Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

thunderbird, thunderbird-bin: 68.10.0 -> 78.0 [High security fixes] #93227

Merged
merged 10 commits into from Aug 1, 2020

Conversation

@taku0
Copy link
Contributor

taku0 commented Jul 16, 2020

Motivation for this change
  • High security fixes
  • Various updates

https://www.mozilla.org/en-US/security/advisories/mfsa2020-29/
https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.
@ofborg ofborg bot requested review from edolstra, lovesegfault and nbp Jul 16, 2020
@vcunat vcunat changed the title thunderbird, thunderbird-bin: 68.9.0 -> 78.0 thunderbird, thunderbird-bin: 68.10.0 -> 78.0 Jul 16, 2020
@taku0 taku0 force-pushed the taku0:thunderbird-bin-78.0 branch from 06d00e3 to fd5e9c4 Jul 16, 2020
@ofborg ofborg bot requested a review from lovek323 Jul 16, 2020
@xfix
Copy link
Contributor

xfix commented Jul 17, 2020

Can we avoid backporting this at least until PGP support gets implemented (likely 78.2)? As release notes say "At this time, users of the Enigmail Add-on should not update to Thunderbird 78", and I personally depend on Enigmail.

@vcunat
Copy link
Member

vcunat commented Jul 17, 2020

I agree. AFAIK it doesn't auto-upgrade yet (e.g. the Windows version, I mean). I expect 68 will be supported and default at least until this stuff is resolved upstream.

@taku0 taku0 changed the title thunderbird, thunderbird-bin: 68.10.0 -> 78.0 thunderbird, thunderbird-bin: 68.10.0 -> 78.0 [High security fixes] Jul 18, 2020
@taku0
Copy link
Contributor Author

taku0 commented Jul 27, 2020

Now expressions for both 68 (default) and 78 (with suffix) are available.

@taku0 taku0 marked this pull request as ready for review Jul 27, 2020
@mweinelt
Copy link
Member

mweinelt commented Jul 28, 2020

LGTM. Did a quick run-test on thunderbird-78.

Result of nixpkgs-review pr 93227 1

3 packages built:
- thunderbird
- thunderbird-78
- thunderbird-bin-78

"--disable-gconf"

This comment has been minimized.

Copy link
@vcunat

vcunat Jul 28, 2020

Member

Can we mention somewhere why these options were removed? (in the commit message perhaps)

This comment has been minimized.

Copy link
@taku0

taku0 Jul 29, 2020

Author Contributor

Updated the commit message.

This comment has been minimized.

Copy link
@vcunat

vcunat Aug 1, 2020

Member

-icu was there twice. For the rest I can't see them referenced in the output, so I assume the flags being unsupported means that thunderbird now always bundles those dependencies :-/ I expect we should remove them from build inputs (some time).

taku0 added 4 commits Jul 15, 2020
- Updated the version and the source hash.
- Removed unsupported options.
- Updated the patch.
- Tweaked dependencies; 78 requires newer versions.
@taku0 taku0 force-pushed the taku0:thunderbird-bin-78.0 branch from 70a326c to 379d978 Jul 29, 2020
@ofborg ofborg bot requested a review from lovesegfault Jul 29, 2020
@taku0
Copy link
Contributor Author

taku0 commented Jul 30, 2020

@vcunat
Copy link
Member

vcunat commented Jul 30, 2020

I saw it yesterday accidentally (when looking at NSS stuff), but I still can't see any release notes or tarballs even now.

@xfix
Copy link
Contributor

xfix commented Jul 30, 2020

@vcunat
Copy link
Member

vcunat commented Jul 30, 2020

Still not suitable for default.

At this time, users of the Enigmail Add-on should not update to Thunderbird 78.

OpenPGP in Thunderbird 78.1.0 has reached feature complete state, but it's still disabled by default, to allow more time for testing, correctness, and localization. See the wiki for how to enable and help with testing.

@vcunat
vcunat approved these changes Aug 1, 2020
Copy link
Member

vcunat left a comment

Both seem to work for me, but so far I haven't been brave enough to start that enigmail migration wizard.

@vcunat vcunat merged commit 35ce100 into NixOS:master Aug 1, 2020
18 checks passed
18 checks passed
tests
Details
editorconfig editorconfig
Details
Evaluation Performance Report Evaluator Performance Report
Details
grahamcofborg-eval ^.^!
Details
grahamcofborg-eval-check-maintainers matching changed paths to changed attrs...
Details
grahamcofborg-eval-check-meta config.nix: checkMeta = true
Details
grahamcofborg-eval-darwin nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="60977e8"; rev="60977e8d88ad1a4e566eb746ca2019e3afaac633"; } ./pkgs/t
Details
grahamcofborg-eval-lib-tests nix-build --arg pkgs import ./. {} ./lib/tests/release.nix
Details
grahamcofborg-eval-nixos nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="60977e8"; rev="60977e8d88ad1a4e566eb746ca2019e3afaac633"; } ./nixos/
Details
grahamcofborg-eval-nixos-manual nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="60977e8"; rev="60977e8d88ad1a4e566eb746ca2019e3afaac633"; } ./nixos/
Details
grahamcofborg-eval-nixos-options nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="60977e8"; rev="60977e8d88ad1a4e566eb746ca2019e3afaac633"; } ./nixos/
Details
grahamcofborg-eval-nixpkgs-manual nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="60977e8"; rev="60977e8d88ad1a4e566eb746ca2019e3afaac633"; } ./pkgs/t
Details
grahamcofborg-eval-nixpkgs-tarball nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="60977e8"; rev="60977e8d88ad1a4e566eb746ca2019e3afaac633"; } ./pkgs/t
Details
grahamcofborg-eval-nixpkgs-unstable-jobset nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="60977e8"; rev="60977e8d88ad1a4e566eb746ca2019e3afaac633"; } ./pkgs/t
Details
grahamcofborg-eval-package-list nix-env -qa --json --file .
Details
grahamcofborg-eval-package-list-no-aliases nix-env -qa --json --file . --arg config { allowAliases = false; }
Details
thunderbird, thunderbird-bin, thunderbird-bin.passthru.tests, thunderbird.passthru.tests on aarch64-linux Success
Details
thunderbird, thunderbird-bin, thunderbird-bin.passthru.tests, thunderbird.passthru.tests on x86_64-linux Success
Details
@vcunat
Copy link
Member

vcunat commented Aug 1, 2020

Well, one of the extensions I've been using isn't compatible, but such things aren't really a surprise.

@mweinelt
Copy link
Member

mweinelt commented Aug 1, 2020

I haven't been brave enough to start that enigmail migration wizard.

I have and it didn't work. Exported my private key and it's a 2048 bit RSA key, 260kB in size, I get an error when trying to import it manually.

Specifically I'm running into https://bugzilla.mozilla.org/show_bug.cgi?id=1654894.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked issues

Successfully merging this pull request may close these issues.

None yet

6 participants
You can’t perform that action at this time.