eric wroteSee commit github

# Disable crypto hardening settings for now

+//pref("security.tls.unrestricted_rc4_fallback", false);
+//pref("security.tls.insecure_fallback_hosts.use_static_list", false);
+//pref("security.tls.version.min", 1);
+//pref("security.ssl3.rsa_rc4_128_sha", false);
+//pref("security.ssl3.rsa_rc4_128_md5", false);
+//pref("security.ssl3.rsa_des_ede3_sha", false);
+//pref("security.ssl3.ecdhe_ecdsa_rc4_128_sha", false);
+//pref("security.ssl3.ecdhe_rsa_rc4_128_sha", false);
+//pref("security.ssl3.rsa_rc4_128_sha", false);
+//pref("security.ssl3.rsa_rc4_128_md5", false);
+//pref("security.ssl3.rsa_des_ede3_sha", false);
+//pref("security.ssl3.ecdhe_ecdsa_rc4_128_sha", false);
+//pref("security.ssl3.ecdhe_rsa_rc4_128_sha", false);
[omitted]

Woah! What?! Wtf?! No, NO, NO!

parabola bug 842 wrote facebook.com website is not working correctly

DId parabola SERIOUSLY enable WEAK ciphers over facebook failing?!
Have they lost their mind? Was someone there drinking to many?!
This isn't icecats fault, some sites do have weak ciphers and it should NEVER be enabled!!
https://blog.mozilla.org/security/2015/09/11/deprecating-the-rc4-cipher/
https://directory.fsf.org/wiki/Disable_DHE

I'm going to test it over the weekend but I'm commenting OUT and removing that patch, and you should too.
As a alternative, remove the patch and make a post about the parabola bug then leave an option for people to disable it themselves,
If users want to fuck themselves over that would be their choice.

Theres also this...
https://addons.mozilla.org/en-US/firefox/addon/enable-disable-weak-ssl-cip/
https://addons.mozilla.org/en-US/firefox/addon/toggle-cipher-suites/?src=search

eric wrotei don't use facebook lol

I don't either which is also the point I was insisting lol. Furthermore I don't trust the cdn that they are harping about (akamaihd.net) which [fail]book primarily uses. firefox addon called Decentraleyes takes care of that though.

eric wroteif it touch a large site like this that the patch is needed.

There is absolutely no damn reason why they disabled the hardening in the first place, because if you go through the mailing list discussion.The issue wasn't about all those ciphers it was because of mozillas Online Certificate Status Protocol (OCSP) requirement and even then that shouldn't of been disabled by default. For shame, parabola.

eric wroteSo i will make the change.

Thanks :), security is one thing I will *never* slip pass. (especially if its called "disable-security-ciphers" lol, nope)

eric wroteAnyway i pushed it on obarun_testing, because some patch was added on it, need deeply test

==> Finished making: icecat 38.7.1-2 (Sat Apr 16 17:24:33 [XXX] 2016)
==> Installing package icecat with pacman -U...
loading packages...
resolving dependencies...
looking for conflicting packages...

Packages (1) icecat-38.7.1-2

Total Installed Size:  92.57 MiB

:: Proceed with installation? [Y/n] Y
(1/1) checking keys in keyring                     [# #####################] 100%
(1/1) checking package integrity                   [# #####################] 100%
(1/1) loading package files                        [# #####################] 100%
(1/1) checking for file conflicts                  [# #####################] 100%
(1/1) checking available disk space                [# #####################] 100%
:: Processing package changes...
(1/1) installing icecat                            [# #####################] 100%
Optional dependencies for icecat
    networkmanager: Location detection via available WiFi networks
    gst-plugins-good: h.264 video
    gst-libav: h.264 video
    upower: Battery API
==> Removing installed dependencies...
checking dependencies...

Packages (2) imake-1.0.7-1  yasm-1.3.0-1

Total Removed Size:  4.92 MiB

:: Do you want to remove these packages? [Y/n] Y
:: Processing package changes...
(1/2) removing yasm                                [# #####################] 100%
(2/2) removing imake                               [# #####################] 100%
taco@ zen icecat % 

warning: ignoring package replacement (icecat-38.7.1-2 => icecat-bin-38.7.1-1)
warning: icecat: local (38.7.1-2) is newer than obarun (38.4.0-1)
 there is nothing to do

Icecat from the obarun-testing git compiled fine. Can you replace the old icecat from the obarun repo with a binary from the testing git, add a signature to it and remove icecat-bin? Please :)

Note: sorry for necromancing I'll move this post to a different thread if you want
For the next icecat release (since it would need to be repacked anyway (see: icu hell) ) I propose a feature request: Disable dbus and necko-wifi (a bastard child of dbus) :). This of course would have to go into obarun-testing before moving it to the main repo, But I'd be more than glad to test it. As far as I can see dbus is useless, as seen on mozillas wiki for modules dbus (0) relies on bluetooth and necko-wifi relies on geolocation (1) (bad for security)

This can be done by adding this to mozconfig:

ac_add_options --disable-necko-wifi
ac_add_options --disable-dbus

The reason for this is that I would prefer dbus to dependent on the absolute minimum (or at best, Not at all!)

(0) https://wiki.mozilla.org/Modules/All# Firefox
(1) http://www.linuxfromscratch.org/blfs/view/svn/xsoft/firefox.html

eric wroteAgree with your post, i will test it as soon as possible

Awesome! Thanks for your support :)

eric wrotenote : the last glibc break the compilation for the old package too

Can you post any specific errors??

Update: I went along with trying to build it and of course it failed.
This is what I got [0]

Update2: gcc5 from the aur failed for me(*) ;_; not going to try gcc49 yet gcc{47,49} aiso failed...If I haven't expressed how much i hate gcc6. well, Its the worst thing I have ever fucking delt with. I fucking hate it.


I can bet money the reason why we had no issues building 38.7 is that icecat was built with gcc 5.x at the time. But this time it is building/failing with gcc 6.1 and the annoying part is that it's been a bug for 4 months and it seems the devs [1] put off [2] fixing it [3] aarrgghh! [4][5]. Which leads me to believe GCC 6 is probably so buggy right now that no one seems to know why. Although I didn't notice anything about glibc, I might have missed it if it presented itself.

It doesn't even look like they made a changelog yet [6] so I'm guessing its still in testing

Edit: I have a bad feeling about this [7]

Jonathan Wakely 2016-01-22 12:56:16 UTC wrote Specifically, if you build GCC against glibc before https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=d9b965fa56350d6eea9f7f438a0714c7ffbb183f and then update glibc to a snapshot of 2.22 from git master after that commit, libstdc++ will not work.

Edit: It appears more programs are having issues with gcc 6, like palemoon (a fork of firefox) [8] and cataclysm-dda. [9] Does this happen alot with arch? because its starting to really piss me off.

[0] https://ghostbin.com/paste/ac2zw/raw
[1] https://lists.gnu.org/archive/html/bug-gnuzilla/2016-01/msg00043.html
[2] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=69581
[3] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=69383
[4] https://bugzilla.redhat.com/show_bug.cgi?id=1306553
[5] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=822716
[6] https://savannah.gnu.org/news/?group_id=7880
[7] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=69413# c2
[8] https://forum.palemoon.org/viewtopic.php?t=12045&p=84788
[9] https://github.com/CleverRaven/Cataclysm-DDA/issues/16576

P.S Theres only 2 distributions that have gcc 6, fedora rawhide and archlinux. Everyone else has gcc 5.x
I have a theory, because gcc 6 is so unstable not even gentoo has touched it yet.

References:
https://gcc.gnu.org/gcc-6/porting_to.html
https://news.ycombinator.com/item?id=11181742
https://bbs.archlinux.org/viewtopic.php?id=208023
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=69881
https://www.phoronix.com/scan.php?page=news_item&px=GCC6-Misleading-Indentation
(*)http://stackoverflow.com/questions/5216399/usr-lib-libstdc-so-6-version-glibcxx-3-4-15-not-found

eric wroteBTW. parabola seem to build the new version with gcc 6

The key word here is seem[ed], It is not known whether they compiled it with gcc 6, 5 or 4 but that also makes me eager to contact the last maintainer to find out how he compiled it and or with what version of gcc and why he orphaned the package.

eric wrote the last glibc break the compilation for the old package too written error

Do you see the theme here? It isn't glibc, all of the bug reports I've posted lead to either gcc or gcc-libs *not* glibc
Like this one for instance: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=69581

taco@ zen ~ % pacman -Qo /usr/lib/libstdc++.so
/usr/lib/libstdc++.so is owned by gcc-libs 6.1.1-1

eric wroteMaybe the issue come from obarun system.... i doubt

As you said 'obarun isn't arch', However the problem IS coming from arch and fedora as they made the choice of pushing the updates straight from git, VERY bad idea. Their decision has made new bugs even MORE prominent and just look at whats happening now! ARGH. I wanted to use arch NOT fedora, fedora is known to do this shit.

eric wroteTaking a git release, grrrr, i don't like this ...

eric wrotefor me it is not gcc6 that i hate, but this kind of package

It would have been fine if it was just icecat, but no, It is also IceApe, WxPython, cataclysm-dda and even more. Hell anything that relies on stdlib.h is absolutely fucked. and all I get from researching it is "Try GCC 4.9" or the classic "It will be fixed in the NEXT version". If you disagree, Prove me wrong. The only way I can fathom why everything isn't becoming utterly broken is that the devs precompile the packages with a different version of gcc.

eric wroteCompilation take almost the same time that a kernel

That's because it takes more time for gcc6 to shit out more warnings and errors, than it does actually compiling it. It *didn't* have this problem on gcc 5.

eric wrotei will try to compile the gcc package with the last commit

I commend you for your efforts/work and believe me when you read this, I'm not mad at you. I'm simply venting/mad at poor execution from arch that affects obarun, because let me repeat- gentoo doesn't even list gcc 6 as a testing package, they haven't even made it a priority to test. That's really REALLY bad. Void for instance has compiled the latest icecat, why? because they have gcc 4.9

To seal the fate of my trust for arch, This the answer a Arch Trusted User gave when asked if it is possible to use Gcc 4.9, The OP had the same exact F!@ # $ing issue.

Xyne (0) wrote A rolling release distro is not suitable for your needs. You should consider using something else for work. If you have a work computer then remove Arch and put whatever you actually need on it. If you don't have a work computer or need to keep Arch on the work computer, dual boot or use system virtualization. Keep a fully updated Arch host system and a nested build system.

https://bbs.archlinux.org/viewtopic.php?pid=1598675# p1598675
Therefore according to Xyne, Arch is the least applicable option for production. Which is the complete opposite of what I thought it was at first.

Would arch apply fedoras patch [1] for gcc6 so it doesn't suck ass? Allan says "No." [1]

wdirksen wrote
Allan,
Will you be updating the gcc related Arch packages with this or other solution?

Allan wrote Why would I?  gcc is not broken...

Yes, the SAME Allan that made propaganda for systemd, the same person that thought keysigning wasn't an issue back in 2011 and now he is using the "But it works for me(TM)" bullshit excuse. Honestly, fuck him.
http://allanmcrae.com/2012/08/are-we-removing-what-defines-arch-linux/
https://igurublog.wordpress.com/2011/03/24/lwn-picks-up-on-package-signing/

When I wrote in the other thread and I quote

bit wrotePretty much debating if I should just replace obarun with void unless gcc fixes their shit real fast, which they most likely won't.

I wasn't even remotely kidding. Arch did this. Not you.
[0] http://pkgs.fedoraproject.org/cgit/rpms/flann.git/tree/flann-1.8.4-gcc6.patch
[1] https://bbs.archlinux.org/viewtopic.php?pid=1626161# p1626161

eric wrote I hope you're wrong about this thought

UPDATE Trust for arch developers (except eric ;)): Completely gone. (see below)
E-Mail sent

Mime-Version: 1.0
Date: Wed, 18 May 2016 23:08:58 +0000
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Message-ID: <3142ea709e2eb81317d75deb5f42cd4d@ mail.teknik.io>
X-Mailer: [Omitted]
From: bit@ teknik.io
Subject: GNU IceCat compilation
To: emulatorman@ riseup.net

Hello Andr=C3=A9 Silva, =0AI've noticed that you're the last packager for=
 GNU Icecat from Parabola GNU/Linux [0] and would like to ask you a few q=
uestions, First I'll briefly explain my dilemma. I've tried to compile GN=
U IceCat on Arch Linux from source with makepkg, gcc 6.1.1 (20160501), an=
d the source files provided by Parabola [1]. But unfortunately IceCat fai=
ls to build [2].=0APresently I've only found several bug reports[3][4][5]=
[6][7][8] about the compile errors, However none of them are fruitful nor=
 have any indication as to when it will be fixed. My question to you is t=
his, How did you compile it? Did you have to do anything differently? Or =
did you use a previous version of gcc? =0A=0AI'll be patiently awaiting y=
our reply, -b=0A=0A[0] https://www.parabola.nu/packages/libre/x86_64/icec=
at/=0A[1] https://projects.parabola.nu/abslibre.git/tree/libre/icecat=0A[=
2] https://ghostbin.com/paste/ac2zw/raw=0A[3] https://lists.gnu.org/archi=
ve/html/bug-gnuzilla/2016-01/msg00043.html=0A[4] https://bugzilla.redhat.=
com/show_bug.cgi?id=3D1306553=0A[5] https://gcc.gnu.org/bugzilla/show_bug=
.cgi?id=3D69383=0A[6] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D6958=
1=0A[7] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D69413=0A[8] https:=
//bugs.debian.org/cgi-bin/bugreport.cgi?bug=3D822716

Reply from developer

André Silva wrote I built it with a previous version of gcc and gcc-libs, in that time,
Parabola had gcc-5.3.0-5 and gcc-libs-5.3.0-5. [0]

That's it, going to dual boot with void.... SIGH

Note: Won't have any time to test s6 thanks to this shit. but s6 is a great concept :)

[0] https://zerobin.net/?31833e9deaf8b531# v32Yx6R4KpDsRJQulRdDut78R+9yqNTf9Cfl3Ao/oEw= (expires in 6 days from the time of this writing)

eric wroteSo i have tested to downgrade gcc6 to gcc5.3.0-5 and glibc to glibc-2.23-2, normaly libstdc do not need to downgrade. The compilation fail and other compilation like runit-obarun fail. I need to test with clang, llvm-libs downgraded too.

icecat fails with gcc 4.9.2, although I'm not sure if that was just a bad mix of versions from dependencies. However! I can confirm that icecat will compile with gcc 5.2.0! But you need to downgrade to these package versions for it to work.

binutils-2.25.1-2  clang-3.7.0-4  gcc-5.2.0-2  gcc-libs-5.2.0-2
glibc-2.22-1  hunspell-1.3.3-2  lib32-gcc-libs-5.2.0-2(*)
lib32-glibc-2.22-1(*)  llvm-libs-3.7.0-4 

* = Needed if you already have it

Note: I haven't tested restarting xorg with the downgraded packages, so also downgrading opencl-mesa-nosystemd to at least 11.1.1-1 is suggested, but I think it will be ok without needing to do so :)


I didn't compile it with gcc 5.3, only because I *assumed* it wouldn't work based on your experience. But I think aligning the dependency versions to gcc 5.3 might work. However I strongly recommend to use gcc 5.2 for now and follow CRUX's gcc versions later on. (which the dependency versions presented above are practically the same as CRUX anyway..)
CRUX's rss: https://crux.nu/rss.php

Fun Fact: Arch Linux is loosely based on crux :)

==> Tidying install...
  -> Removing libtool files...
  -> Purging unwanted files...
  -> Removing static library files...
  -> Stripping unneeded symbols from binaries and libraries...
  -> Compressing man and info pages...
==> Checking for packaging issue...
==> Creating package "icecat"...
  -> Generating .PKGINFO file...
  -> Generating .BUILDINFO file...
  -> Adding install file...
  -> Generating .MTREE file...
  -> Compressing package...
==> Leaving fakeroot environment.
==> Finished making: icecat 38.8.0-3 (Thu May 19 19:34:36 CDT 2016)
==> Cleaning up...
==> Removing installed dependencies...

taco@ zen gcc5 % ls
icecat-38.8.0-3-x86_64.pkg.tar.xz # ;)

eric wrotelast version of icecat available on testing repo.

Installed, Works like a charm. Thanks again eric :)

Edit: Please repackage without dbus-glib dependency! [0]

[0] https://github.com/Obarun/obarun-pkgbuild-testing/blob/master/icecat/PKGBUILD# L20 404'd (Archived here:https://archive.is/aRzcM# 20%)

For instance this is from *my* pkgbuild and pkg.tar.xz

taco@ zen gcc5 % cat ../PKGBUILD| grep depends
depends=('gtk2' 'mozilla-common' 'libxt' 'startup-notification' 'mime-types'
makedepends=('unzip' 'zip' 'diffutils' 'python2' 'yasm' 'mesa' 'imake'
optdepends=('networkmanager: Location detection via available WiFi networks'
taco@ zen gcc5 % pacman -Qi --file icecat-38.8.0-3-x86_64.pkg.tar.xz | grep Depends 
Depends On      : gtk2  mozilla-common  libxt  startup-notification  mime-types  alsa-lib  desktop-file-utils  hicolor-icon-theme  libvpx  icu  libevent  nss  hunspell  sqlite  pango  freetype2  libxft  libx11

Notice how dbus-glib isn't in mine :)

P.S Stop scaring me, eric. lol

Update: 6/20/16
IceCat needs to rebuilt with gcc 5 and the latest hunspell (at the time of this post: 1.4.1-1)

taco@ zen ~ % icecat
XPCOMGlueLoad error for file /usr/lib/icecat/libxul.so:
libhunspell-1.3.so.0: cannot open shared object file: No such file or directory
Couldn't load XPCOM.
taco@ zen [255] ~ %

Update: Wed Jun 29 00:50:08 UTC 2016
Good news,It looks like parabola devs have patched around the gcc6 issue 6~ days ago (at the time of this post) [0]
Based on two bug reports from archlinux :)

GNU/Icecat commit wrote* GCC6 is not officially supported and lot of patches have been added.

I strongly suggest to backport the patches. [1] [2] and possibly the harfbuzz [3] [4] and install dir [5] patches.

I will test this in a few days (without dbus, pulseaudio and the disable-crypto-hardening-settings.patch of course ^^).

[0] gcc6-fix-compilation-for-IceCat.patch message
[1] gcc6-fix-compilation-for-IceCat.patch
[2] firefox-gcc-6.0.patch
[3] harfbuzz-1.1.3.patch
[4] mozilla-1228540-1.patch
[5] icecat-install-dir.patch

Update: Fri Jul 1 02:11:52 UTC 2016
Icecat successfully builds with GCC 6 from the patches provided by parabola!

==> Tidying install...
  -> Removing empty directories...
  -> Removing libtool files...
  -> Purging unwanted files...
  -> Removing static library files...
  -> Stripping unneeded symbols from binaries and libraries...
  -> Compressing man and info pages...
==> Checking for packaging issue...
==> Creating package "icecat"...
  -> Generating .PKGINFO file...
  -> Generating .BUILDINFO file...
  -> Adding install file...
  -> Generating .MTREE file...
  -> Compressing package...
==> Creating package "icecat-debug"...
  -> Generating .PKGINFO file...
  -> Generating .BUILDINFO file...
  -> Generating .MTREE file...
  -> Compressing package...
==> Leaving fakeroot environment.
==> Finished making: icecat 38.8.0_gnu2-1 (Thu Jun 30 21:00:43 CDT 2016)
==> Cleaning up...
==> Removing installed dependencies...
checking dependencies...

Packages (2) imake-1.0.7-1  yasm-1.3.0-1

Total Removed Size:  4.92 MiB

:: Do you want to remove these packages? [Y/n] Y
:: Processing package changes...
(1/2) removing yasm                                                 [# #####################################] 100%
(2/2) removing imake                                                [# #####################################] 100%
:: Running post-transaction hooks...
(1/1) Purging old manpage index entries...
taco@ zen IceCat-Parabola % gcc --version
gcc (GCC) 6.1.1 20160602
Copyright (C) 2016 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

There's a few changes I made to the PKGBUILD here, you can compare it with the one provided by parabola.

icecat needs to be rebuilt with libvpx 1.6.0 otherwise it will fail to start. Please make that change.


Also icecat.install is now redundant since it compiles with gcc6 [0]

post_install() {
  cat <<MSG
>>> This package fail to build with gcc6.
	It was build with this toolchain :
	binutils-2.26-3  gcc-5.3.0-5  gcc-libs-5.3.0-5 
	glibc-2.23-1 llvm-3.7.1-1 llvm-libs-3.7.1-1 clang-3.7.1-1
MSG
}

[0] https://github.com/Obarun/obarun-pkgbuild/blob/master/icecat/icecat.install