[PATCH v5 0/3] [SECURITY] Add nss-rapid; update Librewolf to 128.0.3-1

  • Done
  • quality assurance status badge
Details
3 participants
  • Andreas Enge
  • Ian Eure
  • Vagrant Cascadian
Owner
unassigned
Submitted by
Ian Eure
Severity
normal
I
I
Ian Eure wrote on 29 Jun 05:57 +0200
[PATCH 0/2] Add nss-latest; updte Librewolf to 127.0.2-2.
(address . guix-patches@gnu.org)(name . Ian Eure)(address . ian@retrospec.tv)
20240629035716.21504-1-ian@retrospec.tv
This patch series begins implementing my proposal for nss[1], by adding
nss-latest (at version 3.101). When the next ESR is out, I’ll update and
ungraft the other nss, as proposed.

It also updates Librewolf to 127.0.2-2, the latest version. Librewolf 127.x
requires nss >= 3.100, so both patches are combined in this series. LW also
builds with Rust 1.77 now, since that’s the new minimum version (and the
default version used by upstream Firefox builds).


Ian Eure (2):
gnu: Add nss-latest.
gnu: librewolf: Update to 127.0.2-1.

gnu/packages/librewolf.scm | 1039 ++++++++++++++++++------------------
gnu/packages/nss.scm | 67 ++-
2 files changed, 587 insertions(+), 519 deletions(-)

--
2.45.1
I
I
Ian Eure wrote on 29 Jun 05:59 +0200
[PATCH 1/2] gnu: Add nss-latest.
(address . 71832@debbugs.gnu.org)(name . Ian Eure)(address . ian@retrospec.tv)
20240629035957.21688-1-ian@retrospec.tv
* gnu/packages/nss.scm (nss-latest): New variable.

Change-Id: Ifdc215090a20dee1bde83013852ef21b6cfd9979
---
gnu/packages/nss.scm | 67 ++++++++++++++++++++++++++++++++++++++++----
1 file changed, 61 insertions(+), 6 deletions(-)

Toggle diff (95 lines)
diff --git a/gnu/packages/nss.scm b/gnu/packages/nss.scm
index d558079f44..6b45e59ea8 100644
--- a/gnu/packages/nss.scm
+++ b/gnu/packages/nss.scm
@@ -106,6 +106,9 @@ (define-public nspr-4.32
(base32
"0v3zds1id71j5a5si42a658fjz8nv2f6zp6w4gqrqmdr6ksz8sxv"))))))
+;; nss should track ESRs, but currently doesn't. When the next ESR it out, it
+;; should get updated.
+
(define-public nss
(package
(name "nss")
@@ -153,13 +156,13 @@ (define-public nss
;; Ensure we are building for the (%current-target-system).
#$@(if (%current-target-system)
#~((string-append
- "OS_TEST="
- (string-take #$(%current-target-system)
- (string-index #$(%current-target-system) #\-)))
+ "OS_TEST="
+ (string-take #$(%current-target-system)
+ (string-index #$(%current-target-system) #\-)))
(string-append
- "KERNEL=" (cond (#$(target-hurd?) "gnu")
- (#$(target-linux?) "linux")
- (else ""))))
+ "KERNEL=" (cond (#$(target-hurd?) "gnu")
+ (#$(target-linux?) "linux")
+ (else ""))))
#~())
#$@(if (%current-target-system)
#~("CROSS_COMPILE=1")
@@ -303,6 +306,58 @@ (define-public nss/fixed
(invoke "faketime" "2024-01-23" "./nss/tests/all.sh"))
(format #t "test suite not run~%"))))))))))))
+;; nss-latest tracks the latest released version.
+
+(define-public nss-latest
+ (package
+ (inherit nss)
+ (name "nss-latest")
+ (version "3.101")
+ (source (origin
+ (inherit (package-source nss))
+ (uri (let ((version-with-underscores
+ (string-join (string-split version #\.) "_")))
+ (string-append
+ "https://ftp.mozilla.org/pub/mozilla.org/security/nss/"
+ "releases/NSS_" version-with-underscores "_RTM/src/"
+ "nss-" version ".tar.gz")))
+ (sha256
+ (base32
+ "1rw5xpclsy174znvxcb4d4zgjwadxy45mbh0wvkm3fxpnkq4i5w5"))))
+ (arguments
+ (substitute-keyword-arguments (package-arguments nss)
+ ((#:phases phases)
+ #~(modify-phases #$phases
+ (replace 'check
+ (lambda* (#:key tests? #:allow-other-keys)
+ (if tests?
+ (begin
+ ;; Use 127.0.0.1 instead of $HOST.$DOMSUF as HOSTADDR for
+ ;; testing. The latter requires a working DNS or /etc/hosts.
+ (setenv "DOMSUF" "localdomain")
+ (setenv "USE_IP" "TRUE")
+ (setenv "IP_ADDRESS" "127.0.0.1")
+
+ ;; This specific test is looking at performance "now
+ ;; verify that we can quickly dump a database", and
+ ;; we're not testing performance here (especially
+ ;; since we're using faketime), so raise the
+ ;; threshold
+ (substitute* "nss/tests/dbtests/dbtests.sh"
+ ((" -lt 5") " -lt 50"))
+
+ ;; Since the test suite is very lengthy, run the test
+ ;; suite once, not thrice as done by default, by
+ ;; selecting only the 'standard' cycle.
+ (setenv "NSS_CYCLES" "standard")
+
+ ;; The "PayPalEE.cert" certificate expires every six months,
+ ;; leading to test failures:
+ ;; <https://bugzilla.mozilla.org/show_bug.cgi?id=609734>. To
+ ;; work around that, set the time to roughly the release date.
+ (invoke "faketime" "2024-01-23" "./nss/tests/all.sh"))
+ (format #t "test suite not run~%"))))))))))
+
(define-public nsncd
(package
(name "nsncd")
--
2.45.1
I
I
Ian Eure wrote on 29 Jun 05:59 +0200
[PATCH 2/2] gnu: librewolf: Update to 127.0.2-1.
(address . 71832@debbugs.gnu.org)(name . Ian Eure)(address . ian@retrospec.tv)
20240629035957.21688-2-ian@retrospec.tv
* gnu/packages/librewolf.scm (librewolf): Update to 127.0.2-1. Reorganize
module to improve usability and reduce duplication. The Rust package and
build ID are now at the top of the file. The librewolf-source variable has
been replaced with the make-librewolf-source procedure, centralizing versions
& hashes in the librewolf package definition. Dedent some of the package’s
arguments to improve readability.

Change-Id: I15f8a2aa1fae07e0497ab5511d10af0c1f70cc2e
---
gnu/packages/librewolf.scm | 1039 ++++++++++++++++++------------------
1 file changed, 526 insertions(+), 513 deletions(-)

Toggle diff (399 lines)
diff --git a/gnu/packages/librewolf.scm b/gnu/packages/librewolf.scm
index c84bcaf3ce..7f8579e8dd 100644
--- a/gnu/packages/librewolf.scm
+++ b/gnu/packages/librewolf.scm
@@ -93,6 +93,18 @@ (define-module (gnu packages librewolf)
#:use-module (gnu packages xdisorg)
#:use-module (gnu packages xorg))
+;; Define the versions of rust needed to build librewolf, trying to match
+;; upstream. See the file taskcluster/kinds/toolchain/rust.yml at
+;; https://searchfox.org under the particular firefox release, like
+;; mozilla-esr102.
+;; 1.75 is the default in Guix, 1.77 is the minimum for Librewolf.
+(define rust-librewolf rust-1.77)
+
+;; Update this id with every update to its release date.
+;; It's used for cache validation and therefore can lead to strange bugs.
+;; ex: date '+%Y%m%d%H%M%S'
+(define %librewolf-build-id "20240626133423")
+
(define (firefox-source-origin version hash)
(origin
(method url-fetch)
@@ -114,11 +126,14 @@ (define (librewolf-source-origin version hash)
(define computed-origin-method (@@ (guix packages) computed-origin-method))
-(define librewolf-source
- (let* ((ff-src (firefox-source-origin "126.0.1" "0fr679rcwshwpfxidc55b2xsn4pmrr7p9ix4rr2mv2k7kwsjcc7n"))
- (version "126.0.1-1")
- (lw-src (librewolf-source-origin version "0cac80073vkzd85ai9rbnwixs1h9bpy4dj2ri6jxdlqsy5d663km")))
-
+(define* (make-librewolf-source version #:key firefox-hash librewolf-hash)
+ (let* ((ff-src (firefox-source-origin
+ (car (string-split version #\-))
+ firefox-hash))
+ (version version)
+ (lw-src (librewolf-source-origin
+ version
+ librewolf-hash)))
(origin
(method computed-origin-method)
(file-name (string-append "librewolf-" version ".source.tar.gz"))
@@ -204,523 +219,521 @@ (define librewolf-source
".source.tar.gz")
#$output))))))))
-;; Define the versions of rust needed to build librewolf, trying to match
-;; upstream. See the file taskcluster/ci/toolchain/rust.yml at
-;; https://searchfox.org under the particular firefox release, like
-;; mozilla-esr102.
-(define rust-librewolf rust) ; 1.75 is the default in Guix, 1.65 is the minimum.
-
-;; Update this id with every update to its release date.
-;; It's used for cache validation and therefore can lead to strange bugs.
-;; ex: date '+%Y%m%d%H%M%S'
-(define %librewolf-build-id "20240607212143")
-
(define-public librewolf
- (package
- (name "librewolf")
- (version "126.0.1-1")
- (source librewolf-source)
- (build-system gnu-build-system)
- (arguments
- (list
- #:configure-flags #~(let ((clang #$(this-package-native-input "clang")))
- `("--enable-application=browser"
-
- ;; Configuration
- "--without-wasm-sandboxed-libraries"
- "--with-system-jpeg"
- "--with-system-zlib"
- "--with-system-png"
- "--with-system-webp"
- "--with-system-icu"
- "--with-system-libvpx"
- "--with-system-libevent"
- "--with-system-ffi"
- "--enable-system-pixman"
- "--enable-jemalloc"
-
- ;; see https://bugs.gnu.org/32833
- "--with-system-nspr"
- "--with-system-nss"
-
- ,(string-append "--with-clang-path=" clang
- "/bin/clang")
- ,(string-append "--with-libclang-path=" clang
- "/lib")
-
- ;; Distribution
- "--with-distribution-id=org.guix"
- "--with-app-name=librewolf"
- "--with-app-basename=LibreWolf"
- "--with-branding=browser/branding/librewolf"
-
- ;; Features
- "--disable-tests"
- "--disable-updater"
- "--enable-pulseaudio"
- "--disable-crashreporter"
- "--allow-addon-sideload"
- "--with-unsigned-addon-scopes=app,system"
- "--disable-eme"
-
- ;; Build details
- "--disable-debug"
- "--enable-rust-simd"
- "--enable-release"
- "--enable-optimize"
- "--enable-strip"
- "--enable-hardening"
- "--disable-elf-hack"))
- #:imported-modules %cargo-utils-modules
- #:modules `((ice-9 regex)
- (ice-9 string-fun)
- (ice-9 ftw)
- (srfi srfi-1)
- (srfi srfi-26)
- (rnrs bytevectors)
- (rnrs io ports)
- (guix elf)
- (guix build gremlin)
- ,@%gnu-build-system-modules)
- #:phases #~(modify-phases %standard-phases
- (add-after 'unpack 'fix-preferences
- (lambda* (#:key inputs #:allow-other-keys)
- (let ((port (open-file "browser/app/profile/firefox.js"
- "a")))
- (define (write-setting key value)
- (format port "~%pref(\"~a\", ~a);~%" key value)
- (format #t
+ (let ((version "127.0.2-2"))
+ (package
+ (name "librewolf")
+ (version version)
+ (source (make-librewolf-source
+ version
+ #:firefox-hash
+ "1s73fdp7k60058ylyvlixq13k5hfbmj6k1y42fmzqlpg7n62lyqb"
+ #:librewolf-hash
+ "1f4xz496x1nf7lmvk50hakj9p6q0kzxl5f9s2k0b6kczvyc8gw5n"))
+
+ (build-system gnu-build-system)
+ (arguments
+ (list
+ #:configure-flags
+ #~(let ((clang #$(this-package-native-input "clang")))
+ `("--enable-application=browser"
+
+ ;; Configuration
+ "--without-wasm-sandboxed-libraries"
+ "--with-system-jpeg"
+ "--with-system-zlib"
+ "--with-system-png"
+ "--with-system-webp"
+ "--with-system-icu"
+ "--with-system-libvpx"
+ "--with-system-libevent"
+ "--with-system-ffi"
+ "--enable-system-pixman"
+ "--enable-jemalloc"
+
+ ;; see https://bugs.gnu.org/32833
+ "--with-system-nspr"
+ "--with-system-nss"
+
+ ,(string-append "--with-clang-path=" clang
+ "/bin/clang")
+ ,(string-append "--with-libclang-path=" clang
+ "/lib")
+
+ ;; Distribution
+ "--with-distribution-id=org.guix"
+ "--with-app-name=librewolf"
+ "--with-app-basename=LibreWolf"
+ "--with-branding=browser/branding/librewolf"
+
+ ;; Features
+ "--disable-tests"
+ "--disable-updater"
+ "--enable-pulseaudio"
+ "--disable-crashreporter"
+ "--allow-addon-sideload"
+ "--with-unsigned-addon-scopes=app,system"
+ "--disable-eme"
+
+ ;; Build details
+ "--disable-debug"
+ "--enable-rust-simd"
+ "--enable-release"
+ "--enable-optimize"
+ "--enable-strip"
+ "--enable-hardening"
+ "--disable-elf-hack"))
+ #:imported-modules %cargo-utils-modules
+ #:modules `((ice-9 regex)
+ (ice-9 string-fun)
+ (ice-9 ftw)
+ (srfi srfi-1)
+ (srfi srfi-26)
+ (rnrs bytevectors)
+ (rnrs io ports)
+ (guix elf)
+ (guix build gremlin)
+ ,@%gnu-build-system-modules)
+ #:phases
+ #~(modify-phases %standard-phases
+ (add-after 'unpack 'fix-preferences
+ (lambda* (#:key inputs #:allow-other-keys)
+ (let ((port (open-file "browser/app/profile/firefox.js"
+ "a")))
+ (define (write-setting key value)
+ (format port "~%pref(\"~a\", ~a);~%" key value)
+ (format #t
"fix-preferences: setting value of ~a to ~a~%" key
value))
- ;; We should allow the sandbox to read the store directory,
- ;; because the sandbox has access to /usr on FHS distros.
- (write-setting
- "security.sandbox.content.read_path_whitelist"
- (string-append "\""
- (%store-directory) "/\""))
-
- ;; XDG settings should be managed by Guix.
- (write-setting "browser.shell.checkDefaultBrowser"
- "false")
- (close-port port))))
- (add-after 'fix-preferences 'fix-ffmpeg-runtime-linker
- (lambda* (#:key inputs #:allow-other-keys)
- (let* ((ffmpeg (assoc-ref inputs "ffmpeg"))
- (libavcodec (string-append ffmpeg
- "/lib/libavcodec.so")))
- ;; Arrange to load libavcodec.so by its absolute file name.
- (substitute* "dom/media/platforms/ffmpeg/FFmpegRuntimeLinker.cpp"
- (("libavcodec\\.so")
- libavcodec)))))
- (add-after 'patch-source-shebangs 'patch-cargo-checksums
- (lambda _
- (use-modules (guix build cargo-utils))
- (let ((null-hash
- ;; This is the SHA256 output of an empty string.
- (string-append
- "e3b0c44298fc1c149afbf4c8996fb924"
- "27ae41e4649b934ca495991b7852b855")))
- (for-each (lambda (file)
- (format #t
+ ;; We should allow the sandbox to read the store directory,
+ ;; because the sandbox has access to /usr on FHS distros.
+ (write-setting
+ "security.sandbox.content.read_path_whitelist"
+ (string-append "\""
+ (%store-directory) "/\""))
+
+ ;; XDG settings should be managed by Guix.
+ (write-setting "browser.shell.checkDefaultBrowser"
+ "false")
+ (close-port port))))
+ (add-after 'fix-preferences 'fix-ffmpeg-runtime-linker
+ (lambda* (#:key inputs #:allow-other-keys)
+ (let* ((ffmpeg (assoc-ref inputs "ffmpeg"))
+ (libavcodec (string-append ffmpeg
+ "/lib/libavcodec.so")))
+ ;; Arrange to load libavcodec.so by its absolute file name.
+ (substitute* "dom/media/platforms/ffmpeg/FFmpegRuntimeLinker.cpp"
+ (("libavcodec\\.so")
+ libavcodec)))))
+ (add-after 'patch-source-shebangs 'patch-cargo-checksums
+ (lambda _
+ (use-modules (guix build cargo-utils))
+ (let ((null-hash
+ ;; This is the SHA256 output of an empty string.
+ (string-append
+ "e3b0c44298fc1c149afbf4c8996fb924"
+ "27ae41e4649b934ca495991b7852b855")))
+ (for-each (lambda (file)
+ (format #t
"patch-cargo-checksums: patching checksums in ~a~%"
file)
- (substitute* file
- (("(checksum = )\".*\"" all name)
- (string-append name "\"" null-hash
- "\""))))
- (find-files "." "Cargo\\.lock$"))
- (for-each generate-all-checksums
- '("build"
- "dom/media"
- "dom/webauthn"
- "gfx"
- "intl"
- "js"
- "media"
- "modules"
- "mozglue/static/rust"
- "netwerk"
- "remote"
- "security/manager/ssl"
- "servo"
- "storage"
- "third_party/rust"
- "toolkit"
- "xpcom/rust"
- "services")))))
- (add-after 'patch-cargo-checksums 'remove-cargo-frozen-flag
- (lambda _
- ;; Remove --frozen flag from cargo invokation, otherwise it'll
- ;; complain that it's not able to change Cargo.lock.
- ;; https://bugzilla.mozilla.org/show_bug.cgi?id=1726373
- (substitute* "build/RunCbindgen.py"
- (("args.append\\(\"--frozen\"\\)") "pass"))))
- (delete 'bootstrap)
- (add-before 'configure 'patch-SpeechDispatcherService.cpp
- (lambda _
- (let* ((lib "libspeechd.so.2")
- (file (string-append
- "dom/media/webspeech/synth/"
- "speechd/SpeechDispatcherService.cpp"))
- (old-content (call-with-input-file file
- get-string-all)))
- (substitute
- file
- `((,(format #f "~s" lib) unquote
- (lambda (line _)
- (string-replace-substring
- line lib
- (string-append #$speech-dispatcher
- "/lib/" lib))))))
- (if (string=? old-content
- (call-with-input-file file
- get-string-all))
- (error
- "substitute did nothing, phase requires an update")))))
- (add-before 'configure 'set-build-id
- ;; Build will write the timestamp to output, which is harmful
- ;; for reproducibility, so change it to a fixed date. Use a
- ;; separate phase for easier modification with inherit.
- (lambda _
- (setenv "MOZ_BUILD_DATE"
- #$%librewolf-build-id)))
- (replace 'configure
- (lambda* (#:key inputs outputs configure-flags
- #:allow-other-keys)
- (setenv "AUTOCONF"
- (string-append (assoc-ref inputs "autoconf")
- "/bin/autoconf"))
- (setenv "SHELL"
- (which "bash"))
- (setenv "CONFIG_SHELL"
- (which "bash"))
- (setenv "MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE"
- "system")
- ;; This should use the host info probably (does it
- ;; build on non-x86_64 though?)
- (setenv "GUIX_PYTHONPATH"
- (string-append (getcwd)
- "/obj-x86_64-pc-linux-gnu/_virtualenvs/build"))
-
- ;; Use Clang, Clang is 2x faster than GCC
- (setenv "AR" "llvm-ar")
- (setenv "NM" "llvm-nm")
- (setenv "CC" "clang")
- (setenv "CXX" "clang++")
- (setenv "MOZ_NOSPAM" "1")
- (setenv "MOZ_APP_NAME" "librewolf")
-
- (setenv "MOZBUILD_STATE_PATH"
- (getcwd))
-
- (let* ((mozconfig (string-append (getcwd) "/mozconfig"))
- (out (assoc-ref outputs "out"))
- (flags (cons (string-append "--prefix=" out)
- configure-flags)))
- (format #t "build directory: ~s~%"
- (getcwd))
- (format #t "configure flags: ~s~%" flags)
-
- (define write-flags
- (lambda flags
- (display (string-join (map (cut string-append
- "ac_add_options " <>)
- flags) "\n"))
- (display "\n")))
- (with-output-to-file mozconfig
- (lambda ()
- (apply write-flags flags)
- ;; The following option unsets Telemetry
- ;; Reporting. With the Addons Fiasco,
- ;; Mozilla was found to be collecting
- ;; user's data, including saved passwords
- ;; and web form data, without users
- ;; consent. Mozilla was also found
- ;; shipping updates to systems without
- ;; the user's knowledge or permission.
- ;; As a result of this, use the following
- ;; command to permanently disable
- ;; telemetry reporting.
- (display "unset MOZ_TELEME
This message was truncated. Download the full message here.
I
I
Ian Eure wrote on 29 Jun 19:22 +0200
[PATCH v2 2/2] gnu: librewolf: Update to 127.0.2-1.
(address . 71832@debbugs.gnu.org)(name . Ian Eure)(address . ian@retrospec.tv)
20240629172209.26420-3-ian@retrospec.tv
* gnu/packages/librewolf.scm (librewolf): Update to 127.0.2-1. Reorganize
module to improve usability and reduce duplication. The Rust package and
build ID are now at the top of the file. The librewolf-source variable has
been replaced with the make-librewolf-source procedure, centralizing versions
& hashes in the librewolf package definition. Dedent some of the package’s
arguments to improve readability.

Change-Id: I15f8a2aa1fae07e0497ab5511d10af0c1f70cc2e
---
gnu/packages/librewolf.scm | 1044 ++++++++++++++++++------------------
1 file changed, 526 insertions(+), 518 deletions(-)

Toggle diff (404 lines)
diff --git a/gnu/packages/librewolf.scm b/gnu/packages/librewolf.scm
index c84bcaf3ce..a400080dcb 100644
--- a/gnu/packages/librewolf.scm
+++ b/gnu/packages/librewolf.scm
@@ -93,6 +93,18 @@ (define-module (gnu packages librewolf)
#:use-module (gnu packages xdisorg)
#:use-module (gnu packages xorg))
+;; Define the versions of rust needed to build librewolf, trying to match
+;; upstream. See the file taskcluster/kinds/toolchain/rust.yml at
+;; https://searchfox.org under the particular firefox release, like
+;; mozilla-esr102.
+;; 1.75 is the default in Guix, 1.77 is the minimum for Librewolf.
+(define rust-librewolf rust-1.77)
+
+;; Update this id with every update to its release date.
+;; It's used for cache validation and therefore can lead to strange bugs.
+;; ex: date '+%Y%m%d%H%M%S'
+(define %librewolf-build-id "20240626133423")
+
(define (firefox-source-origin version hash)
(origin
(method url-fetch)
@@ -114,11 +126,14 @@ (define (librewolf-source-origin version hash)
(define computed-origin-method (@@ (guix packages) computed-origin-method))
-(define librewolf-source
- (let* ((ff-src (firefox-source-origin "126.0.1" "0fr679rcwshwpfxidc55b2xsn4pmrr7p9ix4rr2mv2k7kwsjcc7n"))
- (version "126.0.1-1")
- (lw-src (librewolf-source-origin version "0cac80073vkzd85ai9rbnwixs1h9bpy4dj2ri6jxdlqsy5d663km")))
-
+(define* (make-librewolf-source version #:key firefox-hash librewolf-hash)
+ (let* ((ff-src (firefox-source-origin
+ (car (string-split version #\-))
+ firefox-hash))
+ (version version)
+ (lw-src (librewolf-source-origin
+ version
+ librewolf-hash)))
(origin
(method computed-origin-method)
(file-name (string-append "librewolf-" version ".source.tar.gz"))
@@ -162,11 +177,6 @@ (define librewolf-source
(("^ff_source_tarball:=.*")
(string-append "ff_source_tarball:=" #+ff-src)))
- ;; Remove encoding_rs patch, it doesn't build with Rust 1.75.
- (substitute* '("assets/patches.txt")
- (("patches/encoding_rs.patch\\\n$")
- ""))
-
;; Stage locales.
(begin
(format #t "Staging locales...~%")
@@ -204,523 +214,521 @@ (define librewolf-source
".source.tar.gz")
#$output))))))))
-;; Define the versions of rust needed to build librewolf, trying to match
-;; upstream. See the file taskcluster/ci/toolchain/rust.yml at
-;; https://searchfox.org under the particular firefox release, like
-;; mozilla-esr102.
-(define rust-librewolf rust) ; 1.75 is the default in Guix, 1.65 is the minimum.
-
-;; Update this id with every update to its release date.
-;; It's used for cache validation and therefore can lead to strange bugs.
-;; ex: date '+%Y%m%d%H%M%S'
-(define %librewolf-build-id "20240607212143")
-
(define-public librewolf
- (package
- (name "librewolf")
- (version "126.0.1-1")
- (source librewolf-source)
- (build-system gnu-build-system)
- (arguments
- (list
- #:configure-flags #~(let ((clang #$(this-package-native-input "clang")))
- `("--enable-application=browser"
-
- ;; Configuration
- "--without-wasm-sandboxed-libraries"
- "--with-system-jpeg"
- "--with-system-zlib"
- "--with-system-png"
- "--with-system-webp"
- "--with-system-icu"
- "--with-system-libvpx"
- "--with-system-libevent"
- "--with-system-ffi"
- "--enable-system-pixman"
- "--enable-jemalloc"
-
- ;; see https://bugs.gnu.org/32833
- "--with-system-nspr"
- "--with-system-nss"
-
- ,(string-append "--with-clang-path=" clang
- "/bin/clang")
- ,(string-append "--with-libclang-path=" clang
- "/lib")
-
- ;; Distribution
- "--with-distribution-id=org.guix"
- "--with-app-name=librewolf"
- "--with-app-basename=LibreWolf"
- "--with-branding=browser/branding/librewolf"
-
- ;; Features
- "--disable-tests"
- "--disable-updater"
- "--enable-pulseaudio"
- "--disable-crashreporter"
- "--allow-addon-sideload"
- "--with-unsigned-addon-scopes=app,system"
- "--disable-eme"
-
- ;; Build details
- "--disable-debug"
- "--enable-rust-simd"
- "--enable-release"
- "--enable-optimize"
- "--enable-strip"
- "--enable-hardening"
- "--disable-elf-hack"))
- #:imported-modules %cargo-utils-modules
- #:modules `((ice-9 regex)
- (ice-9 string-fun)
- (ice-9 ftw)
- (srfi srfi-1)
- (srfi srfi-26)
- (rnrs bytevectors)
- (rnrs io ports)
- (guix elf)
- (guix build gremlin)
- ,@%gnu-build-system-modules)
- #:phases #~(modify-phases %standard-phases
- (add-after 'unpack 'fix-preferences
- (lambda* (#:key inputs #:allow-other-keys)
- (let ((port (open-file "browser/app/profile/firefox.js"
- "a")))
- (define (write-setting key value)
- (format port "~%pref(\"~a\", ~a);~%" key value)
- (format #t
+ (let ((version "127.0.2-2"))
+ (package
+ (name "librewolf")
+ (version version)
+ (source (make-librewolf-source
+ version
+ #:firefox-hash
+ "1s73fdp7k60058ylyvlixq13k5hfbmj6k1y42fmzqlpg7n62lyqb"
+ #:librewolf-hash
+ "1f4xz496x1nf7lmvk50hakj9p6q0kzxl5f9s2k0b6kczvyc8gw5n"))
+
+ (build-system gnu-build-system)
+ (arguments
+ (list
+ #:configure-flags
+ #~(let ((clang #$(this-package-native-input "clang")))
+ `("--enable-application=browser"
+
+ ;; Configuration
+ "--without-wasm-sandboxed-libraries"
+ "--with-system-jpeg"
+ "--with-system-zlib"
+ "--with-system-png"
+ "--with-system-webp"
+ "--with-system-icu"
+ "--with-system-libvpx"
+ "--with-system-libevent"
+ "--with-system-ffi"
+ "--enable-system-pixman"
+ "--enable-jemalloc"
+
+ ;; see https://bugs.gnu.org/32833
+ "--with-system-nspr"
+ "--with-system-nss"
+
+ ,(string-append "--with-clang-path=" clang
+ "/bin/clang")
+ ,(string-append "--with-libclang-path=" clang
+ "/lib")
+
+ ;; Distribution
+ "--with-distribution-id=org.guix"
+ "--with-app-name=librewolf"
+ "--with-app-basename=LibreWolf"
+ "--with-branding=browser/branding/librewolf"
+
+ ;; Features
+ "--disable-tests"
+ "--disable-updater"
+ "--enable-pulseaudio"
+ "--disable-crashreporter"
+ "--allow-addon-sideload"
+ "--with-unsigned-addon-scopes=app,system"
+ "--disable-eme"
+
+ ;; Build details
+ "--disable-debug"
+ "--enable-rust-simd"
+ "--enable-release"
+ "--enable-optimize"
+ "--enable-strip"
+ "--enable-hardening"
+ "--disable-elf-hack"))
+ #:imported-modules %cargo-utils-modules
+ #:modules `((ice-9 regex)
+ (ice-9 string-fun)
+ (ice-9 ftw)
+ (srfi srfi-1)
+ (srfi srfi-26)
+ (rnrs bytevectors)
+ (rnrs io ports)
+ (guix elf)
+ (guix build gremlin)
+ ,@%gnu-build-system-modules)
+ #:phases
+ #~(modify-phases %standard-phases
+ (add-after 'unpack 'fix-preferences
+ (lambda* (#:key inputs #:allow-other-keys)
+ (let ((port (open-file "browser/app/profile/firefox.js"
+ "a")))
+ (define (write-setting key value)
+ (format port "~%pref(\"~a\", ~a);~%" key value)
+ (format #t
"fix-preferences: setting value of ~a to ~a~%" key
value))
- ;; We should allow the sandbox to read the store directory,
- ;; because the sandbox has access to /usr on FHS distros.
- (write-setting
- "security.sandbox.content.read_path_whitelist"
- (string-append "\""
- (%store-directory) "/\""))
-
- ;; XDG settings should be managed by Guix.
- (write-setting "browser.shell.checkDefaultBrowser"
- "false")
- (close-port port))))
- (add-after 'fix-preferences 'fix-ffmpeg-runtime-linker
- (lambda* (#:key inputs #:allow-other-keys)
- (let* ((ffmpeg (assoc-ref inputs "ffmpeg"))
- (libavcodec (string-append ffmpeg
- "/lib/libavcodec.so")))
- ;; Arrange to load libavcodec.so by its absolute file name.
- (substitute* "dom/media/platforms/ffmpeg/FFmpegRuntimeLinker.cpp"
- (("libavcodec\\.so")
- libavcodec)))))
- (add-after 'patch-source-shebangs 'patch-cargo-checksums
- (lambda _
- (use-modules (guix build cargo-utils))
- (let ((null-hash
- ;; This is the SHA256 output of an empty string.
- (string-append
- "e3b0c44298fc1c149afbf4c8996fb924"
- "27ae41e4649b934ca495991b7852b855")))
- (for-each (lambda (file)
- (format #t
+ ;; We should allow the sandbox to read the store directory,
+ ;; because the sandbox has access to /usr on FHS distros.
+ (write-setting
+ "security.sandbox.content.read_path_whitelist"
+ (string-append "\""
+ (%store-directory) "/\""))
+
+ ;; XDG settings should be managed by Guix.
+ (write-setting "browser.shell.checkDefaultBrowser"
+ "false")
+ (close-port port))))
+ (add-after 'fix-preferences 'fix-ffmpeg-runtime-linker
+ (lambda* (#:key inputs #:allow-other-keys)
+ (let* ((ffmpeg (assoc-ref inputs "ffmpeg"))
+ (libavcodec (string-append ffmpeg
+ "/lib/libavcodec.so")))
+ ;; Arrange to load libavcodec.so by its absolute file name.
+ (substitute* "dom/media/platforms/ffmpeg/FFmpegRuntimeLinker.cpp"
+ (("libavcodec\\.so")
+ libavcodec)))))
+ (add-after 'patch-source-shebangs 'patch-cargo-checksums
+ (lambda _
+ (use-modules (guix build cargo-utils))
+ (let ((null-hash
+ ;; This is the SHA256 output of an empty string.
+ (string-append
+ "e3b0c44298fc1c149afbf4c8996fb924"
+ "27ae41e4649b934ca495991b7852b855")))
+ (for-each (lambda (file)
+ (format #t
"patch-cargo-checksums: patching checksums in ~a~%"
file)
- (substitute* file
- (("(checksum = )\".*\"" all name)
- (string-append name "\"" null-hash
- "\""))))
- (find-files "." "Cargo\\.lock$"))
- (for-each generate-all-checksums
- '("build"
- "dom/media"
- "dom/webauthn"
- "gfx"
- "intl"
- "js"
- "media"
- "modules"
- "mozglue/static/rust"
- "netwerk"
- "remote"
- "security/manager/ssl"
- "servo"
- "storage"
- "third_party/rust"
- "toolkit"
- "xpcom/rust"
- "services")))))
- (add-after 'patch-cargo-checksums 'remove-cargo-frozen-flag
- (lambda _
- ;; Remove --frozen flag from cargo invokation, otherwise it'll
- ;; complain that it's not able to change Cargo.lock.
- ;; https://bugzilla.mozilla.org/show_bug.cgi?id=1726373
- (substitute* "build/RunCbindgen.py"
- (("args.append\\(\"--frozen\"\\)") "pass"))))
- (delete 'bootstrap)
- (add-before 'configure 'patch-SpeechDispatcherService.cpp
- (lambda _
- (let* ((lib "libspeechd.so.2")
- (file (string-append
- "dom/media/webspeech/synth/"
- "speechd/SpeechDispatcherService.cpp"))
- (old-content (call-with-input-file file
- get-string-all)))
- (substitute
- file
- `((,(format #f "~s" lib) unquote
- (lambda (line _)
- (string-replace-substring
- line lib
- (string-append #$speech-dispatcher
- "/lib/" lib))))))
- (if (string=? old-content
- (call-with-input-file file
- get-string-all))
- (error
- "substitute did nothing, phase requires an update")))))
- (add-before 'configure 'set-build-id
- ;; Build will write the timestamp to output, which is harmful
- ;; for reproducibility, so change it to a fixed date. Use a
- ;; separate phase for easier modification with inherit.
- (lambda _
- (setenv "MOZ_BUILD_DATE"
- #$%librewolf-build-id)))
- (replace 'configure
- (lambda* (#:key inputs outputs configure-flags
- #:allow-other-keys)
- (setenv "AUTOCONF"
- (string-append (assoc-ref inputs "autoconf")
- "/bin/autoconf"))
- (setenv "SHELL"
- (which "bash"))
- (setenv "CONFIG_SHELL"
- (which "bash"))
- (setenv "MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE"
- "system")
- ;; This should use the host info probably (does it
- ;; build on non-x86_64 though?)
- (setenv "GUIX_PYTHONPATH"
- (string-append (getcwd)
- "/obj-x86_64-pc-linux-gnu/_virtualenvs/build"))
-
- ;; Use Clang, Clang is 2x faster than GCC
- (setenv "AR" "llvm-ar")
- (setenv "NM" "llvm-nm")
- (setenv "CC" "clang")
- (setenv "CXX" "clang++")
- (setenv "MOZ_NOSPAM" "1")
- (setenv "MOZ_APP_NAME" "librewolf")
-
- (setenv "MOZBUILD_STATE_PATH"
- (getcwd))
-
- (let* ((mozconfig (string-append (getcwd) "/mozconfig"))
- (out (assoc-ref outputs "out"))
- (flags (cons (string-append "--prefix=" out)
- configure-flags)))
- (format #t "build directory: ~s~%"
- (getcwd))
- (format #t "configure flags: ~s~%" flags)
-
- (define write-flags
- (lambda flags
- (display (string-join (map (cut string-append
- "ac_add_options " <>)
- flags) "\n"))
- (display "\n")))
- (with-output-to-file mozconfig
- (lambda ()
- (apply write-flags flags)
- ;; The following option unsets Telemetry
- ;; Reporting. With the Addons Fiasco,
- ;; Mozilla was found to be collecting
- ;; user's data, including saved passwords
- ;;
This message was truncated. Download the full message here.
I
I
Ian Eure wrote on 29 Jun 19:22 +0200
[PATCH v2 1/2] gnu: Add nss-latest.
(address . 71832@debbugs.gnu.org)(name . Ian Eure)(address . ian@retrospec.tv)
20240629172209.26420-2-ian@retrospec.tv
* gnu/packages/nss.scm (nss-latest): New variable.

Change-Id: Ifdc215090a20dee1bde83013852ef21b6cfd9979
---
gnu/packages/nss.scm | 67 ++++++++++++++++++++++++++++++++++++++++----
1 file changed, 61 insertions(+), 6 deletions(-)

Toggle diff (95 lines)
diff --git a/gnu/packages/nss.scm b/gnu/packages/nss.scm
index d558079f44..6b45e59ea8 100644
--- a/gnu/packages/nss.scm
+++ b/gnu/packages/nss.scm
@@ -106,6 +106,9 @@ (define-public nspr-4.32
(base32
"0v3zds1id71j5a5si42a658fjz8nv2f6zp6w4gqrqmdr6ksz8sxv"))))))
+;; nss should track ESRs, but currently doesn't. When the next ESR it out, it
+;; should get updated.
+
(define-public nss
(package
(name "nss")
@@ -153,13 +156,13 @@ (define-public nss
;; Ensure we are building for the (%current-target-system).
#$@(if (%current-target-system)
#~((string-append
- "OS_TEST="
- (string-take #$(%current-target-system)
- (string-index #$(%current-target-system) #\-)))
+ "OS_TEST="
+ (string-take #$(%current-target-system)
+ (string-index #$(%current-target-system) #\-)))
(string-append
- "KERNEL=" (cond (#$(target-hurd?) "gnu")
- (#$(target-linux?) "linux")
- (else ""))))
+ "KERNEL=" (cond (#$(target-hurd?) "gnu")
+ (#$(target-linux?) "linux")
+ (else ""))))
#~())
#$@(if (%current-target-system)
#~("CROSS_COMPILE=1")
@@ -303,6 +306,58 @@ (define-public nss/fixed
(invoke "faketime" "2024-01-23" "./nss/tests/all.sh"))
(format #t "test suite not run~%"))))))))))))
+;; nss-latest tracks the latest released version.
+
+(define-public nss-latest
+ (package
+ (inherit nss)
+ (name "nss-latest")
+ (version "3.101")
+ (source (origin
+ (inherit (package-source nss))
+ (uri (let ((version-with-underscores
+ (string-join (string-split version #\.) "_")))
+ (string-append
+ "https://ftp.mozilla.org/pub/mozilla.org/security/nss/"
+ "releases/NSS_" version-with-underscores "_RTM/src/"
+ "nss-" version ".tar.gz")))
+ (sha256
+ (base32
+ "1rw5xpclsy174znvxcb4d4zgjwadxy45mbh0wvkm3fxpnkq4i5w5"))))
+ (arguments
+ (substitute-keyword-arguments (package-arguments nss)
+ ((#:phases phases)
+ #~(modify-phases #$phases
+ (replace 'check
+ (lambda* (#:key tests? #:allow-other-keys)
+ (if tests?
+ (begin
+ ;; Use 127.0.0.1 instead of $HOST.$DOMSUF as HOSTADDR for
+ ;; testing. The latter requires a working DNS or /etc/hosts.
+ (setenv "DOMSUF" "localdomain")
+ (setenv "USE_IP" "TRUE")
+ (setenv "IP_ADDRESS" "127.0.0.1")
+
+ ;; This specific test is looking at performance "now
+ ;; verify that we can quickly dump a database", and
+ ;; we're not testing performance here (especially
+ ;; since we're using faketime), so raise the
+ ;; threshold
+ (substitute* "nss/tests/dbtests/dbtests.sh"
+ ((" -lt 5") " -lt 50"))
+
+ ;; Since the test suite is very lengthy, run the test
+ ;; suite once, not thrice as done by default, by
+ ;; selecting only the 'standard' cycle.
+ (setenv "NSS_CYCLES" "standard")
+
+ ;; The "PayPalEE.cert" certificate expires every six months,
+ ;; leading to test failures:
+ ;; <https://bugzilla.mozilla.org/show_bug.cgi?id=609734>. To
+ ;; work around that, set the time to roughly the release date.
+ (invoke "faketime" "2024-01-23" "./nss/tests/all.sh"))
+ (format #t "test suite not run~%"))))))))))
+
(define-public nsncd
(package
(name "nsncd")
--
2.45.1
I
I
Ian Eure wrote on 29 Jun 19:22 +0200
[PATCH v2 0/2] Add nss-latest; update Librewolf to 127.0.2-2
(address . 71832@debbugs.gnu.org)(name . Ian Eure)(address . ian@retrospec.tv)
20240629172209.26420-1-ian@retrospec.tv
Realized that I didn't remove the backout of the encoding_rs patch which was
added for 126.x. The browser built and worked, but that change isn’t needed
anymore; remove it.

Ian Eure (2):
gnu: Add nss-latest.
gnu: librewolf: Update to 127.0.2-1.

gnu/packages/librewolf.scm | 1044 ++++++++++++++++++------------------
gnu/packages/nss.scm | 67 ++-
2 files changed, 587 insertions(+), 524 deletions(-)

--
2.45.1
I
I
Ian Eure wrote on 2 Jul 02:21 +0200
[PATCH v3 0/2] Add nss-rapid; updte Librewolf to 127.0.2-2.
(address . 71832@debbugs.gnu.org)(name . Ian Eure)(address . ian@retrospec.tv)
20240702002103.9015-1-ian@retrospec.tv
Updated with discussion from guix-devel:

- nss rapid release package is now named `nss-rapid'.
- Synposis and description clarify what this means.
- Comments added above nss-rapid with packager guidance.

Ian Eure (2):
gnu: Add nss-rapid.
gnu: librewolf: Update to 127.0.2-1.

gnu/packages/librewolf.scm | 1044 ++++++++++++++++++------------------
gnu/packages/nss.scm | 80 ++-
2 files changed, 600 insertions(+), 524 deletions(-)

--
2.45.1
I
I
Ian Eure wrote on 2 Jul 02:21 +0200
[PATCH v3 1/2] gnu: Add nss-rapid.
(address . 71832@debbugs.gnu.org)(name . Ian Eure)(address . ian@retrospec.tv)
20240702002103.9015-2-ian@retrospec.tv
* gnu/packages/nss.scm (nss-rapid): New variable.

Change-Id: I2bdd2119fb0c857feae9eb2e47a28909b8228cd7
---
gnu/packages/nss.scm | 80 ++++++++++++++++++++++++++++++++++++++++----
1 file changed, 74 insertions(+), 6 deletions(-)

Toggle diff (108 lines)
diff --git a/gnu/packages/nss.scm b/gnu/packages/nss.scm
index d558079f44..4e892ce649 100644
--- a/gnu/packages/nss.scm
+++ b/gnu/packages/nss.scm
@@ -106,6 +106,9 @@ (define-public nspr-4.32
(base32
"0v3zds1id71j5a5si42a658fjz8nv2f6zp6w4gqrqmdr6ksz8sxv"))))))
+;; nss should track ESRs, but currently doesn't. When the next ESR it out, it
+;; should get updated.
+
(define-public nss
(package
(name "nss")
@@ -153,13 +156,13 @@ (define-public nss
;; Ensure we are building for the (%current-target-system).
#$@(if (%current-target-system)
#~((string-append
- "OS_TEST="
- (string-take #$(%current-target-system)
- (string-index #$(%current-target-system) #\-)))
+ "OS_TEST="
+ (string-take #$(%current-target-system)
+ (string-index #$(%current-target-system) #\-)))
(string-append
- "KERNEL=" (cond (#$(target-hurd?) "gnu")
- (#$(target-linux?) "linux")
- (else ""))))
+ "KERNEL=" (cond (#$(target-hurd?) "gnu")
+ (#$(target-linux?) "linux")
+ (else ""))))
#~())
#$@(if (%current-target-system)
#~("CROSS_COMPILE=1")
@@ -303,6 +306,71 @@ (define-public nss/fixed
(invoke "faketime" "2024-01-23" "./nss/tests/all.sh"))
(format #t "test suite not run~%"))))))))))))
+;; nss-rapid tracks the rapid release channel. Unless your package requires a
+;; newer version, you should prefer the `nss' package, which tracks the ESR
+;; channel.
+;;
+;; See https://wiki.mozilla.org/NSS:Release_Versions
+;; and https://wiki.mozilla.org/Rapid_Release_Model
+
+(define-public nss-rapid
+ (package
+ (inherit nss)
+ (name "nss-rapid")
+ (version "3.101")
+ (source (origin
+ (inherit (package-source nss))
+ (uri (let ((version-with-underscores
+ (string-join (string-split version #\.) "_")))
+ (string-append
+ "https://ftp.mozilla.org/pub/mozilla.org/security/nss/"
+ "releases/NSS_" version-with-underscores "_RTM/src/"
+ "nss-" version ".tar.gz")))
+ (sha256
+ (base32
+ "1rw5xpclsy174znvxcb4d4zgjwadxy45mbh0wvkm3fxpnkq4i5w5"))))
+ (arguments
+ (substitute-keyword-arguments (package-arguments nss)
+ ((#:phases phases)
+ #~(modify-phases #$phases
+ (replace 'check
+ (lambda* (#:key tests? #:allow-other-keys)
+ (if tests?
+ (begin
+ ;; Use 127.0.0.1 instead of $HOST.$DOMSUF as HOSTADDR for
+ ;; testing. The latter requires a working DNS or /etc/hosts.
+ (setenv "DOMSUF" "localdomain")
+ (setenv "USE_IP" "TRUE")
+ (setenv "IP_ADDRESS" "127.0.0.1")
+
+ ;; This specific test is looking at performance "now
+ ;; verify that we can quickly dump a database", and
+ ;; we're not testing performance here (especially
+ ;; since we're using faketime), so raise the
+ ;; threshold
+ (substitute* "nss/tests/dbtests/dbtests.sh"
+ ((" -lt 5") " -lt 50"))
+
+ ;; Since the test suite is very lengthy, run the test
+ ;; suite once, not thrice as done by default, by
+ ;; selecting only the 'standard' cycle.
+ (setenv "NSS_CYCLES" "standard")
+
+ ;; The "PayPalEE.cert" certificate expires every six months,
+ ;; leading to test failures:
+ ;; <https://bugzilla.mozilla.org/show_bug.cgi?id=609734>. To
+ ;; work around that, set the time to roughly the release date.
+ (invoke "faketime" "2024-01-23" "./nss/tests/all.sh"))
+ (format #t "test suite not run~%"))))))))
+ (synopsis "Network Security Services (Rapid Release)")
+ (description
+ "Network Security Services (@dfn{NSS}) is a set of libraries designed to
+support cross-platform development of security-enabled client and server
+applications. Applications built with NSS can support SSL v2 and v3, TLS,
+PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other
+security standards.
+
+This package tracks the Rapid Release channel, which updates frequently.")))
(define-public nsncd
(package
(name "nsncd")
--
2.45.1
I
I
Ian Eure wrote on 2 Jul 02:21 +0200
[PATCH v3 2/2] gnu: librewolf: Update to 127.0.2-1.
(address . 71832@debbugs.gnu.org)(name . Ian Eure)(address . ian@retrospec.tv)
20240702002103.9015-3-ian@retrospec.tv
* gnu/packages/librewolf.scm (librewolf): Update to 127.0.2-1. Reorganize
module to improve usability and reduce duplication. The Rust package and
build ID are now at the top of the file. The librewolf-source variable has
been replaced with the make-librewolf-source procedure, centralizing versions
& hashes in the librewolf package definition. Dedent some of the package’s
arguments to improve readability.

Change-Id: I15f8a2aa1fae07e0497ab5511d10af0c1f70cc2e
---
gnu/packages/librewolf.scm | 1044 ++++++++++++++++++------------------
1 file changed, 526 insertions(+), 518 deletions(-)

Toggle diff (404 lines)
diff --git a/gnu/packages/librewolf.scm b/gnu/packages/librewolf.scm
index c84bcaf3ce..a400080dcb 100644
--- a/gnu/packages/librewolf.scm
+++ b/gnu/packages/librewolf.scm
@@ -93,6 +93,18 @@ (define-module (gnu packages librewolf)
#:use-module (gnu packages xdisorg)
#:use-module (gnu packages xorg))
+;; Define the versions of rust needed to build librewolf, trying to match
+;; upstream. See the file taskcluster/kinds/toolchain/rust.yml at
+;; https://searchfox.org under the particular firefox release, like
+;; mozilla-esr102.
+;; 1.75 is the default in Guix, 1.77 is the minimum for Librewolf.
+(define rust-librewolf rust-1.77)
+
+;; Update this id with every update to its release date.
+;; It's used for cache validation and therefore can lead to strange bugs.
+;; ex: date '+%Y%m%d%H%M%S'
+(define %librewolf-build-id "20240626133423")
+
(define (firefox-source-origin version hash)
(origin
(method url-fetch)
@@ -114,11 +126,14 @@ (define (librewolf-source-origin version hash)
(define computed-origin-method (@@ (guix packages) computed-origin-method))
-(define librewolf-source
- (let* ((ff-src (firefox-source-origin "126.0.1" "0fr679rcwshwpfxidc55b2xsn4pmrr7p9ix4rr2mv2k7kwsjcc7n"))
- (version "126.0.1-1")
- (lw-src (librewolf-source-origin version "0cac80073vkzd85ai9rbnwixs1h9bpy4dj2ri6jxdlqsy5d663km")))
-
+(define* (make-librewolf-source version #:key firefox-hash librewolf-hash)
+ (let* ((ff-src (firefox-source-origin
+ (car (string-split version #\-))
+ firefox-hash))
+ (version version)
+ (lw-src (librewolf-source-origin
+ version
+ librewolf-hash)))
(origin
(method computed-origin-method)
(file-name (string-append "librewolf-" version ".source.tar.gz"))
@@ -162,11 +177,6 @@ (define librewolf-source
(("^ff_source_tarball:=.*")
(string-append "ff_source_tarball:=" #+ff-src)))
- ;; Remove encoding_rs patch, it doesn't build with Rust 1.75.
- (substitute* '("assets/patches.txt")
- (("patches/encoding_rs.patch\\\n$")
- ""))
-
;; Stage locales.
(begin
(format #t "Staging locales...~%")
@@ -204,523 +214,521 @@ (define librewolf-source
".source.tar.gz")
#$output))))))))
-;; Define the versions of rust needed to build librewolf, trying to match
-;; upstream. See the file taskcluster/ci/toolchain/rust.yml at
-;; https://searchfox.org under the particular firefox release, like
-;; mozilla-esr102.
-(define rust-librewolf rust) ; 1.75 is the default in Guix, 1.65 is the minimum.
-
-;; Update this id with every update to its release date.
-;; It's used for cache validation and therefore can lead to strange bugs.
-;; ex: date '+%Y%m%d%H%M%S'
-(define %librewolf-build-id "20240607212143")
-
(define-public librewolf
- (package
- (name "librewolf")
- (version "126.0.1-1")
- (source librewolf-source)
- (build-system gnu-build-system)
- (arguments
- (list
- #:configure-flags #~(let ((clang #$(this-package-native-input "clang")))
- `("--enable-application=browser"
-
- ;; Configuration
- "--without-wasm-sandboxed-libraries"
- "--with-system-jpeg"
- "--with-system-zlib"
- "--with-system-png"
- "--with-system-webp"
- "--with-system-icu"
- "--with-system-libvpx"
- "--with-system-libevent"
- "--with-system-ffi"
- "--enable-system-pixman"
- "--enable-jemalloc"
-
- ;; see https://bugs.gnu.org/32833
- "--with-system-nspr"
- "--with-system-nss"
-
- ,(string-append "--with-clang-path=" clang
- "/bin/clang")
- ,(string-append "--with-libclang-path=" clang
- "/lib")
-
- ;; Distribution
- "--with-distribution-id=org.guix"
- "--with-app-name=librewolf"
- "--with-app-basename=LibreWolf"
- "--with-branding=browser/branding/librewolf"
-
- ;; Features
- "--disable-tests"
- "--disable-updater"
- "--enable-pulseaudio"
- "--disable-crashreporter"
- "--allow-addon-sideload"
- "--with-unsigned-addon-scopes=app,system"
- "--disable-eme"
-
- ;; Build details
- "--disable-debug"
- "--enable-rust-simd"
- "--enable-release"
- "--enable-optimize"
- "--enable-strip"
- "--enable-hardening"
- "--disable-elf-hack"))
- #:imported-modules %cargo-utils-modules
- #:modules `((ice-9 regex)
- (ice-9 string-fun)
- (ice-9 ftw)
- (srfi srfi-1)
- (srfi srfi-26)
- (rnrs bytevectors)
- (rnrs io ports)
- (guix elf)
- (guix build gremlin)
- ,@%gnu-build-system-modules)
- #:phases #~(modify-phases %standard-phases
- (add-after 'unpack 'fix-preferences
- (lambda* (#:key inputs #:allow-other-keys)
- (let ((port (open-file "browser/app/profile/firefox.js"
- "a")))
- (define (write-setting key value)
- (format port "~%pref(\"~a\", ~a);~%" key value)
- (format #t
+ (let ((version "127.0.2-2"))
+ (package
+ (name "librewolf")
+ (version version)
+ (source (make-librewolf-source
+ version
+ #:firefox-hash
+ "1s73fdp7k60058ylyvlixq13k5hfbmj6k1y42fmzqlpg7n62lyqb"
+ #:librewolf-hash
+ "1f4xz496x1nf7lmvk50hakj9p6q0kzxl5f9s2k0b6kczvyc8gw5n"))
+
+ (build-system gnu-build-system)
+ (arguments
+ (list
+ #:configure-flags
+ #~(let ((clang #$(this-package-native-input "clang")))
+ `("--enable-application=browser"
+
+ ;; Configuration
+ "--without-wasm-sandboxed-libraries"
+ "--with-system-jpeg"
+ "--with-system-zlib"
+ "--with-system-png"
+ "--with-system-webp"
+ "--with-system-icu"
+ "--with-system-libvpx"
+ "--with-system-libevent"
+ "--with-system-ffi"
+ "--enable-system-pixman"
+ "--enable-jemalloc"
+
+ ;; see https://bugs.gnu.org/32833
+ "--with-system-nspr"
+ "--with-system-nss"
+
+ ,(string-append "--with-clang-path=" clang
+ "/bin/clang")
+ ,(string-append "--with-libclang-path=" clang
+ "/lib")
+
+ ;; Distribution
+ "--with-distribution-id=org.guix"
+ "--with-app-name=librewolf"
+ "--with-app-basename=LibreWolf"
+ "--with-branding=browser/branding/librewolf"
+
+ ;; Features
+ "--disable-tests"
+ "--disable-updater"
+ "--enable-pulseaudio"
+ "--disable-crashreporter"
+ "--allow-addon-sideload"
+ "--with-unsigned-addon-scopes=app,system"
+ "--disable-eme"
+
+ ;; Build details
+ "--disable-debug"
+ "--enable-rust-simd"
+ "--enable-release"
+ "--enable-optimize"
+ "--enable-strip"
+ "--enable-hardening"
+ "--disable-elf-hack"))
+ #:imported-modules %cargo-utils-modules
+ #:modules `((ice-9 regex)
+ (ice-9 string-fun)
+ (ice-9 ftw)
+ (srfi srfi-1)
+ (srfi srfi-26)
+ (rnrs bytevectors)
+ (rnrs io ports)
+ (guix elf)
+ (guix build gremlin)
+ ,@%gnu-build-system-modules)
+ #:phases
+ #~(modify-phases %standard-phases
+ (add-after 'unpack 'fix-preferences
+ (lambda* (#:key inputs #:allow-other-keys)
+ (let ((port (open-file "browser/app/profile/firefox.js"
+ "a")))
+ (define (write-setting key value)
+ (format port "~%pref(\"~a\", ~a);~%" key value)
+ (format #t
"fix-preferences: setting value of ~a to ~a~%" key
value))
- ;; We should allow the sandbox to read the store directory,
- ;; because the sandbox has access to /usr on FHS distros.
- (write-setting
- "security.sandbox.content.read_path_whitelist"
- (string-append "\""
- (%store-directory) "/\""))
-
- ;; XDG settings should be managed by Guix.
- (write-setting "browser.shell.checkDefaultBrowser"
- "false")
- (close-port port))))
- (add-after 'fix-preferences 'fix-ffmpeg-runtime-linker
- (lambda* (#:key inputs #:allow-other-keys)
- (let* ((ffmpeg (assoc-ref inputs "ffmpeg"))
- (libavcodec (string-append ffmpeg
- "/lib/libavcodec.so")))
- ;; Arrange to load libavcodec.so by its absolute file name.
- (substitute* "dom/media/platforms/ffmpeg/FFmpegRuntimeLinker.cpp"
- (("libavcodec\\.so")
- libavcodec)))))
- (add-after 'patch-source-shebangs 'patch-cargo-checksums
- (lambda _
- (use-modules (guix build cargo-utils))
- (let ((null-hash
- ;; This is the SHA256 output of an empty string.
- (string-append
- "e3b0c44298fc1c149afbf4c8996fb924"
- "27ae41e4649b934ca495991b7852b855")))
- (for-each (lambda (file)
- (format #t
+ ;; We should allow the sandbox to read the store directory,
+ ;; because the sandbox has access to /usr on FHS distros.
+ (write-setting
+ "security.sandbox.content.read_path_whitelist"
+ (string-append "\""
+ (%store-directory) "/\""))
+
+ ;; XDG settings should be managed by Guix.
+ (write-setting "browser.shell.checkDefaultBrowser"
+ "false")
+ (close-port port))))
+ (add-after 'fix-preferences 'fix-ffmpeg-runtime-linker
+ (lambda* (#:key inputs #:allow-other-keys)
+ (let* ((ffmpeg (assoc-ref inputs "ffmpeg"))
+ (libavcodec (string-append ffmpeg
+ "/lib/libavcodec.so")))
+ ;; Arrange to load libavcodec.so by its absolute file name.
+ (substitute* "dom/media/platforms/ffmpeg/FFmpegRuntimeLinker.cpp"
+ (("libavcodec\\.so")
+ libavcodec)))))
+ (add-after 'patch-source-shebangs 'patch-cargo-checksums
+ (lambda _
+ (use-modules (guix build cargo-utils))
+ (let ((null-hash
+ ;; This is the SHA256 output of an empty string.
+ (string-append
+ "e3b0c44298fc1c149afbf4c8996fb924"
+ "27ae41e4649b934ca495991b7852b855")))
+ (for-each (lambda (file)
+ (format #t
"patch-cargo-checksums: patching checksums in ~a~%"
file)
- (substitute* file
- (("(checksum = )\".*\"" all name)
- (string-append name "\"" null-hash
- "\""))))
- (find-files "." "Cargo\\.lock$"))
- (for-each generate-all-checksums
- '("build"
- "dom/media"
- "dom/webauthn"
- "gfx"
- "intl"
- "js"
- "media"
- "modules"
- "mozglue/static/rust"
- "netwerk"
- "remote"
- "security/manager/ssl"
- "servo"
- "storage"
- "third_party/rust"
- "toolkit"
- "xpcom/rust"
- "services")))))
- (add-after 'patch-cargo-checksums 'remove-cargo-frozen-flag
- (lambda _
- ;; Remove --frozen flag from cargo invokation, otherwise it'll
- ;; complain that it's not able to change Cargo.lock.
- ;; https://bugzilla.mozilla.org/show_bug.cgi?id=1726373
- (substitute* "build/RunCbindgen.py"
- (("args.append\\(\"--frozen\"\\)") "pass"))))
- (delete 'bootstrap)
- (add-before 'configure 'patch-SpeechDispatcherService.cpp
- (lambda _
- (let* ((lib "libspeechd.so.2")
- (file (string-append
- "dom/media/webspeech/synth/"
- "speechd/SpeechDispatcherService.cpp"))
- (old-content (call-with-input-file file
- get-string-all)))
- (substitute
- file
- `((,(format #f "~s" lib) unquote
- (lambda (line _)
- (string-replace-substring
- line lib
- (string-append #$speech-dispatcher
- "/lib/" lib))))))
- (if (string=? old-content
- (call-with-input-file file
- get-string-all))
- (error
- "substitute did nothing, phase requires an update")))))
- (add-before 'configure 'set-build-id
- ;; Build will write the timestamp to output, which is harmful
- ;; for reproducibility, so change it to a fixed date. Use a
- ;; separate phase for easier modification with inherit.
- (lambda _
- (setenv "MOZ_BUILD_DATE"
- #$%librewolf-build-id)))
- (replace 'configure
- (lambda* (#:key inputs outputs configure-flags
- #:allow-other-keys)
- (setenv "AUTOCONF"
- (string-append (assoc-ref inputs "autoconf")
- "/bin/autoconf"))
- (setenv "SHELL"
- (which "bash"))
- (setenv "CONFIG_SHELL"
- (which "bash"))
- (setenv "MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE"
- "system")
- ;; This should use the host info probably (does it
- ;; build on non-x86_64 though?)
- (setenv "GUIX_PYTHONPATH"
- (string-append (getcwd)
- "/obj-x86_64-pc-linux-gnu/_virtualenvs/build"))
-
- ;; Use Clang, Clang is 2x faster than GCC
- (setenv "AR" "llvm-ar")
- (setenv "NM" "llvm-nm")
- (setenv "CC" "clang")
- (setenv "CXX" "clang++")
- (setenv "MOZ_NOSPAM" "1")
- (setenv "MOZ_APP_NAME" "librewolf")
-
- (setenv "MOZBUILD_STATE_PATH"
- (getcwd))
-
- (let* ((mozconfig (string-append (getcwd) "/mozconfig"))
- (out (assoc-ref outputs "out"))
- (flags (cons (string-append "--prefix=" out)
- configure-flags)))
- (format #t "build directory: ~s~%"
- (getcwd))
- (format #t "configure flags: ~s~%" flags)
-
- (define write-flags
- (lambda flags
- (display (string-join (map (cut string-append
- "ac_add_options " <>)
- flags) "\n"))
- (display "\n")))
- (with-output-to-file mozconfig
- (lambda ()
- (apply write-flags flags)
- ;; The following option unsets Telemetry
- ;; Reporting. With the Addons Fiasco,
- ;; Mozilla was found to be collecting
- ;; user's data, including saved passwords
- ;;
This message was truncated. Download the full message here.
A
A
Andreas Enge wrote on 8 Jul 10:55 +0200
Closing one bug
ZouphUGFYPpDQVqT@jurong
Hello,

I have pushed the patch of #71882 to fix the build on non-x86 architectures.
I could still build on x86_64, but could still not build on aarch64; but
the latter failure is probably due to a lack of memory (the configure phase
passes now, but the build fails later on with a SIGKILL).

As this means that the librewolf update of #71832 needs to be rebased,
I am cc-ing this bug.

Andreas
I
I
Ian Eure wrote on 17 Jul 05:06 +0200
[PATCH v4 0/3] Add nss-rapid; update Librewolf to 128.0-2
(address . 71832@debbugs.gnu.org)(name . Ian Eure)(address . ian@retrospec.tv)
20240717030619.26631-1-ian@retrospec.tv
# vs. v3 of these patches, this series:

- Rebases to integrate #71832.
- Update Librewolf to 128.0-2, the current version.
- Update nss-rapid to 3.102, the current rapid release version.
- Add the skr locale, needed by Firefox 128.x, which is Librewolf’s upstream.

Ian Eure (3):
gnu: Add nss-rapid.
gnu: gnuzilla: Add skr to all-mozilla-locales.
gnu: librewolf: Update to 128.0-2

gnu/packages/gnuzilla.scm | 1 +
gnu/packages/librewolf.scm | 1049 ++++++++++++++++++------------------
gnu/packages/nss.scm | 80 ++-
3 files changed, 603 insertions(+), 527 deletions(-)

--
2.45.2
I
I
Ian Eure wrote on 17 Jul 05:06 +0200
[PATCH v4 1/3] gnu: Add nss-rapid.
(address . 71832@debbugs.gnu.org)(name . Ian Eure)(address . ian@retrospec.tv)
20240717030619.26631-2-ian@retrospec.tv
* gnu/packages/nss.scm (nss-rapid): New variable.

Change-Id: I2bdd2119fb0c857feae9eb2e47a28909b8228cd7
---
gnu/packages/nss.scm | 80 ++++++++++++++++++++++++++++++++++++++++----
1 file changed, 74 insertions(+), 6 deletions(-)

Toggle diff (108 lines)
diff --git a/gnu/packages/nss.scm b/gnu/packages/nss.scm
index d558079f44..33ebabc829 100644
--- a/gnu/packages/nss.scm
+++ b/gnu/packages/nss.scm
@@ -106,6 +106,9 @@ (define-public nspr-4.32
(base32
"0v3zds1id71j5a5si42a658fjz8nv2f6zp6w4gqrqmdr6ksz8sxv"))))))
+;; nss should track ESRs, but currently doesn't. When the next ESR it out, it
+;; should get updated.
+
(define-public nss
(package
(name "nss")
@@ -153,13 +156,13 @@ (define-public nss
;; Ensure we are building for the (%current-target-system).
#$@(if (%current-target-system)
#~((string-append
- "OS_TEST="
- (string-take #$(%current-target-system)
- (string-index #$(%current-target-system) #\-)))
+ "OS_TEST="
+ (string-take #$(%current-target-system)
+ (string-index #$(%current-target-system) #\-)))
(string-append
- "KERNEL=" (cond (#$(target-hurd?) "gnu")
- (#$(target-linux?) "linux")
- (else ""))))
+ "KERNEL=" (cond (#$(target-hurd?) "gnu")
+ (#$(target-linux?) "linux")
+ (else ""))))
#~())
#$@(if (%current-target-system)
#~("CROSS_COMPILE=1")
@@ -303,6 +306,71 @@ (define-public nss/fixed
(invoke "faketime" "2024-01-23" "./nss/tests/all.sh"))
(format #t "test suite not run~%"))))))))))))
+;; nss-rapid tracks the rapid release channel. Unless your package requires a
+;; newer version, you should prefer the `nss' package, which tracks the ESR
+;; channel.
+;;
+;; See https://wiki.mozilla.org/NSS:Release_Versions
+;; and https://wiki.mozilla.org/Rapid_Release_Model
+
+(define-public nss-rapid
+ (package
+ (inherit nss)
+ (name "nss-rapid")
+ (version "3.102")
+ (source (origin
+ (inherit (package-source nss))
+ (uri (let ((version-with-underscores
+ (string-join (string-split version #\.) "_")))
+ (string-append
+ "https://ftp.mozilla.org/pub/mozilla.org/security/nss/"
+ "releases/NSS_" version-with-underscores "_RTM/src/"
+ "nss-" version ".tar.gz")))
+ (sha256
+ (base32
+ "0yrhrgk6050ilnmhpxpknlkpqh56rizp7pmw9yiiinsn93r076y2"))))
+ (arguments
+ (substitute-keyword-arguments (package-arguments nss)
+ ((#:phases phases)
+ #~(modify-phases #$phases
+ (replace 'check
+ (lambda* (#:key tests? #:allow-other-keys)
+ (if tests?
+ (begin
+ ;; Use 127.0.0.1 instead of $HOST.$DOMSUF as HOSTADDR for
+ ;; testing. The latter requires a working DNS or /etc/hosts.
+ (setenv "DOMSUF" "localdomain")
+ (setenv "USE_IP" "TRUE")
+ (setenv "IP_ADDRESS" "127.0.0.1")
+
+ ;; This specific test is looking at performance "now
+ ;; verify that we can quickly dump a database", and
+ ;; we're not testing performance here (especially
+ ;; since we're using faketime), so raise the
+ ;; threshold
+ (substitute* "nss/tests/dbtests/dbtests.sh"
+ ((" -lt 5") " -lt 50"))
+
+ ;; Since the test suite is very lengthy, run the test
+ ;; suite once, not thrice as done by default, by
+ ;; selecting only the 'standard' cycle.
+ (setenv "NSS_CYCLES" "standard")
+
+ ;; The "PayPalEE.cert" certificate expires every six months,
+ ;; leading to test failures:
+ ;; <https://bugzilla.mozilla.org/show_bug.cgi?id=609734>. To
+ ;; work around that, set the time to roughly the release date.
+ (invoke "faketime" "2024-01-23" "./nss/tests/all.sh"))
+ (format #t "test suite not run~%"))))))))
+ (synopsis "Network Security Services (Rapid Release)")
+ (description
+ "Network Security Services (@dfn{NSS}) is a set of libraries designed to
+support cross-platform development of security-enabled client and server
+applications. Applications built with NSS can support SSL v2 and v3, TLS,
+PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other
+security standards.
+
+This package tracks the Rapid Release channel, which updates frequently.")))
(define-public nsncd
(package
(name "nsncd")
--
2.45.2
I
I
Ian Eure wrote on 17 Jul 05:06 +0200
[PATCH v4 2/3] gnu: gnuzilla: Add skr to all-mozilla-locales.
(address . 71832@debbugs.gnu.org)(name . Ian Eure)(address . ian@retrospec.tv)
20240717030619.26631-3-ian@retrospec.tv
* (gnuzilla): Add skr to all-mozilla-locales.

Change-Id: If996048792a53dffb55b7e16e69370dd72fc78e3
---
gnu/packages/gnuzilla.scm | 1 +
1 file changed, 1 insertion(+)

Toggle diff (14 lines)
diff --git a/gnu/packages/gnuzilla.scm b/gnu/packages/gnuzilla.scm
index 3e7818ba43..98dd67a5dd 100644
--- a/gnu/packages/gnuzilla.scm
+++ b/gnu/packages/gnuzilla.scm
@@ -508,6 +508,7 @@ (define-public all-mozilla-locales
("0xndsph4v725q3xcpmxxjb9vxv19sssqnng82m9215cdsv9klgpb" "bf5f6e362f6f" "sco")
("0l70n8817mbmbc09fsnn2aqjj9k9dhad2gmzgphmiilf9mqm2dpf" "1f705c926a99" "si")
("19bqjazazww08chd1qc08dsnr2521088jq5jd4j3185yb1ypm3nr" "c1bd10d70325" "sk")
+ ("12q1nv6z4bk8yaw3vhl9xs41i7kpx1415mwg635v76fx8h94ycl3" "00eaf8d9e83b" "skr")
("11nmjmy2j249588ahg4mh9lxdqr476jbh28a07qxxibfa76j9vk3" "44be3cbf69b6" "sl")
("1ww35141nixg2s03kfmmq9fk6m3qiz2vg7p5a85shjp7i89pyj1d" "800576ff8ef9" "son")
("1q7nfybwc8mxdwi9fpvfhayq18mykzygkpakr5ngfz2316k8lf5r" "4de8638ac27f" "sq")
--
2.45.2
I
I
Ian Eure wrote on 17 Jul 05:06 +0200
[PATCH v4 3/3] gnu: librewolf: Update to 128.0-2
(address . 71832@debbugs.gnu.org)(name . Ian Eure)(address . ian@retrospec.tv)
20240717030619.26631-4-ian@retrospec.tv
* gnu/packages/librewolf.scm (librewolf): Update to 128.0-2. Reorganize
module to improve usability and reduce duplication. The Rust package and
build ID are now at the top of the file. The librewolf-source variable has
been replaced with the make-librewolf-source procedure, centralizing versions
& hashes in the librewolf package definition. Dedent some of the package’s
arguments to improve readability.

Change-Id: I15f8a2aa1fae07e0497ab5511d10af0c1f70cc2e

Change-Id: I6282c62937d7f59c0d0e5521c8d35f35df58982b
---
gnu/packages/librewolf.scm | 1049 ++++++++++++++++++------------------
1 file changed, 528 insertions(+), 521 deletions(-)

Toggle diff (403 lines)
diff --git a/gnu/packages/librewolf.scm b/gnu/packages/librewolf.scm
index 3e46477724..5e5988860a 100644
--- a/gnu/packages/librewolf.scm
+++ b/gnu/packages/librewolf.scm
@@ -94,6 +94,18 @@ (define-module (gnu packages librewolf)
#:use-module (gnu packages xdisorg)
#:use-module (gnu packages xorg))
+;; Define the versions of rust needed to build librewolf, trying to match
+;; upstream. See the file taskcluster/kinds/toolchain/rust.yml at
+;; https://searchfox.org under the particular firefox release, like
+;; mozilla-esr102.
+;; 1.75 is the default in Guix, 1.77 is the minimum for Librewolf.
+(define rust-librewolf rust-1.77)
+
+;; Update this id with every update to its release date.
+;; It's used for cache validation and therefore can lead to strange bugs.
+;; ex: date '+%Y%m%d%H%M%S'
+(define %librewolf-build-id "20240626133423")
+
(define (firefox-source-origin version hash)
(origin
(method url-fetch)
@@ -115,11 +127,14 @@ (define (librewolf-source-origin version hash)
(define computed-origin-method (@@ (guix packages) computed-origin-method))
-(define librewolf-source
- (let* ((ff-src (firefox-source-origin "126.0.1" "0fr679rcwshwpfxidc55b2xsn4pmrr7p9ix4rr2mv2k7kwsjcc7n"))
- (version "126.0.1-1")
- (lw-src (librewolf-source-origin version "0cac80073vkzd85ai9rbnwixs1h9bpy4dj2ri6jxdlqsy5d663km")))
-
+(define* (make-librewolf-source version #:key firefox-hash librewolf-hash)
+ (let* ((ff-src (firefox-source-origin
+ (car (string-split version #\-))
+ firefox-hash))
+ (version version)
+ (lw-src (librewolf-source-origin
+ version
+ librewolf-hash)))
(origin
(method computed-origin-method)
(file-name (string-append "librewolf-" version ".source.tar.gz"))
@@ -163,11 +178,6 @@ (define librewolf-source
(("^ff_source_tarball:=.*")
(string-append "ff_source_tarball:=" #+ff-src)))
- ;; Remove encoding_rs patch, it doesn't build with Rust 1.75.
- (substitute* '("assets/patches.txt")
- (("patches/encoding_rs.patch\\\n$")
- ""))
-
;; Stage locales.
(begin
(format #t "Staging locales...~%")
@@ -205,526 +215,523 @@ (define librewolf-source
".source.tar.gz")
#$output))))))))
-;; Define the versions of rust needed to build librewolf, trying to match
-;; upstream. See the file taskcluster/ci/toolchain/rust.yml at
-;; https://searchfox.org under the particular firefox release, like
-;; mozilla-esr102.
-(define rust-librewolf rust) ; 1.75 is the default in Guix, 1.65 is the minimum.
-
-;; Update this id with every update to its release date.
-;; It's used for cache validation and therefore can lead to strange bugs.
-;; ex: date '+%Y%m%d%H%M%S'
-(define %librewolf-build-id "20240607212143")
-
(define-public librewolf
- (package
- (name "librewolf")
- (version "126.0.1-1")
- (source librewolf-source)
- (build-system gnu-build-system)
- (arguments
- (list
- #:configure-flags #~(let ((clang #$(this-package-native-input "clang")))
- `("--enable-application=browser"
-
- ;; Configuration
- "--without-wasm-sandboxed-libraries"
- "--with-system-jpeg"
- "--with-system-zlib"
- "--with-system-png"
- "--with-system-webp"
- "--with-system-icu"
- "--with-system-libvpx"
- "--with-system-libevent"
- "--with-system-ffi"
- "--enable-system-pixman"
- "--enable-jemalloc"
-
- ;; see https://bugs.gnu.org/32833
- "--with-system-nspr"
- "--with-system-nss"
-
- ,(string-append "--with-clang-path=" clang
- "/bin/clang")
- ,(string-append "--with-libclang-path=" clang
- "/lib")
-
- ;; Distribution
- "--with-distribution-id=org.guix"
- "--with-app-name=librewolf"
- "--with-app-basename=LibreWolf"
- "--with-branding=browser/branding/librewolf"
-
- ;; Features
- "--disable-tests"
- "--disable-updater"
- "--enable-pulseaudio"
- "--disable-crashreporter"
- "--allow-addon-sideload"
- "--with-unsigned-addon-scopes=app,system"
-
- ;; switch only available on x86, whereas EME
- ;; is not supported on other targets
- ,@(if #$(target-x86?) '("--disable-eme") '())
-
- ;; Build details
- "--disable-debug"
- "--enable-rust-simd"
- "--enable-release"
- "--enable-optimize"
- "--enable-strip"
- "--enable-hardening"
- "--disable-elf-hack"))
- #:imported-modules %cargo-utils-modules
- #:modules `((ice-9 regex)
- (ice-9 string-fun)
- (ice-9 ftw)
- (srfi srfi-1)
- (srfi srfi-26)
- (rnrs bytevectors)
- (rnrs io ports)
- (guix elf)
- (guix build gremlin)
- ,@%gnu-build-system-modules)
- #:phases #~(modify-phases %standard-phases
- (add-after 'unpack 'fix-preferences
- (lambda* (#:key inputs #:allow-other-keys)
- (let ((port (open-file "browser/app/profile/firefox.js"
- "a")))
- (define (write-setting key value)
- (format port "~%pref(\"~a\", ~a);~%" key value)
- (format #t
+ (let ((version "128.0-2"))
+ (package
+ (name "librewolf")
+ (version version)
+ (source (make-librewolf-source
+ version
+ #:firefox-hash
+ "0wjiz7pahsqj7ibkyq9gggigq1hg983z50d0cbhs2pi3zgz1y9v5"
+ #:librewolf-hash
+ "0239m5r5nfn291slpxh1qhj3g3q2pskyp967ahvn7nbsqlvjyhag"))
+
+ (build-system gnu-build-system)
+ (arguments
+ (list
+ #:configure-flags
+ #~(let ((clang #$(this-package-native-input "clang")))
+ `("--enable-application=browser"
+
+ ;; Configuration
+ "--without-wasm-sandboxed-libraries"
+ "--with-system-jpeg"
+ "--with-system-zlib"
+ "--with-system-png"
+ "--with-system-webp"
+ "--with-system-icu"
+ "--with-system-libvpx"
+ "--with-system-libevent"
+ "--with-system-ffi"
+ "--enable-system-pixman"
+ "--enable-jemalloc"
+
+ ;; see https://bugs.gnu.org/32833
+ "--with-system-nspr"
+ "--with-system-nss"
+
+ ,(string-append "--with-clang-path=" clang
+ "/bin/clang")
+ ,(string-append "--with-libclang-path=" clang
+ "/lib")
+
+ ;; Distribution
+ "--with-distribution-id=org.guix"
+ "--with-app-name=librewolf"
+ "--with-app-basename=LibreWolf"
+ "--with-branding=browser/branding/librewolf"
+
+ ;; Features
+ "--disable-tests"
+ "--disable-updater"
+ "--enable-pulseaudio"
+ "--disable-crashreporter"
+ "--allow-addon-sideload"
+ "--with-unsigned-addon-scopes=app,system"
+ ;; switch only available on x86, whereas EME
+ ;; is not supported on other targets
+ ,@(if #$(target-x86?) '("--disable-eme") '())
+
+ ;; Build details
+ "--disable-debug"
+ "--enable-rust-simd"
+ "--enable-release"
+ "--enable-optimize"
+ "--enable-strip"
+ "--enable-hardening"
+ "--disable-elf-hack"))
+ #:imported-modules %cargo-utils-modules
+ #:modules `((ice-9 regex)
+ (ice-9 string-fun)
+ (ice-9 ftw)
+ (srfi srfi-1)
+ (srfi srfi-26)
+ (rnrs bytevectors)
+ (rnrs io ports)
+ (guix elf)
+ (guix build gremlin)
+ ,@%gnu-build-system-modules)
+ #:phases
+ #~(modify-phases %standard-phases
+ (add-after 'unpack 'fix-preferences
+ (lambda* (#:key inputs #:allow-other-keys)
+ (let ((port (open-file "browser/app/profile/firefox.js"
+ "a")))
+ (define (write-setting key value)
+ (format port "~%pref(\"~a\", ~a);~%" key value)
+ (format #t
"fix-preferences: setting value of ~a to ~a~%" key
value))
- ;; We should allow the sandbox to read the store directory,
- ;; because the sandbox has access to /usr on FHS distros.
- (write-setting
- "security.sandbox.content.read_path_whitelist"
- (string-append "\""
- (%store-directory) "/\""))
-
- ;; XDG settings should be managed by Guix.
- (write-setting "browser.shell.checkDefaultBrowser"
- "false")
- (close-port port))))
- (add-after 'fix-preferences 'fix-ffmpeg-runtime-linker
- (lambda* (#:key inputs #:allow-other-keys)
- (let* ((ffmpeg (assoc-ref inputs "ffmpeg"))
- (libavcodec (string-append ffmpeg
- "/lib/libavcodec.so")))
- ;; Arrange to load libavcodec.so by its absolute file name.
- (substitute* "dom/media/platforms/ffmpeg/FFmpegRuntimeLinker.cpp"
- (("libavcodec\\.so")
- libavcodec)))))
- (add-after 'patch-source-shebangs 'patch-cargo-checksums
- (lambda _
- (use-modules (guix build cargo-utils))
- (let ((null-hash
- ;; This is the SHA256 output of an empty string.
- (string-append
- "e3b0c44298fc1c149afbf4c8996fb924"
- "27ae41e4649b934ca495991b7852b855")))
- (for-each (lambda (file)
- (format #t
+ ;; We should allow the sandbox to read the store directory,
+ ;; because the sandbox has access to /usr on FHS distros.
+ (write-setting
+ "security.sandbox.content.read_path_whitelist"
+ (string-append "\""
+ (%store-directory) "/\""))
+
+ ;; XDG settings should be managed by Guix.
+ (write-setting "browser.shell.checkDefaultBrowser"
+ "false")
+ (close-port port))))
+ (add-after 'fix-preferences 'fix-ffmpeg-runtime-linker
+ (lambda* (#:key inputs #:allow-other-keys)
+ (let* ((ffmpeg (assoc-ref inputs "ffmpeg"))
+ (libavcodec (string-append ffmpeg
+ "/lib/libavcodec.so")))
+ ;; Arrange to load libavcodec.so by its absolute file name.
+ (substitute* "dom/media/platforms/ffmpeg/FFmpegRuntimeLinker.cpp"
+ (("libavcodec\\.so")
+ libavcodec)))))
+ (add-after 'patch-source-shebangs 'patch-cargo-checksums
+ (lambda _
+ (use-modules (guix build cargo-utils))
+ (let ((null-hash
+ ;; This is the SHA256 output of an empty string.
+ (string-append
+ "e3b0c44298fc1c149afbf4c8996fb924"
+ "27ae41e4649b934ca495991b7852b855")))
+ (for-each (lambda (file)
+ (format #t
"patch-cargo-checksums: patching checksums in ~a~%"
file)
- (substitute* file
- (("(checksum = )\".*\"" all name)
- (string-append name "\"" null-hash
- "\""))))
- (find-files "." "Cargo\\.lock$"))
- (for-each generate-all-checksums
- '("build"
- "dom/media"
- "dom/webauthn"
- "gfx"
- "intl"
- "js"
- "media"
- "modules"
- "mozglue/static/rust"
- "netwerk"
- "remote"
- "security/manager/ssl"
- "servo"
- "storage"
- "third_party/rust"
- "toolkit"
- "xpcom/rust"
- "services")))))
- (add-after 'patch-cargo-checksums 'remove-cargo-frozen-flag
- (lambda _
- ;; Remove --frozen flag from cargo invokation, otherwise it'll
- ;; complain that it's not able to change Cargo.lock.
- ;; https://bugzilla.mozilla.org/show_bug.cgi?id=1726373
- (substitute* "build/RunCbindgen.py"
- (("args.append\\(\"--frozen\"\\)") "pass"))))
- (delete 'bootstrap)
- (add-before 'configure 'patch-SpeechDispatcherService.cpp
- (lambda _
- (let* ((lib "libspeechd.so.2")
- (file (string-append
- "dom/media/webspeech/synth/"
- "speechd/SpeechDispatcherService.cpp"))
- (old-content (call-with-input-file file
- get-string-all)))
- (substitute
- file
- `((,(format #f "~s" lib) unquote
- (lambda (line _)
- (string-replace-substring
- line lib
- (string-append #$speech-dispatcher
- "/lib/" lib))))))
- (if (string=? old-content
- (call-with-input-file file
- get-string-all))
- (error
- "substitute did nothing, phase requires an update")))))
- (add-before 'configure 'set-build-id
- ;; Build will write the timestamp to output, which is harmful
- ;; for reproducibility, so change it to a fixed date. Use a
- ;; separate phase for easier modification with inherit.
- (lambda _
- (setenv "MOZ_BUILD_DATE"
- #$%librewolf-build-id)))
- (replace 'configure
- (lambda* (#:key inputs outputs configure-flags
- #:allow-other-keys)
- (setenv "AUTOCONF"
- (string-append (assoc-ref inputs "autoconf")
- "/bin/autoconf"))
- (setenv "SHELL"
- (which "bash"))
- (setenv "CONFIG_SHELL"
- (which "bash"))
- (setenv "MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE"
- "system")
- ;; This should use the host info probably (does it
- ;; build on non-x86_64 though?)
- (setenv "GUIX_PYTHONPATH"
- (string-append (getcwd)
- "/obj-x86_64-pc-linux-gnu/_virtualenvs/build"))
-
- ;; Use Clang, Clang is 2x faster than GCC
- (setenv "AR" "llvm-ar")
- (setenv "NM" "llvm-nm")
- (setenv "CC" "clang")
- (setenv "CXX" "clang++")
- (setenv "MOZ_NOSPAM" "1")
- (setenv "MOZ_APP_NAME" "librewolf")
-
- (setenv "MOZBUILD_STATE_PATH"
- (getcwd))
-
- (let* ((mozconfig (string-append (getcwd) "/mozconfig"))
- (out (assoc-ref outputs "out"))
- (flags (cons (string-append "--prefix=" out)
- configure-flags)))
- (format #t "build directory: ~s~%"
- (getcwd))
- (format #t "configure flags: ~s~%" flags)
-
- (define write-flags
- (lambda flags
- (display (string-join (map (cut string-append
- "ac_add_options " <>)
- flags) "\n"))
- (display "\n")))
- (with-output-to-file mozconfig
- (lambda ()
This message was truncated. Download the full message here.
I
I
Ian Eure wrote on 21 Jul 18:17 +0200
Re: [PATCH 0/2] Add nss-latest; updte Librewolf to 127.0.2-2.
(address . control@debbugs.gnu.org)(address . 71832@debbugs.gnu.org)
87le1uu38i.fsf@meson
retitle 71832 [PATCH v4 0/3] Add nss-rapid; update Librewolf to
128.0-2
thanks

Toggle quote (16 lines)
> Hello,
>
> I have pushed the patch of #71882 to fix the build on non-x86
> architectures.
> I could still build on x86_64, but could still not build on
> aarch64; but
> the latter failure is probably due to a lack of memory (the
> configure phase
> passes now, but the build fails later on with a SIGKILL).
>
> As this means that the librewolf update of #71832 needs to be
> rebased,
> I am cc-ing this bug.
>
> Andreas

Thank you, I’ve rebased and updated.

Thanks,

— Ian
I
I
Ian Eure wrote on 31 Jul 05:54 +0200
[PATCH v5 1/3] gnu: Add nss-rapid.
(address . 71832@debbugs.gnu.org)(name . Ian Eure)(address . ian@retrospec.tv)
20240731035501.27512-2-ian@retrospec.tv
* gnu/packages/nss.scm (nss-rapid): New variable.

Change-Id: I2bdd2119fb0c857feae9eb2e47a28909b8228cd7
---
gnu/packages/nss.scm | 80 ++++++++++++++++++++++++++++++++++++++++----
1 file changed, 74 insertions(+), 6 deletions(-)

Toggle diff (108 lines)
diff --git a/gnu/packages/nss.scm b/gnu/packages/nss.scm
index 9224a8ed5a..17f05a65b0 100644
--- a/gnu/packages/nss.scm
+++ b/gnu/packages/nss.scm
@@ -106,6 +106,9 @@ (define-public nspr-4.32
(base32
"0v3zds1id71j5a5si42a658fjz8nv2f6zp6w4gqrqmdr6ksz8sxv"))))))
+;; nss should track ESRs, but currently doesn't. When the next ESR it out, it
+;; should get updated.
+
(define-public nss
(package
(name "nss")
@@ -153,13 +156,13 @@ (define-public nss
;; Ensure we are building for the (%current-target-system).
#$@(if (%current-target-system)
#~((string-append
- "OS_TEST="
- (string-take #$(%current-target-system)
- (string-index #$(%current-target-system) #\-)))
+ "OS_TEST="
+ (string-take #$(%current-target-system)
+ (string-index #$(%current-target-system) #\-)))
(string-append
- "KERNEL=" (cond (#$(target-hurd?) "gnu")
- (#$(target-linux?) "linux")
- (else ""))))
+ "KERNEL=" (cond (#$(target-hurd?) "gnu")
+ (#$(target-linux?) "linux")
+ (else ""))))
#~())
#$@(if (%current-target-system)
#~("CROSS_COMPILE=1")
@@ -303,6 +306,71 @@ (define-public nss/fixed
(invoke "faketime" "2024-01-23" "./nss/tests/all.sh"))
(format #t "test suite not run~%"))))))))))))
+;; nss-rapid tracks the rapid release channel. Unless your package requires a
+;; newer version, you should prefer the `nss' package, which tracks the ESR
+;; channel.
+;;
+;; See https://wiki.mozilla.org/NSS:Release_Versions
+;; and https://wiki.mozilla.org/Rapid_Release_Model
+
+(define-public nss-rapid
+ (package
+ (inherit nss)
+ (name "nss-rapid")
+ (version "3.102.1")
+ (source (origin
+ (inherit (package-source nss))
+ (uri (let ((version-with-underscores
+ (string-join (string-split version #\.) "_")))
+ (string-append
+ "https://ftp.mozilla.org/pub/mozilla.org/security/nss/"
+ "releases/NSS_" version-with-underscores "_RTM/src/"
+ "nss-" version ".tar.gz")))
+ (sha256
+ (base32
+ "1k1pjxz0ab4lg8xqggbb8pw77c1q8h4bldi09z4pj5g4hwsjv62l"))))
+ (arguments
+ (substitute-keyword-arguments (package-arguments nss)
+ ((#:phases phases)
+ #~(modify-phases #$phases
+ (replace 'check
+ (lambda* (#:key tests? #:allow-other-keys)
+ (if tests?
+ (begin
+ ;; Use 127.0.0.1 instead of $HOST.$DOMSUF as HOSTADDR for
+ ;; testing. The latter requires a working DNS or /etc/hosts.
+ (setenv "DOMSUF" "localdomain")
+ (setenv "USE_IP" "TRUE")
+ (setenv "IP_ADDRESS" "127.0.0.1")
+
+ ;; This specific test is looking at performance "now
+ ;; verify that we can quickly dump a database", and
+ ;; we're not testing performance here (especially
+ ;; since we're using faketime), so raise the
+ ;; threshold
+ (substitute* "nss/tests/dbtests/dbtests.sh"
+ ((" -lt 5") " -lt 50"))
+
+ ;; Since the test suite is very lengthy, run the test
+ ;; suite once, not thrice as done by default, by
+ ;; selecting only the 'standard' cycle.
+ (setenv "NSS_CYCLES" "standard")
+
+ ;; The "PayPalEE.cert" certificate expires every six months,
+ ;; leading to test failures:
+ ;; <https://bugzilla.mozilla.org/show_bug.cgi?id=609734>. To
+ ;; work around that, set the time to roughly the release date.
+ (invoke "faketime" "2024-01-23" "./nss/tests/all.sh"))
+ (format #t "test suite not run~%"))))))))
+ (synopsis "Network Security Services (Rapid Release)")
+ (description
+ "Network Security Services (@dfn{NSS}) is a set of libraries designed to
+support cross-platform development of security-enabled client and server
+applications. Applications built with NSS can support SSL v2 and v3, TLS,
+PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other
+security standards.
+
+This package tracks the Rapid Release channel, which updates frequently.")))
(define-public nsncd
(package
(name "nsncd")
--
2.45.2
I
I
Ian Eure wrote on 31 Jul 05:54 +0200
[PATCH v5 0/3] [SECURITY] Add nss-rapid; update Librewolf to 128.0.3-1
(address . 71832@debbugs.gnu.org)
20240731035501.27512-1-ian@retrospec.tv
retitle 71832 [PATCH v5 0/3] [SECURITY] Add nss-rapid; update Librewolf to 128.0.3-1
thanks

New upstream versions of nss-rapid and LibreWolf. This contains security fixes for:

CVE-2024-6605: Firefox Android missed activation delay to prevent tapjacking debugger eval code
CVE-2024-6606: Out-of-bounds read in clipboard component debugger eval code
CVE-2024-6607: Leaving pointerlock by pressing the escape key could be prevented debugger eval code
CVE-2024-6608: Cursor could be moved out of the viewport using pointerlock. debugger eval code
CVE-2024-6609: Memory corruption in NSS debugger eval code
CVE-2024-6610: Form validation popups could block exiting full-screen mode debugger eval code
CVE-2024-6600: Memory corruption in WebGL API debugger eval code
CVE-2024-6601: Race condition in permission assignment debugger eval code
CVE-2024-6602: Memory corruption in NSS debugger eval code
CVE-2024-6603: Memory corruption in thread creation debugger eval code
CVE-2024-6611: Incorrect handling of SameSite cookies debugger eval code
CVE-2024-6612: CSP violation leakage when using devtools debugger eval code
CVE-2024-6613: Incorrect listing of stack frames debugger eval code
CVE-2024-6614: Incorrect listing of stack frames debugger eval code
CVE-2024-6604: Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, Thunderbird 128, and Thunderbird 115.13 debugger eval code
CVE-2024-6615: Memory safety bugs fixed in Firefox 128 and Thunderbird 128

This also includes a fix for the application icon not showing up in DEs.


Ian Eure (3):
gnu: Add nss-rapid.
gnu: gnuzilla: Add skr to all-mozilla-locales.
gnu: librewolf: Update to 128.0.3-1

gnu/packages/gnuzilla.scm | 1 +
gnu/packages/librewolf.scm | 1054 ++++++++++++++++++------------------
gnu/packages/nss.scm | 80 ++-
3 files changed, 606 insertions(+), 529 deletions(-)

--
2.45.2
I
I
Ian Eure wrote on 31 Jul 05:55 +0200
[PATCH v5 2/3] gnu: gnuzilla: Add skr to all-mozilla-locales.
(address . 71832@debbugs.gnu.org)(name . Ian Eure)(address . ian@retrospec.tv)
20240731035501.27512-3-ian@retrospec.tv
* (gnuzilla): Add skr to all-mozilla-locales.

Change-Id: If996048792a53dffb55b7e16e69370dd72fc78e3
---
gnu/packages/gnuzilla.scm | 1 +
1 file changed, 1 insertion(+)

Toggle diff (14 lines)
diff --git a/gnu/packages/gnuzilla.scm b/gnu/packages/gnuzilla.scm
index 3e7818ba43..98dd67a5dd 100644
--- a/gnu/packages/gnuzilla.scm
+++ b/gnu/packages/gnuzilla.scm
@@ -508,6 +508,7 @@ (define-public all-mozilla-locales
("0xndsph4v725q3xcpmxxjb9vxv19sssqnng82m9215cdsv9klgpb" "bf5f6e362f6f" "sco")
("0l70n8817mbmbc09fsnn2aqjj9k9dhad2gmzgphmiilf9mqm2dpf" "1f705c926a99" "si")
("19bqjazazww08chd1qc08dsnr2521088jq5jd4j3185yb1ypm3nr" "c1bd10d70325" "sk")
+ ("12q1nv6z4bk8yaw3vhl9xs41i7kpx1415mwg635v76fx8h94ycl3" "00eaf8d9e83b" "skr")
("11nmjmy2j249588ahg4mh9lxdqr476jbh28a07qxxibfa76j9vk3" "44be3cbf69b6" "sl")
("1ww35141nixg2s03kfmmq9fk6m3qiz2vg7p5a85shjp7i89pyj1d" "800576ff8ef9" "son")
("1q7nfybwc8mxdwi9fpvfhayq18mykzygkpakr5ngfz2316k8lf5r" "4de8638ac27f" "sq")
--
2.45.2
I
I
Ian Eure wrote on 31 Jul 05:55 +0200
[PATCH v5 3/3] gnu: librewolf: Update to 128.0.3-1
(address . 71832@debbugs.gnu.org)(name . Ian Eure)(address . ian@retrospec.tv)
20240731035501.27512-4-ian@retrospec.tv
* gnu/packages/librewolf.scm (librewolf): Update to 128.0.3-1. Reorganize
module to improve usability and reduce duplication. The Rust package and
build ID are now at the top of the file. The librewolf-source variable has
been replaced with the make-librewolf-source procedure, centralizing versions
& hashes in the librewolf package definition. Dedent some of the package’s
arguments to improve readability.

Change-Id: I15f8a2aa1fae07e0497ab5511d10af0c1f70cc2e
---
gnu/packages/librewolf.scm | 1054 ++++++++++++++++++------------------
1 file changed, 531 insertions(+), 523 deletions(-)

Toggle diff (407 lines)
diff --git a/gnu/packages/librewolf.scm b/gnu/packages/librewolf.scm
index 3e46477724..def21997fc 100644
--- a/gnu/packages/librewolf.scm
+++ b/gnu/packages/librewolf.scm
@@ -94,12 +94,24 @@ (define-module (gnu packages librewolf)
#:use-module (gnu packages xdisorg)
#:use-module (gnu packages xorg))
+;; Define the versions of rust needed to build librewolf, trying to match
+;; upstream. See the file taskcluster/kinds/toolchain/rust.yml at
+;; https://searchfox.org under the particular firefox release, like
+;; mozilla-esr102.
+;; 1.75 is the default in Guix, 1.77 is the minimum for Librewolf.
+(define rust-librewolf rust-1.77)
+
+;; Update this id with every update to its release date.
+;; It's used for cache validation and therefore can lead to strange bugs.
+;; ex: date '+%Y%m%d%H%M%S'
+(define %librewolf-build-id "20240730155826")
+
(define (firefox-source-origin version hash)
(origin
(method url-fetch)
(uri (string-append
"https://ftp.mozilla.org/pub/firefox/releases/"
- version "/source/" "firefox-" version
+ version "/source/firefox-" version
".source.tar.xz"))
(sha256 (base32 hash))))
@@ -115,11 +127,14 @@ (define (librewolf-source-origin version hash)
(define computed-origin-method (@@ (guix packages) computed-origin-method))
-(define librewolf-source
- (let* ((ff-src (firefox-source-origin "126.0.1" "0fr679rcwshwpfxidc55b2xsn4pmrr7p9ix4rr2mv2k7kwsjcc7n"))
- (version "126.0.1-1")
- (lw-src (librewolf-source-origin version "0cac80073vkzd85ai9rbnwixs1h9bpy4dj2ri6jxdlqsy5d663km")))
-
+(define* (make-librewolf-source version #:key firefox-hash librewolf-hash)
+ (let* ((ff-src (firefox-source-origin
+ (car (string-split version #\-))
+ firefox-hash))
+ (version version)
+ (lw-src (librewolf-source-origin
+ version
+ librewolf-hash)))
(origin
(method computed-origin-method)
(file-name (string-append "librewolf-" version ".source.tar.gz"))
@@ -163,11 +178,6 @@ (define librewolf-source
(("^ff_source_tarball:=.*")
(string-append "ff_source_tarball:=" #+ff-src)))
- ;; Remove encoding_rs patch, it doesn't build with Rust 1.75.
- (substitute* '("assets/patches.txt")
- (("patches/encoding_rs.patch\\\n$")
- ""))
-
;; Stage locales.
(begin
(format #t "Staging locales...~%")
@@ -205,526 +215,524 @@ (define librewolf-source
".source.tar.gz")
#$output))))))))
-;; Define the versions of rust needed to build librewolf, trying to match
-;; upstream. See the file taskcluster/ci/toolchain/rust.yml at
-;; https://searchfox.org under the particular firefox release, like
-;; mozilla-esr102.
-(define rust-librewolf rust) ; 1.75 is the default in Guix, 1.65 is the minimum.
-
-;; Update this id with every update to its release date.
-;; It's used for cache validation and therefore can lead to strange bugs.
-;; ex: date '+%Y%m%d%H%M%S'
-(define %librewolf-build-id "20240607212143")
-
(define-public librewolf
- (package
- (name "librewolf")
- (version "126.0.1-1")
- (source librewolf-source)
- (build-system gnu-build-system)
- (arguments
- (list
- #:configure-flags #~(let ((clang #$(this-package-native-input "clang")))
- `("--enable-application=browser"
-
- ;; Configuration
- "--without-wasm-sandboxed-libraries"
- "--with-system-jpeg"
- "--with-system-zlib"
- "--with-system-png"
- "--with-system-webp"
- "--with-system-icu"
- "--with-system-libvpx"
- "--with-system-libevent"
- "--with-system-ffi"
- "--enable-system-pixman"
- "--enable-jemalloc"
-
- ;; see https://bugs.gnu.org/32833
- "--with-system-nspr"
- "--with-system-nss"
-
- ,(string-append "--with-clang-path=" clang
- "/bin/clang")
- ,(string-append "--with-libclang-path=" clang
- "/lib")
-
- ;; Distribution
- "--with-distribution-id=org.guix"
- "--with-app-name=librewolf"
- "--with-app-basename=LibreWolf"
- "--with-branding=browser/branding/librewolf"
-
- ;; Features
- "--disable-tests"
- "--disable-updater"
- "--enable-pulseaudio"
- "--disable-crashreporter"
- "--allow-addon-sideload"
- "--with-unsigned-addon-scopes=app,system"
-
- ;; switch only available on x86, whereas EME
- ;; is not supported on other targets
- ,@(if #$(target-x86?) '("--disable-eme") '())
-
- ;; Build details
- "--disable-debug"
- "--enable-rust-simd"
- "--enable-release"
- "--enable-optimize"
- "--enable-strip"
- "--enable-hardening"
- "--disable-elf-hack"))
- #:imported-modules %cargo-utils-modules
- #:modules `((ice-9 regex)
- (ice-9 string-fun)
- (ice-9 ftw)
- (srfi srfi-1)
- (srfi srfi-26)
- (rnrs bytevectors)
- (rnrs io ports)
- (guix elf)
- (guix build gremlin)
- ,@%gnu-build-system-modules)
- #:phases #~(modify-phases %standard-phases
- (add-after 'unpack 'fix-preferences
- (lambda* (#:key inputs #:allow-other-keys)
- (let ((port (open-file "browser/app/profile/firefox.js"
- "a")))
- (define (write-setting key value)
- (format port "~%pref(\"~a\", ~a);~%" key value)
- (format #t
+ (let ((version "128.0.3-1"))
+ (package
+ (name "librewolf")
+ (version version)
+ (source (make-librewolf-source
+ version
+ #:firefox-hash
+ "1p6ymqzp23xfd4h3lc6aihjbq1ljspli9m17bm6rgklkbk6m8r1j"
+ #:librewolf-hash
+ "0pp36q4rcsiyv9b09jfgfrl1k3vqp5bh08c9iq0r2v8is5rbcdz5"))
+
+ (build-system gnu-build-system)
+ (arguments
+ (list
+ #:configure-flags
+ #~(let ((clang #$(this-package-native-input "clang")))
+ `("--enable-application=browser"
+
+ ;; Configuration
+ "--without-wasm-sandboxed-libraries"
+ "--with-system-jpeg"
+ "--with-system-zlib"
+ "--with-system-png"
+ "--with-system-webp"
+ "--with-system-icu"
+ "--with-system-libvpx"
+ "--with-system-libevent"
+ "--with-system-ffi"
+ "--enable-system-pixman"
+ "--enable-jemalloc"
+
+ ;; see https://bugs.gnu.org/32833
+ "--with-system-nspr"
+ "--with-system-nss"
+
+ ,(string-append "--with-clang-path=" clang
+ "/bin/clang")
+ ,(string-append "--with-libclang-path=" clang
+ "/lib")
+
+ ;; Distribution
+ "--with-distribution-id=org.guix"
+ "--with-app-name=librewolf"
+ "--with-app-basename=LibreWolf"
+ "--with-branding=browser/branding/librewolf"
+
+ ;; Features
+ "--disable-tests"
+ "--disable-updater"
+ "--enable-pulseaudio"
+ "--disable-crashreporter"
+ "--allow-addon-sideload"
+ "--with-unsigned-addon-scopes=app,system"
+ ;; switch only available on x86, whereas EME
+ ;; is not supported on other targets
+ ,@(if #$(target-x86?) '("--disable-eme") '())
+
+ ;; Build details
+ "--disable-debug"
+ "--enable-rust-simd"
+ "--enable-release"
+ "--enable-optimize"
+ "--enable-strip"
+ "--enable-hardening"
+ "--disable-elf-hack"))
+ #:imported-modules %cargo-utils-modules
+ #:modules `((ice-9 regex)
+ (ice-9 string-fun)
+ (ice-9 ftw)
+ (srfi srfi-1)
+ (srfi srfi-26)
+ (rnrs bytevectors)
+ (rnrs io ports)
+ (guix elf)
+ (guix build gremlin)
+ ,@%gnu-build-system-modules)
+ #:phases
+ #~(modify-phases %standard-phases
+ (add-after 'unpack 'fix-preferences
+ (lambda* (#:key inputs #:allow-other-keys)
+ (let ((port (open-file "browser/app/profile/firefox.js"
+ "a")))
+ (define (write-setting key value)
+ (format port "~%pref(\"~a\", ~a);~%" key value)
+ (format #t
"fix-preferences: setting value of ~a to ~a~%" key
value))
- ;; We should allow the sandbox to read the store directory,
- ;; because the sandbox has access to /usr on FHS distros.
- (write-setting
- "security.sandbox.content.read_path_whitelist"
- (string-append "\""
- (%store-directory) "/\""))
-
- ;; XDG settings should be managed by Guix.
- (write-setting "browser.shell.checkDefaultBrowser"
- "false")
- (close-port port))))
- (add-after 'fix-preferences 'fix-ffmpeg-runtime-linker
- (lambda* (#:key inputs #:allow-other-keys)
- (let* ((ffmpeg (assoc-ref inputs "ffmpeg"))
- (libavcodec (string-append ffmpeg
- "/lib/libavcodec.so")))
- ;; Arrange to load libavcodec.so by its absolute file name.
- (substitute* "dom/media/platforms/ffmpeg/FFmpegRuntimeLinker.cpp"
- (("libavcodec\\.so")
- libavcodec)))))
- (add-after 'patch-source-shebangs 'patch-cargo-checksums
- (lambda _
- (use-modules (guix build cargo-utils))
- (let ((null-hash
- ;; This is the SHA256 output of an empty string.
- (string-append
- "e3b0c44298fc1c149afbf4c8996fb924"
- "27ae41e4649b934ca495991b7852b855")))
- (for-each (lambda (file)
- (format #t
+ ;; We should allow the sandbox to read the store directory,
+ ;; because the sandbox has access to /usr on FHS distros.
+ (write-setting
+ "security.sandbox.content.read_path_whitelist"
+ (string-append "\""
+ (%store-directory) "/\""))
+
+ ;; XDG settings should be managed by Guix.
+ (write-setting "browser.shell.checkDefaultBrowser"
+ "false")
+ (close-port port))))
+ (add-after 'fix-preferences 'fix-ffmpeg-runtime-linker
+ (lambda* (#:key inputs #:allow-other-keys)
+ (let* ((ffmpeg (assoc-ref inputs "ffmpeg"))
+ (libavcodec (string-append ffmpeg
+ "/lib/libavcodec.so")))
+ ;; Arrange to load libavcodec.so by its absolute file name.
+ (substitute* "dom/media/platforms/ffmpeg/FFmpegRuntimeLinker.cpp"
+ (("libavcodec\\.so")
+ libavcodec)))))
+ (add-after 'patch-source-shebangs 'patch-cargo-checksums
+ (lambda _
+ (use-modules (guix build cargo-utils))
+ (let ((null-hash
+ ;; This is the SHA256 output of an empty string.
+ (string-append
+ "e3b0c44298fc1c149afbf4c8996fb924"
+ "27ae41e4649b934ca495991b7852b855")))
+ (for-each (lambda (file)
+ (format #t
"patch-cargo-checksums: patching checksums in ~a~%"
file)
- (substitute* file
- (("(checksum = )\".*\"" all name)
- (string-append name "\"" null-hash
- "\""))))
- (find-files "." "Cargo\\.lock$"))
- (for-each generate-all-checksums
- '("build"
- "dom/media"
- "dom/webauthn"
- "gfx"
- "intl"
- "js"
- "media"
- "modules"
- "mozglue/static/rust"
- "netwerk"
- "remote"
- "security/manager/ssl"
- "servo"
- "storage"
- "third_party/rust"
- "toolkit"
- "xpcom/rust"
- "services")))))
- (add-after 'patch-cargo-checksums 'remove-cargo-frozen-flag
- (lambda _
- ;; Remove --frozen flag from cargo invokation, otherwise it'll
- ;; complain that it's not able to change Cargo.lock.
- ;; https://bugzilla.mozilla.org/show_bug.cgi?id=1726373
- (substitute* "build/RunCbindgen.py"
- (("args.append\\(\"--frozen\"\\)") "pass"))))
- (delete 'bootstrap)
- (add-before 'configure 'patch-SpeechDispatcherService.cpp
- (lambda _
- (let* ((lib "libspeechd.so.2")
- (file (string-append
- "dom/media/webspeech/synth/"
- "speechd/SpeechDispatcherService.cpp"))
- (old-content (call-with-input-file file
- get-string-all)))
- (substitute
- file
- `((,(format #f "~s" lib) unquote
- (lambda (line _)
- (string-replace-substring
- line lib
- (string-append #$speech-dispatcher
- "/lib/" lib))))))
- (if (string=? old-content
- (call-with-input-file file
- get-string-all))
- (error
- "substitute did nothing, phase requires an update")))))
- (add-before 'configure 'set-build-id
- ;; Build will write the timestamp to output, which is harmful
- ;; for reproducibility, so change it to a fixed date. Use a
- ;; separate phase for easier modification with inherit.
- (lambda _
- (setenv "MOZ_BUILD_DATE"
- #$%librewolf-build-id)))
- (replace 'configure
- (lambda* (#:key inputs outputs configure-flags
- #:allow-other-keys)
- (setenv "AUTOCONF"
- (string-append (assoc-ref inputs "autoconf")
- "/bin/autoconf"))
- (setenv "SHELL"
- (which "bash"))
- (setenv "CONFIG_SHELL"
- (which "bash"))
- (setenv "MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE"
- "system")
- ;; This should use the host info probably (does it
- ;; build on non-x86_64 though?)
- (setenv "GUIX_PYTHONPATH"
- (string-append (getcwd)
- "/obj-x86_64-pc-linux-gnu/_virtualenvs/build"))
-
- ;; Use Clang, Clang is 2x faster than GCC
- (setenv "AR" "llvm-ar")
- (setenv "NM" "llvm-nm")
- (setenv "CC" "clang")
- (setenv "CXX" "clang++")
- (setenv "MOZ_NOSPAM" "1")
- (setenv "MOZ_APP_NAME" "librewolf")
-
- (setenv "MOZBUILD_STATE_PATH"
- (getcwd))
-
- (let* ((mozconfig (string-append (getcwd) "/mozconfig"))
- (out (assoc-ref outputs "out"))
- (flags (cons (string-append "--prefix=" out)
- configure-flags)))
- (format #t "build directory: ~s~%"
- (getcwd))
- (format #t "configure flags: ~s~%" flags)
-
- (define write-flags
- (lambda flags
- (display (string-join (map (cut string-append
- "ac_add_options " <>)
-
This message was truncated. Download the full message here.
I
I
Ian Eure wrote on 17 Aug 21:32 +0200
[PATCH v6 1/3] gnu: gnuzilla: Add skr to all-mozilla-locales.
(address . 71832@debbugs.gnu.org)
20240817193240.27089-2-ian@retrospec.tv
* (gnuzilla): Add skr to all-mozilla-locales.

Change-Id: If996048792a53dffb55b7e16e69370dd72fc78e3
---
gnu/packages/gnuzilla.scm | 1 +
1 file changed, 1 insertion(+)

Toggle diff (14 lines)
diff --git a/gnu/packages/gnuzilla.scm b/gnu/packages/gnuzilla.scm
index 039b6de71c..df48976419 100644
--- a/gnu/packages/gnuzilla.scm
+++ b/gnu/packages/gnuzilla.scm
@@ -508,6 +508,7 @@ (define-public all-mozilla-locales
("0xndsph4v725q3xcpmxxjb9vxv19sssqnng82m9215cdsv9klgpb" "bf5f6e362f6f" "sco")
("0l70n8817mbmbc09fsnn2aqjj9k9dhad2gmzgphmiilf9mqm2dpf" "1f705c926a99" "si")
("19bqjazazww08chd1qc08dsnr2521088jq5jd4j3185yb1ypm3nr" "c1bd10d70325" "sk")
+ ("12q1nv6z4bk8yaw3vhl9xs41i7kpx1415mwg635v76fx8h94ycl3" "00eaf8d9e83b" "skr")
("11nmjmy2j249588ahg4mh9lxdqr476jbh28a07qxxibfa76j9vk3" "44be3cbf69b6" "sl")
("1ww35141nixg2s03kfmmq9fk6m3qiz2vg7p5a85shjp7i89pyj1d" "800576ff8ef9" "son")
("1q7nfybwc8mxdwi9fpvfhayq18mykzygkpakr5ngfz2316k8lf5r" "4de8638ac27f" "sq")
--
2.45.2
I
I
Ian Eure wrote on 17 Aug 21:32 +0200
[PATCH v6 2/3] gnu: Add nss-rapid.
(address . 71832@debbugs.gnu.org)
20240817193240.27089-3-ian@retrospec.tv
* gnu/packages/nss.scm (nss-rapid): New variable.

Change-Id: I2bdd2119fb0c857feae9eb2e47a28909b8228cd7
---
gnu/packages/nss.scm | 67 ++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 67 insertions(+)

Toggle diff (87 lines)
diff --git a/gnu/packages/nss.scm b/gnu/packages/nss.scm
index 9224a8ed5a..1a684e6146 100644
--- a/gnu/packages/nss.scm
+++ b/gnu/packages/nss.scm
@@ -106,6 +106,8 @@ (define-public nspr-4.32
(base32
"0v3zds1id71j5a5si42a658fjz8nv2f6zp6w4gqrqmdr6ksz8sxv"))))))
+;; nss should track ESRs, but currently doesn't. 3.102.1 is the current ESR.
+
(define-public nss
(package
(name "nss")
@@ -303,6 +305,71 @@ (define-public nss/fixed
(invoke "faketime" "2024-01-23" "./nss/tests/all.sh"))
(format #t "test suite not run~%"))))))))))))
+;; nss-rapid tracks the rapid release channel. Unless your package requires a
+;; newer version, you should prefer the `nss' package, which tracks the ESR
+;; channel.
+;;
+;; See https://wiki.mozilla.org/NSS:Release_Versions
+;; and https://wiki.mozilla.org/Rapid_Release_Model
+
+(define-public nss-rapid
+ (package
+ (inherit nss)
+ (name "nss-rapid")
+ (version "3.103")
+ (source (origin
+ (inherit (package-source nss))
+ (uri (let ((version-with-underscores
+ (string-join (string-split version #\.) "_")))
+ (string-append
+ "https://ftp.mozilla.org/pub/mozilla.org/security/nss/"
+ "releases/NSS_" version-with-underscores "_RTM/src/"
+ "nss-" version ".tar.gz")))
+ (sha256
+ (base32
+ "0qp9rs226rr6gh51b42cdbydr4mj80cli3bfqhh7bp3jyxbvcjkv"))))
+ (arguments
+ (substitute-keyword-arguments (package-arguments nss)
+ ((#:phases phases)
+ #~(modify-phases #$phases
+ (replace 'check
+ (lambda* (#:key tests? #:allow-other-keys)
+ (if tests?
+ (begin
+ ;; Use 127.0.0.1 instead of $HOST.$DOMSUF as HOSTADDR for
+ ;; testing. The latter requires a working DNS or /etc/hosts.
+ (setenv "DOMSUF" "localdomain")
+ (setenv "USE_IP" "TRUE")
+ (setenv "IP_ADDRESS" "127.0.0.1")
+
+ ;; This specific test is looking at performance "now
+ ;; verify that we can quickly dump a database", and
+ ;; we're not testing performance here (especially
+ ;; since we're using faketime), so raise the
+ ;; threshold
+ (substitute* "nss/tests/dbtests/dbtests.sh"
+ ((" -lt 5") " -lt 50"))
+
+ ;; Since the test suite is very lengthy, run the test
+ ;; suite once, not thrice as done by default, by
+ ;; selecting only the 'standard' cycle.
+ (setenv "NSS_CYCLES" "standard")
+
+ ;; The "PayPalEE.cert" certificate expires every six months,
+ ;; leading to test failures:
+ ;; <https://bugzilla.mozilla.org/show_bug.cgi?id=609734>. To
+ ;; work around that, set the time to roughly the release date.
+ (invoke "faketime" "2024-08-17" "./nss/tests/all.sh"))
+ (format #t "test suite not run~%"))))))))
+ (synopsis "Network Security Services (Rapid Release)")
+ (description
+ "Network Security Services (@dfn{NSS}) is a set of libraries designed to
+support cross-platform development of security-enabled client and server
+applications. Applications built with NSS can support SSL v2 and v3, TLS,
+PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other
+security standards.
+
+This package tracks the Rapid Release channel, which updates frequently.")))
(define-public nsncd
(package
(name "nsncd")
--
2.45.2
I
I
Ian Eure wrote on 17 Aug 21:32 +0200
[PATCH v6 0/3] [SECURITY] Update LibreWolf to 129.0.1-1; add nss-rapid
(address . 71832@debbugs.gnu.org)
20240817193240.27089-1-ian@retrospec.tv
vs. the previous versions of this patch series, v6:

- Updates LibreWolf to 129.0.1-1, the latest upstream.
- Updates nss-rapid, to version 3.103, the latest upstream.
- Adds the skr locale to all-mozilla-locales.
- Backs out improvements not directly related to updating the browser version, to make review easier.

In addition to the CVEs fixed in 128.0, this includes fixes for[1]:

CVE-2024-7518: Fullscreen notification dialog can be obscured by document content
CVE-2024-7519: Out of bounds memory access in graphics shared memory handling
CVE-2024-7520: Type confusion in WebAssembly
CVE-2024-7521: Incomplete WebAssembly exception handing
CVE-2024-7522: Out of bounds read in editor component
CVE-2024-7523: Document content could partially obscure security prompts
CVE-2024-7524: CSP strict-dynamic bypass using web-compatibility shims
CVE-2024-7525: Missing permission check when creating a StreamFilter
CVE-2024-7526: Uninitialized memory used by WebGL
CVE-2024-7527: Use-after-free in JavaScript garbage collection
CVE-2024-7528: Use-after-free in IndexedDB
CVE-2024-7529: Document content could partially obscure security prompts
CVE-2024-7530: Use-after-free in JavaScript code coverage collection
CVE-2024-7531: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge


Ian Eure (3):
gnu: gnuzilla: Add skr to all-mozilla-locales.
gnu: Add nss-rapid.
gnu: librewolf: Update to 129.0.1-1.

gnu/packages/gnuzilla.scm | 1 +
gnu/packages/librewolf.scm | 12 +++----
gnu/packages/nss.scm | 67 ++++++++++++++++++++++++++++++++++++++
3 files changed, 74 insertions(+), 6 deletions(-)

--
2.45.2
I
I
Ian Eure wrote on 17 Aug 21:32 +0200
[PATCH v6 3/3] gnu: librewolf: Update to 129.0.1-1.
(address . 71832@debbugs.gnu.org)
20240817193240.27089-4-ian@retrospec.tv
* gnu/packages/librewolf.scm (librewolf): Update to 129.0.1-1.

Change-Id: Iefeff2ea7016e8d55313b55dd97179f80bcead1b
---
gnu/packages/librewolf.scm | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)

Toggle diff (43 lines)
diff --git a/gnu/packages/librewolf.scm b/gnu/packages/librewolf.scm
index 45fbb84e4f..c7487b1259 100644
--- a/gnu/packages/librewolf.scm
+++ b/gnu/packages/librewolf.scm
@@ -117,9 +117,9 @@ (define (librewolf-source-origin version hash)
(define computed-origin-method (@@ (guix packages) computed-origin-method))
(define librewolf-source
- (let* ((ff-src (firefox-source-origin "126.0.1" "0fr679rcwshwpfxidc55b2xsn4pmrr7p9ix4rr2mv2k7kwsjcc7n"))
- (version "126.0.1-1")
- (lw-src (librewolf-source-origin version "0cac80073vkzd85ai9rbnwixs1h9bpy4dj2ri6jxdlqsy5d663km")))
+ (let* ((ff-src (firefox-source-origin "129.0.1" "0wy0fn0pavlhlkdybr59hhbn5ng0zn56mxa7gsknf8f2whiyipwx"))
+ (version "129.0.1-1")
+ (lw-src (librewolf-source-origin version "0pvv3v23q31hdjvqi1f3cqfyjrb8dbrrbfwxj2wacak1g0mzbxf4")))
(origin
(method computed-origin-method)
@@ -215,12 +215,12 @@ (define rust-librewolf rust) ; 1.75 is the default in Guix, 1.65 is the minimum.
;; Update this id with every update to its release date.
;; It's used for cache validation and therefore can lead to strange bugs.
;; ex: date '+%Y%m%d%H%M%S'
-(define %librewolf-build-id "20240607212143")
+(define %librewolf-build-id "20240817075827")
(define-public librewolf
(package
(name "librewolf")
- (version "126.0.1-1")
+ (version "129.0.1-1")
(source librewolf-source)
(build-system gnu-build-system)
(arguments
@@ -691,7 +691,7 @@ (define (runpaths-of-input label)
mesa
mit-krb5
nspr
- nss/fixed
+ nss-rapid
pango
pciutils
pipewire
--
2.45.2
V
V
Vagrant Cascadian wrote on 18 Aug 00:46 +0200
Re: [bug#71832] [PATCH v6 2/3] gnu: Add nss-rapid.
(address . guix-security@gnu.org)
87sev2lqcx.fsf@wireframe
On 2024-08-17, Ian Eure wrote:
Toggle quote (7 lines)
> * gnu/packages/nss.scm (nss-rapid): New variable.
>
> Change-Id: I2bdd2119fb0c857feae9eb2e47a28909b8228cd7
> ---
> gnu/packages/nss.scm | 67 ++++++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 67 insertions(+)

Unfortunately, this failed to build:

error: in phase 'check': uncaught exception:
%exception #<&invoke-error program: "faketime" arguments: ("2024-08-17" "./nss/tests/all.sh") exit-status: 1 term-signal: #f stop-signal: #f>
phase `check' failed after 1983.7 seconds
command "faketime" "2024-08-17" "./nss/tests/all.sh" failed with status 1
builder for `/gnu/store/nhzx27ndgbhsbl0kjnv49xsy3xdy0a66-nss-rapid-3.103.drv' failed with exit code 1
build of /gnu/store/nhzx27ndgbhsbl0kjnv49xsy3xdy0a66-nss-rapid-3.103.drv failed
View build log at '/var/log/guix/drvs/nh/zx27ndgbhsbl0kjnv49xsy3xdy0a66-nss-rapid-3.103.drv.gz'.
guix build: error: build of `/gnu/store/nhzx27ndgbhsbl0kjnv49xsy3xdy0a66-nss-rapid-3.103.drv' failed


live well,
vagrant
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQRlgHNhO/zFx+LkXUXcUY/If5cWqgUCZsEoTgAKCRDcUY/If5cW
qkxCAP9CUBXtG4Fuw3rJPeOcrDQnEcvzmS2KBDmm/WNcL8UPzgEA1P8aul7PUrXR
HCd5CD4W8aWlhAk+Br32KJc+fOX+zAk=
=iODr
-----END PGP SIGNATURE-----

V
V
Vagrant Cascadian wrote on 18 Aug 01:33 +0200
(address . guix-security@gnu.org)
87plq6lo79.fsf@wireframe
On 2024-08-17, Vagrant Cascadian wrote:
Toggle quote (19 lines)
> On 2024-08-17, Ian Eure wrote:
>> * gnu/packages/nss.scm (nss-rapid): New variable.
>>
>> Change-Id: I2bdd2119fb0c857feae9eb2e47a28909b8228cd7
>> ---
>> gnu/packages/nss.scm | 67 ++++++++++++++++++++++++++++++++++++++++++++
>> 1 file changed, 67 insertions(+)
>
> Unfortunately, this failed to build:
>
> error: in phase 'check': uncaught exception:
> %exception #<&invoke-error program: "faketime" arguments: ("2024-08-17" "./nss/tests/all.sh") exit-status: 1 term-signal: #f stop-signal: #f>
> phase `check' failed after 1983.7 seconds
> command "faketime" "2024-08-17" "./nss/tests/all.sh" failed with status 1
> builder for `/gnu/store/nhzx27ndgbhsbl0kjnv49xsy3xdy0a66-nss-rapid-3.103.drv' failed with exit code 1
> build of /gnu/store/nhzx27ndgbhsbl0kjnv49xsy3xdy0a66-nss-rapid-3.103.drv failed
> View build log at '/var/log/guix/drvs/nh/zx27ndgbhsbl0kjnv49xsy3xdy0a66-nss-rapid-3.103.drv.gz'.
> guix build: error: build of `/gnu/store/nhzx27ndgbhsbl0kjnv49xsy3xdy0a66-nss-rapid-3.103.drv' failed

Hrm. The build log was truncated and I could not find the actual
errors. There were two test suite failures... :/

I tried to build it again and it worked this time... hrm.

live well,
vagrant
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQRlgHNhO/zFx+LkXUXcUY/If5cWqgUCZsEzOgAKCRDcUY/If5cW
qsubAQDFUqGl5lPTFGFlSkZm/2N4jDPB+8NQK1sa9esdaNQGgAD+IJ53qO9K7BJJ
BaHIx66N2Id/nl/mD98nDWkzttw90w0=
=w0Tl
-----END PGP SIGNATURE-----

I
I
Ian Eure wrote on 18 Aug 01:51 +0200
(address . guix-security@gnu.org)
9AB57E33-2043-4D96-B6BD-DB0E25111319@retrospec.tv
Thank you for taking a look. It seems like the build process crashed when running the extensive test suite. Both these packages are resource-intensive to build. A machine with 16gb RAM and no swap will OOM, but a 24gb machine can complete them. Perhaps there's a clue in dmesg?

I built both nss-rapid and librewolf locally and made sure they seemed to work prior to sending the patch series.

On August 17, 2024 4:33:14 PM PDT, Vagrant Cascadian <vagrant@debian.org> wrote:
Toggle quote (27 lines)
>On 2024-08-17, Vagrant Cascadian wrote:
>> On 2024-08-17, Ian Eure wrote:
>>> * gnu/packages/nss.scm (nss-rapid): New variable.
>>>
>>> Change-Id: I2bdd2119fb0c857feae9eb2e47a28909b8228cd7
>>> ---
>>> gnu/packages/nss.scm | 67 ++++++++++++++++++++++++++++++++++++++++++++
>>> 1 file changed, 67 insertions(+)
>>
>> Unfortunately, this failed to build:
>>
>> error: in phase 'check': uncaught exception:
>> %exception #<&invoke-error program: "faketime" arguments: ("2024-08-17" "./nss/tests/all.sh") exit-status: 1 term-signal: #f stop-signal: #f>
>> phase `check' failed after 1983.7 seconds
>> command "faketime" "2024-08-17" "./nss/tests/all.sh" failed with status 1
>> builder for `/gnu/store/nhzx27ndgbhsbl0kjnv49xsy3xdy0a66-nss-rapid-3.103.drv' failed with exit code 1
>> build of /gnu/store/nhzx27ndgbhsbl0kjnv49xsy3xdy0a66-nss-rapid-3.103.drv failed
>> View build log at '/var/log/guix/drvs/nh/zx27ndgbhsbl0kjnv49xsy3xdy0a66-nss-rapid-3.103.drv.gz'.
>> guix build: error: build of `/gnu/store/nhzx27ndgbhsbl0kjnv49xsy3xdy0a66-nss-rapid-3.103.drv' failed
>
>Hrm. The build log was truncated and I could not find the actual
>errors. There were two test suite failures... :/
>
>I tried to build it again and it worked this time... hrm.
>
>live well,
> vagrant
Attachment: file
V
V
Vagrant Cascadian wrote on 18 Aug 04:00 +0200
(address . guix-security@gnu.org)
87le0ulhd1.fsf@wireframe
On 2024-08-17, Ian Eure wrote:
Toggle quote (6 lines)
> Thank you for taking a look. It seems like the build process crashed
> when running the extensive test suite. Both these packages are
> resource-intensive to build. A machine with 16gb RAM and no swap will
> OOM, but a 24gb machine can complete them. Perhaps there's a clue in
> dmesg?

I got a successful build of both nss-rapid and librewolf even only with
16gb of ram and 2.5gb of swap (maybe newer versions ... actually use
less resources?!) ... it just took two tries to build nss-rapid! :)

Have not actually run it yet... because foolishly I built it on a
headless system and need to transfer it over somewhere else to actually
test it... but so far looks promising.

live well,
vagrant
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQRlgHNhO/zFx+LkXUXcUY/If5cWqgUCZsFV2gAKCRDcUY/If5cW
qhsiAQCIAfJqTt7XDzq3T/OncbUNLXr4rlymPByaAFfvd23GIQEA56tV8tvVc91Y
/LHP5bYwhdEUj+3oVMjvLhQsOcI8PAE=
=tgNZ
-----END PGP SIGNATURE-----

V
V
Vagrant Cascadian wrote on 18 Aug 05:38 +0200
(name . Ian Eure)(address . ian@retrospec.tv)
87ed6mlcv2.fsf@wireframe
On 2024-08-17, Ian Eure wrote:
Toggle quote (4 lines)
> diff --git a/gnu/packages/nss.scm b/gnu/packages/nss.scm
> index 9224a8ed5a..1a684e6146 100644
> --- a/gnu/packages/nss.scm
> +++ b/gnu/packages/nss.scm
...
Toggle quote (6 lines)
> +;; nss should track ESRs, but currently doesn't. 3.102.1 is the current ESR.
> +
> (define-public nss
> (package
> (name "nss")

Though I largely agree with the logic (e.g. nss *should* probably be
packaging ESR versions in general)... it seems a little weird to include
a comment about what the packaging for nss *should* do, even though it
is not (yet) doing it... similar with embedding a specific "current"
version, which will obviously become inaccurate before too long...

Alternately, maybe moving the comment to where the nss version is
actually defined; to give someone pause when considering updating the
version?

Or maybe this belongs in a separate discussion on guix-devel and/or bug?


Toggle quote (9 lines)
> +;; nss-rapid tracks the rapid release channel. Unless your package requires a
> +;; newer version, you should prefer the `nss' package, which tracks the ESR
> +;; channel.
> +;;
> +;; See https://wiki.mozilla.org/NSS:Release_Versions
> +;; and https://wiki.mozilla.org/Rapid_Release_Model
> +
> +(define-public nss-rapid

Mixed feelings on rapid vs. latest ... latest is a bit more consistent
with other guix packages, though "rapid" is the terminology that
upstream uses here.


Both those points are, in my opinion, quite minor; I would not want to
block on those points alone!


live well,
vagrant
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQRlgHNhO/zFx+LkXUXcUY/If5cWqgUCZsFsoQAKCRDcUY/If5cW
qhjWAQDZiN0mzvD0V9s3uJoiHW/tnonzAhUgrCOF9ZTQnr1EzwD/SYiv+KlZ82v5
dTYuNt8EvCAUpU9Er+q36DT+1n16awk=
=1/TI
-----END PGP SIGNATURE-----

V
V
Vagrant Cascadian wrote on 18 Aug 05:46 +0200
Re: [bug#71832] [PATCH v6 0/3] [SECURITY] Update LibreWolf to 129.0.1-1; add nss-rapid
(name . Ian Eure)(address . ian@retrospec.tv)
87bk1qlchd.fsf@wireframe
On 2024-08-17, Ian Eure wrote:
Toggle quote (5 lines)
> - Updates LibreWolf to 129.0.1-1, the latest upstream.
> - Updates nss-rapid, to version 3.103, the latest upstream.
> - Adds the skr locale to all-mozilla-locales.
> - Backs out improvements not directly related to updating the browser version, to make review easier.

It builds and runs fine for me, so overall I think this should be merged
sooner than later (despite some of my minor comments on the nss-rapid
patch)... given the previous iterations of patches over several months
and the growing list of CVE fixes...

If there are no strong objections and nobody beats me to it, I will
merge these patches in the next couple days.

Thanks for working on librewolf! Sorry the update process has been
lagging!


live well,
vagrant
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQRlgHNhO/zFx+LkXUXcUY/If5cWqgUCZsFujgAKCRDcUY/If5cW
qoOPAQDPdpPphCnvz+2vsRtV5Vj0CO0zVxQx5ZIFz366QkAHnAD9HUCdtWWz3M/K
deB+PyoLNjegbstK6kz4FC1DJiK1bwk=
=dYtq
-----END PGP SIGNATURE-----

I
I
Ian Eure wrote on 18 Aug 05:48 +0200
Re: [bug#71832] [PATCH v6 2/3] gnu: Add nss-rapid.
(name . Vagrant Cascadian)(address . vagrant@debian.org)
87zfpa4gsb.fsf@meson
Vagrant Cascadian <vagrant@debian.org> writes:

Toggle quote (35 lines)
> [[PGP Signed Part:Undecided]]
> On 2024-08-17, Ian Eure wrote:
>> diff --git a/gnu/packages/nss.scm b/gnu/packages/nss.scm
>> index 9224a8ed5a..1a684e6146 100644
>> --- a/gnu/packages/nss.scm
>> +++ b/gnu/packages/nss.scm
> ...
>> +;; nss should track ESRs, but currently doesn't. 3.102.1 is
>> the current ESR.
>> +
>> (define-public nss
>> (package
>> (name "nss")
>
> Though I largely agree with the logic (e.g. nss *should*
> probably be
> packaging ESR versions in general)... it seems a little weird to
> include
> a comment about what the packaging for nss *should* do, even
> though it
> is not (yet) doing it... similar with embedding a specific
> "current"
> version, which will obviously become inaccurate before too
> long...
>
> Alternately, maybe moving the comment to where the nss version
> is
> actually defined; to give someone pause when considering
> updating the
> version?
>
> Or maybe this belongs in a separate discussion on guix-devel
> and/or bug?
>

I started a discussion about nss earlier this year[1], and some of
the changes in this patch set are a result of that. The long and
short of it is that nss should track ESRs only, and it could do
that now, but the process to update it is murky to me due to it
causing a lot of rebuilds. I asked for some advice on that a
couple days ago[2]. The comment is left in the hopes that a
well-meaning contributor doesn’t update it to a non-ESR version
before the ESR updates can be worked out, which would set the
timeline for that change back by a year.

If you have guidance on how to update a package low in the graph,
I’d appreciate hearing!


Toggle quote (18 lines)
>
>> +;; nss-rapid tracks the rapid release channel. Unless your
>> package requires a
>> +;; newer version, you should prefer the `nss' package, which
>> tracks the ESR
>> +;; channel.
>> +;;
>> +;; See https://wiki.mozilla.org/NSS:Release_Versions
>> +;; and https://wiki.mozilla.org/Rapid_Release_Model
>> +
>> +(define-public nss-rapid
>
> Mixed feelings on rapid vs. latest ... latest is a bit more
> consistent
> with other guix packages, though "rapid" is the terminology that
> upstream uses here.
>

Yes, agreed that the terminology situation isn’t ideal. I don’t
have a strong preference, but neither is there concensus around
"latest." In the absence of strong concensus, and to avoid
bikeshedding, I opted for reusing upstream terminology, but
clarifying that in the package description and synopsis. I
frankly do not care which is adopted, and it can be updated any
time, since this is high in the package graph. I do think that if
the package is named "nss-rapid", the synopsis/description should
indicate that this is upstreams Rapid Release channel. It
currently does, but would need some trivial editing should the
package name change.


Toggle quote (5 lines)
> Both those points are, in my opinion, quite minor; I would not
> want to
> block on those points alone!
>

I agree, and I appreciate your pragmatic approach here.

Thanks,

— Ian


[1]:
[2]:
V
V
Vagrant Cascadian wrote on 20 Aug 07:46 +0200
Re: [bug#71832] [PATCH v6 0/3] [SECURITY] Update LibreWolf to 129.0.1-1; add nss-rapid
(name . Ian Eure)(address . ian@retrospec.tv)
87y14rkaqk.fsf@wireframe
On 2024-08-17, Vagrant Cascadian wrote:
Toggle quote (14 lines)
> On 2024-08-17, Ian Eure wrote:
>> - Updates LibreWolf to 129.0.1-1, the latest upstream.
>> - Updates nss-rapid, to version 3.103, the latest upstream.
>> - Adds the skr locale to all-mozilla-locales.
>> - Backs out improvements not directly related to updating the browser version, to make review easier.
>
> It builds and runs fine for me, so overall I think this should be merged
> sooner than later (despite some of my minor comments on the nss-rapid
> patch)... given the previous iterations of patches over several months
> and the growing list of CVE fixes...
>
> If there are no strong objections and nobody beats me to it, I will
> merge these patches in the next couple days.

Pushed as 58faaf4eaadafa09a97ab31103eb54bd2076a699.

live well,
vagrant
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQRlgHNhO/zFx+LkXUXcUY/If5cWqgUCZsQtowAKCRDcUY/If5cW
quHKAP43JK+bNz72+QNsUd14TBc8dZIld7fOBNMkzYKkxu7ZfQEA/JSEqxFE0xXl
iesuTNHcqR4EeH9JKrwhHO9R1yIRJQ0=
=oznB
-----END PGP SIGNATURE-----

Closed
?
Your comment

Commenting via the web interface is currently disabled.

To comment on this conversation send an email to 71832@debbugs.gnu.org

To respond to this issue using the mumi CLI, first switch to it
mumi current 71832
Then, you may apply the latest patchset in this issue (with sign off)
mumi am -- -s
Or, compose a reply to this issue
mumi compose
Or, send patches to this issue
mumi send-email *.patch