Icecat sandbox causes issues with fonts in --pure env

Hello,

whenever I'm trying to run 'guix environment --pure --ad-hoc icecat --

icecat' or similar commands in a --container I'm ending up with some

tofu ugly font fallback box glyphs in the app. However everything works

fine running 'guix environment --ad-hoc icecat -- icecat'. Moreover I've

noticed that when I edit the default value of

"security.sandbox.content.level" from 4 to 2 in "about:config" then the

problem disappear and the fonts are properly displayed in --pure and

--container env. I was trying to install all possible fonts, running

'fc-cache -rfv' and analyze the icecat logs with "MOZ_SANDBOX_LOGGING=1"

to include blocking paths into the

"security.sandbox.content.read_path_whitelist" but still I couldn't fix

this issue with the icecat default sandbox level. Any ideas how to solve

it in Guix System and what are the side effects of using

"security.sandbox.content.level=2" in --pure env?

Kind regards!

Martin

security.sandbox.content.read_path_whitelist

Hi,

The example about ’eolie’ adapted to your usecase, does it not work?

See:

All the best,

simon

Hi Simon,

no it doesn't help in this case and in general eolie package seems to be

broken because it doesn't work even with the simple 'guix environment

--ad-hoc eolie --  eolie':

Traceback (most recent call last):

  File

"/gnu/store/w47sa5q3vki5siwk5lb62ld4ksxa5gcn-eolie-0.9.101/bin/.eolie-real",

line 20, in <module>

    from eolie.application import Application

  File

"/gnu/store/w47sa5q3vki5siwk5lb62ld4ksxa5gcn-eolie-0.9.101/lib/python3.8/site-packages/eolie/application.py",

line 19, in <module>

    gi.require_version("Handy", "1")

  File

"/gnu/store/597f7p79vyxjhwsv2qqnn76hx107xgj1-python-pygobject-3.34.0/lib/python3.8/site-packages/gi/__init__.py",

line 129, in require_version

    raise ValueError('Namespace %s not available' % namespace)

ValueError: Namespace Handy not available

Kind regards!

Martin

On 3/12/21 9:53 AM, zimoun wrote:

Hi,

For discussion, please CC the bug.

On Fri, 12 Mar 2021 at 10:14, Martin <smartin@disroot.org> wrote:

The manual example is:

from https://guix.gnu.org/manual/devel/en/guix.html#Invoking-guix-environment

Does it not work for you?

Then it should be adapted for your use-case.

All the best,

simon

Hi,

On Fri, 12 Mar 2021 at 10:15, Martin via Bug reports for GNU Guix <bug-guix@gnu.org> wrote:

Indeed, the package eolie is broken; which is another issue–and BTW

thanks for pointing this out. Back to your initial report about icecat,

what about something like that:

All the best,

simon

On 3/12/21 10:51 AM, zimoun wrote:

It's still not relevant to my issue. To run icecat using your example

you should change one parameter to

"--share=$HOME/.mozilla=$HOME/.mozilla" but again with the default

"security.sandbox.content.level=4" the fonts will be tofued. I think

once the issue could be fixed with simpler command, i.e. 'guix

environment --pure --ad-hoc icecat -- icecat' than it would be easier to

port the solution on the --container case.

Kind regards!

Martin

Problem fixed with the newest IceCat v91.2.0-guix0-preview1 in the

 guix c1ca853

    repository URL: https://git.savannah.gnu.org/git/guix.git

    branch: master

    commit: c1ca85323d5246fc805a31e03b4164b8da08e930

Hi,

Martin via Bug reports for GNU Guix <bug-guix@gnu.org> writes:

Thanks for letting us know! I'm closing this bug now.

Regards,

Mark

--

Disinformation flourishes because many people care deeply about injustice

but very few check the facts. Ask me about https://stallmansupport.org.