Security/Version bump, bug #464226. pax-mark unconditional even when no jit is enabled, needs major rework.

(Portage version: 2.1.11.60/cvs/Linux x86_64, signed Manifest commit with key 0xB4D088B4)

2 files changed, 20 insertions, 21 deletions

diff --git a/www-client/firefox/ChangeLog b/www-client/firefox/ChangeLog
index 2ddd837883d5..2ef126c4b140 100644
--- a/www-client/firefox/ChangeLog
+++ b/www-client/firefox/ChangeLog
@@ -1,6 +1,13 @@
 # ChangeLog for www-client/firefox
 # Copyright 1999-2013 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/www-client/firefox/ChangeLog,v 1.227 2013/04/04 14:37:59 polynomial-c Exp $
+# $Header: /var/cvsroot/gentoo-x86/www-client/firefox/ChangeLog,v 1.228 2013/04/05 22:49:56 anarchy Exp $
+
+*firefox-20.0 (05 Apr 2013)
+
+  05 Apr 2013; Jory A. Pratt <anarchy@gentoo.org> -firefox-19.0.2.ebuild,
+  +firefox-20.0.ebuild:
+  Security/Version bump, bug #464226. pax-mark unconditional even when no jit
+  is enabled, needs major rework.
 
 *firefox-17.0.5 (04 Apr 2013)
 
diff --git a/www-client/firefox/firefox-19.0.2.ebuild b/www-client/firefox/firefox-20.0.ebuild
index 59296cdfb762..21d55d6bf40e 100644
--- a/www-client/firefox/firefox-19.0.2.ebuild
+++ b/www-client/firefox/firefox-20.0.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2013 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/www-client/firefox/firefox-19.0.2.ebuild,v 1.2 2013/03/25 14:07:25 polynomial-c Exp $
+# $Header: /var/cvsroot/gentoo-x86/www-client/firefox/firefox-20.0.ebuild,v 1.1 2013/04/05 22:49:56 anarchy Exp $
 
 EAPI="3"
 VIRTUALX_REQUIRED="pgo"
@@ -25,7 +25,7 @@ if [[ ${MOZ_ESR} == 1 ]]; then
 fi
 
 # Patch version
-PATCH="${PN}-19.0-patches-0.3"
+PATCH="${PN}-20.0-patches-0.2"
 # Upstream ftp release URI that's used by mozlinguas.eclass
 # We don't use the http mirror because it deletes old tarballs.
 MOZ_FTP_URI="ftp://ftp.mozilla.org/pub/${PN}/releases/"
@@ -54,7 +54,7 @@ RDEPEND="
 	>=dev-libs/nspr-4.9.4
 	>=dev-libs/glib-2.26:2
 	>=media-libs/mesa-7.10
-	>=media-libs/libpng-1.5.13[apng]
+	>=media-libs/libpng-1.5.11[apng]
 	virtual/libffi
 	gstreamer? ( media-plugins/gst-plugins-meta:0.10[ffmpeg] )
 	system-jpeg? ( >=media-libs/libjpeg-turbo-1.2.1 )
@@ -65,6 +65,7 @@ RDEPEND="
 	>=media-libs/libvpx-1.0.0
 	kernel_linux? ( media-libs/alsa-lib )
 	selinux? ( sec-policy/selinux-mozilla )"
+
 DEPEND="${RDEPEND}
 	virtual/pkgconfig
 	pgo? (
@@ -216,6 +217,7 @@ src_configure() {
 	# Feature is know to cause problems on hardened
 	mozconfig_use_enable jit methodjit
 	mozconfig_use_enable jit tracejit
+	mozconfig_use_enable jit ion
 
 	# Allow for a proper pgo build
 	if use pgo; then
@@ -277,23 +279,20 @@ src_install() {
 	obj_dir="${obj_dir%/*}"
 	cd "${S}/${obj_dir}"
 
-	# Without methodjit and tracejit there's no conflict with PaX
-	if use jit; then
-		# Pax mark xpcshell for hardened support, only used for startupcache creation.
-		pax-mark m "${S}/${obj_dir}"/dist/bin/xpcshell
-	fi
+	# Pax mark xpcshell for hardened support, only used for startupcache creation.
+	pax-mark m "${S}/${obj_dir}"/dist/bin/xpcshell
 
 	# Add our default prefs for firefox
 	cp "${FILESDIR}"/gentoo-default-prefs.js-1 \
-		"${S}/${obj_dir}/dist/bin/defaults/preferences/all-gentoo.js" || die
+		"${S}/${obj_dir}/dist/bin/defaults/pref/all-gentoo.js" || die
 
 	if ! use libnotify; then
 		echo "pref(\"browser.download.manager.showAlertOnComplete\", false);" \
-			>> "${S}/${obj_dir}/dist/bin/defaults/preferences/all-gentoo.js"
+			>> "${S}/${obj_dir}/dist/bin/defaults/pref/all-gentoo.js"
 	fi
 
 	echo "pref("extensions.autoDisableScopes", 3);" >> \
-		"${S}/${obj_dir}/dist/bin/defaults/preferences/all-gentoo.js" || die
+		"${S}/${obj_dir}/dist/bin/defaults/pref/all-gentoo.js" || die
 
 	MOZ_MAKE_FLAGS="${MAKEOPTS}" \
 	emake DESTDIR="${D}" install || die "emake install failed"
@@ -335,15 +334,8 @@ src_install() {
 		echo "StartupNotify=true" >> "${ED}/usr/share/applications/${PN}.desktop"
 	fi
 
-	# Without methodjit and tracejit there's no conflict with PaX
-	if use jit; then
-		# Required in order to use plugins and even run firefox on hardened.
-		pax-mark m "${ED}"${MOZILLA_FIVE_HOME}/{firefox,firefox-bin}
-	fi
-
-	# Plugin-container needs to be pax-marked for hardened to ensure plugins such as flash
-	# continue to work as expected.
-	pax-mark m "${ED}"${MOZILLA_FIVE_HOME}/plugin-container
+	# Required in order to use plugins and even run firefox on hardened.
+	pax-mark m "${ED}"${MOZILLA_FIVE_HOME}/{firefox,firefox-bin,plugin-container}
 
 	# Plugins dir
 	share_plugins_dir