Repository navigation
The browser image carries the texts of Firefox's licences, not only the pointer to them - #518
Merged
Merged
Conversation
Firefox's top-level LICENSE says only to see toolkit/content/license.html, and source_licences took top-level files alone, so the image's licence directory held a pointer to a path in the source tree. license.html holds the texts of everything Firefox carries (its about:license): the licences row takes it too, and fails if it is not there.
…ge-chain fixes, browser.accepted, the mirrors, 4096-byte image blocks
…h kryptikd's and the proxy's make images passes KRYPTIK_STICK_BIN through CHROOT_ENV like the other two Rust binaries, but only those two were cleared for an image's chroot. With it set, as in one `make system images` naming all three, stage 03 would make /kryptik-stick in the image's overlay to bind the binary over, and tools/check-image-tree.sh refuses that file as one outside /usr: its mount points name kryptikd's and the proxy's alone. CI's images job runs `make -o system images` without the variable, so no run met it. 04-images.sh is among every image's inputs, so this rebuilds each image once.
DevomB
marked this pull request as ready for review
October 15, 2026 16:33
… images' /usr through a descriptor opened as host root
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What was wrong
Firefox's top-level
LICENSEcontains only a pointer: "Please see the file toolkit/content/license.html for the copyright licensing conditions attached to this codebase, including copies of the licenses concerned."source_licencestakes a tarball's top-level licence files, so the browser image's/usr/share/licenses/firefox/held that pointer to a path in the source tree and none of the texts.check-image-licences.shpassed, because it asks only that the directory has files. The texts did ship, but only insideomni.jaas about:license.Separately,
make imagespassesKRYPTIK_STICK_BINthroughCHROOT_ENVlike the other two Rust binaries, but04-images.shcleared only kryptikd's and the proxy's for an image's chroot. With it set, as in onemake system imagesnaming all three, stage 03 would make/kryptik-stickin the image's overlay to bind the binary over.tools/check-image-tree.shrefuses that file as one outside/usr, because its mount points name kryptikd's and the proxy's alone. CI's images job runsmake -o system imageswithout the variable, so no run met it.What changed
s_browser_licencespassessource_licencesthe pattern^[^/]+/toolkit/content/license\.html$, which is what its pattern argument is for. This puts the texts, 100 licences and about 340 KB, at/usr/share/licenses/firefox/toolkit/content/license.html. The row then checks the file is there and not empty, so a later ESR that moves it fails the row instead of shipping the pointer alone.04-images.shnow enters each image's chroot withKRYPTIK_STICK_BIN=cleared as well. This is its own commit.When it lands
With the browser batch, as one extra on its push. The branch merges 9d540a3, the batch as it lands. If the batch head moves, the new head is merged again.
build/images/browser.shis an input of the browser image, and04-images.shis an input of every image, so the push's run rebuilds each image once, Firefox included (about 3 h). It must land before any release that ships the browser.How checked
LICENSEatFIREFOX_153_5_0esr_RELEASEis the pointer above, andtoolkit/content/license.htmlis 341,861 bytes, with 100 licences (oneh1each) among its 141 headings.licence_members' default,source_licences' own additions and this one) matchedfirefox-153.5.0/LICENSEandfirefox-153.5.0/toolkit/content/license.html. It rejectedlicense.html.origand a nestedtoolkit/content/license.html.bash -npasses on both files. The licence file is installed 0644, sobrowser.programsis unaffected.CHROOT_ENVpasses (Makefile), and stage 03 binds only a variable that is set (03-chroot-prep.sh).