sigprof / nur-packages Goto Github PK

for better visibility

http://nur.nix-community.org/

Hello!

I hope you are doing well!

We are a security research team. Our tool automatically detected a vulnerability in this repository. We want to disclose it responsibly. GitHub has a feature called Private vulnerability reporting, which enables security research to privately disclose a vulnerability. Unfortunately, it is not enabled for this repository.

Can you enable it, so that we can report it?

Thanks in advance!

PS: you can read about how to enable private vulnerability reporting here: https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository

The way the langpacks are currently installed, Firefox is unable to find them by default.

They get installed to share/mozilla/extensions/... as defined in

However, I believe the correct path for the applications to pick up the extensions automatically is lib/${mozAppName}/browser/extensions/${addonId}.xpi for the Firefox packages and lib/${mozAppName}/extensions/${addonId}.xpi for Thunderbird, so this requires some additional logic for the path. Please note that I haven't actually tried this, but rather deducted from the current filesystem layout and how other distributions do it.

Anyone looking for a temporary solution to have Firefox pick up this package automatically, a workaround is the following:

programs.firefox = {
  enable = true;
  package = pkgs.firefox;
  policies = {
    "ExtensionSettings" = {
      "[email protected]" = {
        "installation_mode" = "force_installed";
        "install_url" = "file:///run/current-system/sw/share/mozilla/extensions/{ec8030f7-c20a-464f-9b0e-13a3a9e97384}/[email protected]";
      };
    };
    "RequestedLocales" = "de,en-US";
  };
};

or, in a slightly more Nix way:

  programs.firefox.policies.ExtensionSettings."[email protected]" = {
          "installation_mode" = "force_installed";
          "install_url" = "file://${config.nur.repos.sigprof.firefox-langpack-de}/share/mozilla/extensions/{ec8030f7-c20a-464f-9b0e-13a3a9e97384}/[email protected]";
        };

The latter doesn't need a package in environment.systemPackages.

This will set your Firefox to German by default. However, this copies the xpi file to the respective profile instead of just using the one available on the system directly.