colin/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
9881acaee4
nixpkgs/pkgs/applications/networking/browsers/tor-browser/default.nix

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

338 lines
10 KiB
Nix
Raw Normal View History

tor-browser: use system install & simplify wrapper Enables official system install which stores state in `~/.tor project` instead of `~/.local/share/tor-browser`. The custom wrapper, which added some isolation, is replaced with a simpler makeWrapper-based solution. These changes bring the `tor-browser` package much closer to the `mullvad-browser` package.
2023-10-15 16:23:41 +00:00
{ lib
, stdenv
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
, fetchurl
, makeDesktopItem
tor-browser: use copyDesktopItems
2023-10-15 16:22:29 +00:00
, copyDesktopItems
tor-browser: use system install & simplify wrapper Enables official system install which stores state in `~/.tor project` instead of `~/.local/share/tor-browser`. The custom wrapper, which added some isolation, is replaced with a simpler makeWrapper-based solution. These changes bring the `tor-browser` package much closer to the `mullvad-browser` package.
2023-10-15 16:23:41 +00:00
, makeWrapper
tor-browser-bundle-bin: add distribution.ini & policies.json The `distribution.ini` allows for some light branding, which is also used by `pkgs.firefox`. The `policies.json` fixes an issue where about:preferences#general is empty and some other issues on about:preferences.
2023-04-14 17:13:05 +00:00
, writeText
tor-browser: add support for GPU acceleration Support GPU acceleration for WebRender & VA-API.
2023-11-12 17:54:09 +00:00
, autoPatchelfHook
tor-browser: use system install & simplify wrapper Enables official system install which stores state in `~/.tor project` instead of `~/.local/share/tor-browser`. The custom wrapper, which added some isolation, is replaced with a simpler makeWrapper-based solution. These changes bring the `tor-browser` package much closer to the `mullvad-browser` package.
2023-10-15 16:23:41 +00:00
, wrapGAppsHook
tor-browser-bundle-bin: add passthru.updateScript
2023-05-13 21:54:14 +00:00
, callPackage
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
, atk
, cairo
, dbus
tree-wide: autorename gnome packages to use dashes
2018-02-25 02:23:58 +00:00
, dbus-glib
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
, fontconfig
, freetype
gdk-pixbuf: rename from gdk_pixbuf
2019-05-22 11:03:39 +00:00
, gdk-pixbuf
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
, glib
tor-browser-bundle-bin: 7.5.6 -> 8.0
2018-09-11 10:33:02 +00:00
, gtk3
tor-browser-bundle-bin: 6.5.2 -> 7.0 Now requires pulseaudio for audio playback. https://blog.torproject.org/blog/tor-browser-70-released
2017-06-07 17:04:51 +00:00
, libxcb
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
, libX11
, libXext
, libXrender
, libXt
tor-browser: add support for GPU acceleration Support GPU acceleration for WebRender & VA-API.
2023-11-12 17:54:09 +00:00
, libXtst
, mesa
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
, pango
tor-browser: add support for GPU acceleration Support GPU acceleration for WebRender & VA-API.
2023-11-12 17:54:09 +00:00
, pciutils
, zlib
, libnotifySupport ? stdenv.isLinux
, libnotify
, waylandSupport ? stdenv.isLinux
, libxkbcommon
, libdrm
tor-browser: add missing libGL required for wayland
2023-11-25 13:25:22 +00:00
, libGL
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
tor-browser: use system install & simplify wrapper Enables official system install which stores state in `~/.tor project` instead of `~/.local/share/tor-browser`. The custom wrapper, which added some isolation, is replaced with a simpler makeWrapper-based solution. These changes bring the `tor-browser` package much closer to the `mullvad-browser` package.
2023-10-15 16:23:41 +00:00
, mediaSupport ? true
, ffmpeg
tor-browser-bundle-bin: 6.5.2 -> 7.0 Now requires pulseaudio for audio playback. https://blog.torproject.org/blog/tor-browser-70-released
2017-06-07 17:04:51 +00:00
, audioSupport ? mediaSupport
tor-browser: add support for GPU acceleration Support GPU acceleration for WebRender & VA-API.
2023-11-12 17:54:09 +00:00
, pipewireSupport ? audioSupport
, pipewire
, pulseaudioSupport ? audioSupport
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
, libpulseaudio
tor-browser-bundle-bin: support audio playback without pulseaudio Still a little rough around the edges but does work. Defaults to using the default plughw; set the APULSE_PLAYBACK_DEVICE envvar to override.
2017-09-23 16:25:42 +00:00
, apulse
tor-browser-bundle-bin: 11.5.8 -> 12.0.3 * https://blog.torproject.org/new-release-tor-browser-120/ * https://blog.torproject.org/new-release-tor-browser-1201/ * https://blog.torproject.org/new-release-tor-browser-1202/ * https://blog.torproject.org/new-release-tor-browser-1203/ Fix an issue in 12.0.x where TBB fails to connect to its Tor socket, by cleaning up $XDG_RUNTIME_DIR/Tor*.
2023-02-18 15:59:52 +00:00
, alsa-lib
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
tor-browser: add support for GPU acceleration Support GPU acceleration for WebRender & VA-API.
2023-11-12 17:54:09 +00:00
, libvaSupport ? mediaSupport
, libva
tor-browser-bundle-bin: use hardened allocator
2019-09-24 08:28:37 +00:00
# Hardening
, graphene-hardened-malloc
tor-browser-bundle-bin: Enable content sandbox and hardened malloc Tor browser enables multi-process support in firefox to sandbox each site in its own process. This is a very important security feature. It was disabled in the nixpkgs version, according to a comment due to "crashing tabs", but running with it enabled I have not been able to recreate this. Sandboxing enabled is the upstream default, and if we can't ship a tor browser that way then we should not ship one at all. Also re-enable useHardenedMalloc to use graphene-hardened-malloc. Here there was also a comment, in this case saying it caused "crashes with intel driver". I have also been unable to recreate this on my Intel UHD P630 onboard graphics. I believe neither of these are issues any longer.
2021-11-04 23:10:37 +00:00
# Whether to use graphene-hardened-malloc
tor-browser-bundle-bin: deprecate useHardenedMalloc Set useHardenedMalloc to false by default & add deprecation warning. graphene-hardened-malloc cannot fully replace Tor Browser's statically linked jemalloc & can cause issues.
2023-08-08 23:24:40 +00:00
, useHardenedMalloc ? null
tor-browser-bundle-bin: use hardened allocator
2019-09-24 08:28:37 +00:00
tor-browser-bundle-bin: Enable content sandbox and hardened malloc Tor browser enables multi-process support in firefox to sandbox each site in its own process. This is a very important security feature. It was disabled in the nixpkgs version, according to a comment due to "crashing tabs", but running with it enabled I have not been able to recreate this. Sandboxing enabled is the upstream default, and if we can't ship a tor browser that way then we should not ship one at all. Also re-enable useHardenedMalloc to use graphene-hardened-malloc. Here there was also a comment, in this case saying it caused "crashes with intel driver". I have also been unable to recreate this on my Intel UHD P630 onboard graphics. I believe neither of these are issues any longer.
2021-11-04 23:10:37 +00:00
# Whether to disable multiprocess support
, disableContentSandbox ? false
tor-browser-bundle-bin: optionally disable multiprocess support Multiprocess tabs always crash, as first reported by the issue mentioned below. It is now consistently reproducible both on NixOS and non-NixOS for me, so I've decided to add a toggle to conveniently disable multiprocess support as a work-around. Closes https://github.com/NixOS/nixpkgs/issues/27759 but does not really fix the underlying problem ...
2017-09-15 09:41:49 +00:00
tor-browser-bundle-bin: support injecting additional prefs The `extraPrefs` parameter is injected verbatim into the mozilla.cfg file. Note that the syntax is a superset of the usual prefs.js syntax. The following procedures are of particular interest: pref() to set a preference as if it had been toggled in about:config defaultPref() to set the *default* value of a preference lockPref() to set a preference & prevent further modification clearPref() to reset a preference to its default state Example: ```nix tor-browser-bundle-bin.override { extraPrefs = '' // Increase default security level pref("extensions.torbutton.security_slider", 2); ''; } ```
2017-07-13 07:57:10 +00:00
# Extra preferences
, extraPrefs ? ""
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
}:
tor-browser-bundle-bin: deprecate useHardenedMalloc Set useHardenedMalloc to false by default & add deprecation warning. graphene-hardened-malloc cannot fully replace Tor Browser's statically linked jemalloc & can cause issues.
2023-08-08 23:24:40 +00:00
lib.warnIf (useHardenedMalloc != null)
tor-browser: rename from tor-browser-bundle-bin The term "Tor Browser Bundle" has been dropped quite a while ago. It's just called "Tor Browser" now. Also removes the `-bin` pname suffix, since the it's already marked as a binary distribution via `meta.sourceProvenance`.
2023-09-23 17:46:07 +00:00
"tor-browser: useHardenedMalloc is deprecated and enabling it can cause issues"
tor-browser-bundle-bin: deprecate useHardenedMalloc Set useHardenedMalloc to false by default & add deprecation warning. graphene-hardened-malloc cannot fully replace Tor Browser's statically linked jemalloc & can cause issues.
2023-08-08 23:24:40 +00:00
(let
tor-browser: add support for GPU acceleration Support GPU acceleration for WebRender & VA-API.
2023-11-12 17:54:09 +00:00
libPath = lib.makeLibraryPath (
[
alsa-lib
atk
cairo
dbus
dbus-glib
fontconfig
freetype
gdk-pixbuf
glib
gtk3
libxcb
libX11
libXext
libXrender
libXt
libXtst
mesa # for libgbm
pango
pciutils
stdenv.cc.cc
stdenv.cc.libc
zlib
] ++ lib.optionals libnotifySupport [ libnotify ]
tor-browser: add missing libGL required for wayland
2023-11-25 13:25:22 +00:00
++ lib.optionals waylandSupport [ libxkbcommon libdrm libGL ]
tor-browser: add support for GPU acceleration Support GPU acceleration for WebRender & VA-API.
2023-11-12 17:54:09 +00:00
++ lib.optionals pipewireSupport [ pipewire ]
++ lib.optionals pulseaudioSupport [ libpulseaudio ]
++ lib.optionals libvaSupport [ libva ]
++ lib.optionals mediaSupport [ ffmpeg ]
);
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
tor-browser: 13.0.13 -> 13.0.14 https://blog.torproject.org/new-release-tor-browser-13014/
2024-04-16 17:25:09 +00:00
version = "13.0.14";
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
tor-browser-bundle-bin: add passthru.updateScript
2023-05-13 21:54:14 +00:00
sources = {
treewide: remove redundant quotes
2019-08-13 21:52:01 +00:00
x86_64-linux = fetchurl {
tor-browser-bundle-bin: Add eff.org mirror
2021-05-11 13:38:24 +00:00
urls = [
tor-browser: 12.5.6 -> 13.0 https://blog.torproject.org/new-release-tor-browser-130/ Also removes some workarounds for Tor sockets which are no longer needed.
2023-09-23 17:09:23 +00:00
"https://archive.torproject.org/tor-package-archive/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
"https://dist.torproject.org/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
"https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
"https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
tor-browser-bundle-bin: Add eff.org mirror
2021-05-11 13:38:24 +00:00
];
tor-browser: 13.0.13 -> 13.0.14 https://blog.torproject.org/new-release-tor-browser-13014/
2024-04-16 17:25:09 +00:00
hash = "sha256-UWR2zMVXa6QMz1EIWJf43Vmj14ZIaug105esxeSd0KU=";
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
};
treewide: remove redundant quotes
2019-08-13 21:52:01 +00:00
i686-linux = fetchurl {
tor-browser-bundle-bin: Add eff.org mirror
2021-05-11 13:38:24 +00:00
urls = [
tor-browser: 12.5.6 -> 13.0 https://blog.torproject.org/new-release-tor-browser-130/ Also removes some workarounds for Tor sockets which are no longer needed.
2023-09-23 17:09:23 +00:00
"https://archive.torproject.org/tor-package-archive/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
"https://dist.torproject.org/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
"https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
"https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
tor-browser-bundle-bin: Add eff.org mirror
2021-05-11 13:38:24 +00:00
];
tor-browser: 13.0.13 -> 13.0.14 https://blog.torproject.org/new-release-tor-browser-13014/
2024-04-16 17:25:09 +00:00
hash = "sha256-n+qj3IY4z+erOg4iUkQ4CP3rtJASTeKPg7beZRdesw4=";
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
};
};
tor-browser-bundle-bin: add distribution.ini & policies.json The `distribution.ini` allows for some light branding, which is also used by `pkgs.firefox`. The `policies.json` fixes an issue where about:preferences#general is empty and some other issues on about:preferences.
2023-04-14 17:13:05 +00:00
distributionIni = writeText "distribution.ini" (lib.generators.toINI {} {
# Some light branding indicating this build uses our distro preferences
Global = {
id = "nixos";
version = "1.0";
about = "Tor Browser for NixOS";
};
});
policiesJson = writeText "policies.json" (builtins.toJSON {
policies.DisableAppUpdate = true;
});
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
in
stdenv.mkDerivation rec {
tor-browser: rename from tor-browser-bundle-bin The term "Tor Browser Bundle" has been dropped quite a while ago. It's just called "Tor Browser" now. Also removes the `-bin` pname suffix, since the it's already marked as a binary distribution via `meta.sourceProvenance`.
2023-09-23 17:46:07 +00:00
pname = "tor-browser";
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
inherit version;
tor-browser-bundle-bin: add passthru.updateScript
2023-05-13 21:54:14 +00:00
src = sources.${stdenv.hostPlatform.system} or (throw "unsupported system: ${stdenv.hostPlatform.system}");
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
tor-browser: use system install & simplify wrapper Enables official system install which stores state in `~/.tor project` instead of `~/.local/share/tor-browser`. The custom wrapper, which added some isolation, is replaced with a simpler makeWrapper-based solution. These changes bring the `tor-browser` package much closer to the `mullvad-browser` package.
2023-10-15 16:23:41 +00:00
nativeBuildInputs = [ autoPatchelfHook copyDesktopItems makeWrapper wrapGAppsHook ];
tor-browser: add support for GPU acceleration Support GPU acceleration for WebRender & VA-API.
2023-11-12 17:54:09 +00:00
buildInputs = [
gtk3
alsa-lib
dbus-glib
libXtst
];
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
preferLocalBuild = true;
tor-browser-bundle-bin: additional download urls To better support users that are unable to access the official Tor distribution site, e.g., https://github.com/NixOS/nixpkgs/issues/26184
2017-05-28 18:06:19 +00:00
allowSubstitutes = false;
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
tor-browser: use copyDesktopItems
2023-10-15 16:22:29 +00:00
desktopItems = [(makeDesktopItem {
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
name = "torbrowser";
tor-browser: use copyDesktopItems
2023-10-15 16:22:29 +00:00
exec = "tor-browser %U";
icon = "tor-browser";
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
desktopName = "Tor Browser";
genericName = "Web Browser";
comment = meta.description;
treewide: switch all desktop file generators to new API Notably: - remove explicit arguments that match the defaults - convert everything to the right Nix types
2022-02-22 14:56:15 +00:00
categories = [ "Network" "WebBrowser" "Security" ];
tor-browser: use copyDesktopItems
2023-10-15 16:22:29 +00:00
})];
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
tor-browser-bundle-bin: add distribution.ini & policies.json The `distribution.ini` allows for some light branding, which is also used by `pkgs.firefox`. The `policies.json` fixes an issue where about:preferences#general is empty and some other issues on about:preferences.
2023-04-14 17:13:05 +00:00
buildPhase = ''
runHook preBuild
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
# For convenience ...
TBB_IN_STORE=$out/share/tor-browser
interp=$(< $NIX_CC/nix-support/dynamic-linker)
# Unpack & enter
mkdir -p "$TBB_IN_STORE"
tor-browser-bundle-bin: make overrideAttrs work
2021-03-28 07:22:07 +00:00
tar xf "$src" -C "$TBB_IN_STORE" --strip-components=2
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
pushd "$TBB_IN_STORE"
# Set ELF interpreter
tor-browser-bundle-bin: 7.5.6 -> 8.0
2018-09-11 10:33:02 +00:00
for exe in firefox.real TorBrowser/Tor/tor ; do
echo "Setting ELF interpreter on $exe ..." >&2
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
patchelf --set-interpreter "$interp" "$exe"
done
tor-browser-bundle-bin: 7.5.6 -> 8.0
2018-09-11 10:33:02 +00:00
# firefox is a wrapper that checks for a more recent libstdc++ & appends it to the ld path
mv firefox.real firefox
tor-browser: use system install & simplify wrapper Enables official system install which stores state in `~/.tor project` instead of `~/.local/share/tor-browser`. The custom wrapper, which added some isolation, is replaced with a simpler makeWrapper-based solution. These changes bring the `tor-browser` package much closer to the `mullvad-browser` package.
2023-10-15 16:23:41 +00:00
# store state at `~/.tor browser` instead of relative to executable
touch "$TBB_IN_STORE/system-install"
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
# The final libPath. Note, we could split this into firefoxLibPath
# and torLibPath for accuracy, but this is more convenient ...
libPath=${libPath}:$TBB_IN_STORE:$TBB_IN_STORE/TorBrowser/Tor
tor-browser-bundle-bin: support audio playback without pulseaudio Still a little rough around the edges but does work. Defaults to using the default plughw; set the APULSE_PLAYBACK_DEVICE envvar to override.
2017-09-23 16:25:42 +00:00
# apulse uses a non-standard library path. For now special-case it.
treewide: remove global with lib; in pkgs/{misc,networking}
2023-01-24 16:29:20 +00:00
${lib.optionalString (audioSupport && !pulseaudioSupport) ''
tor-browser-bundle-bin: support audio playback without pulseaudio Still a little rough around the edges but does work. Defaults to using the default plughw; set the APULSE_PLAYBACK_DEVICE envvar to override.
2017-09-23 16:25:42 +00:00
libPath=${apulse}/lib/apulse:$libPath
''}
torbrowser: support obfs and fte transports meek still broken, but then, sending all your traffic to Amazon seems like something you'd do only if everything else fails.
2017-03-26 11:49:24 +00:00
# Fixup paths to pluggable transports.
sed -i TorBrowser/Data/Tor/torrc-defaults \
-e "s,./TorBrowser,$TBB_IN_STORE/TorBrowser,g"
# Fixup obfs transport. Work around patchelf failing to set
# interpreter for pre-compiled Go binaries by invoking the interpreter
# directly.
sed -i TorBrowser/Data/Tor/torrc-defaults \
tor-browser-bundle-bin: 8.5.5 -> 9.0 https://blog.torproject.org/new-release-tor-browser-90
2019-10-23 17:21:03 +00:00
-e "s|\(ClientTransportPlugin meek_lite,obfs2,obfs3,obfs4,scramblesuit\) exec|\1 exec $interp|"
torbrowser: support obfs and fte transports meek still broken, but then, sending all your traffic to Amazon seems like something you'd do only if everything else fails.
2017-03-26 11:49:24 +00:00
tor-browser-bundle-bin: 8.5.5 -> 9.0 https://blog.torproject.org/new-release-tor-browser-90
2019-10-23 17:21:03 +00:00
# Similarly fixup snowflake
sed -i TorBrowser/Data/Tor/torrc-defaults \
-e "s|\(ClientTransportPlugin snowflake\) exec|\1 exec $interp|"
torbrowser: support obfs and fte transports meek still broken, but then, sending all your traffic to Amazon seems like something you'd do only if everything else fails.
2017-03-26 11:49:24 +00:00
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
# Prepare for autoconfig.
#
# See https://developer.mozilla.org/en-US/Firefox/Enterprise_deployment
cat >defaults/pref/autoconfig.js <<EOF
//
pref("general.config.filename", "mozilla.cfg");
pref("general.config.obscure_value", 0);
EOF
# Hard-coded Firefox preferences.
cat >mozilla.cfg <<EOF
// First line must be a comment
tor-browser: use system install & simplify wrapper Enables official system install which stores state in `~/.tor project` instead of `~/.local/share/tor-browser`. The custom wrapper, which added some isolation, is replaced with a simpler makeWrapper-based solution. These changes bring the `tor-browser` package much closer to the `mullvad-browser` package.
2023-10-15 16:23:41 +00:00
// Reset pref that captures store paths.
clearPref("extensions.xpiState");
// Stop obnoxious first-run redirection.
lockPref("noscript.firstRunRedirection", false);
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
// User should never change these. Locking prevents these
// values from being written to prefs.js, avoiding Store
// path capture.
lockPref("extensions.torlauncher.torrc-defaults_path", "$TBB_IN_STORE/TorBrowser/Data/Tor/torrc-defaults");
lockPref("extensions.torlauncher.tor_path", "$TBB_IN_STORE/TorBrowser/Tor/tor");
tor-browser-bundle-bin: communicate with tor over named pipes
2017-07-04 13:09:39 +00:00
// Insist on using IPC for communicating with Tor
//
tor-browser-bundle-bin: fix IPC socket issue
2023-04-14 17:11:52 +00:00
// Defaults to creating \$XDG_RUNTIME_DIR/Tor/{socks,control}.socket
tor-browser-bundle-bin: communicate with tor over named pipes
2017-07-04 13:09:39 +00:00
lockPref("extensions.torlauncher.control_port_use_ipc", true);
lockPref("extensions.torlauncher.socks_port_use_ipc", true);
tor-browser-bundle-bin: support injecting additional prefs The `extraPrefs` parameter is injected verbatim into the mozilla.cfg file. Note that the syntax is a superset of the usual prefs.js syntax. The following procedures are of particular interest: pref() to set a preference as if it had been toggled in about:config defaultPref() to set the *default* value of a preference lockPref() to set a preference & prevent further modification clearPref() to reset a preference to its default state Example: ```nix tor-browser-bundle-bin.override { extraPrefs = '' // Increase default security level pref("extensions.torbutton.security_slider", 2); ''; } ```
2017-07-13 07:57:10 +00:00
tor-browser-bundle-bin: optionally disable multiprocess support Multiprocess tabs always crash, as first reported by the issue mentioned below. It is now consistently reproducible both on NixOS and non-NixOS for me, so I've decided to add a toggle to conveniently disable multiprocess support as a work-around. Closes https://github.com/NixOS/nixpkgs/issues/27759 but does not really fix the underlying problem ...
2017-09-15 09:41:49 +00:00
// Optionally disable multiprocess support. We always set this to ensure that
// toggling the pref takes effect.
lockPref("browser.tabs.remote.autostart.2", ${if disableContentSandbox then "false" else "true"});
tor-browser-bundle-bin: support audio playback without pulseaudio Still a little rough around the edges but does work. Defaults to using the default plughw; set the APULSE_PLAYBACK_DEVICE envvar to override.
2017-09-23 16:25:42 +00:00
// Allow sandbox access to sound devices if using ALSA directly
${if (audioSupport && !pulseaudioSupport) then ''
pref("security.sandbox.content.write_path_whitelist", "/dev/snd/");
'' else ''
clearPref("security.sandbox.content.write_path_whitelist");
''}
treewide: remove global with lib; in pkgs/{misc,networking}
2023-01-24 16:29:20 +00:00
${lib.optionalString (extraPrefs != "") ''
tor-browser-bundle-bin: support injecting additional prefs The `extraPrefs` parameter is injected verbatim into the mozilla.cfg file. Note that the syntax is a superset of the usual prefs.js syntax. The following procedures are of particular interest: pref() to set a preference as if it had been toggled in about:config defaultPref() to set the *default* value of a preference lockPref() to set a preference & prevent further modification clearPref() to reset a preference to its default state Example: ```nix tor-browser-bundle-bin.override { extraPrefs = '' // Increase default security level pref("extensions.torbutton.security_slider", 2); ''; } ```
2017-07-13 07:57:10 +00:00
${extraPrefs}
''}
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
EOF
tor-browser: use system install & simplify wrapper Enables official system install which stores state in `~/.tor project` instead of `~/.local/share/tor-browser`. The custom wrapper, which added some isolation, is replaced with a simpler makeWrapper-based solution. These changes bring the `tor-browser` package much closer to the `mullvad-browser` package.
2023-10-15 16:23:41 +00:00
# FONTCONFIG_FILE is required to make fontconfig read the TBB
# fonts.conf; upstream uses FONTCONFIG_PATH, but FC_DEBUG=1024
# indicates the system fonts.conf being used instead.
tor-browser-bundle-bin: 12.0.7 -> 12.5
2023-06-23 09:49:19 +00:00
FONTCONFIG_FILE=$TBB_IN_STORE/fontconfig/fonts.conf
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
sed -i "$FONTCONFIG_FILE" \
tor-browser: use system install & simplify wrapper Enables official system install which stores state in `~/.tor project` instead of `~/.local/share/tor-browser`. The custom wrapper, which added some isolation, is replaced with a simpler makeWrapper-based solution. These changes bring the `tor-browser` package much closer to the `mullvad-browser` package.
2023-10-15 16:23:41 +00:00
-e "s,<dir>fonts</dir>,<dir>$TBB_IN_STORE/fonts</dir>,"
tor-browser-bundle-bin: support installing extensions Closes https://github.com/NixOS/nixpkgs/issues/30443
2017-10-20 13:24:20 +00:00
torbrowser: correct internal note about geoip
2017-03-26 12:51:08 +00:00
# Hard-code paths to geoip data files. TBB resolves the geoip files
# relative to torrc-defaults_path but if we do not hard-code them
# here, these paths end up being written to the torrc in the user's
# state dir.
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
cat >>TorBrowser/Data/Tor/torrc-defaults <<EOF
GeoIPFile $TBB_IN_STORE/TorBrowser/Data/Tor/geoip
GeoIPv6File $TBB_IN_STORE/TorBrowser/Data/Tor/geoip6
EOF
mkdir -p $out/bin
tor-browser: use system install & simplify wrapper Enables official system install which stores state in `~/.tor project` instead of `~/.local/share/tor-browser`. The custom wrapper, which added some isolation, is replaced with a simpler makeWrapper-based solution. These changes bring the `tor-browser` package much closer to the `mullvad-browser` package.
2023-10-15 16:23:41 +00:00
makeWrapper "$TBB_IN_STORE/firefox" "$out/bin/tor-browser" \
--prefix LD_PRELOAD : "${lib.optionalString (useHardenedMalloc == true)
"${graphene-hardened-malloc}/lib/libhardened_malloc.so"}" \
--prefix LD_LIBRARY_PATH : "$libPath" \
--set FONTCONFIG_FILE "$FONTCONFIG_FILE" \
--set-default MOZ_ENABLE_WAYLAND 1
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
# Easier access to docs
mkdir -p $out/share/doc
ln -s $TBB_IN_STORE/TorBrowser/Docs $out/share/doc/tor-browser
tor-browser: use copyDesktopItems
2023-10-15 16:22:29 +00:00
# Install icons
tor-browser-bundle-bin: fix icons
2019-10-16 20:48:42 +00:00
for i in 16 32 48 64 128; do
mkdir -p $out/share/icons/hicolor/''${i}x''${i}/apps/
ln -s $out/share/tor-browser/browser/chrome/icons/default/default$i.png $out/share/icons/hicolor/''${i}x''${i}/apps/tor-browser.png
done
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
# Check installed apps
echo "Checking bundled Tor ..."
LD_LIBRARY_PATH=$libPath $TBB_IN_STORE/TorBrowser/Tor/tor --version >/dev/null
echo "Checking tor-browser wrapper ..."
tor-browser: use system install & simplify wrapper Enables official system install which stores state in `~/.tor project` instead of `~/.local/share/tor-browser`. The custom wrapper, which added some isolation, is replaced with a simpler makeWrapper-based solution. These changes bring the `tor-browser` package much closer to the `mullvad-browser` package.
2023-10-15 16:23:41 +00:00
$out/bin/tor-browser --version >/dev/null
tor-browser-bundle-bin: add distribution.ini & policies.json The `distribution.ini` allows for some light branding, which is also used by `pkgs.firefox`. The `policies.json` fixes an issue where about:preferences#general is empty and some other issues on about:preferences.
2023-04-14 17:13:05 +00:00
runHook postBuild
'';
installPhase = ''
runHook preInstall
# Install distribution customizations
install -Dvm644 ${distributionIni} $out/share/tor-browser/distribution/distribution.ini
install -Dvm644 ${policiesJson} $out/share/tor-browser/distribution/policies.json
runHook postInstall
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
'';
tor-browser-bundle-bin: add passthru.updateScript
2023-05-13 21:54:14 +00:00
passthru = {
inherit sources;
updateScript = callPackage ./update.nix {
inherit pname version meta;
};
};
treewide: with stdenv.lib; in meta -> with lib; Part of: https://github.com/NixOS/nixpkgs/issues/108938 meta = with stdenv.lib; is a widely used pattern. We want to slowly remove the `stdenv.lib` indirection and encourage people to use `lib` directly. Thus let’s start with the meta field. This used a rewriting script to mostly automatically replace all occurances of this pattern, and add the `lib` argument to the package header if it doesn’t exist yet. The script in its current form is available at https://cs.tvl.fyi/depot@2f807d7f141068d2d60676a89213eaa5353ca6e0/-/blob/users/Profpatsch/nixpkgs-rewriter/default.nix
2021-01-11 07:54:33 +00:00
meta = with lib; {
tor-browser: rename from tor-browser-bundle-bin The term "Tor Browser Bundle" has been dropped quite a while ago. It's just called "Tor Browser" now. Also removes the `-bin` pname suffix, since the it's already marked as a binary distribution via `meta.sourceProvenance`.
2023-09-23 17:46:07 +00:00
description = "Privacy-focused browser routing traffic through the Tor network";
treewide: add meta.mainProgram to packages with a single binary The nixpkgs-unstable channel's programs.sqlite was used to identify packages producing exactly one binary, and these automatically added to their package definitions wherever possible.
2024-03-19 02:14:51 +00:00
mainProgram = "tor-browser";
tor-browser-bundle-bin: meta.homepage is a regular string
2019-05-07 07:39:33 +00:00
homepage = "https://www.torproject.org/";
tor-browser-bundle-bin: 9.0.9 -> 9.5
2020-06-03 05:46:00 +00:00
changelog = "https://gitweb.torproject.org/builders/tor-browser-build.git/plain/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt?h=maint-${version}";
tor-browser-bundle-bin: add passthru.updateScript
2023-05-13 21:54:14 +00:00
platforms = attrNames sources;
tor-browser-bundle-bin: add felschr & panicgh as maintainers
2023-06-08 18:03:07 +00:00
maintainers = with maintainers; [ felschr panicgh joachifm hax404 ];
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
# MPL2.0+, GPL+, &c. While it's not entirely clear whether
# the compound is "libre" in a strict sense (some components place certain
# restrictions on redistribution), it's free enough for our purposes.
tor-browser: update licenses To match licenses with mullvad-browser.
2023-09-23 17:25:37 +00:00
license = with licenses; [ mpl20 lgpl21Plus lgpl3Plus free ];
tor-browser-bundle-bin: mark meta.sourceProvenance
2022-06-01 07:47:11 +00:00
sourceProvenance = with sourceTypes; [ binaryNativeCode ];
torbrowser: reduce risk of stale Nix store references This patch restructures the expression and wrapper to minimize Nix store references captured by the user's state directory. The previous version would write lots of references to the Nix store into the user's state directory, resulting in synchronization issues between the Store and the local state directory. At best, this would cause TBB to stop working when the version used to instantiate the local state was garbage collected; at worst, a user would continue to use the old version even after an upgrade. To solve the issue, hard-code as much as possible at the Store side and minimize the amount of stuff being copied into the local state dir. Currently, only a few files generated at firefox startup and fontconfig cache files end up capturing store paths; these files are simply removed upon every startup. Otherwise, no capture should occur and the user should always be using the TBB associated with the tor-browser wrapper script. To check for stale Store paths, do `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser` This command should *never* return any other store path than the one associated with the current tor-browser wrapper script, even after an update (assuming you've run tor-browser at least once after updating). Deviations from this general rule are considered bugs from now on. Note that no attempt has been made to support pluggable transports; they are still broken with this patch (to be fixed in a follow-up patch). User visible changes: - Wrapper retains only environment variables required for TBB to work - pulseaudioSupport can be toggled independently of mediaSupport (the latter weakly implies the former). - Store local state under $TBB_HOME. Defaults to $XDG_DATA_HOME/tor-browser - Stop obnoxious first-run stuff (NoScript redirect, in particular) - Set desktop item GenericName to Web Browser Some minor enhancements: - Disable Hydra builds - Specify system -> source mapping to make it easier to extend supported platforms.
2017-03-25 14:59:13 +00:00
};
tor-browser-bundle-bin: deprecate useHardenedMalloc Set useHardenedMalloc to false by default & add deprecation warning. graphene-hardened-malloc cannot fully replace Tor Browser's statically linked jemalloc & can cause issues.
2023-08-08 23:24:40 +00:00
})
Reference in New Issue Copy Permalink