GNU bug report logs - #76129
[PATCH] gnu: mullvadbrowser: Update to 14.0.5 [security fixes].

Previous Next

Full log

Message #10 received at 76129 <at> debbugs.gnu.org (full text, mbox):

From: André Batista <nandre <at> riseup.net>
To: Ian Eure <ian <at> retrospec.tv>
Cc: 76129 <at> debbugs.gnu.org
Subject: Was [bug#76129], mullvadbrowser: glean, psutil and zstd [security
 fixes].
Date: Thu, 20 Feb 2025 17:39:03 -0300

Hi Ian,

ter 11 fev 2025 às 06:57:41 (1739267861), ian <at> retrospec.tv enviou:
> Hi André,
> 
> The patch looks good; I’m building it now to make sure it passes and seems
> to work, and will push today assuming it does.
> 
> I noticed that some python dependencies seem to be missing from
> native-inputs, which cause the build to attempt downloading them, printing
> messages like:
> 
>    WARNING: Retrying (Retry(total=4, connect=None, read=None,
> redirect=None, status=None)) after connection broken by
> 'NewConnectionError('<pip._vendor.urllib3.connection.HTTPSConnection
> object at 0x7ffff56cb520>: Failed to establish a new    connection: [Errno
> -3] Temporary failure in name    resolution')': /simple/glean-sdk/
> 
> It looks like glean-sdk (seems to be unpackaged in Guix), python-psutil, and
> python-zstandard are the missing packages triggering this.  This doesn’t
> fail the build, so it seems these aren’t critical.  If you’re willing to
> either add the deps, remove them from wherever they’re listed, or otherwise
> stop the download attempts (which take a while to retry and fail), I think
> that’d be a good followup.
> 

I've checked the build logs and after those warning messages we get:

-------
(...)
Could not install glean-sdk, so telemetry will not be collected. Continuing.
Could not install psutil, so telemetry will be missing some data. Continuing.
Could not install zstandard, so zstd archives will not be possible to extract.
Continuing.
Configure complete!
(...)
-------

However, upstream purposefully disables telemetry by unsetting the
variable 'MOZ_TELEMETRY_REPORTING' and that's sensible IMO.  So glean-sdk
and psutil have no place on our build.  OTOH, zstandard is used to
extract blobs (included/downloaded?) which is also foreign to our goals
on guix and a possible threat vector (remember xz-utils?).

So I don't think any of them should be included.  As for mozilla's
warnings, I can live with them.  It seems to me that patching the sources
to remove those checks/messages would be much trouble for little gain: a
couple of seconds at best?

Can you live with them as well?

Cheers!

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.