Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

thunderbird, thunderbird-bin: 68.10.0 -> 78.0 [High security fixes] #93227

Merged
merged 10 commits into from Aug 1, 2020
Merged

thunderbird, thunderbird-bin: 68.10.0 -> 78.0 [High security fixes] #93227

merged 10 commits into from Aug 1, 2020

Conversation

taku0
Copy link
Contributor

@taku0 taku0 commented Jul 16, 2020 •
edited

Motivation for this change
  • High security fixes
  • Various updates

https://www.mozilla.org/en-US/security/advisories/mfsa2020-29/
https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.

@ofborg ofborg bot requested review from edolstra, lovesegfault and nbp July 16, 2020 06:58
@vcunat vcunat changed the title thunderbird, thunderbird-bin: 68.9.0 -> 78.0 thunderbird, thunderbird-bin: 68.10.0 -> 78.0 Jul 16, 2020
@ofborg ofborg bot requested a review from lovek323 July 16, 2020 10:14
@KamilaBorowska
Copy link
Member

KamilaBorowska commented Jul 17, 2020 •
edited

Can we avoid backporting this at least until PGP support gets implemented (likely 78.2)? As release notes say "At this time, users of the Enigmail Add-on should not update to Thunderbird 78", and I personally depend on Enigmail.

@vcunat
Copy link
Member

vcunat commented Jul 17, 2020

I agree. AFAIK it doesn't auto-upgrade yet (e.g. the Windows version, I mean). I expect 68 will be supported and default at least until this stuff is resolved upstream.

@taku0 taku0 changed the title thunderbird, thunderbird-bin: 68.10.0 -> 78.0 thunderbird, thunderbird-bin: 68.10.0 -> 78.0 [High security fixes] Jul 18, 2020
@taku0
Copy link
Contributor Author

taku0 commented Jul 27, 2020

Now expressions for both 68 (default) and 78 (with suffix) are available.

@taku0 taku0 marked this pull request as ready for review July 27, 2020 14:59
@mweinelt
Copy link
Member

LGTM. Did a quick run-test on thunderbird-78.

Result of nixpkgs-review pr 93227 1

3 packages built:
- thunderbird
- thunderbird-78
- thunderbird-bin-78

vcunat
vcunat reviewed Jul 28, 2020
View reviewed changes
pkgs/applications/networking/mailreaders/thunderbird/default.nix

"--disable-gconf"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we mention somewhere why these options were removed? (in the commit message perhaps)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated the commit message.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

-icu was there twice. For the rest I can't see them referenced in the output, so I assume the flags being unsupported means that thunderbird now always bundles those dependencies :-/ I expect we should remove them from build inputs (some time).

@taku0
thunderbird: 68.9.0 -> 78.0
658b4d7 
- Updated the version and the source hash.
- Removed unsupported options.
- Updated the patch.
- Tweaked dependencies; 78 requires newer versions.
@taku0
thunderbird-bin: 78.0 -> 78.0.1
c9f781e
@taku0
thunderbird: 78.0 -> 78.0.1
5e20f9c
@taku0
thunderbird: make 68 as the default
379d978
@ofborg ofborg bot requested a review from lovesegfault July 29, 2020 03:25
@taku0
Copy link
Contributor Author

taku0 commented Jul 30, 2020

Is Thunderbird 78.1 coming?

https://www.mozilla.org/en-US/security/advisories/mfsa2020-33/

@vcunat
Copy link
Member

vcunat commented Jul 30, 2020 •
edited

I saw it yesterday accidentally (when looking at NSS stuff), but I still can't see any release notes or tarballs even now.

@KamilaBorowska
Copy link
Member

https://www.thunderbird.net/en-US/thunderbird/78.1.0/releasenotes/

@vcunat
Copy link
Member

vcunat commented Jul 30, 2020

Still not suitable for default.

At this time, users of the Enigmail Add-on should not update to Thunderbird 78.

OpenPGP in Thunderbird 78.1.0 has reached feature complete state, but it's still disabled by default, to allow more time for testing, correctness, and localization. See the wiki for how to enable and help with testing.

vcunat
vcunat approved these changes Aug 1, 2020
View reviewed changes
Copy link
Member

@vcunat vcunat left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Both seem to work for me, but so far I haven't been brave enough to start that enigmail migration wizard.

@vcunat vcunat merged commit 35ce100 into NixOS:master Aug 1, 2020
@vcunat
Copy link
Member

vcunat commented Aug 1, 2020

Well, one of the extensions I've been using isn't compatible, but such things aren't really a surprise.

@mweinelt
Copy link
Member

mweinelt commented Aug 1, 2020

I haven't been brave enough to start that enigmail migration wizard.

I have and it didn't work. Exported my private key and it's a 2048 bit RSA key, 260kB in size, I get an error when trying to import it manually.

Specifically I'm running into https://bugzilla.mozilla.org/show_bug.cgi?id=1654894.

@ShamrockLee
Copy link
Contributor

FYI
thunderbird, thunderbird-bin: 68.10.0 -> 68.11.0, 78.1.0 -> 78.1.1 [High security fixes] #94863

@chvp chvp mentioned this pull request Sep 24, 2020
Merged
10 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@vcunat vcunat vcunat approved these changes

@mweinelt mweinelt mweinelt approved these changes

@edolstra edolstra Awaiting requested review from edolstra

@nbp nbp Awaiting requested review from nbp

@lovek323 lovek323 Awaiting requested review from lovek323

@lovesegfault lovesegfault Awaiting requested review from lovesegfault

Assignees
No one assigned
Labels
1.severity: security 8.has: package (new) 10.rebuild-darwin: 0 10.rebuild-linux: 1-10
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
7 participants
@taku0 @KamilaBorowska @vcunat @mweinelt @ShamrockLee @lovesegfault @gebner