From 48d59208fcbf06c8b02164bc6e17a4ed14a4f3a5 Mon Sep 17 00:00:00 2001
From: Tomas Volf <~@wolfsden.cz>
Date: Tue, 19 Mar 2024 15:49:03 +0100
Subject: nongnu: firefox: Update to 124.0 [security fixes].

Fixes CVE-2023-5388, CVE-2024-2605, CVE-2024-2606, CVE-2024-2607,
CVE-2024-2608, CVE-2024-2609, CVE-2024-2610, CVE-2024-2611,
CVE-2024-2612, CVE-2024-2613, CVE-2024-2614, CVE-2024-2615.

* nongnu/packages/mozilla.scm (firefox): Update to 124.0.
[arguments]<#:phases>{'remove-cargo-frozen-flag}: New phase.
(firefox-wayland): Wrap comment.

Signed-off-by: Jonathan Brielmaier <jonathan.brielmaier@web.de>
---
 nongnu/packages/mozilla.scm | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

(limited to 'nongnu/packages')

diff --git a/nongnu/packages/mozilla.scm b/nongnu/packages/mozilla.scm
index bc2b286..8260e3f 100644
--- a/nongnu/packages/mozilla.scm
+++ b/nongnu/packages/mozilla.scm
@@ -532,27 +532,34 @@ MOZ_ENABLE_WAYLAND=1 exec ~a $@\n"
 
 ;; Update this id with every firefox update to its release date.
 ;; It's used for cache validation and therefore can lead to strange bugs.
-(define %firefox-build-id "20240304165820")
+(define %firefox-build-id "20240318140215")
 
 (define-public firefox
   (package
     (inherit firefox-esr)
     (name "firefox")
-    (version "123.0.1")
+    (version "124.0")
     (source
      (origin
        (method url-fetch)
        (uri (string-append "https://archive.mozilla.org/pub/firefox/releases/"
                            version "/source/firefox-" version ".source.tar.xz"))
        (sha256
-        (base32 "073lbl2gs7c08kr9h6r2jvl3cvj84h3pdh6aj151c3synravkp6m"))))
+        (base32 "1n692gfy61j4f3y81lyk16nm5gs8x84szadlrp70in1s28si4nil"))))
     (arguments
      (substitute-keyword-arguments (package-arguments firefox-esr)
        ((#:phases phases)
         #~(modify-phases #$phases
             (replace 'set-build-id
               (lambda _
-                (setenv "MOZ_BUILD_DATE" #$%firefox-build-id)))))))
+                (setenv "MOZ_BUILD_DATE" #$%firefox-build-id)))
+            (replace 'remove-cargo-frozen-flag
+              (lambda _
+                ;; Remove --frozen flag from cargo invokation, otherwise it'll
+                ;; complain that it's not able to change Cargo.lock.
+                ;; https://bugzilla.mozilla.org/show_bug.cgi?id=1726373
+                (substitute* "build/RunCbindgen.py"
+                  (("args.append\\(\"--frozen\"\\)") "pass"))))))))
     (native-inputs
      (modify-inputs (package-native-inputs firefox-esr)
        (replace "rust" rust-firefox)
@@ -562,7 +569,7 @@ MOZ_ENABLE_WAYLAND=1 exec ~a $@\n"
      "Full-featured browser client built from Firefox source tree, without
 the official icon and the name \"firefox\".")))
 
-;; As of Firefox 121.0, Firefox uses Wayland by default. This means we no longer need a seperate package
-;; for Firefox on Wayland.
+;; As of Firefox 121.0, Firefox uses Wayland by default. This means we no
+;; longer need a seperate package for Firefox on Wayland.
 (define-public firefox-wayland
   (deprecated-package "firefox-wayland" firefox))
-- 
cgit v1.2.3