From 38c4d08cb96d7f148d4a23d07945fef576eb5ed8 Mon Sep 17 00:00:00 2001 From: Tomas Volf <~@wolfsden.cz> Date: Tue, 21 Jul 2026 21:52:49 +0200 Subject: nongnu: firefox-esr: Update to 153.0esr [security fixes]. Fixes CVE-2026-15718, CVE-2026-15719, CVE-2026-16349, CVE-2026-16350, CVE-2026-16351, CVE-2026-16352, CVE-2026-16353, CVE-2026-16354, CVE-2026-16355, CVE-2026-16356, CVE-2026-16357, CVE-2026-16358, CVE-2026-16359, CVE-2026-16360, CVE-2026-16361, CVE-2026-16362, CVE-2026-16363, CVE-2026-16368, CVE-2026-16369, CVE-2026-16371, CVE-2026-16374, CVE-2026-16375, CVE-2026-16377, CVE-2026-16379, CVE-2026-16381, CVE-2026-16383, CVE-2026-16387, CVE-2026-16390, CVE-2026-16391, CVE-2026-16396, CVE-2026-16405, CVE-2026-16412. * nongnu/packages/mozilla.scm (firefox-esr): Update to 153.0esr. [source]: Remove -esr, -ge-138 from patch names. Sort. [inputs]: Use icu4c-78, clang-19, rust-cbindgen-0.29.4. (rust-cbindgen-0.29.4): New variable. (firefox)[source]: Remove -ge-138 from patch name. [inputs]: Drop icu4c replacement. * nongnu/packages/patches/firefox-ge-138-compare-paths.patch: Rename from this... * nongnu/packages/patches/firefox-compare-paths.patch: ... to this. * nongnu/packages/patches/firefox-esr-add-store-to-rdd-allowlist.patch, nongnu/packages/patches/firefox-esr-use-system-wide-dir.patch: Delete files. * nongnu/packages/wasm.scm (wasm32-wasi-clang-runtime): Inherit from clang-runtime-19. [native-inputs]: Use clang-19. [inputs]: Use llvm-19. (wasm32-wasi-clang) [base]: Use llvm-19. Drop #:patches. (wasm32-wasi-libcxx) [version]: Use llvm-19. [arguments]<#:configure-flags>: Add -DLIBCXXABI_USE_LLVM_UNWINDER=OFF. Signed-off-by: Jonathan Brielmaier --- nongnu/packages/mozilla.scm | 23 ++++++-------- .../packages/patches/firefox-compare-paths.patch | 21 ++++++++++++ .../firefox-esr-add-store-to-rdd-allowlist.patch | 36 --------------------- .../patches/firefox-esr-use-system-wide-dir.patch | 37 ---------------------- .../patches/firefox-ge-138-compare-paths.patch | 21 ------------ nongnu/packages/wasm.scm | 14 ++++---- 6 files changed, 38 insertions(+), 114 deletions(-) create mode 100644 nongnu/packages/patches/firefox-compare-paths.patch delete mode 100644 nongnu/packages/patches/firefox-esr-add-store-to-rdd-allowlist.patch delete mode 100644 nongnu/packages/patches/firefox-esr-use-system-wide-dir.patch delete mode 100644 nongnu/packages/patches/firefox-ge-138-compare-paths.patch diff --git a/nongnu/packages/mozilla.scm b/nongnu/packages/mozilla.scm index 085d65f..4f97cec 100644 --- a/nongnu/packages/mozilla.scm +++ b/nongnu/packages/mozilla.scm @@ -88,25 +88,25 @@ ;; Update this id with every firefox update to its release date. ;; It's used for cache validation and therefore can lead to strange bugs. -(define %firefox-esr-build-id "20260720102539") +(define %firefox-esr-build-id "20260720102245") (define-public firefox-esr (package (name "firefox-esr") - (version "140.13.0esr") + (version "153.0esr") (source (origin (method url-fetch) (uri (string-append "https://archive.mozilla.org/pub/firefox/releases/" version "/source/firefox-" version ".source.tar.xz")) (sha256 - (base32 "00adf648nrhzngb4ssx31l17bh4zym491mx7b8ca3g9ajk39sfzm")) + (base32 "1dbcc80wq1354pzy6wg17gm81qiddyf5b3384fva865ivkgdkqyv")) (patches (nongnu-patches + "firefox-add-store-to-rdd-allowlist.patch" + "firefox-compare-paths.patch" "firefox-restore-desktop-files.patch" - "firefox-ge-138-compare-paths.patch" - "firefox-esr-use-system-wide-dir.patch" - "firefox-esr-add-store-to-rdd-allowlist.patch")) + "firefox-use-system-wide-dir.patch")) ;; XXX: 75 Mo (800+ Mo uncompressed) of unused tests. ;; Removing it makes it possible to compile on some systems. (modules '((guix build utils))) @@ -460,7 +460,7 @@ gtk+ gtk+-2 hunspell - icu4c-76 + icu4c-78 jemalloc libcanberra libevent @@ -498,7 +498,7 @@ alsa-lib autoconf-2.13 `(,rust-firefox-esr "cargo") - clang-18 + clang-19 llvm wasm32-wasi-clang-toolchain m4 @@ -508,7 +508,7 @@ pkg-config python rust-firefox-esr - rust-cbindgen-0.28 + rust-cbindgen-0.29 which yasm)) (native-search-paths @@ -543,7 +543,7 @@ Release (ESR) version.") (patches (nongnu-patches "firefox-restore-desktop-files.patch" - "firefox-ge-138-compare-paths.patch" + "firefox-compare-paths.patch" "firefox-use-system-wide-dir.patch" "firefox-add-store-to-rdd-allowlist.patch")) ;; XXX: 75 Mo (800+ Mo uncompressed) of unused tests. @@ -557,9 +557,6 @@ Release (ESR) version.") (replace 'set-build-id (lambda _ (setenv "MOZ_BUILD_DATE" #$%firefox-build-id))))))) - (inputs - (modify-inputs inputs - (replace "icu4c" icu4c-78))) (native-inputs (modify-inputs native-inputs (replace "rust" rust-firefox) diff --git a/nongnu/packages/patches/firefox-compare-paths.patch b/nongnu/packages/patches/firefox-compare-paths.patch new file mode 100644 index 0000000..b7d92d7 --- /dev/null +++ b/nongnu/packages/patches/firefox-compare-paths.patch @@ -0,0 +1,21 @@ +diff --git a/toolkit/mozapps/extensions/internal/XPIDatabase.sys.mjs b/toolkit/mozapps/extensions/internal/XPIDatabase.sys.mjs +index 1b01851e2fff..7f3b8c200c2f 100644 +--- a/toolkit/mozapps/extensions/internal/XPIDatabase.sys.mjs ++++ b/toolkit/mozapps/extensions/internal/XPIDatabase.sys.mjs +@@ -3753,6 +3753,7 @@ export const XPIDatabaseReconcile = { + if ( + newAddon || + oldAddon.updateDate != xpiState.mtime || ++ oldAddon.path != xpiState.path || + (aUpdateCompatibility && this.isAppBundledLocation(installLocation)) || + // update addon metadata if the addon in bundled into + // the omni jar and version or the resource URI pointing +@@ -3767,8 +3768,6 @@ export const XPIDatabaseReconcile = { + xpiState, + newAddon + ); +- } else if (oldAddon.path != xpiState.path) { +- newAddon = this.updatePath(installLocation, oldAddon, xpiState); + } else if (aUpdateCompatibility || aSchemaChange) { + newAddon = this.updateCompatibility( + installLocation, diff --git a/nongnu/packages/patches/firefox-esr-add-store-to-rdd-allowlist.patch b/nongnu/packages/patches/firefox-esr-add-store-to-rdd-allowlist.patch deleted file mode 100644 index 4bdaa7d..0000000 --- a/nongnu/packages/patches/firefox-esr-add-store-to-rdd-allowlist.patch +++ /dev/null @@ -1,36 +0,0 @@ -diff --git a/security/sandbox/linux/broker/SandboxBrokerPolicyFactory.cpp b/security/sandbox/linux/broker/SandboxBrokerPolicyFactory.cpp -index 4eff5e6..42171eb 100644 ---- a/security/sandbox/linux/broker/SandboxBrokerPolicyFactory.cpp -+++ b/security/sandbox/linux/broker/SandboxBrokerPolicyFactory.cpp -@@ -476,6 +476,7 @@ void SandboxBrokerPolicyFactory::InitContentPolicy() { - // Various places where fonts reside - policy->AddTree(rdonly, "/usr/X11R6/lib/X11/fonts"); - policy->AddTree(rdonly, "/nix/store"); -+ policy->AddTree(rdonly, "/gnu/store"); - // https://gitlab.com/freedesktop-sdk/freedesktop-sdk/-/blob/e434e680d22260f277f4a30ec4660ed32b591d16/files/fontconfig-flatpak.conf - policy->AddTree(rdonly, "/run/host/fonts"); - policy->AddTree(rdonly, "/run/host/user-fonts"); -@@ -485,6 +486,7 @@ void SandboxBrokerPolicyFactory::InitContentPolicy() { - // Bug 1848615 - policy->AddPath(rdonly, "/usr"); - policy->AddPath(rdonly, "/nix"); -+ policy->AddPath(rdonly, "/gnu"); - - AddLdconfigPaths(policy); - AddLdLibraryEnvPaths(policy); -@@ -934,6 +936,7 @@ SandboxBrokerPolicyFactory::GetRDDPolicy(int aPid) { - policy->AddTree(rdonly, "/usr/lib64"); - policy->AddTree(rdonly, "/run/opengl-driver/lib"); - policy->AddTree(rdonly, "/nix/store"); -+ policy->AddTree(rdonly, "/gnu/store"); - - // Bug 1647957: memory reporting. - AddMemoryReporting(policy.get(), aPid); -@@ -1079,6 +1082,7 @@ SandboxBrokerPolicyFactory::GetUtilityProcessPolicy(int aPid) { - // Required to make sure ffmpeg loads properly, this is already existing on - // Content and RDD - policy->AddTree(rdonly, "/nix/store"); -+ policy->AddTree(rdonly, "/gnu/store"); - - // glibc will try to stat64("/") while populating nsswitch database - // https://sourceware.org/git/?p=glibc.git;a=blob;f=nss/nss_database.c;h=cf0306adc47f12d9bc761ab1b013629f4482b7e6;hb=9826b03b747b841f5fc6de2054bf1ef3f5c4bdf3#l396 diff --git a/nongnu/packages/patches/firefox-esr-use-system-wide-dir.patch b/nongnu/packages/patches/firefox-esr-use-system-wide-dir.patch deleted file mode 100644 index 564f12f..0000000 --- a/nongnu/packages/patches/firefox-esr-use-system-wide-dir.patch +++ /dev/null @@ -1,37 +0,0 @@ -Replace "/usr/lib/mozilla" (the system-wide directory for extensions and -native manifests) with "$ICECAT_SYSTEM_DIR". - -diff --git a/toolkit/xre/nsXREDirProvider.cpp b/toolkit/xre/nsXREDirProvider.cpp -index e3be04e70c..a3501c4f44 100644 ---- a/toolkit/xre/nsXREDirProvider.cpp -+++ b/toolkit/xre/nsXREDirProvider.cpp -@@ -280,24 +280,11 @@ nsresult nsXREDirProvider::GetBackgroundTasksProfilesRootDir( - static nsresult GetSystemParentDirectory(nsIFile** aFile) { - nsresult rv; - nsCOMPtr localDir; --# if defined(XP_MACOSX) -- rv = GetOSXFolderType(kOnSystemDisk, kApplicationSupportFolderType, -- getter_AddRefs(localDir)); -- if (NS_SUCCEEDED(rv)) { -- rv = localDir->AppendNative("Mozilla"_ns); -- } --# else -- constexpr auto dirname = --# ifdef HAVE_USR_LIB64_DIR -- "/usr/lib64/mozilla"_ns --# elif defined(__OpenBSD__) || defined(__FreeBSD__) -- "/usr/local/lib/mozilla"_ns --# else -- "/usr/lib/mozilla"_ns --# endif -- ; -- rv = NS_NewNativeLocalFile(dirname, getter_AddRefs(localDir)); --# endif -+ const char* systemParentDir = getenv("ICECAT_SYSTEM_DIR"); -+ if (!systemParentDir || !*systemParentDir) return NS_ERROR_FAILURE; -+ -+ rv = NS_NewNativeLocalFile(nsDependentCString(systemParentDir), -+ getter_AddRefs(localDir)); - - if (NS_SUCCEEDED(rv)) { - localDir.forget(aFile); diff --git a/nongnu/packages/patches/firefox-ge-138-compare-paths.patch b/nongnu/packages/patches/firefox-ge-138-compare-paths.patch deleted file mode 100644 index b7d92d7..0000000 --- a/nongnu/packages/patches/firefox-ge-138-compare-paths.patch +++ /dev/null @@ -1,21 +0,0 @@ -diff --git a/toolkit/mozapps/extensions/internal/XPIDatabase.sys.mjs b/toolkit/mozapps/extensions/internal/XPIDatabase.sys.mjs -index 1b01851e2fff..7f3b8c200c2f 100644 ---- a/toolkit/mozapps/extensions/internal/XPIDatabase.sys.mjs -+++ b/toolkit/mozapps/extensions/internal/XPIDatabase.sys.mjs -@@ -3753,6 +3753,7 @@ export const XPIDatabaseReconcile = { - if ( - newAddon || - oldAddon.updateDate != xpiState.mtime || -+ oldAddon.path != xpiState.path || - (aUpdateCompatibility && this.isAppBundledLocation(installLocation)) || - // update addon metadata if the addon in bundled into - // the omni jar and version or the resource URI pointing -@@ -3767,8 +3768,6 @@ export const XPIDatabaseReconcile = { - xpiState, - newAddon - ); -- } else if (oldAddon.path != xpiState.path) { -- newAddon = this.updatePath(installLocation, oldAddon, xpiState); - } else if (aUpdateCompatibility || aSchemaChange) { - newAddon = this.updateCompatibility( - installLocation, diff --git a/nongnu/packages/wasm.scm b/nongnu/packages/wasm.scm index 3451489..ba74aea 100644 --- a/nongnu/packages/wasm.scm +++ b/nongnu/packages/wasm.scm @@ -67,11 +67,11 @@ other APIs.") license:expat)))) (define-public wasm32-wasi-clang-runtime - (package (inherit clang-runtime-17) + (package (inherit clang-runtime-19) (native-inputs - (list clang-17 + (list clang-19 wasi-libc)) - (inputs (list llvm-17)) + (inputs (list llvm-19)) (arguments (list #:build-type "Release" @@ -109,8 +109,7 @@ other APIs.") (define-public wasm32-wasi-clang (let ((base - (clang-from-llvm llvm-17 wasm32-wasi-clang-runtime - #:patches '("clang-17.0-fix-build-with-gcc-14-on-arm.patch")))) + (clang-from-llvm llvm-19 wasm32-wasi-clang-runtime))) (package (inherit base) (name "wasm32-wasi-clang") @@ -132,7 +131,7 @@ other APIs.") (define-public wasm32-wasi-libcxx (package (name "wasm32-wasi-libcxx") - (version (package-version llvm-17)) + (version (package-version llvm-19)) (source (llvm-monorepo version)) (build-system cmake-build-system) (arguments @@ -173,7 +172,8 @@ other APIs.") "-DLIBCXXABI_ENABLE_EXCEPTIONS=OFF" "-DLIBCXXABI_ENABLE_SHARED=OFF" "-DLIBCXXABI_ENABLE_THREADS=OFF" - "-DLIBCXXABI_ENABLE_FILESYSTEM=OFF") + "-DLIBCXXABI_ENABLE_FILESYSTEM=OFF" + "-DLIBCXXABI_USE_LLVM_UNWINDER=OFF") #:tests? #f #:phases #~(modify-phases %standard-phases -- cgit v1.2.3