MX 17 Repository: The firefox thread

[mmikeinsantarosa]

We have firefox-66.0 in main now.

It's probably a good idea to upgrade now as there were a couple of critical security vulnerabilities fixed in this one.

Check out the release notes page for more info.

- mike

[TJ Hoye]

Should we wait a bit on this? My synaptic, after a reload, says:

GPG error: http://la.mxrepo.com/antix/stretch stretch InRelease: The following signatures were invalid: EXPKEYSIG DB36CDF3452F0C20 antiX (antix repo) <antix@daveserver.info>The repository 'http://la.mxrepo.com/antix/stretch stretch InRelease' is not signed.

[mmikeinsantarosa]

Should we wait a bit on this? My synaptic, after a reload, says:

GPG error: http://la.mxrepo.com/antix/stretch stretch InRelease: The following signatures were invalid: EXPKEYSIG DB36CDF3452F0C20 antiX (antix repo) <antix@daveserver.info>The repository 'http://la.mxrepo.com/antix/stretch stretch InRelease' is not signed.

Check synaptic to make sure the package antix-archive-keyring is at rev 20019.3.13 and if it's not update it and try again.

- mike

[Stevo]

Installed and working well!

[mmikeinsantarosa]

Installed and working well!

Thanks for the testing post.

[mmikeinsantarosa]

firefox-66.0.2 is ready to upgrade to.

I didn't see any big fixes in this one but in case you want to see for yourself, the release notes page can be viewed here.

- mike

[Stevo]

Working fine so far.


As an experiment, I tried using uscan instead of "get-orig-source" to get the newer source files, but it just got the 64-bit tarball, so obviously the debian/watch file needs to be reworked to work with uscan.

[kmathern]

As an experiment, I tried using uscan instead of "get-orig-source" to get the newer source files, but it just got the 64-bit tarball, so obviously the debian/watch file needs to be reworked to work with uscan.

As far as I know uscan will only download one upstream source tarball file at a time, but we include both the 32bit & 64bit tarballs in our firefox_xx.y.z.orig.tar.xz source, so uscan needs to be run twice (once for each architecture).

The "get-orig-source" command uses uscan and the debian/watch-i386 watch file to download the 32bit tarballs from
http://ftp.mozilla.org/pub/firefox/releases/xx.y.z/linux-i686/en-US/

And it uses the debian/watch-amd64 watch file with uscan to download the 64bit tarballs from
http://ftp.mozilla.org/pub/firefox/releases/xx.y.z/linux-x86_64/en-US/

Also the debian/watch file is the same as the debian/watch-amd64 file.

uscan uses the debian/watch file by default if you don't specify with the --watchfile option which watch file to use, so it also downloads the 64bit tarball ("get-orig-source" uses the --watchfile option in it's uscan calls).

[Stevo]

Yes, probably best not to poke a stick into what's working.

Uscan does work well for real source code: I just used it to get and "dfsg-y" a KeepassXC 2.4.0 source tarball.

[mmikeinsantarosa]

firefox-66.0.3 is available to upgrade to now from main.

I didn't see any security updates in this one and as always, feel free to check the release notes page for more info.

- mike