Files
IronFox/scripts/patches.sh
celenity e6c69ef28d IronFox v144.0
ironfox-oss/IronFox!92
____

## Changes

- [Added a separate toggle in settings to enable/disable JIT for **extensions**](48a42e213a) when JIT is otherwise disabled globally *(**Disabled** by default)*, located at `Settings` -> `IronFox` -> `IronFox settings` -> `Security` -> **`Enable JavaScript Just-in-time Compilation (JIT) for extensions`**.
- [Added support for natively enabling/disabling WebGL per-site](5e1acb19a6) via FPP overrides. **It is now recommended to disable the uBlock Origin `Block WebGL` lists** *(The `Block WebGL` lists will be removed from the uBlock Origin config entirely in the near future, but we're keeping them for now to ex. give users time to update)*. See [Notes](#notes) below for details, such as how you can manually allow desired websites to use WebGL.
- [Added a toggle in settings to enable or disable our default WebGL overrides](c9298799ee) *(**Enabled** by default)*, located at `Settings` -> `IronFox` -> `IronFox settings` -> `Privacy` -> **`Enable WebGL overrides from IronFox`**. When WebGL is enabled, this setting enables WebGL by default for certain websites, to reduce breakage/unexpected behavior. Note that this list is **NOT** fetched/updated remotely.
- [Added a toggle in settings to enable or disable spoofing the timezone to `UTC-0`](c8cb5064e4) *(**Disabled** by default)*, located at `Settings` -> `IronFox` -> `IronFox settings` -> `Privacy` -> **`Spoof timezone to UTC-0`**.
- [Added a toggle in settings to enable or disable our default timezone overrides](c8cb5064e4) *(**Enabled** by default)*, located at `Settings` -> `IronFox` -> `IronFox settings` -> `Privacy` -> **`Enable timezone spoofing overrides from IronFox`**. When timezone spoofing is enabled, this setting disables timezone spoofing by default for certain websites, to reduce breakage/unexpected behavior. Note that this list is **NOT** fetched/updated remotely.
- [Added a toggle in settings to enable or disable *Mozilla's* default fingerprinting protection overrides](64e3706be8) to reduce website breakage *(**Enabled** by default)*, located at `Settings` -> `IronFox` -> `IronFox settings` -> `Privacy` -> **`Enable fingerprinting protection overrides from Mozilla`**. Note that this list **IS** fetched/updated remotely.
- [Added a toggle in settings to enable or disable *our* default fingerprinting protection overrides](64e3706be8) to reduce website breakage *(**Enabled** by default)*, located at `Settings` -> `IronFox` -> `IronFox settings` -> `Privacy` -> **`Enable fingerprinting protection overrides from IronFox`**. This toggle does **not** disable fingerprinting protection overrides that we set to **harden** protection for certain websites. Note that this list is **NOT** fetched/updated remotely.
- [Implemented](522770b2dc) [Phoenix's extension blocklist](https://codeberg.org/celenity/Phoenix/src/branch/pages/build/policies/blocklist.json) to block malicious/phishing/sketchy extensions.
- [Locked Gecko preferences controlled by UI settings](bc9df5c52c) *(See [details](https://gitlab.com/ironfox-oss/IronFox/-/blob/dev/docs/FAQ.md#why-are-certain-preferences-locked))*.
- [Prevented the JIT toggle from controlling `javascript.options.main_process_disable_jit`](8171a4da48), as this pref is not required for JIT to function, and is preferable to leave on - even when JIT is enabled, to improve security.
- Updated to Firefox [`144.0`](https://firefox.com/firefox/android/144.0/releasenotes/).
- Updated microG to [`v0.3.10.250932`](https://github.com/microg/GmsCore/releases/tag/v0.3.10.250932).
- Updated Phoenix to [`2025.10.12.1`](https://codeberg.org/celenity/Phoenix/releases/tag/2025.10.12.1).
- [Other minor tweaks, adjustments, and enhancements](https://gitlab.com/ironfox-oss/IronFox/-/merge_requests/92/diffs).

## Notes

You can manually allow websites to use WebGL with the `privacy.fingerprintingProtection.granularOverrides` preference at `about:config`. For instance, if I want to allow **`example.com`** to use WebGL, I would set the value of `privacy.fingerprintingProtection.granularOverrides` to:

```sh
[{"firstPartyDomain":"example.com","overrides":"-DisableWebGL"}]
```

If I *also* wanted to allow `example2.com`, I'd set the value to:

```sh
[{"firstPartyDomain":"example.com","overrides":"-DisableWebGL"},{"firstPartyDomain":"example2.com","overrides":"-DisableWebGL"}]
```

**[Please report websites that require WebGL to us if possible](https://gitlab.com/ironfox-oss/IronFox/-/issues)**, so that we can investigate and potentially add them to the default WebGL overrides list.

MR-author: celenity <celenity@celenity.dev>
Co-authored-by: Weblate <hosted@weblate.org>
Co-authored-by: Akash Yadav <itsaky01@gmail.com>
Approved-by: celenity <celenity@celenity.dev>
Merged-by: celenity <celenity@celenity.dev>
2025-10-16 04:14:42 +00:00

392 lines
11 KiB
Bash

#!/bin/bash
if [[ "$env_source" != "true" ]]; then
echo "Use 'source scripts/env_local.sh' before calling prebuild or build"
return 1
fi
source "$rootdir/scripts/versions.sh"
RED="\033[0;31m"
GREEN="\033[0;32m"
NC="\033[0m"
declare -a PATCH_FILES
declare -a AS_PATCH_FILES
declare -a GLEAN_PATCH_FILES
# shellcheck disable=SC2207
PATCH_FILES=($(yq '.patches[].file' "$(dirname "$0")"/patches.yaml))
AS_PATCH_FILES=($(yq '.patches[].file' "$(dirname "$0")"/a-s-patches.yaml))
GLEAN_PATCH_FILES=($(yq '.patches[].file' "$(dirname "$0")"/glean-patches.yaml))
check_patch() {
patch="$patches/$1"
if ! [[ -f "$patch" ]]; then
printf "${RED}✗ %-45s: FAILED${NC}\n" "$(basename "$patch")"
echo "'$patch' does not exist or is not a file"
return 1
fi
if ! patch -p1 -f --dry-run <"$patch"; then
printf "${RED}✗ %-45s: FAILED${NC}\n" "$(basename "$patch")"
echo "Incompatible patch: '$patch'"
return 1
fi
}
check_patches() {
for patch in "${PATCH_FILES[@]}"; do
if ! check_patch "$patch"; then
return 1
fi
done
}
a-s_check_patches() {
for patch in "${AS_PATCH_FILES[@]}"; do
if ! check_patch "$patch"; then
return 1
fi
done
}
glean_check_patches() {
for patch in "${GLEAN_PATCH_FILES[@]}"; do
if ! check_patch "$patch"; then
return 1
fi
done
}
test_patches() {
for patch in "${PATCH_FILES[@]}"; do
if ! check_patch "$patch" >/dev/null 2>&1; then
printf "${RED}✗ %-45s: FAILED${NC}\n" "$(basename "$patch")"
else
printf "${GREEN}✓ %-45s: OK${NC}\n" "$(basename "$patch")"
fi
done
}
a-s_test_patches() {
for patch in "${AS_PATCH_FILES[@]}"; do
if ! check_patch "$patch" >/dev/null 2>&1; then
printf "${RED}✗ %-45s: FAILED${NC}\n" "$(basename "$patch")"
else
printf "${GREEN}✓ %-45s: OK${NC}\n" "$(basename "$patch")"
fi
done
}
glean_test_patches() {
for patch in "${GLEAN_PATCH_FILES[@]}"; do
if ! check_patch "$patch" >/dev/null 2>&1; then
printf "${RED}✗ %-45s: FAILED${NC}\n" "$(basename "$patch")"
else
printf "${GREEN}✓ %-45s: OK${NC}\n" "$(basename "$patch")"
fi
done
}
apply_patch() {
name="$1"
echo "Applying patch: $name"
check_patch "$name" || return 1
patch -p1 --no-backup-if-mismatch <"$patches/$name"
return $?
}
apply_patches() {
for patch in "${PATCH_FILES[@]}"; do
if ! apply_patch "$patch"; then
printf "${RED}✗ %-45s: FAILED${NC}\n" "$(basename "$patch")"
echo "Failed to apply $patch"
return 1
fi
done
}
a-s_apply_patches() {
for patch in "${AS_PATCH_FILES[@]}"; do
if ! apply_patch "$patch"; then
printf "${RED}✗ %-45s: FAILED${NC}\n" "$(basename "$patch")"
echo "Failed to apply $patch"
return 1
fi
done
}
glean_apply_patches() {
for patch in "${GLEAN_PATCH_FILES[@]}"; do
if ! apply_patch "$patch"; then
printf "${RED}✗ %-45s: FAILED${NC}\n" "$(basename "$patch")"
echo "Failed to apply $patch"
return 1
fi
done
}
list_patches() {
for patch in "${PATCH_FILES[@]}"; do
echo "$patch"
done
}
a-s_list_patches() {
for patch in "${AS_PATCH_FILES[@]}"; do
echo "$patch"
done
}
glean_list_patches() {
for patch in "${GLEAN_PATCH_FILES[@]}"; do
echo "$patch"
done
}
slugify() {
local input="$1"
echo "$input" | \
tr '[:upper:]' '[:lower:]' | \
"$SED" -E 's/[^a-z0-9]+/-/g' | \
"$SED" -E 's/^-+|-+$//g'
}
# Function to rebase a single patch file atomically
# Usage: rebase_patch <compatible_tag> <target_tag> <patch_file_path>
rebase_patch() {
local compatible_tag="$1"
local target_tag="$2"
local patch_file="$3"
# Validate inputs
if [[ -z "$compatible_tag" || -z "$target_tag" || -z "$patch_file" ]]; then
printf "${RED}✗ %-45s: FAILED${NC}\n" "$(basename "$patch")"
echo "Missing required parameters" >&2
echo "Usage: rebase_patch <compatible_tag> <target_tag> <patch_file_path>" >&2
return 1
fi
if [[ ! -f "$patch_file" ]]; then
printf "${RED}✗ %-45s: FAILED${NC}\n" "$(basename "$patch")"
echo "Patch file '$patch_file' does not exist" >&2
return 1
fi
# Store original state for rollback
local original_branch
original_branch=$(git rev-parse --abbrev-ref HEAD 2>/dev/null)
local original_stash_count
original_stash_count=$(git stash list | wc -l)
local patch_name
patch_name=$(basename "$patch_file" .patch)
local branch_name="rebase-${patch_name}"
cleanup_and_rollback() {
echo "Error occurred, rolling back changes..." >&2
# Check if we're in the middle of a rebase and abort it
if git status --porcelain=v1 2>/dev/null | grep -q "^R" ||
[[ -d "$(git rev-parse --git-dir)/rebase-merge" ]] ||
[[ -d "$(git rev-parse --git-dir)/rebase-apply" ]]; then
echo "Aborting rebase in progress..."
git rebase --abort 2>/dev/null
fi
# Switch back to original branch if it exists
if [[ -n "$original_branch" && "$original_branch" != "HEAD" ]]; then
git checkout "$original_branch" 2>/dev/null
fi
# Delete the temporary branch if it was created
git branch -D "$branch_name" 2>/dev/null
# Restore stashed changes if any were created
local current_stash_count
current_stash_count=$(git stash list | wc -l)
if [[ $current_stash_count -gt $original_stash_count ]]; then
git stash pop 2>/dev/null
fi
return 1
}
# Ensure clean git directory state
if ! git diff-index --quiet HEAD --; then
echo "Stashing uncommitted changes..."
if ! git stash push -m "Temporary stash for patch rebase"; then
printf "${RED}✗ %-45s: FAILED${NC}\n" "$(basename "$patch")"
echo "Failed to stash changes" >&2
return 1
fi
fi
# Check if tags exist
if ! git rev-parse --verify "$compatible_tag" >/dev/null 2>&1; then
printf "${RED}✗ %-45s: FAILED${NC}\n" "$(basename "$patch")"
echo "Compatible tag '$compatible_tag' does not exist" >&2
cleanup_and_rollback
return 1
fi
if ! git rev-parse --verify "$target_tag" >/dev/null 2>&1; then
printf "${RED}✗ %-45s: FAILED${NC}\n" "$(basename "$patch")"
echo "Target tag '$target_tag' does not exist" >&2
cleanup_and_rollback
return 1
fi
# Checkout the compatible tag
echo "Checking out compatible tag '$compatible_tag'..."
if ! git checkout "$compatible_tag"; then
printf "${RED}✗ %-45s: FAILED${NC}\n" "$(basename "$patch")"
echo "Failed to checkout compatible tag '$compatible_tag'" >&2
cleanup_and_rollback
return 1
fi
# Create and switch to new branch
echo "Creating branch '$branch_name'..."
if ! git checkout -b "$branch_name"; then
printf "${RED}✗ %-45s: FAILED${NC}\n" "$(basename "$patch")"
echo "Failed to create branch '$branch_name'" >&2
cleanup_and_rollback
return 1
fi
# Apply the patch
echo "Applying patch '$patch_file'..."
if ! git apply "$patch_file"; then
printf "${RED}✗ %-45s: FAILED${NC}\n" "$(basename "$patch")"
echo "Failed to apply '$patch_file'" >&2
cleanup_and_rollback
return 1
fi
# Stage all changes
if ! git add .; then
printf "${RED}✗ %-45s: FAILED${NC}\n" "$(basename "$patch")"
echo "Failed to stage changes" >&2
cleanup_and_rollback
return 1
fi
# Commit the changes
local commit_message
commit_message="Apply patch $(basename "$patch_file") - rebased to $target_tag"
echo "Committing changes..."
if ! git commit -m "$commit_message"; then
printf "${RED}✗ %-45s: FAILED${NC}\n" "$(basename "$patch")"
echo "Failed to commit changes" >&2
cleanup_and_rollback
return 1
fi
# Rebase to target tag
echo "Rebasing to target tag '$target_tag'..."
if ! git rebase "$target_tag"; then
printf "${RED}✗ %-45s: FAILED${NC}\n" "$(basename "$patch")"
echo "Failed to rebase to target tag '$target_tag'" >&2
cleanup_and_rollback
return 1
fi
# Update the patch file using git format-patch
echo "Updating patch file..."
local temp_patch
temp_patch=$(mktemp)
if ! git format-patch -1 --stdout >"$temp_patch"; then
printf "${RED}✗ %-45s: FAILED${NC}\n" "$(basename "$patch")"
echo "Failed to generate new patch" >&2
rm -f "$temp_patch"
cleanup_and_rollback
return 1
fi
# Atomically replace the original patch file
if ! mv "$temp_patch" "$patch_file"; then
printf "${RED}✗ %-45s: FAILED${NC}\n" "$(basename "$patch")"
echo "Failed to update patch file" >&2
rm -f "$temp_patch"
cleanup_and_rollback
return 1
fi
# Cleanup: switch back to original branch and delete temporary branch
if [[ -n "$original_branch" && "$original_branch" != "HEAD" ]]; then
git checkout "$original_branch"
else
git checkout "$target_tag"
fi
git branch -D "$branch_name"
# Restore stashed changes if any
local current_stash_count
current_stash_count=$(git stash list | wc -l)
if [[ $current_stash_count -gt $original_stash_count ]]; then
echo "Restoring stashed changes..."
git stash pop
fi
printf "${GREEN}✓ %-45s: SUCCESS${NC}\n" "$(basename "$patch")"
echo "Rebased patch '$patch_file' from '$compatible_tag' to '$target_tag'"
return 0
}
# Function to rebase multiple patch files
# Usage: rebase_patches <compatible_tag> <target_tag> <patch_file1> [patch_file2] [...]
rebase_patches() {
local compatible_tag="$1"
local target_tag="$2"
# Validate inputs
if [[ -z "$compatible_tag" || -z "$target_tag" ]]; then
printf "${RED}✗ %-45s: FAILED${NC}\n" "$(basename "$patch")"
echo "Missing required parameters" >&2
echo "Usage: rebase_patches <compatible_tag> <target_tag>" >&2
return 1
fi
local success_count=0
local failure_count=0
local failed_patches=()
echo "Starting batch rebase of ${#PATCH_FILES[@]} patch files..."
echo "Compatible tag: $compatible_tag"
echo "Target tag: $target_tag"
echo "----------------------------------------"
for patch_file in "${PATCH_FILES[@]}"; do
echo "Processing: $patch_file"
if rebase_patch "$compatible_tag" "$target_tag" "$patch_file"; then
printf "${GREEN}✓ %-45s: SUCCESS${NC}\n" "$(basename "$patch")"
((success_count++))
else
printf "${RED}✗ %-45s: FAILED${NC}\n" "$(basename "$patch")"
failed_patches+=("$patch_file")
((failure_count++))
fi
echo "----------------------------------------"
done
# Summary
echo "Batch rebase completed:"
echo " Successful: $success_count"
echo " Failed: $failure_count"
if [[ $failure_count -gt 0 ]]; then
echo "Failed patches:"
for failed_patch in "${failed_patches[@]}"; do
echo " - $failed_patch"
done
return 1
fi
return 0
}