From 98bdae95f77dd77da34c60ec8cc9b7fe265bee8a Mon Sep 17 00:00:00 2001
From: Jan Horak <jhorak@redhat.com>
Date: Mon, 16 Feb 2026 19:03:26 +0100
Subject: [PATCH] Update to 140.8.0 esr

Resolves: RHEL-146468
---
 .gitignore               |  2 ++
 D278532-fips-keydb.diff  | 18 ++++++++++++++++++
 firefox.spec             | 14 ++++++++++----
 process-official-tarball |  2 +-
 sources                  |  4 ++--
 5 files changed, 33 insertions(+), 7 deletions(-)
 create mode 100644 D278532-fips-keydb.diff

diff --git a/.gitignore b/.gitignore
index 3121a69..8d8d5e6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -405,3 +405,5 @@
 /firefox-langpacks-140.6.0esr-20251202.tar.xz
 /firefox-140.7.0esr.processed-source.tar.xz
 /firefox-langpacks-140.7.0esr-20260107.tar.xz
+/firefox-langpacks-140.8.0esr-20260216.tar.xz
+/firefox-140.8.0esr.processed-source.tar.xz
diff --git a/D278532-fips-keydb.diff b/D278532-fips-keydb.diff
new file mode 100644
index 0000000..da7f8e0
--- /dev/null
+++ b/D278532-fips-keydb.diff
@@ -0,0 +1,18 @@
+diff --git a/security/manager/ssl/nsNSSIOLayer.cpp b/security/manager/ssl/nsNSSIOLayer.cpp
+--- a/security/manager/ssl/nsNSSIOLayer.cpp
++++ b/security/manager/ssl/nsNSSIOLayer.cpp
+@@ -1256,13 +1256,10 @@
+   // success of this function.
+   PRFileDesc* sslSock = SSL_ImportFD(nullptr, fd);
+   if (!sslSock) {
+     return nullptr;
+   }
+-  if (SSL_SetPKCS11PinArg(sslSock, infoObject) != SECSuccess) {
+-    return nullptr;
+-  }
+   if (SSL_HandshakeCallback(sslSock, HandshakeCallback, infoObject) !=
+       SECSuccess) {
+     return nullptr;
+   }
+   if (SSL_SecretCallback(sslSock, SecretCallback, infoObject) != SECSuccess) {
+
diff --git a/firefox.spec b/firefox.spec
index 3df3d11..dfb2246 100644
--- a/firefox.spec
+++ b/firefox.spec
@@ -191,7 +191,7 @@ end}
 
 Summary:        Mozilla Firefox Web browser
 Name:           firefox
-Version:        140.7.0
+Version:        140.8.0
 Release:        1%{?dist}
 URL:            https://www.mozilla.org/firefox/
 License:        MPLv1.1 or GPLv2+ or LGPLv2+
@@ -222,7 +222,7 @@ ExcludeArch:    aarch64 s390 ppc
 # Link to original tarball: https://archive.mozilla.org/pub/firefox/releases/%%{version}%%{?pre_version}/source/firefox-%%{version}%%{?pre_version}.source.tar.xz
 Source0:        firefox-%{version}%{?pre_version}%{?buildnum}.processed-source.tar.xz
 %if %{with langpacks}
-Source1:        firefox-langpacks-%{version}%{?pre_version}-20260107.tar.xz
+Source1:        firefox-langpacks-%{version}%{?pre_version}-20260216.tar.xz
 %endif
 Source2:        cbindgen-vendor.tar.xz
 Source3:        process-official-tarball
@@ -325,6 +325,8 @@ Patch201:       D224587.1728128070.diff
 Patch202:       D224588.1728128098.diff
 Patch203:       wasi.patch
 
+Patch210:       D278532-fips-keydb.diff
+
 # ---- Test patches ----
 # Generate without context by
 # GENDIFF_DIFF_ARGS=-U0 gendiff firefox-xxxx .firefox-tests-xpcshell
@@ -541,7 +543,6 @@ Obsoletes:      mozilla <= 37:1.7.13
 Provides:       webclient
 
 # Bundled libraries
-#Provides: bundled(libjxl) it's used only on nightly builds
 Provides: bundled(abseil-cpp)
 Provides: bundled(angle)
 Provides: bundled(aom)
@@ -587,7 +588,7 @@ Provides: bundled(libepoxy)
 Provides: bundled(libfuzzer)
 Provides: bundled(libgbm)
 Provides: bundled(libjpeg)
-Provides: bundled(libjxl)
+Provides: bundled(jxl-rs)
 Provides: bundled(libmar)
 Provides: bundled(libmkv)
 Provides: bundled(libnestegg)
@@ -1388,6 +1389,8 @@ export LIBCLANG_RT=`pwd`/wasi-sdk-20/build/compiler-rt/lib/wasi/libclang_rt.buil
 %patch -P202 -p1 -b .D224588
 %endif
 
+%patch -P210 -p1 -b .D278532-fips-keydb
+
 # ---- Security patches ----
 
 %{__rm} -f .mozconfig
@@ -2137,6 +2140,9 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
 #---------------------------------------------------------------------
 
 %changelog
+* Mon Feb 16 2026 Jan Horak <jhorak@redhat.com> - 140.8.0-1
+- Update to 140.8.0 ESR
+
 * Wed Jan  7 2026 Jan Horak <jhorak@redhat.com> - 140.7.0-1
 - Update to 140.7.0 ESR
 
diff --git a/process-official-tarball b/process-official-tarball
index fed6a71..5b28c16 100755
--- a/process-official-tarball
+++ b/process-official-tarball
@@ -27,7 +27,7 @@ rm -vrf ./process-tarball-dir/*/modules/zlib
 processed_tarball=${1/source/processed-source}
 
 cd ./process-tarball-dir
-tar -cf - ./* | xz -9 -T 0 -f > $processed_tarball
+tar -cf - ./* | xz -9 -T 8 -f > $processed_tarball
 mv $processed_tarball ..
 cd ..
 
diff --git a/sources b/sources
index 29e1d5c..04fc827 100644
--- a/sources
+++ b/sources
@@ -4,5 +4,5 @@ SHA512 (nss-3.112.0-1.el9_4.src.rpm) = 6386239e79f8095b05270b3c8b76ac9203b0df196
 SHA512 (nss-3.112.0-4.el8_2.src.rpm) = 59cca3df7a0ec6a731f4a36f8f560d496d240da0c16650f047ae686e683b883dc2630aedbe46a8b2cb21662c15f03f1efbe99da42055cc3a5418da4839e28da2
 SHA512 (nspr-4.36.0-2.el8_2.src.rpm) = fcc720afd2453a5110975fac9dd06f636491234780b62cbfcc235a485b4935e97c4f438292c686d27d9dc86b56f43399c024bee4fffcdff5f27c62d105310645
 SHA512 (cbindgen-vendor.tar.xz) = 79becf7e70bddbbebfd8c3eaf8c0003e29e267bfbcd64b9801ed2cfd35f5de9d04bb55afcf379f784b5a1e2b9b83c6b14eb6af6219ed5ccea1df29fc24e5614c
-SHA512 (firefox-140.7.0esr.processed-source.tar.xz) = 54bf9ae899314ce31d1d6d1c3e62c7e8ff0c744f9acb29864aa33431df8bd25e15668bc3e87548d305eb2aec0f9f78030c720fdf8ea4ce24cbe87ce0c3076baa
-SHA512 (firefox-langpacks-140.7.0esr-20260107.tar.xz) = 94a62aea3b43a99e16939f0b0ca4a6ed4e9c21a9c8be528c889d825582ce4bf1327d089cb44a944077d5c088bbf27ef03d851cc12f30c27f4853dbe871836fc6
+SHA512 (firefox-langpacks-140.8.0esr-20260216.tar.xz) = 96c647b5b0c5ce4aa2a66df34e9be5a4825b3790f77a42bd6c51f7240c2424e75a4b264f583f309273d8cbffc1d0ca08733e680bad6b18e92c66c9b6c03ec7cd
+SHA512 (firefox-140.8.0esr.processed-source.tar.xz) = ab8315dfd4e118dde5517032e7f87925641c7a42af9472a215b8661cc85b1112b988417c84ed4224533395c9b8564b06ba9809cf0d99c788ebcf0f658fc9baaf