* ((ff-src (firefox-source-origin + (car (string-split version #\-)) + firefox-hash)) + (version version) + (lw-src (librewolf-source-origin + version + librewolf-hash))) (origin (method computed-origin-method) (file-name (string-append "librewolf-" version ".source.tar.gz")) @@ -162,11 +177,6 @@ (define librewolf-source (("^ff_source_tarball:=.*") (string-append "ff_source_tarball:=" #+ff-src))) - ;; Remove encoding_rs patch, it doesn't build with Rust 1.75. - (substitute* '("assets/patches.txt") - (("patches/encoding_rs.patch\\\n$") - "")) - ;; Stage locales. (begin (format #t "Staging locales...~%") @@ -204,523 +214,521 @@ (define librewolf-source ".source.tar.gz") #$output)))))))) -;; Define the versions of rust needed to build librewolf, trying to match -;; upstream. See the file taskcluster/ci/toolchain/rust.yml at -;; https://searchfox.org under the particular firefox release, like -;; mozilla-esr102. -(define rust-librewolf rust) ; 1.75 is the default in Guix, 1.65 is the minimum. - -;; Update this id with every update to its release date. -;; It's used for cache validation and therefore can lead to strange bugs. -;; ex: date '+%Y%m%d%H%M%S' -(define %librewolf-build-id "20240607212143") - (define-public librewolf - (package - (name "librewolf") - (version "126.0.1-1") - (source librewolf-source) - (build-system gnu-build-system) - (arguments - (list - #:configure-flags #~(let ((clang #$(this-package-native-input "clang"))) - `("--enable-application=browser" - - ;; Configuration - "--without-wasm-sandboxed-libraries" - "--with-system-jpeg" - "--with-system-zlib" - "--with-system-png" - "--with-system-webp" - "--with-system-icu" - "--with-system-libvpx" - "--with-system-libevent" - "--with-system-ffi" - "--enable-system-pixman" - "--enable-jemalloc" - - ;; see https://bugs.gnu.org/32833 - "--with-system-nspr" - "--with-system-nss" - - ,(string-append "--with-clang-path=" clang - "/bin/clang") - ,(string-append "--with-libclang-path=" clang - "/lib") - - ;; Distribution - "--with-distribution-id=org.guix" - "--with-app-name=librewolf" - "--with-app-basename=LibreWolf" - "--with-branding=browser/branding/librewolf" - - ;; Features - "--disable-tests" - "--disable-updater" - "--enable-pulseaudio" - "--disable-crashreporter" - "--allow-addon-sideload" - "--with-unsigned-addon-scopes=app,system" - "--disable-eme" - - ;; Build details - "--disable-debug" - "--enable-rust-simd" - "--enable-release" - "--enable-optimize" - "--enable-strip" - "--enable-hardening" - "--disable-elf-hack")) - #:imported-modules %cargo-utils-modules - #:modules `((ice-9 regex) - (ice-9 string-fun) - (ice-9 ftw) - (srfi srfi-1) - (srfi srfi-26) - (rnrs bytevectors) - (rnrs io ports) - (guix elf) - (guix build gremlin) - ,@%gnu-build-system-modules) - #:phases #~(modify-phases %standard-phases - (add-after 'unpack 'fix-preferences - (lambda* (#:key inputs #:allow-other-keys) - (let ((port (open-file "browser/app/profile/firefox.js" - "a"))) - (define (write-setting key value) - (format port "~%pref(\"~a\", ~a);~%" key value) - (format #t + (let ((version "127.0.2-2")) + (package + (name "librewolf") + (version version) + (source (make-librewolf-source + version + #:firefox-hash + "1s73fdp7k60058ylyvlixq13k5hfbmj6k1y42fmzqlpg7n62lyqb" + #:librewolf-hash + "1f4xz496x1nf7lmvk50hakj9p6q0kzxl5f9s2k0b6kczvyc8gw5n")) + + (build-system gnu-build-system) + (arguments + (list + #:configure-flags + #~(let ((clang #$(this-package-native-input "clang"))) + `("--enable-application=browser" + + ;; Configuration + "--without-wasm-sandboxed-libraries" + "--with-system-jpeg" + "--with-system-zlib" + "--with-system-png" + "--with-system-webp" + "--with-system-icu" + "--with-system-libvpx" + "--with-system-libevent" + "--with-system-ffi" + "--enable-system-pixman" + "--enable-jemalloc" + + ;; see https://bugs.gnu.org/32833 + "--with-system-nspr" + "--with-system-nss" + + ,(string-append "--with-clang-path=" clang + "/bin/clang") + ,(string-append "--with-libclang-path=" clang + "/lib") + + ;; Distribution + "--with-distribution-id=org.guix" + "--with-app-name=librewolf" + "--with-app-basename=LibreWolf" + "--with-branding=browser/branding/librewolf" + + ;; Features + "--disable-tests" + "--disable-updater" + "--enable-pulseaudio" + "--disable-crashreporter" + "--allow-addon-sideload" + "--with-unsigned-addon-scopes=app,system" + "--disable-eme" + + ;; Build details + "--disable-debug" + "--enable-rust-simd" + "--enable-release" + "--enable-optimize" + "--enable-strip" + "--enable-hardening" + "--disable-elf-hack")) + #:imported-modules %cargo-utils-modules + #:modules `((ice-9 regex) + (ice-9 string-fun) + (ice-9 ftw) + (srfi srfi-1) + (srfi srfi-26) + (rnrs bytevectors) + (rnrs io ports) + (guix elf) + (guix build gremlin) + ,@%gnu-build-system-modules) + #:phases + #~(modify-phases %standard-phases + (add-after 'unpack 'fix-preferences + (lambda* (#:key inputs #:allow-other-keys) + (let ((port (open-file "browser/app/profile/firefox.js" + "a"))) + (define (write-setting key value) + (format port "~%pref(\"~a\", ~a);~%" key value) + (format #t "fix-preferences: setting value of ~a to ~a~%" key value)) - ;; We should allow the sandbox to read the store directory, - ;; because the sandbox has access to /usr on FHS distros. - (write-setting - "security.sandbox.content.read_path_whitelist" - (string-append "\"" - (%store-directory) "/\"")) - - ;; XDG settings should be managed by Guix. - (write-setting "browser.shell.checkDefaultBrowser" - "false") - (close-port port)))) - (add-after 'fix-preferences 'fix-ffmpeg-runtime-linker - (lambda* (#:key inputs #:allow-other-keys) - (let* ((ffmpeg (assoc-ref inputs "ffmpeg")) - (libavcodec (string-append ffmpeg - "/lib/libavcodec.so"))) - ;; Arrange to load libavcodec.so by its absolute file name. - (substitute* "dom/media/platforms/ffmpeg/FFmpegRuntimeLinker.cpp" - (("libavcodec\\.so") - libavcodec))))) - (add-after 'patch-source-shebangs 'patch-cargo-checksums - (lambda _ - (use-modules (guix build cargo-utils)) - (let ((null-hash - ;; This is the SHA256 output of an empty string. - (string-append - "e3b0c44298fc1c149afbf4c8996fb924" - "27ae41e4649b934ca495991b7852b855"))) - (for-each (lambda (file) - (format #t + ;; We should allow the sandbox to read the store directory, + ;; because the sandbox has access to /usr on FHS distros. + (write-setting + "security.sandbox.content.read_path_whitelist" + (string-append "\"" + (%store-directory) "/\"")) + + ;; XDG settings should be managed by Guix. + (write-setting "browser.shell.checkDefaultBrowser" + "false") + (close-port port)))) + (add-after 'fix-preferences 'fix-ffmpeg-runtime-linker + (lambda* (#:key inputs #:allow-other-keys) + (let* ((ffmpeg (assoc-ref inputs "ffmpeg")) + (libavcodec (string-append ffmpeg + "/lib/libavcodec.so"))) + ;; Arrange to load libavcodec.so by its absolute file name. + (substitute* "dom/media/platforms/ffmpeg/FFmpegRuntimeLinker.cpp" + (("libavcodec\\.so") + libavcodec))))) + (add-after 'patch-source-shebangs 'patch-cargo-checksums + (lambda _ + (use-modules (guix build cargo-utils)) + (let ((null-hash + ;; This is the SHA256 output of an empty string. + (string-append + "e3b0c44298fc1c149afbf4c8996fb924" + "27ae41e4649b934ca495991b7852b855"))) + (for-each (lambda (file) + (format #t "patch-cargo-checksums: patching checksums in ~a~%" file) - (substitute* file - (("(checksum = )\".*\"" all name) - (string-append name "\"" null-hash - "\"")))) - (find-files "." "Cargo\\.lock$")) - (for-each generate-all-checksums - '("build" - "dom/media" - "dom/webauthn" - "gfx" - "intl" - "js" - "media" - "modules" - "mozglue/static/rust" - "netwerk" - "remote" - "security/manager/ssl" - "servo" - "storage" - "third_party/rust" - "toolkit" - "xpcom/rust" - "services"))))) - (add-after 'patch-cargo-checksums 'remove-cargo-frozen-flag - (lambda _ - ;; Remove --frozen flag from cargo invokation, otherwise it'll - ;; complain that it's not able to change Cargo.lock. - ;; https://bugzilla.mozilla.org/show_bug.cgi?id=1726373 - (substitute* "build/RunCbindgen.py" - (("args.append\\(\"--frozen\"\\)") "pass")))) - (delete 'bootstrap) - (add-before 'configure 'patch-SpeechDispatcherService.cpp - (lambda _ - (let* ((lib "libspeechd.so.2") - (file (string-append - "dom/media/webspeech/synth/" - "speechd/SpeechDispatcherService.cpp")) - (old-content (call-with-input-file file - get-string-all))) - (substitute - file - `((,(format #f "~s" lib) unquote - (lambda (line _) - (string-replace-substring - line lib - (string-append #$speech-dispatcher - "/lib/" lib)))))) - (if (string=? old-content - (call-with-input-file file - get-string-all)) - (error - "substitute did nothing, phase requires an update"))))) - (add-before 'configure 'set-build-id - ;; Build will write the timestamp to output, which is harmful - ;; for reproducibility, so change it to a fixed date. Use a - ;; separate phase for easier modification with inherit. - (lambda _ - (setenv "MOZ_BUILD_DATE" - #$%librewolf-build-id))) - (replace 'configure - (lambda* (#:key inputs outputs configure-flags - #:allow-other-keys) - (setenv "AUTOCONF" - (string-append (assoc-ref inputs "autoconf") - "/bin/autoconf")) - (setenv "SHELL" - (which "bash")) - (setenv "CONFIG_SHELL" - (which "bash")) - (setenv "MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE" - "system") - ;; This should use the host info probably (does it - ;; build on non-x86_64 though?) - (setenv "GUIX_PYTHONPATH" - (string-append (getcwd) - "/obj-x86_64-pc-linux-gnu/_virtualenvs/build")) - - ;; Use Clang, Clang is 2x faster than GCC - (setenv "AR" "llvm-ar") - (setenv "NM" "llvm-nm") - (setenv "CC" "clang") - (setenv "CXX" "clang++") - (setenv "MOZ_NOSPAM" "1") - (setenv "MOZ_APP_NAME" "librewolf") - - (setenv "MOZBUILD_STATE_PATH" - (getcwd)) - - (let* ((mozconfig (string-append (getcwd) "/mozconfig")) - (out (assoc-ref outputs "out")) - (flags (cons (string-append "--prefix=" out) - configure-flags))) - (format #t "build directory: ~s~%" - (getcwd)) - (format #t "configure flags: ~s~%" flags) - - (define write-flags - (lambda flags - (display (string-join (map (cut string-append - "ac_add_options " <>) - flags) "\n")) - (display "\n"))) - (with-output-to-file mozconfig - (lambda () - (apply write-flags flags) - ;; The following option unsets Telemetry - ;; Reporting. With the Addons Fiasco, - ;; Mozilla was found to be collecting - ;; user's data, including saved passwords - ;; and web form data, without users - ;; consent. Mozilla was also found - ;; shipping updates to systems without - ;; the user's knowledge or permission. - ;; As a result of this, use the following - ;; command to permanently disable - ;; telemetry reporting. - (display "unset MOZ_TELEMETRY_REPORTING\n") - (display "mk_add_options MOZ_CRASHREPORTER=0\n") - (display "mk_add_options MOZ_DATA_REPORTING=0\n") - (display - "mk_add_options MOZ_SERVICES_HEALTHREPORT=0") - (display - "mk_add_options MOZ_TELEMETRY_REPORTING=0"))) - (setenv "MOZCONFIG" mozconfig)) - (invoke "./mach" "configure"))) - (add-before 'build 'fix-addons-placeholder - (lambda _ - (substitute* "toolkit/locales/en-US/toolkit/about/aboutAddons.ftl" - (("addons.mozilla.org") - "gnuzilla.gnu.org")))) - (replace 'build - (lambda* (#:key (make-flags '()) - (parallel-build? #t) #:allow-other-keys) - (apply invoke "./mach" "build" - ;; mach will use parallel build if possible by default - `(,@(if parallel-build? - '() - '("-j1")) ,@make-flags)))) - (add-after 'build 'neutralise-store-references - (lambda _ - ;; Mangle the store references to compilers & - ;; other build tools in about:buildconfig, - ;; reducing the package's closure by 1 GiB on - ;; x86-64. - (let* ((build-dir (car (scandir "." - (cut string-prefix? - "obj-" <>)))) - (file (string-append build-dir - "/dist/bin/chrome/toolkit/" - "content/global/buildconfig.html"))) - (substitute* file - (((format #f "(~a/)([0-9a-df-np-sv-z]{32})" - (regexp-quote (%store-directory))) - _ store hash) - (string-append store - (string-take hash 8) - "<!-- Guix: not a runtime dependency -->" - (string-drop hash 8))))))) - (replace 'install - (lambda _ - (invoke "./mach" "install"))) - (add-after 'install 'remove-duplicate-bin - (lambda* (#:key outputs #:allow-other-keys) - (delete-file (string-append #$output - "/lib/librewolf/librewolf-bin")))) - (add-after 'install 'wrap-glxtest - ;; glxtest uses dlopen() to load mesa and pci - ;; libs, wrap it to set LD_LIBRARY_PATH. - (lambda* (#:key inputs outputs #:allow-other-keys) - (let* ((out (assoc-ref outputs "out")) - (lib (string-append out "/lib")) - (libs (map - (lambda (lib-name) - (string-append (assoc-ref inputs - lib-name) - "/lib")) - '("mesa" "pciutils")))) - (wrap-program (car (find-files lib "^glxtest$")) - `("LD_LIBRARY_PATH" prefix ,libs))))) - (add-after 'install 'patch-config - (lambda* (#:key inputs #:allow-other-keys) - (let ((lib (string-append #$output "/lib/librewolf")) - (config-file "librewolf.cfg")) - - ;; Required for Guix packaged extensions - ;; SCOPE_PROFILE=1, SCOPE_APPLICATION=4, SCOPE_SYSTEM=8 - ;; Default is 5. - (substitute* (in-vicinity lib config-file) - (("defaultPref\\(\"extensions.enabledScopes\", 5\\)") - "defaultPref(\"extensions.enabledScopes\", 13)")) - ;; Use Mozzarella addons repo. - (call-with-port - (open-file - (in-vicinity lib config-file) - "a") - (lambda (port) - ;; Add-ons panel (see settings.js in Icecat source). - (for-each - (lambda (pref) - (format port - "defaultPref(~s, ~s);~%" - (car pref) - (cdr pref))) - `(("extensions.getAddons.search.browseURL" - ,(string-append - "https://gnuzilla.gnu.org/mozzarella/" - "search.php?q=%TERMS%")) - ("extensions.getAddons.get.url" . - "https://gnuzilla.gnu.org/mozzarella") - ("extensions.getAddons.link.url" . - "https://gnuzilla.gnu.org/mozzarella") - ("extensions.getAddons.discovery.api_url" . - "https://gnuzilla.gnu.org/mozzarella") - ("extensions.getAddons.langpacks.url" . - "https://gnuzilla.gnu.org/mozzarella") - ("lightweightThemes.getMoreURL" . - "https://gnuzilla.gnu.org/mozzarella")))))))) - (add-after 'install 'wrap-program - (lambda* (#:key inputs outputs #:allow-other-keys) - ;; The following two functions are from Guix's icecat package in - ;; (gnu packages gnuzilla). See commit - ;; b7a0935420ee630a29b7e5ac73a32ba1eb24f00b. - (define (runpath-of lib) - (call-with-input-file lib - (compose elf-dynamic-info-runpath elf-dynamic-info - parse-elf get-bytevector-all))) - (define (runpaths-of-input label) - (let* ((dir (string-append (assoc-ref inputs label) - "/lib")) - (libs (find-files dir "\\.so$"))) - (append-map runpath-of libs))) - (let* ((out (assoc-ref outputs "out")) - (lib (string-append out "/lib")) - (libs (map - (lambda (lib-name) - (string-append (assoc-ref inputs - lib-name) - "/lib")) - '("mesa" "libpng-apng" "libnotify" "libva" - "pulseaudio" "gtk+" "pipewire" - ;; For U2F and WebAuthn - "eudev"))) - - ;; VA-API is run in the RDD (Remote Data Decoder) sandbox - ;; and must be explicitly given access to files it needs. - ;; Rather than adding the whole store (as Nix had - ;; upstream do, see - ;; <https://github.com/NixOS/nixpkgs/pull/165964> and - ;; linked upstream patches), we can just follow the - ;; runpaths of the needed libraries to add everything to - ;; LD_LIBRARY_PATH. These will then be accessible in the - ;; RDD sandbox. - (rdd-whitelist (map (cut string-append <> "/") - (delete-duplicates (append-map - runpaths-of-input - '("mesa" - "ffmpeg"))))) - (gtk-share (string-append (assoc-ref inputs - "gtk+") - "/share"))) - (wrap-program (car (find-files lib "^librewolf$")) - `("LD_LIBRARY_PATH" prefix - (,@libs ,@rdd-whitelist)) - `("XDG_DATA_DIRS" prefix - (,gtk-share)) - `("MOZ_LEGACY_PROFILES" = - ("1")) - `("MOZ_ALLOW_DOWNGRADE" = - ("1")))))) - (add-after 'wrap-program 'install-desktop-entry - (lambda* (#:key outputs #:allow-other-keys) - (let* ((desktop-file - "taskcluster/docker/firefox-snap/firefox.desktop") - (applications (string-append #$output - "/share/applications"))) - (substitute* desktop-file - (("^Exec=firefox") - (string-append "Exec=" - #$output "/bin/librewolf")) - ;; "Firefox" -> "LibreWolf" everywhere - (("Firefox") - "LibreWolf") - ;; Remove non-Latin translations. - (("^Name\\[(ar|bn)\\].*$") - "") - (("^Icon=.*") - (string-append "Icon=" - #$output - "/share/icons/hicolor/128x128/apps/librewolf.png + (substitute* file + (("(checksum = )\".*\"" all name) + (string-append name "\"" null-hash + "\"")))) + (find-files "." "Cargo\\.lock$")) + (for-each generate-all-checksums + '("build" + "dom/media" + "dom/webauthn" + "gfx" + "intl" + "js" + "media" + "modules" + "mozglue/static/rust" + "netwerk" + "remote" + "security/manager/ssl" + "servo" + "storage" + "third_party/rust" + "toolkit" + "xpcom/rust" + "services"))))) + (add-after 'patch-cargo-checksums 'remove-cargo-frozen-flag + (lambda _ + ;; Remove --frozen flag from cargo invokation, otherwise it'll + ;; complain that it's not able to change Cargo.lock. + ;; https://bugzilla.mozilla.org/show_bug.cgi?id=1726373 + (substitute* "build/RunCbindgen.py" + (("args.append\\(\"--frozen\"\\)") "pass")))) + (delete 'bootstrap) + (add-before 'configure 'patch-SpeechDispatcherService.cpp + (lambda _ + (let* ((lib "libspeechd.so.2") + (file (string-append + "dom/media/webspeech/synth/" + "speechd/SpeechDispatcherService.cpp")) + (old-content (call-with-input-file file + get-string-all))) + (substitute + file + `((,(format #f "~s" lib) unquote + (lambda (line _) + (string-replace-substring + line lib + (string-append #$speech-dispatcher + "/lib/" lib)))))) + (if (string=? old-content + (call-with-input-file file + get-string-all)) + (error + "substitute did nothing, phase requires an update"))))) + (add-before 'configure 'set-build-id + ;; Build will write the timestamp to output, which is harmful + ;; for reproducibility, so change it to a fixed date. Use a + ;; separate phase for easier modification with inherit. + (lambda _ + (setenv "MOZ_BUILD_DATE" + #$%librewolf-build-id))) + (replace 'configure + (lambda* (#:key inputs outputs configure-flags + #:allow-other-keys) + (setenv "AUTOCONF" + (string-append (assoc-ref inputs "autoconf") + "/bin/autoconf")) + (setenv "SHELL" + (which "bash")) + (setenv "CONFIG_SHELL" + (which "bash")) + (setenv "MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE" + "system") + ;; This should use the host info probably (does it + ;; build on non-x86_64 though?) + (setenv "GUIX_PYTHONPATH" + (string-append (getcwd) + "/obj-x86_64-pc-linux-gnu/_virtualenvs/build")) + + ;; Use Clang, Clang is 2x faster than GCC + (setenv "AR" "llvm-ar") + (setenv "NM" "llvm-nm") + (setenv "CC" "clang") + (setenv "CXX" "clang++") + (setenv "MOZ_NOSPAM" "1") + (setenv "MOZ_APP_NAME" "librewolf") + + (setenv "MOZBUILD_STATE_PATH" + (getcwd)) + + (let* ((mozconfig (string-append (getcwd) "/mozconfig")) + (out (assoc-ref outputs "out")) + (flags (cons (string-append "--prefix=" out) + configure-flags))) + (format #t "build directory: ~s~%" + (getcwd)) + (format #t "configure flags: ~s~%" flags) + + (define write-flags + (lambda flags + (display (string-join (map (cut string-append + "ac_add_options " <>) + flags) "\n")) + (display "\n"))) + (with-output-to-file mozconfig + (lambda () + (apply write-flags flags) + ;; The following option unsets Telemetry + ;; Reporting. With the Addons Fiasco, + ;; Mozilla was found to be collecting + ;; user's data, including saved passwords + ;; and web form data, without users + ;; consent. Mozilla was also found + ;; shipping updates to systems without + ;; the user's knowledge or permission. + ;; As a result of this, use the following + ;; command to permanently disable + ;; telemetry reporting. + (display "unset MOZ_TELEMETRY_REPORTING\n") + (display "mk_add_options MOZ_CRASHREPORTER=0\n") + (display "mk_add_options MOZ_DATA_REPORTING=0\n") + (display + "mk_add_options MOZ_SERVICES_HEALTHREPORT=0") + (display + "mk_add_options MOZ_TELEMETRY_REPORTING=0"))) + (setenv "MOZCONFIG" mozconfig)) + (invoke "./mach" "configure"))) + (add-before 'build 'fix-addons-placeholder + (lambda _ + (substitute* "toolkit/locales/en-US/toolkit/about/aboutAddons.ftl" + (("addons.mozilla.org") + "gnuzilla.gnu.org")))) + (replace 'build + (lambda* (#:key (make-flags '()) + (parallel-build? #t) #:allow-other-keys) + (apply invoke "./mach" "build" + ;; mach will use parallel build if possible by default + `(,@(if parallel-build? + '() + '("-j1")) ,@make-flags)))) + (add-after 'build 'neutralise-store-references + (lambda _ + ;; Mangle the store references to compilers & + ;; other build tools in about:buildconfig, + ;; reducing the package's closure by 1 GiB on + ;; x86-64. + (let* ((build-dir (car (scandir "." + (cut string-prefix? + "obj-" <>)))) + (file (string-append build-dir + "/dist/bin/chrome/toolkit/" + "content/global/buildconfig.html"))) + (substitute* file + (((format #f "(~a/)([0-9a-df-np-sv-z]{32})" + (regexp-quote (%store-directory))) + _ store hash) + (string-append store + (string-take hash 8) + "<!-- Guix: not a runtime dependency -->" + (string-drop hash 8))))))) + (replace 'install + (lambda _ + (invoke "./mach" "install"))) + (add-after 'install 'remove-duplicate-bin + (lambda* (#:key outputs #:allow-other-keys) + (delete-file (string-append #$output + "/lib/librewolf/librewolf-bin")))) + (add-after 'install 'wrap-glxtest + ;; glxtest uses dlopen() to load mesa and pci + ;; libs, wrap it to set LD_LIBRARY_PATH. + (lambda* (#:key inputs outputs #:allow-other-keys) + (let* ((out (assoc-ref outputs "out")) + (lib (string-append out "/lib")) + (libs (map + (lambda (lib-name) + (string-append (assoc-ref inputs + lib-name) + "/lib")) + '("mesa" "pciutils")))) + (wrap-program (car (find-files lib "^glxtest$")) + `("LD_LIBRARY_PATH" prefix ,libs))))) + (add-after 'install 'patch-config + (lambda* (#:key inputs #:allow-other-keys) + (let ((lib (string-append #$output "/lib/librewolf")) + (config-file "librewolf.cfg")) + + ;; Required for Guix packaged extensions + ;; SCOPE_PROFILE=1, SCOPE_APPLICATION=4, SCOPE_SYSTEM=8 + ;; Default is 5. + (substitute* (in-vicinity lib config-file) + (("defaultPref\\(\"extensions.enabledScopes\", 5\\)") + "defaultPref(\"extensions.enabledScopes\", 13)")) + ;; Use Mozzarella addons repo. + (call-with-port + (open-file + (in-vicinity lib config-file) + "a") + (lambda (port) + ;; Add-ons panel (see settings.js in Icecat source). + (for-each + (lambda (pref) + (format port + "defaultPref(~s, ~s);~%" + (car pref) + (cdr pref))) + `(("extensions.getAddons.search.browseURL" + ,(string-append + "https://gnuzilla.gnu.org/mozzarella/" + "search.php?q=%TERMS%")) + ("extensions.getAddons.get.url" . + "https://gnuzilla.gnu.org/mozzarella") + ("extensions.getAddons.link.url" . + "https://gnuzilla.gnu.org/mozzarella") + ("extensions.getAddons.discovery.api_url" . + "https://gnuzilla.gnu.org/mozzarella") + ("extensions.getAddons.langpacks.url" . + "https://gnuzilla.gnu.org/mozzarella") + ("lightweightThemes.getMoreURL" . + "https://gnuzilla.gnu.org/mozzarella")))))))) + (add-after 'install 'wrap-program + (lambda* (#:key inputs outputs #:allow-other-keys) + ;; The following two functions are from Guix's icecat package in + ;; (gnu packages gnuzilla). See commit + ;; b7a0935420ee630a29b7e5ac73a32ba1eb24f00b. + (define (runpath-of lib) + (call-with-input-file lib + (compose elf-dynamic-info-runpath elf-dynamic-info + parse-elf get-bytevector-all))) + (define (runpaths-of-input label) + (let* ((dir (string-append (assoc-ref inputs label) + "/lib")) + (libs (find-files dir "\\.so$"))) + (append-map runpath-of libs))) + (let* ((out (assoc-ref outputs "out")) + (lib (string-append out "/lib")) + (libs (map + (lambda (lib-name) + (string-append (assoc-ref inputs + lib-name) + "/lib")) + '("mesa" "libpng-apng" "libnotify" "libva" + "pulseaudio" "gtk+" "pipewire" + ;; For U2F and WebAuthn + "eudev"))) + + ;; VA-API is run in the RDD (Remote Data Decoder) sandbox + ;; and must be explicitly given access to files it needs. + ;; Rather than adding the whole store (as Nix had + ;; upstream do, see + ;; <https://github.com/NixOS/nixpkgs/pull/165964> and + ;; linked upstream patches), we can just follow the + ;; runpaths of the needed libraries to add everything to + ;; LD_LIBRARY_PATH. These will then be accessible in the + ;; RDD sandbox. + (rdd-whitelist (map (cut string-append <> "/") + (delete-duplicates (append-map + runpaths-of-input + '("mesa" + "ffmpeg"))))) + (gtk-share (string-append (assoc-ref inputs + "gtk+") + "/share"))) + (wrap-program (car (find-files lib "^librewolf$")) + `("LD_LIBRARY_PATH" prefix + (,@libs ,@rdd-whitelist)) + `("XDG_DATA_DIRS" prefix + (,gtk-share)) + `("MOZ_LEGACY_PROFILES" = + ("1")) + `("MOZ_ALLOW_DOWNGRADE" = + ("1")))))) + (add-after 'wrap-program 'install-desktop-entry + (lambda* (#:key outputs #:allow-other-keys) + (let* ((desktop-file + "taskcluster/docker/firefox-snap/firefox.desktop") + (applications (string-append #$output + "/share/applications"))) + (substitute* desktop-file + (("^Exec=firefox") + (string-append "Exec=" + #$output "/bin/librewolf")) + ;; "Firefox" -> "LibreWolf" everywhere + (("Firefox") + "LibreWolf") + ;; Remove non-Latin translations. + (("^Name\\[(ar|bn)\\].*$") + "") + (("^Icon=.*") + (string-append "Icon=" + #$output + "/share/icons/hicolor/128x128/apps/librewolf.png ")) - ;; These commands were changed. - (("-NewWindow") - "-new-window") - (("-NewPrivateWindow") - "-new-private-window") - (("StartupNotify=true") - "StartupNotify=true + ;; These commands were changed. + (("-NewWindow") + "-new-window") + (("-NewPrivateWindow") + "-new-private-window") + (("StartupNotify=true") + "StartupNotify=true StartupWMClass=Navigator")) - (copy-file desktop-file "librewolf.desktop") - (install-file "librewolf.desktop" applications)))) - (add-after 'install-desktop-entry 'install-icons - (lambda* (#:key outputs #:allow-other-keys) - (let ((icon-source-dir (string-append #$output - "/lib/librewolf/browser/" - "chrome/icons/default"))) - (for-each (lambda (size) - (let ((dest (string-append #$output - "/share/icons/hicolor/" - size - "x" - size - "/apps"))) - (mkdir-p dest) - (symlink (string-append icon-source-dir - "/default" size ".png") - (string-append dest - "/librewolf.png")))) - '("16" "32" "48" "64" "128")))))) - - ;; Test will significantly increase build time but with little rewards. - #:tests? #f - - ;; WARNING: Parallel build will consume lots of memory! - ;; If you have encountered OOM issue in build phase, try disable it. - #:parallel-build? #t - - ;; Some dynamic lib was determined at runtime, so rpath check may fail. - #:validate-runpath? #f)) - (inputs (list bash-minimal - bzip2 - cairo - cups - dbus-glib - freetype - ffmpeg - gdk-pixbuf - glib - gtk+ - gtk+-2 - hunspell - icu4c-73 - jemalloc - libcanberra - libevent - libffi - libgnome - libjpeg-turbo - libnotify - libpng-apng - libva - libvpx - libwebp - libxcomposite - libxft - libxinerama - libxscrnsaver - libxt - mesa - mit-krb5 - nspr - nss/fixed - pango - pciutils - pipewire - pixman - pulseaudio - speech-dispatcher - sqlite - startup-notification - eudev - unzip - zip - zlib)) - (native-inputs (list alsa-lib - autoconf-2.13 - `(,rust-librewolf "cargo") - clang-18 - llvm-18 - m4 - nasm - node-lts - perl - pkg-config - python - rust-librewolf - rust-cbindgen-0.26 - which - yasm)) - (home-page "https://librewolf.net/") - (synopsis - "Custom version of Firefox, focused on privacy, security and freedom") - (description - "LibreWolf is designed to increase protection against tracking and + (copy-file desktop-file "librewolf.desktop") + (install-file "librewolf.desktop" applications)))) + (add-after 'install-desktop-entry 'install-icons + (lambda* (#:key outputs #:allow-other-keys) + (let ((icon-source-dir (string-append #$output + "/lib/librewolf/browser/" + "chrome/icons/default"))) + (for-each (lambda (size) + (let ((dest (string-append #$output + "/share/icons/hicolor/" + size + "x" + size + "/apps"))) + (mkdir-p dest) + (symlink (string-append icon-source-dir + "/default" size ".png") + (string-append dest + "/librewolf.png")))) + '("16" "32" "48" "64" "128")))))) + + ;; Test will significantly increase build time but with little rewards. + #:tests? #f + + ;; WARNING: Parallel build will consume lots of memory! + ;; If you have encountered OOM issue in build phase, try disable it. + #:parallel-build? #t + + ;; Some dynamic lib was determined at runtime, so rpath check may fail. + #:validate-runpath? #f)) + (inputs (list bash-minimal + bzip2 + cairo + cups + dbus-glib + freetype + ffmpeg + gdk-pixbuf + glib + gtk+ + gtk+-2 + hunspell + icu4c-73 + jemalloc + libcanberra + libevent + libffi + libgnome + libjpeg-turbo + libnotify + libpng-apng + libva + libvpx + libwebp + libxcomposite + libxft + libxinerama + libxscrnsaver + libxt + mesa + mit-krb5 + nspr + nss-latest + pango + pciutils + pipewire + pixman + pulseaudio + speech-dispatcher + sqlite + startup-notification + eudev + unzip + zip + zlib)) + (native-inputs (list alsa-lib + autoconf-2.13 + `(,rust-librewolf "cargo") + clang-18 + llvm-18 + m4 + nasm + node-lts + perl + pkg-config + python + rust-librewolf + rust-cbindgen-0.26 + which + yasm)) + (home-page "https://librewolf.net/") + (synopsis + "Custom version of Firefox, focused on privacy, security and freedom") + (description + "LibreWolf is designed to increase protection against tracking and fingerprinting techniques, while also including a few security improvements. This is achieved through our privacy and security oriented settings and patches. LibreWolf also aims to remove all the telemetry, data collection and annoyances, as well as disabling anti-freedom features like DRM.") - (license license:mpl2.0))) + (license license:mpl2.0)))) -- 2.45.1 ^ permalink raw reply related [flat|nested] 33+ messages in thread
* [bug#71832] Closing one bug 2024-06-29 3:57 [bug#71832] [PATCH 0/2] Add nss-latest; updte Librewolf to 127.0.2-2 Ian Eure ` (2 preceding siblings ...) 2024-07-02 0:21 ` [bug#71832] [PATCH v3 0/2] Add nss-rapid; updte Librewolf to 127.0.2-2 Ian Eure @ 2024-07-08 8:55 ` Andreas Enge 2024-07-01 19:53 ` [bug#71882] [PATCH] gnu: librewolf: Fix building on aarch64-linux Remco van 't Veer 2024-07-17 3:06 ` [bug#71832] [PATCH v4 0/3] Add nss-rapid; update Librewolf to 128.0-2 Ian Eure ` (3 subsequent siblings) 7 siblings, 1 reply; 33+ messages in thread From: Andreas Enge @ 2024-07-08 8:55 UTC (permalink / raw) To: 71882-done, 71832 Hello, I have pushed the patch of #71882 to fix the build on non-x86 architectures. I could still build on x86_64, but could still not build on aarch64; but the latter failure is probably due to a lack of memory (the configure phase passes now, but the build fails later on with a SIGKILL). As this means that the librewolf update of #71832 needs to be rebased, I am cc-ing this bug. Andreas ^ permalink raw reply [flat|nested] 33+ messages in thread
* [bug#71882] [PATCH] gnu: librewolf: Fix building on aarch64-linux. @ 2024-07-01 19:53 ` Remco van 't Veer [not found] ` <handler.71882.D71882.172042897930179.notifdone@debbugs.gnu.org> 0 siblings, 1 reply; 33+ messages in thread From: Remco van 't Veer @ 2024-07-01 19:53 UTC (permalink / raw) To: 71882; +Cc: Remco van 't Veer * gnu/packages/librewolf.scm (librewolf)[arguments]: On non-x86-linux systems the "--disable-eme" switch is not available because EME is not available. Change-Id: I0f397570249b1bc6a0182d2744a8d3c459c1bafa --- gnu/packages/librewolf.scm | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/gnu/packages/librewolf.scm b/gnu/packages/librewolf.scm index c84bcaf3ce..892f12565d 100644 --- a/gnu/packages/librewolf.scm +++ b/gnu/packages/librewolf.scm @@ -22,6 +22,7 @@ ;;; Copyright © 2022 Pierre Langlois <pierre.langlois@gmx.com> ;;; Copyright © 2023 Tomas Volf <wolf@wolfsden.cz> ;;; Copyright © 2023 Ian Eure <ian@retrospec.tv> +;;; Copyright © 2024 Remco van 't Veer <remco@remworks.net> ;;; ;;; This file is part of GNU Guix. ;;; @@ -261,7 +262,10 @@ (define-public librewolf "--disable-crashreporter" "--allow-addon-sideload" "--with-unsigned-addon-scopes=app,system" - "--disable-eme" + + ;; switch only available on x86 and EME not + ;; supported on other targets + ,@(if #$(target-x86?) '("--disable-eme") '()) ;; Build details "--disable-debug" base-commit: ba6460900f052759fe82e4ceb606d25e19f02884 -- 2.45.1 ^ permalink raw reply related [flat|nested] 33+ messages in thread
[parent not found: <handler.71882.D71882.172042897930179.notifdone@debbugs.gnu.org>]
* [bug#71882] closed (Closing one bug) [not found] ` <handler.71882.D71882.172042897930179.notifdone@debbugs.gnu.org> @ 2024-07-08 10:16 ` Remco van 't Veer 0 siblings, 0 replies; 33+ messages in thread From: Remco van 't Veer @ 2024-07-08 10:16 UTC (permalink / raw) To: 71882; +Cc: Andreas Enge Hi Andreas, Thanks for committing this. 2024/07/08, GNU bug Tracking System: > I have pushed the patch of #71882 to fix the build on non-x86 architectures. > I could still build on x86_64, but could still not build on aarch64; but > the latter failure is probably due to a lack of memory (the configure phase > passes now, but the build fails later on with a SIGKILL). I tried to build it on the only ARM machine I have but indeed 8Gb of RAM is not enough and this build dies with a OOM kill. So I used a 22Gb x86 machine and qemu with offload build to get a working binary for my ARM machine. Happily browsing the internet with librwolf on my mnt reform now. Remco ^ permalink raw reply [flat|nested] 33+ messages in thread
* [bug#71832] [PATCH v4 0/3] Add nss-rapid; update Librewolf to 128.0-2 2024-06-29 3:57 [bug#71832] [PATCH 0/2] Add nss-latest; updte Librewolf to 127.0.2-2 Ian Eure ` (3 preceding siblings ...) 2024-07-08 8:55 ` [bug#71832] Closing one bug Andreas Enge @ 2024-07-17 3:06 ` Ian Eure 2024-07-17 3:06 ` [bug#71832] [PATCH v4 1/3] gnu: Add nss-rapid Ian Eure ` (2 more replies) 2024-07-21 16:17 ` [bug#71832] [PATCH 0/2] Add nss-latest; updte Librewolf to 127.0.2-2 Ian Eure ` (2 subsequent siblings) 7 siblings, 3 replies; 33+ messages in thread From: Ian Eure @ 2024-07-17 3:06 UTC (permalink / raw) To: 71832; +Cc: Ian Eure # vs. v3 of these patches, this series: - Rebases to integrate #71832. - Update Librewolf to 128.0-2, the current version. - Update nss-rapid to 3.102, the current rapid release version. - Add the skr locale, needed by Firefox 128.x, which is Librewolf’s upstream. Ian Eure (3): gnu: Add nss-rapid. gnu: gnuzilla: Add skr to all-mozilla-locales. gnu: librewolf: Update to 128.0-2 gnu/packages/gnuzilla.scm | 1 + gnu/packages/librewolf.scm | 1049 ++++++++++++++++++------------------ gnu/packages/nss.scm | 80 ++- 3 files changed, 603 insertions(+), 527 deletions(-) -- 2.45.2 ^ permalink raw reply [flat|nested] 33+ messages in thread
* [bug#71832] [PATCH v4 1/3] gnu: Add nss-rapid. 2024-07-17 3:06 ` [bug#71832] [PATCH v4 0/3] Add nss-rapid; update Librewolf to 128.0-2 Ian Eure @ 2024-07-17 3:06 ` Ian Eure 2024-07-17 3:06 ` [bug#71832] [PATCH v4 2/3] gnu: gnuzilla: Add skr to all-mozilla-locales Ian Eure 2024-07-17 3:06 ` [bug#71832] [PATCH v4 3/3] gnu: librewolf: Update to 128.0-2 Ian Eure 2 siblings, 0 replies; 33+ messages in thread From: Ian Eure @ 2024-07-17 3:06 UTC (permalink / raw) To: 71832; +Cc: Ian Eure * gnu/packages/nss.scm (nss-rapid): New variable. Change-Id: I2bdd2119fb0c857feae9eb2e47a28909b8228cd7 --- gnu/packages/nss.scm | 80 ++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 74 insertions(+), 6 deletions(-) diff --git a/gnu/packages/nss.scm b/gnu/packages/nss.scm index d558079f44..33ebabc829 100644 --- a/gnu/packages/nss.scm +++ b/gnu/packages/nss.scm @@ -106,6 +106,9 @@ (define-public nspr-4.32 (base32 "0v3zds1id71j5a5si42a658fjz8nv2f6zp6w4gqrqmdr6ksz8sxv")))))) +;; nss should track ESRs, but currently doesn't. When the next ESR it out, it +;; should get updated. + (define-public nss (package (name "nss") @@ -153,13 +156,13 @@ (define-public nss ;; Ensure we are building for the (%current-target-system). #$@(if (%current-target-system) #~((string-append - "OS_TEST=" - (string-take #$(%current-target-system) - (string-index #$(%current-target-system) #\-))) + "OS_TEST=" + (string-take #$(%current-target-system) + (string-index #$(%current-target-system) #\-))) (string-append - "KERNEL=" (cond (#$(target-hurd?) "gnu") - (#$(target-linux?) "linux") - (else "")))) + "KERNEL=" (cond (#$(target-hurd?) "gnu") + (#$(target-linux?) "linux") + (else "")))) #~()) #$@(if (%current-target-system) #~("CROSS_COMPILE=1") @@ -303,6 +306,71 @@ (define-public nss/fixed (invoke "faketime" "2024-01-23" "./nss/tests/all.sh")) (format #t "test suite not run~%")))))))))))) +;; nss-rapid tracks the rapid release channel. Unless your package requires a +;; newer version, you should prefer the `nss' package, which tracks the ESR +;; channel. +;; +;; See https://wiki.mozilla.org/NSS:Release_Versions +;; and https://wiki.mozilla.org/Rapid_Release_Model + +(define-public nss-rapid + (package + (inherit nss) + (name "nss-rapid") + (version "3.102") + (source (origin + (inherit (package-source nss)) + (uri (let ((version-with-underscores + (string-join (string-split version #\.) "_"))) + (string-append + "https://ftp.mozilla.org/pub/mozilla.org/security/nss/" + "releases/NSS_" version-with-underscores "_RTM/src/" + "nss-" version ".tar.gz"))) + (sha256 + (base32 + "0yrhrgk6050ilnmhpxpknlkpqh56rizp7pmw9yiiinsn93r076y2")))) + (arguments + (substitute-keyword-arguments (package-arguments nss) + ((#:phases phases) + #~(modify-phases #$phases + (replace 'check + (lambda* (#:key tests? #:allow-other-keys) + (if tests? + (begin + ;; Use 127.0.0.1 instead of $HOST.$DOMSUF as HOSTADDR for + ;; testing. The latter requires a working DNS or /etc/hosts. + (setenv "DOMSUF" "localdomain") + (setenv "USE_IP" "TRUE") + (setenv "IP_ADDRESS" "127.0.0.1") + + ;; This specific test is looking at performance "now + ;; verify that we can quickly dump a database", and + ;; we're not testing performance here (especially + ;; since we're using faketime), so raise the + ;; threshold + (substitute* "nss/tests/dbtests/dbtests.sh" + ((" -lt 5") " -lt 50")) + + ;; Since the test suite is very lengthy, run the test + ;; suite once, not thrice as done by default, by + ;; selecting only the 'standard' cycle. + (setenv "NSS_CYCLES" "standard") + + ;; The "PayPalEE.cert" certificate expires every six months, + ;; leading to test failures: + ;; <https://bugzilla.mozilla.org/show_bug.cgi?id=609734>. To + ;; work around that, set the time to roughly the release date. + (invoke "faketime" "2024-01-23" "./nss/tests/all.sh")) + (format #t "test suite not run~%")))))))) + (synopsis "Network Security Services (Rapid Release)") + (description + "Network Security Services (@dfn{NSS}) is a set of libraries designed to +support cross-platform development of security-enabled client and server +applications. Applications built with NSS can support SSL v2 and v3, TLS, +PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other +security standards. + +This package tracks the Rapid Release channel, which updates frequently."))) (define-public nsncd (package (name "nsncd") -- 2.45.2 ^ permalink raw reply related [flat|nested] 33+ messages in thread
* [bug#71832] [PATCH v4 2/3] gnu: gnuzilla: Add skr to all-mozilla-locales. 2024-07-17 3:06 ` [bug#71832] [PATCH v4 0/3] Add nss-rapid; update Librewolf to 128.0-2 Ian Eure 2024-07-17 3:06 ` [bug#71832] [PATCH v4 1/3] gnu: Add nss-rapid Ian Eure @ 2024-07-17 3:06 ` Ian Eure 2024-07-17 3:06 ` [bug#71832] [PATCH v4 3/3] gnu: librewolf: Update to 128.0-2 Ian Eure 2 siblings, 0 replies; 33+ messages in thread From: Ian Eure @ 2024-07-17 3:06 UTC (permalink / raw) To: 71832; +Cc: Ian Eure * (gnuzilla): Add skr to all-mozilla-locales. Change-Id: If996048792a53dffb55b7e16e69370dd72fc78e3 --- gnu/packages/gnuzilla.scm | 1 + 1 file changed, 1 insertion(+) diff --git a/gnu/packages/gnuzilla.scm b/gnu/packages/gnuzilla.scm index 3e7818ba43..98dd67a5dd 100644 --- a/gnu/packages/gnuzilla.scm +++ b/gnu/packages/gnuzilla.scm @@ -508,6 +508,7 @@ (define-public all-mozilla-locales ("0xndsph4v725q3xcpmxxjb9vxv19sssqnng82m9215cdsv9klgpb" "bf5f6e362f6f" "sco") ("0l70n8817mbmbc09fsnn2aqjj9k9dhad2gmzgphmiilf9mqm2dpf" "1f705c926a99" "si") ("19bqjazazww08chd1qc08dsnr2521088jq5jd4j3185yb1ypm3nr" "c1bd10d70325" "sk") + ("12q1nv6z4bk8yaw3vhl9xs41i7kpx1415mwg635v76fx8h94ycl3" "00eaf8d9e83b" "skr") ("11nmjmy2j249588ahg4mh9lxdqr476jbh28a07qxxibfa76j9vk3" "44be3cbf69b6" "sl") ("1ww35141nixg2s03kfmmq9fk6m3qiz2vg7p5a85shjp7i89pyj1d" "800576ff8ef9" "son") ("1q7nfybwc8mxdwi9fpvfhayq18mykzygkpakr5ngfz2316k8lf5r" "4de8638ac27f" "sq") -- 2.45.2 ^ permalink raw reply related [flat|nested] 33+ messages in thread
* [bug#71832] [PATCH v4 3/3] gnu: librewolf: Update to 128.0-2 2024-07-17 3:06 ` [bug#71832] [PATCH v4 0/3] Add nss-rapid; update Librewolf to 128.0-2 Ian Eure 2024-07-17 3:06 ` [bug#71832] [PATCH v4 1/3] gnu: Add nss-rapid Ian Eure 2024-07-17 3:06 ` [bug#71832] [PATCH v4 2/3] gnu: gnuzilla: Add skr to all-mozilla-locales Ian Eure @ 2024-07-17 3:06 ` Ian Eure 2 siblings, 0 replies; 33+ messages in thread From: Ian Eure @ 2024-07-17 3:06 UTC (permalink / raw) To: 71832; +Cc: Ian Eure * gnu/packages/librewolf.scm (librewolf): Update to 128.0-2. Reorganize module to improve usability and reduce duplication. The Rust package and build ID are now at the top of the file. The librewolf-source variable has been replaced with the make-librewolf-source procedure, centralizing versions & hashes in the librewolf package definition. Dedent some of the package’s arguments to improve readability. Change-Id: I15f8a2aa1fae07e0497ab5511d10af0c1f70cc2e Change-Id: I6282c62937d7f59c0d0e5521c8d35f35df58982b --- gnu/packages/librewolf.scm | 1049 ++++++++++++++++++------------------ 1 file changed, 528 insertions(+), 521 deletions(-) diff --git a/gnu/packages/librewolf.scm b/gnu/packages/librewolf.scm index 3e46477724..5e5988860a 100644 --- a/gnu/packages/librewolf.scm +++ b/gnu/packages/librewolf.scm @@ -94,6 +94,18 @@ (define-module (gnu packages librewolf) #:use-module (gnu packages xdisorg) #:use-module (gnu packages xorg)) +;; Define the versions of rust needed to build librewolf, trying to match +;; upstream. See the file taskcluster/kinds/toolchain/rust.yml at +;; https://searchfox.org under the particular firefox release, like +;; mozilla-esr102. +;; 1.75 is the default in Guix, 1.77 is the minimum for Librewolf. +(define rust-librewolf rust-1.77) + +;; Update this id with every update to its release date. +;; It's used for cache validation and therefore can lead to strange bugs. +;; ex: date '+%Y%m%d%H%M%S' +(define %librewolf-build-id "20240626133423") + (define (firefox-source-origin version hash) (origin (method url-fetch) @@ -115,11 +127,14 @@ (define (librewolf-source-origin version hash) (define computed-origin-method (@@ (guix packages) computed-origin-method)) -(define librewolf-source - (let* ((ff-src (firefox-source-origin "126.0.1" "0fr679rcwshwpfxidc55b2xsn4pmrr7p9ix4rr2mv2k7kwsjcc7n")) - (version "126.0.1-1") - (lw-src (librewolf-source-origin version "0cac80073vkzd85ai9rbnwixs1h9bpy4dj2ri6jxdlqsy5d663km"))) - +(define* (make-librewolf-source version #:key firefox-hash librewolf-hash) + (let* ((ff-src (firefox-source-origin + (car (string-split version #\-)) + firefox-hash)) + (version version) + (lw-src (librewolf-source-origin + version + librewolf-hash))) (origin (method computed-origin-method) (file-name (string-append "librewolf-" version ".source.tar.gz")) @@ -163,11 +178,6 @@ (define librewolf-source (("^ff_source_tarball:=.*") (string-append "ff_source_tarball:=" #+ff-src))) - ;; Remove encoding_rs patch, it doesn't build with Rust 1.75. - (substitute* '("assets/patches.txt") - (("patches/encoding_rs.patch\\\n$") - "")) - ;; Stage locales. (begin (format #t "Staging locales...~%") @@ -205,526 +215,523 @@ (define librewolf-source ".source.tar.gz") #$output)))))))) -;; Define the versions of rust needed to build librewolf, trying to match -;; upstream. See the file taskcluster/ci/toolchain/rust.yml at -;; https://searchfox.org under the particular firefox release, like -;; mozilla-esr102. -(define rust-librewolf rust) ; 1.75 is the default in Guix, 1.65 is the minimum. - -;; Update this id with every update to its release date. -;; It's used for cache validation and therefore can lead to strange bugs. -;; ex: date '+%Y%m%d%H%M%S' -(define %librewolf-build-id "20240607212143") - (define-public librewolf - (package - (name "librewolf") - (version "126.0.1-1") - (source librewolf-source) - (build-system gnu-build-system) - (arguments - (list - #:configure-flags #~(let ((clang #$(this-package-native-input "clang"))) - `("--enable-application=browser" - - ;; Configuration - "--without-wasm-sandboxed-libraries" - "--with-system-jpeg" - "--with-system-zlib" - "--with-system-png" - "--with-system-webp" - "--with-system-icu" - "--with-system-libvpx" - "--with-system-libevent" - "--with-system-ffi" - "--enable-system-pixman" - "--enable-jemalloc" - - ;; see https://bugs.gnu.org/32833 - "--with-system-nspr" - "--with-system-nss" - - ,(string-append "--with-clang-path=" clang - "/bin/clang") - ,(string-append "--with-libclang-path=" clang - "/lib") - - ;; Distribution - "--with-distribution-id=org.guix" - "--with-app-name=librewolf" - "--with-app-basename=LibreWolf" - "--with-branding=browser/branding/librewolf" - - ;; Features - "--disable-tests" - "--disable-updater" - "--enable-pulseaudio" - "--disable-crashreporter" - "--allow-addon-sideload" - "--with-unsigned-addon-scopes=app,system" - - ;; switch only available on x86, whereas EME - ;; is not supported on other targets - ,@(if #$(target-x86?) '("--disable-eme") '()) - - ;; Build details - "--disable-debug" - "--enable-rust-simd" - "--enable-release" - "--enable-optimize" - "--enable-strip" - "--enable-hardening" - "--disable-elf-hack")) - #:imported-modules %cargo-utils-modules - #:modules `((ice-9 regex) - (ice-9 string-fun) - (ice-9 ftw) - (srfi srfi-1) - (srfi srfi-26) - (rnrs bytevectors) - (rnrs io ports) - (guix elf) - (guix build gremlin) - ,@%gnu-build-system-modules) - #:phases #~(modify-phases %standard-phases - (add-after 'unpack 'fix-preferences - (lambda* (#:key inputs #:allow-other-keys) - (let ((port (open-file "browser/app/profile/firefox.js" - "a"))) - (define (write-setting key value) - (format port "~%pref(\"~a\", ~a);~%" key value) - (format #t + (let ((version "128.0-2")) + (package + (name "librewolf") + (version version) + (source (make-librewolf-source + version + #:firefox-hash + "0wjiz7pahsqj7ibkyq9gggigq1hg983z50d0cbhs2pi3zgz1y9v5" + #:librewolf-hash + "0239m5r5nfn291slpxh1qhj3g3q2pskyp967ahvn7nbsqlvjyhag")) + + (build-system gnu-build-system) + (arguments + (list + #:configure-flags + #~(let ((clang #$(this-package-native-input "clang"))) + `("--enable-application=browser" + + ;; Configuration + "--without-wasm-sandboxed-libraries" + "--with-system-jpeg" + "--with-system-zlib" + "--with-system-png" + "--with-system-webp" + "--with-system-icu" + "--with-system-libvpx" + "--with-system-libevent" + "--with-system-ffi" + "--enable-system-pixman" + "--enable-jemalloc" + + ;; see https://bugs.gnu.org/32833 + "--with-system-nspr" + "--with-system-nss" + + ,(string-append "--with-clang-path=" clang + "/bin/clang") + ,(string-append "--with-libclang-path=" clang + "/lib") + + ;; Distribution + "--with-distribution-id=org.guix" + "--with-app-name=librewolf" + "--with-app-basename=LibreWolf" + "--with-branding=browser/branding/librewolf" + + ;; Features + "--disable-tests" + "--disable-updater" + "--enable-pulseaudio" + "--disable-crashreporter" + "--allow-addon-sideload" + "--with-unsigned-addon-scopes=app,system" + ;; switch only available on x86, whereas EME + ;; is not supported on other targets + ,@(if #$(target-x86?) '("--disable-eme") '()) + + ;; Build details + "--disable-debug" + "--enable-rust-simd" + "--enable-release" + "--enable-optimize" + "--enable-strip" + "--enable-hardening" + "--disable-elf-hack")) + #:imported-modules %cargo-utils-modules + #:modules `((ice-9 regex) + (ice-9 string-fun) + (ice-9 ftw) + (srfi srfi-1) + (srfi srfi-26) + (rnrs bytevectors) + (rnrs io ports) + (guix elf) + (guix build gremlin) + ,@%gnu-build-system-modules) + #:phases + #~(modify-phases %standard-phases + (add-after 'unpack 'fix-preferences + (lambda* (#:key inputs #:allow-other-keys) + (let ((port (open-file "browser/app/profile/firefox.js" + "a"))) + (define (write-setting key value) + (format port "~%pref(\"~a\", ~a);~%" key value) + (format #t "fix-preferences: setting value of ~a to ~a~%" key value)) - ;; We should allow the sandbox to read the store directory, - ;; because the sandbox has access to /usr on FHS distros. - (write-setting - "security.sandbox.content.read_path_whitelist" - (string-append "\"" - (%store-directory) "/\"")) - - ;; XDG settings should be managed by Guix. - (write-setting "browser.shell.checkDefaultBrowser" - "false") - (close-port port)))) - (add-after 'fix-preferences 'fix-ffmpeg-runtime-linker - (lambda* (#:key inputs #:allow-other-keys) - (let* ((ffmpeg (assoc-ref inputs "ffmpeg")) - (libavcodec (string-append ffmpeg - "/lib/libavcodec.so"))) - ;; Arrange to load libavcodec.so by its absolute file name. - (substitute* "dom/media/platforms/ffmpeg/FFmpegRuntimeLinker.cpp" - (("libavcodec\\.so") - libavcodec))))) - (add-after 'patch-source-shebangs 'patch-cargo-checksums - (lambda _ - (use-modules (guix build cargo-utils)) - (let ((null-hash - ;; This is the SHA256 output of an empty string. - (string-append - "e3b0c44298fc1c149afbf4c8996fb924" - "27ae41e4649b934ca495991b7852b855"))) - (for-each (lambda (file) - (format #t + ;; We should allow the sandbox to read the store directory, + ;; because the sandbox has access to /usr on FHS distros. + (write-setting + "security.sandbox.content.read_path_whitelist" + (string-append "\"" + (%store-directory) "/\"")) + + ;; XDG settings should be managed by Guix. + (write-setting "browser.shell.checkDefaultBrowser" + "false") + (close-port port)))) + (add-after 'fix-preferences 'fix-ffmpeg-runtime-linker + (lambda* (#:key inputs #:allow-other-keys) + (let* ((ffmpeg (assoc-ref inputs "ffmpeg")) + (libavcodec (string-append ffmpeg + "/lib/libavcodec.so"))) + ;; Arrange to load libavcodec.so by its absolute file name. + (substitute* "dom/media/platforms/ffmpeg/FFmpegRuntimeLinker.cpp" + (("libavcodec\\.so") + libavcodec))))) + (add-after 'patch-source-shebangs 'patch-cargo-checksums + (lambda _ + (use-modules (guix build cargo-utils)) + (let ((null-hash + ;; This is the SHA256 output of an empty string. + (string-append + "e3b0c44298fc1c149afbf4c8996fb924" + "27ae41e4649b934ca495991b7852b855"))) + (for-each (lambda (file) + (format #t "patch-cargo-checksums: patching checksums in ~a~%" file) - (substitute* file - (("(checksum = )\".*\"" all name) - (string-append name "\"" null-hash - "\"")))) - (find-files "." "Cargo\\.lock$")) - (for-each generate-all-checksums - '("build" - "dom/media" - "dom/webauthn" - "gfx" - "intl" - "js" - "media" - "modules" - "mozglue/static/rust" - "netwerk" - "remote" - "security/manager/ssl" - "servo" - "storage" - "third_party/rust" - "toolkit" - "xpcom/rust" - "services"))))) - (add-after 'patch-cargo-checksums 'remove-cargo-frozen-flag - (lambda _ - ;; Remove --frozen flag from cargo invokation, otherwise it'll - ;; complain that it's not able to change Cargo.lock. - ;; https://bugzilla.mozilla.org/show_bug.cgi?id=1726373 - (substitute* "build/RunCbindgen.py" - (("args.append\\(\"--frozen\"\\)") "pass")))) - (delete 'bootstrap) - (add-before 'configure 'patch-SpeechDispatcherService.cpp - (lambda _ - (let* ((lib "libspeechd.so.2") - (file (string-append - "dom/media/webspeech/synth/" - "speechd/SpeechDispatcherService.cpp")) - (old-content (call-with-input-file file - get-string-all))) - (substitute - file - `((,(format #f "~s" lib) unquote - (lambda (line _) - (string-replace-substring - line lib - (string-append #$speech-dispatcher - "/lib/" lib)))))) - (if (string=? old-content - (call-with-input-file file - get-string-all)) - (error - "substitute did nothing, phase requires an update"))))) - (add-before 'configure 'set-build-id - ;; Build will write the timestamp to output, which is harmful - ;; for reproducibility, so change it to a fixed date. Use a - ;; separate phase for easier modification with inherit. - (lambda _ - (setenv "MOZ_BUILD_DATE" - #$%librewolf-build-id))) - (replace 'configure - (lambda* (#:key inputs outputs configure-flags - #:allow-other-keys) - (setenv "AUTOCONF" - (string-append (assoc-ref inputs "autoconf") - "/bin/autoconf")) - (setenv "SHELL" - (which "bash")) - (setenv "CONFIG_SHELL" - (which "bash")) - (setenv "MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE" - "system") - ;; This should use the host info probably (does it - ;; build on non-x86_64 though?) - (setenv "GUIX_PYTHONPATH" - (string-append (getcwd) - "/obj-x86_64-pc-linux-gnu/_virtualenvs/build")) - - ;; Use Clang, Clang is 2x faster than GCC - (setenv "AR" "llvm-ar") - (setenv "NM" "llvm-nm") - (setenv "CC" "clang") - (setenv "CXX" "clang++") - (setenv "MOZ_NOSPAM" "1") - (setenv "MOZ_APP_NAME" "librewolf") - - (setenv "MOZBUILD_STATE_PATH" - (getcwd)) - - (let* ((mozconfig (string-append (getcwd) "/mozconfig")) - (out (assoc-ref outputs "out")) - (flags (cons (string-append "--prefix=" out) - configure-flags))) - (format #t "build directory: ~s~%" - (getcwd)) - (format #t "configure flags: ~s~%" flags) - - (define write-flags - (lambda flags - (display (string-join (map (cut string-append - "ac_add_options " <>) - flags) "\n")) - (display "\n"))) - (with-output-to-file mozconfig - (lambda () - (apply write-flags flags) - ;; The following option unsets Telemetry - ;; Reporting. With the Addons Fiasco, - ;; Mozilla was found to be collecting - ;; user's data, including saved passwords - ;; and web form data, without users - ;; consent. Mozilla was also found - ;; shipping updates to systems without - ;; the user's knowledge or permission. - ;; As a result of this, use the following - ;; command to permanently disable - ;; telemetry reporting. - (display "unset MOZ_TELEMETRY_REPORTING\n") - (display "mk_add_options MOZ_CRASHREPORTER=0\n") - (display "mk_add_options MOZ_DATA_REPORTING=0\n") - (display - "mk_add_options MOZ_SERVICES_HEALTHREPORT=0") - (display - "mk_add_options MOZ_TELEMETRY_REPORTING=0"))) - (setenv "MOZCONFIG" mozconfig)) - (invoke "./mach" "configure"))) - (add-before 'build 'fix-addons-placeholder - (lambda _ - (substitute* "toolkit/locales/en-US/toolkit/about/aboutAddons.ftl" - (("addons.mozilla.org") - "gnuzilla.gnu.org")))) - (replace 'build - (lambda* (#:key (make-flags '()) - (parallel-build? #t) #:allow-other-keys) - (apply invoke "./mach" "build" - ;; mach will use parallel build if possible by default - `(,@(if parallel-build? - '() - '("-j1")) ,@make-flags)))) - (add-after 'build 'neutralise-store-references - (lambda _ - ;; Mangle the store references to compilers & - ;; other build tools in about:buildconfig, - ;; reducing the package's closure by 1 GiB on - ;; x86-64. - (let* ((build-dir (car (scandir "." - (cut string-prefix? - "obj-" <>)))) - (file (string-append build-dir - "/dist/bin/chrome/toolkit/" - "content/global/buildconfig.html"))) - (substitute* file - (((format #f "(~a/)([0-9a-df-np-sv-z]{32})" - (regexp-quote (%store-directory))) - _ store hash) - (string-append store - (string-take hash 8) - "<!-- Guix: not a runtime dependency -->" - (string-drop hash 8))))))) - (replace 'install - (lambda _ - (invoke "./mach" "install"))) - (add-after 'install 'remove-duplicate-bin - (lambda* (#:key outputs #:allow-other-keys) - (delete-file (string-append #$output - "/lib/librewolf/librewolf-bin")))) - (add-after 'install 'wrap-glxtest - ;; glxtest uses dlopen() to load mesa and pci - ;; libs, wrap it to set LD_LIBRARY_PATH. - (lambda* (#:key inputs outputs #:allow-other-keys) - (let* ((out (assoc-ref outputs "out")) - (lib (string-append out "/lib")) - (libs (map - (lambda (lib-name) - (string-append (assoc-ref inputs - lib-name) - "/lib")) - '("mesa" "pciutils")))) - (wrap-program (car (find-files lib "^glxtest$")) - `("LD_LIBRARY_PATH" prefix ,libs))))) - (add-after 'install 'patch-config - (lambda* (#:key inputs #:allow-other-keys) - (let ((lib (string-append #$output "/lib/librewolf")) - (config-file "librewolf.cfg")) - - ;; Required for Guix packaged extensions - ;; SCOPE_PROFILE=1, SCOPE_APPLICATION=4, SCOPE_SYSTEM=8 - ;; Default is 5. - (substitute* (in-vicinity lib config-file) - (("defaultPref\\(\"extensions.enabledScopes\", 5\\)") - "defaultPref(\"extensions.enabledScopes\", 13)")) - ;; Use Mozzarella addons repo. - (call-with-port - (open-file - (in-vicinity lib config-file) - "a") - (lambda (port) - ;; Add-ons panel (see settings.js in Icecat source). - (for-each - (lambda (pref) - (format port - "defaultPref(~s, ~s);~%" - (car pref) - (cdr pref))) - `(("extensions.getAddons.search.browseURL" - ,(string-append - "https://gnuzilla.gnu.org/mozzarella/" - "search.php?q=%TERMS%")) - ("extensions.getAddons.get.url" . - "https://gnuzilla.gnu.org/mozzarella") - ("extensions.getAddons.link.url" . - "https://gnuzilla.gnu.org/mozzarella") - ("extensions.getAddons.discovery.api_url" . - "https://gnuzilla.gnu.org/mozzarella") - ("extensions.getAddons.langpacks.url" . - "https://gnuzilla.gnu.org/mozzarella") - ("lightweightThemes.getMoreURL" . - "https://gnuzilla.gnu.org/mozzarella")))))))) - (add-after 'install 'wrap-program - (lambda* (#:key inputs outputs #:allow-other-keys) - ;; The following two functions are from Guix's icecat package in - ;; (gnu packages gnuzilla). See commit - ;; b7a0935420ee630a29b7e5ac73a32ba1eb24f00b. - (define (runpath-of lib) - (call-with-input-file lib - (compose elf-dynamic-info-runpath elf-dynamic-info - parse-elf get-bytevector-all))) - (define (runpaths-of-input label) - (let* ((dir (string-append (assoc-ref inputs label) - "/lib")) - (libs (find-files dir "\\.so$"))) - (append-map runpath-of libs))) - (let* ((out (assoc-ref outputs "out")) - (lib (string-append out "/lib")) - (libs (map - (lambda (lib-name) - (string-append (assoc-ref inputs - lib-name) - "/lib")) - '("mesa" "libpng-apng" "libnotify" "libva" - "pulseaudio" "gtk+" "pipewire" - ;; For U2F and WebAuthn - "eudev"))) - - ;; VA-API is run in the RDD (Remote Data Decoder) sandbox - ;; and must be explicitly given access to files it needs. - ;; Rather than adding the whole store (as Nix had - ;; upstream do, see - ;; <https://github.com/NixOS/nixpkgs/pull/165964> and - ;; linked upstream patches), we can just follow the - ;; runpaths of the needed libraries to add everything to - ;; LD_LIBRARY_PATH. These will then be accessible in the - ;; RDD sandbox. - (rdd-whitelist (map (cut string-append <> "/") - (delete-duplicates (append-map - runpaths-of-input - '("mesa" - "ffmpeg"))))) - (gtk-share (string-append (assoc-ref inputs - "gtk+") - "/share"))) - (wrap-program (car (find-files lib "^librewolf$")) - `("LD_LIBRARY_PATH" prefix - (,@libs ,@rdd-whitelist)) - `("XDG_DATA_DIRS" prefix - (,gtk-share)) - `("MOZ_LEGACY_PROFILES" = - ("1")) - `("MOZ_ALLOW_DOWNGRADE" = - ("1")))))) - (add-after 'wrap-program 'install-desktop-entry - (lambda* (#:key outputs #:allow-other-keys) - (let* ((desktop-file - "taskcluster/docker/firefox-snap/firefox.desktop") - (applications (string-append #$output - "/share/applications"))) - (substitute* desktop-file - (("^Exec=firefox") - (string-append "Exec=" - #$output "/bin/librewolf")) - ;; "Firefox" -> "LibreWolf" everywhere - (("Firefox") - "LibreWolf") - ;; Remove non-Latin translations. - (("^Name\\[(ar|bn)\\].*$") - "") - (("^Icon=.*") - (string-append "Icon=" - #$output - "/share/icons/hicolor/128x128/apps/librewolf.png + (substitute* file + (("(checksum = )\".*\"" all name) + (string-append name "\"" null-hash + "\"")))) + (find-files "." "Cargo\\.lock$")) + (for-each generate-all-checksums + '("build" + "dom/media" + "dom/webauthn" + "gfx" + "intl" + "js" + "media" + "modules" + "mozglue/static/rust" + "netwerk" + "remote" + "security/manager/ssl" + "servo" + "storage" + "third_party/rust" + "toolkit" + "xpcom/rust" + "services"))))) + (add-after 'patch-cargo-checksums 'remove-cargo-frozen-flag + (lambda _ + ;; Remove --frozen flag from cargo invokation, otherwise it'll + ;; complain that it's not able to change Cargo.lock. + ;; https://bugzilla.mozilla.org/show_bug.cgi?id=1726373 + (substitute* "build/RunCbindgen.py" + (("args.append\\(\"--frozen\"\\)") "pass")))) + (delete 'bootstrap) + (add-before 'configure 'patch-SpeechDispatcherService.cpp + (lambda _ + (let* ((lib "libspeechd.so.2") + (file (string-append + "dom/media/webspeech/synth/" + "speechd/SpeechDispatcherService.cpp")) + (old-content (call-with-input-file file + get-string-all))) + (substitute + file + `((,(format #f "~s" lib) unquote + (lambda (line _) + (string-replace-substring + line lib + (string-append #$speech-dispatcher + "/lib/" lib)))))) + (if (string=? old-content + (call-with-input-file file + get-string-all)) + (error + "substitute did nothing, phase requires an update"))))) + (add-before 'configure 'set-build-id + ;; Build will write the timestamp to output, which is harmful + ;; for reproducibility, so change it to a fixed date. Use a + ;; separate phase for easier modification with inherit. + (lambda _ + (setenv "MOZ_BUILD_DATE" + #$%librewolf-build-id))) + (replace 'configure + (lambda* (#:key inputs outputs configure-flags + #:allow-other-keys) + (setenv "AUTOCONF" + (string-append (assoc-ref inputs "autoconf") + "/bin/autoconf")) + (setenv "SHELL" + (which "bash")) + (setenv "CONFIG_SHELL" + (which "bash")) + (setenv "MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE" + "system") + ;; This should use the host info probably (does it + ;; build on non-x86_64 though?) + (setenv "GUIX_PYTHONPATH" + (string-append (getcwd) + "/obj-x86_64-pc-linux-gnu/_virtualenvs/build")) + + ;; Use Clang, Clang is 2x faster than GCC + (setenv "AR" "llvm-ar") + (setenv "NM" "llvm-nm") + (setenv "CC" "clang") + (setenv "CXX" "clang++") + (setenv "MOZ_NOSPAM" "1") + (setenv "MOZ_APP_NAME" "librewolf") + + (setenv "MOZBUILD_STATE_PATH" + (getcwd)) + + (let* ((mozconfig (string-append (getcwd) "/mozconfig")) + (out (assoc-ref outputs "out")) + (flags (cons (string-append "--prefix=" out) + configure-flags))) + (format #t "build directory: ~s~%" + (getcwd)) + (format #t "configure flags: ~s~%" flags) + + (define write-flags + (lambda flags + (display (string-join (map (cut string-append + "ac_add_options " <>) + flags) "\n")) + (display "\n"))) + (with-output-to-file mozconfig + (lambda () + (apply write-flags flags) + ;; The following option unsets Telemetry + ;; Reporting. With the Addons Fiasco, + ;; Mozilla was found to be collecting + ;; user's data, including saved passwords + ;; and web form data, without users + ;; consent. Mozilla was also found + ;; shipping updates to systems without + ;; the user's knowledge or permission. + ;; As a result of this, use the following + ;; command to permanently disable + ;; telemetry reporting. + (display "unset MOZ_TELEMETRY_REPORTING\n") + (display "mk_add_options MOZ_CRASHREPORTER=0\n") + (display "mk_add_options MOZ_DATA_REPORTING=0\n") + (display + "mk_add_options MOZ_SERVICES_HEALTHREPORT=0") + (display + "mk_add_options MOZ_TELEMETRY_REPORTING=0"))) + (setenv "MOZCONFIG" mozconfig)) + (invoke "./mach" "configure"))) + (add-before 'build 'fix-addons-placeholder + (lambda _ + (substitute* "toolkit/locales/en-US/toolkit/about/aboutAddons.ftl" + (("addons.mozilla.org") + "gnuzilla.gnu.org")))) + (replace 'build + (lambda* (#:key (make-flags '()) + (parallel-build? #t) #:allow-other-keys) + (apply invoke "./mach" "build" + ;; mach will use parallel build if possible by default + `(,@(if parallel-build? + '() + '("-j1")) ,@make-flags)))) + (add-after 'build 'neutralise-store-references + (lambda _ + ;; Mangle the store references to compilers & + ;; other build tools in about:buildconfig, + ;; reducing the package's closure by 1 GiB on + ;; x86-64. + (let* ((build-dir (car (scandir "." + (cut string-prefix? + "obj-" <>)))) + (file (string-append build-dir + "/dist/bin/chrome/toolkit/" + "content/global/buildconfig.html"))) + (substitute* file + (((format #f "(~a/)([0-9a-df-np-sv-z]{32})" + (regexp-quote (%store-directory))) + _ store hash) + (string-append store + (string-take hash 8) + "<!-- Guix: not a runtime dependency -->" + (string-drop hash 8))))))) + (replace 'install + (lambda _ + (invoke "./mach" "install"))) + (add-after 'install 'remove-duplicate-bin + (lambda* (#:key outputs #:allow-other-keys) + (delete-file (string-append #$output + "/lib/librewolf/librewolf-bin")))) + (add-after 'install 'wrap-glxtest + ;; glxtest uses dlopen() to load mesa and pci + ;; libs, wrap it to set LD_LIBRARY_PATH. + (lambda* (#:key inputs outputs #:allow-other-keys) + (let* ((out (assoc-ref outputs "out")) + (lib (string-append out "/lib")) + (libs (map + (lambda (lib-name) + (string-append (assoc-ref inputs + lib-name) + "/lib")) + '("mesa" "pciutils")))) + (wrap-program (car (find-files lib "^glxtest$")) + `("LD_LIBRARY_PATH" prefix ,libs))))) + (add-after 'install 'patch-config + (lambda* (#:key inputs #:allow-other-keys) + (let ((lib (string-append #$output "/lib/librewolf")) + (config-file "librewolf.cfg")) + + ;; Required for Guix packaged extensions + ;; SCOPE_PROFILE=1, SCOPE_APPLICATION=4, SCOPE_SYSTEM=8 + ;; Default is 5. + (substitute* (in-vicinity lib config-file) + (("defaultPref\\(\"extensions.enabledScopes\", 5\\)") + "defaultPref(\"extensions.enabledScopes\", 13)")) + ;; Use Mozzarella addons repo. + (call-with-port + (open-file + (in-vicinity lib config-file) + "a") + (lambda (port) + ;; Add-ons panel (see settings.js in Icecat source). + (for-each + (lambda (pref) + (format port + "defaultPref(~s, ~s);~%" + (car pref) + (cdr pref))) + `(("extensions.getAddons.search.browseURL" + ,(string-append + "https://gnuzilla.gnu.org/mozzarella/" + "search.php?q=%TERMS%")) + ("extensions.getAddons.get.url" . + "https://gnuzilla.gnu.org/mozzarella") + ("extensions.getAddons.link.url" . + "https://gnuzilla.gnu.org/mozzarella") + ("extensions.getAddons.discovery.api_url" . + "https://gnuzilla.gnu.org/mozzarella") + ("extensions.getAddons.langpacks.url" . + "https://gnuzilla.gnu.org/mozzarella") + ("lightweightThemes.getMoreURL" . + "https://gnuzilla.gnu.org/mozzarella")))))))) + (add-after 'install 'wrap-program + (lambda* (#:key inputs outputs #:allow-other-keys) + ;; The following two functions are from Guix's icecat package in + ;; (gnu packages gnuzilla). See commit + ;; b7a0935420ee630a29b7e5ac73a32ba1eb24f00b. + (define (runpath-of lib) + (call-with-input-file lib + (compose elf-dynamic-info-runpath elf-dynamic-info + parse-elf get-bytevector-all))) + (define (runpaths-of-input label) + (let* ((dir (string-append (assoc-ref inputs label) + "/lib")) + (libs (find-files dir "\\.so$"))) + (append-map runpath-of libs))) + (let* ((out (assoc-ref outputs "out")) + (lib (string-append out "/lib")) + (libs (map + (lambda (lib-name) + (string-append (assoc-ref inputs + lib-name) + "/lib")) + '("mesa" "libpng-apng" "libnotify" "libva" + "pulseaudio" "gtk+" "pipewire" + ;; For U2F and WebAuthn + "eudev"))) + + ;; VA-API is run in the RDD (Remote Data Decoder) sandbox + ;; and must be explicitly given access to files it needs. + ;; Rather than adding the whole store (as Nix had + ;; upstream do, see + ;; <https://github.com/NixOS/nixpkgs/pull/165964> and + ;; linked upstream patches), we can just follow the + ;; runpaths of the needed libraries to add everything to + ;; LD_LIBRARY_PATH. These will then be accessible in the + ;; RDD sandbox. + (rdd-whitelist (map (cut string-append <> "/") + (delete-duplicates (append-map + runpaths-of-input + '("mesa" + "ffmpeg"))))) + (gtk-share (string-append (assoc-ref inputs + "gtk+") + "/share"))) + (wrap-program (car (find-files lib "^librewolf$")) + `("LD_LIBRARY_PATH" prefix + (,@libs ,@rdd-whitelist)) + `("XDG_DATA_DIRS" prefix + (,gtk-share)) + `("MOZ_LEGACY_PROFILES" = + ("1")) + `("MOZ_ALLOW_DOWNGRADE" = + ("1")))))) + (add-after 'wrap-program 'install-desktop-entry + (lambda* (#:key outputs #:allow-other-keys) + (let* ((desktop-file + "taskcluster/docker/firefox-snap/firefox.desktop") + (applications (string-append #$output + "/share/applications"))) + (substitute* desktop-file + (("^Exec=firefox") + (string-append "Exec=" + #$output "/bin/librewolf")) + ;; "Firefox" -> "LibreWolf" everywhere + (("Firefox") + "LibreWolf") + ;; Remove non-Latin translations. + (("^Name\\[(ar|bn)\\].*$") + "") + (("^Icon=.*") + (string-append "Icon=" + #$output + "/share/icons/hicolor/128x128/apps/librewolf.png ")) - ;; These commands were changed. - (("-NewWindow") - "-new-window") - (("-NewPrivateWindow") - "-new-private-window") - (("StartupNotify=true") - "StartupNotify=true + ;; These commands were changed. + (("-NewWindow") + "-new-window") + (("-NewPrivateWindow") + "-new-private-window") + (("StartupNotify=true") + "StartupNotify=true StartupWMClass=Navigator")) - (copy-file desktop-file "librewolf.desktop") - (install-file "librewolf.desktop" applications)))) - (add-after 'install-desktop-entry 'install-icons - (lambda* (#:key outputs #:allow-other-keys) - (let ((icon-source-dir (string-append #$output - "/lib/librewolf/browser/" - "chrome/icons/default"))) - (for-each (lambda (size) - (let ((dest (string-append #$output - "/share/icons/hicolor/" - size - "x" - size - "/apps"))) - (mkdir-p dest) - (symlink (string-append icon-source-dir - "/default" size ".png") - (string-append dest - "/librewolf.png")))) - '("16" "32" "48" "64" "128")))))) - - ;; Test will significantly increase build time but with little rewards. - #:tests? #f - - ;; WARNING: Parallel build will consume lots of memory! - ;; If you have encountered OOM issue in build phase, try disable it. - #:parallel-build? #t - - ;; Some dynamic lib was determined at runtime, so rpath check may fail. - #:validate-runpath? #f)) - (inputs (list bash-minimal - bzip2 - cairo - cups - dbus-glib - freetype - ffmpeg - gdk-pixbuf - glib - gtk+ - gtk+-2 - hunspell - icu4c-73 - jemalloc - libcanberra - libevent - libffi - libgnome - libjpeg-turbo - libnotify - libpng-apng - libva - libvpx - libwebp - libxcomposite - libxft - libxinerama - libxscrnsaver - libxt - mesa - mit-krb5 - nspr - nss/fixed - pango - pciutils - pipewire - pixman - pulseaudio - speech-dispatcher - sqlite - startup-notification - eudev - unzip - zip - zlib)) - (native-inputs (list alsa-lib - autoconf-2.13 - `(,rust-librewolf "cargo") - clang-18 - llvm-18 - m4 - nasm - node-lts - perl - pkg-config - python - rust-librewolf - rust-cbindgen-0.26 - which - yasm)) - (home-page "https://librewolf.net/") - (synopsis - "Custom version of Firefox, focused on privacy, security and freedom") - (description - "LibreWolf is designed to increase protection against tracking and + (copy-file desktop-file "librewolf.desktop") + (install-file "librewolf.desktop" applications)))) + (add-after 'install-desktop-entry 'install-icons + (lambda* (#:key outputs #:allow-other-keys) + (let ((icon-source-dir (string-append #$output + "/lib/librewolf/browser/" + "chrome/icons/default"))) + (for-each (lambda (size) + (let ((dest (string-append #$output + "/share/icons/hicolor/" + size + "x" + size + "/apps"))) + (mkdir-p dest) + (symlink (string-append icon-source-dir + "/default" size ".png") + (string-append dest + "/librewolf.png")))) + '("16" "32" "48" "64" "128")))))) + + ;; Test will significantly increase build time but with little rewards. + #:tests? #f + + ;; WARNING: Parallel build will consume lots of memory! + ;; If you have encountered OOM issue in build phase, try disable it. + #:parallel-build? #t + + ;; Some dynamic lib was determined at runtime, so rpath check may fail. + #:validate-runpath? #f)) + (inputs (list bash-minimal + bzip2 + cairo + cups + dbus-glib + freetype + ffmpeg + gdk-pixbuf + glib + gtk+ + gtk+-2 + hunspell + icu4c-73 + jemalloc + libcanberra + libevent + libffi + libgnome + libjpeg-turbo + libnotify + libpng-apng + libva + libvpx + libwebp + libxcomposite + libxft + libxinerama + libxscrnsaver + libxt + mesa + mit-krb5 + nspr + nss-rapid + pango + pciutils + pipewire + pixman + pulseaudio + speech-dispatcher + sqlite + startup-notification + eudev + unzip + zip + zlib)) + (native-inputs (list alsa-lib + autoconf-2.13 + `(,rust-librewolf "cargo") + clang-18 + llvm-18 + m4 + nasm + node-lts + perl + pkg-config + python + rust-librewolf + rust-cbindgen-0.26 + which + yasm)) + (home-page "https://librewolf.net/") + (synopsis + "Custom version of Firefox, focused on privacy, security and freedom") + (description + "LibreWolf is designed to increase protection against tracking and fingerprinting techniques, while also including a few security improvements. This is achieved through our privacy and security oriented settings and patches. LibreWolf also aims to remove all the telemetry, data collection and annoyances, as well as disabling anti-freedom features like DRM.") - (license license:mpl2.0))) + (license license:mpl2.0)))) -- 2.45.2 ^ permalink raw reply related [flat|nested] 33+ messages in thread
* [bug#71832] [PATCH 0/2] Add nss-latest; updte Librewolf to 127.0.2-2. 2024-06-29 3:57 [bug#71832] [PATCH 0/2] Add nss-latest; updte Librewolf to 127.0.2-2 Ian Eure ` (4 preceding siblings ...) 2024-07-17 3:06 ` [bug#71832] [PATCH v4 0/3] Add nss-rapid; update Librewolf to 128.0-2 Ian Eure @ 2024-07-21 16:17 ` Ian Eure 2024-07-31 3:54 ` [bug#71832] [PATCH v5 0/3] [SECURITY] Add nss-rapid; update Librewolf to 128.0.3-1 Ian Eure 2024-08-17 19:32 ` [bug#71832] [PATCH v6 0/3] [SECURITY] Update LibreWolf to 129.0.1-1; add nss-rapid Ian Eure 7 siblings, 0 replies; 33+ messages in thread From: Ian Eure @ 2024-07-21 16:17 UTC (permalink / raw) To: control; +Cc: 71832 retitle 71832 [PATCH v4 0/3] Add nss-rapid; update Librewolf to 128.0-2 thanks > Hello, > > I have pushed the patch of #71882 to fix the build on non-x86 > architectures. > I could still build on x86_64, but could still not build on > aarch64; but > the latter failure is probably due to a lack of memory (the > configure phase > passes now, but the build fails later on with a SIGKILL). > > As this means that the librewolf update of #71832 needs to be > rebased, > I am cc-ing this bug. > > Andreas Thank you, I’ve rebased and updated. Thanks, — Ian ^ permalink raw reply [flat|nested] 33+ messages in thread
* [bug#71832] [PATCH v5 0/3] [SECURITY] Add nss-rapid; update Librewolf to 128.0.3-1 2024-06-29 3:57 [bug#71832] [PATCH 0/2] Add nss-latest; updte Librewolf to 127.0.2-2 Ian Eure ` (5 preceding siblings ...) 2024-07-21 16:17 ` [bug#71832] [PATCH 0/2] Add nss-latest; updte Librewolf to 127.0.2-2 Ian Eure @ 2024-07-31 3:54 ` Ian Eure 2024-07-31 3:54 ` [bug#71832] [PATCH v5 1/3] gnu: Add nss-rapid Ian Eure ` (2 more replies) 2024-08-17 19:32 ` [bug#71832] [PATCH v6 0/3] [SECURITY] Update LibreWolf to 129.0.1-1; add nss-rapid Ian Eure 7 siblings, 3 replies; 33+ messages in thread From: Ian Eure @ 2024-07-31 3:54 UTC (permalink / raw) To: 71832; +Cc: control, Ian Eure retitle 71832 [PATCH v5 0/3] [SECURITY] Add nss-rapid; update Librewolf to 128.0.3-1 thanks New upstream versions of nss-rapid and LibreWolf. This contains security fixes for: CVE-2024-6605: Firefox Android missed activation delay to prevent tapjacking debugger eval code CVE-2024-6606: Out-of-bounds read in clipboard component debugger eval code CVE-2024-6607: Leaving pointerlock by pressing the escape key could be prevented debugger eval code CVE-2024-6608: Cursor could be moved out of the viewport using pointerlock. debugger eval code CVE-2024-6609: Memory corruption in NSS debugger eval code CVE-2024-6610: Form validation popups could block exiting full-screen mode debugger eval code CVE-2024-6600: Memory corruption in WebGL API debugger eval code CVE-2024-6601: Race condition in permission assignment debugger eval code CVE-2024-6602: Memory corruption in NSS debugger eval code CVE-2024-6603: Memory corruption in thread creation debugger eval code CVE-2024-6611: Incorrect handling of SameSite cookies debugger eval code CVE-2024-6612: CSP violation leakage when using devtools debugger eval code CVE-2024-6613: Incorrect listing of stack frames debugger eval code CVE-2024-6614: Incorrect listing of stack frames debugger eval code CVE-2024-6604: Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, Thunderbird 128, and Thunderbird 115.13 debugger eval code CVE-2024-6615: Memory safety bugs fixed in Firefox 128 and Thunderbird 128 This also includes a fix for the application icon not showing up in DEs. Ian Eure (3): gnu: Add nss-rapid. gnu: gnuzilla: Add skr to all-mozilla-locales. gnu: librewolf: Update to 128.0.3-1 gnu/packages/gnuzilla.scm | 1 + gnu/packages/librewolf.scm | 1054 ++++++++++++++++++------------------ gnu/packages/nss.scm | 80 ++- 3 files changed, 606 insertions(+), 529 deletions(-) -- 2.45.2 ^ permalink raw reply [flat|nested] 33+ messages in thread
* [bug#71832] [PATCH v5 1/3] gnu: Add nss-rapid. 2024-07-31 3:54 ` [bug#71832] [PATCH v5 0/3] [SECURITY] Add nss-rapid; update Librewolf to 128.0.3-1 Ian Eure @ 2024-07-31 3:54 ` Ian Eure 2024-07-31 3:55 ` [bug#71832] [PATCH v5 2/3] gnu: gnuzilla: Add skr to all-mozilla-locales Ian Eure 2024-07-31 3:55 ` [bug#71832] [PATCH v5 3/3] gnu: librewolf: Update to 128.0.3-1 Ian Eure 2 siblings, 0 replies; 33+ messages in thread From: Ian Eure @ 2024-07-31 3:54 UTC (permalink / raw) To: 71832; +Cc: Ian Eure * gnu/packages/nss.scm (nss-rapid): New variable. Change-Id: I2bdd2119fb0c857feae9eb2e47a28909b8228cd7 --- gnu/packages/nss.scm | 80 ++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 74 insertions(+), 6 deletions(-) diff --git a/gnu/packages/nss.scm b/gnu/packages/nss.scm index 9224a8ed5a..17f05a65b0 100644 --- a/gnu/packages/nss.scm +++ b/gnu/packages/nss.scm @@ -106,6 +106,9 @@ (define-public nspr-4.32 (base32 "0v3zds1id71j5a5si42a658fjz8nv2f6zp6w4gqrqmdr6ksz8sxv")))))) +;; nss should track ESRs, but currently doesn't. When the next ESR it out, it +;; should get updated. + (define-public nss (package (name "nss") @@ -153,13 +156,13 @@ (define-public nss ;; Ensure we are building for the (%current-target-system). #$@(if (%current-target-system) #~((string-append - "OS_TEST=" - (string-take #$(%current-target-system) - (string-index #$(%current-target-system) #\-))) + "OS_TEST=" + (string-take #$(%current-target-system) + (string-index #$(%current-target-system) #\-))) (string-append - "KERNEL=" (cond (#$(target-hurd?) "gnu") - (#$(target-linux?) "linux") - (else "")))) + "KERNEL=" (cond (#$(target-hurd?) "gnu") + (#$(target-linux?) "linux") + (else "")))) #~()) #$@(if (%current-target-system) #~("CROSS_COMPILE=1") @@ -303,6 +306,71 @@ (define-public nss/fixed (invoke "faketime" "2024-01-23" "./nss/tests/all.sh")) (format #t "test suite not run~%")))))))))))) +;; nss-rapid tracks the rapid release channel. Unless your package requires a +;; newer version, you should prefer the `nss' package, which tracks the ESR +;; channel. +;; +;; See https://wiki.mozilla.org/NSS:Release_Versions +;; and https://wiki.mozilla.org/Rapid_Release_Model + +(define-public nss-rapid + (package + (inherit nss) + (name "nss-rapid") + (version "3.102.1") + (source (origin + (inherit (package-source nss)) + (uri (let ((version-with-underscores + (string-join (string-split version #\.) "_"))) + (string-append + "https://ftp.mozilla.org/pub/mozilla.org/security/nss/" + "releases/NSS_" version-with-underscores "_RTM/src/" + "nss-" version ".tar.gz"))) + (sha256 + (base32 + "1k1pjxz0ab4lg8xqggbb8pw77c1q8h4bldi09z4pj5g4hwsjv62l")))) + (arguments + (substitute-keyword-arguments (package-arguments nss) + ((#:phases phases) + #~(modify-phases #$phases + (replace 'check + (lambda* (#:key tests? #:allow-other-keys) + (if tests? + (begin + ;; Use 127.0.0.1 instead of $HOST.$DOMSUF as HOSTADDR for + ;; testing. The latter requires a working DNS or /etc/hosts. + (setenv "DOMSUF" "localdomain") + (setenv "USE_IP" "TRUE") + (setenv "IP_ADDRESS" "127.0.0.1") + + ;; This specific test is looking at performance "now + ;; verify that we can quickly dump a database", and + ;; we're not testing performance here (especially + ;; since we're using faketime), so raise the + ;; threshold + (substitute* "nss/tests/dbtests/dbtests.sh" + ((" -lt 5") " -lt 50")) + + ;; Since the test suite is very lengthy, run the test + ;; suite once, not thrice as done by default, by + ;; selecting only the 'standard' cycle. + (setenv "NSS_CYCLES" "standard") + + ;; The "PayPalEE.cert" certificate expires every six months, + ;; leading to test failures: + ;; <https://bugzilla.mozilla.org/show_bug.cgi?id=609734>. To + ;; work around that, set the time to roughly the release date. + (invoke "faketime" "2024-01-23" "./nss/tests/all.sh")) + (format #t "test suite not run~%")))))))) + (synopsis "Network Security Services (Rapid Release)") + (description + "Network Security Services (@dfn{NSS}) is a set of libraries designed to +support cross-platform development of security-enabled client and server +applications. Applications built with NSS can support SSL v2 and v3, TLS, +PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other +security standards. + +This package tracks the Rapid Release channel, which updates frequently."))) (define-public nsncd (package (name "nsncd") -- 2.45.2 ^ permalink raw reply related [flat|nested] 33+ messages in thread
* [bug#71832] [PATCH v5 2/3] gnu: gnuzilla: Add skr to all-mozilla-locales. 2024-07-31 3:54 ` [bug#71832] [PATCH v5 0/3] [SECURITY] Add nss-rapid; update Librewolf to 128.0.3-1 Ian Eure 2024-07-31 3:54 ` [bug#71832] [PATCH v5 1/3] gnu: Add nss-rapid Ian Eure @ 2024-07-31 3:55 ` Ian Eure 2024-07-31 3:55 ` [bug#71832] [PATCH v5 3/3] gnu: librewolf: Update to 128.0.3-1 Ian Eure 2 siblings, 0 replies; 33+ messages in thread From: Ian Eure @ 2024-07-31 3:55 UTC (permalink / raw) To: 71832; +Cc: Ian Eure * (gnuzilla): Add skr to all-mozilla-locales. Change-Id: If996048792a53dffb55b7e16e69370dd72fc78e3 --- gnu/packages/gnuzilla.scm | 1 + 1 file changed, 1 insertion(+) diff --git a/gnu/packages/gnuzilla.scm b/gnu/packages/gnuzilla.scm index 3e7818ba43..98dd67a5dd 100644 --- a/gnu/packages/gnuzilla.scm +++ b/gnu/packages/gnuzilla.scm @@ -508,6 +508,7 @@ (define-public all-mozilla-locales ("0xndsph4v725q3xcpmxxjb9vxv19sssqnng82m9215cdsv9klgpb" "bf5f6e362f6f" "sco") ("0l70n8817mbmbc09fsnn2aqjj9k9dhad2gmzgphmiilf9mqm2dpf" "1f705c926a99" "si") ("19bqjazazww08chd1qc08dsnr2521088jq5jd4j3185yb1ypm3nr" "c1bd10d70325" "sk") + ("12q1nv6z4bk8yaw3vhl9xs41i7kpx1415mwg635v76fx8h94ycl3" "00eaf8d9e83b" "skr") ("11nmjmy2j249588ahg4mh9lxdqr476jbh28a07qxxibfa76j9vk3" "44be3cbf69b6" "sl") ("1ww35141nixg2s03kfmmq9fk6m3qiz2vg7p5a85shjp7i89pyj1d" "800576ff8ef9" "son") ("1q7nfybwc8mxdwi9fpvfhayq18mykzygkpakr5ngfz2316k8lf5r" "4de8638ac27f" "sq") -- 2.45.2 ^ permalink raw reply related [flat|nested] 33+ messages in thread
* [bug#71832] [PATCH v5 3/3] gnu: librewolf: Update to 128.0.3-1 2024-07-31 3:54 ` [bug#71832] [PATCH v5 0/3] [SECURITY] Add nss-rapid; update Librewolf to 128.0.3-1 Ian Eure 2024-07-31 3:54 ` [bug#71832] [PATCH v5 1/3] gnu: Add nss-rapid Ian Eure 2024-07-31 3:55 ` [bug#71832] [PATCH v5 2/3] gnu: gnuzilla: Add skr to all-mozilla-locales Ian Eure @ 2024-07-31 3:55 ` Ian Eure 2 siblings, 0 replies; 33+ messages in thread From: Ian Eure @ 2024-07-31 3:55 UTC (permalink / raw) To: 71832; +Cc: Ian Eure * gnu/packages/librewolf.scm (librewolf): Update to 128.0.3-1. Reorganize module to improve usability and reduce duplication. The Rust package and build ID are now at the top of the file. The librewolf-source variable has been replaced with the make-librewolf-source procedure, centralizing versions & hashes in the librewolf package definition. Dedent some of the package’s arguments to improve readability. Change-Id: I15f8a2aa1fae07e0497ab5511d10af0c1f70cc2e --- gnu/packages/librewolf.scm | 1054 ++++++++++++++++++------------------ 1 file changed, 531 insertions(+), 523 deletions(-) diff --git a/gnu/packages/librewolf.scm b/gnu/packages/librewolf.scm index 3e46477724..def21997fc 100644 --- a/gnu/packages/librewolf.scm +++ b/gnu/packages/librewolf.scm @@ -94,12 +94,24 @@ (define-module (gnu packages librewolf) #:use-module (gnu packages xdisorg) #:use-module (gnu packages xorg)) +;; Define the versions of rust needed to build librewolf, trying to match +;; upstream. See the file taskcluster/kinds/toolchain/rust.yml at +;; https://searchfox.org under the particular firefox release, like +;; mozilla-esr102. +;; 1.75 is the default in Guix, 1.77 is the minimum for Librewolf. +(define rust-librewolf rust-1.77) + +;; Update this id with every update to its release date. +;; It's used for cache validation and therefore can lead to strange bugs. +;; ex: date '+%Y%m%d%H%M%S' +(define %librewolf-build-id "20240730155826") + (define (firefox-source-origin version hash) (origin (method url-fetch) (uri (string-append "https://ftp.mozilla.org/pub/firefox/releases/" - version "/source/" "firefox-" version + version "/source/firefox-" version ".source.tar.xz")) (sha256 (base32 hash)))) @@ -115,11 +127,14 @@ (define (librewolf-source-origin version hash) (define computed-origin-method (@@ (guix packages) computed-origin-method)) -(define librewolf-source - (let* ((ff-src (firefox-source-origin "126.0.1" "0fr679rcwshwpfxidc55b2xsn4pmrr7p9ix4rr2mv2k7kwsjcc7n")) - (version "126.0.1-1") - (lw-src (librewolf-source-origin version "0cac80073vkzd85ai9rbnwixs1h9bpy4dj2ri6jxdlqsy5d663km"))) - +(define* (make-librewolf-source version #:key firefox-hash librewolf-hash) + (let* ((ff-src (firefox-source-origin + (car (string-split version #\-)) + firefox-hash)) + (version version) + (lw-src (librewolf-source-origin + version + librewolf-hash))) (origin (method computed-origin-method) (file-name (string-append "librewolf-" version ".source.tar.gz")) @@ -163,11 +178,6 @@ (define librewolf-source (("^ff_source_tarball:=.*") (string-append "ff_source_tarball:=" #+ff-src))) - ;; Remove encoding_rs patch, it doesn't build with Rust 1.75. - (substitute* '("assets/patches.txt") - (("patches/encoding_rs.patch\\\n$") - "")) - ;; Stage locales. (begin (format #t "Staging locales...~%") @@ -205,526 +215,524 @@ (define librewolf-source ".source.tar.gz") #$output)))))))) -;; Define the versions of rust needed to build librewolf, trying to match -;; upstream. See the file taskcluster/ci/toolchain/rust.yml at -;; https://searchfox.org under the particular firefox release, like -;; mozilla-esr102. -(define rust-librewolf rust) ; 1.75 is the default in Guix, 1.65 is the minimum. - -;; Update this id with every update to its release date. -;; It's used for cache validation and therefore can lead to strange bugs. -;; ex: date '+%Y%m%d%H%M%S' -(define %librewolf-build-id "20240607212143") - (define-public librewolf - (package - (name "librewolf") - (version "126.0.1-1") - (source librewolf-source) - (build-system gnu-build-system) - (arguments - (list - #:configure-flags #~(let ((clang #$(this-package-native-input "clang"))) - `("--enable-application=browser" - - ;; Configuration - "--without-wasm-sandboxed-libraries" - "--with-system-jpeg" - "--with-system-zlib" - "--with-system-png" - "--with-system-webp" - "--with-system-icu" - "--with-system-libvpx" - "--with-system-libevent" - "--with-system-ffi" - "--enable-system-pixman" - "--enable-jemalloc" - - ;; see https://bugs.gnu.org/32833 - "--with-system-nspr" - "--with-system-nss" - - ,(string-append "--with-clang-path=" clang - "/bin/clang") - ,(string-append "--with-libclang-path=" clang - "/lib") - - ;; Distribution - "--with-distribution-id=org.guix" - "--with-app-name=librewolf" - "--with-app-basename=LibreWolf" - "--with-branding=browser/branding/librewolf" - - ;; Features - "--disable-tests" - "--disable-updater" - "--enable-pulseaudio" - "--disable-crashreporter" - "--allow-addon-sideload" - "--with-unsigned-addon-scopes=app,system" - - ;; switch only available on x86, whereas EME - ;; is not supported on other targets - ,@(if #$(target-x86?) '("--disable-eme") '()) - - ;; Build details - "--disable-debug" - "--enable-rust-simd" - "--enable-release" - "--enable-optimize" - "--enable-strip" - "--enable-hardening" - "--disable-elf-hack")) - #:imported-modules %cargo-utils-modules - #:modules `((ice-9 regex) - (ice-9 string-fun) - (ice-9 ftw) - (srfi srfi-1) - (srfi srfi-26) - (rnrs bytevectors) - (rnrs io ports) - (guix elf) - (guix build gremlin) - ,@%gnu-build-system-modules) - #:phases #~(modify-phases %standard-phases - (add-after 'unpack 'fix-preferences - (lambda* (#:key inputs #:allow-other-keys) - (let ((port (open-file "browser/app/profile/firefox.js" - "a"))) - (define (write-setting key value) - (format port "~%pref(\"~a\", ~a);~%" key value) - (format #t + (let ((version "128.0.3-1")) + (package + (name "librewolf") + (version version) + (source (make-librewolf-source + version + #:firefox-hash + "1p6ymqzp23xfd4h3lc6aihjbq1ljspli9m17bm6rgklkbk6m8r1j" + #:librewolf-hash + "0pp36q4rcsiyv9b09jfgfrl1k3vqp5bh08c9iq0r2v8is5rbcdz5")) + + (build-system gnu-build-system) + (arguments + (list + #:configure-flags + #~(let ((clang #$(this-package-native-input "clang"))) + `("--enable-application=browser" + + ;; Configuration + "--without-wasm-sandboxed-libraries" + "--with-system-jpeg" + "--with-system-zlib" + "--with-system-png" + "--with-system-webp" + "--with-system-icu" + "--with-system-libvpx" + "--with-system-libevent" + "--with-system-ffi" + "--enable-system-pixman" + "--enable-jemalloc" + + ;; see https://bugs.gnu.org/32833 + "--with-system-nspr" + "--with-system-nss" + + ,(string-append "--with-clang-path=" clang + "/bin/clang") + ,(string-append "--with-libclang-path=" clang + "/lib") + + ;; Distribution + "--with-distribution-id=org.guix" + "--with-app-name=librewolf" + "--with-app-basename=LibreWolf" + "--with-branding=browser/branding/librewolf" + + ;; Features + "--disable-tests" + "--disable-updater" + "--enable-pulseaudio" + "--disable-crashreporter" + "--allow-addon-sideload" + "--with-unsigned-addon-scopes=app,system" + ;; switch only available on x86, whereas EME + ;; is not supported on other targets + ,@(if #$(target-x86?) '("--disable-eme") '()) + + ;; Build details + "--disable-debug" + "--enable-rust-simd" + "--enable-release" + "--enable-optimize" + "--enable-strip" + "--enable-hardening" + "--disable-elf-hack")) + #:imported-modules %cargo-utils-modules + #:modules `((ice-9 regex) + (ice-9 string-fun) + (ice-9 ftw) + (srfi srfi-1) + (srfi srfi-26) + (rnrs bytevectors) + (rnrs io ports) + (guix elf) + (guix build gremlin) + ,@%gnu-build-system-modules) + #:phases + #~(modify-phases %standard-phases + (add-after 'unpack 'fix-preferences + (lambda* (#:key inputs #:allow-other-keys) + (let ((port (open-file "browser/app/profile/firefox.js" + "a"))) + (define (write-setting key value) + (format port "~%pref(\"~a\", ~a);~%" key value) + (format #t "fix-preferences: setting value of ~a to ~a~%" key value)) - ;; We should allow the sandbox to read the store directory, - ;; because the sandbox has access to /usr on FHS distros. - (write-setting - "security.sandbox.content.read_path_whitelist" - (string-append "\"" - (%store-directory) "/\"")) - - ;; XDG settings should be managed by Guix. - (write-setting "browser.shell.checkDefaultBrowser" - "false") - (close-port port)))) - (add-after 'fix-preferences 'fix-ffmpeg-runtime-linker - (lambda* (#:key inputs #:allow-other-keys) - (let* ((ffmpeg (assoc-ref inputs "ffmpeg")) - (libavcodec (string-append ffmpeg - "/lib/libavcodec.so"))) - ;; Arrange to load libavcodec.so by its absolute file name. - (substitute* "dom/media/platforms/ffmpeg/FFmpegRuntimeLinker.cpp" - (("libavcodec\\.so") - libavcodec))))) - (add-after 'patch-source-shebangs 'patch-cargo-checksums - (lambda _ - (use-modules (guix build cargo-utils)) - (let ((null-hash - ;; This is the SHA256 output of an empty string. - (string-append - "e3b0c44298fc1c149afbf4c8996fb924" - "27ae41e4649b934ca495991b7852b855"))) - (for-each (lambda (file) - (format #t + ;; We should allow the sandbox to read the store directory, + ;; because the sandbox has access to /usr on FHS distros. + (write-setting + "security.sandbox.content.read_path_whitelist" + (string-append "\"" + (%store-directory) "/\"")) + + ;; XDG settings should be managed by Guix. + (write-setting "browser.shell.checkDefaultBrowser" + "false") + (close-port port)))) + (add-after 'fix-preferences 'fix-ffmpeg-runtime-linker + (lambda* (#:key inputs #:allow-other-keys) + (let* ((ffmpeg (assoc-ref inputs "ffmpeg")) + (libavcodec (string-append ffmpeg + "/lib/libavcodec.so"))) + ;; Arrange to load libavcodec.so by its absolute file name. + (substitute* "dom/media/platforms/ffmpeg/FFmpegRuntimeLinker.cpp" + (("libavcodec\\.so") + libavcodec))))) + (add-after 'patch-source-shebangs 'patch-cargo-checksums + (lambda _ + (use-modules (guix build cargo-utils)) + (let ((null-hash + ;; This is the SHA256 output of an empty string. + (string-append + "e3b0c44298fc1c149afbf4c8996fb924" + "27ae41e4649b934ca495991b7852b855"))) + (for-each (lambda (file) + (format #t "patch-cargo-checksums: patching checksums in ~a~%" file) - (substitute* file - (("(checksum = )\".*\"" all name) - (string-append name "\"" null-hash - "\"")))) - (find-files "." "Cargo\\.lock$")) - (for-each generate-all-checksums - '("build" - "dom/media" - "dom/webauthn" - "gfx" - "intl" - "js" - "media" - "modules" - "mozglue/static/rust" - "netwerk" - "remote" - "security/manager/ssl" - "servo" - "storage" - "third_party/rust" - "toolkit" - "xpcom/rust" - "services"))))) - (add-after 'patch-cargo-checksums 'remove-cargo-frozen-flag - (lambda _ - ;; Remove --frozen flag from cargo invokation, otherwise it'll - ;; complain that it's not able to change Cargo.lock. - ;; https://bugzilla.mozilla.org/show_bug.cgi?id=1726373 - (substitute* "build/RunCbindgen.py" - (("args.append\\(\"--frozen\"\\)") "pass")))) - (delete 'bootstrap) - (add-before 'configure 'patch-SpeechDispatcherService.cpp - (lambda _ - (let* ((lib "libspeechd.so.2") - (file (string-append - "dom/media/webspeech/synth/" - "speechd/SpeechDispatcherService.cpp")) - (old-content (call-with-input-file file - get-string-all))) - (substitute - file - `((,(format #f "~s" lib) unquote - (lambda (line _) - (string-replace-substring - line lib - (string-append #$speech-dispatcher - "/lib/" lib)))))) - (if (string=? old-content - (call-with-input-file file - get-string-all)) - (error - "substitute did nothing, phase requires an update"))))) - (add-before 'configure 'set-build-id - ;; Build will write the timestamp to output, which is harmful - ;; for reproducibility, so change it to a fixed date. Use a - ;; separate phase for easier modification with inherit. - (lambda _ - (setenv "MOZ_BUILD_DATE" - #$%librewolf-build-id))) - (replace 'configure - (lambda* (#:key inputs outputs configure-flags - #:allow-other-keys) - (setenv "AUTOCONF" - (string-append (assoc-ref inputs "autoconf") - "/bin/autoconf")) - (setenv "SHELL" - (which "bash")) - (setenv "CONFIG_SHELL" - (which "bash")) - (setenv "MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE" - "system") - ;; This should use the host info probably (does it - ;; build on non-x86_64 though?) - (setenv "GUIX_PYTHONPATH" - (string-append (getcwd) - "/obj-x86_64-pc-linux-gnu/_virtualenvs/build")) - - ;; Use Clang, Clang is 2x faster than GCC - (setenv "AR" "llvm-ar") - (setenv "NM" "llvm-nm") - (setenv "CC" "clang") - (setenv "CXX" "clang++") - (setenv "MOZ_NOSPAM" "1") - (setenv "MOZ_APP_NAME" "librewolf") - - (setenv "MOZBUILD_STATE_PATH" - (getcwd)) - - (let* ((mozconfig (string-append (getcwd) "/mozconfig")) - (out (assoc-ref outputs "out")) - (flags (cons (string-append "--prefix=" out) - configure-flags))) - (format #t "build directory: ~s~%" - (getcwd)) - (format #t "configure flags: ~s~%" flags) - - (define write-flags - (lambda flags - (display (string-join (map (cut string-append - "ac_add_options " <>) - flags) "\n")) - (display "\n"))) - (with-output-to-file mozconfig - (lambda () - (apply write-flags flags) - ;; The following option unsets Telemetry - ;; Reporting. With the Addons Fiasco, - ;; Mozilla was found to be collecting - ;; user's data, including saved passwords - ;; and web form data, without users - ;; consent. Mozilla was also found - ;; shipping updates to systems without - ;; the user's knowledge or permission. - ;; As a result of this, use the following - ;; command to permanently disable - ;; telemetry reporting. - (display "unset MOZ_TELEMETRY_REPORTING\n") - (display "mk_add_options MOZ_CRASHREPORTER=0\n") - (display "mk_add_options MOZ_DATA_REPORTING=0\n") - (display - "mk_add_options MOZ_SERVICES_HEALTHREPORT=0") - (display - "mk_add_options MOZ_TELEMETRY_REPORTING=0"))) - (setenv "MOZCONFIG" mozconfig)) - (invoke "./mach" "configure"))) - (add-before 'build 'fix-addons-placeholder - (lambda _ - (substitute* "toolkit/locales/en-US/toolkit/about/aboutAddons.ftl" - (("addons.mozilla.org") - "gnuzilla.gnu.org")))) - (replace 'build - (lambda* (#:key (make-flags '()) - (parallel-build? #t) #:allow-other-keys) - (apply invoke "./mach" "build" - ;; mach will use parallel build if possible by default - `(,@(if parallel-build? - '() - '("-j1")) ,@make-flags)))) - (add-after 'build 'neutralise-store-references - (lambda _ - ;; Mangle the store references to compilers & - ;; other build tools in about:buildconfig, - ;; reducing the package's closure by 1 GiB on - ;; x86-64. - (let* ((build-dir (car (scandir "." - (cut string-prefix? - "obj-" <>)))) - (file (string-append build-dir - "/dist/bin/chrome/toolkit/" - "content/global/buildconfig.html"))) - (substitute* file - (((format #f "(~a/)([0-9a-df-np-sv-z]{32})" - (regexp-quote (%store-directory))) - _ store hash) - (string-append store - (string-take hash 8) - "<!-- Guix: not a runtime dependency -->" - (string-drop hash 8))))))) - (replace 'install - (lambda _ - (invoke "./mach" "install"))) - (add-after 'install 'remove-duplicate-bin - (lambda* (#:key outputs #:allow-other-keys) - (delete-file (string-append #$output - "/lib/librewolf/librewolf-bin")))) - (add-after 'install 'wrap-glxtest - ;; glxtest uses dlopen() to load mesa and pci - ;; libs, wrap it to set LD_LIBRARY_PATH. - (lambda* (#:key inputs outputs #:allow-other-keys) - (let* ((out (assoc-ref outputs "out")) - (lib (string-append out "/lib")) - (libs (map - (lambda (lib-name) - (string-append (assoc-ref inputs - lib-name) - "/lib")) - '("mesa" "pciutils")))) - (wrap-program (car (find-files lib "^glxtest$")) - `("LD_LIBRARY_PATH" prefix ,libs))))) - (add-after 'install 'patch-config - (lambda* (#:key inputs #:allow-other-keys) - (let ((lib (string-append #$output "/lib/librewolf")) - (config-file "librewolf.cfg")) - - ;; Required for Guix packaged extensions - ;; SCOPE_PROFILE=1, SCOPE_APPLICATION=4, SCOPE_SYSTEM=8 - ;; Default is 5. - (substitute* (in-vicinity lib config-file) - (("defaultPref\\(\"extensions.enabledScopes\", 5\\)") - "defaultPref(\"extensions.enabledScopes\", 13)")) - ;; Use Mozzarella addons repo. - (call-with-port - (open-file - (in-vicinity lib config-file) - "a") - (lambda (port) - ;; Add-ons panel (see settings.js in Icecat source). - (for-each - (lambda (pref) - (format port - "defaultPref(~s, ~s);~%" - (car pref) - (cdr pref))) - `(("extensions.getAddons.search.browseURL" - ,(string-append - "https://gnuzilla.gnu.org/mozzarella/" - "search.php?q=%TERMS%")) - ("extensions.getAddons.get.url" . - "https://gnuzilla.gnu.org/mozzarella") - ("extensions.getAddons.link.url" . - "https://gnuzilla.gnu.org/mozzarella") - ("extensions.getAddons.discovery.api_url" . - "https://gnuzilla.gnu.org/mozzarella") - ("extensions.getAddons.langpacks.url" . - "https://gnuzilla.gnu.org/mozzarella") - ("lightweightThemes.getMoreURL" . - "https://gnuzilla.gnu.org/mozzarella")))))))) - (add-after 'install 'wrap-program - (lambda* (#:key inputs outputs #:allow-other-keys) - ;; The following two functions are from Guix's icecat package in - ;; (gnu packages gnuzilla). See commit - ;; b7a0935420ee630a29b7e5ac73a32ba1eb24f00b. - (define (runpath-of lib) - (call-with-input-file lib - (compose elf-dynamic-info-runpath elf-dynamic-info - parse-elf get-bytevector-all))) - (define (runpaths-of-input label) - (let* ((dir (string-append (assoc-ref inputs label) - "/lib")) - (libs (find-files dir "\\.so$"))) - (append-map runpath-of libs))) - (let* ((out (assoc-ref outputs "out")) - (lib (string-append out "/lib")) - (libs (map - (lambda (lib-name) - (string-append (assoc-ref inputs - lib-name) - "/lib")) - '("mesa" "libpng-apng" "libnotify" "libva" - "pulseaudio" "gtk+" "pipewire" - ;; For U2F and WebAuthn - "eudev"))) - - ;; VA-API is run in the RDD (Remote Data Decoder) sandbox - ;; and must be explicitly given access to files it needs. - ;; Rather than adding the whole store (as Nix had - ;; upstream do, see - ;; <https://github.com/NixOS/nixpkgs/pull/165964> and - ;; linked upstream patches), we can just follow the - ;; runpaths of the needed libraries to add everything to - ;; LD_LIBRARY_PATH. These will then be accessible in the - ;; RDD sandbox. - (rdd-whitelist (map (cut string-append <> "/") - (delete-duplicates (append-map - runpaths-of-input - '("mesa" - "ffmpeg"))))) - (gtk-share (string-append (assoc-ref inputs - "gtk+") - "/share"))) - (wrap-program (car (find-files lib "^librewolf$")) - `("LD_LIBRARY_PATH" prefix - (,@libs ,@rdd-whitelist)) - `("XDG_DATA_DIRS" prefix - (,gtk-share)) - `("MOZ_LEGACY_PROFILES" = - ("1")) - `("MOZ_ALLOW_DOWNGRADE" = - ("1")))))) - (add-after 'wrap-program 'install-desktop-entry - (lambda* (#:key outputs #:allow-other-keys) - (let* ((desktop-file - "taskcluster/docker/firefox-snap/firefox.desktop") - (applications (string-append #$output - "/share/applications"))) - (substitute* desktop-file - (("^Exec=firefox") - (string-append "Exec=" - #$output "/bin/librewolf")) - ;; "Firefox" -> "LibreWolf" everywhere - (("Firefox") - "LibreWolf") - ;; Remove non-Latin translations. - (("^Name\\[(ar|bn)\\].*$") - "") - (("^Icon=.*") - (string-append "Icon=" - #$output - "/share/icons/hicolor/128x128/apps/librewolf.png + (substitute* file + (("(checksum = )\".*\"" all name) + (string-append name "\"" null-hash + "\"")))) + (find-files "." "Cargo\\.lock$")) + (for-each generate-all-checksums + '("build" + "dom/media" + "dom/webauthn" + "gfx" + "intl" + "js" + "media" + "modules" + "mozglue/static/rust" + "netwerk" + "remote" + "security/manager/ssl" + "servo" + "storage" + "third_party/rust" + "toolkit" + "xpcom/rust" + "services"))))) + (add-after 'patch-cargo-checksums 'remove-cargo-frozen-flag + (lambda _ + ;; Remove --frozen flag from cargo invokation, otherwise it'll + ;; complain that it's not able to change Cargo.lock. + ;; https://bugzilla.mozilla.org/show_bug.cgi?id=1726373 + (substitute* "build/RunCbindgen.py" + (("args.append\\(\"--frozen\"\\)") "pass")))) + (delete 'bootstrap) + (add-before 'configure 'patch-SpeechDispatcherService.cpp + (lambda _ + (let* ((lib "libspeechd.so.2") + (file (string-append + "dom/media/webspeech/synth/" + "speechd/SpeechDispatcherService.cpp")) + (old-content (call-with-input-file file + get-string-all))) + (substitute + file + `((,(format #f "~s" lib) unquote + (lambda (line _) + (string-replace-substring + line lib + (string-append #$speech-dispatcher + "/lib/" lib)))))) + (if (string=? old-content + (call-with-input-file file + get-string-all)) + (error + "substitute did nothing, phase requires an update"))))) + (add-before 'configure 'set-build-id + ;; Build will write the timestamp to output, which is harmful + ;; for reproducibility, so change it to a fixed date. Use a + ;; separate phase for easier modification with inherit. + (lambda _ + (setenv "MOZ_BUILD_DATE" + #$%librewolf-build-id))) + (replace 'configure + (lambda* (#:key inputs outputs configure-flags + #:allow-other-keys) + (setenv "AUTOCONF" + (string-append (assoc-ref inputs "autoconf") + "/bin/autoconf")) + (setenv "SHELL" + (which "bash")) + (setenv "CONFIG_SHELL" + (which "bash")) + (setenv "MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE" + "system") + ;; This should use the host info probably (does it + ;; build on non-x86_64 though?) + (setenv "GUIX_PYTHONPATH" + (string-append (getcwd) + "/obj-x86_64-pc-linux-gnu/_virtualenvs/build")) + + ;; Use Clang, Clang is 2x faster than GCC + (setenv "AR" "llvm-ar") + (setenv "NM" "llvm-nm") + (setenv "CC" "clang") + (setenv "CXX" "clang++") + (setenv "MOZ_NOSPAM" "1") + (setenv "MOZ_APP_NAME" "librewolf") + (setenv "MOZ_APP_REMOTINGNAME" "LibreWolf") + + (setenv "MOZBUILD_STATE_PATH" + (getcwd)) + + (let* ((mozconfig (string-append (getcwd) "/mozconfig")) + (out (assoc-ref outputs "out")) + (flags (cons (string-append "--prefix=" out) + configure-flags))) + (format #t "build directory: ~s~%" + (getcwd)) + (format #t "configure flags: ~s~%" flags) + + (define write-flags + (lambda flags + (display (string-join (map (cut string-append + "ac_add_options " <>) + flags) "\n")) + (display "\n"))) + (with-output-to-file mozconfig + (lambda () + (apply write-flags flags) + ;; The following option unsets Telemetry + ;; Reporting. With the Addons Fiasco, + ;; Mozilla was found to be collecting + ;; user's data, including saved passwords + ;; and web form data, without users + ;; consent. Mozilla was also found + ;; shipping updates to systems without + ;; the user's knowledge or permission. + ;; As a result of this, use the following + ;; command to permanently disable + ;; telemetry reporting. + (display "unset MOZ_TELEMETRY_REPORTING\n") + (display "mk_add_options MOZ_CRASHREPORTER=0\n") + (display "mk_add_options MOZ_DATA_REPORTING=0\n") + (display + "mk_add_options MOZ_SERVICES_HEALTHREPORT=0") + (display + "mk_add_options MOZ_TELEMETRY_REPORTING=0"))) + (setenv "MOZCONFIG" mozconfig)) + (invoke "./mach" "configure"))) + (add-before 'build 'fix-addons-placeholder + (lambda _ + (substitute* "toolkit/locales/en-US/toolkit/about/aboutAddons.ftl" + (("addons.mozilla.org") + "gnuzilla.gnu.org")))) + (replace 'build + (lambda* (#:key (make-flags '()) + (parallel-build? #t) #:allow-other-keys) + (apply invoke "./mach" "build" + ;; mach will use parallel build if possible by default + `(,@(if parallel-build? + '() + '("-j1")) ,@make-flags)))) + (add-after 'build 'neutralise-store-references + (lambda _ + ;; Mangle the store references to compilers & + ;; other build tools in about:buildconfig, + ;; reducing the package's closure by 1 GiB on + ;; x86-64. + (let* ((build-dir (car (scandir "." + (cut string-prefix? + "obj-" <>)))) + (file (string-append build-dir + "/dist/bin/chrome/toolkit/" + "content/global/buildconfig.html"))) + (substitute* file + (((format #f "(~a/)([0-9a-df-np-sv-z]{32})" + (regexp-quote (%store-directory))) + _ store hash) + (string-append store + (string-take hash 8) + "<!-- Guix: not a runtime dependency -->" + (string-drop hash 8))))))) + (replace 'install + (lambda _ + (invoke "./mach" "install"))) + (add-after 'install 'remove-duplicate-bin + (lambda* (#:key outputs #:allow-other-keys) + (delete-file (string-append #$output + "/lib/librewolf/librewolf-bin")))) + (add-after 'install 'wrap-glxtest + ;; glxtest uses dlopen() to load mesa and pci + ;; libs, wrap it to set LD_LIBRARY_PATH. + (lambda* (#:key inputs outputs #:allow-other-keys) + (let* ((out (assoc-ref outputs "out")) + (lib (string-append out "/lib")) + (libs (map + (lambda (lib-name) + (string-append (assoc-ref inputs + lib-name) + "/lib")) + '("mesa" "pciutils")))) + (wrap-program (car (find-files lib "^glxtest$")) + `("LD_LIBRARY_PATH" prefix ,libs))))) + (add-after 'install 'patch-config + (lambda* (#:key inputs #:allow-other-keys) + (let ((lib (string-append #$output "/lib/librewolf")) + (config-file "librewolf.cfg")) + + ;; Required for Guix packaged extensions + ;; SCOPE_PROFILE=1, SCOPE_APPLICATION=4, SCOPE_SYSTEM=8 + ;; Default is 5. + (substitute* (in-vicinity lib config-file) + (("defaultPref\\(\"extensions.enabledScopes\", 5\\)") + "defaultPref(\"extensions.enabledScopes\", 13)")) + ;; Use Mozzarella addons repo. + (call-with-port + (open-file + (in-vicinity lib config-file) + "a") + (lambda (port) + ;; Add-ons panel (see settings.js in Icecat source). + (for-each + (lambda (pref) + (format port + "defaultPref(~s, ~s);~%" + (car pref) + (cdr pref))) + `(("extensions.getAddons.search.browseURL" + ,(string-append + "https://gnuzilla.gnu.org/mozzarella/" + "search.php?q=%TERMS%")) + ("extensions.getAddons.get.url" . + "https://gnuzilla.gnu.org/mozzarella") + ("extensions.getAddons.link.url" . + "https://gnuzilla.gnu.org/mozzarella") + ("extensions.getAddons.discovery.api_url" . + "https://gnuzilla.gnu.org/mozzarella") + ("extensions.getAddons.langpacks.url" . + "https://gnuzilla.gnu.org/mozzarella") + ("lightweightThemes.getMoreURL" . + "https://gnuzilla.gnu.org/mozzarella")))))))) + (add-after 'install 'wrap-program + (lambda* (#:key inputs outputs #:allow-other-keys) + ;; The following two functions are from Guix's icecat package in + ;; (gnu packages gnuzilla). See commit + ;; b7a0935420ee630a29b7e5ac73a32ba1eb24f00b. + (define (runpath-of lib) + (call-with-input-file lib + (compose elf-dynamic-info-runpath elf-dynamic-info + parse-elf get-bytevector-all))) + (define (runpaths-of-input label) + (let* ((dir (string-append (assoc-ref inputs label) + "/lib")) + (libs (find-files dir "\\.so$"))) + (append-map runpath-of libs))) + (let* ((out (assoc-ref outputs "out")) + (lib (string-append out "/lib")) + (libs (map + (lambda (lib-name) + (string-append (assoc-ref inputs + lib-name) + "/lib")) + '("mesa" "libpng-apng" "libnotify" "libva" + "pulseaudio" "gtk+" "pipewire" + ;; For U2F and WebAuthn + "eudev"))) + + ;; VA-API is run in the RDD (Remote Data Decoder) sandbox + ;; and must be explicitly given access to files it needs. + ;; Rather than adding the whole store (as Nix had + ;; upstream do, see + ;; <https://github.com/NixOS/nixpkgs/pull/165964> and + ;; linked upstream patches), we can just follow the + ;; runpaths of the needed libraries to add everything to + ;; LD_LIBRARY_PATH. These will then be accessible in the + ;; RDD sandbox. + (rdd-whitelist (map (cut string-append <> "/") + (delete-duplicates (append-map + runpaths-of-input + '("mesa" + "ffmpeg"))))) + (gtk-share (string-append (assoc-ref inputs + "gtk+") + "/share"))) + (wrap-program (car (find-files lib "^librewolf$")) + `("LD_LIBRARY_PATH" prefix + (,@libs ,@rdd-whitelist)) + `("XDG_DATA_DIRS" prefix + (,gtk-share)) + `("MOZ_LEGACY_PROFILES" = + ("1")) + `("MOZ_ALLOW_DOWNGRADE" = + ("1")))))) + (add-after 'wrap-program 'install-desktop-entry + (lambda* (#:key outputs #:allow-other-keys) + (let* ((desktop-file + "taskcluster/docker/firefox-snap/firefox.desktop") + (applications (string-append #$output + "/share/applications"))) + (substitute* desktop-file + (("^Exec=firefox") + (string-append "Exec=" + #$output "/bin/librewolf")) + ;; "Firefox" -> "LibreWolf" everywhere + (("Firefox") + "LibreWolf") + ;; Remove non-Latin translations. + (("^Name\\[(ar|bn)\\].*$") + "") + (("^Icon=.*") + (string-append "Icon=" + #$output + "/share/icons/hicolor/128x128/apps/librewolf.png ")) - ;; These commands were changed. - (("-NewWindow") - "-new-window") - (("-NewPrivateWindow") - "-new-private-window") - (("StartupNotify=true") - "StartupNotify=true -StartupWMClass=Navigator")) - (copy-file desktop-file "librewolf.desktop") - (install-file "librewolf.desktop" applications)))) - (add-after 'install-desktop-entry 'install-icons - (lambda* (#:key outputs #:allow-other-keys) - (let ((icon-source-dir (string-append #$output - "/lib/librewolf/browser/" - "chrome/icons/default"))) - (for-each (lambda (size) - (let ((dest (string-append #$output - "/share/icons/hicolor/" - size - "x" - size - "/apps"))) - (mkdir-p dest) - (symlink (string-append icon-source-dir - "/default" size ".png") - (string-append dest - "/librewolf.png")))) - '("16" "32" "48" "64" "128")))))) - - ;; Test will significantly increase build time but with little rewards. - #:tests? #f - - ;; WARNING: Parallel build will consume lots of memory! - ;; If you have encountered OOM issue in build phase, try disable it. - #:parallel-build? #t - - ;; Some dynamic lib was determined at runtime, so rpath check may fail. - #:validate-runpath? #f)) - (inputs (list bash-minimal - bzip2 - cairo - cups - dbus-glib - freetype - ffmpeg - gdk-pixbuf - glib - gtk+ - gtk+-2 - hunspell - icu4c-73 - jemalloc - libcanberra - libevent - libffi - libgnome - libjpeg-turbo - libnotify - libpng-apng - libva - libvpx - libwebp - libxcomposite - libxft - libxinerama - libxscrnsaver - libxt - mesa - mit-krb5 - nspr - nss/fixed - pango - pciutils - pipewire - pixman - pulseaudio - speech-dispatcher - sqlite - startup-notification - eudev - unzip - zip - zlib)) - (native-inputs (list alsa-lib - autoconf-2.13 - `(,rust-librewolf "cargo") - clang-18 - llvm-18 - m4 - nasm - node-lts - perl - pkg-config - python - rust-librewolf - rust-cbindgen-0.26 - which - yasm)) - (home-page "https://librewolf.net/") - (synopsis - "Custom version of Firefox, focused on privacy, security and freedom") - (description - "LibreWolf is designed to increase protection against tracking and + ;; These commands were changed. + (("-NewWindow") + "-new-window") + (("-NewPrivateWindow") + "-new-private-window") + (("StartupNotify=true") + "StartupNotify=true +StartupWMClass=LibreWolf")) + (copy-file desktop-file "librewolf.desktop") + (install-file "librewolf.desktop" applications)))) + (add-after 'install-desktop-entry 'install-icons + (lambda* (#:key outputs #:allow-other-keys) + (let ((icon-source-dir (string-append #$output + "/lib/librewolf/browser/" + "chrome/icons/default"))) + (for-each (lambda (size) + (let ((dest (string-append #$output + "/share/icons/hicolor/" + size + "x" + size + "/apps"))) + (mkdir-p dest) + (symlink (string-append icon-source-dir + "/default" size ".png") + (string-append dest + "/librewolf.png")))) + '("16" "32" "48" "64" "128")))))) + + ;; Test will significantly increase build time but with little rewards. + #:tests? #f + + ;; WARNING: Parallel build will consume lots of memory! + ;; If you have encountered OOM issue in build phase, try disable it. + #:parallel-build? #t + + ;; Some dynamic lib was determined at runtime, so rpath check may fail. + #:validate-runpath? #f)) + (inputs (list bash-minimal + bzip2 + cairo + cups + dbus-glib + freetype + ffmpeg + gdk-pixbuf + glib + gtk+ + gtk+-2 + hunspell + icu4c-73 + jemalloc + libcanberra + libevent + libffi + libgnome + libjpeg-turbo + libnotify + libpng-apng + libva + libvpx + libwebp + libxcomposite + libxft + libxinerama + libxscrnsaver + libxt + mesa + mit-krb5 + nspr + nss-rapid + pango + pciutils + pipewire + pixman + pulseaudio + speech-dispatcher + sqlite + startup-notification + eudev + unzip + zip + zlib)) + (native-inputs (list alsa-lib + autoconf-2.13 + `(,rust-librewolf "cargo") + clang-18 + llvm-18 + m4 + nasm + node-lts + perl + pkg-config + python + rust-librewolf + rust-cbindgen-0.26 + which + yasm)) + (home-page "https://librewolf.net/") + (synopsis + "Custom version of Firefox, focused on privacy, security and freedom") + (description + "LibreWolf is designed to increase protection against tracking and fingerprinting techniques, while also including a few security improvements. This is achieved through our privacy and security oriented settings and patches. LibreWolf also aims to remove all the telemetry, data collection and annoyances, as well as disabling anti-freedom features like DRM.") - (license license:mpl2.0))) + (license license:mpl2.0)))) -- 2.45.2 ^ permalink raw reply related [flat|nested] 33+ messages in thread
* [bug#71832] [PATCH v6 0/3] [SECURITY] Update LibreWolf to 129.0.1-1; add nss-rapid 2024-06-29 3:57 [bug#71832] [PATCH 0/2] Add nss-latest; updte Librewolf to 127.0.2-2 Ian Eure ` (6 preceding siblings ...) 2024-07-31 3:54 ` [bug#71832] [PATCH v5 0/3] [SECURITY] Add nss-rapid; update Librewolf to 128.0.3-1 Ian Eure @ 2024-08-17 19:32 ` Ian Eure 2024-08-17 19:32 ` [bug#71832] [PATCH v6 1/3] gnu: gnuzilla: Add skr to all-mozilla-locales Ian Eure ` (3 more replies) 7 siblings, 4 replies; 33+ messages in thread From: Ian Eure @ 2024-08-17 19:32 UTC (permalink / raw) To: 71832; +Cc: Ian Eure, guix-security vs. the previous versions of this patch series, v6: - Updates LibreWolf to 129.0.1-1, the latest upstream. - Updates nss-rapid, to version 3.103, the latest upstream. - Adds the skr locale to all-mozilla-locales. - Backs out improvements not directly related to updating the browser version, to make review easier. In addition to the CVEs fixed in 128.0, this includes fixes for[1]: CVE-2024-7518: Fullscreen notification dialog can be obscured by document content CVE-2024-7519: Out of bounds memory access in graphics shared memory handling CVE-2024-7520: Type confusion in WebAssembly CVE-2024-7521: Incomplete WebAssembly exception handing CVE-2024-7522: Out of bounds read in editor component CVE-2024-7523: Document content could partially obscure security prompts CVE-2024-7524: CSP strict-dynamic bypass using web-compatibility shims CVE-2024-7525: Missing permission check when creating a StreamFilter CVE-2024-7526: Uninitialized memory used by WebGL CVE-2024-7527: Use-after-free in JavaScript garbage collection CVE-2024-7528: Use-after-free in IndexedDB CVE-2024-7529: Document content could partially obscure security prompts CVE-2024-7530: Use-after-free in JavaScript code coverage collection CVE-2024-7531: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge [1]: https://www.mozilla.org/en-US/security/advisories/mfsa2024-33/ Ian Eure (3): gnu: gnuzilla: Add skr to all-mozilla-locales. gnu: Add nss-rapid. gnu: librewolf: Update to 129.0.1-1. gnu/packages/gnuzilla.scm | 1 + gnu/packages/librewolf.scm | 12 +++---- gnu/packages/nss.scm | 67 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 74 insertions(+), 6 deletions(-) -- 2.45.2 ^ permalink raw reply [flat|nested] 33+ messages in thread
* [bug#71832] [PATCH v6 1/3] gnu: gnuzilla: Add skr to all-mozilla-locales. 2024-08-17 19:32 ` [bug#71832] [PATCH v6 0/3] [SECURITY] Update LibreWolf to 129.0.1-1; add nss-rapid Ian Eure @ 2024-08-17 19:32 ` Ian Eure 2024-08-17 19:32 ` [bug#71832] [PATCH v6 2/3] gnu: Add nss-rapid Ian Eure ` (2 subsequent siblings) 3 siblings, 0 replies; 33+ messages in thread From: Ian Eure @ 2024-08-17 19:32 UTC (permalink / raw) To: 71832; +Cc: Ian Eure, guix-security * (gnuzilla): Add skr to all-mozilla-locales. Change-Id: If996048792a53dffb55b7e16e69370dd72fc78e3 --- gnu/packages/gnuzilla.scm | 1 + 1 file changed, 1 insertion(+) diff --git a/gnu/packages/gnuzilla.scm b/gnu/packages/gnuzilla.scm index 039b6de71c..df48976419 100644 --- a/gnu/packages/gnuzilla.scm +++ b/gnu/packages/gnuzilla.scm @@ -508,6 +508,7 @@ (define-public all-mozilla-locales ("0xndsph4v725q3xcpmxxjb9vxv19sssqnng82m9215cdsv9klgpb" "bf5f6e362f6f" "sco") ("0l70n8817mbmbc09fsnn2aqjj9k9dhad2gmzgphmiilf9mqm2dpf" "1f705c926a99" "si") ("19bqjazazww08chd1qc08dsnr2521088jq5jd4j3185yb1ypm3nr" "c1bd10d70325" "sk") + ("12q1nv6z4bk8yaw3vhl9xs41i7kpx1415mwg635v76fx8h94ycl3" "00eaf8d9e83b" "skr") ("11nmjmy2j249588ahg4mh9lxdqr476jbh28a07qxxibfa76j9vk3" "44be3cbf69b6" "sl") ("1ww35141nixg2s03kfmmq9fk6m3qiz2vg7p5a85shjp7i89pyj1d" "800576ff8ef9" "son") ("1q7nfybwc8mxdwi9fpvfhayq18mykzygkpakr5ngfz2316k8lf5r" "4de8638ac27f" "sq") -- 2.45.2 ^ permalink raw reply related [flat|nested] 33+ messages in thread
* [bug#71832] [PATCH v6 2/3] gnu: Add nss-rapid. 2024-08-17 19:32 ` [bug#71832] [PATCH v6 0/3] [SECURITY] Update LibreWolf to 129.0.1-1; add nss-rapid Ian Eure 2024-08-17 19:32 ` [bug#71832] [PATCH v6 1/3] gnu: gnuzilla: Add skr to all-mozilla-locales Ian Eure @ 2024-08-17 19:32 ` Ian Eure 2024-08-17 22:46 ` Vagrant Cascadian 2024-08-18 3:38 ` Vagrant Cascadian 2024-08-17 19:32 ` [bug#71832] [PATCH v6 3/3] gnu: librewolf: Update to 129.0.1-1 Ian Eure 2024-08-18 3:46 ` [bug#71832] [PATCH v6 0/3] [SECURITY] Update LibreWolf to 129.0.1-1; add nss-rapid Vagrant Cascadian 3 siblings, 2 replies; 33+ messages in thread From: Ian Eure @ 2024-08-17 19:32 UTC (permalink / raw) To: 71832; +Cc: Ian Eure, guix-security * gnu/packages/nss.scm (nss-rapid): New variable. Change-Id: I2bdd2119fb0c857feae9eb2e47a28909b8228cd7 --- gnu/packages/nss.scm | 67 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 67 insertions(+) diff --git a/gnu/packages/nss.scm b/gnu/packages/nss.scm index 9224a8ed5a..1a684e6146 100644 --- a/gnu/packages/nss.scm +++ b/gnu/packages/nss.scm @@ -106,6 +106,8 @@ (define-public nspr-4.32 (base32 "0v3zds1id71j5a5si42a658fjz8nv2f6zp6w4gqrqmdr6ksz8sxv")))))) +;; nss should track ESRs, but currently doesn't. 3.102.1 is the current ESR. + (define-public nss (package (name "nss") @@ -303,6 +305,71 @@ (define-public nss/fixed (invoke "faketime" "2024-01-23" "./nss/tests/all.sh")) (format #t "test suite not run~%")))))))))))) +;; nss-rapid tracks the rapid release channel. Unless your package requires a +;; newer version, you should prefer the `nss' package, which tracks the ESR +;; channel. +;; +;; See https://wiki.mozilla.org/NSS:Release_Versions +;; and https://wiki.mozilla.org/Rapid_Release_Model + +(define-public nss-rapid + (package + (inherit nss) + (name "nss-rapid") + (version "3.103") + (source (origin + (inherit (package-source nss)) + (uri (let ((version-with-underscores + (string-join (string-split version #\.) "_"))) + (string-append + "https://ftp.mozilla.org/pub/mozilla.org/security/nss/" + "releases/NSS_" version-with-underscores "_RTM/src/" + "nss-" version ".tar.gz"))) + (sha256 + (base32 + "0qp9rs226rr6gh51b42cdbydr4mj80cli3bfqhh7bp3jyxbvcjkv")))) + (arguments + (substitute-keyword-arguments (package-arguments nss) + ((#:phases phases) + #~(modify-phases #$phases + (replace 'check + (lambda* (#:key tests? #:allow-other-keys) + (if tests? + (begin + ;; Use 127.0.0.1 instead of $HOST.$DOMSUF as HOSTADDR for + ;; testing. The latter requires a working DNS or /etc/hosts. + (setenv "DOMSUF" "localdomain") + (setenv "USE_IP" "TRUE") + (setenv "IP_ADDRESS" "127.0.0.1") + + ;; This specific test is looking at performance "now + ;; verify that we can quickly dump a database", and + ;; we're not testing performance here (especially + ;; since we're using faketime), so raise the + ;; threshold + (substitute* "nss/tests/dbtests/dbtests.sh" + ((" -lt 5") " -lt 50")) + + ;; Since the test suite is very lengthy, run the test + ;; suite once, not thrice as done by default, by + ;; selecting only the 'standard' cycle. + (setenv "NSS_CYCLES" "standard") + + ;; The "PayPalEE.cert" certificate expires every six months, + ;; leading to test failures: + ;; <https://bugzilla.mozilla.org/show_bug.cgi?id=609734>. To + ;; work around that, set the time to roughly the release date. + (invoke "faketime" "2024-08-17" "./nss/tests/all.sh")) + (format #t "test suite not run~%")))))))) + (synopsis "Network Security Services (Rapid Release)") + (description + "Network Security Services (@dfn{NSS}) is a set of libraries designed to +support cross-platform development of security-enabled client and server +applications. Applications built with NSS can support SSL v2 and v3, TLS, +PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other +security standards. + +This package tracks the Rapid Release channel, which updates frequently."))) (define-public nsncd (package (name "nsncd") -- 2.45.2 ^ permalink raw reply related [flat|nested] 33+ messages in thread
* [bug#71832] [PATCH v6 2/3] gnu: Add nss-rapid. 2024-08-17 19:32 ` [bug#71832] [PATCH v6 2/3] gnu: Add nss-rapid Ian Eure @ 2024-08-17 22:46 ` Vagrant Cascadian 2024-08-17 23:33 ` Vagrant Cascadian 2024-08-18 3:38 ` Vagrant Cascadian 1 sibling, 1 reply; 33+ messages in thread From: Vagrant Cascadian @ 2024-08-17 22:46 UTC (permalink / raw) To: Ian Eure, 71832; +Cc: guix-security [-- Attachment #1: Type: text/plain, Size: 1001 bytes --] On 2024-08-17, Ian Eure wrote: > * gnu/packages/nss.scm (nss-rapid): New variable. > > Change-Id: I2bdd2119fb0c857feae9eb2e47a28909b8228cd7 > --- > gnu/packages/nss.scm | 67 ++++++++++++++++++++++++++++++++++++++++++++ > 1 file changed, 67 insertions(+) Unfortunately, this failed to build: error: in phase 'check': uncaught exception: %exception #<&invoke-error program: "faketime" arguments: ("2024-08-17" "./nss/tests/all.sh") exit-status: 1 term-signal: #f stop-signal: #f> phase `check' failed after 1983.7 seconds command "faketime" "2024-08-17" "./nss/tests/all.sh" failed with status 1 builder for `/gnu/store/nhzx27ndgbhsbl0kjnv49xsy3xdy0a66-nss-rapid-3.103.drv' failed with exit code 1 build of /gnu/store/nhzx27ndgbhsbl0kjnv49xsy3xdy0a66-nss-rapid-3.103.drv failed View build log at '/var/log/guix/drvs/nh/zx27ndgbhsbl0kjnv49xsy3xdy0a66-nss-rapid-3.103.drv.gz'. guix build: error: build of `/gnu/store/nhzx27ndgbhsbl0kjnv49xsy3xdy0a66-nss-rapid-3.103.drv' failed live well, vagrant [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 227 bytes --] ^ permalink raw reply [flat|nested] 33+ messages in thread
* [bug#71832] [PATCH v6 2/3] gnu: Add nss-rapid. 2024-08-17 22:46 ` Vagrant Cascadian @ 2024-08-17 23:33 ` Vagrant Cascadian 2024-08-17 23:51 ` Ian Eure 0 siblings, 1 reply; 33+ messages in thread From: Vagrant Cascadian @ 2024-08-17 23:33 UTC (permalink / raw) To: Ian Eure, 71832; +Cc: guix-security [-- Attachment #1: Type: text/plain, Size: 1242 bytes --] On 2024-08-17, Vagrant Cascadian wrote: > On 2024-08-17, Ian Eure wrote: >> * gnu/packages/nss.scm (nss-rapid): New variable. >> >> Change-Id: I2bdd2119fb0c857feae9eb2e47a28909b8228cd7 >> --- >> gnu/packages/nss.scm | 67 ++++++++++++++++++++++++++++++++++++++++++++ >> 1 file changed, 67 insertions(+) > > Unfortunately, this failed to build: > > error: in phase 'check': uncaught exception: > %exception #<&invoke-error program: "faketime" arguments: ("2024-08-17" "./nss/tests/all.sh") exit-status: 1 term-signal: #f stop-signal: #f> > phase `check' failed after 1983.7 seconds > command "faketime" "2024-08-17" "./nss/tests/all.sh" failed with status 1 > builder for `/gnu/store/nhzx27ndgbhsbl0kjnv49xsy3xdy0a66-nss-rapid-3.103.drv' failed with exit code 1 > build of /gnu/store/nhzx27ndgbhsbl0kjnv49xsy3xdy0a66-nss-rapid-3.103.drv failed > View build log at '/var/log/guix/drvs/nh/zx27ndgbhsbl0kjnv49xsy3xdy0a66-nss-rapid-3.103.drv.gz'. > guix build: error: build of `/gnu/store/nhzx27ndgbhsbl0kjnv49xsy3xdy0a66-nss-rapid-3.103.drv' failed Hrm. The build log was truncated and I could not find the actual errors. There were two test suite failures... :/ I tried to build it again and it worked this time... hrm. live well, vagrant [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 227 bytes --] ^ permalink raw reply [flat|nested] 33+ messages in thread
* [bug#71832] [PATCH v6 2/3] gnu: Add nss-rapid. 2024-08-17 23:33 ` Vagrant Cascadian @ 2024-08-17 23:51 ` Ian Eure 2024-08-18 2:00 ` Vagrant Cascadian 0 siblings, 1 reply; 33+ messages in thread From: Ian Eure @ 2024-08-17 23:51 UTC (permalink / raw) To: Vagrant Cascadian, 71832; +Cc: guix-security [-- Attachment #1: Type: text/plain, Size: 1780 bytes --] Thank you for taking a look. It seems like the build process crashed when running the extensive test suite. Both these packages are resource-intensive to build. A machine with 16gb RAM and no swap will OOM, but a 24gb machine can complete them. Perhaps there's a clue in dmesg? I built both nss-rapid and librewolf locally and made sure they seemed to work prior to sending the patch series. On August 17, 2024 4:33:14 PM PDT, Vagrant Cascadian <vagrant@debian.org> wrote: >On 2024-08-17, Vagrant Cascadian wrote: >> On 2024-08-17, Ian Eure wrote: >>> * gnu/packages/nss.scm (nss-rapid): New variable. >>> >>> Change-Id: I2bdd2119fb0c857feae9eb2e47a28909b8228cd7 >>> --- >>> gnu/packages/nss.scm | 67 ++++++++++++++++++++++++++++++++++++++++++++ >>> 1 file changed, 67 insertions(+) >> >> Unfortunately, this failed to build: >> >> error: in phase 'check': uncaught exception: >> %exception #<&invoke-error program: "faketime" arguments: ("2024-08-17" "./nss/tests/all.sh") exit-status: 1 term-signal: #f stop-signal: #f> >> phase `check' failed after 1983.7 seconds >> command "faketime" "2024-08-17" "./nss/tests/all.sh" failed with status 1 >> builder for `/gnu/store/nhzx27ndgbhsbl0kjnv49xsy3xdy0a66-nss-rapid-3.103.drv' failed with exit code 1 >> build of /gnu/store/nhzx27ndgbhsbl0kjnv49xsy3xdy0a66-nss-rapid-3.103.drv failed >> View build log at '/var/log/guix/drvs/nh/zx27ndgbhsbl0kjnv49xsy3xdy0a66-nss-rapid-3.103.drv.gz'. >> guix build: error: build of `/gnu/store/nhzx27ndgbhsbl0kjnv49xsy3xdy0a66-nss-rapid-3.103.drv' failed > >Hrm. The build log was truncated and I could not find the actual >errors. There were two test suite failures... :/ > >I tried to build it again and it worked this time... hrm. > >live well, > vagrant [-- Attachment #2: Type: text/html, Size: 2456 bytes --] ^ permalink raw reply [flat|nested] 33+ messages in thread
* [bug#71832] [PATCH v6 2/3] gnu: Add nss-rapid. 2024-08-17 23:51 ` Ian Eure @ 2024-08-18 2:00 ` Vagrant Cascadian 0 siblings, 0 replies; 33+ messages in thread From: Vagrant Cascadian @ 2024-08-18 2:00 UTC (permalink / raw) To: Ian Eure, 71832; +Cc: guix-security [-- Attachment #1: Type: text/plain, Size: 733 bytes --] On 2024-08-17, Ian Eure wrote: > Thank you for taking a look. It seems like the build process crashed > when running the extensive test suite. Both these packages are > resource-intensive to build. A machine with 16gb RAM and no swap will > OOM, but a 24gb machine can complete them. Perhaps there's a clue in > dmesg? I got a successful build of both nss-rapid and librewolf even only with 16gb of ram and 2.5gb of swap (maybe newer versions ... actually use less resources?!) ... it just took two tries to build nss-rapid! :) Have not actually run it yet... because foolishly I built it on a headless system and need to transfer it over somewhere else to actually test it... but so far looks promising. live well, vagrant [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 227 bytes --] ^ permalink raw reply [flat|nested] 33+ messages in thread
* [bug#71832] [PATCH v6 2/3] gnu: Add nss-rapid. 2024-08-17 19:32 ` [bug#71832] [PATCH v6 2/3] gnu: Add nss-rapid Ian Eure 2024-08-17 22:46 ` Vagrant Cascadian @ 2024-08-18 3:38 ` Vagrant Cascadian 2024-08-18 3:48 ` Ian Eure 1 sibling, 1 reply; 33+ messages in thread From: Vagrant Cascadian @ 2024-08-18 3:38 UTC (permalink / raw) To: Ian Eure; +Cc: 71832, guix-security [-- Attachment #1: Type: text/plain, Size: 1510 bytes --] On 2024-08-17, Ian Eure wrote: > diff --git a/gnu/packages/nss.scm b/gnu/packages/nss.scm > index 9224a8ed5a..1a684e6146 100644 > --- a/gnu/packages/nss.scm > +++ b/gnu/packages/nss.scm ... > +;; nss should track ESRs, but currently doesn't. 3.102.1 is the current ESR. > + > (define-public nss > (package > (name "nss") Though I largely agree with the logic (e.g. nss *should* probably be packaging ESR versions in general)... it seems a little weird to include a comment about what the packaging for nss *should* do, even though it is not (yet) doing it... similar with embedding a specific "current" version, which will obviously become inaccurate before too long... Alternately, maybe moving the comment to where the nss version is actually defined; to give someone pause when considering updating the version? Or maybe this belongs in a separate discussion on guix-devel and/or bug? > +;; nss-rapid tracks the rapid release channel. Unless your package requires a > +;; newer version, you should prefer the `nss' package, which tracks the ESR > +;; channel. > +;; > +;; See https://wiki.mozilla.org/NSS:Release_Versions > +;; and https://wiki.mozilla.org/Rapid_Release_Model > + > +(define-public nss-rapid Mixed feelings on rapid vs. latest ... latest is a bit more consistent with other guix packages, though "rapid" is the terminology that upstream uses here. Both those points are, in my opinion, quite minor; I would not want to block on those points alone! live well, vagrant [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 227 bytes --] ^ permalink raw reply [flat|nested] 33+ messages in thread
* [bug#71832] [PATCH v6 2/3] gnu: Add nss-rapid. 2024-08-18 3:38 ` Vagrant Cascadian @ 2024-08-18 3:48 ` Ian Eure 0 siblings, 0 replies; 33+ messages in thread From: Ian Eure @ 2024-08-18 3:48 UTC (permalink / raw) To: Vagrant Cascadian; +Cc: 71832, guix-security Vagrant Cascadian <vagrant@debian.org> writes: > [[PGP Signed Part:Undecided]] > On 2024-08-17, Ian Eure wrote: >> diff --git a/gnu/packages/nss.scm b/gnu/packages/nss.scm >> index 9224a8ed5a..1a684e6146 100644 >> --- a/gnu/packages/nss.scm >> +++ b/gnu/packages/nss.scm > ... >> +;; nss should track ESRs, but currently doesn't. 3.102.1 is >> the current ESR. >> + >> (define-public nss >> (package >> (name "nss") > > Though I largely agree with the logic (e.g. nss *should* > probably be > packaging ESR versions in general)... it seems a little weird to > include > a comment about what the packaging for nss *should* do, even > though it > is not (yet) doing it... similar with embedding a specific > "current" > version, which will obviously become inaccurate before too > long... > > Alternately, maybe moving the comment to where the nss version > is > actually defined; to give someone pause when considering > updating the > version? > > Or maybe this belongs in a separate discussion on guix-devel > and/or bug? > I started a discussion about nss earlier this year[1], and some of the changes in this patch set are a result of that. The long and short of it is that nss should track ESRs only, and it could do that now, but the process to update it is murky to me due to it causing a lot of rebuilds. I asked for some advice on that a couple days ago[2]. The comment is left in the hopes that a well-meaning contributor doesn’t update it to a non-ESR version before the ESR updates can be worked out, which would set the timeline for that change back by a year. If you have guidance on how to update a package low in the graph, I’d appreciate hearing! > >> +;; nss-rapid tracks the rapid release channel. Unless your >> package requires a >> +;; newer version, you should prefer the `nss' package, which >> tracks the ESR >> +;; channel. >> +;; >> +;; See https://wiki.mozilla.org/NSS:Release_Versions >> +;; and https://wiki.mozilla.org/Rapid_Release_Model >> + >> +(define-public nss-rapid > > Mixed feelings on rapid vs. latest ... latest is a bit more > consistent > with other guix packages, though "rapid" is the terminology that > upstream uses here. > Yes, agreed that the terminology situation isn’t ideal. I don’t have a strong preference, but neither is there concensus around "latest." In the absence of strong concensus, and to avoid bikeshedding, I opted for reusing upstream terminology, but clarifying that in the package description and synopsis. I frankly do not care which is adopted, and it can be updated any time, since this is high in the package graph. I do think that if the package is named "nss-rapid", the synopsis/description should indicate that this is upstreams Rapid Release channel. It currently does, but would need some trivial editing should the package name change. > Both those points are, in my opinion, quite minor; I would not > want to > block on those points alone! > I agree, and I appreciate your pragmatic approach here. Thanks, — Ian [1]: https://lists.gnu.org/archive/html/guix-devel/2024-06/msg00318.html [2]: https://lists.gnu.org/archive/html/guix-devel/2024-08/msg00074.html ^ permalink raw reply [flat|nested] 33+ messages in thread
* [bug#71832] [PATCH v6 3/3] gnu: librewolf: Update to 129.0.1-1. 2024-08-17 19:32 ` [bug#71832] [PATCH v6 0/3] [SECURITY] Update LibreWolf to 129.0.1-1; add nss-rapid Ian Eure 2024-08-17 19:32 ` [bug#71832] [PATCH v6 1/3] gnu: gnuzilla: Add skr to all-mozilla-locales Ian Eure 2024-08-17 19:32 ` [bug#71832] [PATCH v6 2/3] gnu: Add nss-rapid Ian Eure @ 2024-08-17 19:32 ` Ian Eure 2024-08-18 3:46 ` [bug#71832] [PATCH v6 0/3] [SECURITY] Update LibreWolf to 129.0.1-1; add nss-rapid Vagrant Cascadian 3 siblings, 0 replies; 33+ messages in thread From: Ian Eure @ 2024-08-17 19:32 UTC (permalink / raw) To: 71832; +Cc: Ian Eure, guix-security * gnu/packages/librewolf.scm (librewolf): Update to 129.0.1-1. Change-Id: Iefeff2ea7016e8d55313b55dd97179f80bcead1b --- gnu/packages/librewolf.scm | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/gnu/packages/librewolf.scm b/gnu/packages/librewolf.scm index 45fbb84e4f..c7487b1259 100644 --- a/gnu/packages/librewolf.scm +++ b/gnu/packages/librewolf.scm @@ -117,9 +117,9 @@ (define (librewolf-source-origin version hash) (define computed-origin-method (@@ (guix packages) computed-origin-method)) (define librewolf-source - (let* ((ff-src (firefox-source-origin "126.0.1" "0fr679rcwshwpfxidc55b2xsn4pmrr7p9ix4rr2mv2k7kwsjcc7n")) - (version "126.0.1-1") - (lw-src (librewolf-source-origin version "0cac80073vkzd85ai9rbnwixs1h9bpy4dj2ri6jxdlqsy5d663km"))) + (let* ((ff-src (firefox-source-origin "129.0.1" "0wy0fn0pavlhlkdybr59hhbn5ng0zn56mxa7gsknf8f2whiyipwx")) + (version "129.0.1-1") + (lw-src (librewolf-source-origin version "0pvv3v23q31hdjvqi1f3cqfyjrb8dbrrbfwxj2wacak1g0mzbxf4"))) (origin (method computed-origin-method) @@ -215,12 +215,12 @@ (define rust-librewolf rust) ; 1.75 is the default in Guix, 1.65 is the minimum. ;; Update this id with every update to its release date. ;; It's used for cache validation and therefore can lead to strange bugs. ;; ex: date '+%Y%m%d%H%M%S' -(define %librewolf-build-id "20240607212143") +(define %librewolf-build-id "20240817075827") (define-public librewolf (package (name "librewolf") - (version "126.0.1-1") + (version "129.0.1-1") (source librewolf-source) (build-system gnu-build-system) (arguments @@ -691,7 +691,7 @@ (define (runpaths-of-input label) mesa mit-krb5 nspr - nss/fixed + nss-rapid pango pciutils pipewire -- 2.45.2 ^ permalink raw reply related [flat|nested] 33+ messages in thread
* [bug#71832] [PATCH v6 0/3] [SECURITY] Update LibreWolf to 129.0.1-1; add nss-rapid 2024-08-17 19:32 ` [bug#71832] [PATCH v6 0/3] [SECURITY] Update LibreWolf to 129.0.1-1; add nss-rapid Ian Eure ` (2 preceding siblings ...) 2024-08-17 19:32 ` [bug#71832] [PATCH v6 3/3] gnu: librewolf: Update to 129.0.1-1 Ian Eure @ 2024-08-18 3:46 ` Vagrant Cascadian 2024-08-20 5:46 ` bug#71832: " Vagrant Cascadian 3 siblings, 1 reply; 33+ messages in thread From: Vagrant Cascadian @ 2024-08-18 3:46 UTC (permalink / raw) To: Ian Eure; +Cc: 71832, guix-security [-- Attachment #1: Type: text/plain, Size: 768 bytes --] On 2024-08-17, Ian Eure wrote: > - Updates LibreWolf to 129.0.1-1, the latest upstream. > - Updates nss-rapid, to version 3.103, the latest upstream. > - Adds the skr locale to all-mozilla-locales. > - Backs out improvements not directly related to updating the browser version, to make review easier. It builds and runs fine for me, so overall I think this should be merged sooner than later (despite some of my minor comments on the nss-rapid patch)... given the previous iterations of patches over several months and the growing list of CVE fixes... If there are no strong objections and nobody beats me to it, I will merge these patches in the next couple days. Thanks for working on librewolf! Sorry the update process has been lagging! live well, vagrant [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 227 bytes --] ^ permalink raw reply [flat|nested] 33+ messages in thread
* bug#71832: [PATCH v6 0/3] [SECURITY] Update LibreWolf to 129.0.1-1; add nss-rapid 2024-08-18 3:46 ` [bug#71832] [PATCH v6 0/3] [SECURITY] Update LibreWolf to 129.0.1-1; add nss-rapid Vagrant Cascadian @ 2024-08-20 5:46 ` Vagrant Cascadian 0 siblings, 0 replies; 33+ messages in thread From: Vagrant Cascadian @ 2024-08-20 5:46 UTC (permalink / raw) To: Ian Eure; +Cc: 71832-done, guix-security [-- Attachment #1: Type: text/plain, Size: 803 bytes --] On 2024-08-17, Vagrant Cascadian wrote: > On 2024-08-17, Ian Eure wrote: >> - Updates LibreWolf to 129.0.1-1, the latest upstream. >> - Updates nss-rapid, to version 3.103, the latest upstream. >> - Adds the skr locale to all-mozilla-locales. >> - Backs out improvements not directly related to updating the browser version, to make review easier. > > It builds and runs fine for me, so overall I think this should be merged > sooner than later (despite some of my minor comments on the nss-rapid > patch)... given the previous iterations of patches over several months > and the growing list of CVE fixes... > > If there are no strong objections and nobody beats me to it, I will > merge these patches in the next couple days. Pushed as 58faaf4eaadafa09a97ab31103eb54bd2076a699. live well, vagrant [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 227 bytes --] ^ permalink raw reply [flat|nested] 33+ messages in thread
end of thread, other threads:[~2024-08-20 5:47 UTC | newest]
Thread overview: 33+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-06-29 3:57 [bug#71832] [PATCH 0/2] Add nss-latest; updte Librewolf to 127.0.2-2 Ian Eure
2024-06-29 3:59 ` [bug#71832] [PATCH 1/2] gnu: Add nss-latest Ian Eure
2024-06-29 3:59 ` [bug#71832] [PATCH 2/2] gnu: librewolf: Update to 127.0.2-1 Ian Eure
2024-06-29 17:22 ` [bug#71832] [PATCH v2 0/2] Add nss-latest; update Librewolf to 127.0.2-2 Ian Eure
2024-06-29 17:22 ` [bug#71832] [PATCH v2 1/2] gnu: Add nss-latest Ian Eure
2024-06-29 17:22 ` [bug#71832] [PATCH v2 2/2] gnu: librewolf: Update to 127.0.2-1 Ian Eure
2024-07-02 0:21 ` [bug#71832] [PATCH v3 0/2] Add nss-rapid; updte Librewolf to 127.0.2-2 Ian Eure
2024-07-02 0:21 ` [bug#71832] [PATCH v3 1/2] gnu: Add nss-rapid Ian Eure
2024-07-02 0:21 ` [bug#71832] [PATCH v3 2/2] gnu: librewolf: Update to 127.0.2-1 Ian Eure
2024-07-08 8:55 ` [bug#71832] Closing one bug Andreas Enge
2024-07-01 19:53 ` [bug#71882] [PATCH] gnu: librewolf: Fix building on aarch64-linux Remco van 't Veer
[not found] ` <handler.71882.D71882.172042897930179.notifdone@debbugs.gnu.org>
2024-07-08 10:16 ` [bug#71882] closed (Closing one bug) Remco van 't Veer
2024-07-17 3:06 ` [bug#71832] [PATCH v4 0/3] Add nss-rapid; update Librewolf to 128.0-2 Ian Eure
2024-07-17 3:06 ` [bug#71832] [PATCH v4 1/3] gnu: Add nss-rapid Ian Eure
2024-07-17 3:06 ` [bug#71832] [PATCH v4 2/3] gnu: gnuzilla: Add skr to all-mozilla-locales Ian Eure
2024-07-17 3:06 ` [bug#71832] [PATCH v4 3/3] gnu: librewolf: Update to 128.0-2 Ian Eure
2024-07-21 16:17 ` [bug#71832] [PATCH 0/2] Add nss-latest; updte Librewolf to 127.0.2-2 Ian Eure
2024-07-31 3:54 ` [bug#71832] [PATCH v5 0/3] [SECURITY] Add nss-rapid; update Librewolf to 128.0.3-1 Ian Eure
2024-07-31 3:54 ` [bug#71832] [PATCH v5 1/3] gnu: Add nss-rapid Ian Eure
2024-07-31 3:55 ` [bug#71832] [PATCH v5 2/3] gnu: gnuzilla: Add skr to all-mozilla-locales Ian Eure
2024-07-31 3:55 ` [bug#71832] [PATCH v5 3/3] gnu: librewolf: Update to 128.0.3-1 Ian Eure
2024-08-17 19:32 ` [bug#71832] [PATCH v6 0/3] [SECURITY] Update LibreWolf to 129.0.1-1; add nss-rapid Ian Eure
2024-08-17 19:32 ` [bug#71832] [PATCH v6 1/3] gnu: gnuzilla: Add skr to all-mozilla-locales Ian Eure
2024-08-17 19:32 ` [bug#71832] [PATCH v6 2/3] gnu: Add nss-rapid Ian Eure
2024-08-17 22:46 ` Vagrant Cascadian
2024-08-17 23:33 ` Vagrant Cascadian
2024-08-17 23:51 ` Ian Eure
2024-08-18 2:00 ` Vagrant Cascadian
2024-08-18 3:38 ` Vagrant Cascadian
2024-08-18 3:48 ` Ian Eure
2024-08-17 19:32 ` [bug#71832] [PATCH v6 3/3] gnu: librewolf: Update to 129.0.1-1 Ian Eure
2024-08-18 3:46 ` [bug#71832] [PATCH v6 0/3] [SECURITY] Update LibreWolf to 129.0.1-1; add nss-rapid Vagrant Cascadian
2024-08-20 5:46 ` bug#71832: " Vagrant Cascadian
Code repositories for project(s) associated with this external index https://git.savannah.gnu.org/cgit/guix.git This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.