From c79ada33c752f459ea6fbe1a5403e701334044fb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Felix=20Schr=C3=B6ter?= Date: Mon, 20 Oct 2025 22:06:33 +0200 Subject: [PATCH] tor-browser: remove deprecated useHardenedMalloc The option been deprecated since NixOS 23.05: https://github.com/NixOS/nixpkgs/pull/248040 --- pkgs/by-name/to/tor-browser/package.nix | 609 ++++++++++++------------ 1 file changed, 297 insertions(+), 312 deletions(-) diff --git a/pkgs/by-name/to/tor-browser/package.nix b/pkgs/by-name/to/tor-browser/package.nix index e5d139bd6453..75f6988c6454 100644 --- a/pkgs/by-name/to/tor-browser/package.nix +++ b/pkgs/by-name/to/tor-browser/package.nix @@ -55,11 +55,6 @@ libvaSupport ? mediaSupport, libva, - # Hardening - graphene-hardened-malloc, - # Whether to use graphene-hardened-malloc - useHardenedMalloc ? null, - # Whether to use IPC for communicating with Tor useIPCTorService ? false, # Whether to disable multiprocess support @@ -69,317 +64,307 @@ extraPrefs ? "", }: -lib.warnIf (useHardenedMalloc != null) - "tor-browser: useHardenedMalloc is deprecated and enabling it can cause issues" +let + libPath = lib.makeLibraryPath ( + [ + alsa-lib + atk + cairo + dbus + dbus-glib + fontconfig + freetype + gdk-pixbuf + glib + gtk3 + libxcb + libX11 + libXext + libXrender + libXt + libXtst + libgbm + pango + pciutils + stdenv.cc.cc + stdenv.cc.libc + zlib + ] + ++ lib.optionals libnotifySupport [ libnotify ] + ++ lib.optionals waylandSupport [ + libxkbcommon + libdrm + libGL + ] + ++ lib.optionals pipewireSupport [ pipewire ] + ++ lib.optionals pulseaudioSupport [ libpulseaudio ] + ++ lib.optionals libvaSupport [ libva ] + ++ lib.optionals mediaSupport [ ffmpeg ] + ); - ( - let - libPath = lib.makeLibraryPath ( - [ - alsa-lib - atk - cairo - dbus - dbus-glib - fontconfig - freetype - gdk-pixbuf - glib - gtk3 - libxcb - libX11 - libXext - libXrender - libXt - libXtst - libgbm - pango - pciutils - stdenv.cc.cc - stdenv.cc.libc - zlib - ] - ++ lib.optionals libnotifySupport [ libnotify ] - ++ lib.optionals waylandSupport [ - libxkbcommon - libdrm - libGL - ] - ++ lib.optionals pipewireSupport [ pipewire ] - ++ lib.optionals pulseaudioSupport [ libpulseaudio ] - ++ lib.optionals libvaSupport [ libva ] - ++ lib.optionals mediaSupport [ ffmpeg ] - ); + version = "14.5.8"; - version = "14.5.8"; - - sources = { - x86_64-linux = fetchurl { - urls = [ - "https://archive.torproject.org/tor-package-archive/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz" - "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz" - "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz" - "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz" - ]; - hash = "sha256-hf3pkl+J9Hs28XSyNoXCZM0B9A7g4/n6F7WFkD/hl/o="; - }; - - i686-linux = fetchurl { - urls = [ - "https://archive.torproject.org/tor-package-archive/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz" - "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz" - "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz" - "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz" - ]; - hash = "sha256-iSHeHCyBg66pbGw8glmViTFMvys3EArOkXVpqJBXEfc="; - }; - }; - - distributionIni = writeText "distribution.ini" ( - lib.generators.toINI { } { - # Some light branding indicating this build uses our distro preferences - Global = { - id = "nixos"; - version = "1.0"; - about = "Tor Browser for NixOS"; - }; - } - ); - - policiesJson = writeText "policies.json" ( - builtins.toJSON { - policies.DisableAppUpdate = true; - } - ); - in - stdenv.mkDerivation rec { - pname = "tor-browser"; - inherit version; - - src = - sources.${stdenv.hostPlatform.system} - or (throw "unsupported system: ${stdenv.hostPlatform.system}"); - - nativeBuildInputs = [ - autoPatchelfHook - patchelfUnstable - copyDesktopItems - makeWrapper - wrapGAppsHook3 + sources = { + x86_64-linux = fetchurl { + urls = [ + "https://archive.torproject.org/tor-package-archive/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz" + "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz" + "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz" + "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz" ]; - buildInputs = [ - gtk3 - alsa-lib - dbus-glib - libXtst + hash = "sha256-hf3pkl+J9Hs28XSyNoXCZM0B9A7g4/n6F7WFkD/hl/o="; + }; + + i686-linux = fetchurl { + urls = [ + "https://archive.torproject.org/tor-package-archive/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz" + "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz" + "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz" + "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz" ]; + hash = "sha256-iSHeHCyBg66pbGw8glmViTFMvys3EArOkXVpqJBXEfc="; + }; + }; - # Firefox uses "relrhack" to manually process relocations from a fixed offset - patchelfFlags = [ "--no-clobber-old-sections" ]; - - preferLocalBuild = true; - allowSubstitutes = false; - - desktopItems = [ - (makeDesktopItem { - name = "torbrowser"; - exec = "tor-browser %U"; - icon = "tor-browser"; - desktopName = "Tor Browser"; - genericName = "Web Browser"; - comment = meta.description; - categories = [ - "Network" - "WebBrowser" - "Security" - ]; - mimeTypes = [ - "text/html" - "text/xml" - "application/xhtml+xml" - "application/vnd.mozilla.xul+xml" - "x-scheme-handler/http" - "x-scheme-handler/https" - ]; - startupWMClass = "Tor Browser"; - }) - ]; - - buildPhase = '' - runHook preBuild - - # For convenience ... - TBB_IN_STORE=$out/share/tor-browser - - # Unpack & enter - mkdir -p "$TBB_IN_STORE" - tar xf "$src" -C "$TBB_IN_STORE" --strip-components=2 - pushd "$TBB_IN_STORE" - - # Set ELF interpreter - autoPatchelf firefox.real TorBrowser/Tor - - # firefox is a wrapper that checks for a more recent libstdc++ & appends it to the ld path - mv firefox.real firefox - - # store state at `~/.tor browser` instead of relative to executable - touch "$TBB_IN_STORE/system-install" - - # The final libPath. Note, we could split this into firefoxLibPath - # and torLibPath for accuracy, but this is more convenient ... - libPath=${libPath}:$TBB_IN_STORE:$TBB_IN_STORE/TorBrowser/Tor - - # apulse uses a non-standard library path. For now special-case it. - ${lib.optionalString (audioSupport && !pulseaudioSupport) '' - libPath=${apulse}/lib/apulse:$libPath - ''} - - # Fixup paths to pluggable transports. - substituteInPlace TorBrowser/Data/Tor/torrc-defaults \ - --replace-fail './TorBrowser' "$TBB_IN_STORE/TorBrowser" - - # Prepare for autoconfig. - # - # See https://developer.mozilla.org/en-US/Firefox/Enterprise_deployment - cat >defaults/pref/autoconfig.js <mozilla.cfg <fonts' "$TBB_IN_STORE/fonts" - - # Hard-code paths to geoip data files. TBB resolves the geoip files - # relative to torrc-defaults_path but if we do not hard-code them - # here, these paths end up being written to the torrc in the user's - # state dir. - cat >>TorBrowser/Data/Tor/torrc-defaults </dev/null - - echo "Checking tor-browser wrapper ..." - $out/bin/tor-browser --version >/dev/null - - runHook postBuild - ''; - - installPhase = '' - runHook preInstall - - # Install distribution customizations - install -Dvm644 ${distributionIni} $out/share/tor-browser/distribution/distribution.ini - install -Dvm644 ${policiesJson} $out/share/tor-browser/distribution/policies.json - - runHook postInstall - ''; - - passthru = { - inherit sources; - updateScript = callPackage ./update.nix { - inherit pname version meta; - }; - }; - - meta = { - description = "Privacy-focused browser routing traffic through the Tor network"; - mainProgram = "tor-browser"; - homepage = "https://www.torproject.org/"; - changelog = "https://gitweb.torproject.org/builders/tor-browser-build.git/plain/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt?h=maint-${version}"; - platforms = lib.attrNames sources; - maintainers = with lib.maintainers; [ - c4patino - felschr - hax404 - joachifm - panicgh - ]; - # MPL2.0+, GPL+, &c. While it's not entirely clear whether - # the compound is "libre" in a strict sense (some components place certain - # restrictions on redistribution), it's free enough for our purposes. - license = with lib.licenses; [ - mpl20 - lgpl21Plus - lgpl3Plus - free - ]; - sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ]; + distributionIni = writeText "distribution.ini" ( + lib.generators.toINI { } { + # Some light branding indicating this build uses our distro preferences + Global = { + id = "nixos"; + version = "1.0"; + about = "Tor Browser for NixOS"; }; } - ) + ); + + policiesJson = writeText "policies.json" ( + builtins.toJSON { + policies.DisableAppUpdate = true; + } + ); +in +stdenv.mkDerivation rec { + pname = "tor-browser"; + inherit version; + + src = + sources.${stdenv.hostPlatform.system} + or (throw "unsupported system: ${stdenv.hostPlatform.system}"); + + nativeBuildInputs = [ + autoPatchelfHook + patchelfUnstable + copyDesktopItems + makeWrapper + wrapGAppsHook3 + ]; + buildInputs = [ + gtk3 + alsa-lib + dbus-glib + libXtst + ]; + + # Firefox uses "relrhack" to manually process relocations from a fixed offset + patchelfFlags = [ "--no-clobber-old-sections" ]; + + preferLocalBuild = true; + allowSubstitutes = false; + + desktopItems = [ + (makeDesktopItem { + name = "torbrowser"; + exec = "tor-browser %U"; + icon = "tor-browser"; + desktopName = "Tor Browser"; + genericName = "Web Browser"; + comment = meta.description; + categories = [ + "Network" + "WebBrowser" + "Security" + ]; + mimeTypes = [ + "text/html" + "text/xml" + "application/xhtml+xml" + "application/vnd.mozilla.xul+xml" + "x-scheme-handler/http" + "x-scheme-handler/https" + ]; + startupWMClass = "Tor Browser"; + }) + ]; + + buildPhase = '' + runHook preBuild + + # For convenience ... + TBB_IN_STORE=$out/share/tor-browser + + # Unpack & enter + mkdir -p "$TBB_IN_STORE" + tar xf "$src" -C "$TBB_IN_STORE" --strip-components=2 + pushd "$TBB_IN_STORE" + + # Set ELF interpreter + autoPatchelf firefox.real TorBrowser/Tor + + # firefox is a wrapper that checks for a more recent libstdc++ & appends it to the ld path + mv firefox.real firefox + + # store state at `~/.tor browser` instead of relative to executable + touch "$TBB_IN_STORE/system-install" + + # The final libPath. Note, we could split this into firefoxLibPath + # and torLibPath for accuracy, but this is more convenient ... + libPath=${libPath}:$TBB_IN_STORE:$TBB_IN_STORE/TorBrowser/Tor + + # apulse uses a non-standard library path. For now special-case it. + ${lib.optionalString (audioSupport && !pulseaudioSupport) '' + libPath=${apulse}/lib/apulse:$libPath + ''} + + # Fixup paths to pluggable transports. + substituteInPlace TorBrowser/Data/Tor/torrc-defaults \ + --replace-fail './TorBrowser' "$TBB_IN_STORE/TorBrowser" + + # Prepare for autoconfig. + # + # See https://developer.mozilla.org/en-US/Firefox/Enterprise_deployment + cat >defaults/pref/autoconfig.js <mozilla.cfg <fonts' "$TBB_IN_STORE/fonts" + + # Hard-code paths to geoip data files. TBB resolves the geoip files + # relative to torrc-defaults_path but if we do not hard-code them + # here, these paths end up being written to the torrc in the user's + # state dir. + cat >>TorBrowser/Data/Tor/torrc-defaults </dev/null + + echo "Checking tor-browser wrapper ..." + $out/bin/tor-browser --version >/dev/null + + runHook postBuild + ''; + + installPhase = '' + runHook preInstall + + # Install distribution customizations + install -Dvm644 ${distributionIni} $out/share/tor-browser/distribution/distribution.ini + install -Dvm644 ${policiesJson} $out/share/tor-browser/distribution/policies.json + + runHook postInstall + ''; + + passthru = { + inherit sources; + updateScript = callPackage ./update.nix { + inherit pname version meta; + }; + }; + + meta = { + description = "Privacy-focused browser routing traffic through the Tor network"; + mainProgram = "tor-browser"; + homepage = "https://www.torproject.org/"; + changelog = "https://gitweb.torproject.org/builders/tor-browser-build.git/plain/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt?h=maint-${version}"; + platforms = lib.attrNames sources; + maintainers = with lib.maintainers; [ + c4patino + felschr + hax404 + joachifm + panicgh + ]; + # MPL2.0+, GPL+, &c. While it's not entirely clear whether + # the compound is "libre" in a strict sense (some components place certain + # restrictions on redistribution), it's free enough for our purposes. + license = with lib.licenses; [ + mpl20 + lgpl21Plus + lgpl3Plus + free + ]; + sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ]; + }; +}