Hi everyone, See patch attached.
This touches Firefox, Firefox ESR, SeaMonkey and Thunderbird, in the OpenBSD ports system. It adapts various hardened build options present in my LibreWolf port. I've tested them all and it works perfectly on all.
Note that the Rust SIMD option (--enable-rust-simd) might fail in the future when the rustc/cargo ports update. This option is quite sensitive to rustc/cargo versions. Since the ports system will bulk-build these anyway, it should be fine at the moment, and then it'll be fine again on update.
The rust simd option is sensitive only on ESR browsers, given that they don't change as much, but in practise it's probably fine. On regular firefox releases for example, they regularly update themselves to handle new rustc versions.
Beyond that, several hardening options e.g. --enable-hardening, disabling crash reporter. I also added some CFLAGS that mitigate undefined behaviour (e.g. undeclared local variables). All good things, with love from LibreWolf.
I considered that OpenBSD would probably want these on other mozilla ports. See patch!
I decided to just do one big patch for this, since it's actually quite a trivial change.
-- Company director, Minifree Ltd Registered in England, No. 9361826 | VAT No. GB202190462 Registered Office: 19 Hilton Road, Canvey Island, Essex SS8 9QA, UK
From 2f572868c6ed52ffadd2673c69223ed98655e534 Mon Sep 17 00:00:00 2001 From: Leah Rowe <[email protected]> Date: Thu, 3 Sep 2026 12:30:14 +0100 Subject: [PATCH 1/1] mozilla projects: add hardened build options these are imported from the librewolf port, which are in turn imported upstream from librewolf. where available, rust simd extensions are also enabled. this enables a big speed improvement on certain workloads. options added to CFLAGS/CXXFLAGS that mitigate undefined behaviour in some cases e.g. overflows. librewolf uses these in its own build system. i would have gone much deeper here, but this change is much more conservative by comparison, in line with the seeming light touch approach taken by Landry on the firefox port. i've followed suit accordingly, for all mozilla projects.1 Signed-off-by: Leah Rowe <[email protected]> --- mail/mozilla-thunderbird/Makefile | 17 ++++++++++++++--- www/firefox-esr/Makefile | 18 +++++++++++++++--- www/mozilla-firefox/Makefile | 19 ++++++++++++++++--- www/seamonkey/Makefile | 18 +++++++++++++++++- www/tor-browser/browser/Makefile | 19 +++++++++++++++++++ 5 files changed, 81 insertions(+), 10 deletions(-) diff --git a/mail/mozilla-thunderbird/Makefile b/mail/mozilla-thunderbird/Makefile index 83673286271..776130b1fbf 100644 --- a/mail/mozilla-thunderbird/Makefile +++ b/mail/mozilla-thunderbird/Makefile @@ -10,6 +10,7 @@ MOZILLA_CODENAME = comm/mail EXTRACT_SUFX = .tar.xz DEBUG_PACKAGES = ${BUILD_PACKAGES} PKGNAME = ${MOZILLA_PROJECT}-${MOZILLA_VERSION:S/esr//:S/b/beta/} +REVISION = 0 # XXX badly formed debug in libxul ? DWZ = : @@ -67,17 +68,27 @@ CONFIGURE_ARGS += --with-system-ffi CONFIGURE_ARGS += --with-system-librnp CONFIGURE_ARGS += --enable-release #1386371 +# hardening imported from the librewolf port +CONFIGURE_ARGS += --disable-crashreporter \ + --disable-tests \ + --enable-hardening \ + --enable-stl-hardening \ + --enable-rust-simd + # --enable-debug does too much, this defaults to -g (which is 3 times larger than using -ggdb1) CONFIGURE_ARGS += --disable-debug-symbols DEBUG_CONFIGURE_ARGS += --enable-debug-symbols \ --disable-install-strip MAKE_ENV += BUILD_VERBOSE_LOG="1" CARGOFLAGS="-j${MAKE_JOBS}" +# hardened flags for the build +HARDFLAGS = -ftrivial-auto-var-init=zero -fwrapv -Wno-backend-plugin .if ${MACHINE_ARCH} == aarch64 # retguard leads to segfault at startup on arm64, cf #1973016 -CONFIGURE_ENV += CPPFLAGS="-fno-ret-protector -Wno-backend-plugin" -.else -CONFIGURE_ENV += CPPFLAGS=-Wno-backend-plugin +HARDFLAGS += -fno-ret-protector .endif +CONFIGURE_ENV += CFLAGS="${HARDFLAGS}" +CONFIGURE_ENV += CPPFLAGS="${HARDFLAGS}" +CONFIGURE_ENV += CXXFLAGS="${HARDFLAGS}" CONFIGURE_ENV += LDFLAGS="-Wl,--threads=5 --ld-path=${WRKDIR}/bin/ld" # #2026497 diff --git a/www/firefox-esr/Makefile b/www/firefox-esr/Makefile index 5c3b79b6e2b..38a09525a89 100644 --- a/www/firefox-esr/Makefile +++ b/www/firefox-esr/Makefile @@ -7,6 +7,7 @@ MOZILLA_PROJECT = firefox-esr MOZILLA_CODENAME = browser MOZILLA_DIST = firefox MOZILLA_PROFDATA_TASKID = BG92wx2xQXCqzNWrQPYftA +REVISION = 0 WRKDIST = ${WRKDIR}/${MOZILLA_DIST}-${MOZILLA_DIST_VERSION:C/esr//} HOMEPAGE = https://www.mozilla.org/firefox/organizations/ @@ -52,12 +53,14 @@ CONFIGURE_SCRIPT = ${MODPY_BIN} ${WRKSRC}/configure.py CONFIGURE_ARGS += --prefix=${PREFIX} CONFIGURE_ARGS += --enable-official-branding MAKE_ENV += BUILD_VERBOSE_LOG="1" CARGOFLAGS="-j${MAKE_JOBS}" +HARDFLAGS = -ftrivial-auto-var-init=zero -fwrapv -Wno-backend-plugin .if ${MACHINE_ARCH} == aarch64 # retguard leads to segfault at startup on arm64, cf #1973016 -CONFIGURE_ENV += CPPFLAGS="-fno-ret-protector -Wno-backend-plugin" -.else -CONFIGURE_ENV += CPPFLAGS=-Wno-backend-plugin +HARDFLAGS += -fno-ret-protector .endif +CONFIGURE_ENV += CFLAGS="${HARDFLAGS}" +CONFIGURE_ENV += CPPFLAGS="${HARDFLAGS}" +CONFIGURE_ENV += CXXFLAGS="${HARDFLAGS}" NCPU !!= sysctl -n hw.ncpuonline .if ${NCPU} > 4 CONFIGURE_ENV += LDFLAGS="-Wl,--threads=5 --ld-path=${WRKDIR}/bin/ld" @@ -81,6 +84,15 @@ CONFIGURE_ARGS += --with-wasi-sysroot=${LOCALBASE}/share/wasi-sysroot CONFIGURE_ARGS += --enable-lto=thin .endif +# hardening imported from the librewolf port +CONFIGURE_ARGS += --disable-crashreporter \ + --disable-default-browser-agent \ + --disable-tests \ + --disable-cargo-incremental \ + --enable-hardening \ + --enable-stl-hardening \ + --enable-rust-simd + # XXX badly formed debug DWZ = : DEBUG_PACKAGES = ${BUILD_PACKAGES} diff --git a/www/mozilla-firefox/Makefile b/www/mozilla-firefox/Makefile index bb0f85b5c62..5e57b8f00e6 100644 --- a/www/mozilla-firefox/Makefile +++ b/www/mozilla-firefox/Makefile @@ -8,6 +8,7 @@ MOZILLA_BRANCH = release MOZILLA_PROJECT = firefox MOZILLA_CODENAME = browser MOZILLA_PROFDATA_TASKID = cNOKkWdaQfOqEzllBpy9Rw +REVISION = 0 WRKDIST = ${WRKDIR}/${MOZILLA_DIST}-${MOZILLA_DIST_VERSION:C/b[0-9]*//} HOMEPAGE = https://www.mozilla.org/firefox/ @@ -51,12 +52,15 @@ CONFIGURE_SCRIPT = ${MODPY_BIN} ${WRKSRC}/configure.py CONFIGURE_ARGS += --prefix=${PREFIX} CONFIGURE_ARGS += --enable-official-branding MAKE_ENV += BUILD_VERBOSE_LOG="1" CARGOFLAGS="-j${MAKE_JOBS}" +# hardened flags for the build +HARDFLAGS = -ftrivial-auto-var-init=zero -fwrapv -Wno-backend-plugin .if ${MACHINE_ARCH} == aarch64 # retguard leads to segfault at startup on arm64, cf #1973016 -CONFIGURE_ENV += CPPFLAGS="-fno-ret-protector -Wno-backend-plugin" -.else -CONFIGURE_ENV += CPPFLAGS=-Wno-backend-plugin +HARDFLAGS += -fno-ret-protector .endif +CONFIGURE_ENV += CFLAGS="${HARDFLAGS}" +CONFIGURE_ENV += CPPFLAGS="${HARDFLAGS}" +CONFIGURE_ENV += CXXFLAGS="${HARDFLAGS}" CONFIGURE_ENV += LDFLAGS="-Wl,--threads=4 --ld-path=${WRKDIR}/bin/ld" # 2026497 CONFIGURE_ENV += MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE=none @@ -72,6 +76,15 @@ CONFIGURE_ARGS += --with-wasi-sysroot=${LOCALBASE}/share/wasi-sysroot CONFIGURE_ARGS += --enable-lto=thin .endif +# hardening imported from the librewolf port +CONFIGURE_ARGS += --disable-crashreporter \ + --disable-default-browser-agent \ + --disable-tests \ + --disable-cargo-incremental \ + --enable-hardening \ + --enable-stl-hardening \ + --enable-rust-simd + # XXX badly formed debug ? DWZ = : DEBUG_PACKAGES = ${BUILD_PACKAGES} diff --git a/www/seamonkey/Makefile b/www/seamonkey/Makefile index 0c7756c9e48..519fffc95c6 100644 --- a/www/seamonkey/Makefile +++ b/www/seamonkey/Makefile @@ -10,7 +10,7 @@ MOZILLA_PROJECT = seamonkey MOZILLA_CODENAME = comm/suite SITES = https://archive.seamonkey-project.org/releases/${MOZILLA_DIST_VERSION}/source/ -REVISION-main = 0 +REVISION-main = 1 # unbreaks build with modern rust cf #1896958 SITES.p = https://bugzilla.mozilla.org/ @@ -67,6 +67,16 @@ BUILD_DEPENDS += devel/autoconf/2.13 # for distutils; possibly not needed any more BUILD_DEPENDS += devel/py-setuptools +# hardened flags for the build +HARDFLAGS = -ftrivial-auto-var-init=zero -fwrapv -Wno-backend-plugin +.if ${MACHINE_ARCH} == aarch64 +# retguard may lead to segfault on arm64 +HARDFLAGS += -fno-ret-protector +.endif +CONFIGURE_ENV += CFLAGS="${HARDFLAGS}" +CONFIGURE_ENV += CPPFLAGS="${HARDFLAGS}" +CONFIGURE_ENV += CXXFLAGS="${HARDFLAGS}" + # lld blows when linking libxul; limit threads .if ${MACHINE_ARCH:Mi386} CONFIGURE_ENV += LDFLAGS="-Wl,--threads=2" @@ -86,6 +96,12 @@ CONFIGURE_ARGS += --enable-calendar # remove post 96 CONFIGURE_ARGS += --disable-necko-wifi +# hardening imported from the librewolf port +CONFIGURE_ARGS += --disable-crashreporter \ + --disable-tests \ + --enable-hardening \ + --enable-rust-simd + # XXX badly formed debug ? DWZ = : DEBUG_PACKAGES = ${BUILD_PACKAGES:N-lightning} diff --git a/www/tor-browser/browser/Makefile b/www/tor-browser/browser/Makefile index fad4ce8d13b..764670789ae 100644 --- a/www/tor-browser/browser/Makefile +++ b/www/tor-browser/browser/Makefile @@ -7,6 +7,7 @@ COMMENT = modified version of Firefox ESR for browsing over Tor MOZILLA_VERSION = ${TB_VERSION} MOZILLA_PROJECT = ${BROWSER_NAME} MOZILLA_CODENAME = browser +REVISION = 0 EXTRACT_SUFX = .tar.xz @@ -77,10 +78,20 @@ NO_TEST = Yes WRKDIST = ${WRKDIR}/${DISTNAME:S/src-//} +# hardened flags for the build +HARDFLAGS = -ftrivial-auto-var-init=zero -fwrapv -Wno-backend-plugin +.if ${MACHINE_ARCH} == aarch64 +# retguard leads to segfault at startup on arm64, cf #1973016 +HARDFLAGS += -fno-ret-protector +.endif + CONFIGURE_STYLE = simple CONFIGURE_SCRIPT = ${MODPY_BIN} ${WRKSRC}/configure.py CONFIGURE_ARGS += --prefix=${PREFIX} MAKE_ENV += BUILD_VERBOSE_LOG="1" CARGOFLAGS="-j${MAKE_JOBS}" +CONFIGURE_ENV += CFLAGS="${HARDFLAGS}" +CONFIGURE_ENV += CPPFLAGS="${HARDFLAGS}" +CONFIGURE_ENV += CXXFLAGS="${HARDFLAGS}" CONFIGURE_ENV += LDFLAGS="-Wl,--threads=${MAKE_JOBS} --ld-path=${WRKDIR}/bin/ld" # app-name etc. for tor-browser @@ -109,6 +120,14 @@ CONFIGURE_ARGS += --with-wasi-sysroot=${LOCALBASE}/share/wasi-sysroot CONFIGURE_ARGS += --enable-lto=thin .endif +# hardening imported from the librewolf port +CONFIGURE_ARGS += --disable-crashreporter \ + --disable-default-browser-agent \ + --disable-tests \ + --disable-cargo-incremental \ + --enable-hardening \ + --enable-rust-simd + # XXX badly formed debug DWZ = : #DEBUG_PACKAGES = ${BUILD_PACKAGES} -- 2.47.3
OpenPGP_0x5C654067D383B1FF.asc
Description: OpenPGP public key
OpenPGP_signature.asc
Description: OpenPGP digital signature
