4 ms·

When I download the Unbranded/"Nightly" build, it says it's v107.0.1, versus Stable is v109.0. You seemed to be of the impression the declared version string w

by jakear 4y ago

When I download the Unbranded/"Nightly" build, it says it's v107.0.1, versus Stable is v109.0. You seemed to be of the impression the declared version string was incorrect, so I dug a bit deeper. The security fixes mentioned in the changelog for v109, such as CVE-2023-23601 [1] are not present in the latest Unbranded/"Nightly" release. So basically Mozilla telling developers: want to be able to run your own code? Fine. But only if you use a months-old browser subject to a bunch of security vulnerabilities we keep a list of on our website for any would-be attacker to consult. [1] https://www.mozilla.org/en-US/security/advisories/mfsa2023-01/#CVE-2023-23601 https://www.mozilla.org/en-US/security/advisories/mfsa2023-0...

TazeTSchnitzel 4y ago
The interface is unfriendly to say the least, but if I follow the trail • https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded_Builds https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded... (click “release”) • https://treeherder.mozilla.org/jobs?repo=mozilla-release&searchStr=addon https://treeherder.mozilla.org/jobs?repo=mozilla-release&sea... (click the date of the most recent complete build) • https://treeherder.mozilla.org/jobs?repo=mozilla-release&searchStr=addon&revision=dddf31a42e95b6fcf751937c3340f772f603b3f7 https://treeherder.mozilla.org/jobs?repo=mozilla-release&sea... (click “B” next to your desired platform, OS X in my case) • https://treeherder.mozilla.org/jobs?repo=mozilla-release&searchStr=addon&revision=dddf31a42e95b6fcf751937c3340f772f603b3f7&selectedTaskRun=NglUFgUWRc2g98WLCBI-jw.0 https://treeherder.mozilla.org/jobs?repo=mozilla-release&sea... (click “Artifacts and Debugging”, then “target.dmg”/“target.zip”) • https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/NglUFgUWRc2g98WLCBI-jw/runs/0/artifacts/public/build/target.dmg https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task... … then I get a “Nightly” build reporting version 109.0.1. The direct links to the latest releases should be better maintained for sure, and it did take me longer than I'd like to figure out the build interface.

by jakear 4y ago

TazeTSchnitzel 4y ago

The interface is unfriendly to say the least, but if I follow the trail • https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded_Builds https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded... (click “release”) • https://treeherder.mozilla.org/jobs?repo=mozilla-release&searchStr=addon https://treeherder.mozilla.org/jobs?repo=mozilla-release&sea... (click the date of the most recent complete build) • https://treeherder.mozilla.org/jobs?repo=mozilla-release&searchStr=addon&revision=dddf31a42e95b6fcf751937c3340f772f603b3f7 https://treeherder.mozilla.org/jobs?repo=mozilla-release&sea... (click “B” next to your desired platform, OS X in my case) • https://treeherder.mozilla.org/jobs?repo=mozilla-release&searchStr=addon&revision=dddf31a42e95b6fcf751937c3340f772f603b3f7&selectedTaskRun=NglUFgUWRc2g98WLCBI-jw.0 https://treeherder.mozilla.org/jobs?repo=mozilla-release&sea... (click “Artifacts and Debugging”, then “target.dmg”/“target.zip”) • https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/NglUFgUWRc2g98WLCBI-jw/runs/0/artifacts/public/build/target.dmg https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task... … then I get a “Nightly” build reporting version 109.0.1. The direct links to the latest releases should be better maintained for sure, and it did take me longer than I'd like to figure out the build interface.