Age | Commit message (Collapse) | Author | Files | Lines |
|
Firefox that functioned on NetBSD 8, but it's now so far gone, many
dependencies of this aren't compiling with the old toolchain and
userspace... Users of platforms like NetBSD 8 might have an easier
time using arcticfox instead.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
All checksums have been double-checked against existing RMD160 and
SHA512 hashes
Not committed (merge conflicts):
www/nghttp2/distinfo
Unfetchable distfiles (almost certainly fetched conditionally...):
./www/nginx-devel/distinfo array-var-nginx-module-0.05.tar.gz
./www/nginx-devel/distinfo echo-nginx-module-0.62.tar.gz
./www/nginx-devel/distinfo encrypted-session-nginx-module-0.08.tar.gz
./www/nginx-devel/distinfo form-input-nginx-module-0.12.tar.gz
./www/nginx-devel/distinfo headers-more-nginx-module-0.33.tar.gz
./www/nginx-devel/distinfo lua-nginx-module-0.10.19.tar.gz
./www/nginx-devel/distinfo naxsi-1.3.tar.gz
./www/nginx-devel/distinfo nginx-dav-ext-module-3.0.0.tar.gz
./www/nginx-devel/distinfo nginx-rtmp-module-1.2.2.tar.gz
./www/nginx-devel/distinfo nginx_http_push_module-1.2.10.tar.gz
./www/nginx-devel/distinfo ngx_cache_purge-2.5.1.tar.gz
./www/nginx-devel/distinfo ngx_devel_kit-0.3.1.tar.gz
./www/nginx-devel/distinfo ngx_http_geoip2_module-3.3.tar.gz
./www/nginx-devel/distinfo njs-0.5.0.tar.gz
./www/nginx-devel/distinfo set-misc-nginx-module-0.32.tar.gz
./www/nginx/distinfo array-var-nginx-module-0.05.tar.gz
./www/nginx/distinfo echo-nginx-module-0.62.tar.gz
./www/nginx/distinfo encrypted-session-nginx-module-0.08.tar.gz
./www/nginx/distinfo form-input-nginx-module-0.12.tar.gz
./www/nginx/distinfo headers-more-nginx-module-0.33.tar.gz
./www/nginx/distinfo lua-nginx-module-0.10.19.tar.gz
./www/nginx/distinfo naxsi-1.3.tar.gz
./www/nginx/distinfo nginx-dav-ext-module-3.0.0.tar.gz
./www/nginx/distinfo nginx-rtmp-module-1.2.2.tar.gz
./www/nginx/distinfo nginx_http_push_module-1.2.10.tar.gz
./www/nginx/distinfo ngx_cache_purge-2.5.1.tar.gz
./www/nginx/distinfo ngx_devel_kit-0.3.1.tar.gz
./www/nginx/distinfo ngx_http_geoip2_module-3.3.tar.gz
./www/nginx/distinfo njs-0.5.0.tar.gz
./www/nginx/distinfo set-misc-nginx-module-0.32.tar.gz
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
While here, note why this package is kept around.
|
|
|
|
|
|
Security Vulnerabilities fixed in Firefox ESR 68.12
#CVE-2020-15663: Downgrade attack on the Mozilla Maintenance Service could
have resulted in escalation of privilege
#CVE-2020-15664: Attacker-induced prompt for extension installation
#CVE-2020-15669: Use-After-Free when aborting an operation
|
|
|
|
|
|
This fixes the build with newer Rust, but probably also helps netbsd
releases which had the "dead lock detected" flakiness.
|
|
Security Vulnerabilities fixed in Firefox ESR 68.11
#CVE-2020-15652: Potential leak of redirect targets when loading scripts in
a worker
#CVE-2020-6514: WebRTC data channel leaks internal address to peer
#CVE-2020-6463: Use-after-free in ANGLE
gl::Texture::onUnbindAsSamplerTexture
#CVE-2020-15650: Overwriting local files through malicious file picker
application
#CVE-2020-15649: Exfiltrating local files through malicious file picker
application
#CVE-2020-15659: Memory safety bugs fixed in Firefox 79 and Firefox ESR
68.11
|
|
Makes them considerably less painful to use.
|
|
Based on patch submitted upstream:
https://github.com/mozilla/authenticator-rs/pull/116
Adapted lightly for firefox68 which had its own copy of an older
version of authenticator-rs.
|
|
For anyone curious about the delay: apparently, my ccache cache
was corrupted so the build was failing. *sigh* that won't be a problem
soon...
Security Vulnerabilities fixed in Firefox ESR 68.10
#CVE-2020-12417: Memory corruption due to missing sign-extension for
ValueTags on ARM64
#CVE-2020-12418: Information disclosure due to manipulated URL object
#CVE-2020-12419: Use-after-free in nsGlobalWindowInner
#CVE-2020-12420: Use-After-Free when trying to connect to a STUN server
#CVE-2020-12421: Add-On updates did not respect the same certificate trust
rules as software updates
|
|
|
|
|
|
please supply one bottle of club mate to nia alarie, london
|
|
thanks jperkin for the hint.
|
|
|
|
|
|
This was working around the lack of pshared semaphores on older NetBSD
releases, and restrictions on which process can destroy semaphores
on newer NetBSD releases.
However, we've switched to a new NetBSD-exclusive hack in www/firefox
where we force the use of the tiled rendering mode. This copies what
Firefox does on macOS, which has similar limitations on cross-process
semaphores. The discovery of this was a joint effort between maya
and me.
This avoids several bugs:
1) Multiprocess mode being outright broken on older NetBSD releases
2) Multiprocess mode leaking semaphores and eventually hitting open
file limits on newer NetBSD releases
Bump PKGREVISION
|
|
|
|
This allows rust-bin and rust to coexist in bulk builds (for testing, etc),
but the packages still may not be installed at the same time.
rust.mk as a solution for picking the correct rust variant was suggested
by gdt@. It is intended to be included directly by packages that do not
use cargo.mk, and indirectly by packages that do use cargo.mk.
rust.mk provides one user-settable variable:
RUST_TYPE
as before, whether to bootstrap rust from source or use
official binaries. may be "src" or "bin"
And two package-settable variables:
RUST_REQ
the minimum version of Rust required by the package.
defaults to "1.20.0"
RUST_RUNTIME
whether Rust is a runtime dependency, may be "yes" or "no"
|
|
|
|
Security Vulnerabilities fixed in Firefox ESR 68.9
#CVE-2020-12399: Timing attack on DSA signatures in NSS library
#CVE-2020-12405: Use-after-free in SharedWorkerService
#CVE-2020-12406: JavaScript Type confusion with NativeTypes
#CVE-2020-12410: Memory safety bugs fixed in Firefox 77 and Firefox ESR 68.9
|
|
|
|
Security Vulnerabilities fixed in Firefox ESR 68.8
#CVE-2020-12387: Use-after-free during worker shutdown
#CVE-2020-12388: Sandbox escape with improperly guarded Access Tokens
#CVE-2020-12389: Sandbox escape with improperly separated process types
#CVE-2020-6831: Buffer overflow in SCTP chunk input validation
#CVE-2020-12392: Arbitrary local file access with 'Copy as cURL'
#CVE-2020-12393: Devtools' 'Copy as cURL' feature did not fully escape
website-controlled data, potentially leading to command injection
#CVE-2020-12395: Memory safety bugs fixed in Firefox 76 and Firefox ESR 68.8
|
|
Otherwise configure gets confused if SHELL happens to be unset in
the environment, e.g. if you always do builds with `env -i
PATH=/bin:/usr/bin:$PREFIX/bin bmake ...'.
|