How to have updated firefox-esr in Chimaera?

rdav · 2021-10-22 08:53:28

Hi,

How is it possible to get firefox-esr from Ceres while running Chimaera?

As in Chimaera has firefox-esr 78.15.0 which is not up-to date enough for some online sites I have to visit.
Whereas in Ceres has firefox-esr 91.2
https://pkginfo.devuan.org/cgi-bin/poli … r&x=submit

Looks like this could be done by doing a temporary change in apt sources to Ceres, update FF and then change sources back to Chimaera.
as done in this post: http://dev1galaxy.org/viewtopic.php?pid=32203#p32203

I have tested and this works, though it's only a temporary fix as Apt will not be able to update the FF that came from Ceres as the sources are now pointing to Chimaera.

Please advise if this is possible and a safe and stable way to do this!

NicePics13 · 2021-10-22 10:36:35

🤔 By apt-pinning https://wiki.debian.org/AptConfiguration? Could get messy.
I'd just use something like LibreWolf (https://librewolf-community.gitlab.io/) that has an AppImage and a debian unstable repo.

mmaglis · 2021-10-22 11:40:53

I do not recommend mixing package repositories from different releases. It will mess and eventually destroy your system.

This fine page https://www.devuan.org/os/packages explains the use of backports package source.
It is advised to disable backports and only enable to install specific packages.
More advanced users may be able to give backports a lower priority (apt pinning) and install packages by specifying the target release (-t).
Please consult the apt documentation (e.g. man apt-get)

Check if the required Firefox version is in backports.
Alternatively, you can always download and use the latest Firefox version from upstream:
https://www.mozilla.org/en-US/firefox/a … op-release

Last edited by mmaglis (2021-10-22 11:42:43)

Head_on_a_Stick · 2021-10-22 15:40:29

rdav wrote:

Looks like this could be done by doing a temporary change in apt sources to Ceres, update FF and then change sources back to Chimaera.
as done in this post: http://dev1galaxy.org/viewtopic.php?pid=32203#p32203
I have tested and this works

It also breaks your system 'cos it pulls in glibc from ceres... *slow handclap*

See also https://forums.debian.net/viewtopic.php?f=20&t=114130

rolfie · 2021-10-22 19:07:26

What is wrong with firefox-esr 78.15.0? When it is no more supported Chimaera will update to the next release.

Anyhow, I am using firefox-esr downloaded from upstream. It will tell me when the Upgrade to 91.2 is due. I can wait.

rolfie

Head_on_a_Stick · 2021-10-22 22:56:17

v78 ESR goes EOL next week: https://endoflife.date/firefox

andyprough · 2021-10-22 23:32:28

I can't recall for sure, but it seems like SOMEONE made a thread awhile back about "How to use Bedrock Linux to add Ceres packages to your stable Devuan" or something like that.

Oh now I remember - it was me! - https://dev1galaxy.org/viewtopic.php?id=4402

I can see why no one would ever want to do it though, as it's SOOOO difficult. It takes three whole steps, and like a couple of whole minutes:
1. Download the BedrockLinux script for your architecture from here: https://raw.githubusercontent.com/bedro … 7/releases
2. Run the script as root: sh ./bedrock-linux-release-arch.sh --hijack
3. Reboot and add the Devuan Ceres "strata" to the system, with the name "myceres" (or pick your own preferred name):
$ sudo brl fetch -n myceres -r ceres devuan

That's it! So hard, no one should ever try it. And most certainly do not then try (as root)
$ strat myceres apt install firefox-esr

It would be a terrible shame if you had the unstable version of your favorite browser running perfectly on your stable installation. That would be just awful. Do not try this.

mmaglis · 2021-10-23 08:24:39

andyprough wrote:

It would be a terrible shame if you had the unstable version of your favorite browser running perfectly on your stable installation. That would be just awful. Do not try this.

Besides the humor/irony, it all depends how much you value your system and what you are using it for.

If it is only for Firefox, one can simply download and run the desired version directly from upstream source (https://www.mozilla.org/en-US/firefox/a … op-release).
You don't need to mess your system by mixing stable with unstable or resorting to foreign scripts to do it for you.
There are also the updates, proposed-updates and backports repositories that were designed to cover precisely such needs:
https://www.devuan.org/os/packages

That's the sensible and safe thing to do. But you can also skip advise and learn from your own mistakes.
Please make sure you are having fun doing it and no pain ;-)

Last edited by mmaglis (2021-10-23 15:14:11)

PedroReina · 2021-10-23 09:24:34

mmaglis wrote:

If it is only for Firefox, one can simply download and run the desired version directly from upstream source

I used to do so, but now I cannot deal with Firefox compiled only with pulseaudio and not pure alsa. I dont install pulseaudio in my Devuan systems.
(May be I should try apulse again).

Last edited by PedroReina (2021-10-23 11:00:47)

Head_on_a_Stick · 2021-10-23 09:40:55

There are also packaging decisions such as disabling studies in the De{bi,vu}an version of FF ESR. This is a strong argument against Mozilla's tarball, flatpaks, snaps, and to a slightly lesser extent, third-party packaging solutions such as Bedrock. See also https://drewdevault.com/2021/09/27/Let- … r-job.html & http://kmkeen.com/maintainers-matter/

hevidevi · 2021-10-23 11:51:18

Head_on_a_Stick wrote:

There are also packaging decisions such as disabling studies in the De{bi,vu}an version of FF ESR. This is a strong argument against Mozilla's tarball, flatpaks, snaps, and to a slightly lesser extent, third-party packaging solutions such as Bedrock. See also https://drewdevault.com/2021/09/27/Let- … r-job.html & http://kmkeen.com/maintainers-matter/

Im happy to stay with debians firefox-esr but if you wanted to add some level of security to a mozilla tarball (snaps and flatpaks should be avoided imo), then a good starting point is the custom user.js. I use a modified, custom version of this https://github.com/arkenfox/user.js/ with a custom user-overrides.js

andyprough · 2021-10-23 14:51:27

Head_on_a_Stick wrote:

There are also packaging decisions such as disabling studies in the De{bi,vu}an version of FF ESR. This is a strong argument against Mozilla's tarball, flatpaks, snaps, and to a slightly lesser extent, third-party packaging solutions such as Bedrock.

Bedrock does not do any packaging, third-party or otherwise. All the packages come directly from Devuan's repos.

devadmin · 2021-10-23 21:32:49

hevidevi wrote:

Im happy to stay with debians firefox-esr but if you wanted to add some level of security to a mozilla tarball (snaps and flatpaks should be avoided imo), then a good starting point is the custom user.js. I use a modified, custom version of this https://github.com/arkenfox/user.js/ with a custom user-overrides.js

Hi. I was using the same but FF was trying to connect to mozilla site. So I had to block the push.mozilla.. etc on dns level and I cannot install addons anymore

I've tried ungoogled-chromium - good. Icecat - looks like abandoned. Will try abrowser. Looks fresh and promising. (?)

hevidevi · 2021-10-24 10:25:26

devadmin wrote:

hevidevi wrote:
Im happy to stay with debians firefox-esr but if you wanted to add some level of security to a mozilla tarball (snaps and flatpaks should be avoided imo), then a good starting point is the custom user.js. I use a modified, custom version of this https://github.com/arkenfox/user.js/ with a custom user-overrides.js
Hi. I was using the same but FF was trying to connect to mozilla site. So I had to block the push.mozilla.. etc on dns level and I cannot install addons anymore
I've tried ungoogled-chromium - good. Icecat - looks like abandoned. Will try abrowser. Looks fresh and promising. (?)

In what way, how could you check that? push.mozilla is all false in my about:config with custom user.js when i downloaded and unpacked firefox 92. Just curious is all as i dont know all that much about this.

These are what push settings i could find in my custom user.js

user_pref("dom.push.enabled", false);

user_pref("dom.push.connection.enabled", false); // [UNBREAK=true] [*PRIV=false] *TODO* unknown - assumed to be related to push notifications

user_pref("dom.push.userAgentID", "");  // user-agent ID for push services

Last edited by hevidevi (2021-10-24 10:26:51)

andyprough · 2021-10-24 21:44:03

devadmin wrote:

Will try abrowser. Looks fresh and promising. (?)

If it's useful, here's my write-up on installing abrowser on Devuan by adding the Trisquel repo and doing some apt pinning - https://trisquel.info/en/forum/how-inst … ser-devuan

Works well on Devuan. All the Firefox telemetry and 'phone home' behavior and pocket and such nonsense is stripped out, but you can still install the Mozilla extensions. And it's kept pretty much up-to-date.

zephyr · 2021-10-24 22:46:37

Have Firefox 92.0 running in Chimaera, just download, extract, rename .firefox and put into home directory /home/<your name>/.firefox/

cheers

zephyr

devadmin · 2021-10-24 23:22:31

hevidevi wrote:

user_pref("dom.push.enabled", false);

user_pref("dom.push.connection.enabled", false); // [UNBREAK=true] [*PRIV=false] *TODO* unknown - assumed to be related to push notifications

user_pref("dom.push.userAgentID", "");  // user-agent ID for push services

Yes, works. Missed it. Thank you.

There are many ways to discover connections in Linux. Recently I found one more great tool https://github.com/evilsocket/opensnitch application level firewall. Very useful nowadays. Shows all connections per application can block internet access by process or using the list of addresses etc.

devadmin · 2021-10-24 23:36:10

andyprough wrote:

So hard, no one should ever try it.
...
Do not try this.

I've tried. But then I read on some Internet site the statement of the main dev. He said something like they are now more interested in adding new features than in security. Maybe this is a kind of prejudice, but I don't like such statements

devadmin · 2021-10-24 23:49:41

andyprough wrote:

devadmin wrote:
Will try abrowser. Looks fresh and promising. (?)
If it's useful, here's my write-up on installing abrowser on Devuan by adding the Trisquel repo and doing some apt pinning - https://trisquel.info/en/forum/how-inst … ser-devuan

Oh, I jumped to some crazy way of installation.
The main problem that I have no idea where to find info about other distro's repositories? So invented smth like this:

wget -q -O- http://archive.trisquel.info/trisquel/t … ignkey.gpg | sudo apt-key add -

added this

deb http://archive.trisquel.info/trisquel/ etiona main
deb http://archive.trisquel.info/trisquel/ etiona-security main
deb http://archive.trisquel.info/trisquel/ etiona-updates main
deb http://archive.trisquel.info/trisquel/ etiona-backports main

and got abrowser_93.0+build1-0ubuntu0.20.04.1+10.0trisquel84_amd64.deb

It must have to be a very dirty hack

No dependencies and works fine. Excellent.

andyprough · 2021-10-25 00:16:13

devadmin wrote:

No dependencies and works fine. Excellent.

Agreed - no new dependencies is one of the big advantages. Enjoy.

PedroReina · 2021-10-25 08:57:40

zephyr wrote:

Have Firefox 92.0 running in Chimaera

With or without pulseaudio in your system?

devadmin · 2021-10-25 16:09:38

I have no sound in abrowser 93 (=firefox 93) with alsa. And have no bluetooth with alsa.

jnr2820 · 2021-10-27 09:22:52

I simply removed firefox-esr and installed the upstream version of 90+ via Flatpak. I'm unsure if sound works without pulseaudio. One thing I ran into was links from other programs don't trigger the Flatpak version of Firefox to open. I'm not sure how to solve that one yet. (Maybe something custom with "update-alternatives")

Marjorie · 2021-10-27 10:01:54

Not quite sure why some of us are rushing to update firefox-Esr, and looking for round-about, and perhaps dangerous, ways to do so.
The whole point of firefox-esr is that it is stable.
Although firefox-esr 91.0 was released on 8 August Mozilla continue to provide 3 months of monthly point security updates of the previous Firefox-esr.
Debian/Devuan have always used this delayed release and only then made the new version avaialble as a security upgrade, which has then had three security patches under the belt.
Firefox-esr 91.3 is due for release 2 November, at the same time as Firefox 94.
I expect to receive it shortly thereafter in a normal unattended secruity update, replacing the last version of Firefox-esr 78 - 78.15.
This is what happened last year.

hevidevi · 2021-10-27 11:14:55

everyone wants new shiny things Marjorie

The officially official Devuan Forum!

#1 2021-10-22 08:53:28

How to have updated firefox-esr in Chimaera?

#2 2021-10-22 10:36:35

Re: How to have updated firefox-esr in Chimaera?

#3 2021-10-22 11:40:53

Re: How to have updated firefox-esr in Chimaera?

#4 2021-10-22 15:40:29

Re: How to have updated firefox-esr in Chimaera?

#5 2021-10-22 19:07:26

Re: How to have updated firefox-esr in Chimaera?

#6 2021-10-22 22:56:17

Re: How to have updated firefox-esr in Chimaera?

#7 2021-10-22 23:32:28

Re: How to have updated firefox-esr in Chimaera?

#8 2021-10-23 08:24:39

Re: How to have updated firefox-esr in Chimaera?

#9 2021-10-23 09:24:34

Re: How to have updated firefox-esr in Chimaera?

#10 2021-10-23 09:40:55

Re: How to have updated firefox-esr in Chimaera?

#11 2021-10-23 11:51:18

Re: How to have updated firefox-esr in Chimaera?

#12 2021-10-23 14:51:27

Re: How to have updated firefox-esr in Chimaera?

#13 2021-10-23 21:32:49

Re: How to have updated firefox-esr in Chimaera?

#14 2021-10-24 10:25:26

Re: How to have updated firefox-esr in Chimaera?

#15 2021-10-24 21:44:03

Re: How to have updated firefox-esr in Chimaera?

#16 2021-10-24 22:46:37

Re: How to have updated firefox-esr in Chimaera?

#17 2021-10-24 23:22:31

Re: How to have updated firefox-esr in Chimaera?

#18 2021-10-24 23:36:10

Re: How to have updated firefox-esr in Chimaera?

#19 2021-10-24 23:49:41

Re: How to have updated firefox-esr in Chimaera?

#20 2021-10-25 00:16:13

Re: How to have updated firefox-esr in Chimaera?

#21 2021-10-25 08:57:40

Re: How to have updated firefox-esr in Chimaera?

#22 2021-10-25 16:09:38

Re: How to have updated firefox-esr in Chimaera?

#23 2021-10-27 09:22:52

Re: How to have updated firefox-esr in Chimaera?

#24 2021-10-27 10:01:54

Re: How to have updated firefox-esr in Chimaera?

#25 2021-10-27 11:14:55

Re: How to have updated firefox-esr in Chimaera?

Board footer