firefox 75.0 -> 76.0

[andir]

This is the upcoming Firefox 76 update. It is due for tomorrow.

The prelimiary changelog can be seen over at mozillas release notes repo.

Usually these updates also fix a few security issues with varying
severity.

While ofBorg will classify this is a mass-rebuild the Firefox bump
itself isn't. The NSS change included in this PR has been submitted (and
merged) to staging and should be included in the next staging iteration.

I kept the NSS change to make it easier to review this PR and to merge
it into master if the fixed security issues are severe enough to warrant
it.

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/firefox-not-up-to-date/5941/11

[mweinelt]

Built firefox-wayland and it's up and running writing this comment.

Thanks!

[vcunat]

It's not surprising that there are multiple "critical" vulnerabilities fixed: https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/

EDIT: link to beautiful version of release notes, for completeness: https://www.mozilla.org/en-US/firefox/76.0/releasenotes/

[drewrisinger]

@andir is there a reason you merged #86806 & #86811 before this?

[vcunat]

Because of the rebuilds, I suppose. Even the current staging-next doesn't have that nss version yet.

[andir]

@andir is there a reason you merged #86806 & #86811 before this?

Yeah, @vcunat is right. The other two have less rebuilds since they are already using dedicated NSS packages. There is no reason to delay the stable branches because of master needing more rebuilds/time.

[vcunat]

I think just the firefox attribute needs the updated NSS. For now I briefly tried the most important ones atop master (-bin and -esr) and pushed them.