bac379f30a
The nixpkgs manual contains references to both sri hash and explicit sha256 attributes. This is at best confusing to new users. Since the final destination is exclusive use of sri hashes, see nixos/rfcs#131, might as well push new users in that direction gently. Notable exceptions to sri hash support are builtins.fetchTarball, cataclysm-dda, coq, dockerTools.pullimage, elixir.override, and fetchCrate. None, other than builtins.fetchTarball, are fundamentally incompatible, but all currently accept explicit sha256 attributes as input. Because adding backwards compatibility is out of scope for this change, they have been left intact, but migration to sri format has been made for any using old hash formats. All hashes have been manually tested to be accurate, and updates were only made for missing upstream artefacts or bugs.
55 lines
2.9 KiB
Markdown
55 lines
2.9 KiB
Markdown
# Firefox {#sec-firefox}
|
|
|
|
## Build wrapped Firefox with extensions and policies {#build-wrapped-firefox-with-extensions-and-policies}
|
|
|
|
The `wrapFirefox` function allows to pass policies, preferences and extensions that are available to Firefox. With the help of `fetchFirefoxAddon` this allows to build a Firefox version that already comes with add-ons pre-installed:
|
|
|
|
```nix
|
|
{
|
|
# Nix firefox addons only work with the firefox-esr package.
|
|
myFirefox = wrapFirefox firefox-esr-unwrapped {
|
|
nixExtensions = [
|
|
(fetchFirefoxAddon {
|
|
name = "ublock"; # Has to be unique!
|
|
url = "https://addons.mozilla.org/firefox/downloads/file/3679754/ublock_origin-1.31.0-an+fx.xpi";
|
|
hash = "sha256-2e73AbmYZlZXCP5ptYVcFjQYdjDp4iPoEPEOSCVF5sA=";
|
|
})
|
|
];
|
|
|
|
extraPolicies = {
|
|
CaptivePortal = false;
|
|
DisableFirefoxStudies = true;
|
|
DisablePocket = true;
|
|
DisableTelemetry = true;
|
|
DisableFirefoxAccounts = true;
|
|
FirefoxHome = {
|
|
Pocket = false;
|
|
Snippets = false;
|
|
};
|
|
UserMessaging = {
|
|
ExtensionRecommendations = false;
|
|
SkipOnboarding = true;
|
|
};
|
|
SecurityDevices = {
|
|
# Use a proxy module rather than `nixpkgs.config.firefox.smartcardSupport = true`
|
|
"PKCS#11 Proxy Module" = "${pkgs.p11-kit}/lib/p11-kit-proxy.so";
|
|
};
|
|
};
|
|
|
|
extraPrefs = ''
|
|
// Show more ssl cert infos
|
|
lockPref("security.identityblock.show_extended_validation", true);
|
|
'';
|
|
};
|
|
}
|
|
```
|
|
|
|
If `nixExtensions != null`, then all manually installed add-ons will be uninstalled from your browser profile.
|
|
To view available enterprise policies, visit [enterprise policies](https://github.com/mozilla/policy-templates#enterprisepoliciesenabled)
|
|
or type into the Firefox URL bar: `about:policies#documentation`.
|
|
Nix installed add-ons do not have a valid signature, which is why signature verification is disabled. This does not compromise security because downloaded add-ons are checksummed and manual add-ons can't be installed. Also, make sure that the `name` field of `fetchFirefoxAddon` is unique. If you remove an add-on from the `nixExtensions` array, rebuild and start Firefox: the removed add-on will be completely removed with all of its settings.
|
|
|
|
## Troubleshooting {#sec-firefox-troubleshooting}
|
|
If add-ons are marked as broken or the signature is invalid, make sure you have Firefox ESR installed. Normal Firefox does not provide the ability anymore to disable signature verification for add-ons thus nix add-ons get disabled by the normal Firefox binary.
|
|
|
|
If add-ons do not appear installed despite being defined in your nix configuration file, reset the local add-on state of your Firefox profile by clicking `Help -> More Troubleshooting Information -> Refresh Firefox`. This can happen if you switch from manual add-on mode to nix add-on mode and then back to manual mode and then again to nix add-on mode.
|