Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix firefox wrapper #105796

Merged
merged 1 commit into from
Dec 4, 2020
+18 −7
Merged

Fix firefox wrapper #105796

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion doc/builders/packages/firefox.section.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ The `wrapFirefox` function allows to pass policies, preferences and extension th
```nix
{
myFirefox = wrapFirefox firefox-unwrapped {
extraExtensions = [
nixExtensions = [
(fetchFirefoxAddon {
name = "ublock";
url = "https://addons.mozilla.org/firefox/downloads/file/3679754/ublock_origin-1.31.0-an+fx.xpi";
Expand Down Expand Up @@ -38,3 +38,12 @@ The `wrapFirefox` function allows to pass policies, preferences and extension th
};
}
```

If `nixExtensions != null` then all manually installed addons will be uninstalled from your browser profile.
To view available enterprise policies visit [enterprise policies](https://github.com/mozilla/policy-templates#enterprisepoliciesenabled)
or type into the Firefox url bar: `about:policies#documentation`.
Nix installed addons do not have a valid signature, which is why signature verification is disabled. This does not compromise security because downloaded addons are checksumed and manual addons can't be installed.

# Troubleshooting
If addons do not appear installed although they have been defined in your nix configuration file reset the local addon state of your Firefox profile by clicking `help -> restart with addons disabled -> restart -> refresh firefox`. This can happen if you switch from manual addon mode to nix addon mode and then back to manual mode and then again to nix addon mode.

14 changes: 8 additions & 6 deletions pkgs/applications/networking/browsers/firefox/wrapper.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ let
# https://github.com/mozilla/policy-templates#enterprisepoliciesenabled
, extraPolicies ? {}
, firefoxLibName ? "firefox" # Important for tor package or the like
, extraExtensions ? [ ]
, nixExtensions ? null
}:

assert forceWayland -> (browser ? gtk3); # Can only use the wayland backend if gtk3 is being used
Expand Down Expand Up @@ -100,19 +100,21 @@ let
policiesJson = builtins.toFile "policies.json"
(builtins.toJSON enterprisePolicies);

usesNixExtensions = nixExtensions != null;

extensions = builtins.map (a:
if ! (builtins.hasAttr "extid" a) then
throw "extraExtensions has an invalid entry. Missing extid attribute. Please use fetchfirefoxaddon"
throw "nixExtensions has an invalid entry. Missing extid attribute. Please use fetchfirefoxaddon"
else
a
) extraExtensions;
) (if usesNixExtensions then nixExtensions else []);

enterprisePolicies =
{
policies = {
policies = lib.optionalAttrs usesNixExtensions {
DisableAppUpdate = true;
} //
{
lib.optionalAttrs usesNixExtensions {
ExtensionSettings = {
"*" = {
blocked_install_message = "You can't have manual extension mixed with nix extensions";
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This message should explain how to disable this enforcement.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@kevincox can you make a PR?

Expand All @@ -137,7 +139,7 @@ let
// to be able to install addons that do not have an extid
// Security is maintained because only user whitelisted addons
// with a checksum can be installed
lockPref("xpinstall.signatures.required", false);
${ lib.optionalString usesNixExtensions ''lockPref("xpinstall.signatures.required", false)'' };
${extraPrefs}
'';

Expand Down