From c4c81ac8a219e8725dae514f49c7c1b960632e67 Mon Sep 17 00:00:00 2001 From: Infinidoge Date: Thu, 20 Jul 2023 19:13:51 -0400 Subject: [PATCH 1/5] buildMozillaMach: support disabling extension signing enforcement Previously, derivations specified the environment variable themselves, which did not actually disable signing enforcement. --- pkgs/applications/networking/browsers/firefox/common.nix | 3 +++ pkgs/applications/networking/browsers/firefox/packages.nix | 7 +++---- pkgs/applications/networking/browsers/firefox/wrapper.nix | 7 ++----- .../applications/networking/browsers/librewolf/default.nix | 7 +++---- 4 files changed, 11 insertions(+), 13 deletions(-) diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix index 348c93d0c383..26145c69fd83 100644 --- a/pkgs/applications/networking/browsers/firefox/common.nix +++ b/pkgs/applications/networking/browsers/firefox/common.nix @@ -6,6 +6,7 @@ , application ? "browser" , applicationName ? "Mozilla Firefox" , branding ? null +, requireSigning ? true , src , unpackPhase ? null , extraPatches ? [] @@ -367,6 +368,8 @@ buildStdenv.mkDerivation { configureFlagsArray+=("--with-mozilla-api-keyfile=$TMPDIR/mls-api-key") '' + lib.optionalString (enableOfficialBranding && !stdenv.is32bit) '' export MOZILLA_OFFICIAL=1 + '' + lib.optionalString (!requireSigning) '' + export MOZ_REQUIRE_SIGNING= '' + lib.optionalString stdenv.hostPlatform.isMusl '' # linking firefox hits the vm.max_map_count kernel limit with the default musl allocator # TODO: Default vm.max_map_count has been increased, retest without this diff --git a/pkgs/applications/networking/browsers/firefox/packages.nix b/pkgs/applications/networking/browsers/firefox/packages.nix index 27f3ec022ce3..bd9794b0cde9 100644 --- a/pkgs/applications/networking/browsers/firefox/packages.nix +++ b/pkgs/applications/networking/browsers/firefox/packages.nix @@ -54,10 +54,11 @@ }; }; - firefox-devedition = (buildMozillaMach rec { + firefox-devedition = buildMozillaMach rec { pname = "firefox-devedition"; version = "116.0b3"; applicationName = "Mozilla Firefox Developer Edition"; + requireSigning = false; branding = "browser/branding/aurora"; src = fetchurl { url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz"; @@ -81,9 +82,7 @@ versionSuffix = "b[0-9]*"; baseUrl = "https://archive.mozilla.org/pub/devedition/releases/"; }; - }).overrideAttrs (prev: { - env.MOZ_REQUIRE_SIGNING = ""; - }); + }; firefox-esr-102 = buildMozillaMach rec { pname = "firefox-esr-102"; diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix index 6b08a891ec69..7ff74a971ca6 100644 --- a/pkgs/applications/networking/browsers/firefox/wrapper.nix +++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix @@ -102,15 +102,12 @@ let nameArray = builtins.map(a: a.name) (lib.optionals usesNixExtensions nixExtensions); - requiresSigning = browser ? MOZ_REQUIRE_SIGNING - -> toString browser.MOZ_REQUIRE_SIGNING != ""; - # Check that every extension has a unqiue .name attribute # and an extid attribute extensions = if nameArray != (lib.unique nameArray) then throw "Firefox addon name needs to be unique" - else if requiresSigning && !lib.hasSuffix "esr" browser.name then - throw "Nix addons are only supported without signature enforcement (eg. Firefox ESR)" + else if browser.requireSigning then + throw "Nix addons are only supported with signature enforcement disabled" else builtins.map (a: if ! (builtins.hasAttr "extid" a) then throw "nixExtensions has an invalid entry. Missing extid attribute. Please use fetchfirefoxaddon" diff --git a/pkgs/applications/networking/browsers/librewolf/default.nix b/pkgs/applications/networking/browsers/librewolf/default.nix index 4dde2d57d7e0..49f48db6858f 100644 --- a/pkgs/applications/networking/browsers/librewolf/default.nix +++ b/pkgs/applications/networking/browsers/librewolf/default.nix @@ -3,12 +3,13 @@ let librewolf-src = callPackage ./librewolf.nix { }; in -((buildMozillaMach rec { +(buildMozillaMach rec { pname = "librewolf"; applicationName = "LibreWolf"; binaryName = "librewolf"; version = librewolf-src.packageVersion; src = librewolf-src.firefox; + requireSigning = false; inherit (librewolf-src) extraConfigureFlags extraPatches extraPostPatch extraPassthru; meta = { @@ -29,6 +30,4 @@ in }).override { crashreporterSupport = false; enableOfficialBranding = false; -}).overrideAttrs (prev: { - MOZ_REQUIRE_SIGNING = ""; -}) +} From 101fc1b99ac22a6e652f32a189a91dcd6ee85a6c Mon Sep 17 00:00:00 2001 From: Infinidoge Date: Tue, 14 Nov 2023 09:40:05 -0500 Subject: [PATCH 2/5] buildMozillaMach: support addon sideloading --- pkgs/applications/networking/browsers/firefox/common.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix index 26145c69fd83..ac8bf05fae75 100644 --- a/pkgs/applications/networking/browsers/firefox/common.nix +++ b/pkgs/applications/networking/browsers/firefox/common.nix @@ -7,6 +7,7 @@ , applicationName ? "Mozilla Firefox" , branding ? null , requireSigning ? true +, allowAddonSideload ? false , src , unpackPhase ? null , extraPatches ? [] @@ -411,6 +412,7 @@ buildStdenv.mkDerivation { # https://bugzilla.mozilla.org/show_bug.cgi?id=1482204 ++ lib.optional (ltoSupport && (buildStdenv.isAarch32 || buildStdenv.isi686 || buildStdenv.isx86_64)) "--disable-elf-hack" ++ lib.optional (!drmSupport) "--disable-eme" + ++ lib.optional (allowAddonSideload) "--allow-addon-sideload" ++ [ (enableFeature alsaSupport "alsa") (enableFeature crashreporterSupport "crashreporter") From a997db8e4fd2339e75afec4ea0ccd13d83327bf2 Mon Sep 17 00:00:00 2001 From: Infinidoge Date: Tue, 14 Nov 2023 09:33:06 -0500 Subject: [PATCH 3/5] librewolf: allow addon sideloading LibreWolf's build configuration[1] already disables addon sideloading, so this isn't a change in behavior. [1] https://codeberg.org/librewolf/source/src/commit/e5762e9d5badf50bbc72f578d01111ed6e92dd74/assets/mozconfig.new#L3 --- pkgs/applications/networking/browsers/librewolf/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/applications/networking/browsers/librewolf/default.nix b/pkgs/applications/networking/browsers/librewolf/default.nix index 49f48db6858f..1d1575090deb 100644 --- a/pkgs/applications/networking/browsers/librewolf/default.nix +++ b/pkgs/applications/networking/browsers/librewolf/default.nix @@ -10,6 +10,7 @@ in version = librewolf-src.packageVersion; src = librewolf-src.firefox; requireSigning = false; + allowAddonSideload = true; inherit (librewolf-src) extraConfigureFlags extraPatches extraPostPatch extraPassthru; meta = { From c09e1762318d2d078b2590b5702710ded49bc287 Mon Sep 17 00:00:00 2001 From: Infinidoge Date: Tue, 14 Nov 2023 09:40:31 -0500 Subject: [PATCH 4/5] firefox: consider sideloading capability in extension handling --- pkgs/applications/networking/browsers/firefox/wrapper.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix index 7ff74a971ca6..0b5fca6adcb9 100644 --- a/pkgs/applications/networking/browsers/firefox/wrapper.nix +++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix @@ -106,8 +106,8 @@ let # and an extid attribute extensions = if nameArray != (lib.unique nameArray) then throw "Firefox addon name needs to be unique" - else if browser.requireSigning then - throw "Nix addons are only supported with signature enforcement disabled" + else if browser.requireSigning || !browser.allowAddonSideload then + throw "Nix addons are only supported with signature enforcement disabled and addon sideloading enabled (eg. LibreWolf)" else builtins.map (a: if ! (builtins.hasAttr "extid" a) then throw "nixExtensions has an invalid entry. Missing extid attribute. Please use fetchfirefoxaddon" From db262d35698b91db20582d92cd8cac8995978df9 Mon Sep 17 00:00:00 2001 From: Infinidoge Date: Tue, 7 Nov 2023 18:08:10 -0500 Subject: [PATCH 5/5] firefox: correct capitalization in extension check error --- pkgs/applications/networking/browsers/firefox/wrapper.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix index 0b5fca6adcb9..91adf1d7e96d 100644 --- a/pkgs/applications/networking/browsers/firefox/wrapper.nix +++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix @@ -110,7 +110,7 @@ let throw "Nix addons are only supported with signature enforcement disabled and addon sideloading enabled (eg. LibreWolf)" else builtins.map (a: if ! (builtins.hasAttr "extid" a) then - throw "nixExtensions has an invalid entry. Missing extid attribute. Please use fetchfirefoxaddon" + throw "nixExtensions has an invalid entry. Missing extid attribute. Please use fetchFirefoxAddon" else a ) (lib.optionals usesNixExtensions nixExtensions);