Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1908791 - Filter out bundled libraries provides
Summary: Filter out bundled libraries provides
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: firefox
Version: rawhide
Hardware: Unspecified
OS: Unspecified
unspecified
urgent
Target Milestone: ---
Assignee: Gecko Maintainer
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
: 1909386 1909801 1922935 (view as bug list)
Depends On:
Blocks: F34FinalBlocker 1908905 1908951
TreeView+ depends on / blocked
 
Reported: 2020-12-17 16:11 UTC by Vít Ondruch
Modified: 2021-02-01 10:57 UTC (History)
23 users (show)

Fixed In Version: firefox-84.0-7.fc34
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1908792 (view as bug list)
Environment:
Last Closed: 2021-02-01 10:41:22 UTC
Type: Bug
Embargoed:
mhroncok: fedora_prioritized_bug?


Attachments (Terms of Use)

Description Vít Ondruch 2020-12-17 16:11:05 UTC
Description of problem:

FF should not provide the bundled libraries. See for comparison:

~~~
$ rpm -qPp https://kojipkgs.fedoraproject.org//packages/firefox/83.0/14.fc34/x86_64/firefox-83.0-14.fc34.x86_64.rpm
application()
application(firefox.desktop)
firefox = 83.0-14.fc34
firefox(x86-64) = 83.0-14.fc34
libclearkey.so()(64bit)
liblgpllibs.so()(64bit)
libmozavcodec.so()(64bit)
libmozavcodec.so(libmozavcodec.so)(64bit)
libmozavutil.so()(64bit)
libmozavutil.so(libmozavutil.so)(64bit)
libmozgtk.so()(64bit)
libmozsandbox.so()(64bit)
libmozsqlite3.so()(64bit)
libmozsqlite3.so(libmozsqlite3.so)(64bit)
libmozwayland.so()(64bit)
libxul.so()(64bit)
libxul.so(xul83)(64bit)
metainfo()
metainfo(firefox.appdata.xml)
mimehandler(application/vnd.mozilla.xul+xml)
mimehandler(application/xhtml+xml)
mimehandler(text/html)
mimehandler(text/mml)
mimehandler(text/xml)
mimehandler(x-scheme-handler/http)
mimehandler(x-scheme-handler/https)
webclient

$ rpm -qPp https://kojipkgs.fedoraproject.org//packages/firefox/84.0/6.fc34/x86_64/firefox-84.0-6.fc34.x86_64.rpm
application()
application(firefox.desktop)
firefox = 84.0-6.fc34
firefox(x86-64) = 84.0-6.fc34
libclearkey.so()(64bit)
libfreeblpriv3.so()(64bit)
libfreeblpriv3.so(NSSprivate_3.11)(64bit)
libfreeblpriv3.so(NSSprivate_3.16)(64bit)
liblgpllibs.so()(64bit)
libmozavcodec.so()(64bit)
libmozavcodec.so(libmozavcodec.so)(64bit)
libmozavutil.so()(64bit)
libmozavutil.so(libmozavutil.so)(64bit)
libmozgtk.so()(64bit)
libmozsandbox.so()(64bit)
libmozsqlite3.so()(64bit)
libmozsqlite3.so(libmozsqlite3.so)(64bit)
libmozwayland.so()(64bit)
libnspr4.so()(64bit)
libnss3.so()(64bit)
libnss3.so(NSS_3.10)(64bit)
libnss3.so(NSS_3.10.2)(64bit)
libnss3.so(NSS_3.11)(64bit)
libnss3.so(NSS_3.11.1)(64bit)
libnss3.so(NSS_3.11.2)(64bit)
libnss3.so(NSS_3.11.7)(64bit)
libnss3.so(NSS_3.11.9)(64bit)
libnss3.so(NSS_3.12)(64bit)
libnss3.so(NSS_3.12.1)(64bit)
libnss3.so(NSS_3.12.10)(64bit)
libnss3.so(NSS_3.12.3)(64bit)
libnss3.so(NSS_3.12.4)(64bit)
libnss3.so(NSS_3.12.5)(64bit)
libnss3.so(NSS_3.12.6)(64bit)
libnss3.so(NSS_3.12.7)(64bit)
libnss3.so(NSS_3.12.9)(64bit)
libnss3.so(NSS_3.13)(64bit)
libnss3.so(NSS_3.13.2)(64bit)
libnss3.so(NSS_3.14)(64bit)
libnss3.so(NSS_3.14.1)(64bit)
libnss3.so(NSS_3.14.3)(64bit)
libnss3.so(NSS_3.15)(64bit)
libnss3.so(NSS_3.15.4)(64bit)
libnss3.so(NSS_3.16.1)(64bit)
libnss3.so(NSS_3.16.2)(64bit)
libnss3.so(NSS_3.18)(64bit)
libnss3.so(NSS_3.19)(64bit)
libnss3.so(NSS_3.19.1)(64bit)
libnss3.so(NSS_3.2)(64bit)
libnss3.so(NSS_3.2.1)(64bit)
libnss3.so(NSS_3.21)(64bit)
libnss3.so(NSS_3.22)(64bit)
libnss3.so(NSS_3.3)(64bit)
libnss3.so(NSS_3.3.1)(64bit)
libnss3.so(NSS_3.30)(64bit)
libnss3.so(NSS_3.31)(64bit)
libnss3.so(NSS_3.33)(64bit)
libnss3.so(NSS_3.34)(64bit)
libnss3.so(NSS_3.39)(64bit)
libnss3.so(NSS_3.4)(64bit)
libnss3.so(NSS_3.43)(64bit)
libnss3.so(NSS_3.44)(64bit)
libnss3.so(NSS_3.45)(64bit)
libnss3.so(NSS_3.47)(64bit)
libnss3.so(NSS_3.5)(64bit)
libnss3.so(NSS_3.52)(64bit)
libnss3.so(NSS_3.53)(64bit)
libnss3.so(NSS_3.55)(64bit)
libnss3.so(NSS_3.58)(64bit)
libnss3.so(NSS_3.59)(64bit)
libnss3.so(NSS_3.6)(64bit)
libnss3.so(NSS_3.7)(64bit)
libnss3.so(NSS_3.7.1)(64bit)
libnss3.so(NSS_3.8)(64bit)
libnss3.so(NSS_3.9)(64bit)
libnss3.so(NSS_3.9.2)(64bit)
libnss3.so(NSS_3.9.3)(64bit)
libnssutil3.so()(64bit)
libnssutil3.so(NSSUTIL_3.12)(64bit)
libnssutil3.so(NSSUTIL_3.12.3)(64bit)
libnssutil3.so(NSSUTIL_3.12.5)(64bit)
libnssutil3.so(NSSUTIL_3.12.7)(64bit)
libnssutil3.so(NSSUTIL_3.13)(64bit)
libnssutil3.so(NSSUTIL_3.14)(64bit)
libnssutil3.so(NSSUTIL_3.15)(64bit)
libnssutil3.so(NSSUTIL_3.17.1)(64bit)
libnssutil3.so(NSSUTIL_3.21)(64bit)
libnssutil3.so(NSSUTIL_3.24)(64bit)
libnssutil3.so(NSSUTIL_3.25)(64bit)
libnssutil3.so(NSSUTIL_3.31)(64bit)
libnssutil3.so(NSSUTIL_3.33)(64bit)
libnssutil3.so(NSSUTIL_3.38)(64bit)
libnssutil3.so(NSSUTIL_3.39)(64bit)
libnssutil3.so(NSSUTIL_3.59)(64bit)
libplc4.so()(64bit)
libplds4.so()(64bit)
libsmime3.so()(64bit)
libsmime3.so(NSS_3.10)(64bit)
libsmime3.so(NSS_3.12.10)(64bit)
libsmime3.so(NSS_3.12.2)(64bit)
libsmime3.so(NSS_3.13)(64bit)
libsmime3.so(NSS_3.15)(64bit)
libsmime3.so(NSS_3.16)(64bit)
libsmime3.so(NSS_3.18)(64bit)
libsmime3.so(NSS_3.2)(64bit)
libsmime3.so(NSS_3.2.1)(64bit)
libsmime3.so(NSS_3.3)(64bit)
libsmime3.so(NSS_3.4)(64bit)
libsmime3.so(NSS_3.4.1)(64bit)
libsmime3.so(NSS_3.6)(64bit)
libsmime3.so(NSS_3.7)(64bit)
libsmime3.so(NSS_3.7.2)(64bit)
libsmime3.so(NSS_3.8)(64bit)
libsmime3.so(NSS_3.9)(64bit)
libsmime3.so(NSS_3.9.3)(64bit)
libsoftokn3.so()(64bit)
libsoftokn3.so(NSS_3.4)(64bit)
libsoftokn3.so(NSS_3.52)(64bit)
libssl3.so()(64bit)
libssl3.so(NSS_3.11.4)(64bit)
libssl3.so(NSS_3.11.8)(64bit)
libssl3.so(NSS_3.12.10)(64bit)
libssl3.so(NSS_3.12.6)(64bit)
libssl3.so(NSS_3.13)(64bit)
libssl3.so(NSS_3.13.2)(64bit)
libssl3.so(NSS_3.14)(64bit)
libssl3.so(NSS_3.15)(64bit)
libssl3.so(NSS_3.15.4)(64bit)
libssl3.so(NSS_3.2)(64bit)
libssl3.so(NSS_3.2.1)(64bit)
libssl3.so(NSS_3.20)(64bit)
libssl3.so(NSS_3.21)(64bit)
libssl3.so(NSS_3.22)(64bit)
libssl3.so(NSS_3.23)(64bit)
libssl3.so(NSS_3.24)(64bit)
libssl3.so(NSS_3.27)(64bit)
libssl3.so(NSS_3.28)(64bit)
libssl3.so(NSS_3.30)(64bit)
libssl3.so(NSS_3.30.0.1)(64bit)
libssl3.so(NSS_3.33)(64bit)
libssl3.so(NSS_3.4)(64bit)
libssl3.so(NSS_3.7.4)(64bit)
libxul.so()(64bit)
libxul.so(xul84)(64bit)
metainfo()
metainfo(firefox.appdata.xml)
mimehandler(application/vnd.mozilla.xul+xml)
mimehandler(application/xhtml+xml)
mimehandler(text/html)
mimehandler(text/mml)
mimehandler(text/xml)
mimehandler(x-scheme-handler/http)
mimehandler(x-scheme-handler/https)
webclient
~~~

Version-Release number of selected component (if applicable):
firefox-84.0-6.fc34.x86_64


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:
Provides for bundled libraries are generated, shadowing system libraries.

Expected results:
Provides for bundled libraries are not generated.

Additional info:

Comment 1 Petr Pisar 2020-12-18 07:58:35 UTC
This prevents other packages from building, e.g. <https://koji.fedoraproject.org/koji/taskinfo?taskID=57697515>:

pdfinfo: error while loading shared libraries: libsmime3.so: cannot open shared object file: No such file or directory
"pdfinfo" unexpectedly returned exit value 127 at t/1112_save_pdf_with_locale.t line 44.

Comment 2 Marek Kašík 2020-12-18 13:43:40 UTC
The same here: https://koji.fedoraproject.org/koji/taskinfo?taskID=57680585

/usr/bin/ld: warning: libsmime3.so, needed by /usr/lib64/libpoppler.so.101, not found (try using -rpath or -rpath-link)
/usr/bin/ld: warning: libnss3.so, needed by /usr/lib64/libpoppler.so.101, not found (try using -rpath or -rpath-link)
/usr/bin/ld: warning: libnspr4.so, needed by /usr/lib64/libpoppler.so.101, not found (try using -rpath or -rpath-link)

Comment 3 Miro Hrončok 2020-12-19 16:10:02 UTC
*** Bug 1909386 has been marked as a duplicate of this bug. ***

Comment 4 Miro Hrončok 2020-12-19 16:12:07 UTC
Also, inkscape is broken now (bz1909386).

inkscape: error while loading shared libraries: libsmime3.so: cannot open shared object file: No such file or directory

Comment 6 Miro Hrončok 2020-12-20 19:13:20 UTC
(In reply to Miro Hrončok from comment #5)
> https://src.fedoraproject.org/rpms/firefox/pull-request/22

I'd appreciate another packager to review my PR.


In the meantime, trying to figure out if downgrading gcc can solve the armv7hl build failure.

Comment 7 Miro Hrončok 2020-12-21 01:05:04 UTC
(In reply to Miro Hrončok from comment #6)
> In the meantime, trying to figure out if downgrading gcc can solve the
> armv7hl build failure.

I've tagged:

glib2-2.67.0-7.fc34
langpacks-3.0-5.fc34
libfido2-1.5.0-3.fc34
clang-11.0.1-1.rc1.fc34
zstd-1.4.5-6.fc34
gcc-11.0.0-0.7.fc34
annobin-9.52-2.fc34

Into f34-build-side-35227 and the scratch build seem to go past the failure: https://koji.fedoraproject.org/koji/taskinfo?taskID=57897561

I need to leave now, but in case another provenpackager gets to it, please merge https://src.fedoraproject.org/rpms/firefox/pull-request/22 and build it in f34-build-side-35227 if the above scratch build passes.

Comment 8 Miro Hrončok 2020-12-21 12:03:52 UTC
Task info: https://koji.fedoraproject.org/koji/taskinfo?taskID=57943607

Comment 9 Adam Williamson 2020-12-21 17:45:38 UTC
*** Bug 1909801 has been marked as a duplicate of this bug. ***

Comment 10 Adam Williamson 2020-12-21 17:47:17 UTC
See https://bugzilla.redhat.com/show_bug.cgi?id=1909801#c1 for blocker justification (that bug turns out to be caused by Firefox satisfying the libnss deps of libfprint, but not actually providing the libraries in a way it can use).

Comment 11 Fedora Update System 2020-12-21 18:37:37 UTC
FEDORA-2020-77631a1fea has been pushed to the Fedora 34 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 12 Martin Stransky 2020-12-22 10:31:47 UTC
I can't install the fixed packages, it prints:

error: Failed dependencies:
	libmozavutil.so()(64bit) is needed by firefox-84.0.1-1.npgo.fc33.x86_64
	libmozavutil.so(libmozavutil.so)(64bit) is needed by firefox-84.0.1-1.npgo.fc33.x86_64
	libxul.so(xul84)(64bit) is needed by firefox-84.0.1-1.npgo.fc33.x86_64

the same results are from f34 packages.

Comment 13 Vít Ondruch 2020-12-22 10:33:21 UTC
(In reply to Martin Stransky from comment #12)
I can confirm this issue:

~~~
$ sudo dnf install https://kojipkgs.fedoraproject.org//packages/firefox/84.0/7.fc34/x86_64/firefox-84.0-7.fc34.x86_64.rpm
Last metadata expiration check: 3:06:12 ago on Tue Dec 22 08:24:42 2020.
Error: 
 Problem: package firefox-84.0-7.fc34.x86_64 requires libxul.so(xul84)(64bit), but none of the providers can be installed
  - cannot install both firefox-84.0-7.fc34.x86_64 and firefox-84.0-6.fc34.x86_64
  - conflicting requests
(try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages)
~~~

As well as Koschei:

https://koschei.fedoraproject.org/package/rubygem-selenium-webdriver?collection=f34

Comment 14 Martin Stransky 2020-12-22 10:35:49 UTC
Reverted at 84.0.1-1

Comment 15 Miro Hrončok 2020-12-22 10:45:21 UTC
Sorry for breaking firefox. I guess this is still a bit better than everything else broken, so before you revert, please consider how to fix this.

Comment 16 Miro Hrončok 2020-12-22 10:47:17 UTC
Also note that this: https://src.fedoraproject.org/rpms/firefox/c/b66e1288c5ee707349cee8606fcaf21d9a0e03de?branch=master does not work as a revert, because the macro expands.

Comment 17 Miro Hrončok 2020-12-22 10:56:06 UTC
Here is my attempted fix: https://src.fedoraproject.org/rpms/firefox/pull-request/23

This time, I'll double check it installs.

Comment 18 Miro Hrončok 2020-12-22 11:03:32 UTC
About my error in judgement:

I have verified that firefox does not require the removed provides before I merged, but I have tested on the previous firefox build. Apparently, rpm removes self-satisfied requires automatically, so when I filtered the provides, it started to require them :(

--- firefox_requires_old	2020-12-22 12:00:13.513805334 +0100
+++ firefox_requires_new	2020-12-22 12:00:01.747752088 +0100
@@ -41,13 +41,78 @@
 libgtk-3.so.0()(64bit)
 libgtk-x11-2.0.so.0()(64bit)
 libharfbuzz.so.0()(64bit)
+liblgpllibs.so()(64bit)
 libm.so.6()(64bit)
 libm.so.6(GLIBC_2.2.5)(64bit)
 libm.so.6(GLIBC_2.27)(64bit)
 libm.so.6(GLIBC_2.29)(64bit)
+libmozavutil.so()(64bit)
+libmozavutil.so(libmozavutil.so)(64bit)
+libmozgtk.so()(64bit)
+libmozsandbox.so()(64bit)
+libmozsqlite3.so()(64bit)
+libmozsqlite3.so(libmozsqlite3.so)(64bit)
+libmozwayland.so()(64bit)
+libnspr4.so()(64bit)
+libnss3.so()(64bit)
+libnss3.so(NSS_3.10)(64bit)
+libnss3.so(NSS_3.10.2)(64bit)
+libnss3.so(NSS_3.11)(64bit)
+libnss3.so(NSS_3.11.1)(64bit)
+libnss3.so(NSS_3.11.2)(64bit)
+libnss3.so(NSS_3.12)(64bit)
+libnss3.so(NSS_3.12.3)(64bit)
+libnss3.so(NSS_3.12.4)(64bit)
+libnss3.so(NSS_3.12.5)(64bit)
+libnss3.so(NSS_3.12.6)(64bit)
+libnss3.so(NSS_3.13)(64bit)
+libnss3.so(NSS_3.13.2)(64bit)
+libnss3.so(NSS_3.14)(64bit)
+libnss3.so(NSS_3.14.3)(64bit)
+libnss3.so(NSS_3.15)(64bit)
+libnss3.so(NSS_3.16.1)(64bit)
+libnss3.so(NSS_3.16.2)(64bit)
+libnss3.so(NSS_3.19)(64bit)
+libnss3.so(NSS_3.19.1)(64bit)
+libnss3.so(NSS_3.2)(64bit)
+libnss3.so(NSS_3.21)(64bit)
+libnss3.so(NSS_3.22)(64bit)
+libnss3.so(NSS_3.3)(64bit)
+libnss3.so(NSS_3.3.1)(64bit)
+libnss3.so(NSS_3.30)(64bit)
+libnss3.so(NSS_3.4)(64bit)
+libnss3.so(NSS_3.44)(64bit)
+libnss3.so(NSS_3.45)(64bit)
+libnss3.so(NSS_3.47)(64bit)
+libnss3.so(NSS_3.5)(64bit)
+libnss3.so(NSS_3.52)(64bit)
+libnss3.so(NSS_3.55)(64bit)
+libnss3.so(NSS_3.58)(64bit)
+libnss3.so(NSS_3.6)(64bit)
+libnss3.so(NSS_3.7)(64bit)
+libnss3.so(NSS_3.8)(64bit)
+libnss3.so(NSS_3.9)(64bit)
+libnss3.so(NSS_3.9.2)(64bit)
+libnss3.so(NSS_3.9.3)(64bit)
+libnssutil3.so()(64bit)
+libnssutil3.so(NSSUTIL_3.12)(64bit)
+libnssutil3.so(NSSUTIL_3.12.3)(64bit)
+libnssutil3.so(NSSUTIL_3.12.5)(64bit)
+libnssutil3.so(NSSUTIL_3.13)(64bit)
+libnssutil3.so(NSSUTIL_3.14)(64bit)
+libnssutil3.so(NSSUTIL_3.15)(64bit)
+libnssutil3.so(NSSUTIL_3.17.1)(64bit)
+libnssutil3.so(NSSUTIL_3.21)(64bit)
+libnssutil3.so(NSSUTIL_3.24)(64bit)
+libnssutil3.so(NSSUTIL_3.31)(64bit)
+libnssutil3.so(NSSUTIL_3.38)(64bit)
+libnssutil3.so(NSSUTIL_3.39)(64bit)
+libnssutil3.so(NSSUTIL_3.59)(64bit)
 libpango-1.0.so.0()(64bit)
 libpangocairo-1.0.so.0()(64bit)
 libpangoft2-1.0.so.0()(64bit)
+libplc4.so()(64bit)
+libplds4.so()(64bit)
 libpthread.so.0()(64bit)
 libpthread.so.0(GLIBC_2.12)(64bit)
 libpthread.so.0(GLIBC_2.2.5)(64bit)
@@ -55,6 +120,27 @@
 libpthread.so.0(GLIBC_2.3.3)(64bit)
 librt.so.1()(64bit)
 librt.so.1(GLIBC_2.2.5)(64bit)
+libsmime3.so()(64bit)
+libsmime3.so(NSS_3.13)(64bit)
+libsmime3.so(NSS_3.16)(64bit)
+libsmime3.so(NSS_3.2)(64bit)
+libsmime3.so(NSS_3.4)(64bit)
+libssl3.so()(64bit)
+libssl3.so(NSS_3.12.6)(64bit)
+libssl3.so(NSS_3.13)(64bit)
+libssl3.so(NSS_3.13.2)(64bit)
+libssl3.so(NSS_3.14)(64bit)
+libssl3.so(NSS_3.15)(64bit)
+libssl3.so(NSS_3.15.4)(64bit)
+libssl3.so(NSS_3.2)(64bit)
+libssl3.so(NSS_3.21)(64bit)
+libssl3.so(NSS_3.22)(64bit)
+libssl3.so(NSS_3.23)(64bit)
+libssl3.so(NSS_3.27)(64bit)
+libssl3.so(NSS_3.28)(64bit)
+libssl3.so(NSS_3.30.0.1)(64bit)
+libssl3.so(NSS_3.33)(64bit)
+libssl3.so(NSS_3.4)(64bit)
 libstdc++.so.6()(64bit)
 libstdc++.so.6(CXXABI_1.3)(64bit)
 libstdc++.so.6(CXXABI_1.3.5)(64bit)
@@ -71,6 +157,8 @@
 libstdc++.so.6(GLIBCXX_3.4.9)(64bit)
 libxcb-shm.so.0()(64bit)
 libxcb.so.1()(64bit)
+libxul.so()(64bit)
+libxul.so(xul84)(64bit)
 libz.so.1()(64bit)
 libz.so.1(ZLIB_1.2.0)(64bit)
 libz.so.1(ZLIB_1.2.3.4)(64bit)

Comment 19 Vít Ondruch 2020-12-22 11:14:42 UTC
(In reply to Miro Hrončok from comment #15)
> Sorry for breaking firefox. I guess this is still a bit better than
> everything else broken, so before you revert, please consider how to fix
> this.

Can't agree more. If FF is broken, so be it, but FF breaking everything else is unacceptable.

BTW in icecat, there were attempts such as:

https://src.fedoraproject.org/rpms/icecat/c/a6aae13bc5af882087bd583fa70e6ed6e2e9be45?branch=master

Not sure why Antonio backed out.

Comment 20 Martin Stransky 2020-12-22 13:21:36 UTC
Long time ago (Firefox 2.0) we used a scrip to filter out the dependencies. Not sure what happened to it, it used:

%define __find_provides add-gecko-provides
%define __find_requires find-external-requires


add-gecko-provides.in:

#!/bin/sh
#
# Use the internal provides generator"
#
filelist=`sed "s/[]['\"*?{}]/\\\\\&/g"`
provides=`echo $filelist | /usr/lib/rpm/find-provides`
echo $provides

#
# Now output the stuff we want to add
#
core_files=`echo $filelist | grep "libxpcom\.so" | wc -l`
devel_files=`echo $filelist | grep "firefox\-xpcom\.pc" | wc -l`
debug_files=`echo $filelist | grep "libxpcom\.so\.debug" | wc -l`
if [ $debug_files -eq 0 ]; then
  if [ $devel_files -gt 0 ]; then
    echo "gecko-devel = @GECKO_VERSION@"
  elif [ $core_files -gt 0 ]; then
    echo "gecko-libs = @GECKO_VERSION@"
  fi
fi


find-external-requires:

#!/bin/sh
# Finds requirements provided outside of the current file set

filelist=`sed "s/[]['\"*?{}]/\\\\\&/g"`

provides=`echo $filelist | /usr/lib/rpm/find-provides`

{
for f in $filelist ; do
        echo $f | /usr/lib/rpm/find-requires | while read req ; do
                found=0
                for p in $provides ; do
                        if [ "$req" = "$p" ]; then
                                found=1
                        fi
                done
                if [ "$found" = "0" ]; then
                        echo $req
                fi
        done
done
} | sort -u

Comment 21 Martin Stransky 2020-12-22 13:23:04 UTC
btw. This is from git revision 795983ff16b967821039d9253012be3b05e7439c

Comment 22 Vít Ondruch 2020-12-22 13:53:52 UTC
(In reply to Martin Stransky from comment #20)
> %define __find_provides add-gecko-provides
> %define __find_requires find-external-requires

These are old style generators AFAIK. They couldbe used together with `_use_internal_dependency_generator`, but that is not good idea these days. The PR proposed in comment 17 does similar job IMO.

Comment 23 Antonio T. sagitter 2020-12-22 14:39:17 UTC
(In reply to Vít Ondruch from comment #19)
> (In reply to Miro Hrončok from comment #15)
> > Sorry for breaking firefox. I guess this is still a bit better than
> > everything else broken, so before you revert, please consider how to fix
> > this.
> 
> Can't agree more. If FF is broken, so be it, but FF breaking everything else
> is unacceptable.
> 
> BTW in icecat, there were attempts such as:
> 
> https://src.fedoraproject.org/rpms/icecat/c/
> a6aae13bc5af882087bd583fa70e6ed6e2e9be45?branch=master
> 
> Not sure why Antonio backed out.

Because of https://bugzilla.redhat.com/show_bug.cgi?id=1908018#c17

I did not understand yet if using Firefox bundled NSS libraries is safe to use or not.

Comment 24 Miro Hrončok 2020-12-22 18:01:17 UTC
I see my change was reverted, but this bug remains not fixed. Please don't ship this, it breaks a lot of packages.

On rawhide, arm won't build (see my previous comments), so at least there's that. If nss is also bundled in previous Fedora releases, this should not reach our users.

Comment 25 Mohan Boddu 2020-12-22 18:04:24 UTC
We need a fix for this as rawhide is breaking because of this https://pagure.io/releng/failed-composes/issue/2141, I can see there is a new build with reverted commit, but according to comment 16 it might not work.

Comment 26 Adam Williamson 2020-12-22 20:29:21 UTC
Could we please just go back to building against system nss, but allow SHA-1 signatures? That would be the correct thing to do anyway. https://bugzilla.redhat.com/show_bug.cgi?id=1908018#c17 explained how to do that.

Comment 27 Vít Ondruch 2020-12-23 08:56:18 UTC
(In reply to Antonio T. sagitter from comment #23)
> Because of https://bugzilla.redhat.com/show_bug.cgi?id=1908018#c17
> 
> I did not understand yet if using Firefox bundled NSS libraries is safe to
> use or not.

Ah, right. Using bundled libraries is definitely not good idea generally and this is even worse case since NSS should follow system security policies.

However, bundling is one issue, the other issue is when the bundled libraries leaks to the whole system and this is precisely this case. That means that not only the FF/icecat were not following the policies but the whole system would not follow the security policies.

Comment 28 Martin Stransky 2020-12-23 09:36:54 UTC
(In reply to Adam Williamson from comment #26)
> Could we please just go back to building against system nss, but allow SHA-1
> signatures? That would be the correct thing to do anyway.
> https://bugzilla.redhat.com/show_bug.cgi?id=1908018#c17 explained how to do
> that.

Okay, I'll do the build against system nss on rawhide too.

Comment 29 Adam Williamson 2020-12-23 16:53:37 UTC
but...you left out the "but allow SHA-1 signatures" part...

Comment 30 Antonio T. sagitter 2020-12-26 11:53:48 UTC
(In reply to Adam Williamson from comment #26)
> Could we please just go back to building against system nss, but allow SHA-1
> signatures? That would be the correct thing to do anyway.
> https://bugzilla.redhat.com/show_bug.cgi?id=1908018#c17 explained how to do
> that.

If this code is for patching Firefox/IceCat, i don't know how to use it. :-/

Comment 31 Adam Williamson 2020-12-28 17:58:44 UTC
You shouldn't have to, I meant my comment for Martin, I was hoping he would apply that change when switching Firefox back to build against system NSS. Unfortunately he didn't. I'll see if I can.

Comment 32 Adam Williamson 2021-01-02 20:00:38 UTC
Firefox is back to building against system NSS as of now, so this bug can be closed.

Comment 33 Miro Hrončok 2021-01-04 09:39:14 UTC
I strongly recommend to get bz1582116 fixed to avoid disasters in the future.

Comment 34 Martin Stransky 2021-02-01 07:55:30 UTC
*** Bug 1922935 has been marked as a duplicate of this bug. ***

Comment 35 Martin Stransky 2021-02-01 07:56:07 UTC
Not yet finished - Bug 1922935 - 85.0-5 regression: libXt.so.6: cannot open shared object file: No such file or directory

Comment 36 Kalev Lember 2021-02-01 08:44:55 UTC
I believe this regression is already fixed with https://src.fedoraproject.org/rpms/firefox/c/00f050ca50ed263883650e2f5819556bec57e678?branch=master

Comment 37 Kalev Lember 2021-02-01 08:48:06 UTC
When comparing the requires in the two versions (85.0-5 and 85.0-8 that has the fix above), we can see that libXt.so.6 requires appear in the diff:

 rpmdiff -i T -i 5 -i S firefox-85.0-5.fc33.x86_64.rpm firefox-85.0-8.fc33.x86_64.rpm | grep -v build-id 
removed     REQUIRES dbus-glib  
added       REQUIRES libX11-xcb.so.1()(64bit)  
added       REQUIRES libX11.so.6()(64bit)  
added       REQUIRES libXcomposite.so.1()(64bit)  
added       REQUIRES libXcursor.so.1()(64bit)  
added       REQUIRES libXdamage.so.1()(64bit)  
added       REQUIRES libXext.so.6()(64bit)  
added       REQUIRES libXfixes.so.3()(64bit)  
added       REQUIRES libXi.so.6()(64bit)  
added       REQUIRES libXrender.so.1()(64bit)  
added       REQUIRES libXt.so.6()(64bit)  
added       REQUIRES libc.so.6(GLIBC_2.10)(64bit)  
added       REQUIRES libc.so.6(GLIBC_2.11)(64bit)  
added       REQUIRES libc.so.6(GLIBC_2.15)(64bit)  
added       REQUIRES libc.so.6(GLIBC_2.18)(64bit)  
added       REQUIRES libc.so.6(GLIBC_2.27)(64bit)  
added       REQUIRES libc.so.6(GLIBC_2.28)(64bit)  
added       REQUIRES libc.so.6(GLIBC_2.32)(64bit)  
added       REQUIRES libc.so.6(GLIBC_2.8)(64bit)  
added       REQUIRES libc.so.6(GLIBC_2.9)(64bit)  
added       REQUIRES libdbus-1.so.3()(64bit)  
added       REQUIRES libdbus-1.so.3(LIBDBUS_1_3)(64bit)  
added       REQUIRES libdbus-glib-1.so.2()(64bit)  
added       REQUIRES libfdk-aac.so.2()(64bit)  
added       REQUIRES libffi.so.6()(64bit)  
added       REQUIRES libfontconfig.so.1()(64bit)  
added       REQUIRES libfreetype.so.6()(64bit)  
added       REQUIRES libgcc_s.so.1(GCC_3.4)(64bit)  
added       REQUIRES libgcc_s.so.1(GCC_4.0.0)(64bit)  
added       REQUIRES libgdk-x11-2.0.so.0()(64bit)  
added       REQUIRES libgtk-x11-2.0.so.0()(64bit)  
added       REQUIRES libm.so.6(GLIBC_2.27)(64bit)  
added       REQUIRES libm.so.6(GLIBC_2.29)(64bit)  
added       REQUIRES libnss3.so()(64bit)  
added       REQUIRES libnss3.so(NSS_3.10)(64bit)  
added       REQUIRES libnss3.so(NSS_3.10.2)(64bit)  
added       REQUIRES libnss3.so(NSS_3.11)(64bit)  
added       REQUIRES libnss3.so(NSS_3.11.2)(64bit)  
added       REQUIRES libnss3.so(NSS_3.12)(64bit)  
added       REQUIRES libnss3.so(NSS_3.12.3)(64bit)  
added       REQUIRES libnss3.so(NSS_3.12.4)(64bit)  
added       REQUIRES libnss3.so(NSS_3.12.5)(64bit)  
added       REQUIRES libnss3.so(NSS_3.13)(64bit)  
added       REQUIRES libnss3.so(NSS_3.13.2)(64bit)  
added       REQUIRES libnss3.so(NSS_3.15)(64bit)  
added       REQUIRES libnss3.so(NSS_3.16.1)(64bit)  
added       REQUIRES libnss3.so(NSS_3.16.2)(64bit)  
added       REQUIRES libnss3.so(NSS_3.19)(64bit)  
added       REQUIRES libnss3.so(NSS_3.2)(64bit)  
added       REQUIRES libnss3.so(NSS_3.21)(64bit)  
added       REQUIRES libnss3.so(NSS_3.22)(64bit)  
added       REQUIRES libnss3.so(NSS_3.3)(64bit)  
added       REQUIRES libnss3.so(NSS_3.30)(64bit)  
added       REQUIRES libnss3.so(NSS_3.4)(64bit)  
added       REQUIRES libnss3.so(NSS_3.44)(64bit)  
added       REQUIRES libnss3.so(NSS_3.45)(64bit)  
added       REQUIRES libnss3.so(NSS_3.47)(64bit)  
added       REQUIRES libnss3.so(NSS_3.5)(64bit)  
added       REQUIRES libnss3.so(NSS_3.55)(64bit)  
added       REQUIRES libnss3.so(NSS_3.6)(64bit)  
added       REQUIRES libnss3.so(NSS_3.7)(64bit)  
added       REQUIRES libnss3.so(NSS_3.8)(64bit)  
added       REQUIRES libnss3.so(NSS_3.9)(64bit)  
added       REQUIRES libnss3.so(NSS_3.9.2)(64bit)  
added       REQUIRES libnss3.so(NSS_3.9.3)(64bit)  
added       REQUIRES libnssutil3.so()(64bit)  
added       REQUIRES libnssutil3.so(NSSUTIL_3.12)(64bit)  
added       REQUIRES libnssutil3.so(NSSUTIL_3.12.3)(64bit)  
added       REQUIRES libnssutil3.so(NSSUTIL_3.12.5)(64bit)  
added       REQUIRES libnssutil3.so(NSSUTIL_3.13)(64bit)  
added       REQUIRES libpangoft2-1.0.so.0()(64bit)  
added       REQUIRES libpthread.so.0(GLIBC_2.12)(64bit)  
added       REQUIRES librt.so.1()(64bit)  
added       REQUIRES librt.so.1(GLIBC_2.2.5)(64bit)  
added       REQUIRES libsmime3.so()(64bit)  
added       REQUIRES libsmime3.so(NSS_3.13)(64bit)  
added       REQUIRES libsmime3.so(NSS_3.16)(64bit)  
added       REQUIRES libsmime3.so(NSS_3.2)(64bit)  
added       REQUIRES libsmime3.so(NSS_3.4)(64bit)  
added       REQUIRES libssl3.so()(64bit)  
added       REQUIRES libssl3.so(NSS_3.12.6)(64bit)  
added       REQUIRES libssl3.so(NSS_3.13)(64bit)  
added       REQUIRES libssl3.so(NSS_3.13.2)(64bit)  
added       REQUIRES libssl3.so(NSS_3.14)(64bit)  
added       REQUIRES libssl3.so(NSS_3.15)(64bit)  
added       REQUIRES libssl3.so(NSS_3.15.4)(64bit)  
added       REQUIRES libssl3.so(NSS_3.2)(64bit)  
added       REQUIRES libssl3.so(NSS_3.21)(64bit)  
added       REQUIRES libssl3.so(NSS_3.22)(64bit)  
added       REQUIRES libssl3.so(NSS_3.23)(64bit)  
added       REQUIRES libssl3.so(NSS_3.27)(64bit)  
added       REQUIRES libssl3.so(NSS_3.28)(64bit)  
added       REQUIRES libssl3.so(NSS_3.30.0.1)(64bit)  
added       REQUIRES libssl3.so(NSS_3.33)(64bit)  
added       REQUIRES libssl3.so(NSS_3.4)(64bit)  
added       REQUIRES libstdc++.so.6(CXXABI_1.3.5)(64bit)  
added       REQUIRES libstdc++.so.6(GLIBCXX_3.4.14)(64bit)  
added       REQUIRES libstdc++.so.6(GLIBCXX_3.4.15)(64bit)  
added       REQUIRES libstdc++.so.6(GLIBCXX_3.4.18)(64bit)  
added       REQUIRES libstdc++.so.6(GLIBCXX_3.4.22)(64bit)  
added       REQUIRES libxcb-shm.so.0()(64bit)  
added       REQUIRES libxcb.so.1()(64bit)  
added       REQUIRES libz.so.1(ZLIB_1.2.0)(64bit)  
added       REQUIRES libz.so.1(ZLIB_1.2.3.4)(64bit)  
added       REQUIRES libz.so.1(ZLIB_1.2.9)(64bit)  
removed     PROVIDES firefox = 85.0-5.fc33
removed     PROVIDES firefox(x86-64) = 85.0-5.fc33
added       PROVIDES firefox = 85.0-8.fc33
added       PROVIDES firefox(x86-64) = 85.0-8.fc33

Comment 38 Miro Hrončok 2021-02-01 10:41:22 UTC
(In reply to Martin Stransky from comment #35)
> Not yet finished - Bug 1922935 - 85.0-5 regression: libXt.so.6: cannot open
> shared object file: No such file or directory

Yes, as reported in bz1582116. Let's keep this one closed.


Note You need to log in before you can comment on or make changes to this bug.