@sylvestre: I think we would better get explicit permission for Thunderbird as well.

Could we perhaps get permission from @sylvestre or @garbas?

Build options: https://github.com/nixos/nixpkgs/blob/18.03/pkgs/applications/networking/mailreaders/thunderbird/default.nix#L55

No patches are currently being applied.

Would it be possible to decrease a bit the list of specific configure option?
Like --disable-pulseaudio, nss, nspr, necko-wifi, disable-tests?

OK! I'll open a separate pull request that removes --disable-pulseaudio, --disable-tests, --disable-necko-wifi, and --disable-alsa, test that, and ask you to re-evaluate when it gets merged.

On --with-system-nss: it would be preferable to leave it as is because we apply some patches on top of NSS. Generally, NixOS uses system libraries and not ones that are bundled with the package.

please keep disable-alsa.
In general, please do like Firefox on Debian is doing (including using nss).

I know distro like to use system libraries (I am a debian developer myself) but we (Mozilla) prefer to have the exact library... especially with security libs like nss.

please keep disable-alsa.

ALSA is off by default, so the switch has no effect. Excerpt from mozilla/old-configure.in found in the release tarball:

MOZ_ARG_ENABLE_BOOL(alsa,
[  --enable-alsa          Enable Alsa support],
   MOZ_ALSA=1,
   MOZ_ALSA=)

if test -n "$MOZ_ALSA"; then
    PKG_CHECK_MODULES(MOZ_ALSA, alsa, ,
         [echo "$MOZ_ALSA_PKG_ERRORS"
          AC_MSG_ERROR([Need alsa for audio output on Linux. (On Ubuntu, you might try installing the package libasound2-dev.)])])
fi

AC_SUBST(MOZ_ALSA)

In general, please do like Firefox on Debian is doing (including using nss).

My idea was to base flags on mozconfig found in Thunderbird packages on Debian and Fedora. I will also check mozconfig for Firefox on Debian :-)

I know distro like to use system libraries (I am a debian developer myself) but we (Mozilla) prefer to have the exact library... especially with security libs like nss.

We have the following out-of-tree patch for NSS: https://github.com/NixOS/nixpkgs/blob/18.03/pkgs/development/libraries/nss/85_security_load.patch
As I understand, this patch fixes CA root certificate discovery on NixOS. We carry that patch at least from 2012, so it seems it's not upstreamable. It would be hard to keep up with patching and rebasing this for every app whenever NSS bundled with it is bumped.

It makes sense to bundle all libraries on Debian, where stable packages may be dated, but NixOS is a bleeding-edge distro. Security-related updates are strongly prioritized. And if we update NSS system-wide, all Gecko-based applications can benefit from this, and we don't have to go and bump every and each one of them (which is also error-prone, and depends on upstream cutting a new release).

And in Firefox package (now with official branding, thanks to you!) we also use system NSS and NSPR, the only Firefox-based browser exempt from this is Tor, because they have out-of-tree patches to NSS: https://github.com/NixOS/nixpkgs/blob/18.03/pkgs/applications/networking/browsers/firefox/common.nix#L160

Hope that's reasonable.

Thunderbird might need to play sound on certain actions (sending mail, archiving, receiving new mail). There are addons that add more sounds, like ToneQuilla.

PulseAudio is the configuration supported by upstream.

Superseded by #55026.