diff mbox series

[bug#68577,2/2] gnu: Add mullvad-browser.

Message ID 174f8492bd3c72fa1bd186ee29e66eb837684768.1705619435.git.clement@lassieur.org
State New
Headers show
Series gnu: Add Mullvad Browser. | expand

Commit Message

Clément Lassieur Jan. 18, 2024, 11:19 p.m. UTC 
* gnu/packages/tor.scm (%mullvadbrowser-version,
%mullvadbrowser-firefox-version, %mullvadbrowser-locales,
translation-mullvad-browser, mullvadbrowser-assets, mullvadbrowser-base,
mullvadbrowser): New variables.

Change-Id: Ie6d48823b3794710f60f0ae201a0297925221f66
---
 gnu/packages/tor.scm | 131 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 131 insertions(+)

Comments

Mark H Weaver Jan. 22, 2024, 5:57 a.m. UTC | #1 
Hi Clément,

Clément Lassieur <clement@lassieur.org> writes:

> +(define-public mullvadbrowser-assets
> +  ;; This is a prebuilt Mullvad Browser from which we take the assets we need.
> +  (package
> +    (name "mullvadbrowser-assets")
> +    (version %mullvadbrowser-version)
> +    (source
> +     (origin
> +       (method url-fetch)
> +       (uri
> +        (string-append
> +         "https://archive.torproject.org/tor-package-archive/mullvadbrowser/"
> +         version "/mullvad-browser-linux-x86_64-" version ".tar.xz"))
> +       (sha256
> +        (base32
> +         "1i7vf7cn6s5iajsp4999jpxxn8qblljrrmfs4nswmc2swdmi07gk"))))
> +    (arguments
> +     (list
> +      #:install-plan
> +      ''(("Browser" "." #:include-regexp
> +          ("^\\./fonts/"
> +           "^\\./fontconfig/fonts.conf"
> +           ;; Mullvad Browser Extension
> +           "^\\./distribution/extensions/\\{d19a89b9-76c1-4a61-bcd4-49e8de916403\\}.xpi"
> +           )))))
> +    (build-system copy-build-system)
> +    (home-page "https://www.torproject.org")
> +    (synopsis "Mullvad Browser assets")
> +    (description "This package contains fonts and configuration files for
> +Mullvad Browser.")
> +    (license license:silofl1.1)))

Guix packages should, wherever feasible, avoid using components from
pre-built binary distributions.  Each required font family should be
added as a separate Guix package following our conventions for font
packages.  As for the configuration files: how about distributing them
separately, or as part of the Mullvad source distribution?

      Thanks,
        Mark
Mark H Weaver Jan. 22, 2024, 6:15 a.m. UTC | #2 
Earlier, I wrote:
> Guix packages should, wherever feasible, avoid using components from
> pre-built binary distributions.  Each required font family should be
> added as a separate Guix package following our conventions for font
> packages.  As for the configuration files: how about distributing them
> separately, or as part of the Mullvad source distribution?

These comments apply to 'torbrowser-assets' as well, which I only just
found out about.

        Mark
Clément Lassieur Jan. 22, 2024, 10:33 a.m. UTC | #3 
On Mon, Jan 22 2024, Mark H Weaver wrote:

> Hi Clément,
>
> Clément Lassieur <clement@lassieur.org> writes:
>
>> +(define-public mullvadbrowser-assets
>> +  ;; This is a prebuilt Mullvad Browser from which we take the assets we need.
>> +  (package
>> +    (name "mullvadbrowser-assets")
>> +    (version %mullvadbrowser-version)
>> +    (source
>> +     (origin
>> +       (method url-fetch)
>> +       (uri
>> +        (string-append
>> +         "https://archive.torproject.org/tor-package-archive/mullvadbrowser/"
>> +         version "/mullvad-browser-linux-x86_64-" version ".tar.xz"))
>> +       (sha256
>> +        (base32
>> +         "1i7vf7cn6s5iajsp4999jpxxn8qblljrrmfs4nswmc2swdmi07gk"))))
>> +    (arguments
>> +     (list
>> +      #:install-plan
>> +      ''(("Browser" "." #:include-regexp
>> +          ("^\\./fonts/"
>> +           "^\\./fontconfig/fonts.conf"
>> +           ;; Mullvad Browser Extension
>> +           "^\\./distribution/extensions/\\{d19a89b9-76c1-4a61-bcd4-49e8de916403\\}.xpi"
>> +           )))))
>> +    (build-system copy-build-system)
>> +    (home-page "https://www.torproject.org")
>> +    (synopsis "Mullvad Browser assets")
>> +    (description "This package contains fonts and configuration files for
>> +Mullvad Browser.")
>> +    (license license:silofl1.1)))
>
> Guix packages should, wherever feasible, avoid using components from
> pre-built binary distributions.  Each required font family should be
> added as a separate Guix package following our conventions for font
> packages.

Not feasible in this case, because fonts are used for fingerprinting.
We need to make sure they are identical to upstream fonts.

We should do the same to Icecat by the way.

> As for the configuration files: how about distributing them
> separately, or as part of the Mullvad source distribution?

What's the issue?
Clément Lassieur Jan. 22, 2024, 11:41 a.m. UTC | #4 
On Mon, Jan 22 2024, Mark H Weaver wrote:

> Earlier, I wrote:
>> Guix packages should, wherever feasible, avoid using components from
>> pre-built binary distributions.  Each required font family should be
>> added as a separate Guix package following our conventions for font
>> packages.  As for the configuration files: how about distributing them
>> separately, or as part of the Mullvad source distribution?
>
> These comments apply to 'torbrowser-assets' as well, which I only just
> found out about.

As said in the other email, the way Icecat is handling fonts is very bad
for fingerprinting, and I believe we should either do it the Tor Browser
way or remove the part about Fingerprinting countermeasures there:
https://www.gnu.org/software/gnuzilla/.
diff mbox series

Patch

diff --git a/gnu/packages/tor.scm b/gnu/packages/tor.scm
index 6eb0c7609f0b..357b561874c7 100644
--- a/gnu/packages/tor.scm
+++ b/gnu/packages/tor.scm
@@ -879,3 +879,134 @@  (define-public torbrowser
                    #:assets torbrowser-assets
                    #:locales %torbrowser-locales
                    #:base-browser-version %torbrowser-version))
+
+;; To find the last version, look at
+;; https://mullvad.net/en/download/browser/linux.
+(define %mullvadbrowser-version "13.0.7")
+
+;; To find the last Firefox version, browse
+;; https://archive.torproject.org/tor-package-archive/mullvadbrowser/<%mullvadbrowser-version>
+;; There should be only one archive that starts with
+;; "src-firefox-mullvad-browser-".
+(define %mullvadbrowser-firefox-version "115.6.0esr-13.0-1-build1")
+
+;; Use the list in tor-browser-build/rbm.conf.
+(define %mullvadbrowser-locales
+  '("ar" "da" "de" "es-ES" "fa" "fi" "fr" "it" "ja" "ko" "my" "nb-NO" "nl"
+    "pl" "pt-BR" "ru" "sv-SE" "th" "tr" "zh-CN" "zh-TW"))
+
+;; See tor-browser-build/projects/translation/config.
+(define translation-mullvad-browser
+  (origin
+    (method git-fetch)
+    (uri (git-reference
+          (url "https://gitlab.torproject.org/tpo/translation.git")
+          (commit "57de1569da0e2c48fd999a13e555f6b522041993")))
+    (file-name "translation-mullvad-browser")
+    (sha256
+     (base32
+      "1q3979ac92c5mib573hx9w06x3hrfw7r52wzmj9r75sz2hhsmrq3"))))
+
+(define-public mullvadbrowser-assets
+  ;; This is a prebuilt Mullvad Browser from which we take the assets we need.
+  (package
+    (name "mullvadbrowser-assets")
+    (version %mullvadbrowser-version)
+    (source
+     (origin
+       (method url-fetch)
+       (uri
+        (string-append
+         "https://archive.torproject.org/tor-package-archive/mullvadbrowser/"
+         version "/mullvad-browser-linux-x86_64-" version ".tar.xz"))
+       (sha256
+        (base32
+         "1i7vf7cn6s5iajsp4999jpxxn8qblljrrmfs4nswmc2swdmi07gk"))))
+    (arguments
+     (list
+      #:install-plan
+      ''(("Browser" "." #:include-regexp
+          ("^\\./fonts/"
+           "^\\./fontconfig/fonts.conf"
+           ;; Mullvad Browser Extension
+           "^\\./distribution/extensions/\\{d19a89b9-76c1-4a61-bcd4-49e8de916403\\}.xpi"
+           )))))
+    (build-system copy-build-system)
+    (home-page "https://www.torproject.org")
+    (synopsis "Mullvad Browser assets")
+    (description "This package contains fonts and configuration files for
+Mullvad Browser.")
+    (license license:silofl1.1)))
+
+(define mullvadbrowser-base
+  (make-torbrowser #:moz-app-name "mullvadbrowser"
+                   #:moz-app-remotingname "Mullvad Browser"
+                   #:branding-directory "browser/branding/mb-release"
+                   #:assets mullvadbrowser-assets
+                   #:locales %mullvadbrowser-locales
+                   #:base-browser-version %mullvadbrowser-version))
+
+(define-public mullvadbrowser
+  (package
+    (inherit mullvadbrowser-base)
+    (name "mullvadbrowser")
+    (version %mullvadbrowser-version)
+    (source
+     (origin
+       (method url-fetch)
+       (uri
+        (string-append
+         "https://archive.torproject.org/tor-package-archive/mullvadbrowser/"
+         version "/src-firefox-mullvad-browser-"
+         %mullvadbrowser-firefox-version ".tar.xz"))
+       (sha256
+        (base32
+         "1hhmq0sh949vzs3mhh0pmpd2llgw149mv7kzzg2ylj8h2628y0px"))))
+    (arguments
+     (substitute-keyword-arguments (package-arguments mullvadbrowser-base)
+       ((#:phases phases)
+        #~(modify-phases #$phases
+            (add-after 'unpack 'ublock-private-allowed
+              (lambda _
+                (substitute* "toolkit/components/extensions/Extension.sys.mjs"
+                  ;; The code that gives the correct permission only applies to
+                  ;; distribution add-ons (see installDistributionAddon() in
+                  ;; XPIProvider.jsm).
+                  (("this.isNoScript")
+                   "this.isNoScript || this.id === \"uBlock0@raymondhill.net\""))))
+            ;; See tor-browser-build/projects/firefox/build.
+            (replace 'copy-torbrowser-locales
+              (lambda _
+                (for-each
+                 (lambda (lang)
+                   (system
+                    (format #f "cp -Lr ~a/~a .mozbuild/l10n-central/"
+                            #$translation-mullvad-browser lang)))
+                 '#$%mullvadbrowser-locales)))
+            (add-before 'build 'fix-profiles
+              ;; Otherwise the profile would change every time the install
+              ;; location changes, that is: at every package update.  These
+              ;; values are already the default values for Icecat and Tor
+              ;; Browser.
+              (lambda _
+                (substitute* "browser/moz.configure"
+                  (("\"MOZ_DEDICATED_PROFILES\", True")
+                   "\"MOZ_DEDICATED_PROFILES\", False")
+                  (("\"MOZ_BLOCK_PROFILE_DOWNGRADE\", True")
+                   "\"MOZ_BLOCK_PROFILE_DOWNGRADE\", False"))))
+            (add-after 'deploy-fonts 'deploy-extension
+              (lambda* (#:key inputs #:allow-other-keys)
+                (let ((lib (in-vicinity #$output "lib/mullvadbrowser")))
+                  ;; Mullvad Browser Extension (FIXME: package it)
+                  (copy-recursively
+                   (in-vicinity #$mullvadbrowser-assets "distribution")
+                   (in-vicinity lib "distribution")))))
+            (delete 'deploy-tor-assets)
+            (delete 'autoconfig-tor)))))
+    (inputs (package-inputs icecat-minimal))
+    (propagated-inputs
+     (list noscript/icecat
+           ublock-origin/icecat))
+    (synopsis "Privacy-focused browser")
+    (description "Mullvad Browser is a privacy-focused web browser designed to
+be used with a trustworthy VPN instead of the Tor Network.")))