Firefox nix addon support #91724

Qubasa · 2020-06-28T14:18:13Z

Motivation for this change

This pull request comes with a bunch of things.
First and foremost you can now add addons to firefox which are pinned to a specific version.
If you remove the addon from your nix config it will also be removed from every firefox profile.
If you change the version of the addon in the configuration it also updates the versions in every profile.
This was terribly difficult to get to work!

The second thing that has been added is a global config for Firefox settings that can't be changed by the user in the respective Firefox profile.

This is the overhauled version of: #74297

Example usage:

{ config, pkgs, ... }:

let
  fetchfirefoxaddon=callPackage ./modules/fetchfirefoxaddon {};
  callPackage = pkgs.lib.callPackageWith (pkgs);
  wrapper = pkgs.callPackage ./overlays/wrapper.nix { fx_cast_bridge=pkgs.unstable.pkgs.fx_cast_bridge; };

  hardenedFirefox= wrapper pkgs.firefox-unwrapped {
    extraExtensions = [
      (fetchfirefoxaddon {
        name = "ublock";
        url = "https://addons.mozilla.org/firefox/downloads/file/3679754/ublock_origin-1.31.0-an+fx.xpi";
        sha256 = "1h768ljlh3pi23l27qp961v1hd0nbj2vasgy11bmcrlqp40zgvnr";
      })
      (fetchfirefoxaddon {
         name = "https-everywhere";
         url = "https://addons.mozilla.org/firefox/downloads/file/3574076/https_everywhere-2020.5.20-an+fx.xpi?src=search";
         sha256 = "10wjimk9wrdfja6f73pppm7pmb1jl838p7siwh4vzlw1sjszr57c";
       })
       (fetchfirefoxaddon {
         name = "certificate-pinner";
         url = "https://addons.mozilla.org/firefox/downloads/file/3599612/certificate_pinner-0.17.10-an+fx.xpi";
         sha256 = "15qyjqca252pf28vv636fwya28pj3nnbywpkpm6cwmj1m64pmdsl";
       })
    ];

    extraPolicies = {
      CaptivePortal = false;
      DisableFirefoxStudies = true;
      DisablePocket = true;
      DisableTelemetry = true;
      DisableFirefoxAccounts = true;
      FirefoxHome = {
        Pocket = false;
        Snippets = false;
      };
       UserMessaging = {
         ExtensionRecommendations = false;
         SkipOnboarding = true;
       };
    };

    extraPrefs = ''
      // Show more ssl cert infos
      lockPref("security.identityblock.show_extended_validation", true);

      // Enable userchrome css
      lockPref("toolkit.legacyUserProfileCustomizations.stylesheets", true);

      // Enable dark dev tools
      lockPref("devtools.theme","dark");
    '';

    gdkWayland = true;
  };

in {

environment.variables = {
  BROWSER = ["firefox"];
};

environment.systemPackages = with pkgs; [
  # firefox
  hardenedFirefox
];

}

Things done

@Lassulus

pkgs/applications/networking/browsers/firefox/wrapper.nix

eyJhb · 2020-07-17T08:52:05Z

I am all in, for being able to customize Firefox even more, but I have a feeling that this is more of a home-manager thing, as it would be lovely to be able to configure pr. profle, instead of globally.

Ideally, we should support these things:

Globally pr. machine like above
Pr. user (already a switch - https://bugzilla.mozilla.org/show_bug.cgi?id=1583466 )
Pr. profile, which would allow users to have multiple profiles, with different settings (requires patching Firefox)

I think we should try to achieve all these, with the least amount of hacks, and working WITH Firefox/Mozilla in this case.
This means by utilizing policies.json 100% for extensions install, etc.

Mic92 · 2020-07-17T09:17:33Z

To summarize our mumble discussion. I suggest to move the firefox extension code to its builder that allows to override a build phases rather than passing in data. However @luis-hebendanz does not want to implement that, so if someone else wants to pick it up, go for it.

Qubasa · 2020-07-18T20:23:03Z

I am all in, for being able to customize Firefox even more, but I have a feeling that this is more of a home-manager thing, as it would be lovely to be able to configure pr. profle, instead of globally.

Ideally, we should support these things:
1. Globally pr. machine like above

2. Pr. user (already a switch - https://bugzilla.mozilla.org/show_bug.cgi?id=1583466 )

3. Pr. profile, which would allow users to have multiple profiles, with different settings (requires patching Firefox)
I think we should try to achieve all these, with the least amount of hacks, and working WITH Firefox/Mozilla in this case.
This means by utilizing policies.json 100% for extensions install, etc.

I strongly disagree to make this a home manager thing. Organizations want to deploy specific configs of Firefox to employees, the current method ensures complete immutability in this regard, home-manager can not guarantee that. Installation of addons can only be done through the policies.json since the newer Firefox versions which means home-manager can't do that. The policies.json are already used 100% for installing the addons in this pull request.
Patching Firefox for multi user profiles is neat but completely out of scope, at least for this pull request.
Also the chrome addon manager in NixOS also works globally.

eyJhb · 2020-07-18T20:28:13Z

Well, actually because of a patch here - https://bugzilla.mozilla.org/show_bug.cgi?id=1583466, it is actually possible to do pr. user policies.json.

But, a thing that might change this whole thin, if we are only going for policies.json here, is to use /etc/firefox/policies/policies.jsonas documented here - https://github.com/mozilla/policy-templates , which does not require a rebuild or anything. And could be a module on its own.
But I am unsure, if that is the goal :)

Also, supporting both would be nice, but I see the pro in both!

Mic92 · 2020-07-19T10:20:40Z

Well, actually because of a patch here - bugzilla.mozilla.org/show_bug.cgi?id=1583466, it is actually possible to do pr. user policies.json.

But, a thing that might change this whole thin, if we are only going for policies.json here, is to use /etc/firefox/policies/policies.jsonas documented here - mozilla/policy-templates , which does not require a rebuild or anything. And could be a module on its own.
But I am unsure, if that is the goal :)

Also, supporting both would be nice, but I see the pro in both!

It could be a simple symlink to the package in that case.

Qubasa · 2020-11-30T15:43:00Z

@Mic92 I added a builder called fetchfirefoxaddon, I also updated my first comment above with an example how to use it now.
Quick overview:

 extraExtensions = [
      (fetchfirefoxaddon {
        name = "ublock";
        url = "https://addons.mozilla.org/firefox/downloads/file/3679754/ublock_origin-1.31.0-an+fx.xpi";
        sha256 = "1h768ljlh3pi23l27qp961v1hd0nbj2vasgy11bmcrlqp40zgvnr";
      })
]

pkgs/applications/networking/browsers/firefox/wrapper.nix

pkgs/top-level/all-packages.nix

Co-authored-by: Jörg Thalheim <Mic92@users.noreply.github.com>

doc/builders/packages/firefox.section.md

eyJhb · 2020-12-03T09:03:28Z

Is extensions for Firefox something we want to cover in Nixpkgs?

EDIT: as in having nixpkgs.firefoxExtensions.ublock

Atemu · 2020-12-03T09:09:12Z

They're some of the most security critical and most used programs, I think packaging them would be a good idea.

Mic92 · 2020-12-03T09:28:24Z

They're some of the most security critical and most used programs, I think packaging them would be a good idea.

I am only a bit concerned that they get out of date on stable channels. Also on unstable they would be a automatic update mechanism required.

eyJhb · 2020-12-03T09:33:50Z

That is also my main concern, as channels can hang for a while.

I know that @rycee has a job on Gitlab that automatically updates the Firefox addons that you can use with home-manager ( https://gitlab.com/rycee/nur-expressions/-/tree/master/pkgs/firefox-addons )

Maybe they could be placed in the community repo? Even though that seems like a hacked solution.

PS: Also this might be a separate issue for discussion?

Mic92 · 2020-12-03T09:49:38Z

Yeah. Having a firefox-addon repo sounds like a great idea.

Atemu · 2020-12-03T10:55:47Z

automatic update mechanism required.

If we updated them automatically anyways, backporting to stable would be trivial.

eyJhb · 2020-12-03T11:03:11Z

Created a discussion here - #105783

Mic92 · 2020-12-03T11:32:44Z

automatic update mechanism required.

If we updated them automatically anyways, backporting to stable would be trivial.

Backporting is still some amount of work that could be avoided if both stable/unstable users could use a repo independent from nixpkgs.

edolstra · 2020-12-03T13:48:02Z

pkgs/applications/networking/browsers/firefox/wrapper.nix

+      };
+
+      mozillaCfg = builtins.toFile "mozilla.cfg" ''
+// First line must be a comment


This looks indented incorrectly.

Its not because toFile does not strip tabs away and this file format needs a comment without spaces at the beginning

@luis-hebendanz: toFile only takes strings, the stripping is caused by ''...''. I don't however see any tab characters involved here. Checking this quickly via nix repl results in:

nix-repl> builtins.readFile (builtins.toFile "mozilla.cfg" '' // First line must be a comment // Disables addon signature checking // to be able to install addons that do not have an extid // Security is maintained because only user whitelisted addons // with a checksum can be installed lockPref("xpinstall.signatures.required", false); ... '') "// First line must be a comment\n\n// Disables addon signature checking\n// to be able to install addons that do not have an extid\n// Security is maintained because only user whitelisted addons\n// with a checksum can be installed\nlockPref(\"xpinstall.signatures.required\", false);\n...\n" nix-repl>

taku0 · 2020-12-03T14:10:45Z

Should we have an option to disable the policy, and disable the policy by default? If this patch is merged to the stable, existing users will lose their installed add-ons. It is not an ideal experience.

Qubasa · 2020-12-03T14:51:32Z

I opened up a fix here #105796

nixos-discourse · 2021-12-09T19:22:41Z

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/some-applications-firefox-mousepad-do-not-open-anymore-with-my-settings-but-as-first-time-opened-after-nightly-nixos-update-using-unstable-channel/16489/3

ofborg bot added 10.rebuild-darwin: 0 10.rebuild-linux: 1-10 labels Jun 28, 2020

Qubasa requested a review from ttuegel June 28, 2020 14:26

Mic92 reviewed Jun 28, 2020

View reviewed changes

pkgs/applications/networking/browsers/firefox/wrapper.nix Outdated Show resolved Hide resolved

Mic92 reviewed Jun 28, 2020

View reviewed changes

pkgs/applications/networking/browsers/firefox/wrapper.nix Outdated Show resolved Hide resolved

Mic92 reviewed Jun 28, 2020

View reviewed changes

pkgs/applications/networking/browsers/firefox/wrapper.nix Outdated Show resolved Hide resolved

ofborg bot added the 6.topic: fetch label Nov 30, 2020

Qubasa requested a review from Mic92 November 30, 2020 15:40

Qubasa mentioned this pull request Dec 1, 2020

Firefox with extensions and global config #74297

Closed

9 tasks

Mic92 reviewed Dec 1, 2020

View reviewed changes

pkgs/applications/networking/browsers/firefox/wrapper.nix Outdated Show resolved Hide resolved

Mic92 reviewed Dec 2, 2020

View reviewed changes

pkgs/top-level/all-packages.nix Outdated Show resolved Hide resolved

Qubasa and others added 6 commits December 2, 2020 09:40

Adding nix firefox extension support

eedee46

Added fetchfirefoxaddon

397597f

Added missing sha1 and sha512 flags

5f8eca5

Update pkgs/applications/networking/browsers/firefox/wrapper.nix

cc42167

Co-authored-by: Jörg Thalheim <Mic92@users.noreply.github.com>

fetchFirefoxAddon: rename to use camelCase

b89c0fc

firefoxaddon: formatting nitpicks

9712bbd

Mic92 force-pushed the firefox-nix-addon-support branch from d4033c7 to 22f4948 Compare December 2, 2020 09:02

doc/firefox: initial documentation

7c8994e

Mic92 force-pushed the firefox-nix-addon-support branch from 22f4948 to 7c8994e Compare December 2, 2020 09:02

Mic92 reviewed Dec 2, 2020

View reviewed changes

doc/builders/packages/firefox.section.md Show resolved Hide resolved

ofborg bot added 8.has: documentation 2.status: merge conflict labels Dec 2, 2020

Merge branch 'master' into firefox-nix-addon-support

3cd6bc1

ofborg bot removed the 2.status: merge conflict label Dec 3, 2020

Mic92 merged commit c0a87f4 into NixOS:master Dec 3, 2020

This was referenced Dec 3, 2020

firefox: add firefox-policies w/ patch #94898

Closed

WIP: Firefox policies w/ extensions integration nix-community/home-manager#1436

Closed

This was referenced Dec 3, 2020

WIP: firefox/wrapper.nix: make firefox wrapper configurable by the user #57554

Closed

Firefox configurable #58195

Closed

Qubasa deleted the firefox-nix-addon-support branch December 3, 2020 10:55

eyJhb mentioned this pull request Dec 3, 2020

Firefox extensions discussion #105783

Open

edolstra reviewed Dec 3, 2020

View reviewed changes

Qubasa mentioned this pull request Dec 3, 2020

Fix firefox wrapper #105796

Merged

10 tasks

cmm mentioned this pull request Dec 4, 2020

firefox removed all my add-ons #105885

Closed

mtreca mentioned this pull request Dec 4, 2020

Firefox module handling changed upstream nix-community/home-manager#1641

Open

ryneeverett mentioned this pull request Dec 4, 2020

firefox: Prefix $PATH with xdg_utils #105894

Merged

10 tasks

doronbehar mentioned this pull request Dec 7, 2020

Firefox won't let me install add-ons. Now what? #105987

Closed

leo60228 mentioned this pull request May 5, 2021

firefox: use policies.json to install extensions nix-community/home-manager#1434

Closed

7 tasks

YoshiRulz mentioned this pull request Jun 30, 2023

Packaging firefox extensions #15959

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Firefox nix addon support #91724

Firefox nix addon support #91724

Qubasa commented Jun 28, 2020 •

edited

eyJhb commented Jul 17, 2020

Mic92 commented Jul 17, 2020

Qubasa commented Jul 18, 2020 •

edited

eyJhb commented Jul 18, 2020

Mic92 commented Jul 19, 2020

Qubasa commented Nov 30, 2020

eyJhb commented Dec 3, 2020 •

edited

Atemu commented Dec 3, 2020

Mic92 commented Dec 3, 2020

eyJhb commented Dec 3, 2020

Mic92 commented Dec 3, 2020

Atemu commented Dec 3, 2020

eyJhb commented Dec 3, 2020

Mic92 commented Dec 3, 2020

edolstra Dec 3, 2020

Qubasa Dec 3, 2020

aszlig Dec 4, 2020

taku0 commented Dec 3, 2020 •

edited

Qubasa commented Dec 3, 2020

nixos-discourse commented Dec 9, 2021

Firefox nix addon support #91724

Firefox nix addon support #91724

Conversation

Qubasa commented Jun 28, 2020 • edited

Motivation for this change

Things done

eyJhb commented Jul 17, 2020

Mic92 commented Jul 17, 2020

Qubasa commented Jul 18, 2020 • edited

eyJhb commented Jul 18, 2020

Mic92 commented Jul 19, 2020

Qubasa commented Nov 30, 2020

eyJhb commented Dec 3, 2020 • edited

Atemu commented Dec 3, 2020

Mic92 commented Dec 3, 2020

eyJhb commented Dec 3, 2020

Mic92 commented Dec 3, 2020

Atemu commented Dec 3, 2020

eyJhb commented Dec 3, 2020

Mic92 commented Dec 3, 2020

edolstra Dec 3, 2020

Choose a reason for hiding this comment

Qubasa Dec 3, 2020

Choose a reason for hiding this comment

aszlig Dec 4, 2020

Choose a reason for hiding this comment

taku0 commented Dec 3, 2020 • edited

Qubasa commented Dec 3, 2020

nixos-discourse commented Dec 9, 2021

Qubasa commented Jun 28, 2020 •

edited

Qubasa commented Jul 18, 2020 •

edited

eyJhb commented Dec 3, 2020 •

edited

taku0 commented Dec 3, 2020 •

edited