firefox: backport updates into release-20.03

We've been slipping behind on backporting for the default firefox version. This doesn't make it perfect, but using ESR 78 should make it easier for us to keep up. Certainly feel free to work on backporting 79+ as well. I briefly tested both affected versions (68 and 78).
2026-09-29 19:30:11 +00:00 · 2020-08-02 12:41:35 +02:00
parent 443d41f3bd 61acfba631
commit ea0b3dd875
7 changed files with 193 additions and 53 deletions
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -8,7 +8,7 @@
 , yasm, libGLU, libGL, sqlite, unzip, makeWrapper
 , hunspell, libXdamage, libevent, libstartup_notification
 , libvpx, libvpx_1_8
-, icu, libpng, jemalloc, glib
+, icu, icu67, libpng, jemalloc, glib
 , autoconf213, which, gnused, cargo, rustc, llvmPackages
 , rust-cbindgen, nodejs, nasm, fetchpatch
 , debugBuild ? false
@@ -16,7 +16,7 @@

 ### backorted packages

-, nss_3_52
+, nss_latest
 , sqlite_3_31_1

 ### optionals
@@ -98,7 +98,7 @@ let
 # backported dependencies where the versions on the stable release did not meet
 # Firefoxs requirements

-nss_pkg = if lib.versionAtLeast ffversion "74" then nss_3_52 else nss;
+nss_pkg = if lib.versionAtLeast ffversion "74" then nss_latest else nss;
 sqlite_pkg = if lib.versionAtLeast ffversion "74" then sqlite_3_31_1 else sqlite;
 rust-cbindgen_pkg = if lib.versionAtLeast ffversion "77" then rust-cbindgen_0_14_1 else rust-cbindgen;

@@ -129,7 +129,7 @@ stdenv.mkDerivation ({
    xorg.libXScrnSaver xorg.xorgproto
    xorg.libXext unzip makeWrapper
    libevent libstartup_notification /* cairo */
-    icu libpng jemalloc glib
+    libpng jemalloc glib
    nasm
    # >= 66 requires nasm for the AV1 lib dav1d
    # yasm can potentially be removed in future versions
@@ -137,8 +137,10 @@ stdenv.mkDerivation ({
    # https://groups.google.com/forum/#!msg/mozilla.dev.platform/o-8levmLU80/SM_zQvfzCQAJ
    nspr nss_pkg
  ]
-  ++ lib.optionals  (lib.versionOlder ffversion "75") [ libvpx sqlite ]
+  ++ lib.optionals (lib.versionOlder ffversion "75") [ libvpx sqlite ]
  ++ lib.optional  (lib.versionAtLeast ffversion "75.0") libvpx_1_8
+  ++ lib.optional  (lib.versionOlder ffversion "78") icu
+  ++ lib.optional  (lib.versionAtLeast ffversion "78.0") icu67
  ++ lib.optional  alsaSupport alsaLib
  ++ lib.optional  pulseaudioSupport libpulseaudio # only headers are needed
  ++ lib.optional  gtk3Support gtk3
@@ -218,7 +220,6 @@ stdenv.mkDerivation ({
    "--enable-application=browser"
    "--with-system-jpeg"
    "--with-system-zlib"
-    "--with-system-bz2"
    "--with-system-libevent"
    "--with-system-libvpx"
    "--with-system-png" # needs APNG support
@@ -226,19 +227,21 @@ stdenv.mkDerivation ({
    "--enable-system-ffi"
    "--enable-system-pixman"
    #"--enable-system-cairo"
-    "--enable-startup-notification"
-    #"--enable-content-sandbox" # TODO: probably enable after 54
    "--disable-tests"
    "--disable-necko-wifi" # maybe we want to enable this at some point
    "--disable-updater"
    "--enable-jemalloc"
-    "--disable-gconf"
    "--enable-default-toolkit=${default-toolkit}"
    "--with-libclang-path=${llvmPackages.libclang}/lib"
    "--with-clang-path=${llvmPackages.clang}/bin/clang"
    "--with-system-nspr"
    "--with-system-nss"
  ]
+  ++ lib.optionals (lib.versionOlder ffversion "78") [
+    "--with-system-bz2"
+    "--enable-startup-notification"
+    "--disable-gconf"
+  ]
  ++ lib.optional (lib.versionOlder ffversion "75") "--enable-system-sqlite"
  ++ lib.optional (stdenv.isDarwin) "--disable-xcode-checks"
  ++ lib.optionals (lib.versionOlder ffversion "69") [
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@@ -1,16 +1,16 @@
-{ config, stdenv, lib, callPackage, fetchurl, fetchpatch }:
+{ config, stdenv, lib, callPackage, fetchurl, fetchpatch, nodejs-13_x }:

 let
-  common = opts: callPackage (import ./common.nix opts) {};
+  common = opts: callPackage (import ./common.nix opts) { nodejs = nodejs-13_x; };
 in

 rec {
  firefox = common rec {
    pname = "firefox";
-    ffversion = "77.0.1";
+    ffversion = "78.0.1";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "ngLihC0YuclLJEV3iPEX+tRzDKIdBe+CCOuFxvWNo7DnX8royOvTj2m4YyWyZoTQ5UCbPTQYmP4otgfovZSe8g==";
+      sha512 = "mdO6masIpiZBvYi6kpYUTSnsOda04CUs2CL1LNf1Yad+rfY4ga4aFuLtfKqfgV5IcIIl86XeiC+0grd4irbCYg==";
    };

    patches = [
@@ -33,6 +33,34 @@ rec {
    };
  };

+  firefox-esr-78 = common rec {
+    pname = "firefox-esr";
+    ffversion = "78.1.0esr";
+    src = fetchurl {
+      url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
+      sha512 = "223v796vjsvgs3yw442c8qbsbh43l1aniial05rl70hx44rh9sg108ripj8q83p5l9m0sp67x6ixd2xvifizv6461a1zra1rvbb1caa";
+    };
+
+    patches = [
+      ./no-buildconfig-ffx76.patch
+    ];
+
+    meta = {
+      description = "A web browser built from Firefox Extended Support Release source tree";
+      homepage = "http://www.mozilla.com/en-US/firefox/";
+      maintainers = with lib.maintainers; [ eelco andir ];
+      platforms = lib.platforms.unix;
+      badPlatforms = lib.platforms.darwin;
+      broken = stdenv.buildPlatform.is32bit; # since Firefox 60, build on 32-bit platforms fails with "out of memory".
+                                             # not in `badPlatforms` because cross-compilation on 64-bit machine might work.
+      license = lib.licenses.mpl20;
+    };
+    updateScript = callPackage ./update.nix {
+      attrPath = "firefox-esr-78-unwrapped";
+      versionKey = "ffversion";
+    };
+  };
+
  firefox-esr-68 = common rec {
    pname = "firefox-esr";
    ffversion = "68.11.0esr";
--- a/pkgs/development/libraries/icu/67.nix
+++ b/pkgs/development/libraries/icu/67.nix
@@ -0,0 +1,4 @@
+import ./base.nix {
+  version = "67.1";
+  sha256 = "1p6mhvxl0xr2n0g6xdps3mwzwlv6mjsz3xlpm793p9aiybb0ra4l";
+}
--- a/pkgs/development/libraries/nss/85_security_load-latest.patch
+++ b/pkgs/development/libraries/nss/85_security_load-latest.patch
@@ -0,0 +1,76 @@
+diff --git nss/cmd/shlibsign/shlibsign.c nss/cmd/shlibsign/shlibsign.c
+index ad8f3b84e..74676d039 100644
+--- nss/cmd/shlibsign/shlibsign.c
+++ nss/cmd/shlibsign/shlibsign.c
+@@ -875,6 +875,8 @@ main(int argc, char **argv)
+         goto cleanup;
+     }
+     lib = PR_LoadLibrary(libname);
+    if (!lib)
+        lib = PR_LoadLibrary(NIX_NSS_LIBDIR"libsoftokn3.so");
+     assert(lib != NULL);
+     if (!lib) {
+         PR_fprintf(PR_STDERR, "loading softokn3 failed");
+diff --git nss/lib/pk11wrap/pk11load.c nss/lib/pk11wrap/pk11load.c
+index 9e7a0a546..a0a23a1a4 100644
+--- nss/lib/pk11wrap/pk11load.c
+++ nss/lib/pk11wrap/pk11load.c
+@@ -466,6 +466,15 @@ secmod_LoadPKCS11Module(SECMODModule *mod, SECMODModule **oldModule)
+          * unload the library if anything goes wrong from here on out...
+          */
+         library = PR_LoadLibrary(mod->dllName);
+#ifndef NSS_STATIC_SOFTOKEN
+        if ((library == NULL) &&
+            !rindex(mod->dllName, PR_GetDirectorySeparator())) {
+            library = PORT_LoadLibraryFromOrigin(my_shlib_name,
+                (PRFuncPtr) &softoken_LoadDSO,
+                mod->dllName);
+        }
+#endif
+
+         mod->library = (void *)library;
+ 
+         if (library == NULL) {
+diff --git nss/lib/util/secload.c nss/lib/util/secload.c
+index 12efd2f75..8b74478f6 100644
+--- nss/lib/util/secload.c
+++ nss/lib/util/secload.c
+@@ -70,9 +70,14 @@ loader_LoadLibInReferenceDir(const char* referencePath, const char* name)
+ 
+     /* Remove the trailing filename from referencePath and add the new one */
+     c = strrchr(referencePath, PR_GetDirectorySeparator());
+    if (!c) { /* referencePath doesn't contain a / means that dladdr gave us argv[0]
+               * and program was called from $PATH. Hack to get libs from NIX_NSS_LIBDIR */
+        referencePath = NIX_NSS_LIBDIR;
+        c = (char*) &referencePath[sizeof(NIX_NSS_LIBDIR) - 1]; /* last / */
+    }
+     if (c) {
+         size_t referencePathSize = 1 + c - referencePath;
+-        fullName = (char*)PORT_Alloc(strlen(name) + referencePathSize + 1);
+        fullName = (char*) PORT_Alloc(strlen(name) + referencePathSize + 5);
+         if (fullName) {
+             memcpy(fullName, referencePath, referencePathSize);
+             strcpy(fullName + referencePathSize, name);
+@@ -82,6 +87,11 @@ loader_LoadLibInReferenceDir(const char* referencePath, const char* name)
+ #endif
+             libSpec.type = PR_LibSpec_Pathname;
+             libSpec.value.pathname = fullName;
+            if ((referencePathSize >= 4) &&
+                (strncmp(fullName + referencePathSize - 4, "bin", 3) == 0)) {
+                memcpy(fullName + referencePathSize -4, "lib", 3);
+            }
+            strcpy(fullName + referencePathSize, name);
+             dlh = PR_LoadLibraryWithFlags(libSpec, PR_LD_NOW | PR_LD_LOCAL
+ #ifdef PR_LD_ALT_SEARCH_PATH
+                                                        /* allow library's dependencies to be found in the same directory
+@@ -89,6 +99,10 @@ loader_LoadLibInReferenceDir(const char* referencePath, const char* name)
+                                                        | PR_LD_ALT_SEARCH_PATH
+ #endif
+                                           );
+            if (! dlh) {
+                strcpy(fullName + referencePathSize, name);
+                dlh = PR_LoadLibraryWithFlags(libSpec, PR_LD_NOW | PR_LD_LOCAL);
+            }
+             PORT_Free(fullName);
+         }
+     }
--- a/pkgs/development/libraries/nss/fix-cross-compilation.patch
+++ b/pkgs/development/libraries/nss/fix-cross-compilation.patch
@@ -0,0 +1,11 @@
+--- nss/nss.gyp
+++ nss/nss.gyp
+@@ -280,7 +280,7 @@
+                   'outputs/': [['exclude', 'nssdbm3']]
+                 }],
+               ],
+-              'action': ['<(python)', '<(DEPTH)/coreconf/shlibsign.py', '<@(_inputs)']
+              'action': ['true']
+             }
+           ],
+         },
--- a/pkgs/development/libraries/nss/latest.nix
+++ b/pkgs/development/libraries/nss/latest.nix
@@ -1,11 +1,11 @@
-{ stdenv, fetchurl, nspr, perl, zlib, sqlite, fixDarwinDylibNames, buildPackages }:
+{ stdenv, fetchurl, nspr, perl, zlib, sqlite, darwin, fixDarwinDylibNames, buildPackages, ninja }:

 let
  nssPEM = fetchurl {
-    url = http://dev.gentoo.org/~polynomial-c/mozilla/nss-3.15.4-pem-support-20140109.patch.xz;
+    url = "http://dev.gentoo.org/~polynomial-c/mozilla/nss-3.15.4-pem-support-20140109.patch.xz";
    sha256 = "10ibz6y0hknac15zr6dw4gv9nb5r5z9ym6gq18j3xqx7v7n3vpdw";
  };
-  version = "3.52.1";
+  version = "3.55";
  underscoreVersion = builtins.replaceStrings ["."] ["_"] version;

 in stdenv.mkDerivation rec {
@@ -14,12 +14,13 @@ in stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/${pname}-${version}.tar.gz";
-    sha256 = "0y4jb9095f7bbgw7d7kvzm4c3g4p5i6y68fwhb8wlkpb7b1imj5w";
+    sha256 = "0100hm7n1xrp144xy665z46s0wf1jpkqkncc6bk2w22snhyjwsgw";
  };

  depsBuildBuild = [ buildPackages.stdenv.cc ];

-  nativeBuildInputs = [ perl ];
+  nativeBuildInputs = [ perl ninja (buildPackages.python2.withPackages (ps: with ps; [ gyp ])) ]
+    ++ stdenv.lib.optional stdenv.isDarwin darwin.cctools;

  buildInputs = [ zlib sqlite ]
    ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
@@ -29,61 +30,69 @@ in stdenv.mkDerivation rec {
  prePatch = ''
    # strip the trailing whitespace from the patch line and the renamed CKO_NETSCAPE_ enum to CKO_NSS_
    xz -d < ${nssPEM} | sed \
-       -e '/^-DIRS = builtins $/ s/ $//' \
+       -e 's/-DIRS = builtins $/-DIRS = . builtins/g' \
       -e 's/CKO_NETSCAPE_/CKO_NSS_/g' \
       -e 's/CKT_NETSCAPE_/CKT_NSS_/g' \
       | patch -p1
+
+    patchShebangs nss
+
+    for f in nss/coreconf/config.gypi nss/build.sh nss/coreconf/config.gypi; do
+      substituteInPlace "$f" --replace "/usr/bin/env" "${buildPackages.coreutils}/bin/env"
+    done
+
+    substituteInPlace nss/coreconf/config.gypi --replace "/usr/bin/grep" "${buildPackages.coreutils}/bin/env grep"
  '';

  patches =
    [
      # Based on http://patch-tracker.debian.org/patch/series/dl/nss/2:3.15.4-1/85_security_load.patch
-      ./85_security_load.patch
+      ./85_security_load-latest.patch
      ./ckpem.patch
+      ./fix-cross-compilation.patch
    ];

  patchFlags = [ "-p0" ];

-  postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
-    substituteInPlace nss/coreconf/Darwin.mk --replace '@executable_path/$(notdir $@)' "$out/lib/\$(notdir \$@)"
-  '';
-
  outputs = [ "out" "dev" "tools" ];

  preConfigure = "cd nss";

-  makeFlags = let
-    cpu = stdenv.hostPlatform.parsed.cpu.name;
-  in [
-    "NSPR_INCLUDE_DIR=${nspr.dev}/include"
-    "NSPR_LIB_DIR=${nspr.out}/lib"
-    "NSDISTMODE=copy"
-    "BUILD_OPT=1"
-    "SOURCE_PREFIX=\$(out)"
-    "NSS_ENABLE_ECC=1"
-    "USE_SYSTEM_ZLIB=1"
-    "NSS_USE_SYSTEM_SQLITE=1"
-    "NATIVE_CC=${buildPackages.stdenv.cc}/bin/cc"
-  ] ++ stdenv.lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [
-    "OS_TEST=${cpu}"
-    "CPU_ARCH=${cpu}"
-    "CROSS_COMPILE=1"
-    "NSS_DISABLE_GTESTS=1" # don't want to build tests when cross-compiling
-  ] ++ stdenv.lib.optional stdenv.is64bit "USE_64=1"
-    ++ stdenv.lib.optional stdenv.isDarwin "CCC=clang++";
+  buildPhase = let
+    getArch = platform: if platform.isx86_64 then "x64"
+          else if platform.isx86_32 then "ia32"
+          else if platform.isAarch32 then "arm"
+          else if platform.isAarch64 then "arm64"
+          else platform.parsed.cpu.name;
+    # yes, this is correct. nixpkgs uses "host" for the platform the binary will run on whereas nss uses "host" for the platform that the build is running on
+    target = getArch stdenv.hostPlatform;
+    host = getArch stdenv.buildPlatform;
+  in ''
+    runHook preBuild

-  NIX_CFLAGS_COMPILE = "-Wno-error";
+    sed -i 's|nss_dist_dir="$dist_dir"|nss_dist_dir="'$out'"|;s|nss_dist_obj_dir="$obj_dir"|nss_dist_obj_dir="'$out'"|' build.sh
+    ./build.sh -v --opt \
+      --with-nspr=${nspr.dev}/include:${nspr.out}/lib \
+      --system-sqlite \
+      --enable-legacy-db \
+      --target ${target} \
+      -Dhost_arch=${host} \
+      -Duse_system_zlib=1 \
+      --enable-libpkix \
+      ${stdenv.lib.optionalString stdenv.isDarwin "--clang"} \
+      ${stdenv.lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "--disable-tests"}

-  # TODO(@oxij): investigate this: `make -n check` works but `make
-  # check` fails with "no rule", same for "installcheck".
-  doCheck = false;
-  doInstallCheck = false;
+    runHook postBuild
+  '';
+
+  NIX_CFLAGS_COMPILE = "-Wno-error -DNIX_NSS_LIBDIR=\"${placeholder "out"}/lib/\"";
+
+  installPhase = ''
+    runHook preInstall

-  postInstall = ''
    rm -rf $out/private
+    find $out -name "*.TOC" -delete
    mv $out/public $out/include
-    mv $out/*.OBJ/* $out/
-    rmdir $out/*.OBJ

    ln -s lib $out/lib64

@@ -133,10 +142,12 @@ in stdenv.mkDerivation rec {
    moveToOutput bin/nss-config "$dev"
    moveToOutput lib/libcrmf.a "$dev" # needed by firefox, for example
    rm -f "$out"/lib/*.a
+
+    runHook postInstall
  '';

  meta = with stdenv.lib; {
-    homepage = https://developer.mozilla.org/en-US/docs/NSS;
+    homepage = "https://developer.mozilla.org/en-US/docs/NSS";
    description = "A set of libraries for development of security-enabled client and server applications";
    license = licenses.mpl20;
    platforms = platforms.all;
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12049,6 +12049,11 @@ in
  } // (stdenv.lib.optionalAttrs (stdenv.hostPlatform.isi686 && stdenv.cc.isGNU) {
      stdenv = gcc6Stdenv; # with gcc-7: undefined reference to `__divmoddi4'
    }));
+  icu67 = callPackage ../development/libraries/icu/67.nix ({
+    nativeBuildRoot = buildPackages.icu67.override { buildRootOnly = true; };
+  } // (stdenv.lib.optionalAttrs (stdenv.hostPlatform.isi686 && stdenv.cc.isGNU) {
+      stdenv = gcc6Stdenv; # with gcc-7: undefined reference to `__divmoddi4'
+    }));

  icu = icu64;

@@ -13535,7 +13540,7 @@ in
    inherit (darwin.apple_sdk.frameworks) CoreServices;
  };

-  nss_3_52 = lowPrio (callPackage ../development/libraries/nss/3_52.nix { });
+  nss_latest = lowPrio (callPackage ../development/libraries/nss/latest.nix { });
  nss = lowPrio (callPackage ../development/libraries/nss { });
  nssTools = nss.tools;

@@ -19249,9 +19254,11 @@ in

  firefox-unwrapped = firefoxPackages.firefox;
  firefox-esr-68-unwrapped = firefoxPackages.firefox-esr-68;
+  firefox-esr-78-unwrapped = firefoxPackages.firefox-esr-78;
  firefox = wrapFirefox firefox-unwrapped { };
  firefox-wayland = wrapFirefox firefox-unwrapped { gdkWayland = true; };
  firefox-esr-68 = wrapFirefox firefox-esr-68-unwrapped { };
+  firefox-esr-78 = wrapFirefox firefox-esr-78-unwrapped { };
  firefox-esr = firefox-esr-68;

  firefox-bin-unwrapped = callPackage ../applications/networking/browsers/firefox-bin {