Mozilla in Lenny

[Mike Hommey]

Hi,

Here is an update on mozilla stuff (at least the ones I know) for Lenny.

Current versions of iceweasel and xulrunner in unstable are better than
the ones in testing right now, but are still not release quality. There
are still at least 2 really problematic bugs with it, and a bunch of
other issues I'd like to tackle before release:
- #482415 and #486334, which I'm not sure if they are the same issue or
  not, and I can't even reproduce.
- #490360 for which I wonder if I'm not going to "simply" disable the
  jemalloc library by default, but leaving possibility to enable it
  (note: Ubuntu doesn't have it enabled though shipping it, because
  the xulrunner-stub doesn't load it, normally ; I patched it to do so)
- j2re1.4 is making a whole bunch of problems. Having it installed and
  having the /usr/lib/mozilla/plugins/libjavaplugin-oji.so file pointing
  to it makes xulrunner-1.9 infinitely loop at initialization when the
  plugin is not registered. When you solve the infinite loop problem
  (which this plugin is the only one to trigger), you hit #402165, and
  once you work around that one, you end up with a crash in
  JavaPluginFactory5::Initialize () from
  /usr/lib/j2se/1.4/jre/plugin/amd64/mozilla/libjavaplugin_oji.so.
  So, considering this file is in j2re1.4, I found no better way to
  solve the issue fully than to conflict with j2re1.4. The problem is
  that people who don't care about the plugin, but only care about the
  java runtime version 1.4 just can't install it, and we already got a
  bug report from a user needing just that. Any suggestions welcome,
  here.
- Seeing how many problems we have with plugins, and how it's a burden
  for users reporting bugs to go all the way moving them around
  (especially now that we have 2 system directories for plugins, which
  is intended as a transition for lenny+1), I want to implement
  https://bugzilla.mozilla.org/show_bug.cgi?id=342333, i.e. having
  iceweasel -safe-mode disable all plugins. It's possible in Tools >
  Add-ons > Plugins, already, but when your browser crashes before you
  can even reach that, that's of no help.
- Anti-phishing protection should be disabled by default, because of its
  privacy concerns.
- #491822
- Remove mozilla-xremote-client call in run-mozilla.sh, as this is done
  by the applications themselves, now, and it's posing some problems at
  build time at least on PPC
- #491693
- Allow mozilla xul extensions to live in /usr/share/mozilla/extensions/
  instead of /usr/share/mozilla/extensions/{application_uuid}, which
  breaks the purpose of having a shared location.
(I may have forgotten some others, if you can think of some, please
followup. I'll also do that myself if I remember something important)

For iceape, I would have liked to reintroduce the calendar package, but
I haven't had time yet, and it's too late in the release process to add
this back. This unfortunately means regression for stable users, but
it's too risky to add this bunch of untested code now.

For other mozilla related packages I maintain (or not yet), there are a
couple things I need to do before release:
- Fix venkman so that it works with any 3.0.x version of iceweasel.
- Package the new upstream of tabextensions. This might end up as a new
  package because while the new one is the only way to get it work with
  iceweasel 3.0, I'm not sure it works with iceape and even if it does,
  it'd a huge regression in functionality.
- Package dom-inspector, which is not provided by iceweasel itself
  anymore.

For galeon, fixing about:, mybrowser: and some other stuff that got
broken with xulrunner-1.9 should be necessary. Or maybe, as galeon is
mostly unmaintained upstream, leave it out of the release.

You can see that's still a lot of work, and with the past months of
work on xulrunner-1.9, I'm currently burned-out, so I'm not even willing
to force myself into work to meet the freeze deadline.
I hope the release team can understand that and request clemency for the
coming freeze exception requests that will come from me.

Also, as you may know, security updates for mozilla packages are now
mainly about uploading new upstream releases, so it would be better if
any upstream release that happens before Lenny release was allowed in
Lenny (especially 1.9.0.2/3.0.2 which will include a bunch of the debian
patches, which means extra care at merge time (though there shouldn't be
conflicts)).

That's all for today.

Cheers,

Mike