diff options
Diffstat (limited to 'pkgs/applications/networking/browsers/tor-browser/default.nix')
| -rw-r--r-- | pkgs/applications/networking/browsers/tor-browser/default.nix | 219 |
1 files changed, 33 insertions, 186 deletions
diff --git a/pkgs/applications/networking/browsers/tor-browser/default.nix b/pkgs/applications/networking/browsers/tor-browser/default.nix index 76cdf1c1df5a..cd3711c5e967 100644 --- a/pkgs/applications/networking/browsers/tor-browser/default.nix +++ b/pkgs/applications/networking/browsers/tor-browser/default.nix @@ -1,8 +1,12 @@ -{ lib, stdenv +{ lib +, stdenv , fetchurl , makeDesktopItem +, copyDesktopItems +, makeWrapper , writeText , autoPatchelfHook +, wrapGAppsHook , callPackage , atk @@ -33,6 +37,9 @@ , libdrm , libGL +, mediaSupport ? true +, ffmpeg + , audioSupport ? mediaSupport , pipewireSupport ? audioSupport @@ -46,18 +53,6 @@ , libvaSupport ? mediaSupport , libva -# Media support (implies audio support) -, mediaSupport ? true -, ffmpeg - -# Wrapper runtime -, coreutils -, glibcLocales -, gnome -, runtimeShell -, shared-mime-info -, gsettings-desktop-schemas - # Hardening , graphene-hardened-malloc # Whether to use graphene-hardened-malloc @@ -149,7 +144,7 @@ stdenv.mkDerivation rec { src = sources.${stdenv.hostPlatform.system} or (throw "unsupported system: ${stdenv.hostPlatform.system}"); - nativeBuildInputs = [ autoPatchelfHook ]; + nativeBuildInputs = [ autoPatchelfHook copyDesktopItems makeWrapper wrapGAppsHook ]; buildInputs = [ gtk3 alsa-lib @@ -160,15 +155,15 @@ stdenv.mkDerivation rec { preferLocalBuild = true; allowSubstitutes = false; - desktopItem = makeDesktopItem { + desktopItems = [(makeDesktopItem { name = "torbrowser"; - exec = "tor-browser"; - icon = "torbrowser"; + exec = "tor-browser %U"; + icon = "tor-browser"; desktopName = "Tor Browser"; genericName = "Web Browser"; comment = meta.description; categories = [ "Network" "WebBrowser" "Security" ]; - }; + })]; buildPhase = '' runHook preBuild @@ -191,6 +186,9 @@ stdenv.mkDerivation rec { # firefox is a wrapper that checks for a more recent libstdc++ & appends it to the ld path mv firefox.real firefox + # store state at `~/.tor browser` instead of relative to executable + touch "$TBB_IN_STORE/system-install" + # The final libPath. Note, we could split this into firefoxLibPath # and torLibPath for accuracy, but this is more convenient ... libPath=${libPath}:$TBB_IN_STORE:$TBB_IN_STORE/TorBrowser/Tor @@ -214,7 +212,6 @@ stdenv.mkDerivation rec { sed -i TorBrowser/Data/Tor/torrc-defaults \ -e "s|\(ClientTransportPlugin snowflake\) exec|\1 exec $interp|" - # Prepare for autoconfig. # # See https://developer.mozilla.org/en-US/Firefox/Enterprise_deployment @@ -228,12 +225,11 @@ stdenv.mkDerivation rec { cat >mozilla.cfg <<EOF // First line must be a comment - // Always update via Nixpkgs - lockPref("app.update.auto", false); - lockPref("app.update.enabled", false); - lockPref("extensions.update.autoUpdateDefault", false); - lockPref("extensions.update.enabled", false); - lockPref("extensions.torbutton.versioncheck_enabled", false); + // Reset pref that captures store paths. + clearPref("extensions.xpiState"); + + // Stop obnoxious first-run redirection. + lockPref("noscript.firstRunRedirection", false); // User should never change these. Locking prevents these // values from being written to prefs.js, avoiding Store @@ -241,12 +237,6 @@ stdenv.mkDerivation rec { lockPref("extensions.torlauncher.torrc-defaults_path", "$TBB_IN_STORE/TorBrowser/Data/Tor/torrc-defaults"); lockPref("extensions.torlauncher.tor_path", "$TBB_IN_STORE/TorBrowser/Tor/tor"); - // Reset pref that captures store paths. - clearPref("extensions.xpiState"); - - // Stop obnoxious first-run redirection. - lockPref("noscript.firstRunRedirection", false); - // Insist on using IPC for communicating with Tor // // Defaults to creating \$XDG_RUNTIME_DIR/Tor/{socks,control}.socket @@ -269,18 +259,12 @@ stdenv.mkDerivation rec { ''} EOF - # Hard-code path to TBB fonts; see also FONTCONFIG_FILE in - # the wrapper below. + # FONTCONFIG_FILE is required to make fontconfig read the TBB + # fonts.conf; upstream uses FONTCONFIG_PATH, but FC_DEBUG=1024 + # indicates the system fonts.conf being used instead. FONTCONFIG_FILE=$TBB_IN_STORE/fontconfig/fonts.conf sed -i "$FONTCONFIG_FILE" \ - -e "s,<dir>fonts</dir>,<dir>$TBB_IN_STORE/fonts</dir>," - - # Preload extensions by moving into the runtime instead of storing under the - # user's profile directory. - # See https://support.mozilla.org/en-US/kb/deploying-firefox-with-extensions - mkdir -p "$TBB_IN_STORE/distribution/extensions" - mv "$TBB_IN_STORE/TorBrowser/Data/Browser/profile.default/extensions/"* \ - "$TBB_IN_STORE/distribution/extensions" + -e "s,<dir>fonts</dir>,<dir>$TBB_IN_STORE/fonts</dir>," # Hard-code paths to geoip data files. TBB resolves the geoip files # relative to torrc-defaults_path but if we do not hard-code them @@ -291,156 +275,20 @@ stdenv.mkDerivation rec { GeoIPv6File $TBB_IN_STORE/TorBrowser/Data/Tor/geoip6 EOF - WRAPPER_LD_PRELOAD=${lib.optionalString (useHardenedMalloc == true) - "${graphene-hardened-malloc}/lib/libhardened_malloc.so"} - - WRAPPER_XDG_DATA_DIRS=${lib.concatMapStringsSep ":" (x: "${x}/share") [ - gnome.adwaita-icon-theme - shared-mime-info - ]} - WRAPPER_XDG_DATA_DIRS+=":"${lib.concatMapStringsSep ":" (x: "${x}/share/gsettings-schemas/${x.name}") [ - glib - gsettings-desktop-schemas - gtk3 - ]}; - - # Generate wrapper mkdir -p $out/bin - cat > "$out/bin/tor-browser" << EOF - #! ${runtimeShell} - set -o errexit -o nounset - - PATH=${lib.makeBinPath [ coreutils ]} - export LC_ALL=C - export LOCALE_ARCHIVE=${glibcLocales}/lib/locale/locale-archive - - # Enter local state directory. - REAL_HOME=\''${HOME%/} - TBB_HOME=\''${TBB_HOME:-''${XDG_DATA_HOME:-\$REAL_HOME/.local/share}/tor-browser} - HOME=\$TBB_HOME - - mkdir -p "\$HOME" - cd "\$HOME" - - # Initialize empty TBB local state directory hierarchy. We - # intentionally mirror the layout that TBB would see if executed from - # the unpacked bundle dir. - mkdir -p "\$HOME/TorBrowser" "\$HOME/TorBrowser/Data" - - # Initialize the Tor data directory. - mkdir -p "\$HOME/TorBrowser/Data/Tor" - - # TBB will fail if ownership is too permissive - chmod 0700 "\$HOME/TorBrowser/Data/Tor" - - # Initialize the browser profile state. - # All files under user's profile dir are generated by TBB. - mkdir -p "\$HOME/TorBrowser/Data/Browser/profile.default" - - # Clear some files if the last known store path is different from the new one - : "\''${KNOWN_STORE_PATH:=\$HOME/known-store-path}" - if ! [ "\$KNOWN_STORE_PATH" -ef $out ]; then - echo "Cleanup files with outdated store references" - ln -Tsf $out "\$KNOWN_STORE_PATH" - - # Clear out some files that tend to capture store references but are - # easily generated by firefox at startup. - rm -f "\$HOME/TorBrowser/Data/Browser/profile.default"/{addonStartup.json.lz4,compatibility.ini,extensions.ini,extensions.json} - rm -f "\$HOME/TorBrowser/Data/Browser/profile.default"/startupCache/* - fi - - # XDG - : "\''${XDG_RUNTIME_DIR:=/run/user/\$(id -u)}" - : "\''${XDG_CONFIG_HOME:=\$REAL_HOME/.config}" - - ${lib.optionalString pulseaudioSupport '' - # Figure out some envvars for pulseaudio - : "\''${PULSE_SERVER:=\$XDG_RUNTIME_DIR/pulse/native}" - : "\''${PULSE_COOKIE:=\$XDG_CONFIG_HOME/pulse/cookie}" - ''} - - # Font cache files capture store paths; clear them out on the off - # chance that TBB would continue using old font files. - rm -rf "\$HOME/.cache/fontconfig" - # Manually specify data paths (by default TB attempts to create these in the store) - { - echo "user_pref(\"extensions.torlauncher.toronionauthdir_path\", \"\$HOME/TorBrowser/Data/Tor/onion-auth\");" - echo "user_pref(\"extensions.torlauncher.torrc_path\", \"\$HOME/TorBrowser/Data/Tor/torrc\");" - echo "user_pref(\"extensions.torlauncher.tordatadir_path\", \"\$HOME/TorBrowser/Data/Tor\");" - } >> "\$HOME/TorBrowser/Data/Browser/profile.default/prefs.js" - - # Lift-off - # - # XAUTHORITY and DISPLAY are required for TBB to work at all. - # - # DBUS_SESSION_BUS_ADDRESS is inherited to avoid auto-launch; to - # prevent that, set it to an empty/invalid value prior to running - # tor-browser. - # - # PULSE_SERVER is necessary for audio playback. - # - # Setting FONTCONFIG_FILE is required to make fontconfig read the TBB - # fonts.conf; upstream uses FONTCONFIG_PATH, but FC_DEBUG=1024 - # indicates the system fonts.conf being used instead. - # - # XDG_DATA_DIRS is set to prevent searching system dirs (looking for .desktop & icons) - exec env -i \ - LD_PRELOAD=$WRAPPER_LD_PRELOAD \ - \ - TZ=":" \ - TZDIR="\''${TZDIR:-}" \ - LOCALE_ARCHIVE="\$LOCALE_ARCHIVE" \ - \ - TMPDIR="\''${TMPDIR:-/tmp}" \ - HOME="\$HOME" \ - XAUTHORITY="\''${XAUTHORITY:-\$HOME/.Xauthority}" \ - DISPLAY="\''${DISPLAY:-}" \ - DBUS_SESSION_BUS_ADDRESS="\''${DBUS_SESSION_BUS_ADDRESS:-unix:path=\$XDG_RUNTIME_DIR/bus}" \\ - \ - XDG_DATA_HOME="\$HOME/.local/share" \ - XDG_DATA_DIRS="$WRAPPER_XDG_DATA_DIRS" \ - \ - PULSE_SERVER="\''${PULSE_SERVER:-}" \ - PULSE_COOKIE="\''${PULSE_COOKIE:-}" \ - \ - MOZ_ENABLE_WAYLAND="\''${MOZ_ENABLE_WAYLAND:-}" \ - WAYLAND_DISPLAY="\''${WAYLAND_DISPLAY:-}" \ - XDG_RUNTIME_DIR="\''${XDG_RUNTIME_DIR:-}" \ - XCURSOR_PATH="\''${XCURSOR_PATH:-}" \ - \ - APULSE_PLAYBACK_DEVICE="\''${APULSE_PLAYBACK_DEVICE:-plug:dmix}" \ - \ - TOR_SKIP_LAUNCH="\''${TOR_SKIP_LAUNCH:-}" \ - TOR_CONTROL_HOST="\''${TOR_CONTROL_HOST:-}" \ - TOR_CONTROL_PORT="\''${TOR_CONTROL_PORT:-}" \ - TOR_CONTROL_COOKIE_AUTH_FILE="\''${TOR_CONTROL_COOKIE_AUTH_FILE:-}" \ - TOR_CONTROL_PASSWD="\''${TOR_CONTROL_PASSWD:-}" \ - TOR_SOCKS_HOST="\''${TOR_SOCKS_HOST:-}" \ - TOR_SOCKS_PORT="\''${TOR_SOCKS_PORT:-}" \ - \ - FONTCONFIG_FILE="$FONTCONFIG_FILE" \ - \ - LD_LIBRARY_PATH="$libPath" \ - \ - "$TBB_IN_STORE/firefox" \ - --class "Tor Browser" \ - -no-remote \ - -profile "\$HOME/TorBrowser/Data/Browser/profile.default" \ - "\''${@}" - EOF - chmod +x $out/bin/tor-browser + makeWrapper "$TBB_IN_STORE/firefox" "$out/bin/tor-browser" \ + --prefix LD_PRELOAD : "${lib.optionalString (useHardenedMalloc == true) + "${graphene-hardened-malloc}/lib/libhardened_malloc.so"}" \ + --prefix LD_LIBRARY_PATH : "$libPath" \ + --set FONTCONFIG_FILE "$FONTCONFIG_FILE" \ + --set-default MOZ_ENABLE_WAYLAND 1 # Easier access to docs mkdir -p $out/share/doc ln -s $TBB_IN_STORE/TorBrowser/Docs $out/share/doc/tor-browser - # Install .desktop item - mkdir -p $out/share/applications - cp $desktopItem/share/applications"/"* $out/share/applications - sed -i $out/share/applications/torbrowser.desktop \ - -e "s,Exec=.*,Exec=$out/bin/tor-browser," \ - -e "s,Icon=.*,Icon=tor-browser," + # Install icons for i in 16 32 48 64 128; do mkdir -p $out/share/icons/hicolor/''${i}x''${i}/apps/ ln -s $out/share/tor-browser/browser/chrome/icons/default/default$i.png $out/share/icons/hicolor/''${i}x''${i}/apps/tor-browser.png @@ -451,8 +299,7 @@ stdenv.mkDerivation rec { LD_LIBRARY_PATH=$libPath $TBB_IN_STORE/TorBrowser/Tor/tor --version >/dev/null echo "Checking tor-browser wrapper ..." - TBB_HOME=$(mktemp -d) \ - $out/bin/tor-browser --version >/dev/null + $out/bin/tor-browser --version >/dev/null runHook postBuild ''; |