Import from CS git

.firefox.metadata

@@ -1,6 +1,6 @@
 5012b69e54cbebe3b5e74011dacf3a2097f49921 SOURCES/cbindgen-vendor.tar.xz
-fa21cbfa3a9b3722ce728009fb4f32ae162ca3e3 SOURCES/firefox-128.8.0esr.processed-source.tar.xz
+271e087aaa09420f7ae42972e7c5375b2a9c1bb5 SOURCES/firefox-128.9.0esr.b2.processed-source.tar.xz
-419baa0ca1266206aaecd844fd3ab7fad084e55a SOURCES/firefox-langpacks-128.8.0esr-20250224.tar.xz
+2d4e4bfa9731134056380841228ad4a44a2ba3ac SOURCES/firefox-langpacks-128.9.0esr-20250331.tar.xz
 2d8a6b2b30d5496735f49ffe8c8a7ede3a78a5ca SOURCES/mochitest-python.tar.gz
 d744f92e874688cc4b5376477dfdd639a97a6cd4 SOURCES/nspr-4.35.0-1.el8_1.src.rpm
 f466d7213e85773e002c48897524eaf909480046 SOURCES/nss-3.101.0-7.el8_2.src.rpm

.gitignore

@@ -1,6 +1,6 @@
 SOURCES/cbindgen-vendor.tar.xz
-SOURCES/firefox-128.8.0esr.processed-source.tar.xz
+SOURCES/firefox-128.9.0esr.b2.processed-source.tar.xz
-SOURCES/firefox-langpacks-128.8.0esr-20250224.tar.xz
+SOURCES/firefox-langpacks-128.9.0esr-20250331.tar.xz
 SOURCES/mochitest-python.tar.gz
 SOURCES/nspr-4.35.0-1.el8_1.src.rpm
 SOURCES/nss-3.101.0-7.el8_2.src.rpm

SOURCES/disable-vsync-for-kiosk.patch

@@ -0,0 +1,18 @@
+diff -up firefox-128.8.0/widget/gtk/nsWindow.cpp.kiosk-vsync firefox-128.8.0/widget/gtk/nsWindow.cpp
+--- firefox-128.8.0/widget/gtk/nsWindow.cpp.kiosk-vsync	2025-03-13 13:04:03.112498669 +0100
++++ firefox-128.8.0/widget/gtk/nsWindow.cpp	2025-03-13 13:06:13.227823446 +0100
+@@ -6348,9 +6348,13 @@ nsresult nsWindow::Create(nsIWidget* aPa
+   // Initialize the window specific VsyncSource early in order to avoid races
+   // with BrowserParent::UpdateVsyncParentVsyncDispatcher().
+   // Only use for toplevel windows for now, see bug 1619246.
++  //
++  // Disable vsync for the kiosk mode - it cause the black screen
++  // This will be fixed in Firefox 140
+   if (GdkIsWaylandDisplay() &&
+       StaticPrefs::widget_wayland_vsync_enabled_AtStartup() &&
+-      IsTopLevelWindowType()) {
++      IsTopLevelWindowType() && 
++      !gKioskMode ) {
+     mWaylandVsyncSource = new WaylandVsyncSource(this);
+     mWaylandVsyncDispatcher = new VsyncDispatcher(mWaylandVsyncSource);
+     LOG_VSYNC("  created WaylandVsyncSource");

SOURCES/process-official-tarball

@@ -18,6 +18,9 @@ rm -vf ./process-tarball-dir/*/mobile/android/android-components/components/feat
 rm -vf ./process-tarball-dir/*/third_party/webkit/PerformanceTests/Speedometer3/resources/editors/dist/assets/codemirror-521de7ab.js
 rm -vf ./process-tarball-dir/*/third_party/python/pip/pip-24.0.dist-info/AUTHORS.txt
 
+# We uses system freetype2
+rm -vrf ./process-tarball-dir/*/modules/freetype2
+
 processed_tarball=${1/source/processed-source}
 
 cd ./process-tarball-dir

SOURCES/rhbz-71999-fips-youtube.patch

@@ -0,0 +1,43 @@
+changeset:   781221:573380ae60a7
+tag:         tip
+user:        stransky <stransky@redhat.com>
+date:        Mon Mar 24 10:13:50 2025 +0100
+files:       dom/cache/CacheStorage.cpp dom/indexedDB/ActorsParent.cpp
+description:
+FIPS-youtube
+
+
+diff --git a/dom/cache/CacheStorage.cpp b/dom/cache/CacheStorage.cpp
+--- a/dom/cache/CacheStorage.cpp
++++ b/dom/cache/CacheStorage.cpp
+@@ -38,6 +38,7 @@
+ #include "nsURLParsers.h"
+ #include "js/Object.h"              // JS::GetClass
+ #include "js/PropertyAndElement.h"  // JS_DefineProperty
++#include "pk11pub.h"
+ 
+ namespace mozilla::dom::cache {
+ 
+@@ -581,7 +582,7 @@ bool CacheStorage::HasStorageAccess(UseC
+     if (!principal->IsSystemPrincipal() &&
+         principal->GetPrivateBrowsingId() !=
+             nsIScriptSecurityManager::DEFAULT_PRIVATE_BROWSING_ID &&
+-        !StaticPrefs::dom_cache_privateBrowsing_enabled()) {
++        (!StaticPrefs::dom_cache_privateBrowsing_enabled() || PK11_IsFIPS())) {
+       return false;
+     }
+   }
+diff --git a/dom/indexedDB/ActorsParent.cpp b/dom/indexedDB/ActorsParent.cpp
+--- a/dom/indexedDB/ActorsParent.cpp
++++ b/dom/indexedDB/ActorsParent.cpp
+@@ -14791,7 +14791,8 @@ nsresult FactoryOp::Open() {
+     mEnforcingQuota = mPersistenceType != PERSISTENCE_TYPE_PERSISTENT;
+ 
+     if (mOriginMetadata.mIsPrivate) {
+-      if (StaticPrefs::dom_indexedDB_privateBrowsing_enabled()) {
++      if (StaticPrefs::dom_indexedDB_privateBrowsing_enabled() &&
++          !PK11_IsFIPS()) {
+         // Explicitly disallow moz-extension urls from using the encrypted
+         // indexedDB storage mode when the caller is an extension (see Bug
+         // 1841806).
+

SPECS/firefox.spec

@@ -156,7 +156,7 @@ end}
 # If set to .b2 or .b3 ... the processed source file needs to be renamed before upload, e.g.
 # firefox-102.8.0esr.b2.processed-source.tar.xz
 # When unset use processed source file name as is.
-##global buildnum .b2
+%global buildnum .b2
 
 %bcond_without langpacks
 
@@ -166,8 +166,8 @@ end}
 
 Summary:        Mozilla Firefox Web browser
 Name:           firefox
-Version:        128.8.0
+Version:        128.9.0
-Release:        1%{?dist}
+Release:        2%{?dist}
 URL:            https://www.mozilla.org/firefox/
 License:        MPLv1.1 or GPLv2+ or LGPLv2+
 
@@ -197,7 +197,7 @@ ExcludeArch:    aarch64 s390 ppc
 # Link to original tarball: https://archive.mozilla.org/pub/firefox/releases/%%{version}%%{?pre_version}/source/firefox-%%{version}%%{?pre_version}.source.tar.xz
 Source0:        firefox-%{version}%{?pre_version}%{?buildnum}.processed-source.tar.xz
 %if %{with langpacks}
-Source1:        firefox-langpacks-%{version}%{?pre_version}-20250224.tar.xz
+Source1:        firefox-langpacks-%{version}%{?pre_version}-20250331.tar.xz
 %endif
 Source2:        cbindgen-vendor.tar.xz
 Source3:        process-official-tarball
@@ -244,6 +244,10 @@ Patch09:        rhbz-2131158-webrtc-nss-fix.patch
 Patch10:        build-ffvpx.patch
 Patch11:        build-disable-gamepad.patch
 Patch12:        firefox-system-nss-replace-xyber-with-mlkem.patch
+# Enabled vsync cause the black screen when running in Kiosk mode
+# This will be fixed in Firefox 140
+Patch13:        disable-vsync-for-kiosk.patch
+Patch14:        rhbz-71999-fips-youtube.patch
 
 # -- Upstreamed patches --
 Patch51:       mozilla-bmo1170092.patch
@@ -521,7 +525,6 @@ Provides: bundled(fastText)
 Provides: bundled(fathom)
 Provides: bundled(fdlibm)
 Provides: bundled(ffvpx)
-Provides: bundled(freetype2)
 Provides: bundled(function2)
 Provides: bundled(gbm)
 Provides: bundled(gemmology)
@@ -1223,6 +1226,8 @@ echo "--------------------------------------------"
 %if 0%{?rhel} == 10
 %patch -P12 -p1 -b .system-nss-replace-xyber-with-mlkem
 %endif
+%patch -P13 -p1 -b .kiosk-vsync
+%patch -P14 -p1 -b .rhbz-71999-fips-youtube
 
 # We need to create the wasi.patch with the correct path to the wasm libclang_rt.
 %if %{with_wasi_sdk}
@@ -1983,6 +1988,12 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
 #---------------------------------------------------------------------
 
 %changelog
+* Mon Mar 31 2025 Eike Rathke <erack@redhat.com> - 128.9.0-2
+- Update to 128.9.0 build2
+
+* Tue Mar 25 2025 Eike Rathke <erack@redhat.com> - 128.9.0-1
+- Update to 128.9.0 build1
+
 * Mon Feb 24 2025 Eike Rathke <erack@redhat.com> - 128.8.0-1
 - Update to 128.8.0 build1