mirror of
https://github.com/archlinuxarm/PKGBUILDs.git
synced 2024-11-08 22:45:43 +00:00
extra/firefox to 110.0.1-4
This commit is contained in:
Kevin Mihelich
parent
19c51f76fb
commit
3e37676588
2 changed files with 173 additions and 1 deletions
|
|
@ -0,0 +1,165 @@
|
|||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Dennis Jackson <djackson@mozilla.com>
|
||||
Date: Thu, 9 Mar 2023 22:05:17 +0000
|
||||
Subject: [PATCH] Bug 1821359: Disable TLS Key Pinning for Twitter Domains.
|
||||
r=keeler, a=dmeehan
|
||||
|
||||
This patch removes Twitter domains from the list of sites we statically pin in Firefox
|
||||
and regenerates the associated headers. Note that the Twitter domains are still
|
||||
imported from Chrome's list of pins, but now have the test flag set, making them inert.
|
||||
|
||||
Differential Revision: https://phabricator.services.mozilla.com/D172161
|
||||
---
|
||||
security/manager/ssl/StaticHPKPins.h | 18 ++++++++--------
|
||||
security/manager/tools/PreloadedHPKPins.json | 22 ++------------------
|
||||
2 files changed, 11 insertions(+), 29 deletions(-)
|
||||
|
||||
diff --git a/security/manager/ssl/StaticHPKPins.h b/security/manager/ssl/StaticHPKPins.h
|
||||
index 3adda637832a..e558393a3218 100644
|
||||
--- a/security/manager/ssl/StaticHPKPins.h
|
||||
+++ b/security/manager/ssl/StaticHPKPins.h
|
||||
@@ -602,26 +602,26 @@ static const TransportSecurityPreload kPublicKeyPinningPreloadList[] = {
|
||||
{ "admin.google.com", true, false, false, -1, &kPinset_google_root_pems },
|
||||
{ "android.com", true, false, false, -1, &kPinset_google_root_pems },
|
||||
{ "api.accounts.firefox.com", true, false, true, 5, &kPinset_mozilla_services },
|
||||
- { "api.twitter.com", true, false, false, -1, &kPinset_twitterCDN },
|
||||
+ { "api.twitter.com", true, true, false, -1, &kPinset_twitterCDN },
|
||||
{ "apis.google.com", true, false, false, -1, &kPinset_google_root_pems },
|
||||
{ "appengine.google.com", true, false, false, -1, &kPinset_google_root_pems },
|
||||
{ "apps.facebook.com", true, false, false, -1, &kPinset_facebook },
|
||||
{ "appspot.com", true, false, false, -1, &kPinset_google_root_pems },
|
||||
{ "at.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
|
||||
{ "au.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
|
||||
{ "aus4.mozilla.org", true, true, true, 3, &kPinset_mozilla_services },
|
||||
{ "aus5.mozilla.org", true, true, true, 7, &kPinset_mozilla_services },
|
||||
{ "az.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
|
||||
{ "be.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
|
||||
{ "bi.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
|
||||
{ "blog.torproject.org", true, false, false, -1, &kPinset_tor },
|
||||
{ "blogger.com", true, false, false, -1, &kPinset_google_root_pems },
|
||||
{ "blogspot.com", true, false, false, -1, &kPinset_google_root_pems },
|
||||
{ "br.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
|
||||
{ "bugs.chromium.org", true, false, false, -1, &kPinset_google_root_pems },
|
||||
{ "build.chromium.org", true, false, false, -1, &kPinset_google_root_pems },
|
||||
{ "business.facebook.com", true, false, false, -1, &kPinset_facebook },
|
||||
- { "business.twitter.com", true, false, false, -1, &kPinset_twitterCom },
|
||||
+ { "business.twitter.com", true, true, false, -1, &kPinset_twitterCom },
|
||||
{ "ca.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
|
||||
{ "calendar.google.com", true, false, false, -1, &kPinset_google_root_pems },
|
||||
{ "cd.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
|
||||
@@ -661,7 +661,7 @@ static const TransportSecurityPreload kPublicKeyPinningPreloadList[] = {
|
||||
{ "ct.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
|
||||
{ "datastudio.google.com", true, false, false, -1, &kPinset_google_root_pems },
|
||||
{ "de.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
|
||||
- { "dev.twitter.com", true, false, false, -1, &kPinset_twitterCom },
|
||||
+ { "dev.twitter.com", true, true, false, -1, &kPinset_twitterCom },
|
||||
{ "developer.android.com", true, false, false, -1, &kPinset_google_root_pems },
|
||||
{ "developers.facebook.com", true, false, false, -1, &kPinset_facebook },
|
||||
{ "dist.torproject.org", true, false, false, -1, &kPinset_tor },
|
||||
@@ -973,34 +973,34 @@ static const TransportSecurityPreload kPublicKeyPinningPreloadList[] = {
|
||||
{ "mbasic.facebook.com", true, false, false, -1, &kPinset_facebook },
|
||||
{ "meet.google.com", true, false, false, -1, &kPinset_google_root_pems },
|
||||
{ "messenger.com", true, false, false, -1, &kPinset_facebook },
|
||||
- { "mobile.twitter.com", true, false, false, -1, &kPinset_twitterCom },
|
||||
+ { "mobile.twitter.com", true, true, false, -1, &kPinset_twitterCom },
|
||||
{ "mt.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
|
||||
{ "mtouch.facebook.com", true, false, false, -1, &kPinset_facebook },
|
||||
{ "mu.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
|
||||
{ "mw.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
|
||||
{ "mx.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
|
||||
{ "myaccount.google.com", true, false, false, -1, &kPinset_google_root_pems },
|
||||
{ "myactivity.google.com", true, false, false, -1, &kPinset_google_root_pems },
|
||||
{ "ni.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
|
||||
{ "nl.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
|
||||
{ "no.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
|
||||
{ "np.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
|
||||
{ "nz.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
|
||||
- { "oauth.twitter.com", true, false, false, -1, &kPinset_twitterCom },
|
||||
+ { "oauth.twitter.com", true, true, false, -1, &kPinset_twitterCom },
|
||||
{ "oauthaccountmanager.googleapis.com", true, false, false, -1, &kPinset_google_root_pems },
|
||||
{ "pa.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
|
||||
{ "passwords.google.com", true, false, false, -1, &kPinset_google_root_pems },
|
||||
{ "passwordsleakcheck-pa.googleapis.com", true, false, false, -1, &kPinset_google_root_pems },
|
||||
{ "payments.google.com", true, false, false, -1, &kPinset_google_root_pems },
|
||||
{ "pe.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
|
||||
{ "ph.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
|
||||
{ "pinning-test.badssl.com", true, false, false, -1, &kPinset_test },
|
||||
{ "pinningtest.appspot.com", true, false, false, -1, &kPinset_test },
|
||||
{ "pixel.facebook.com", true, false, false, -1, &kPinset_facebook },
|
||||
{ "pixel.google.com", true, false, false, -1, &kPinset_google_root_pems },
|
||||
{ "pk.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
|
||||
{ "pl.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
|
||||
- { "platform.twitter.com", true, false, false, -1, &kPinset_twitterCDN },
|
||||
+ { "platform.twitter.com", true, true, false, -1, &kPinset_twitterCDN },
|
||||
{ "play.google.com", true, false, false, -1, &kPinset_google_root_pems },
|
||||
{ "plus.google.com", true, false, false, -1, &kPinset_google_root_pems },
|
||||
{ "plus.sandbox.google.com", true, false, false, -1, &kPinset_google_root_pems },
|
||||
@@ -1043,8 +1043,8 @@ static const TransportSecurityPreload kPublicKeyPinningPreloadList[] = {
|
||||
{ "tunnel.googlezip.net", true, false, false, -1, &kPinset_google_root_pems },
|
||||
{ "tv.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
|
||||
{ "tw.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
|
||||
- { "twimg.com", true, false, false, -1, &kPinset_twitterCDN },
|
||||
- { "twitter.com", true, false, false, -1, &kPinset_twitterCDN },
|
||||
+ { "twimg.com", true, true, false, -1, &kPinset_twitterCDN },
|
||||
+ { "twitter.com", false, true, false, -1, &kPinset_twitterCom },
|
||||
{ "ua.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
|
||||
{ "ua5v.com", true, false, false, -1, &kPinset_google_root_pems },
|
||||
{ "uk.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
|
||||
@@ -1079,7 +1079,7 @@ static const TransportSecurityPreload kPublicKeyPinningPreloadList[] = {
|
||||
{ "www.googlemail.com", false, false, false, -1, &kPinset_google_root_pems },
|
||||
{ "www.messenger.com", true, false, false, -1, &kPinset_facebook },
|
||||
{ "www.torproject.org", true, false, false, -1, &kPinset_tor },
|
||||
- { "www.twitter.com", true, false, false, -1, &kPinset_twitterCom },
|
||||
+ { "www.twitter.com", true, true, false, -1, &kPinset_twitterCom },
|
||||
{ "xa.search.yahoo.com", false, true, false, -1, &kPinset_yahoo },
|
||||
{ "xbrlsuccess.appspot.com", true, false, false, -1, &kPinset_google_root_pems },
|
||||
{ "xn--7xa.google.com", true, false, false, -1, &kPinset_google_root_pems },
|
||||
diff --git a/security/manager/tools/PreloadedHPKPins.json b/security/manager/tools/PreloadedHPKPins.json
|
||||
index 243625852686..c7c20ea6f680 100644
|
||||
--- a/security/manager/tools/PreloadedHPKPins.json
|
||||
+++ b/security/manager/tools/PreloadedHPKPins.json
|
||||
@@ -44,29 +44,16 @@
|
||||
// Dropbox
|
||||
"dropbox.com",
|
||||
"www.dropbox.com",
|
||||
- // Twitter
|
||||
- "api.twitter.com",
|
||||
- "business.twitter.com",
|
||||
- "dev.twitter.com",
|
||||
- "mobile.twitter.com",
|
||||
- "oauth.twitter.com",
|
||||
- "platform.twitter.com",
|
||||
- "twimg.com",
|
||||
- "www.twitter.com",
|
||||
// Tor
|
||||
"torproject.org",
|
||||
"blog.torproject.org",
|
||||
"check.torproject.org",
|
||||
"dist.torproject.org",
|
||||
"www.torproject.org",
|
||||
// SpiderOak
|
||||
"spideroak.com"
|
||||
],
|
||||
- "exclude_domains" : [
|
||||
- // Chrome's entry for twitter.com doesn't include subdomains, so replace
|
||||
- // it with our own entry below which also uses an expanded pinset.
|
||||
- "twitter.com"
|
||||
- ]
|
||||
+ "exclude_domains" : []
|
||||
},
|
||||
"pinsets": [
|
||||
{
|
||||
@@ -193,12 +180,7 @@
|
||||
"include_subdomains": false, "pins": "mozilla_test",
|
||||
"test_mode": false },
|
||||
{ "name": "test-mode.pinning.example.com", "include_subdomains": true,
|
||||
- "pins": "mozilla_test", "test_mode": true },
|
||||
- // Expand twitter's pinset to include all of *.twitter.com and use
|
||||
- // twitterCDN. More specific rules take precedence because we search for
|
||||
- // exact domain name first.
|
||||
- { "name": "twitter.com", "include_subdomains": true,
|
||||
- "pins": "twitterCDN", "test_mode": false }
|
||||
+ "pins": "mozilla_test", "test_mode": true }
|
||||
],
|
||||
// When pinning to non-root certs, like intermediates,
|
||||
// place the PEM of the pinned certificate in this array
|
||||
|
|
@ -11,7 +11,7 @@ highmem=1
|
|||
|
||||
pkgname=firefox
|
||||
pkgver=110.0.1
|
||||
pkgrel=3
|
||||
pkgrel=4
|
||||
pkgdesc="Standalone web browser from mozilla.org"
|
||||
url="https://www.mozilla.org/firefox/"
|
||||
arch=(x86_64)
|
||||
|
|
@ -72,6 +72,7 @@ source=(
|
|||
0001-libwebrtc-screen-cast-sync.patch
|
||||
0002-Bug-1819374-Squashed-ffmpeg-6.0-update.patch
|
||||
0003-Bug-1820416-Use-correct-FFVPX-headers-from-ffmpeg-6..patch
|
||||
0004-Bug-1821359-Disable-TLS-Key-Pinning-for-Twitter-Doma.patch
|
||||
build-arm-libopus.patch
|
||||
)
|
||||
validpgpkeys=(
|
||||
|
|
@ -84,6 +85,7 @@ sha256sums=('f19bb74d684b992625abca68f5776198974cd2785eb5d02d51ba007fc998491f'
|
|||
'43c83101b7ad7dba6f5fffeb89b70a661a547d506a031ea2beada42ccf04eec7'
|
||||
'9347e45cfe3e915b2293f7467fd61c216ec10823e91c70e5aeb9ca08cc5fcfcf'
|
||||
'be9ba079a931d5e881ce38430d418cc834e8c6b157af6c79ea267998caece806'
|
||||
'e4193f0a31a11ec6f5e16ac8d25c866867742d2c6917f34a87d73fa35eb55c55'
|
||||
'2d4d91f7e35d0860225084e37ec320ca6cae669f6c9c8fe7735cdbd542e3a7c9')
|
||||
b2sums=('ff196016e0271f7828163b8f767f3321b5ee08ef6bd0b03b134e17a1e5b62666f10ae80a14569438f6ac1c995a7a8422265eaabbc505b6a86e95a66b5db07209'
|
||||
'SKIP'
|
||||
|
|
@ -92,6 +94,7 @@ b2sums=('ff196016e0271f7828163b8f767f3321b5ee08ef6bd0b03b134e17a1e5b62666f10ae80
|
|||
'2bf65874c8c1f41c9273b68d74f4fe5c81dca5acbad0b9a5f917df1d46e1b2a1fb25d42a419eb885e76f4d193483cdeb6294e14ed4b2e241c34b84565b6ffd72'
|
||||
'086ed7d2c2d4efd441220e2d5244afd8a9a1327fed42b98f1a9e0eb05590abbf893716b3f5e01db1234eafe5386097013578dfc7c20fc8367860ce5cd9611aac'
|
||||
'be47c370c1b765921a6ffbb0eeaceaabc26483629b2ebd73c38f36b3ac418d1746fa021b5d444264641ff7c0c13e688a752758bd75c84e0297aceeaec0062ff2'
|
||||
'219ad84cbd9fe6284e61ded5813c1ca36158067e796ae6532cacfe9aeeb7c716c0382d991df5026c3f880dd39c271c6478bc4f56d4cecb14baa05921cf4dd567'
|
||||
'6e5980e56343a23bce4fcda58f6abc8f2debca0c278c87b09e53abb17ff15849c26e8df3bbff2388985f8fe5a4e9be9982c602ef7159546f0ae335fca1000a41')
|
||||
|
||||
# Google API keys (see http://www.chromium.org/developers/how-tos/api-keys)
|
||||
|
|
@ -123,6 +126,10 @@ prepare() {
|
|||
# https://bugzilla.mozilla.org/show_bug.cgi?id=1820416
|
||||
patch -Np1 -i ../0003-Bug-1820416-Use-correct-FFVPX-headers-from-ffmpeg-6..patch
|
||||
|
||||
# https://bugs.archlinux.org/task/77805
|
||||
# https://bugzilla.mozilla.org/show_bug.cgi?id=1821359
|
||||
patch -Np1 -i ../0004-Bug-1821359-Disable-TLS-Key-Pinning-for-Twitter-Doma.patch
|
||||
|
||||
echo -n "$_google_api_key" >google-api-key
|
||||
echo -n "$_mozilla_api_key" >mozilla-api-key
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue