Skip to content

thunderbird, thunderbird-bin: 68.10.0 -> 78.0 [High security fixes]#93227

Merged
vcunat merged 10 commits intoNixOS:masterfrom
taku0:thunderbird-bin-78.0
Aug 1, 2020
Merged

thunderbird, thunderbird-bin: 68.10.0 -> 78.0 [High security fixes]#93227
vcunat merged 10 commits intoNixOS:masterfrom
taku0:thunderbird-bin-78.0

Conversation

@taku0
Copy link
Contributor

@taku0 taku0 commented Jul 16, 2020 •
edited
Loading

Motivation for this change
  • High security fixes
  • Various updates

https://www.mozilla.org/en-US/security/advisories/mfsa2020-29/
https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.

@ofborg ofborg bot requested review from edolstra, lovesegfault and nbp July 16, 2020 06:58
@ofborg ofborg bot added 10.rebuild-darwin: 0 This PR does not cause any packages to rebuild on Darwin. 10.rebuild-linux: 1-10 This PR causes between 1 and 10 packages to rebuild on Linux. labels Jul 16, 2020
@vcunat vcunat changed the title thunderbird, thunderbird-bin: 68.9.0 -> 78.0 thunderbird, thunderbird-bin: 68.10.0 -> 78.0 Jul 16, 2020
@taku0 taku0 force-pushed the thunderbird-bin-78.0 branch from 06d00e3 to fd5e9c4 Compare July 16, 2020 09:57
@ofborg ofborg bot requested a review from lovek323 July 16, 2020 10:14
@ofborg ofborg bot added 10.rebuild-darwin: 501+ This PR causes many rebuilds on Darwin and should normally target the staging branches. 10.rebuild-darwin: 1001-2500 This PR causes many rebuilds on Darwin and should most likely target the staging branches. 10.rebuild-linux: 501+ This PR causes many rebuilds on Linux and should normally target the staging branches. 10.rebuild-linux: 5001+ This PR causes many rebuilds on Linux and must target the staging branches. and removed 10.rebuild-darwin: 0 This PR does not cause any packages to rebuild on Darwin. 10.rebuild-linux: 1-10 This PR causes between 1 and 10 packages to rebuild on Linux. labels Jul 16, 2020
@sugar700
Copy link
Member

sugar700 commented Jul 17, 2020 •
edited
Loading

Can we avoid backporting this at least until PGP support gets implemented (likely 78.2)? As release notes say "At this time, users of the Enigmail Add-on should not update to Thunderbird 78", and I personally depend on Enigmail.

@vcunat
Copy link
Member

vcunat commented Jul 17, 2020

I agree. AFAIK it doesn't auto-upgrade yet (e.g. the Windows version, I mean). I expect 68 will be supported and default at least until this stuff is resolved upstream.

@taku0 taku0 changed the title thunderbird, thunderbird-bin: 68.10.0 -> 78.0 thunderbird, thunderbird-bin: 68.10.0 -> 78.0 [High security fixes] Jul 18, 2020
@gebner gebner added the 1.severity: security Issues which raise a security issue, or PRs that fix one label Jul 24, 2020
@taku0 taku0 force-pushed the thunderbird-bin-78.0 branch from 1cead24 to 6b56880 Compare July 27, 2020 14:49
@ofborg ofborg bot added 8.has: package (new) This PR adds a new package 10.rebuild-darwin: 0 This PR does not cause any packages to rebuild on Darwin. 10.rebuild-linux: 1-10 This PR causes between 1 and 10 packages to rebuild on Linux. and removed 10.rebuild-darwin: 501+ This PR causes many rebuilds on Darwin and should normally target the staging branches. 10.rebuild-darwin: 1001-2500 This PR causes many rebuilds on Darwin and should most likely target the staging branches. 10.rebuild-linux: 501+ This PR causes many rebuilds on Linux and should normally target the staging branches. 10.rebuild-linux: 5001+ This PR causes many rebuilds on Linux and must target the staging branches. labels Jul 27, 2020
@taku0
Copy link
Contributor Author

taku0 commented Jul 27, 2020

Now expressions for both 68 (default) and 78 (with suffix) are available.

@taku0 taku0 marked this pull request as ready for review July 27, 2020 14:59
@mweinelt
Copy link
Member

mweinelt commented Jul 28, 2020

LGTM. Did a quick run-test on thunderbird-78.

Result of nixpkgs-review pr 93227 1

3 packages built:
- thunderbird
- thunderbird-78
- thunderbird-bin-78

vcunat
vcunat reviewed Jul 28, 2020
View reviewed changes
pkgs/applications/networking/mailreaders/thunderbird/default.nix Outdated
Copy link
Member

@vcunat vcunat Jul 28, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we mention somewhere why these options were removed? (in the commit message perhaps)

Copy link
Contributor Author

@taku0 taku0 Jul 29, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated the commit message.

Copy link
Member

@vcunat vcunat Aug 1, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

-icu was there twice. For the rest I can't see them referenced in the output, so I assume the flags being unsupported means that thunderbird now always bundles those dependencies :-/ I expect we should remove them from build inputs (some time).

taku0 added 4 commits July 29, 2020 12:14
@taku0
thunderbird: 68.9.0 -> 78.0
658b4d7 
- Updated the version and the source hash.
- Removed unsupported options.
- Updated the patch.
- Tweaked dependencies; 78 requires newer versions.
@taku0
thunderbird-bin: 78.0 -> 78.0.1
c9f781e
@taku0
thunderbird: 78.0 -> 78.0.1
5e20f9c
@taku0
thunderbird: make 68 as the default
379d978
@taku0 taku0 force-pushed the thunderbird-bin-78.0 branch from 70a326c to 379d978 Compare July 29, 2020 03:17
@ofborg ofborg bot requested a review from lovesegfault July 29, 2020 03:25
@taku0
Copy link
Contributor Author

taku0 commented Jul 30, 2020

Is Thunderbird 78.1 coming?

https://www.mozilla.org/en-US/security/advisories/mfsa2020-33/

@vcunat
Copy link
Member

vcunat commented Jul 30, 2020 •
edited
Loading

I saw it yesterday accidentally (when looking at NSS stuff), but I still can't see any release notes or tarballs even now.

@sugar700
Copy link
Member

sugar700 commented Jul 30, 2020

https://www.thunderbird.net/en-US/thunderbird/78.1.0/releasenotes/

@vcunat
Copy link
Member

vcunat commented Jul 30, 2020

Still not suitable for default.

At this time, users of the Enigmail Add-on should not update to Thunderbird 78.

OpenPGP in Thunderbird 78.1.0 has reached feature complete state, but it's still disabled by default, to allow more time for testing, correctness, and localization. See the wiki for how to enable and help with testing.

vcunat
vcunat approved these changes Aug 1, 2020
View reviewed changes
Copy link
Member

@vcunat vcunat left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Both seem to work for me, but so far I haven't been brave enough to start that enigmail migration wizard.

@vcunat vcunat merged commit 35ce100 into NixOS:master Aug 1, 2020
@vcunat
Copy link
Member

vcunat commented Aug 1, 2020

Well, one of the extensions I've been using isn't compatible, but such things aren't really a surprise.

@mweinelt
Copy link
Member

mweinelt commented Aug 1, 2020

I haven't been brave enough to start that enigmail migration wizard.

I have and it didn't work. Exported my private key and it's a 2048 bit RSA key, 260kB in size, I get an error when trying to import it manually.

Specifically I'm running into https://bugzilla.mozilla.org/show_bug.cgi?id=1654894.

@ShamrockLee
Copy link
Contributor

ShamrockLee commented Aug 7, 2020

FYI
thunderbird, thunderbird-bin: 68.10.0 -> 68.11.0, 78.1.0 -> 78.1.1 [High security fixes] #94863

@chvp chvp mentioned this pull request Sep 24, 2020
Merged
10 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vcunat vcunat vcunat approved these changes

@mweinelt mweinelt mweinelt approved these changes

@edolstra edolstra Awaiting requested review from edolstra

@nbp nbp Awaiting requested review from nbp

@lovek323 lovek323 Awaiting requested review from lovek323

@lovesegfault lovesegfault Awaiting requested review from lovesegfault

Assignees

No one assigned

Labels

1.severity: security Issues which raise a security issue, or PRs that fix one 8.has: package (new) This PR adds a new package 10.rebuild-darwin: 0 This PR does not cause any packages to rebuild on Darwin. 10.rebuild-linux: 1-10 This PR causes between 1 and 10 packages to rebuild on Linux.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

7 participants

@taku0 @sugar700 @vcunat @mweinelt @ShamrockLee @lovesegfault @gebner