Merge branch 'ecne' of git.cmxsl.org:CMXSL.org/package-helpers-cmxsl into ecne-cmxsl
|
|
@ -4,10 +4,10 @@ Based on https://git.parabola.nu/abslibre.git/diff/libre/iceweasel/9004-FSDG-mis
|
|||
- Remove promos of Firefox Focus and Klar from Private Browsing
|
||||
|
||||
diff --git a/browser/app/profile/firefox.js b/browser/app/profile/firefox.js
|
||||
index c5f7cf3a..f0124235 100644
|
||||
index cc42846d..52d35d49 100644
|
||||
--- a/browser/app/profile/firefox.js
|
||||
+++ b/browser/app/profile/firefox.js
|
||||
@@ -1368,9 +1368,9 @@ pref("accessibility.typeaheadfind.linksonly", false);
|
||||
@@ -1388,11 +1388,11 @@ pref("accessibility.typeaheadfind.linksonly", false);
|
||||
pref("accessibility.typeaheadfind.flashBar", 1);
|
||||
|
||||
// Whether we had to hide the "Firefox Labs" section because it would be empty.
|
||||
|
|
@ -16,9 +16,12 @@ index c5f7cf3a..f0124235 100644
|
|||
// Whether we show the "More from Mozilla" section.
|
||||
-pref("browser.preferences.moreFromMozilla", true);
|
||||
+pref("browser.preferences.moreFromMozilla", false);
|
||||
|
||||
// Used by settings to track whether the user customized advanced
|
||||
// performance settings. Not used directly elsewhere.
|
||||
// Whether we show the "AI Controls" pane.
|
||||
-pref("browser.preferences.aiControls", true);
|
||||
+pref("browser.preferences.aiControls", false);
|
||||
// Whether to show unavailable AI controls regardless of region/locale
|
||||
// restrictions. This is intended for localizers to be able to see the strings.
|
||||
pref("browser.preferences.aiControls.showUnavailable", false);
|
||||
@@ -2281,7 +2281,7 @@ pref("browser.contentblocking.report.vpn_regions", "ca,my,nz,sg,gb,gg,im,io,je,u
|
||||
pref("browser.promo.focus.disallowed_regions", "cn");
|
||||
|
||||
|
|
@ -456,17 +459,19 @@ index b5ff592..22cdf39 100644
|
|||
{
|
||||
id: "PB_NEWTAB_VPN_PROMO",
|
||||
template: "pb_newtab",
|
||||
diff -Nru a/browser/components/preferences/jar.mn b/browser/components/preferences/jar.mn
|
||||
--- a/browser/components/preferences/jar.mn 2022-05-22 09:35:55.400673986 +0000
|
||||
+++ b/browser/components/preferences/jar.mn 2022-05-22 21:45:51.512354083 +0000
|
||||
@@ -18,7 +18,5 @@
|
||||
diff --git a/browser/components/preferences/jar.mn b/browser/components/preferences/jar.mn
|
||||
index b2d65603..b44a1525 100644
|
||||
--- a/browser/components/preferences/jar.mn
|
||||
+++ b/browser/components/preferences/jar.mn
|
||||
@@ -19,8 +19,6 @@ browser.jar:
|
||||
content/browser/preferences/fxaPairDevice.xhtml
|
||||
content/browser/preferences/fxaPairDevice.js
|
||||
content/browser/preferences/findInPage.js
|
||||
- content/browser/preferences/more-from-mozilla-qr-code-simple.svg
|
||||
- content/browser/preferences/more-from-mozilla-qr-code-simple-cn.svg
|
||||
content/browser/preferences/browser-layout-horizontal.svg
|
||||
content/browser/preferences/browser-layout-vertical.svg
|
||||
content/browser/preferences/web-appearance-dark.svg
|
||||
content/browser/preferences/web-appearance-light.svg
|
||||
diff --git a/browser/components/preferences/more-from-mozilla-qr-code-simple-cn.svg b/browser/components/preferences/more-from-mozilla-qr-code-simple-cn.svg
|
||||
index edcad0f3..e69de29b 100644
|
||||
--- a/browser/components/preferences/more-from-mozilla-qr-code-simple-cn.svg
|
||||
|
|
@ -736,10 +741,10 @@ index 3888af10..1d6c606f 100644
|
|||
"chrome://browser/content/asrouter/assets/fox-with-devices.svg",
|
||||
"chrome://browser/content/asrouter/assets/fox-with-locked-box.svg",
|
||||
diff --git a/browser/components/preferences/moreFromMozilla.js b/browser/components/preferences/moreFromMozilla.js
|
||||
index 8807b5d3..82367922 100644
|
||||
index 109d334e..ee49d63f 100644
|
||||
--- a/browser/components/preferences/moreFromMozilla.js
|
||||
+++ b/browser/components/preferences/moreFromMozilla.js
|
||||
@@ -81,51 +81,7 @@ var gMoreFromMozillaPane = {
|
||||
@@ -81,50 +81,7 @@ var gMoreFromMozillaPane = {
|
||||
|
||||
renderProducts() {
|
||||
const isRegionUS = Region.home.toLowerCase() === "us";
|
||||
|
|
@ -777,9 +782,8 @@ index 8807b5d3..82367922 100644
|
|||
- {
|
||||
- id: "mozilla-monitor",
|
||||
- title_string_id: "more-from-moz-mozilla-monitor-title",
|
||||
- description_string_id: isRegionUS
|
||||
- ? "more-from-moz-mozilla-monitor-us-description"
|
||||
- : "more-from-moz-mozilla-monitor-global-description",
|
||||
- description_string_id:
|
||||
- "more-from-moz-mozilla-monitor-global-description",
|
||||
- region: isRegionUS ? "us" : "global",
|
||||
- button: {
|
||||
- id: "mozillaMonitor",
|
||||
|
|
|
|||
|
|
@ -24,8 +24,8 @@ index 217ed280..d91cde94 100644
|
|||
|
||||
// Do not enable the preonboarding experience on Linux
|
||||
#ifdef XP_LINUX
|
||||
@@ -1856,24 +1856,24 @@ pref("browser.newtabpage.activity-stream.mobileDownloadModal.variant-c", false);
|
||||
pref("browser.newtabpage.activity-stream.discoverystream.refinedCardsLayout.enabled", true);
|
||||
@@ -1886,24 +1886,24 @@ pref("browser.newtabpage.activity-stream.mobileDownloadModal.variant-b", false);
|
||||
pref("browser.newtabpage.activity-stream.mobileDownloadModal.variant-c", false);
|
||||
|
||||
// Mozilla Ad Routing Service (MARS) unified ads service
|
||||
-pref("browser.newtabpage.activity-stream.unifiedAds.tiles.enabled", true);
|
||||
|
|
@ -35,13 +35,14 @@ index 217ed280..d91cde94 100644
|
|||
+pref("browser.newtabpage.activity-stream.unifiedAds.spocs.enabled", false);
|
||||
+pref("browser.newtabpage.activity-stream.unifiedAds.endpoint", "");
|
||||
pref("browser.newtabpage.activity-stream.unifiedAds.adsFeed.enabled", false);
|
||||
pref("browser.newtabpage.activity-stream.unifiedAds.ohttp.enabled", false);
|
||||
-pref("browser.newtabpage.activity-stream.unifiedAds.ohttp.enabled", true);
|
||||
+pref("browser.newtabpage.activity-stream.unifiedAds.ohttp.enabled", false);
|
||||
|
||||
// Weather widget for newtab
|
||||
-pref("browser.newtabpage.activity-stream.showWeather", true);
|
||||
+pref("browser.newtabpage.activity-stream.showWeather", false);
|
||||
pref("browser.newtabpage.activity-stream.weather.query", "");
|
||||
pref("browser.newtabpage.activity-stream.weather.display", "simple");
|
||||
pref("browser.newtabpage.activity-stream.weather.display", "detailed");
|
||||
|
||||
pref("browser.newtabpage.activity-stream.images.smart", true);
|
||||
|
||||
|
|
|
|||
|
|
@ -11,53 +11,53 @@ index ba47adb6..c4b29ec4 100644
|
|||
where: "tabshifted",
|
||||
},
|
||||
navigate: true,
|
||||
@@ -750,49 +750,6 @@ const MR_ABOUT_WELCOME_DEFAULT = {
|
||||
@@ -865,6 +865,49 @@ const MR_ABOUT_WELCOME_DEFAULT = {
|
||||
},
|
||||
targeting: "isFxASignedIn",
|
||||
},
|
||||
- {
|
||||
- id: "AW_ACCOUNT_LOGIN",
|
||||
- content: {
|
||||
- fullscreen: true,
|
||||
- position: "split",
|
||||
- split_narrow_bkg_position: "-228px",
|
||||
- image_alt_text: {
|
||||
- string_id: "mr2022-onboarding-gratitude-image-alt",
|
||||
- },
|
||||
- background:
|
||||
- "url('chrome://activity-stream/content/data/content/assets/fox-doodle-waving-laptop.svg') center center / 80% no-repeat var(--mr-screen-background-color)",
|
||||
- progress_bar: true,
|
||||
- logo: {},
|
||||
- title: {
|
||||
- string_id: "onboarding-sign-up-title",
|
||||
- },
|
||||
- subtitle: {
|
||||
- string_id: "onboarding-sign-up-description",
|
||||
- },
|
||||
- secondary_button: {
|
||||
- label: {
|
||||
- string_id: "mr2-onboarding-start-browsing-button-label",
|
||||
- },
|
||||
- style: "secondary",
|
||||
- action: {
|
||||
- navigate: true,
|
||||
- },
|
||||
- },
|
||||
- primary_button: {
|
||||
- label: {
|
||||
- string_id: "onboarding-sign-up-button",
|
||||
- },
|
||||
- action: {
|
||||
- data: {
|
||||
- entrypoint: "newuser-onboarding-desktop",
|
||||
- },
|
||||
- type: "FXA_SIGNIN_FLOW",
|
||||
- navigate: true,
|
||||
- },
|
||||
- },
|
||||
- },
|
||||
- targeting: "!isFxASignedIn",
|
||||
- },
|
||||
+ {
|
||||
+ id: "AW_ACCOUNT_LOGIN",
|
||||
+ content: {
|
||||
+ fullscreen: true,
|
||||
+ position: "split",
|
||||
+ split_narrow_bkg_position: "-228px",
|
||||
+ image_alt_text: {
|
||||
+ string_id: "mr2022-onboarding-gratitude-image-alt",
|
||||
+ },
|
||||
+ background:
|
||||
+ "url('chrome://activity-stream/content/data/content/assets/br-fxa-fox-mirror.svg') var(--mr-secondary-position) no-repeat light-dark(rgba(252, 245, 240, 1), rgba(33, 3, 64, 1))",
|
||||
+ progress_bar: true,
|
||||
+ logo: {},
|
||||
+ title: {
|
||||
+ string_id: "onboarding-sign-up-title",
|
||||
+ },
|
||||
+ subtitle: {
|
||||
+ string_id: "onboarding-sign-up-description",
|
||||
+ },
|
||||
+ secondary_button: {
|
||||
+ label: {
|
||||
+ string_id: "mr2-onboarding-start-browsing-button-label",
|
||||
+ },
|
||||
+ style: "secondary",
|
||||
+ action: {
|
||||
+ navigate: true,
|
||||
+ },
|
||||
+ },
|
||||
+ primary_button: {
|
||||
+ label: {
|
||||
+ string_id: "onboarding-sign-up-button",
|
||||
+ },
|
||||
+ action: {
|
||||
+ data: {
|
||||
+ entrypoint: "newuser-onboarding-desktop",
|
||||
+ },
|
||||
+ type: "FXA_SIGNIN_FLOW",
|
||||
+ navigate: true,
|
||||
+ },
|
||||
+ },
|
||||
+ },
|
||||
+ targeting: "!isFxASignedIn",
|
||||
+ },
|
||||
],
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,28 @@
|
|||
diff --git a/debian/control.in b/debian/control.in
|
||||
index 758352f8..26383a38 100644
|
||||
--- a/debian/control.in
|
||||
+++ b/debian/control.in
|
||||
@@ -43,8 +43,8 @@ Build-Depends: cdbs,
|
||||
libclang-22-dev | libclang-21-dev | libclang-20-dev | libclang-19-dev | libclang-18-dev,
|
||||
llvm-22-dev | llvm-21-dev | llvm-20-dev | llvm-19-dev | llvm-18-dev,
|
||||
lld-22 | lld-21 | lld-20 | lld-19 | lld-18,
|
||||
- cargo-1.90,
|
||||
- rustc-1.90,
|
||||
+ cargo-1.91 | cargo-1.90,
|
||||
+ rustc-1.91 | rustc-1.90,
|
||||
nodejs (>= 12.22.12)
|
||||
Standards-Version: 3.9.1
|
||||
|
||||
diff --git a/debian/build/rules.mk b/debian/build/rules.mk
|
||||
index 896150e7..413e34fc 100644
|
||||
--- a/debian/build/rules.mk
|
||||
+++ b/debian/build/rules.mk
|
||||
@@ -109,7 +109,7 @@ LLVM_VERSIONS = 22 21 20 19 18
|
||||
DEB_LLVM_VERSION = $(firstword $(foreach llvm_version, $(LLVM_VERSIONS), \
|
||||
$(if $(shell which clang-$(llvm_version)), $(llvm_version))))
|
||||
|
||||
-RUSTC_VERSIONS = 1.90
|
||||
+RUSTC_VERSIONS = 1.91 1.90
|
||||
DEB_RUSTC_VERSION = $(firstword $(foreach rustc_version, $(RUSTC_VERSIONS), \
|
||||
$(if $(shell which rustc-$(rustc_version)), $(rustc_version))))
|
||||
|
||||
|
|
@ -0,0 +1,38 @@
|
|||
diff --git a/browser/themes/shared/jar.inc.mn b/browser/themes/shared/jar.inc.mn
|
||||
index 3a12a7a3..ac1245a9 100644
|
||||
--- a/browser/themes/shared/jar.inc.mn
|
||||
+++ b/browser/themes/shared/jar.inc.mn
|
||||
@@ -266,10 +266,10 @@
|
||||
skin/classic/browser/search-indicator-badge-add.svg (../shared/search/search-indicator-badge-add.svg)
|
||||
skin/classic/browser/searchbar.css (../shared/search/searchbar.css)
|
||||
|
||||
- skin/classic/browser/sidebar/firefox.svg (../shared/sidebar/firefox.svg)
|
||||
- skin/classic/browser/sidebar/foxy.svg (../shared/sidebar/foxy.svg)
|
||||
- skin/classic/browser/sidebar/gmail.svg (../shared/sidebar/gmail.svg)
|
||||
- skin/classic/browser/sidebar/slack.svg (../shared/sidebar/slack.svg)
|
||||
+ skin/classic/browser/sidebar/trisquel.svg (../shared/sidebar/trisquel.svg)
|
||||
+ skin/classic/browser/sidebar/fsf.svg (../shared/sidebar/fsf.svg)
|
||||
+ skin/classic/browser/sidebar/wikipedia.svg (../shared/sidebar/wikipedia.svg)
|
||||
+ skin/classic/browser/sidebar/liberachat.svg (../shared/sidebar/liberachat.svg)
|
||||
|
||||
skin/classic/browser/tabbrowser/content-area.css (../shared/tabbrowser/content-area.css)
|
||||
skin/classic/browser/tabbrowser/crashed.svg (../shared/tabbrowser/crashed.svg)
|
||||
diff --git a/browser/components/sidebar/sidebar-pins-promo.mjs b/browser/components/sidebar/sidebar-pins-promo.mjs
|
||||
index beac7ea4..538ae9aa 100644
|
||||
--- a/browser/components/sidebar/sidebar-pins-promo.mjs
|
||||
+++ b/browser/components/sidebar/sidebar-pins-promo.mjs
|
||||
@@ -56,10 +56,10 @@ export default class SidebarPinsPromo extends MozLitElement {
|
||||
this.launcherObserver = new MutationObserver(() => this.requestUpdate());
|
||||
}
|
||||
#icons = [
|
||||
- { name: "firefox", src: "chrome://browser/skin/sidebar/firefox.svg" },
|
||||
- { name: "slack", src: "chrome://browser/skin/sidebar/slack.svg" },
|
||||
- { name: "foxy", src: "chrome://browser/skin/sidebar/foxy.svg" },
|
||||
- { name: "gmail", src: "chrome://browser/skin/sidebar/gmail.svg" },
|
||||
+ { name: "trisquel", src: "chrome://browser/skin/sidebar/trisquel.svg" },
|
||||
+ { name: "liberachat", src: "chrome://browser/skin/sidebar/liberachat.svg" },
|
||||
+ { name: "fsf", src: "chrome://browser/skin/sidebar/fsf.svg" },
|
||||
+ { name: "wikipedia", src: "chrome://browser/skin/sidebar/wikipedia.svg" },
|
||||
];
|
||||
|
||||
connectedCallback() {
|
||||
|
|
@ -0,0 +1,28 @@
|
|||
diff --git a/browser/extensions/newtab/lib/Wallpapers/WallpaperFeed.sys.mjs b/browser/extensions/newtab/lib/Wallpapers/WallpaperFeed.sys.mjs
|
||||
index 72df22b3..24f2f807 100644
|
||||
--- a/browser/extensions/newtab/lib/Wallpapers/WallpaperFeed.sys.mjs
|
||||
+++ b/browser/extensions/newtab/lib/Wallpapers/WallpaperFeed.sys.mjs
|
||||
@@ -156,7 +156,9 @@ export class WallpaperFeed {
|
||||
...record,
|
||||
...(record.attachment
|
||||
? {
|
||||
- wallpaperUrl: `${baseAttachmentURL}${record.attachment.location}`,
|
||||
+ wallpaperUrl: record.attachment.location.includes("trisquel")
|
||||
+ ? `https://trisquel.cmxsl.org/newtab/${record.attachment.filename.replace(".avif", ".webp")}`
|
||||
+ : `${baseAttachmentURL}${record.attachment.location}`,
|
||||
}
|
||||
: {}),
|
||||
background_position: record.background_position || "center",
|
||||
diff --git a/services/settings/remote-settings.sys.mjs b/services/settings/remote-settings.sys.mjs
|
||||
index 2330fb01..2c4062d1 100644
|
||||
--- a/services/settings/remote-settings.sys.mjs
|
||||
+++ b/services/settings/remote-settings.sys.mjs
|
||||
@@ -301,7 +301,7 @@ function remoteSettingsFunction() {
|
||||
bucketName: bucket,
|
||||
signerName,
|
||||
});
|
||||
- if (client.verifySignature) {
|
||||
+ if (client.verifySignature && collection!== "newtab-wallpapers-v2") {
|
||||
lazy.console.debug(
|
||||
`${identifier}: Verify signature of bundled changeset`
|
||||
);
|
||||
72
helpers/DATA/firefox/ui_branding/build.json
Normal file
|
|
@ -0,0 +1,72 @@
|
|||
{
|
||||
"1d43f5a1-64bd-4ad4-b825-88a89878662f": {
|
||||
"title": "trisquel-abe-01",
|
||||
"theme": "dark",
|
||||
"attachment": {
|
||||
"hash": "962073af456fd63c6fc9b11dadbef724a56b223e04a7136f87e9b670f2b9283d",
|
||||
"size": 62524,
|
||||
"filename": "trisquel-abe-01.avif",
|
||||
"location": "main-workspace/newtab-wallpapers-v2/trisquel-abe-01.avif",
|
||||
"mimetype": "image/avif"
|
||||
},
|
||||
"background_position": "bottom right"
|
||||
},
|
||||
"2bf99683-cde8-438b-9f8e-a1222dc7f59c": {
|
||||
"title": "trisquel-abe-02",
|
||||
"theme": "light",
|
||||
"attachment": {
|
||||
"hash": "e3363cf5554c98e1243434ee047de9c31ddc3060355a55ce7b3cecd977f379ab",
|
||||
"size": 72574,
|
||||
"filename": "trisquel-abe-02.avif",
|
||||
"location": "main-workspace/newtab-wallpapers-v2/trisquel-abe-02.avif",
|
||||
"mimetype": "image/avif"
|
||||
},
|
||||
"background_position": "bottom right"
|
||||
},
|
||||
"2e468f89-ac6a-474f-a789-5de0be601887": {
|
||||
"title": "trisquel-abe-03",
|
||||
"theme": "dark",
|
||||
"attachment": {
|
||||
"hash": "3d6687928a6eeee6bd9f52ef2fae115ddfdcf974a832cce2286b37c642c0ede7",
|
||||
"size": 48020,
|
||||
"filename": "trisquel-abe-03.avif",
|
||||
"location": "main-workspace/newtab-wallpapers-v2/trisquel-abe-03.avif",
|
||||
"mimetype": "image/avif"
|
||||
},
|
||||
"background_position": "bottom right"
|
||||
},
|
||||
"429c288c-8d92-4baa-aefb-a04719882454": {
|
||||
"title": "trisquel-abe-04",
|
||||
"theme": "light",
|
||||
"attachment": {
|
||||
"hash": "f6b225b3f091dd556040028e758d143cbcb4d52d4e43ede3a2a367f44505993f",
|
||||
"size": 25226,
|
||||
"filename": "trisquel-abe-04.avif",
|
||||
"location": "main-workspace/newtab-wallpapers-v2/trisquel-abe-04.avif",
|
||||
"mimetype": "image/avif"
|
||||
},
|
||||
"background_position": "bottom right"
|
||||
},
|
||||
"451090be-cdf1-49fc-b1f3-bd2f3b4ac34d": {
|
||||
"title": "trisquel-aramo",
|
||||
"theme": "dark",
|
||||
"attachment": {
|
||||
"hash": "8c9ae9eb2063b763c737cd795af0f7b8883b43b2519d455b4097462ba6f4ad70",
|
||||
"size": 196288,
|
||||
"filename": "trisquel-aramo.avif",
|
||||
"location": "main-workspace/newtab-wallpapers-v2/trisquel-aramo.avif",
|
||||
"mimetype": "image/avif"
|
||||
}
|
||||
},
|
||||
"62aa72d9-b9f3-4f29-88f5-5120ee004e7c": {
|
||||
"title": "trisquel-ecne",
|
||||
"theme": "dark",
|
||||
"attachment": {
|
||||
"hash": "6a233237277c7cdc3a1078f250f1ae21576ceedec9d0abbe33be9f93add25355",
|
||||
"size": 110186,
|
||||
"filename": "trisquel-ecne.avif",
|
||||
"location": "main-workspace/newtab-wallpapers-v2/trisquel-ecne.avif",
|
||||
"mimetype": "image/avif"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
After Width: | Height: | Size: 20 KiB |
|
After Width: | Height: | Size: 6.6 KiB |
|
After Width: | Height: | Size: 15 KiB |
|
After Width: | Height: | Size: 36 KiB |
|
After Width: | Height: | Size: 42 KiB |
6
helpers/DATA/firefox/ui_branding/sidebar/fsf.svg
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
<!-- Generator: Adobe Illustrator 9.0, SVG Export Plug-In -->
|
||||
<svg id="svg2" width="28" height="28" version="1.1" viewBox="0 0 21 21" xml:space="preserve" xmlns="http://www.w3.org/2000/svg">
|
||||
<g id="g10" transform="matrix(.020161 0 0 .020161 1.5 6.4851)" stroke="#000">
|
||||
<path id="path12" d="m86.4 193.62h-86.4v-64.8h86.4v-50.4h-14.4v-36h14.4v-14.4h36v14.4h216c59.668-31.267 129.7-37.338 190.24-38.083 66.813-0.858 70.275-0.107 97.53 0.088 115.37 0.859 123.32 1.368 139.6-1.201 6.564-1.081 13.763 3.26 14.332 6.495 1.323 7.172-13.626 15.478-18.242 16.941-14.351 4.555-40.043 6.616-109.93 10.648l-1.664 0.034c-110.99 10.48-173.25 36.647-189.34 44.135-63.641 29.703-70.511 43.531-62.237 52.355 8.768 9.358 58.312-11.226 82.607-18.164 48.282-13.774 76.735-0.583 94.708 13.152h43.2v-7.2h28.8v7.2h244.8v64.8h-244.8v50.401h208.8v36h-208.8v115.2h-28.8v-115.2h-14.4v-36h14.4v-50.401h-14.4c-0.249 25.469-7.709 48.819-14.848 58.438-66.632 89.505-368.87 101.02-462.49 102.55-23.625 0.405-40.536-3.558-41.059-9.787m167.37-217.57c4.039-16.988 15.325-34.298 28.846-48.704l-158.2 0.631-0.574 49.838 129.12 0.524 0.61 1.033m498.38-118.76c-1.645-0.819-85.667 3.864-90.391 3.435-4.723-0.43-55.339 0.295-83.09-0.43-32.85-0.859-67.324 0.034-99.409 3.006-32.42 3.006-65.914 13.097-93.61 24.691-26.348 11.031-52.604 24.905-73.215 41.223-10.555 8.354-18.579 17.633-25.764 28.986-8.159 12.881-12.092 27.596-6.657 39.935 5.859 13.284 18.962 19.168 35.212 21.685 14.754 2.294 32.85 1.073 44.444 3.435 6.884 1.402 18.183 3.254 18.894 9.877 0.644 6.011-10.206 16.063-15.244 18.463-9.447 4.51-22.115 0.645-34.353-1.932-8.435-1.771-20.953-5.878-28.771-9.448-5.279-2.414-10.927-4.32-12.001-4.32-0.428 0-165.81-0.428-165.6 0 0 2.791-0.213 137.56 0 144 0.235 7.112 24.778 5.005 39.976 3.529 29.361-2.873 59.902-6.442 89.532-10.735 16.942-2.456 34.897-5.637 51.958-9.019 27.053-5.366 59.401-12.882 72.852-17.177 33.642-10.734 68.424-20.181 100.2-33.922 14.286-6.173 31.347-13.956 42.942-21.901 12.358-8.468 25.549-20.182 31.132-32.205 6.199-13.352 8.097-29.428 1.717-44.015-6.011-13.741-22.544-25.978-36.929-28.341-8.187-1.342-14.6-2.147-22.544-1.503-9.138 0.738-24.691 4.079-34.997 5.368-16.942 2.12-36.849 5.133-53.462 2.577-11.164-1.719-28.77-16.103-22.544-32.85 4.563-12.279 22.242-24.88 32.85-31.776 25.765-16.748 72.114-31.368 111.86-40.795 33.493-7.943 80.513-14.385 120.23-14.814 3.83-0.04 39.713-2.449 43.37-2.577 60.332-2.147 62.264-12.023 61.406-12.452" fill="context-fill" stroke="none"/>
|
||||
</g>
|
||||
</svg>
|
||||
|
After Width: | Height: | Size: 2.4 KiB |
3
helpers/DATA/firefox/ui_branding/sidebar/liberachat.svg
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
<svg id="svg1" width="26" height="26" version="1.1" viewBox="0 0 96.89 78.87" xmlns="http://www.w3.org/2000/svg">
|
||||
<path id="path1" d="m56.648 45.061-11.757 13.5-6.4785-2.6344-15.12 19.274 51.009 0.026555zm0.297-5.2542-13.104 15.021-6.3915-2.6585-18.1 23.043h2.0017l16.567-21.2 6.3553 2.632 12.45-14.278 19.583 32.909 1.9269-0.03622zm0.25837-4.822-14.106 16.108-6.4519-2.842-20.993 26.976h1.8303l19.631-25.122 6.3915 2.83 13.476-15.391c7.4672 12.697 15.516 24.912 22.835 37.695h1.8303zm0.38393-32.849-4.9645 38.079 4.5806-5.2301 0.64471 1.0624 8.6903-31.303-0.22215-0.08451a46.942 46.942 0 0 0-8.0987-2.4001 49.254 49.254 0 0 0-0.53122-0.11107zm-18.532 0.050708a39.809 39.809 0 0 0-0.80407 0.17144l-0.27044 0.050708a48.809 48.809 0 0 0-0.53122 0.12315l-0.26078 0.06278a48.648 48.648 0 0 0-7.0218 2.2239l-0.14971 0.07486 13.718 45.47 2.2335-2.5499-6.901-45.627zm43.408 12.882-19.078 30.096 2.2963 3.7813 23.159-26.213a43.629 43.629 0 0 0-3.5833-4.723 48.03 48.03 0 0 0-2.7937-2.941zm-68.554 0.54329a43.184 43.184 0 0 0-3.7451 4.228 50.812 50.812 0 0 0-2.2263 3.0666v0.02414l26.165 28.587 2.12-2.7237zm-13.017 24.453a47.263 47.263 0 0 0-0.891 9.3229l27.669 10.397 2.3084-2.9676zm95.281 0.82822-26.266 15.014 2.1539 3.5447 24.815-9.0501v-0.12556a28.014 28.014 0 0 0 0.0145-0.81615v-1.2604l-0.0145-0.25837v-0.27285l-0.0121-0.27285-0.0121-0.27044-0.0121-0.27286-0.0121-0.27044-0.024-0.26078-0.0121-0.27285-0.0266-0.27044-0.0121-0.27285-0.0241-0.25837-0.0242-0.27285-0.0241-0.27285-0.0266-0.27044-0.0241-0.26078a39.141 39.141 0 0 0-0.45637-3.2139v-0.05071zm-74.866 27.068-17.4 0.0821a49.18 49.18 0 0 0 4.8969 8.6903h0.01212l6.8479-1.5067h-0.01211zm56.135 0.35496 4.1701 6.8672 6.5099 1.4633 0.06278-0.07243a44.531 44.531 0 0 0 3.127-5.0707 45.99 45.99 0 0 0 1.4222-2.929z" fill="context-fill" stroke-width="1.2363"/>
|
||||
</svg>
|
||||
|
After Width: | Height: | Size: 1.8 KiB |
3
helpers/DATA/firefox/ui_branding/sidebar/trisquel.svg
Normal file
|
After Width: | Height: | Size: 26 KiB |
3
helpers/DATA/firefox/ui_branding/sidebar/wikipedia.svg
Normal file
|
After Width: | Height: | Size: 59 KiB |
163
helpers/DATA/firefox/ui_branding/wallpaper-replace.py
Normal file
|
|
@ -0,0 +1,163 @@
|
|||
# Copyright (C) 2026 Luis Guzman <ark@switnet.org>
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
|
||||
import json
|
||||
import hashlib
|
||||
import os
|
||||
import time
|
||||
import argparse
|
||||
import sys
|
||||
|
||||
def calculate_sha256_hash(file_path):
|
||||
"""
|
||||
Calculates the SHA-256 hash of a physical file.
|
||||
"""
|
||||
sha256_hash = hashlib.sha256()
|
||||
with open(file_path, "rb") as f:
|
||||
for byte_block in iter(lambda: f.read(4096), b""):
|
||||
sha256_hash.update(byte_block)
|
||||
return sha256_hash.hexdigest()
|
||||
|
||||
def build_step(config_path, output_path):
|
||||
"""
|
||||
Step 1: Reads config.json, processes the data, and creates build.json.
|
||||
"""
|
||||
print(f"--- Step 1: Building standalone artifact ---")
|
||||
|
||||
if not os.path.exists(config_path):
|
||||
print(f"ERROR: Configuration file '{config_path}' not found.")
|
||||
sys.exit(1)
|
||||
|
||||
with open(config_path, 'r', encoding='utf-8') as f:
|
||||
config = json.load(f)
|
||||
|
||||
build_data = {}
|
||||
|
||||
for item in config.get('replacements',):
|
||||
item_id = item.get('id_to_replace')
|
||||
image_path = item.get('local_image_path')
|
||||
theme = item.get('theme', '').strip()
|
||||
|
||||
if not image_path or not os.path.exists(image_path):
|
||||
print(f"WARNING: Local image not found at '{image_path}' for ID {item_id}. Skipping.")
|
||||
continue
|
||||
|
||||
file_size_bytes = os.path.getsize(image_path)
|
||||
sha256_hash = calculate_sha256_hash(image_path)
|
||||
|
||||
# Get the real file name (e.g., 'trisquel-aramo.webp')
|
||||
real_file_name = os.path.basename(image_path)
|
||||
|
||||
# Create the "disguised" file name to bypass Mozilla's strict schema validation
|
||||
disguised_file_name = real_file_name.replace('.webp', '.avif')
|
||||
|
||||
# Create a 100% schema-compliant entry masking the webp as an avif
|
||||
build_data[item_id] = {
|
||||
"title": real_file_name.replace('.webp', ''),
|
||||
"theme": theme,
|
||||
"attachment": {
|
||||
"hash": sha256_hash,
|
||||
"size": file_size_bytes,
|
||||
"filename": disguised_file_name,
|
||||
"location": f"main-workspace/newtab-wallpapers-v2/{disguised_file_name}",
|
||||
"mimetype": "image/avif" # Masking the mime type for the validator
|
||||
}
|
||||
}
|
||||
|
||||
# Check if the wallpaper is an "abe" one, to position logo accordingly
|
||||
if "abe" in real_file_name.lower():
|
||||
build_data[item_id]["background_position"] = "bottom right"
|
||||
|
||||
# Make sure dark theme is used on trisquel-ecne & trisquel-aramo images
|
||||
if "trisquel-ecne" in real_file_name.lower() or "trisquel-aramo" in real_file_name.lower():
|
||||
build_data[item_id]["theme"] = "dark"
|
||||
|
||||
print(f"Processed: {real_file_name} -> Masked as: {disguised_file_name} -> ID: {item_id}")
|
||||
|
||||
with open(output_path, 'w', encoding='utf-8') as f:
|
||||
json.dump(build_data, f, indent=2, ensure_ascii=False)
|
||||
|
||||
print(f"\nSUCCESS: Generated standalone artifact at '{output_path}'.")
|
||||
|
||||
def replace_step(source_path, target_path):
|
||||
"""
|
||||
Step 2: Injects the build.json data into the target Firefox JSON database.
|
||||
"""
|
||||
print(f"\n--- Step 2: Injecting into target JSON ---")
|
||||
|
||||
if not os.path.exists(source_path):
|
||||
print(f"ERROR: Build source file '{source_path}' not found.")
|
||||
sys.exit(1)
|
||||
|
||||
if not os.path.exists(target_path):
|
||||
print(f"ERROR: Target JSON file '{target_path}' not found.")
|
||||
sys.exit(1)
|
||||
|
||||
with open(source_path, 'r', encoding='utf-8') as f:
|
||||
build_data = json.load(f)
|
||||
|
||||
with open(target_path, 'r', encoding='utf-8') as f:
|
||||
target_db = json.load(f)
|
||||
|
||||
current_timestamp = int(time.time() * 1000)
|
||||
modified_count = 0
|
||||
|
||||
for item in target_db.get('data',):
|
||||
item_id = item.get('id')
|
||||
|
||||
if item_id in build_data:
|
||||
new_data = build_data[item_id]
|
||||
|
||||
# Wipe old custom keys if they exist from previous tests
|
||||
item.pop('wallpaperUrl', None)
|
||||
|
||||
# Apply schema-compliant data
|
||||
item['attachment'] = new_data['attachment']
|
||||
item['title'] = new_data['title']
|
||||
item['schema'] = current_timestamp
|
||||
item['last_modified'] = current_timestamp
|
||||
|
||||
if new_data.get('theme'):
|
||||
item['theme'] = new_data['theme']
|
||||
|
||||
# Apply background_position if it exists in build_data
|
||||
if new_data.get('background_position'):
|
||||
item['background_position'] = new_data['background_position']
|
||||
|
||||
print(f"Updated ID: {item_id} with file '{new_data['attachment']['filename']}'")
|
||||
modified_count += 1
|
||||
|
||||
if modified_count > 0:
|
||||
target_db['timestamp'] = current_timestamp
|
||||
with open(target_path, 'w', encoding='utf-8') as f:
|
||||
json.dump(target_db, f, indent=2, ensure_ascii=False)
|
||||
print(f"\nSUCCESS: Modified {modified_count} entries in '{target_path}'.")
|
||||
else:
|
||||
print("\nWARNING: No matching IDs found in the target JSON to replace.")
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser(description="Firefox Newtab Wallpaper Injection Tool")
|
||||
parser.add_argument('--config', type=str, nargs='?', const='./config.json', help="Step 1: Path to config.json.")
|
||||
parser.add_argument('--replace', type=str, help="Step 2: Path to target Firefox JSON file to be modified.")
|
||||
parser.add_argument('--source', type=str, default='./build.json', help="Step 2: Path to the standalone build.json.")
|
||||
|
||||
args = parser.parse_args()
|
||||
|
||||
if not args.config and not args.replace:
|
||||
parser.print_help()
|
||||
sys.exit(1)
|
||||
|
||||
if args.config: build_step(args.config, './build.json')
|
||||
if args.replace: replace_step(args.source, args.replace)
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
|
|
@ -0,0 +1,266 @@
|
|||
From bfa24370939620efd8b3220bd1206f92fc235107 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?No=C3=A9=20Lopez?= <noelopez@free.fr>
|
||||
Date: Mon, 8 Dec 2025 16:39:11 +0100
|
||||
Subject: [PATCH 1/2] etc: Add AppArmor profile for the daemon.
|
||||
|
||||
* .gitignore: Add etc/apparmor.d/tunables/guix.
|
||||
* Makefile.am (nodist_apparmor_profile_DATA)
|
||||
(nodist_apparmor_profile_tunables_DATA): Define it.
|
||||
* configure.ac: Generate etc/apparmor.d/tunables/guix. Add
|
||||
--with-apparmor-profile-dir option.
|
||||
* etc/apparmor.d/guix-daemon: New file.
|
||||
* etc/apparmor.d/tunables/guix.in: New file.
|
||||
* doc/guix.texi: Document AppArmor profiles.
|
||||
* gnu/packages/package-management.scm (guix): Add future changes commented.
|
||||
|
||||
Change-Id: Iac7df9d642383cc46a2d450c3badef31199ab041
|
||||
GNUtoo: rebased:
|
||||
- removed .gitignore changes
|
||||
- removed manual changes in the "Migrating to the Unprivileged Daemon"
|
||||
subsection.
|
||||
Signed-off-by: Rutherther <rutherther@ditigal.xyz>
|
||||
---
|
||||
Makefile.am | 7 +++
|
||||
configure.ac | 10 ++++
|
||||
doc/guix.texi | 39 +++++++++++++
|
||||
etc/apparmor.d/guix-daemon | 88 +++++++++++++++++++++++++++++
|
||||
etc/apparmor.d/tunables/guix.in | 5 ++
|
||||
gnu/packages/package-management.scm | 4 ++
|
||||
6 files changed, 153 insertions(+)
|
||||
create mode 100644 etc/apparmor.d/guix-daemon
|
||||
create mode 100644 etc/apparmor.d/tunables/guix.in
|
||||
|
||||
diff --git a/Makefile.am b/Makefile.am
|
||||
index 28546be18c..b54b217416 100644
|
||||
--- a/Makefile.am
|
||||
+++ b/Makefile.am
|
||||
@@ -660,6 +660,13 @@ dist_fishcompletion_DATA = etc/completion/fish/guix.fish
|
||||
# SELinux policy
|
||||
nodist_selinux_policy_DATA = etc/guix-daemon.cil
|
||||
|
||||
+# AppArmor profiles.
|
||||
+nodist_apparmor_profile_DATA = \
|
||||
+ etc/apparmor.d/guix-daemon
|
||||
+
|
||||
+nodist_apparmor_profile_tunables_DATA = \
|
||||
+ etc/apparmor.d/tunables/guix
|
||||
+
|
||||
EXTRA_DIST += \
|
||||
.dir-locals.el \
|
||||
.guix-authorizations \
|
||||
diff --git a/configure.ac b/configure.ac
|
||||
index 92dede8014..73c7448758 100644
|
||||
--- a/configure.ac
|
||||
+++ b/configure.ac
|
||||
@@ -64,6 +64,15 @@ AC_ARG_WITH([selinux-policy-dir],
|
||||
[selinux_policydir='${datadir}/selinux/'])
|
||||
AC_SUBST([selinux_policydir])
|
||||
|
||||
+AC_ARG_WITH([apparmor-profile-dir],
|
||||
+ AS_HELP_STRING([--with-apparmor-profile-dir=DIR],
|
||||
+ [name of the AppArmor profile directory]),
|
||||
+ [apparmor_profiledir="$withval"],
|
||||
+ [apparmor_profiledir='${sysconfdir}/apparmor.d'])
|
||||
+AC_SUBST([apparmor_profiledir])
|
||||
+apparmor_profile_tunablesdir='${apparmor_profiledir}/tunables'
|
||||
+AC_SUBST([apparmor_profile_tunablesdir])
|
||||
+
|
||||
dnl Better be verbose.
|
||||
AC_MSG_CHECKING([for the store directory])
|
||||
AC_MSG_RESULT([$storedir])
|
||||
@@ -271,6 +280,7 @@ AC_CONFIG_FILES([Makefile
|
||||
po/guix/Makefile.in
|
||||
po/packages/Makefile.in
|
||||
etc/guix-daemon.cil
|
||||
+ etc/apparmor.d/tunables/guix
|
||||
guix/config.scm])
|
||||
|
||||
AC_CONFIG_FILES([etc/committer.scm], [chmod +x etc/committer.scm])
|
||||
diff --git a/doc/guix.texi b/doc/guix.texi
|
||||
index 784114f0bb..f0954f0d5d 100644
|
||||
--- a/doc/guix.texi
|
||||
+++ b/doc/guix.texi
|
||||
@@ -109,6 +109,7 @@ Copyright @copyright{} 2022 Reily Siegel@*
|
||||
Copyright @copyright{} 2022 Simon Streit@*
|
||||
Copyright @copyright{} 2022 (@*
|
||||
Copyright @copyright{} 2022 John Kehayias@*
|
||||
+Copyright @copyright{} 2025 Noé Lopez@*
|
||||
|
||||
Permission is granted to copy, distribute and/or modify this document
|
||||
under the terms of the GNU Free Documentation License, Version 1.3 or
|
||||
@@ -1137,6 +1138,7 @@ the daemon to download pre-built binaries.
|
||||
* Build Environment Setup:: Preparing the isolated build environment.
|
||||
* Daemon Offload Setup:: Offloading builds to remote machines.
|
||||
* SELinux Support:: Using an SELinux policy for the daemon.
|
||||
+* AppArmor Support:: Using an AppArmor profile for the daemon.
|
||||
@end menu
|
||||
|
||||
@node Build Environment Setup
|
||||
@@ -1593,6 +1595,43 @@ installation time whenever the Guix package that provides the
|
||||
effectively running @code{guix-daemon} executable is upgraded.
|
||||
@end enumerate
|
||||
|
||||
+@node AppArmor Support
|
||||
+@subsection AppArmor Support
|
||||
+
|
||||
+@cindex AppArmor
|
||||
+
|
||||
+Guix includes an AppArmor profile for the build daemon in
|
||||
+@file{etc/apparmor.d/guix-daemon} that can be installed on systems with
|
||||
+strict AppArmor policies to allow it to run unprivileged
|
||||
+(@pxref{Build Environment Setup}). Indeed, the unprivileged daemon makes
|
||||
+use of Linux user namespaces but these are disallowed
|
||||
+without an AppArmor policy on some systems like Ubuntu.
|
||||
+
|
||||
+To know if this applies to you, check if the
|
||||
+@code{kernel.apparmor_restrict_unprivileged_userns} kernel parameter is
|
||||
+enabled.
|
||||
+
|
||||
+@subsubsection Installing the AppArmor profile
|
||||
+@cindex AppArmor, profile installation
|
||||
+
|
||||
+@quotation Note
|
||||
+The @code{guix-install.sh} binary installation script offers to perform
|
||||
+the steps below for you (@pxref{Binary Installation}).
|
||||
+@end quotation
|
||||
+
|
||||
+Run these commands as root to install the profile:
|
||||
+
|
||||
+@example
|
||||
+export apparmor_sources=/var/guix/profiles/per-user/root/current-guix/etc/apparmor.d
|
||||
+cp -f -t /etc/apparmor.d/tunables "$apparmor_sources/tunables/guix"
|
||||
+cp -f -t /etc/apparmor.d "$apparmor_sources/guix-daemon"
|
||||
+cp -f -t /etc/apparmor.d "$apparmor_sources/guix"
|
||||
+apparmor_parser -r /etc/apparmor.d/guix-daemon
|
||||
+apparmor_parser -r /etc/apparmor.d/guix
|
||||
+@end example
|
||||
+
|
||||
+After this, the build daemon will be able to function correctly.
|
||||
+
|
||||
@node Invoking guix-daemon
|
||||
@section Invoking @command{guix-daemon}
|
||||
@cindex @command{guix-daemon}
|
||||
diff --git a/etc/apparmor.d/guix-daemon b/etc/apparmor.d/guix-daemon
|
||||
new file mode 100644
|
||||
index 0000000000..cb1ee92685
|
||||
--- /dev/null
|
||||
+++ b/etc/apparmor.d/guix-daemon
|
||||
@@ -0,0 +1,88 @@
|
||||
+abi <abi/4.0>,
|
||||
+
|
||||
+include <tunables/global>
|
||||
+include <tunables/guix>
|
||||
+
|
||||
+profile guix-daemon @{guix_storedir}/*-{guix-daemon,guix}-*/bin/guix-daemon flags=(enforce,attach_disconnected.path=/disconnected) {
|
||||
+ include <abstractions/base>
|
||||
+
|
||||
+ userns,
|
||||
+ signal,
|
||||
+ capability sys_admin,
|
||||
+ capability net_admin,
|
||||
+ capability sys_chroot,
|
||||
+ capability setgid,
|
||||
+ capability chown,
|
||||
+ network dgram,
|
||||
+ umount,
|
||||
+ mount,
|
||||
+ pivot_root,
|
||||
+ # Paths inside build chroot
|
||||
+ /real-root/ w,
|
||||
+ / w,
|
||||
+
|
||||
+ @{guix_localstatedir}/guix/** rwk,
|
||||
+ /var/log/guix/** w,
|
||||
+ owner @{PROC}/@{pid}/{fd/,environ} r,
|
||||
+ owner @{PROC}/@{pid}/oom_score_adj w,
|
||||
+ owner @{PROC}/@{pid}/uid_map rw,
|
||||
+ owner @{PROC}/@{pid}/gid_map rw,
|
||||
+ owner @{PROC}/@{pid}/setgroups w,
|
||||
+ @{guix_storedir}/ r,
|
||||
+ @{guix_storedir}/** rwlmk,
|
||||
+ @{guix_storedir}/*/bin/guile cx -> guix-builder,
|
||||
+ @{guix_storedir}/*-guix-command cx -> guix-helper,
|
||||
+ @{guix_storedir}/*-guix-*/bin/guix cx -> guix-helper,
|
||||
+ @{etc_rw}/nsswitch.conf r,
|
||||
+ @{etc_rw}/passwd r,
|
||||
+ @{etc_rw}/group r,
|
||||
+ owner /tmp/** rwl,
|
||||
+ owner /var/tmp/** rwl,
|
||||
+
|
||||
+ /usr/bin/newgidmap Ux,
|
||||
+
|
||||
+ # Site-specific additions and overrides. See local/README for details.
|
||||
+ include if exists <local/guix-daemon>
|
||||
+
|
||||
+ profile guix-builder flags=(enforce,attach_disconnected.path=/disconnected) {
|
||||
+ include <abstractions/base>
|
||||
+
|
||||
+ signal (receive),
|
||||
+
|
||||
+ @{guix_storedir}/** rwlmkux,
|
||||
+
|
||||
+ owner /tmp/** rw,
|
||||
+
|
||||
+ @{PROC}/@{pid}/fd/ r,
|
||||
+
|
||||
+ /disconnected/** rw,
|
||||
+ }
|
||||
+
|
||||
+ # This is for any time guix is called by the daemon as a helper:
|
||||
+ # - guix download
|
||||
+ # - guix discover
|
||||
+ # - guix gc --list-busy
|
||||
+ # - probably more?
|
||||
+ profile guix-helper flags=(enforce,attach_disconnected.path=/disconnected) {
|
||||
+ include <abstractions/base>
|
||||
+ include <abstractions/nameservice>
|
||||
+
|
||||
+ signal (receive),
|
||||
+ ptrace (read) peer=guix-daemon,
|
||||
+
|
||||
+ /disconnected/run/dbus/system_bus_socket rw,
|
||||
+ dbus (send, receive),
|
||||
+ @{guix_localstatedir}/guix/discover/ rw,
|
||||
+ @{guix_localstatedir}/guix/discover/* rw,
|
||||
+
|
||||
+ @{guix_localstatedir}/guix/substitute/ rw,
|
||||
+ @{guix_localstatedir}/guix/substitute/** rwk,
|
||||
+
|
||||
+ @{guix_sysconfdir}/guix/** r,
|
||||
+
|
||||
+ @{guix_storedir}/** rwlmix,
|
||||
+
|
||||
+ @{PROC}/ r,
|
||||
+ owner @{PROC}/@{pid}/{fd/,environ} r,
|
||||
+ }
|
||||
+}
|
||||
diff --git a/etc/apparmor.d/tunables/guix.in b/etc/apparmor.d/tunables/guix.in
|
||||
new file mode 100644
|
||||
index 0000000000..e93f7caeb7
|
||||
--- /dev/null
|
||||
+++ b/etc/apparmor.d/tunables/guix.in
|
||||
@@ -0,0 +1,5 @@
|
||||
+@{guix_storedir} = @storedir@
|
||||
+@{guix_sysconfdir} = @guix_sysconfdir@
|
||||
+@{guix_localstatedir} = @guix_localstatedir@
|
||||
+
|
||||
+include if exists <tunables/guix.d>
|
||||
\ No newline at end of file
|
||||
diff --git a/gnu/packages/package-management.scm b/gnu/packages/package-management.scm
|
||||
index 5a09b1fcf8..9f92e6fdaa 100644
|
||||
--- a/gnu/packages/package-management.scm
|
||||
+++ b/gnu/packages/package-management.scm
|
||||
@@ -199,6 +199,10 @@ (define-public guix
|
||||
(string-append "--with-bash-completion-dir="
|
||||
(assoc-ref %outputs "out")
|
||||
"/etc/bash_completion.d")
|
||||
+ ;; TODO: Uncomment after guix is updated.
|
||||
+ ;; (string-append "--with-apparmor-profile-dir="
|
||||
+ ;; (assoc-ref %outputs "out")
|
||||
+ ;; "/etc/apparmor.d")
|
||||
|
||||
;; Set 'DOT_USER_PROGRAM' to the empty string so
|
||||
;; we don't keep a reference to Graphviz, whose
|
||||
--
|
||||
2.43.0
|
||||
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
From 1de980051855bafb37d7e7df6e7d0e1739a46167 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?No=C3=A9=20Lopez?= <noelopez@free.fr>
|
||||
Date: Mon, 15 Dec 2025 01:03:36 +0100
|
||||
Subject: [PATCH 2/2] etc: Add AppArmor profile for the guix command.
|
||||
|
||||
* etc/apparmor.d/guix: New file.
|
||||
* Makefile.am (nodist_apparmor_profile_DATA): Add it.
|
||||
|
||||
Change-Id: I3d61238203d7663ce582717f8e4eac4c6f679928
|
||||
Signed-off-by: Rutherther <rutherther@ditigal.xyz>
|
||||
---
|
||||
Makefile.am | 1 +
|
||||
etc/apparmor.d/guix | 12 ++++++++++++
|
||||
2 files changed, 13 insertions(+)
|
||||
create mode 100644 etc/apparmor.d/guix
|
||||
|
||||
diff --git a/Makefile.am b/Makefile.am
|
||||
index b54b217416..a811d952c2 100644
|
||||
--- a/Makefile.am
|
||||
+++ b/Makefile.am
|
||||
@@ -662,6 +662,7 @@ nodist_selinux_policy_DATA = etc/guix-daemon.cil
|
||||
|
||||
# AppArmor profiles.
|
||||
nodist_apparmor_profile_DATA = \
|
||||
+ etc/apparmor.d/guix \
|
||||
etc/apparmor.d/guix-daemon
|
||||
|
||||
nodist_apparmor_profile_tunables_DATA = \
|
||||
diff --git a/etc/apparmor.d/guix b/etc/apparmor.d/guix
|
||||
new file mode 100644
|
||||
index 0000000000..f1442cf5d3
|
||||
--- /dev/null
|
||||
+++ b/etc/apparmor.d/guix
|
||||
@@ -0,0 +1,12 @@
|
||||
+abi <abi/4.0>,
|
||||
+
|
||||
+include <tunables/global>
|
||||
+include <tunables/guix>
|
||||
+
|
||||
+# There’s no point in confining the guix executable, since it can run
|
||||
+# any user code and so everything is expected. We just need to
|
||||
+# explicitely enable userns for systems with the
|
||||
+# kernel.apparmor_restrict_unprivileged_userns sysctl.
|
||||
+profile guix @{guix_storedir}/{*-guix-command,*-guix-*/bin/guix} flags=(unconfined) {
|
||||
+ userns,
|
||||
+}
|
||||
\ No newline at end of file
|
||||
--
|
||||
2.43.0
|
||||
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
From ee98e3a1ccc4d60daad48767e1466586f23521a3 Mon Sep 17 00:00:00 2001
|
||||
From: Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
|
||||
Date: Wed, 6 May 2026 07:41:12 +0200
|
||||
Subject: [PATCH] debian: build apparmor profile.
|
||||
|
||||
Signed-off-by: Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
|
||||
---
|
||||
debian/control | 1 +
|
||||
debian/rules | 2 ++
|
||||
2 files changed, 3 insertions(+)
|
||||
|
||||
diff --git a/debian/control b/debian/control
|
||||
index 242c44f9be..675ff59936 100644
|
||||
--- a/debian/control
|
||||
+++ b/debian/control
|
||||
@@ -4,6 +4,7 @@ Priority: optional
|
||||
Maintainer: Trisquel GNU/Linux developers <trisquel-devel@listas.trisquel.info>
|
||||
XSBC-Original-Maintainer: Vagrant Cascadian <vagrant@debian.org>
|
||||
Build-Depends: debhelper-compat (=13),
|
||||
+ dh-apparmor,
|
||||
gettext,
|
||||
# git and gnupg are used for tests/guix-build-branch.sh.
|
||||
git <!nocheck>,
|
||||
diff --git a/debian/rules b/debian/rules
|
||||
index 8a71f3cdea..8b9f71e7e6 100755
|
||||
--- a/debian/rules
|
||||
+++ b/debian/rules
|
||||
@@ -68,6 +68,8 @@ override_dh_install:
|
||||
printf ' (tag\n (guix import)\n )\n )\n )\n' >> debian/guix/etc/guix/acl
|
||||
rmdir debian/guix/usr/lib/*/systemd/system/
|
||||
rmdir debian/guix/usr/lib/*/systemd/
|
||||
+ dh_apparmor --profile-name=guix -pguix
|
||||
+ dh_apparmor --profile-name=guix-daemon -pguix
|
||||
|
||||
override_dh_auto_clean:
|
||||
dh_auto_clean
|
||||
--
|
||||
2.43.0
|
||||
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
diff --git a/debian/control b/debian/control
|
||||
index fb3d81f2..a8f07273 100644
|
||||
--- a/debian/control
|
||||
+++ b/debian/control
|
||||
@@ -57,6 +57,8 @@ Depends: plasma-framework,
|
||||
qml-module-org-kde-kopeninghours,
|
||||
qml-module-org-kde-kosmindoormap,
|
||||
qml-module-org-kde-kpublictransport,
|
||||
+ qml-module-org-kde-kirigami-addons-datetime,
|
||||
+ qml-module-org-kde-kirigami-addons-labs-mobileform,
|
||||
qml-module-org-kde-prison,
|
||||
qml-module-qt-labs-platform,
|
||||
qml-module-qt-labs-qmlmodels,
|
||||
65
helpers/DATA/kernel/apply_policies.py
Normal file
|
|
@ -0,0 +1,65 @@
|
|||
#!/usr/bin/env python3
|
||||
import sys
|
||||
import json
|
||||
import subprocess
|
||||
import os
|
||||
|
||||
def set_annotation(config, arch, flavour, value, annotations_file):
|
||||
"""Executes the Debian script to enforce a specific kernel configuration."""
|
||||
|
||||
cmd = [
|
||||
"python3",
|
||||
"debian/scripts/misc/annotations",
|
||||
"--file", annotations_file,
|
||||
"--arch", arch,
|
||||
"--flavour", flavour,
|
||||
"--config", config,
|
||||
"--write", value
|
||||
]
|
||||
|
||||
print(f"Setting {config} for {arch} ({flavour}) to '{value}'")
|
||||
|
||||
try:
|
||||
subprocess.run(cmd, check=True, stdout=subprocess.DEVNULL)
|
||||
except subprocess.CalledProcessError:
|
||||
print(f" [ERROR] Failed to apply {config} on {arch} ({flavour})", file=sys.stderr)
|
||||
|
||||
def main():
|
||||
# Fetch the environment variable exported by helper
|
||||
target_file = os.environ.get("KERNEL_CONFIG_ANNOTATIONS")
|
||||
|
||||
# Fail fast if the annotations file is not defined
|
||||
if not target_file:
|
||||
print("[FATAL ERROR] KERNEL_CONFIG_ANNOTATIONS environment variable is not set.", file=sys.stderr)
|
||||
print("Aborting to prevent modifying the wrong configuration file.", file=sys.stderr)
|
||||
sys.exit(1)
|
||||
|
||||
print(f"[INFO] Target annotations file: {target_file}")
|
||||
|
||||
# Read and parse the JSON policy from stdin
|
||||
try:
|
||||
policy_dict = json.load(sys.stdin)
|
||||
except json.JSONDecodeError as e:
|
||||
print(f"[FATAL ERROR] Invalid JSON policy format: {e}", file=sys.stderr)
|
||||
sys.exit(1)
|
||||
|
||||
# Process the nested dictionary
|
||||
for config, archs in policy_dict.items():
|
||||
for key, value in archs.items():
|
||||
|
||||
# Check if the key contains a flavour delimiter (e.g., "arm64/generic-64k")
|
||||
if "/" in key:
|
||||
arch, flavour = key.split("/", 1)
|
||||
set_annotation(config, arch, flavour, value, target_file)
|
||||
|
||||
# Backward compatibility for nested dicts (just in case)
|
||||
elif isinstance(value, dict):
|
||||
for flavour_nested, val_nested in value.items():
|
||||
set_annotation(config, key, flavour_nested, val_nested, target_file)
|
||||
|
||||
# If it's just a plain string without a slash, default to 'generic'
|
||||
else:
|
||||
set_annotation(config, key, "generic", value, target_file)
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
|
|
@ -0,0 +1,34 @@
|
|||
diff --git a/debian/control b/debian/control
|
||||
index b0f95119..073ece8e 100644
|
||||
--- a/debian/control
|
||||
+++ b/debian/control
|
||||
@@ -196,9 +196,7 @@ Build-Depends-Arch: at-spi2-core [amd64 arm64 armhf] <!nocheck>,
|
||||
poppler-data [amd64 arm64 armhf] <!nocheck>,
|
||||
pstoedit [amd64 arm64 armhf] <!nocheck>,
|
||||
python3-lxml [!ppc64el !riscv64 !s390x] <!nocheck !nopython>,
|
||||
- python3-pip [!ppc64el !riscv64 !s390x] <!nocheck !nopython>,
|
||||
python3-setuptools [!ppc64el !riscv64 !s390x] <!nocheck !nopython>,
|
||||
- python3-venv [!ppc64el !riscv64 !s390x] <!nocheck !nopython>,
|
||||
qt5-qmake,
|
||||
qtbase5-dev,
|
||||
qtbase5-dev-tools,
|
||||
diff --git a/pyuno/qa/pytests/testimports.py b/pyuno/qa/pytests/testimports.py
|
||||
index 29b14736..85ed1a53 100644
|
||||
--- a/pyuno/qa/pytests/testimports.py
|
||||
+++ b/pyuno/qa/pytests/testimports.py
|
||||
@@ -33,6 +33,7 @@ class ImportsTest(unittest.TestCase):
|
||||
print(str(ssl), file=devnull)
|
||||
|
||||
# tdf#162786: make sure importing pip works on all platforms
|
||||
+ @unittest.skip("Test disabled on Trisquel")
|
||||
def test_pip_import(self):
|
||||
import pip
|
||||
|
||||
@@ -40,6 +41,7 @@ class ImportsTest(unittest.TestCase):
|
||||
with open(os.devnull, "w") as devnull:
|
||||
print(str(pip), file=devnull)
|
||||
|
||||
+ @unittest.skip("Test disabled on Trisquel")
|
||||
def test_venv_import(self):
|
||||
import venv
|
||||
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
#
|
||||
# Place the names of udeb modules into this directory that require
|
||||
# runtime firmware.
|
||||
#
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
#
|
||||
# Place the names of udeb modules into this directory that require
|
||||
# runtime firmware.
|
||||
#
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
#
|
||||
# Place the names of udeb modules into this directory that require
|
||||
# runtime firmware.
|
||||
#
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
#
|
||||
# Place the names of udeb modules into this directory that require
|
||||
# runtime firmware.
|
||||
#
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
#
|
||||
# Place the names of udeb modules into this directory that require
|
||||
# runtime firmware.
|
||||
#
|
||||
|
|
@ -1 +0,0 @@
|
|||
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
#
|
||||
# Place the names of udeb modules into this directory that require
|
||||
# runtime firmware.
|
||||
#
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
#
|
||||
# Place the names of udeb modules into this directory that require
|
||||
# runtime firmware.
|
||||
#
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
#
|
||||
# Place the names of udeb modules into this directory that require
|
||||
# runtime firmware.
|
||||
#
|
||||
|
|
@ -1 +0,0 @@
|
|||
#include <nic-modules>
|
||||
|
|
@ -1 +0,0 @@
|
|||
|
||||
|
|
@ -10,6 +10,8 @@ arm64 - generic - - -
|
|||
|
||||
ppc64el - generic - - -
|
||||
|
||||
riscv64 - generic - - -
|
||||
|
||||
s390x - generic - - -
|
||||
|
||||
# Ports
|
||||
|
|
|
|||
|
|
@ -0,0 +1 @@
|
|||
affs
|
||||
|
|
@ -1 +0,0 @@
|
|||
#include <block-modules>
|
||||
|
|
@ -1 +0,0 @@
|
|||
#include <crc-modules>
|
||||
|
|
@ -1 +0,0 @@
|
|||
#include <floppy-modules>
|
||||
|
|
@ -1 +0,0 @@
|
|||
#include <fs-core-modules>
|
||||
|
|
@ -1 +0,0 @@
|
|||
#include <fs-secondary-modules>
|
||||
|
|
@ -1 +0,0 @@
|
|||
#include <message-modules>
|
||||
|
|
@ -1 +0,0 @@
|
|||
#include <mouse-modules>
|
||||
|
|
@ -1 +0,0 @@
|
|||
#include <nic-modules>
|
||||
|
|
@ -1 +0,0 @@
|
|||
#include <parport-modules>
|
||||
|
|
@ -1,2 +0,0 @@
|
|||
#include <scsi-modules>
|
||||
ipr ?
|
||||
|
|
@ -1 +0,0 @@
|
|||
#include <storage-core-modules>
|
||||
|
|
@ -1 +0,0 @@
|
|||
#include <virtio-modules>
|
||||
|
|
@ -1 +0,0 @@
|
|||
#include <vlan-modules>
|
||||
|
|
@ -0,0 +1,2 @@
|
|||
#include <ata-modules>
|
||||
|
||||
|
|
@ -1 +0,0 @@
|
|||
#include <block-modules>
|
||||
|
|
@ -0,0 +1 @@
|
|||
#include <btrfs-modules>
|
||||
|
|
@ -0,0 +1,2 @@
|
|||
#include <cdrom-core-modules>
|
||||
|
||||
|
|
@ -1 +0,0 @@
|
|||
#include <crc-modules>
|
||||
|
|
@ -0,0 +1 @@
|
|||
#include <crypto-dm-modules>
|
||||
|
|
@ -0,0 +1 @@
|
|||
#include <drm-core-modules>
|
||||
|
|
@ -0,0 +1 @@
|
|||
#include <ext4-modules>
|
||||
|
|
@ -0,0 +1 @@
|
|||
#include <f2fs-modules>
|
||||
|
|
@ -1 +1,2 @@
|
|||
#include <fat-modules>
|
||||
|
||||
|
|
|
|||
|
|
@ -2,4 +2,3 @@
|
|||
|
||||
vesafb ?
|
||||
vga16fb
|
||||
|
||||
|
|
|
|||
|
|
@ -1 +0,0 @@
|
|||
#include <floppy-modules>
|
||||
|
|
@ -1 +0,0 @@
|
|||
#include <fs-core-modules>
|
||||
|
|
@ -1 +0,0 @@
|
|||
#include <fs-secondary-modules>
|
||||
|
|
@ -1 +0,0 @@
|
|||
#include <i2c-modules>
|
||||
|
|
@ -1 +0,0 @@
|
|||
#include <ipmi-modules>
|
||||
|
|
@ -0,0 +1 @@
|
|||
#include <jfs-modules>
|
||||
|
|
@ -1 +1,18 @@
|
|||
#include <kernel-image>
|
||||
|
||||
# ACPI drivers
|
||||
fan
|
||||
thermal
|
||||
|
||||
# Optimised CRC32
|
||||
crc32_pclmul ?
|
||||
|
||||
# pmem drivers for UEFI HTTP boot
|
||||
nd_pmem
|
||||
nfit
|
||||
|
||||
# Intel pinctrl drivers
|
||||
drivers/pinctrl/intel/**
|
||||
|
||||
# SPI devices
|
||||
drivers/spi/**
|
||||
|
|
|
|||
|
|
@ -0,0 +1,2 @@
|
|||
#include <loop-modules>
|
||||
|
||||
|
|
@ -1 +1,2 @@
|
|||
#include <md-modules>
|
||||
|
||||
|
|
|
|||
|
|
@ -1 +0,0 @@
|
|||
#include <message-modules>
|
||||
|
|
@ -0,0 +1 @@
|
|||
#include <mmc-core-modules>
|
||||
|
|
@ -0,0 +1 @@
|
|||
#include <mmc-modules>
|
||||
|
|
@ -1 +0,0 @@
|
|||
#include <mouse-modules>
|
||||
|
|
@ -0,0 +1 @@
|
|||
#include <nbd-modules>
|
||||
|
|
@ -1 +0,0 @@
|
|||
#include <nfs-modules>
|
||||
|
|
@ -1 +0,0 @@
|
|||
#include <parport-modules>
|
||||
|
|
@ -1 +1,2 @@
|
|||
#include <pata-modules>
|
||||
|
||||
|
|
|
|||
|
|
@ -1 +0,0 @@
|
|||
#include <plip-modules>
|
||||
|
|
@ -1 +1,2 @@
|
|||
#include <ppp-modules>
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1 @@
|
|||
#include <rfkill-modules>
|
||||
|
|
@ -1,2 +1,3 @@
|
|||
#include <scsi-modules>
|
||||
ipr ?
|
||||
# To support nvme
|
||||
vmd
|
||||
|
|
|
|||
|
|
@ -0,0 +1 @@
|
|||
#include <scsi-nic-modules>
|
||||
|
|
@ -0,0 +1 @@
|
|||
#include <sound-modules>
|
||||
|
|
@ -0,0 +1 @@
|
|||
#include <squashfs-modules>
|
||||
|
|
@ -1 +0,0 @@
|
|||
#include <storage-core-modules>
|
||||
|
|
@ -0,0 +1 @@
|
|||
#include <udf-modules>
|
||||
|
|
@ -0,0 +1 @@
|
|||
#include <uinput-modules>
|
||||
|
|
@ -0,0 +1 @@
|
|||
#include <usb-serial-modules>
|
||||
|
|
@ -1 +1,2 @@
|
|||
#include <usb-storage-modules>
|
||||
|
||||
|
|
|
|||
|
|
@ -1 +0,0 @@
|
|||
#include <virtio-modules>
|
||||
|
|
@ -1 +0,0 @@
|
|||
#include <vlan-modules>
|
||||
|
|
@ -0,0 +1,2 @@
|
|||
#include <xfs-modules>
|
||||
|
||||
|
|
@ -0,0 +1,2 @@
|
|||
#include <ata-modules>
|
||||
|
||||
|
|
@ -1 +0,0 @@
|
|||
#include <block-modules>
|
||||
|
|
@ -0,0 +1 @@
|
|||
#include <btrfs-modules>
|
||||
|
|
@ -0,0 +1,2 @@
|
|||
#include <cdrom-core-modules>
|
||||
|
||||
|
|
@ -1 +0,0 @@
|
|||
#include <crc-modules>
|
||||
|
|
@ -0,0 +1 @@
|
|||
#include <crypto-dm-modules>
|
||||
|
|
@ -0,0 +1 @@
|
|||
#include <ext4-modules>
|
||||