From 3e37676588787e68d25481e7717e10258869a916 Mon Sep 17 00:00:00 2001 From: Kevin Mihelich Date: Sat, 11 Mar 2023 01:13:29 +0000 Subject: [PATCH] extra/firefox to 110.0.1-4 --- ...ble-TLS-Key-Pinning-for-Twitter-Doma.patch | 165 ++++++++++++++++++ extra/firefox/PKGBUILD | 9 +- 2 files changed, 173 insertions(+), 1 deletion(-) create mode 100644 extra/firefox/0004-Bug-1821359-Disable-TLS-Key-Pinning-for-Twitter-Doma.patch diff --git a/extra/firefox/0004-Bug-1821359-Disable-TLS-Key-Pinning-for-Twitter-Doma.patch b/extra/firefox/0004-Bug-1821359-Disable-TLS-Key-Pinning-for-Twitter-Doma.patch new file mode 100644 index 000000000..eb75f7f90 --- /dev/null +++ b/extra/firefox/0004-Bug-1821359-Disable-TLS-Key-Pinning-for-Twitter-Doma.patch @@ -0,0 +1,165 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Dennis Jackson +Date: Thu, 9 Mar 2023 22:05:17 +0000 +Subject: [PATCH] Bug 1821359: Disable TLS Key Pinning for Twitter Domains. + r=keeler, a=dmeehan + +This patch removes Twitter domains from the list of sites we statically pin in Firefox +and regenerates the associated headers. Note that the Twitter domains are still +imported from Chrome's list of pins, but now have the test flag set, making them inert. + +Differential Revision: https://phabricator.services.mozilla.com/D172161 +--- + security/manager/ssl/StaticHPKPins.h | 18 ++++++++-------- + security/manager/tools/PreloadedHPKPins.json | 22 ++------------------ + 2 files changed, 11 insertions(+), 29 deletions(-) + +diff --git a/security/manager/ssl/StaticHPKPins.h b/security/manager/ssl/StaticHPKPins.h +index 3adda637832a..e558393a3218 100644 +--- a/security/manager/ssl/StaticHPKPins.h ++++ b/security/manager/ssl/StaticHPKPins.h +@@ -602,26 +602,26 @@ static const TransportSecurityPreload kPublicKeyPinningPreloadList[] = { + { "admin.google.com", true, false, false, -1, &kPinset_google_root_pems }, + { "android.com", true, false, false, -1, &kPinset_google_root_pems }, + { "api.accounts.firefox.com", true, false, true, 5, &kPinset_mozilla_services }, +- { "api.twitter.com", true, false, false, -1, &kPinset_twitterCDN }, ++ { "api.twitter.com", true, true, false, -1, &kPinset_twitterCDN }, + { "apis.google.com", true, false, false, -1, &kPinset_google_root_pems }, + { "appengine.google.com", true, false, false, -1, &kPinset_google_root_pems }, + { "apps.facebook.com", true, false, false, -1, &kPinset_facebook }, + { "appspot.com", true, false, false, -1, &kPinset_google_root_pems }, + { "at.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, + { "au.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, + { "aus4.mozilla.org", true, true, true, 3, &kPinset_mozilla_services }, + { "aus5.mozilla.org", true, true, true, 7, &kPinset_mozilla_services }, + { "az.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, + { "be.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, + { "bi.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, + { "blog.torproject.org", true, false, false, -1, &kPinset_tor }, + { "blogger.com", true, false, false, -1, &kPinset_google_root_pems }, + { "blogspot.com", true, false, false, -1, &kPinset_google_root_pems }, + { "br.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, + { "bugs.chromium.org", true, false, false, -1, &kPinset_google_root_pems }, + { "build.chromium.org", true, false, false, -1, &kPinset_google_root_pems }, + { "business.facebook.com", true, false, false, -1, &kPinset_facebook }, +- { "business.twitter.com", true, false, false, -1, &kPinset_twitterCom }, ++ { "business.twitter.com", true, true, false, -1, &kPinset_twitterCom }, + { "ca.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, + { "calendar.google.com", true, false, false, -1, &kPinset_google_root_pems }, + { "cd.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, +@@ -661,7 +661,7 @@ static const TransportSecurityPreload kPublicKeyPinningPreloadList[] = { + { "ct.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, + { "datastudio.google.com", true, false, false, -1, &kPinset_google_root_pems }, + { "de.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, +- { "dev.twitter.com", true, false, false, -1, &kPinset_twitterCom }, ++ { "dev.twitter.com", true, true, false, -1, &kPinset_twitterCom }, + { "developer.android.com", true, false, false, -1, &kPinset_google_root_pems }, + { "developers.facebook.com", true, false, false, -1, &kPinset_facebook }, + { "dist.torproject.org", true, false, false, -1, &kPinset_tor }, +@@ -973,34 +973,34 @@ static const TransportSecurityPreload kPublicKeyPinningPreloadList[] = { + { "mbasic.facebook.com", true, false, false, -1, &kPinset_facebook }, + { "meet.google.com", true, false, false, -1, &kPinset_google_root_pems }, + { "messenger.com", true, false, false, -1, &kPinset_facebook }, +- { "mobile.twitter.com", true, false, false, -1, &kPinset_twitterCom }, ++ { "mobile.twitter.com", true, true, false, -1, &kPinset_twitterCom }, + { "mt.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, + { "mtouch.facebook.com", true, false, false, -1, &kPinset_facebook }, + { "mu.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, + { "mw.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, + { "mx.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, + { "myaccount.google.com", true, false, false, -1, &kPinset_google_root_pems }, + { "myactivity.google.com", true, false, false, -1, &kPinset_google_root_pems }, + { "ni.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, + { "nl.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, + { "no.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, + { "np.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, + { "nz.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, +- { "oauth.twitter.com", true, false, false, -1, &kPinset_twitterCom }, ++ { "oauth.twitter.com", true, true, false, -1, &kPinset_twitterCom }, + { "oauthaccountmanager.googleapis.com", true, false, false, -1, &kPinset_google_root_pems }, + { "pa.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, + { "passwords.google.com", true, false, false, -1, &kPinset_google_root_pems }, + { "passwordsleakcheck-pa.googleapis.com", true, false, false, -1, &kPinset_google_root_pems }, + { "payments.google.com", true, false, false, -1, &kPinset_google_root_pems }, + { "pe.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, + { "ph.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, + { "pinning-test.badssl.com", true, false, false, -1, &kPinset_test }, + { "pinningtest.appspot.com", true, false, false, -1, &kPinset_test }, + { "pixel.facebook.com", true, false, false, -1, &kPinset_facebook }, + { "pixel.google.com", true, false, false, -1, &kPinset_google_root_pems }, + { "pk.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, + { "pl.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, +- { "platform.twitter.com", true, false, false, -1, &kPinset_twitterCDN }, ++ { "platform.twitter.com", true, true, false, -1, &kPinset_twitterCDN }, + { "play.google.com", true, false, false, -1, &kPinset_google_root_pems }, + { "plus.google.com", true, false, false, -1, &kPinset_google_root_pems }, + { "plus.sandbox.google.com", true, false, false, -1, &kPinset_google_root_pems }, +@@ -1043,8 +1043,8 @@ static const TransportSecurityPreload kPublicKeyPinningPreloadList[] = { + { "tunnel.googlezip.net", true, false, false, -1, &kPinset_google_root_pems }, + { "tv.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, + { "tw.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, +- { "twimg.com", true, false, false, -1, &kPinset_twitterCDN }, +- { "twitter.com", true, false, false, -1, &kPinset_twitterCDN }, ++ { "twimg.com", true, true, false, -1, &kPinset_twitterCDN }, ++ { "twitter.com", false, true, false, -1, &kPinset_twitterCom }, + { "ua.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, + { "ua5v.com", true, false, false, -1, &kPinset_google_root_pems }, + { "uk.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, +@@ -1079,7 +1079,7 @@ static const TransportSecurityPreload kPublicKeyPinningPreloadList[] = { + { "www.googlemail.com", false, false, false, -1, &kPinset_google_root_pems }, + { "www.messenger.com", true, false, false, -1, &kPinset_facebook }, + { "www.torproject.org", true, false, false, -1, &kPinset_tor }, +- { "www.twitter.com", true, false, false, -1, &kPinset_twitterCom }, ++ { "www.twitter.com", true, true, false, -1, &kPinset_twitterCom }, + { "xa.search.yahoo.com", false, true, false, -1, &kPinset_yahoo }, + { "xbrlsuccess.appspot.com", true, false, false, -1, &kPinset_google_root_pems }, + { "xn--7xa.google.com", true, false, false, -1, &kPinset_google_root_pems }, +diff --git a/security/manager/tools/PreloadedHPKPins.json b/security/manager/tools/PreloadedHPKPins.json +index 243625852686..c7c20ea6f680 100644 +--- a/security/manager/tools/PreloadedHPKPins.json ++++ b/security/manager/tools/PreloadedHPKPins.json +@@ -44,29 +44,16 @@ + // Dropbox + "dropbox.com", + "www.dropbox.com", +- // Twitter +- "api.twitter.com", +- "business.twitter.com", +- "dev.twitter.com", +- "mobile.twitter.com", +- "oauth.twitter.com", +- "platform.twitter.com", +- "twimg.com", +- "www.twitter.com", + // Tor + "torproject.org", + "blog.torproject.org", + "check.torproject.org", + "dist.torproject.org", + "www.torproject.org", + // SpiderOak + "spideroak.com" + ], +- "exclude_domains" : [ +- // Chrome's entry for twitter.com doesn't include subdomains, so replace +- // it with our own entry below which also uses an expanded pinset. +- "twitter.com" +- ] ++ "exclude_domains" : [] + }, + "pinsets": [ + { +@@ -193,12 +180,7 @@ + "include_subdomains": false, "pins": "mozilla_test", + "test_mode": false }, + { "name": "test-mode.pinning.example.com", "include_subdomains": true, +- "pins": "mozilla_test", "test_mode": true }, +- // Expand twitter's pinset to include all of *.twitter.com and use +- // twitterCDN. More specific rules take precedence because we search for +- // exact domain name first. +- { "name": "twitter.com", "include_subdomains": true, +- "pins": "twitterCDN", "test_mode": false } ++ "pins": "mozilla_test", "test_mode": true } + ], + // When pinning to non-root certs, like intermediates, + // place the PEM of the pinned certificate in this array diff --git a/extra/firefox/PKGBUILD b/extra/firefox/PKGBUILD index 3682dd7f5..e43dc1ecb 100644 --- a/extra/firefox/PKGBUILD +++ b/extra/firefox/PKGBUILD @@ -11,7 +11,7 @@ highmem=1 pkgname=firefox pkgver=110.0.1 -pkgrel=3 +pkgrel=4 pkgdesc="Standalone web browser from mozilla.org" url="https://www.mozilla.org/firefox/" arch=(x86_64) @@ -72,6 +72,7 @@ source=( 0001-libwebrtc-screen-cast-sync.patch 0002-Bug-1819374-Squashed-ffmpeg-6.0-update.patch 0003-Bug-1820416-Use-correct-FFVPX-headers-from-ffmpeg-6..patch + 0004-Bug-1821359-Disable-TLS-Key-Pinning-for-Twitter-Doma.patch build-arm-libopus.patch ) validpgpkeys=( @@ -84,6 +85,7 @@ sha256sums=('f19bb74d684b992625abca68f5776198974cd2785eb5d02d51ba007fc998491f' '43c83101b7ad7dba6f5fffeb89b70a661a547d506a031ea2beada42ccf04eec7' '9347e45cfe3e915b2293f7467fd61c216ec10823e91c70e5aeb9ca08cc5fcfcf' 'be9ba079a931d5e881ce38430d418cc834e8c6b157af6c79ea267998caece806' + 'e4193f0a31a11ec6f5e16ac8d25c866867742d2c6917f34a87d73fa35eb55c55' '2d4d91f7e35d0860225084e37ec320ca6cae669f6c9c8fe7735cdbd542e3a7c9') b2sums=('ff196016e0271f7828163b8f767f3321b5ee08ef6bd0b03b134e17a1e5b62666f10ae80a14569438f6ac1c995a7a8422265eaabbc505b6a86e95a66b5db07209' 'SKIP' @@ -92,6 +94,7 @@ b2sums=('ff196016e0271f7828163b8f767f3321b5ee08ef6bd0b03b134e17a1e5b62666f10ae80 '2bf65874c8c1f41c9273b68d74f4fe5c81dca5acbad0b9a5f917df1d46e1b2a1fb25d42a419eb885e76f4d193483cdeb6294e14ed4b2e241c34b84565b6ffd72' '086ed7d2c2d4efd441220e2d5244afd8a9a1327fed42b98f1a9e0eb05590abbf893716b3f5e01db1234eafe5386097013578dfc7c20fc8367860ce5cd9611aac' 'be47c370c1b765921a6ffbb0eeaceaabc26483629b2ebd73c38f36b3ac418d1746fa021b5d444264641ff7c0c13e688a752758bd75c84e0297aceeaec0062ff2' + '219ad84cbd9fe6284e61ded5813c1ca36158067e796ae6532cacfe9aeeb7c716c0382d991df5026c3f880dd39c271c6478bc4f56d4cecb14baa05921cf4dd567' '6e5980e56343a23bce4fcda58f6abc8f2debca0c278c87b09e53abb17ff15849c26e8df3bbff2388985f8fe5a4e9be9982c602ef7159546f0ae335fca1000a41') # Google API keys (see http://www.chromium.org/developers/how-tos/api-keys) @@ -123,6 +126,10 @@ prepare() { # https://bugzilla.mozilla.org/show_bug.cgi?id=1820416 patch -Np1 -i ../0003-Bug-1820416-Use-correct-FFVPX-headers-from-ffmpeg-6..patch + # https://bugs.archlinux.org/task/77805 + # https://bugzilla.mozilla.org/show_bug.cgi?id=1821359 + patch -Np1 -i ../0004-Bug-1821359-Disable-TLS-Key-Pinning-for-Twitter-Doma.patch + echo -n "$_google_api_key" >google-api-key echo -n "$_mozilla_api_key" >mozilla-api-key