Import from CS git

.firefox.metadata

@@ -1,7 +1,8 @@
-5012b69e54cbebe3b5e74011dacf3a2097f49921 SOURCES/cbindgen-vendor.tar.xz
+bc4adac8f38f5103d8f88564a1545063dd8d6402 SOURCES/cbindgen-vendor.tar.xz
-6816817f0b3b42a13dfdc38af8c61dca46b54c13 SOURCES/firefox-128.3.1esr.processed-source.tar.xz
+c25da23b50ddf8926a943f86f1180b6d96c0eff0 SOURCES/firefox-140.4.0esr.processed-source.tar.xz
-4641ad07664f375780e20200322bd5b45cd60ee8 SOURCES/firefox-langpacks-128.3.1esr-20241009.tar.xz
+22a42066c01a85b1264223041ed270b9e294d7e0 SOURCES/firefox-langpacks-140.4.0esr-20251010.tar.xz
 2d8a6b2b30d5496735f49ffe8c8a7ede3a78a5ca SOURCES/mochitest-python.tar.gz
-d744f92e874688cc4b5376477dfdd639a97a6cd4 SOURCES/nspr-4.35.0-1.el8_1.src.rpm
+0d0ddbd2a73340b3cbc977997f57222946b1e775 SOURCES/nspr-4.36.0-2.el8_2.src.rpm
-f466d7213e85773e002c48897524eaf909480046 SOURCES/nss-3.101.0-7.el8_2.src.rpm
+fd3879b176634d66f8ef64d18fdaeec98e140c23 SOURCES/nss-3.112.0-1.el9_4.src.rpm
-0413d22a58ba1bba99acec9c3c2a4db56a4100c7 SOURCES/nss-3.101.0-7.el9_2.src.rpm
+c3f0aaef37972107442e2796efad71be3a98ce3c SOURCES/nss-3.112.0-4.el8_2.src.rpm
+0332862626d2148648ff749078c223dbd859d901 SOURCES/wasi-sdk-20.tar.gz

.gitignore

@@ -1,7 +1,8 @@
 SOURCES/cbindgen-vendor.tar.xz
-SOURCES/firefox-128.3.1esr.processed-source.tar.xz
+SOURCES/firefox-140.4.0esr.processed-source.tar.xz
-SOURCES/firefox-langpacks-128.3.1esr-20241009.tar.xz
+SOURCES/firefox-langpacks-140.4.0esr-20251010.tar.xz
 SOURCES/mochitest-python.tar.gz
-SOURCES/nspr-4.35.0-1.el8_1.src.rpm
+SOURCES/nspr-4.36.0-2.el8_2.src.rpm
-SOURCES/nss-3.101.0-7.el8_2.src.rpm
+SOURCES/nss-3.112.0-1.el9_4.src.rpm
-SOURCES/nss-3.101.0-7.el9_2.src.rpm
+SOURCES/nss-3.112.0-4.el8_2.src.rpm
+SOURCES/wasi-sdk-20.tar.gz

SOURCES/D224587.1728128070.diff

@@ -0,0 +1,50 @@
+diff --git a/dom/media/webrtc/transport/nricectx.cpp b/dom/media/webrtc/transport/nricectx.cpp
+--- a/dom/media/webrtc/transport/nricectx.cpp
++++ b/dom/media/webrtc/transport/nricectx.cpp
+@@ -124,23 +124,30 @@
+ static int nr_crypto_nss_hmac(UCHAR* key, size_t keyl, UCHAR* buf, size_t bufl,
+                               UCHAR* result) {
+   CK_MECHANISM_TYPE mech = CKM_SHA_1_HMAC;
+   PK11SlotInfo* slot = nullptr;
+   MOZ_ASSERT(keyl > 0);
+-  SECItem keyi = {siBuffer, key, static_cast<unsigned int>(keyl)};
++  CK_KEY_DERIVATION_STRING_DATA idkey = {key, keyl};
++  SECItem keyi = {siBuffer, (unsigned char*)&idkey, sizeof(idkey)};
++  PK11SymKey* tmpKey = nullptr;
+   PK11SymKey* skey = nullptr;
+   PK11Context* hmac_ctx = nullptr;
+   SECStatus status;
+   unsigned int hmac_len;
+   SECItem param = {siBuffer, nullptr, 0};
+   int err = R_INTERNAL;
+ 
+   slot = PK11_GetInternalKeySlot();
+   if (!slot) goto abort;
+ 
+-  skey = PK11_ImportSymKey(slot, mech, PK11_OriginUnwrap, CKA_SIGN, &keyi,
+-                           nullptr);
++  // HMAC is used for hash calculation only so use derive instead of import
++  // to be FIPS compliant.
++  tmpKey = PK11_KeyGen(slot, mech, NULL, keyl, nullptr);
++  if (!tmpKey) goto abort;
++
++  skey = PK11_Derive(tmpKey, CKM_CONCATENATE_DATA_AND_BASE, &keyi, mech,
++                     CKA_SIGN, keyl);
+   if (!skey) goto abort;
+ 
+   hmac_ctx = PK11_CreateContextBySymKey(mech, CKA_SIGN, skey, &param);
+   if (!hmac_ctx) goto abort;
+ 
+@@ -157,10 +164,11 @@
+ 
+   err = 0;
+ 
+ abort:
+   if (hmac_ctx) PK11_DestroyContext(hmac_ctx, PR_TRUE);
++  if (tmpKey) PK11_FreeSymKey(tmpKey);
+   if (skey) PK11_FreeSymKey(skey);
+   if (slot) PK11_FreeSlot(slot);
+ 
+   return err;
+ }
+

SOURCES/D224588.1728128098.diff

@@ -0,0 +1,206 @@
+diff -up firefox-140.0/third_party/libsrtp/src/crypto/cipher/aes_gcm_nss.c.D224588 firefox-140.0/third_party/libsrtp/src/crypto/cipher/aes_gcm_nss.c
+--- firefox-140.0/third_party/libsrtp/src/crypto/cipher/aes_gcm_nss.c.D224588	2025-06-25 11:50:45.852066851 +0200
++++ firefox-140.0/third_party/libsrtp/src/crypto/cipher/aes_gcm_nss.c	2025-06-25 11:50:45.908794290 +0200
+@@ -56,6 +56,7 @@
+ #include "cipher_test_cases.h"
+ #include <secerr.h>
+ #include <nspr.h>
++#include "nss_fips.h"
+ 
+ srtp_debug_module_t srtp_mod_aes_gcm = {
+     0,            /* debugging is off by default */
+@@ -215,8 +216,13 @@ static srtp_err_status_t srtp_aes_gcm_ns
+     /* explicitly cast away const of key */
+     SECItem key_item = { siBuffer, (unsigned char *)(uintptr_t)key,
+                          c->key_size };
+-    c->key = PK11_ImportSymKey(slot, CKM_AES_GCM, PK11_OriginUnwrap,
+-                               CKA_ENCRYPT, &key_item, NULL);
++    if (PK11_IsFIPS()) {
++      c->key = PK11_ImportSymKey_FIPS(slot, CKM_AES_GCM, PK11_OriginUnwrap,
++                                 CKA_ENCRYPT, &key_item, NULL);
++    } else {
++      c->key = PK11_ImportSymKey(slot, CKM_AES_GCM, PK11_OriginUnwrap,
++                                 CKA_ENCRYPT, &key_item, NULL);
++    }
+     PK11_FreeSlot(slot);
+ 
+     if (!c->key) {
+diff -up firefox-140.0/third_party/libsrtp/src/crypto/cipher/aes_icm_nss.c.D224588 firefox-140.0/third_party/libsrtp/src/crypto/cipher/aes_icm_nss.c
+--- firefox-140.0/third_party/libsrtp/src/crypto/cipher/aes_icm_nss.c.D224588	2025-06-17 18:15:28.000000000 +0200
++++ firefox-140.0/third_party/libsrtp/src/crypto/cipher/aes_icm_nss.c	2025-06-25 11:50:45.909171218 +0200
+@@ -53,6 +53,7 @@
+ #include "alloc.h"
+ #include "cipher_types.h"
+ #include "cipher_test_cases.h"
++#include "nss_fips.h"
+ 
+ srtp_debug_module_t srtp_mod_aes_icm = {
+     0,            /* debugging is off by default */
+@@ -257,8 +258,13 @@ static srtp_err_status_t srtp_aes_icm_ns
+     /* explicitly cast away const of key */
+     SECItem keyItem = { siBuffer, (unsigned char *)(uintptr_t)key,
+                         c->key_size };
+-    c->key = PK11_ImportSymKey(slot, CKM_AES_CTR, PK11_OriginUnwrap,
+-                               CKA_ENCRYPT, &keyItem, NULL);
++    if (PK11_IsFIPS()) {
++      c->key = PK11_ImportSymKey_FIPS(slot, CKM_AES_CTR, PK11_OriginUnwrap,
++                                 CKA_ENCRYPT, &keyItem, NULL);
++    } else {
++      c->key = PK11_ImportSymKey(slot, CKM_AES_CTR, PK11_OriginUnwrap,
++                                 CKA_ENCRYPT, &keyItem, NULL);
++    }
+     PK11_FreeSlot(slot);
+ 
+     if (!c->key) {
+diff -up firefox-140.0/third_party/libsrtp/src/crypto/include/nss_fips.h.D224588 firefox-140.0/third_party/libsrtp/src/crypto/include/nss_fips.h
+--- firefox-140.0/third_party/libsrtp/src/crypto/include/nss_fips.h.D224588	2025-06-25 11:50:45.909524312 +0200
++++ firefox-140.0/third_party/libsrtp/src/crypto/include/nss_fips.h	2025-06-25 11:50:45.909524312 +0200
+@@ -0,0 +1,148 @@
++/*
++ * Copyright (c) 2024, Red Hat, Inc.
++ * All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ *   Redistributions of source code must retain the above copyright
++ *   notice, this list of conditions and the following disclaimer.
++ *
++ *   Redistributions in binary form must reproduce the above
++ *   copyright notice, this list of conditions and the following
++ *   disclaimer in the documentation and/or other materials provided
++ *   with the distribution.
++ *
++ *   Neither the name of the Red Hat, Inc. nor the names of its
++ *   contributors may be used to endorse or promote products derived
++ *   from this software without specific prior written permission.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
++ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
++ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
++ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
++ * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
++ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
++ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
++ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++*/
++
++/*
++  Adapted from Red Hat Ceph patch by
++  Radoslaw Zarzynski <rzarzyns@redhat.com>
++
++  PK11_ImportSymKey() is a part of NSS API that becomes unavailable
++  in the FIPS mode. Apparently NSS targets stricter restrictions
++  than those coming from Level 1 of FIPS 140-2. In the consequence,
++  loading a symmetric key from plain keyring or key db fails.
++
++  A raw crypto key is in-memory wrapped with fresh, random wrapping
++  key just before being imported via PK11_UnwrapSymKey(). Of course,
++  this effectively lowers to FIPS level 1. Still, this would be no
++  different from what OpenSSL gives in the matter.
++*/
++
++#ifndef NSS_FIPS_H
++#define NSS_FIPS_H
++
++static PK11SymKey *PK11_ImportSymKey_FIPS(
++    PK11SlotInfo * const slot,
++    const CK_MECHANISM_TYPE type,
++    const PK11Origin origin,
++    const CK_ATTRIBUTE_TYPE operation,
++    SECItem * const raw_key,
++    void * const wincx)
++{
++  PK11SymKey* wrapping_key = NULL;
++  PK11Context *wrap_key_crypt_context = NULL;
++  SECItem *raw_key_aligned = NULL;
++  CK_MECHANISM_TYPE wrap_mechanism = 0;
++
++  struct {
++    unsigned char data[256];
++    int len;
++  } wrapped_key;
++
++  #define SCOPE_DATA_FREE()                               \
++  {                                                       \
++    PK11_FreeSymKey(wrapping_key);                        \
++    PK11_DestroyContext(wrap_key_crypt_context, PR_TRUE); \
++    SECITEM_FreeItem(raw_key_aligned, PR_TRUE);           \
++  }
++
++  if(raw_key->len > sizeof(wrapped_key.data)) {
++    return NULL;
++  }
++
++  // getting 306 on my system which is CKM_DES3_ECB.
++  wrap_mechanism = PK11_GetBestWrapMechanism(slot);
++
++  // Generate a wrapping key. It will be used exactly twice over the scope:
++  //   * to encrypt raw_key giving wrapped_key,
++  //   * to decrypt wrapped_key in the internals of PK11_UnwrapSymKey().
++  wrapping_key = PK11_KeyGen(slot, wrap_mechanism, NULL,
++                             PK11_GetBestKeyLength(slot, wrap_mechanism), NULL);
++  if (wrapping_key == NULL) {
++    return NULL;
++  }
++
++  // Prepare a PK11 context for the raw_key -> wrapped_key encryption.
++  SECItem tmp_sec_item;
++  memset(&tmp_sec_item, 0, sizeof(tmp_sec_item));
++  wrap_key_crypt_context = PK11_CreateContextBySymKey(
++   wrap_mechanism,
++   CKA_ENCRYPT,
++   wrapping_key,
++   &tmp_sec_item);
++  if (wrap_key_crypt_context == NULL) {
++    SCOPE_DATA_FREE();
++    return NULL;
++  }
++
++  // Finally wrap the key. Important note is that the wrapping mechanism
++  // selection (read: just grabbing a cipher) offers, at least in my NSS
++  // copy, mostly CKM_*_ECB ciphers (with 3DES as the leading one, see
++  // wrapMechanismList[] in pk11mech.c). There is no CKM_*_*_PAD variant
++  // which means that plaintext we are providing to PK11_CipherOp() must
++  // be aligned to cipher's block size. For 3DES it's 64 bits.
++  raw_key_aligned = PK11_BlockData(raw_key, PK11_GetBlockSize(wrap_mechanism, NULL));
++  if (raw_key_aligned == NULL) {
++    SCOPE_DATA_FREE();
++    return NULL;
++  }
++
++  if (PK11_CipherOp(wrap_key_crypt_context, wrapped_key.data, &wrapped_key.len,
++      sizeof(wrapped_key.data), raw_key_aligned->data,
++      raw_key_aligned->len) != SECSuccess) {
++    SCOPE_DATA_FREE();
++    return NULL;
++  }
++
++  if (PK11_Finalize(wrap_key_crypt_context) != SECSuccess) {
++    SCOPE_DATA_FREE();
++    return NULL;
++  }
++
++  // Key is wrapped now so we can acquire the ultimate PK11SymKey through
++  // unwrapping it. Of course these two opposite operations form NOP with
++  // a side effect: FIPS level 1 compatibility.
++  memset(&tmp_sec_item, 0, sizeof(tmp_sec_item));
++
++  SECItem wrapped_key_item;
++  memset(&wrapped_key_item, 0, sizeof(wrapped_key_item));
++  wrapped_key_item.data = wrapped_key.data;
++  wrapped_key_item.len = wrapped_key.len;
++
++  PK11SymKey *ret = PK11_UnwrapSymKey(wrapping_key, wrap_mechanism,
++                                      &tmp_sec_item, &wrapped_key_item, type,
++                                      operation, raw_key->len);
++  SCOPE_DATA_FREE();
++  return ret;
++ }
++
++#endif // NSS_FIPS_H

SOURCES/D245908.clear-lang-bundles.diff

@@ -0,0 +1,16 @@
+diff --git a/intl/strres/nsStringBundle.cpp b/intl/strres/nsStringBundle.cpp
+--- a/intl/strres/nsStringBundle.cpp
++++ b/intl/strres/nsStringBundle.cpp
+@@ -753,10 +753,11 @@
+                                const char16_t* aSomeData) {
+   if (strcmp("profile-do-change", aTopic) == 0 ||
+       strcmp("chrome-flush-caches", aTopic) == 0 ||
+       strcmp("intl:app-locales-changed", aTopic) == 0) {
+     flushBundleCache(/* ignoreShared = */ false);
++    mBundleMap.Clear();
+   } else if (strcmp("memory-pressure", aTopic) == 0) {
+     flushBundleCache(/* ignoreShared = */ true);
+   }
+ 
+   return NS_OK;
+

SOURCES/D249071.restoreWinState.diff

@@ -0,0 +1,53 @@
+diff --git a/modules/libpref/init/StaticPrefList.yaml b/modules/libpref/init/StaticPrefList.yaml
+--- a/modules/libpref/init/StaticPrefList.yaml
++++ b/modules/libpref/init/StaticPrefList.yaml
+@@ -1762,10 +1762,16 @@
+ - name: browser.privatebrowsing.forceMediaMemoryCache
+   type: bool
+   value: false
+   mirror: always
+ 
++# Disable state restoration, allowing the kiosk desktop environment to manage state and position.
++- name: browser.restoreWindowState.disabled
++  type: bool
++  value: false
++  mirror: always
++
+ # Communicates the toolbar color to platform (for e.g., prefers-color-scheme).
+ #
+ # Returns whether the toolbar is dark (0), light (1), or system (2). The
+ # theming code overrides it if appropriate.
+ - name: browser.theme.toolbar-theme
+diff --git a/xpfe/appshell/AppWindow.cpp b/xpfe/appshell/AppWindow.cpp
+--- a/xpfe/appshell/AppWindow.cpp
++++ b/xpfe/appshell/AppWindow.cpp
+@@ -58,10 +58,11 @@
+ #include "mozilla/AutoRestore.h"
+ #include "mozilla/Preferences.h"
+ #include "mozilla/PresShell.h"
+ #include "mozilla/Services.h"
+ #include "mozilla/SpinEventLoopUntil.h"
++#include "mozilla/StaticPrefs_browser.h"
+ #include "mozilla/dom/BarProps.h"
+ #include "mozilla/dom/DOMRect.h"
+ #include "mozilla/dom/Element.h"
+ #include "mozilla/dom/Event.h"
+ #include "mozilla/dom/ScriptSettings.h"
+@@ -2393,10 +2394,16 @@
+   nsCOMPtr<dom::Element> docShellElement = GetWindowDOMElement();
+   if (!docShellElement) {
+     return;
+   }
+ 
++  // Disable state restoration, allowing the kiosk desktop environment
++  // to manage state and position.
++  if (StaticPrefs::browser_restoreWindowState_disabled()) {
++    return;
++  }
++
+   // Check if the window wants to persist anything.
+   nsAutoString persist;
+   docShellElement->GetAttr(nsGkAtoms::persist, persist);
+   if (persist.IsEmpty()) {
+     return;
+

SOURCES/D266159.1760530435.diff

@@ -0,0 +1,19 @@
+diff --git a/gfx/webrender_bindings/RenderCompositorSWGL.cpp b/gfx/webrender_bindings/RenderCompositorSWGL.cpp
+--- a/gfx/webrender_bindings/RenderCompositorSWGL.cpp
++++ b/gfx/webrender_bindings/RenderCompositorSWGL.cpp
+@@ -76,12 +76,14 @@
+     const wr::DeviceIntRect* aOpaqueRects, size_t aNumOpaqueRects) {
+   // Request a new draw target to use from the widget...
+   MOZ_ASSERT(!mDT);
+   mDT = mWidget->StartRemoteDrawingInRegion(mDirtyRegion);
+   if (!mDT) {
++#if !defined(MOZ_WAYLAND)
+     gfxCriticalNoteOnce
+         << "RenderCompositorSWGL failed mapping default framebuffer, no dt";
++#endif
+     return false;
+   }
+   // Attempt to lock the underlying buffer directly from the draw target.
+   // Verify that the size at least matches what the widget claims and that
+   // the format is BGRA8 as SWGL requires.
+

SOURCES/av1-else-condition-add.patch

@@ -0,0 +1,14 @@
+diff --git a/modules/libpref/init/StaticPrefList.yaml b/modules/libpref/init/StaticPrefList.yaml
+index acadd3a2cc..11b217174d 100644
+--- a/modules/libpref/init/StaticPrefList.yaml
++++ b/modules/libpref/init/StaticPrefList.yaml
+@@ -12561,6 +12561,8 @@
+   type: RelaxedAtomicBool
+ #if defined(MOZ_AV1)
+   value: true
++#else
++  value: false
+ #endif
+   mirror: always
+ 
+

SOURCES/build-ffvpx.patch

@@ -1,24 +1,24 @@
-diff -up thunderbird-128.0/media/ffvpx/libavcodec/av1dec.c.build-ffvpx thunderbird-128.0/media/ffvpx/libavcodec/av1dec.c
+diff -up firefox-140.1.0/media/ffvpx/libavcodec/av1dec.c.build-ffvpx firefox-140.1.0/media/ffvpx/libavcodec/av1dec.c
---- thunderbird-128.0/media/ffvpx/libavcodec/av1dec.c.build-ffvpx	2024-06-24 22:43:40.000000000 +0200
+--- firefox-140.1.0/media/ffvpx/libavcodec/av1dec.c.build-ffvpx	2025-07-14 19:14:53.000000000 +0200
-+++ thunderbird-128.0/media/ffvpx/libavcodec/av1dec.c	2024-07-10 11:20:23.200948767 +0200
++++ firefox-140.1.0/media/ffvpx/libavcodec/av1dec.c	2025-07-31 13:02:48.131126439 +0200
-@@ -887,7 +887,7 @@ static av_cold int av1_decode_init(AVCod
+@@ -904,7 +904,7 @@ static av_cold int av1_decode_init(AVCod
          ff_cbs_fragment_reset(&s->current_obu);
      }
  
 -    s->dovi.logctx = avctx;
 +    s->dovi.logctx = (AVContext *) avctx;
-     s->dovi.dv_profile = 10; // default for AV1
+     s->dovi.cfg.dv_profile = 10; // default for AV1
      sd = ff_get_coded_side_data(avctx, AV_PKT_DATA_DOVI_CONF);
-     if (sd && sd->size > 0)
+     if (sd && sd->size >= sizeof(s->dovi.cfg))
-diff -up thunderbird-128.0/media/ffvpx/libavcodec/libdav1d.c.build-ffvpx thunderbird-128.0/media/ffvpx/libavcodec/libdav1d.c
+diff -up firefox-140.1.0/media/ffvpx/libavcodec/libdav1d.c.build-ffvpx firefox-140.1.0/media/ffvpx/libavcodec/libdav1d.c
---- thunderbird-128.0/media/ffvpx/libavcodec/libdav1d.c.build-ffvpx	2024-07-10 12:46:57.005539959 +0200
+--- firefox-140.1.0/media/ffvpx/libavcodec/libdav1d.c.build-ffvpx	2025-07-14 19:14:54.000000000 +0200
-+++ thunderbird-128.0/media/ffvpx/libavcodec/libdav1d.c	2024-07-10 12:47:19.067507705 +0200
++++ firefox-140.1.0/media/ffvpx/libavcodec/libdav1d.c	2025-07-31 13:03:08.395175190 +0200
-@@ -289,7 +289,7 @@ static av_cold int libdav1d_init(AVCodec
+@@ -293,7 +293,7 @@ static av_cold int libdav1d_init(AVCodec
      c->delay = res > 1 ? res : 0;
  #endif
  
 -    dav1d->dovi.logctx = c;
 +    dav1d->dovi.logctx = (AVContext *) c;
-     dav1d->dovi.dv_profile = 10; // default for AV1
+     dav1d->dovi.cfg.dv_profile = 10; // default for AV1
      sd = ff_get_coded_side_data(c, AV_PKT_DATA_DOVI_CONF);
-     if (sd && sd->size > 0)
+     if (sd && sd->size >= sizeof(dav1d->dovi.cfg))

SOURCES/build-libaom.patch

@@ -1,12 +1,13 @@
 diff -up firefox-128.0/config/external/moz.build.libaom firefox-128.0/config/external/moz.build
 --- firefox-128.0/config/external/moz.build.libaom	2024-07-31 15:32:39.460374047 +0200
 +++ firefox-128.0/config/external/moz.build	2024-07-31 15:34:41.646064796 +0200
-@@ -39,8 +39,8 @@ if CONFIG["MOZ_VORBIS"]:
+@@ -39,9 +39,9 @@ if CONFIG["MOZ_VORBIS"]:
+ 
  if not CONFIG["MOZ_SYSTEM_LIBVPX"]:
      external_dirs += ["media/libvpx"]
- 
 +external_dirs += ["media/libaom"]
- if CONFIG["MOZ_AV1"]:
+ 
+ if not CONFIG["MOZ_SYSTEM_AV1"]:
 -    external_dirs += ["media/libaom"]
      external_dirs += ["media/libdav1d"]
  

SOURCES/build-rhel7-lower-node-min-version.patch

@@ -1,8 +1,9 @@
---- firefox-115.8.0/python/mozbuild/mozbuild/nodeutil.py.lower-node-min-version	2024-02-12 21:53:56.000000000 +0200
+diff -up firefox-140.0/python/mozbuild/mozbuild/nodeutil.py.build-rhel7-lower-node-min-version firefox-140.0/python/mozbuild/mozbuild/nodeutil.py
-+++ firefox-115.8.0/python/mozbuild/mozbuild/nodeutil.py	2024-02-14 16:48:12.476182627 +0200
+--- firefox-140.0/python/mozbuild/mozbuild/nodeutil.py.build-rhel7-lower-node-min-version	2025-06-02 15:26:51.000000000 +0200
-@@ -13,7 +13,7 @@ from mozboot.util import get_tools_dir
++++ firefox-140.0/python/mozbuild/mozbuild/nodeutil.py	2025-06-12 11:54:37.075505124 +0200
+@@ -10,7 +10,7 @@ from mozboot.util import get_tools_dir
+ from mozfile import which
  from packaging.version import Version
- from six import PY3
  
 -NODE_MIN_VERSION = Version("12.22.12")
 +NODE_MIN_VERSION = Version("10.24.0")

SOURCES/build-rhel7-nasm-dwarf.patch

@@ -1,12 +1,12 @@
-diff -up firefox-91.0.1/python/mozbuild/mozbuild/frontend/context.py.rhel7-nasm firefox-91.0.1/python/mozbuild/mozbuild/frontend/context.py
+diff -up firefox-140.0/python/mozbuild/mozbuild/frontend/context.py.build-rhel7-nasm-dwarf firefox-140.0/python/mozbuild/mozbuild/frontend/context.py
---- firefox-91.0.1/python/mozbuild/mozbuild/frontend/context.py.rhel7-nasm	2021-08-31 08:02:10.814740774 +0200
+--- firefox-140.0/python/mozbuild/mozbuild/frontend/context.py.build-rhel7-nasm-dwarf	2025-06-02 15:26:51.000000000 +0200
-+++ firefox-91.0.1/python/mozbuild/mozbuild/frontend/context.py	2021-08-31 08:04:03.967146994 +0200
++++ firefox-140.0/python/mozbuild/mozbuild/frontend/context.py	2025-06-12 12:09:56.398728745 +0200
-@@ -420,7 +420,7 @@ class AsmFlags(BaseCompileFlags):
+@@ -417,7 +417,7 @@ class AsmFlags(BaseCompileFlags):
                  if self._context.config.substs.get("OS_ARCH") == "WINNT":
                      debug_flags += ["-F", "cv8"]
                  elif self._context.config.substs.get("OS_ARCH") != "Darwin":
 -                    debug_flags += ["-F", "dwarf"]
-+                    debug_flags += ["-f", "elf32"]
++                    debug_flags += ["-F", "elf32"]
-             elif (
+             elif self._context.config.substs.get("CC_TYPE") == "clang-cl":
-                 self._context.config.substs.get("OS_ARCH") == "WINNT"
+                 if self._context.config.substs.get("TARGET_CPU") == "aarch64":
-                 and self._context.config.substs.get("CPU_ARCH") == "aarch64"
+                     # armasm64 accepts a paucity of options compared to ml/ml64.

SOURCES/build-system-nss.patch

@@ -0,0 +1,20 @@
+diff -up firefox-140.0/third_party/rust/neqo-crypto/.cargo-checksum.json.system-nss firefox-140.0/third_party/rust/neqo-crypto/.cargo-checksum.json
+--- firefox-140.0/third_party/rust/neqo-crypto/.cargo-checksum.json.system-nss	2025-07-25 10:17:19.112202464 +0200
++++ firefox-140.0/third_party/rust/neqo-crypto/.cargo-checksum.json	2025-07-25 10:17:55.824333955 +0200
+@@ -1 +1 @@
+-{"files":{"Cargo.toml":"a57adef48614a58209447e8bd115a2de3d8a42917a0b9a2ae9a97cabc3400c6a","bindings/bindings.toml":"e7e4b75736cfcf4d52febacb99a6f6c6c7b1d648ed8bdc424648be876c850e91","bindings/nspr_err.h":"2d5205d017b536c2d838bcf9bc4ec79f96dd50e7bb9b73892328781f1ee6629d","bindings/nspr_error.h":"e41c03c77b8c22046f8618832c9569fbcc7b26d8b9bbc35eea7168f35e346889","bindings/nspr_io.h":"085b289849ef0e77f88512a27b4d9bdc28252bd4d39c6a17303204e46ef45f72","bindings/nspr_time.h":"2e637fd338a5cf0fd3fb0070a47f474a34c2a7f4447f31b6875f5a9928d0a261","bindings/nss_ciphers.h":"95ec6344a607558b3c5ba8510f463b6295f3a2fb3f538a01410531045a5f62d1","bindings/nss_init.h":"ef49045063782fb612aff459172cc6a89340f15005808608ade5320ca9974310","bindings/nss_p11.h":"0b81e64fe6db49b2ecff94edd850be111ef99ec11220e88ceb1c67be90143a78","bindings/nss_secerr.h":"713e8368bdae5159af7893cfa517dabfe5103cede051dee9c9557c850a2defc6","bindings/nss_ssl.h":"af222fb957b989e392e762fa2125c82608a0053aff4fb97e556691646c88c335","bindings/nss_sslerr.h":"24b97f092183d8486f774cdaef5030d0249221c78343570d83a4ee5b594210ae","bindings/nss_sslopt.h":"b7807eb7abdad14db6ad7bc51048a46b065a0ea65a4508c95a12ce90e59d1eea","build.rs":"2f54f79958878ed7988441955344dd1a2a079b1bb409e8f12a70284fd7e351ef","min_version.txt":"0f9ddf9ddaeb5137a5ab3d238d06286822f9579b1f46ba76312a8c6d76176500","src/aead.rs":"08d7cad82e3bec32661cfd1689e6611b30ae328ec88481cb32201dd255777365","src/aead_null.rs":"a766e2f71fd8b77a8f81bc60aaaafcffb6aef1f0a1f39ea07fef45b3696718ce","src/agent.rs":"ec90d7556231c57da3a191f508eaf1f820f22d6b7912ee45d1a594eb0fea7a82","src/agentio.rs":"1baecfb725b54717a6a74bb4664692d187f62747cc5e0495f59b06729f96dea2","src/auth.rs":"7a1524bef0a0c71616f5ee8b3976d66201210b809271bcf5d06c0e560ae482af","src/cert.rs":"4fdaa3834d8a72f41198449010fd5c3f6be6a54e429427c37bde5aab9421585c","src/constants.rs":"83606aeb646b2833a8094f9d980c266ecc3e8cb40c93a4820da221988319dd1a","src/ech.rs":"19d16af5a30e2060a8942a72487bd820c0d9c62ff1d3c490871752c56781c44b","src/err.rs":"4c7d0b46955b58aa9375210c2c5d24012056c3ad8a856b72d2c7c9542cc97046","src/exp.rs":"cd864fb5a61cd1472baa5b1d0951fc712753c22d21af83ebed09a01585f33b48","src/ext.rs":"a5676f8b9815cc7f6ed1da6fea091cf8754d8b80e90d37b726e905abe18930f8","src/hkdf.rs":"76c5abc8b2d6ee12d8a86cd730af2cf47a59b2fbfd3b8a635a1826636156794d","src/hp.rs":"6adf4ad78b5a065ab7310c69ad239eec156256043e2c185bf60b9d1f12ab1be4","src/lib.rs":"3ab979c264a909e663c5ef140cd57013180745b99937671c73a9003ca6347f41","src/min_version.rs":"c6e1f98b9f56db0622ac38c1be131c55acf4a0f09ed0d6283f4d6308e2d1301a","src/p11.rs":"49bcde067e55228dab483bd11b70dc29d40dc3c59fa60136daccb205dc468df0","src/prio.rs":"1858088afd2668e8fbff56959765b7d4df09342371b9282ade27bb4d7bd6ce69","src/replay.rs":"594ce92f368cbc5fb71ebfb62214f07d1e86df8e5ce94255d5593ffabb91cd03","src/result.rs":"5a76688787741de7a935dbbab4bcb917d481d1c9c50a34df7e510036feb3da17","src/secrets.rs":"5d85b1e15f47cd267fe70fa8ea7e4ebc4b07eab7713f451afeefcf15f146f8a5","src/selfencrypt.rs":"4f106465f582c38d3bb04cb5cbcbf65a349e3186784726d9f2bf511a4a4a35ee","src/ssl.rs":"04950bb534b5304eb417909a3a39ebaa9be234c7c13eacdc41c00a8edab1b09f","src/time.rs":"22989caf3dab85cfe955cc279fcca98a6df02d14fcd0e93cac7b39374b8b5763","tests/aead.rs":"e36ae77802df1ea6d17cfd1bd2178a3706089577d6fd1554ca86e748b8b235b9","tests/agent.rs":"fb95a2d5c86ce3fafcb127cd0a2a163e5ee70baf09b2c8483e4d1fb25644cee2","tests/ext.rs":"57af4e2df211fa8afdb73125d4344ef5c70c1ea4579107c3e6f5746308ee3e7b","tests/handshake.rs":"df8a901048268a390785e05e28cbc97b82e41e47d7eab2d5c0a57e434ca1adcf","tests/hkdf.rs":"1d2098dc8398395864baf13e4886cfd1da6d36118727c3b264f457ee3da6b048","tests/hp.rs":"7ee5d7290a3f61af67ad2c94670cba376027136370d9784948db655b7e00fe54","tests/init.rs":"3cfe8411ca31ad7dfb23822bb1570e1a5b2b334857173bdd7df086b65b81d95a","tests/selfencrypt.rs":"b65aed70e83dce660017159fc8a956d3b52e0807b590ad8d0a3a4265caa8c1fa"},"package":null}
+\ No newline at end of file
++{"files":{"Cargo.toml":"a57adef48614a58209447e8bd115a2de3d8a42917a0b9a2ae9a97cabc3400c6a","bindings/bindings.toml":"e7e4b75736cfcf4d52febacb99a6f6c6c7b1d648ed8bdc424648be876c850e91","bindings/nspr_err.h":"2d5205d017b536c2d838bcf9bc4ec79f96dd50e7bb9b73892328781f1ee6629d","bindings/nspr_error.h":"e41c03c77b8c22046f8618832c9569fbcc7b26d8b9bbc35eea7168f35e346889","bindings/nspr_io.h":"085b289849ef0e77f88512a27b4d9bdc28252bd4d39c6a17303204e46ef45f72","bindings/nspr_time.h":"2e637fd338a5cf0fd3fb0070a47f474a34c2a7f4447f31b6875f5a9928d0a261","bindings/nss_ciphers.h":"95ec6344a607558b3c5ba8510f463b6295f3a2fb3f538a01410531045a5f62d1","bindings/nss_init.h":"ef49045063782fb612aff459172cc6a89340f15005808608ade5320ca9974310","bindings/nss_p11.h":"0b81e64fe6db49b2ecff94edd850be111ef99ec11220e88ceb1c67be90143a78","bindings/nss_secerr.h":"713e8368bdae5159af7893cfa517dabfe5103cede051dee9c9557c850a2defc6","bindings/nss_ssl.h":"af222fb957b989e392e762fa2125c82608a0053aff4fb97e556691646c88c335","bindings/nss_sslerr.h":"24b97f092183d8486f774cdaef5030d0249221c78343570d83a4ee5b594210ae","bindings/nss_sslopt.h":"b7807eb7abdad14db6ad7bc51048a46b065a0ea65a4508c95a12ce90e59d1eea","build.rs":"2f54f79958878ed7988441955344dd1a2a079b1bb409e8f12a70284fd7e351ef","min_version.txt":"0f9ddf9ddaeb5137a5ab3d238d06286822f9579b1f46ba76312a8c6d76176500","src/aead.rs":"08d7cad82e3bec32661cfd1689e6611b30ae328ec88481cb32201dd255777365","src/aead_null.rs":"a766e2f71fd8b77a8f81bc60aaaafcffb6aef1f0a1f39ea07fef45b3696718ce","src/agent.rs":"ec90d7556231c57da3a191f508eaf1f820f22d6b7912ee45d1a594eb0fea7a82","src/agentio.rs":"1baecfb725b54717a6a74bb4664692d187f62747cc5e0495f59b06729f96dea2","src/auth.rs":"7a1524bef0a0c71616f5ee8b3976d66201210b809271bcf5d06c0e560ae482af","src/cert.rs":"4fdaa3834d8a72f41198449010fd5c3f6be6a54e429427c37bde5aab9421585c","src/constants.rs":"50c1b84e06cd9a71bb9199f2518947a4d4ad3e5c33c1b86c585486dc43e872a0","src/ech.rs":"19d16af5a30e2060a8942a72487bd820c0d9c62ff1d3c490871752c56781c44b","src/err.rs":"4c7d0b46955b58aa9375210c2c5d24012056c3ad8a856b72d2c7c9542cc97046","src/exp.rs":"cd864fb5a61cd1472baa5b1d0951fc712753c22d21af83ebed09a01585f33b48","src/ext.rs":"a5676f8b9815cc7f6ed1da6fea091cf8754d8b80e90d37b726e905abe18930f8","src/hkdf.rs":"76c5abc8b2d6ee12d8a86cd730af2cf47a59b2fbfd3b8a635a1826636156794d","src/hp.rs":"6adf4ad78b5a065ab7310c69ad239eec156256043e2c185bf60b9d1f12ab1be4","src/lib.rs":"3ab979c264a909e663c5ef140cd57013180745b99937671c73a9003ca6347f41","src/min_version.rs":"c6e1f98b9f56db0622ac38c1be131c55acf4a0f09ed0d6283f4d6308e2d1301a","src/p11.rs":"49bcde067e55228dab483bd11b70dc29d40dc3c59fa60136daccb205dc468df0","src/prio.rs":"1858088afd2668e8fbff56959765b7d4df09342371b9282ade27bb4d7bd6ce69","src/replay.rs":"594ce92f368cbc5fb71ebfb62214f07d1e86df8e5ce94255d5593ffabb91cd03","src/result.rs":"5a76688787741de7a935dbbab4bcb917d481d1c9c50a34df7e510036feb3da17","src/secrets.rs":"5d85b1e15f47cd267fe70fa8ea7e4ebc4b07eab7713f451afeefcf15f146f8a5","src/selfencrypt.rs":"4f106465f582c38d3bb04cb5cbcbf65a349e3186784726d9f2bf511a4a4a35ee","src/ssl.rs":"04950bb534b5304eb417909a3a39ebaa9be234c7c13eacdc41c00a8edab1b09f","src/time.rs":"22989caf3dab85cfe955cc279fcca98a6df02d14fcd0e93cac7b39374b8b5763","tests/aead.rs":"e36ae77802df1ea6d17cfd1bd2178a3706089577d6fd1554ca86e748b8b235b9","tests/agent.rs":"fb95a2d5c86ce3fafcb127cd0a2a163e5ee70baf09b2c8483e4d1fb25644cee2","tests/ext.rs":"57af4e2df211fa8afdb73125d4344ef5c70c1ea4579107c3e6f5746308ee3e7b","tests/handshake.rs":"df8a901048268a390785e05e28cbc97b82e41e47d7eab2d5c0a57e434ca1adcf","tests/hkdf.rs":"1d2098dc8398395864baf13e4886cfd1da6d36118727c3b264f457ee3da6b048","tests/hp.rs":"7ee5d7290a3f61af67ad2c94670cba376027136370d9784948db655b7e00fe54","tests/init.rs":"3cfe8411ca31ad7dfb23822bb1570e1a5b2b334857173bdd7df086b65b81d95a","tests/selfencrypt.rs":"b65aed70e83dce660017159fc8a956d3b52e0807b590ad8d0a3a4265caa8c1fa"},"package":null}
+\ No newline at end of file
+diff -up firefox-140.0/third_party/rust/neqo-crypto/src/constants.rs.system-nss firefox-140.0/third_party/rust/neqo-crypto/src/constants.rs
+--- firefox-140.0/third_party/rust/neqo-crypto/src/constants.rs.system-nss	2025-07-25 10:16:27.299270237 +0200
++++ firefox-140.0/third_party/rust/neqo-crypto/src/constants.rs	2025-07-25 10:16:39.698529915 +0200
+@@ -83,7 +83,7 @@ remap_enum! {
+         TLS_GRP_EC_SECP521R1 = ssl_grp_ec_secp521r1,
+         TLS_GRP_EC_X25519 = ssl_grp_ec_curve25519,
+         TLS_GRP_KEM_XYBER768D00 = ssl_grp_kem_xyber768d00,
+-        TLS_GRP_KEM_MLKEM768X25519 = ssl_grp_kem_mlkem768x25519,
++        TLS_GRP_KEM_MLKEM768X25519 = ssl_grp_kem_x25519mlkem768,
+     }
+ }
+ 

SOURCES/disable-pipewire.patch

@@ -1,274 +0,0 @@
-diff -up firefox-128.0/dom/media/webrtc/third_party_build/webrtc.mozbuild.disable-pipewire firefox-128.0/dom/media/webrtc/third_party_build/webrtc.mozbuild
---- firefox-128.0/dom/media/webrtc/third_party_build/webrtc.mozbuild.disable-pipewire	2024-07-17 14:01:36.290603114 +0200
-+++ firefox-128.0/dom/media/webrtc/third_party_build/webrtc.mozbuild	2024-07-17 14:52:02.039208338 +0200
-@@ -31,7 +31,7 @@ if CONFIG["MOZ_WEBRTC"]:
-                 and CONFIG["TARGET_CPU"].startswith("mips")
-             )
-         ):
--            DEFINES["WEBRTC_USE_PIPEWIRE"] = True
-+            DEFINES["WEBRTC_USE_PIPEWIRE"] = False
-     elif CONFIG["OS_TARGET"] == "Darwin":
-         DEFINES["WEBRTC_MAC"] = True
-     elif CONFIG["OS_TARGET"] == "WINNT":
-diff -up firefox-128.0/third_party/libwebrtc/modules/desktop_capture/desktop_capture_gn/moz.build.disable-pipewire firefox-128.0/third_party/libwebrtc/modules/desktop_capture/desktop_capture_gn/moz.build
---- firefox-128.0/third_party/libwebrtc/modules/desktop_capture/desktop_capture_gn/moz.build.disable-pipewire	2024-07-17 14:01:36.291603109 +0200
-+++ firefox-128.0/third_party/libwebrtc/modules/desktop_capture/desktop_capture_gn/moz.build	2024-07-17 14:56:35.419826494 +0200
-@@ -241,102 +241,6 @@ if CONFIG["TARGET_CPU"] == "aarch64":
-     DEFINES["WEBRTC_ARCH_ARM64"] = True
-     DEFINES["WEBRTC_HAS_NEON"] = True
- 
--if CONFIG["TARGET_CPU"] == "arm":
--
--    CXXFLAGS += [
--        "-mfpu=neon"
--    ]
--
--    DEFINES["WEBRTC_ARCH_ARM"] = True
--    DEFINES["WEBRTC_ARCH_ARM_V7"] = True
--    DEFINES["WEBRTC_HAS_NEON"] = True
--    DEFINES["WEBRTC_USE_PIPEWIRE"] = True
--    DEFINES["_GNU_SOURCE"] = True
--
--    LOCAL_INCLUDES += [
--        "/gfx/angle/checkout/include/",
--        "/third_party/drm/drm/",
--        "/third_party/drm/drm/include/",
--        "/third_party/drm/drm/include/libdrm/",
--        "/third_party/gbm/gbm/",
--        "/third_party/libepoxy/libepoxy/include/",
--        "/third_party/pipewire/"
--    ]
--
--    SOURCES += [
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/base_capturer_pipewire.cc"
--    ]
--
--    UNIFIED_SOURCES += [
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/egl_dmabuf.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/mouse_cursor_monitor_pipewire.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/restore_token_manager.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/screen_capture_portal_interface.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/screencast_portal.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/screencast_stream_utils.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/shared_screencast_stream.cc"
--    ]
--
--if CONFIG["TARGET_CPU"] == "mips32":
--
--    DEFINES["MIPS32_LE"] = True
--    DEFINES["MIPS_FPU_LE"] = True
--    DEFINES["WEBRTC_USE_PIPEWIRE"] = True
--    DEFINES["_GNU_SOURCE"] = True
--
--    LOCAL_INCLUDES += [
--        "/gfx/angle/checkout/include/",
--        "/third_party/drm/drm/",
--        "/third_party/drm/drm/include/",
--        "/third_party/drm/drm/include/libdrm/",
--        "/third_party/gbm/gbm/",
--        "/third_party/libepoxy/libepoxy/include/",
--        "/third_party/pipewire/"
--    ]
--
--    SOURCES += [
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/base_capturer_pipewire.cc"
--    ]
--
--    UNIFIED_SOURCES += [
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/egl_dmabuf.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/mouse_cursor_monitor_pipewire.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/restore_token_manager.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/screen_capture_portal_interface.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/screencast_portal.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/screencast_stream_utils.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/shared_screencast_stream.cc"
--    ]
--
--if CONFIG["TARGET_CPU"] == "mips64":
--
--    DEFINES["WEBRTC_USE_PIPEWIRE"] = True
--    DEFINES["_GNU_SOURCE"] = True
--
--    LOCAL_INCLUDES += [
--        "/gfx/angle/checkout/include/",
--        "/third_party/drm/drm/",
--        "/third_party/drm/drm/include/",
--        "/third_party/drm/drm/include/libdrm/",
--        "/third_party/gbm/gbm/",
--        "/third_party/libepoxy/libepoxy/include/",
--        "/third_party/pipewire/"
--    ]
--
--    SOURCES += [
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/base_capturer_pipewire.cc"
--    ]
--
--    UNIFIED_SOURCES += [
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/egl_dmabuf.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/mouse_cursor_monitor_pipewire.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/restore_token_manager.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/screen_capture_portal_interface.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/screencast_portal.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/screencast_stream_utils.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/shared_screencast_stream.cc"
--    ]
--
- if CONFIG["TARGET_CPU"] == "ppc64":
- 
-     DEFINES["USE_X11"] = "1"
-@@ -389,35 +293,6 @@ if CONFIG["MOZ_DEBUG"] == "1" and CONFIG
- 
-     DEFINES["_HAS_ITERATOR_DEBUGGING"] = "0"
- 
--if CONFIG["OS_TARGET"] == "Linux" and CONFIG["TARGET_CPU"] == "aarch64":
--
--    DEFINES["WEBRTC_USE_PIPEWIRE"] = True
--    DEFINES["_GNU_SOURCE"] = True
--
--    LOCAL_INCLUDES += [
--        "/gfx/angle/checkout/include/",
--        "/third_party/drm/drm/",
--        "/third_party/drm/drm/include/",
--        "/third_party/drm/drm/include/libdrm/",
--        "/third_party/gbm/gbm/",
--        "/third_party/libepoxy/libepoxy/include/",
--        "/third_party/pipewire/"
--    ]
--
--    SOURCES += [
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/base_capturer_pipewire.cc"
--    ]
--
--    UNIFIED_SOURCES += [
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/egl_dmabuf.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/mouse_cursor_monitor_pipewire.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/restore_token_manager.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/screen_capture_portal_interface.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/screencast_portal.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/screencast_stream_utils.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/shared_screencast_stream.cc"
--    ]
--
- if CONFIG["OS_TARGET"] == "Linux" and CONFIG["TARGET_CPU"] == "riscv64":
- 
-     DEFINES["USE_X11"] = "1"
-@@ -446,95 +321,6 @@ if CONFIG["OS_TARGET"] == "Linux" and CO
-         "/third_party/libwebrtc/modules/desktop_capture/linux/x11/x_window_property.cc"
-     ]
- 
--if CONFIG["OS_TARGET"] == "Linux" and CONFIG["TARGET_CPU"] == "x86":
--
--    CXXFLAGS += [
--        "-msse2"
--    ]
--
--    DEFINES["WEBRTC_USE_PIPEWIRE"] = True
--    DEFINES["_GNU_SOURCE"] = True
--
--    LOCAL_INCLUDES += [
--        "/gfx/angle/checkout/include/",
--        "/third_party/drm/drm/",
--        "/third_party/drm/drm/include/",
--        "/third_party/drm/drm/include/libdrm/",
--        "/third_party/gbm/gbm/",
--        "/third_party/libepoxy/libepoxy/include/",
--        "/third_party/pipewire/"
--    ]
--
--    SOURCES += [
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/base_capturer_pipewire.cc"
--    ]
--
--    UNIFIED_SOURCES += [
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/egl_dmabuf.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/mouse_cursor_monitor_pipewire.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/restore_token_manager.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/screen_capture_portal_interface.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/screencast_portal.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/screencast_stream_utils.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/shared_screencast_stream.cc"
--    ]
--
--if CONFIG["OS_TARGET"] == "Linux" and CONFIG["TARGET_CPU"] == "x86_64":
--
--    DEFINES["WEBRTC_USE_PIPEWIRE"] = True
--    DEFINES["_GNU_SOURCE"] = True
--
--    LOCAL_INCLUDES += [
--        "/gfx/angle/checkout/include/",
--        "/third_party/drm/drm/",
--        "/third_party/drm/drm/include/",
--        "/third_party/drm/drm/include/libdrm/",
--        "/third_party/gbm/gbm/",
--        "/third_party/libepoxy/libepoxy/include/",
--        "/third_party/pipewire/"
--    ]
--
--    SOURCES += [
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/base_capturer_pipewire.cc"
--    ]
--
--    UNIFIED_SOURCES += [
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/egl_dmabuf.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/mouse_cursor_monitor_pipewire.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/restore_token_manager.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/screen_capture_portal_interface.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/screencast_portal.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/screencast_stream_utils.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/wayland/shared_screencast_stream.cc"
--    ]
--
--if CONFIG["MOZ_X11"] == "1" and CONFIG["OS_TARGET"] == "Linux" and CONFIG["TARGET_CPU"] == "aarch64":
--
--    DEFINES["USE_X11"] = "1"
--    DEFINES["WEBRTC_USE_X11"] = True
--
--    OS_LIBS += [
--        "X11",
--        "Xcomposite",
--        "Xdamage",
--        "Xext",
--        "Xfixes",
--        "Xrandr",
--        "Xrender"
--    ]
--
--    UNIFIED_SOURCES += [
--        "/third_party/libwebrtc/modules/desktop_capture/linux/x11/mouse_cursor_monitor_x11.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/x11/screen_capturer_x11.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/x11/shared_x_display.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/x11/window_capturer_x11.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/x11/window_finder_x11.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/x11/window_list_utils.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/x11/x_atom_cache.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/x11/x_error_trap.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/x11/x_server_pixel_buffer.cc",
--        "/third_party/libwebrtc/modules/desktop_capture/linux/x11/x_window_property.cc"
--    ]
- 
- if CONFIG["MOZ_X11"] == "1" and CONFIG["OS_TARGET"] == "Linux" and CONFIG["TARGET_CPU"] == "arm":
- 
-diff -up firefox-128.0/third_party/libwebrtc/modules/portal/portal_gn/moz.build.disable-pipewire firefox-128.0/third_party/libwebrtc/modules/portal/portal_gn/moz.build
---- firefox-128.0/third_party/libwebrtc/modules/portal/portal_gn/moz.build.disable-pipewire	2024-07-04 18:20:41.000000000 +0200
-+++ firefox-128.0/third_party/libwebrtc/modules/portal/portal_gn/moz.build	2024-07-17 14:01:36.291603109 +0200
-@@ -27,7 +27,7 @@ DEFINES["WEBRTC_MOZILLA_BUILD"] = True
- DEFINES["WEBRTC_NON_STATIC_TRACE_EVENT_HANDLERS"] = "0"
- DEFINES["WEBRTC_POSIX"] = True
- DEFINES["WEBRTC_STRICT_FIELD_TRIALS"] = "0"
--DEFINES["WEBRTC_USE_PIPEWIRE"] = True
-+DEFINES["WEBRTC_USE_PIPEWIRE"] = False
- DEFINES["_FILE_OFFSET_BITS"] = "64"
- DEFINES["_GNU_SOURCE"] = True
- DEFINES["_LARGEFILE64_SOURCE"] = True
-diff -up firefox-128.0/third_party/libwebrtc/third_party/pipewire/pipewire_gn/moz.build.disable-pipewire firefox-128.0/third_party/libwebrtc/third_party/pipewire/pipewire_gn/moz.build
---- firefox-128.0/third_party/libwebrtc/third_party/pipewire/pipewire_gn/moz.build.disable-pipewire	2024-07-04 18:20:41.000000000 +0200
-+++ firefox-128.0/third_party/libwebrtc/third_party/pipewire/pipewire_gn/moz.build	2024-07-17 14:01:36.291603109 +0200
-@@ -25,7 +25,7 @@ DEFINES["WEBRTC_MOZILLA_BUILD"] = True
- DEFINES["WEBRTC_NON_STATIC_TRACE_EVENT_HANDLERS"] = "0"
- DEFINES["WEBRTC_POSIX"] = True
- DEFINES["WEBRTC_STRICT_FIELD_TRIALS"] = "0"
--DEFINES["WEBRTC_USE_PIPEWIRE"] = True
-+DEFINES["WEBRTC_USE_PIPEWIRE"] = False
- DEFINES["_FILE_OFFSET_BITS"] = "64"
- DEFINES["_GNU_SOURCE"] = True
- DEFINES["_LARGEFILE64_SOURCE"] = True

SOURCES/distribution.ini

@@ -1,9 +0,0 @@
-[Global]
-id=almalinux
-version=1.0
-about=Mozilla Firefox for AlmaLinux
-
-[Preferences]
-app.distributor=almalinux
-app.distributor.channel=almalinux
-app.partner.fedora=almalinux

SOURCES/distribution.ini.in

@@ -0,0 +1,9 @@
+[Global]
+id=__ID__
+version=1.0
+about=Mozilla Firefox for __NAME__
+
+[Preferences]
+app.distributor=__ID__
+app.distributor.channel=__ID__
+app.partner.__ID__=__ID__

SOURCES/exceptionHandled-for-IO-error-processhandler.patch

@@ -0,0 +1,29 @@
+diff -up firefox-140.1.0/testing/mozbase/mozprocess/mozprocess/processhandler.py.exceptionHandled-for-IO-error-processhandler firefox-140.1.0/testing/mozbase/mozprocess/mozprocess/processhandler.py
+--- firefox-140.1.0/testing/mozbase/mozprocess/mozprocess/processhandler.py.exceptionHandled-for-IO-error-processhandler	2025-07-14 19:14:55.000000000 +0200
++++ firefox-140.1.0/testing/mozbase/mozprocess/mozprocess/processhandler.py	2025-08-05 18:05:54.329479764 +0200
+@@ -1098,11 +1098,22 @@ class ProcessReader:
+ 
+     def _read_stream(self, stream, queue, callback):
+         sentinel = "" if isinstance(stream, io.TextIOBase) else b""
+-        for line in iter(stream.readline, sentinel):
+-            queue.put((line, callback))
++        try:
++            for line in iter(stream.readline, sentinel):
++                queue.put((line, callback))
++        except ValueError as e:
++            if "I/O operation on closed file" in str(e):
++                # Stream was closed by the process, this is normal
++                pass
++            else:
++                raise
+         # Give a chance to the reading loop to exit without a timeout.
+         queue.put((b"", None))
+-        stream.close()
++        try:
++            stream.close()
++        except ValueError:
++            # Stream might already be closed
++            pass
+ 
+     def start(self, proc):
+         queue = Queue()

SOURCES/firefox-adapt-ml-dsa-support-to-rhel-nss.patch

@@ -0,0 +1,31 @@
+diff --git a/security/nss/lib/mozpkix/lib/pkixnss.cpp b/security/nss/lib/mozpkix/lib/pkixnss.cpp
+index 31aa1ddd67..6eb367eae4 100644
+--- a/security/nss/lib/mozpkix/lib/pkixnss.cpp
++++ b/security/nss/lib/mozpkix/lib/pkixnss.cpp
+@@ -323,13 +323,21 @@ VerifyMLDSASignedDataNSS(Input data,
+   SECItem dataItem(UnsafeMapInputToSECItem(data));
+   CK_MECHANISM_TYPE mechanism;
+ 
+-  switch (pubk->u.mldsa.paramSet) {
+-    case SEC_OID_ML_DSA_44:
+-    case SEC_OID_ML_DSA_65:
+-    case SEC_OID_ML_DSA_87:
++  switch (SEC_GetSignatureAlgorithmOidTag(pubk->keyType, pubk->u.mldsa.params)) {
++    case CKP_ML_DSA_44:
++      hashPolicyTag = SEC_OID_UNKNOWN;
++      mechanism = CKM_ML_DSA;
++      signaturePolicyTag = SEC_OID_PRIVATE_3;
++      break;
++    case CKP_ML_DSA_65:
++      hashPolicyTag = SEC_OID_UNKNOWN;
+       mechanism = CKM_ML_DSA;
+-      signaturePolicyTag = pubk->u.mldsa.paramSet;
++      signaturePolicyTag = SEC_OID_PRIVATE_4;
++      break;
++    case CKP_ML_DSA_87:
+       hashPolicyTag = SEC_OID_UNKNOWN;
++      mechanism = CKM_ML_DSA;
++      signaturePolicyTag = SEC_OID_PRIVATE_5;
+       break;
+     default:
+       return Result::ERROR_UNSUPPORTED_KEYALG;

SOURCES/firefox-add-ml-dsa-certificate-support-to-certviewer.patch

@@ -0,0 +1,323 @@
+diff --git a/toolkit/components/certviewer/content/certDecoder.mjs b/toolkit/components/certviewer/content/certDecoder.mjs
+--- a/toolkit/components/certviewer/content/certDecoder.mjs
++++ b/toolkit/components/certviewer/content/certDecoder.mjs
+@@ -5,10 +5,11 @@
+ import {
+   Certificate,
+   ECNamedCurves,
+   ECPublicKey,
+   RSAPublicKey,
++  MLDSAPublicKey,
+ } from "./vendor/pkijs.js";
+ 
+ const getTimeZone = () => {
+   let timeZone = new Date().toString().match(/\(([A-Za-z\s].*)\)/);
+   if (timeZone === null) {
+@@ -45,10 +46,19 @@
+       x, // x coordinate
+       y, // y coordinate
+       xy: `04:${x}:${y}`, // 04 (uncompressed) public key
+     };
+   }
++  if (publicKey instanceof MLDSAPublicKey) {
++    let keyHex = publicKey.rhoT1.valueBlock.valueHex;
++    let keyBytes = new Uint8Array(keyHex);
++    return {
++      kty: publicKey.alg,
++      keysize: keyBytes.length,
++      rhoT1: hashify(keyHex),
++    };
++  }
+   return { kty: "Unknown" };
+ };
+ 
+ const getX509Ext = (extensions, v) => {
+   for (var extension in extensions) {
+@@ -1132,10 +1142,13 @@
+     "2.16.840.1.101.3.4.3.2": "DSA with SHA-256",
+     "1.2.840.10045.4.1": "ECDSA with SHA-1",
+     "1.2.840.10045.4.3.2": "ECDSA with SHA-256",
+     "1.2.840.10045.4.3.3": "ECDSA with SHA-384",
+     "1.2.840.10045.4.3.4": "ECDSA with SHA-512",
++    "2.16.840.1.101.3.4.3.17": "ML-DSA-44",
++    "2.16.840.1.101.3.4.3.18": "ML-DSA-65",
++    "2.16.840.1.101.3.4.3.19": "ML-DSA-87",
+   },
+ 
+   aia: {
+     "1.3.6.1.5.5.7.48.1": "Online Certificate Status Protocol (OCSP)",
+     "1.3.6.1.5.5.7.48.2": "CA Issuers",
+diff --git a/toolkit/components/certviewer/content/certviewer.mjs b/toolkit/components/certviewer/content/certviewer.mjs
+--- a/toolkit/components/certviewer/content/certviewer.mjs
++++ b/toolkit/components/certviewer/content/certviewer.mjs
+@@ -74,10 +74,23 @@
+     }
+   }
+   return result ? result : false;
+ };
+ 
++const getMLDSASecurityLevel = signatureName => {
++  switch (signatureName) {
++    case "ML-DSA-44":
++      return "Level 2 (NIST)";
++    case "ML-DSA-65":
++      return "Level 3 (NIST)";
++    case "ML-DSA-87":
++      return "Level 5 (NIST)";
++    default:
++      return null;
++  }
++};
++
+ export const adjustCertInformation = cert => {
+   let certItems = [];
+   let tabName = cert?.subject?.cn || "";
+   if (cert && !tabName) {
+     // No common name, use the value of the last item in the cert's entries.
+@@ -173,10 +186,15 @@
+           createEntryItem("key-size", cert.subjectPublicKeyInfo.keysize),
+           createEntryItem("curve", cert.subjectPublicKeyInfo.crv),
+           createEntryItem("public-value", cert.subjectPublicKeyInfo.xy, true),
+           createEntryItem("exponent", cert.subjectPublicKeyInfo.e),
+           createEntryItem("modulus", cert.subjectPublicKeyInfo.n, true),
++          createEntryItem(
++            "mldsa-public-value",
++            cert.subjectPublicKeyInfo.rhoT1,
++            true
++          ),
+         ].filter(elem => elem != null);
+       }
+       return items;
+     },
+     certItems,
+@@ -190,14 +208,23 @@
+         createEntryItem("serial-number", cert.serialNumber, true),
+         createEntryItem(
+           "signature-algorithm",
+           cert.signature ? cert.signature.name : null
+         ),
++      ];
++
++      const secLvl = getMLDSASecurityLevel(cert.signature?.name);
++      if (secLvl) {
++        items.push(createEntryItem("security-level", secLvl));
++      }
++
++      items.push(
+         createEntryItem("version", cert.version),
+-        createEntryItem("download", cert.files ? cert.files.pem : null),
+-      ].filter(elem => elem != null);
+-      return items;
++        createEntryItem("download", cert.files ? cert.files.pem : null)
++      );
++
++      return items.filter(elem => elem != null);
+     },
+     certItems,
+     "miscellaneous",
+     false
+   );
+diff --git a/toolkit/components/certviewer/content/vendor/pkijs.js b/toolkit/components/certviewer/content/vendor/pkijs.js
+--- a/toolkit/components/certviewer/content/vendor/pkijs.js
++++ b/toolkit/components/certviewer/content/vendor/pkijs.js
+@@ -8609,10 +8609,90 @@
+         this.publicExponent = new Integer({ valueHex: stringToArrayBuffer(fromBase64(json.e, true)).slice(0, 3) });
+     }
+ }
+ RSAPublicKey.CLASS_NAME = "RSAPublicKey";
+ 
++/* @see https://www.ietf.org/archive/id/draft-ietf-lamps-dilithium-certificates-11.html */
++const RHO_T1 = "rhoT1";
++const ALG = "alg";
++const CLEAR_PROPS_MLDSA = [RHO_T1, ALG];
++const MLDSA_MIN_LENGTH = 32;
++class MLDSAPublicKey extends PkiObject {
++    constructor(parameters = {}) {
++        super();
++
++        this.rhoT1 = getParametersValue(parameters, RHO_T1, MLDSAPublicKey.defaultValues(RHO_T1));
++        this.alg = getParametersValue(parameters, ALG, MLDSAPublicKey.defaultValues(ALG));
++
++        if (parameters.json) {
++            this.fromJSON(parameters.json);
++        }
++
++        if (parameters.schema) {
++            this.fromSchema(parameters.schema);
++        }
++    }
++
++    static defaultValues(memberName) {
++        switch (memberName) {
++            case RHO_T1:
++                return new BitString();
++            case ALG:
++                return "";
++            default:
++                return super.defaultValues(memberName);
++        }
++    }
++
++    static schema(parameters = {}) {
++        const names = getParametersValue(parameters, "names", {});
++        return new BitString({ name: names.rhoT1 || RHO_T1 });
++    }
++
++    fromSchema(schema) {
++        clearProps(schema, CLEAR_PROPS_MLDSA);
++
++        const asn1 = compareSchema(schema, schema, MLDSAPublicKey.schema({
++            names: { rhoT1: RHO_T1 }
++        }));
++
++        AsnError.assertSchema(asn1, this.className);
++
++        const bitString = asn1.result.rhoT1;
++        const length = bitString.valueBlock.valueHexView.length;
++
++        if (length < MLDSA_MIN_LENGTH || (length - MLDSA_MIN_LENGTH) % 320 !== 0) {
++            throw new Error(`Invalid ML-DSA key length: ${length} bytes`);
++        }
++
++        this.rhoT1 = bitString;
++    }
++
++    toSchema() {
++        return this.rhoT1;
++    }
++
++    toJSON() {
++        return {
++            rhoT1: Convert.ToBase64Url(this.rhoT1.valueBlock.valueHexView),
++            alg: this.alg
++        };
++    }
++
++    fromJSON(json) {
++        ParameterError.assert("json", json, "rhoT1");
++        const rawBuffer = stringToArrayBuffer(fromBase64(json.rhoT1, true));
++
++        if (rawBuffer.byteLength < MLDSA_MIN_LENGTH || (rawBuffer.byteLength - MLDSA_MIN_LENGTH) % 320 !== 0) {
++            throw new Error(`Invalid ML-DSA key length: ${rawBuffer.byteLength} bytes`);
++        }
++
++        this.rhoT1 = new BitString({ valueHex: rawBuffer });
++    }
++}
++MLDSAPublicKey.CLASS_NAME = "MLDSAPublicKey";
++
+ const ALGORITHM$1 = "algorithm";
+ const SUBJECT_PUBLIC_KEY = "subjectPublicKey";
+ const CLEAR_PROPS$1a = [ALGORITHM$1, SUBJECT_PUBLIC_KEY];
+ class PublicKeyInfo extends PkiObject {
+     constructor(parameters = {}) {
+@@ -8657,10 +8737,22 @@
+                             catch (ex) {
+                             }
+                         }
+                     }
+                     break;
++                case "2.16.840.1.101.3.4.3.17":
++                    /* Already a bitstring */
++                    this._parsedKey = new MLDSAPublicKey({ rhoT1: this.subjectPublicKey, alg: "ML-DSA-44" });
++                    break;
++                case "2.16.840.1.101.3.4.3.18":
++                    /* Already a bitstring */
++                    this._parsedKey = new MLDSAPublicKey({ rhoT1: this.subjectPublicKey, alg: "ML-DSA-65" });
++                    break;
++                case "2.16.840.1.101.3.4.3.19":
++                    /* Already a bitstring */
++                    this._parsedKey = new MLDSAPublicKey({ rhoT1: this.subjectPublicKey, alg: "ML-DSA-87" });
++                    break;
+             }
+             this._parsedKey || (this._parsedKey = null);
+         }
+         return this._parsedKey || undefined;
+     }
+@@ -8724,10 +8816,19 @@
+                 jwk.kty = "EC";
+                 break;
+             case "1.2.840.113549.1.1.1":
+                 jwk.kty = "RSA";
+                 break;
++            case "2.16.840.1.101.3.4.3.17":
++                jwk.kty = "ML-DSA-44";
++                break;
++            case "2.16.840.1.101.3.4.3.18":
++                jwk.kty = "ML-DSA-65";
++                break;
++            case "2.16.840.1.101.3.4.3.19":
++                jwk.kty = "ML-DSA-87";
++                break;
+         }
+         const publicKeyJWK = this.parsedKey.toJSON();
+         Object.assign(jwk, publicKeyJWK);
+         return jwk;
+     }
+@@ -8746,10 +8847,31 @@
+                     this.algorithm = new AlgorithmIdentifier({
+                         algorithmId: "1.2.840.113549.1.1.1",
+                         algorithmParams: new Null()
+                     });
+                     break;
++                case "ML-DSA-44":
++                    this.parsedKey = new MLDSAPublicKey({ json });
++                    this.algorithm = new AlgorithmIdentifier({
++                        algorithmId: "2.16.840.1.101.3.4.3.17",
++                        algorithmParams: new Null()
++                    });
++                    break;
++                case "ML-DSA-65":
++                    this.parsedKey = new MLDSAPublicKey({ json });
++                    this.algorithm = new AlgorithmIdentifier({
++                        algorithmId: "2.16.840.1.101.3.4.3.18",
++                        algorithmParams: new Null()
++                    });
++                    break;
++                case "ML-DSA-87":
++                    this.parsedKey = new MLDSAPublicKey({ json });
++                    this.algorithm = new AlgorithmIdentifier({
++                        algorithmId: "2.16.840.1.101.3.4.3.19",
++                        algorithmParams: new Null()
++                    });
++                    break;
+                 default:
+                     throw new Error(`Invalid value for "kty" parameter: ${json.kty}`);
+             }
+             this.subjectPublicKey = new BitString({ valueHex: this.parsedKey.toSchema().toBER(false) });
+         }
+@@ -24078,6 +24200,6 @@
+     }
+ }
+ 
+ initCryptoEngine();
+ 
+-export { AbstractCryptoEngine, AccessDescription, Accuracy, AlgorithmIdentifier, AltName, ArgumentError, AsnError, AttCertValidityPeriod, Attribute, AttributeCertificateInfoV1, AttributeCertificateInfoV2, AttributeCertificateV1, AttributeCertificateV2, AttributeTypeAndValue, AuthenticatedSafe, AuthorityKeyIdentifier, BasicConstraints, BasicOCSPResponse, CAVersion, CRLBag, CRLDistributionPoints, CertBag, CertID, Certificate, CertificateChainValidationEngine, CertificatePolicies, CertificateRevocationList, CertificateSet, CertificateTemplate, CertificationRequest, ChainValidationCode, ChainValidationError, ContentInfo, CryptoEngine, DigestInfo, DistributionPoint, ECCCMSSharedInfo, ECNamedCurves, ECPrivateKey, ECPublicKey, EncapsulatedContentInfo, EncryptedContentInfo, EncryptedData, EnvelopedData, ExtKeyUsage, Extension, ExtensionValueFactory, Extensions, GeneralName, GeneralNames, GeneralSubtree, HASHED_MESSAGE, HASH_ALGORITHM, Holder, InfoAccess, IssuerAndSerialNumber, IssuerSerial, IssuingDistributionPoint, KEKIdentifier, KEKRecipientInfo, KeyAgreeRecipientIdentifier, KeyAgreeRecipientInfo, KeyBag, KeyTransRecipientInfo, MICROS, MILLIS, MacData, MessageImprint, NameConstraints, OCSPRequest, OCSPResponse, ObjectDigestInfo, OriginatorIdentifierOrKey, OriginatorInfo, OriginatorPublicKey, OtherCertificateFormat, OtherKeyAttribute, OtherPrimeInfo, OtherRecipientInfo, OtherRevocationInfoFormat, PBES2Params, PBKDF2Params, PFX, PKCS8ShroudedKeyBag, PKIStatus, PKIStatusInfo, POLICY_IDENTIFIER, POLICY_QUALIFIERS, ParameterError, PasswordRecipientinfo, PkiObject, PolicyConstraints, PolicyInformation, PolicyMapping, PolicyMappings, PolicyQualifierInfo, PrivateKeyInfo, PrivateKeyUsagePeriod, PublicKeyInfo, QCStatement, QCStatements, RDN, RSAESOAEPParams, RSAPrivateKey, RSAPublicKey, RSASSAPSSParams, RecipientEncryptedKey, RecipientEncryptedKeys, RecipientIdentifier, RecipientInfo, RecipientKeyIdentifier, RelativeDistinguishedNames, Request, ResponseBytes, ResponseData, RevocationInfoChoices, RevokedCertificate, SECONDS, SafeBag, SafeBagValueFactory, SafeContents, SecretBag, Signature, SignedAndUnsignedAttributes, SignedCertificateTimestamp, SignedCertificateTimestampList, SignedData, SignedDataVerifyError, SignerInfo, SingleResponse, SubjectDirectoryAttributes, TBSRequest, TSTInfo, TYPE$4 as TYPE, TYPE_AND_VALUES, Time, TimeStampReq, TimeStampResp, TimeType, V2Form, VALUE$5 as VALUE, VALUE_BEFORE_DECODE, checkCA, createCMSECDSASignature, createECDSASignatureFromCMS, engine, getAlgorithmByOID, getAlgorithmParameters, getCrypto, getEngine, getHashAlgorithm, getOIDByAlgorithm, getRandomValues, id_AnyPolicy, id_AuthorityInfoAccess, id_AuthorityKeyIdentifier, id_BaseCRLNumber, id_BasicConstraints, id_CRLBag_X509CRL, id_CRLDistributionPoints, id_CRLNumber, id_CRLReason, id_CertBag_AttributeCertificate, id_CertBag_SDSICertificate, id_CertBag_X509Certificate, id_CertificateIssuer, id_CertificatePolicies, id_ContentType_Data, id_ContentType_EncryptedData, id_ContentType_EnvelopedData, id_ContentType_SignedData, id_ExtKeyUsage, id_FreshestCRL, id_InhibitAnyPolicy, id_InvalidityDate, id_IssuerAltName, id_IssuingDistributionPoint, id_KeyUsage, id_MicrosoftAppPolicies, id_MicrosoftCaVersion, id_MicrosoftCertTemplateV1, id_MicrosoftCertTemplateV2, id_MicrosoftPrevCaCertHash, id_NameConstraints, id_PKIX_OCSP_Basic, id_PolicyConstraints, id_PolicyMappings, id_PrivateKeyUsagePeriod, id_QCStatements, id_SignedCertificateTimestampList, id_SubjectAltName, id_SubjectDirectoryAttributes, id_SubjectInfoAccess, id_SubjectKeyIdentifier, id_ad, id_ad_caIssuers, id_ad_ocsp, id_eContentType_TSTInfo, id_pkix, id_sha1, id_sha256, id_sha384, id_sha512, kdf, setEngine, stringPrep, verifySCTsForCertificate };
++export { AbstractCryptoEngine, AccessDescription, Accuracy, AlgorithmIdentifier, AltName, ArgumentError, AsnError, AttCertValidityPeriod, Attribute, AttributeCertificateInfoV1, AttributeCertificateInfoV2, AttributeCertificateV1, AttributeCertificateV2, AttributeTypeAndValue, AuthenticatedSafe, AuthorityKeyIdentifier, BasicConstraints, BasicOCSPResponse, CAVersion, CRLBag, CRLDistributionPoints, CertBag, CertID, Certificate, CertificateChainValidationEngine, CertificatePolicies, CertificateRevocationList, CertificateSet, CertificateTemplate, CertificationRequest, ChainValidationCode, ChainValidationError, ContentInfo, CryptoEngine, DigestInfo, DistributionPoint, ECCCMSSharedInfo, ECNamedCurves, ECPrivateKey, ECPublicKey, EncapsulatedContentInfo, EncryptedContentInfo, EncryptedData, EnvelopedData, ExtKeyUsage, Extension, ExtensionValueFactory, Extensions, GeneralName, GeneralNames, GeneralSubtree, HASHED_MESSAGE, HASH_ALGORITHM, Holder, InfoAccess, IssuerAndSerialNumber, IssuerSerial, IssuingDistributionPoint, KEKIdentifier, KEKRecipientInfo, KeyAgreeRecipientIdentifier, KeyAgreeRecipientInfo, KeyBag, KeyTransRecipientInfo, MICROS, MILLIS, MacData, MessageImprint, NameConstraints, OCSPRequest, OCSPResponse, ObjectDigestInfo, OriginatorIdentifierOrKey, OriginatorInfo, OriginatorPublicKey, OtherCertificateFormat, OtherKeyAttribute, OtherPrimeInfo, OtherRecipientInfo, OtherRevocationInfoFormat, PBES2Params, PBKDF2Params, PFX, PKCS8ShroudedKeyBag, PKIStatus, PKIStatusInfo, POLICY_IDENTIFIER, POLICY_QUALIFIERS, ParameterError, PasswordRecipientinfo, PkiObject, PolicyConstraints, PolicyInformation, PolicyMapping, PolicyMappings, PolicyQualifierInfo, PrivateKeyInfo, PrivateKeyUsagePeriod, PublicKeyInfo, QCStatement, QCStatements, RDN, RSAESOAEPParams, RSAPrivateKey, RSAPublicKey, RSASSAPSSParams, RecipientEncryptedKey, RecipientEncryptedKeys, RecipientIdentifier, RecipientInfo, RecipientKeyIdentifier, RelativeDistinguishedNames, Request, ResponseBytes, ResponseData, RevocationInfoChoices, RevokedCertificate, SECONDS, SafeBag, SafeBagValueFactory, SafeContents, SecretBag, Signature, SignedAndUnsignedAttributes, SignedCertificateTimestamp, SignedCertificateTimestampList, SignedData, SignedDataVerifyError, SignerInfo, SingleResponse, SubjectDirectoryAttributes, TBSRequest, TSTInfo, TYPE$4 as TYPE, TYPE_AND_VALUES, Time, TimeStampReq, TimeStampResp, TimeType, V2Form, VALUE$5 as VALUE, VALUE_BEFORE_DECODE, checkCA, createCMSECDSASignature, createECDSASignatureFromCMS, engine, getAlgorithmByOID, getAlgorithmParameters, getCrypto, getEngine, getHashAlgorithm, getOIDByAlgorithm, getRandomValues, id_AnyPolicy, id_AuthorityInfoAccess, id_AuthorityKeyIdentifier, id_BaseCRLNumber, id_BasicConstraints, id_CRLBag_X509CRL, id_CRLDistributionPoints, id_CRLNumber, id_CRLReason, id_CertBag_AttributeCertificate, id_CertBag_SDSICertificate, id_CertBag_X509Certificate, id_CertificateIssuer, id_CertificatePolicies, id_ContentType_Data, id_ContentType_EncryptedData, id_ContentType_EnvelopedData, id_ContentType_SignedData, id_ExtKeyUsage, id_FreshestCRL, id_InhibitAnyPolicy, id_InvalidityDate, id_IssuerAltName, id_IssuingDistributionPoint, id_KeyUsage, id_MicrosoftAppPolicies, id_MicrosoftCaVersion, id_MicrosoftCertTemplateV1, id_MicrosoftCertTemplateV2, id_MicrosoftPrevCaCertHash, id_NameConstraints, id_PKIX_OCSP_Basic, id_PolicyConstraints, id_PolicyMappings, id_PrivateKeyUsagePeriod, id_QCStatements, id_SignedCertificateTimestampList, id_SubjectAltName, id_SubjectDirectoryAttributes, id_SubjectInfoAccess, id_SubjectKeyIdentifier, id_ad, id_ad_caIssuers, id_ad_ocsp, id_eContentType_TSTInfo, id_pkix, id_sha1, id_sha256, id_sha384, id_sha512, kdf, setEngine, stringPrep, verifySCTsForCertificate, MLDSAPublicKey };
+diff --git a/toolkit/locales/en-US/toolkit/about/certviewer.ftl b/toolkit/locales/en-US/toolkit/about/certviewer.ftl
+--- a/toolkit/locales/en-US/toolkit/about/certviewer.ftl
++++ b/toolkit/locales/en-US/toolkit/about/certviewer.ftl
+@@ -45,20 +45,22 @@
+ certificate-viewer-organization = Organization
+ certificate-viewer-organizational-unit = Organizational Unit
+ certificate-viewer-policy = Policy
+ certificate-viewer-protocol = Protocol
+ certificate-viewer-public-value = Public Value
++certificate-viewer-mldsa-public-value = Public Value
+ certificate-viewer-purposes = Purposes
+ certificate-viewer-qualifier = Qualifier
+ certificate-viewer-qualifiers = Qualifiers
+ certificate-viewer-required = Required
+ certificate-viewer-unsupported = &lt;unsupported&gt;
+ # Inc. means Incorporated, e.g GitHub is incorporated in Delaware
+ certificate-viewer-inc-state-province = Inc. State/Province
+ certificate-viewer-state-province = State/Province
+ certificate-viewer-sha-1 = SHA-1
+ certificate-viewer-sha-256 = SHA-256
++certificate-viewer-security-level = Security Level
+ certificate-viewer-serial-number = Serial Number
+ certificate-viewer-signature-algorithm = Signature Algorithm
+ certificate-viewer-signature-scheme = Signature Scheme
+ certificate-viewer-timestamp = Timestamp
+ certificate-viewer-value = Value
+

SOURCES/firefox-enable-ml-dsa-in-manager-ssl.patch

@@ -0,0 +1,48 @@
+diff --git a/security/manager/ssl/nsNSSCallbacks.cpp b/security/manager/ssl/nsNSSCallbacks.cpp
+index 2dc48c9f4c..0a7b84d787 100644
+--- a/security/manager/ssl/nsNSSCallbacks.cpp
++++ b/security/manager/ssl/nsNSSCallbacks.cpp
+@@ -722,6 +722,15 @@ nsCString getSignatureName(uint32_t aSignatureScheme) {
+     case ssl_sig_rsa_pkcs1_sha1md5:
+       signatureName = "RSA-PKCS1-SHA1MD5"_ns;
+       break;
++    case ssl_sig_mldsa44:
++      signatureName = "ML-DSA-44"_ns;
++      break;
++    case ssl_sig_mldsa65:
++      signatureName = "ML-DSA-65"_ns;
++      break;
++    case ssl_sig_mldsa87:
++      signatureName = "ML-DSA-87"_ns;
++      break;
+     // All other groups are not enabled in Firefox. See sEnabledSignatureSchemes
+     // in nsNSSIOLayer.cpp.
+     default:
+@@ -1061,6 +1070,13 @@ void HandshakeCallback(PRFileDesc* fd, void* client_data) {
+           glean::ssl::auth_ecdsa_curve_full.AccumulateSingleSample(
+               ECCCurve(channelInfo.authKeyBits));
+           break;
++      case ssl_auth_mldsa44:
++      case ssl_auth_mldsa65:
++      case ssl_auth_mldsa87:
++          /* TODO: add auth_mldsa_key_size_full in ssl/metrics.yaml
++          glean::ssl::auth_mldsa_key_size_full.AccumulateSingleSample(
++              NonECCKeySize(channelInfo.authKeyBits)); */
++          break;
+         default:
+           MOZ_CRASH("impossible auth algorithm");
+           break;
+diff --git a/security/manager/ssl/nsNSSIOLayer.cpp b/security/manager/ssl/nsNSSIOLayer.cpp
+index b1a5f5c2df..7443011b13 100644
+--- a/security/manager/ssl/nsNSSIOLayer.cpp
++++ b/security/manager/ssl/nsNSSIOLayer.cpp
+@@ -1300,6 +1300,9 @@ static PRFileDesc* nsSSLIOLayerImportFD(PRFileDesc* fd,
+ // Please change getSignatureName in nsNSSCallbacks.cpp when changing the list
+ // here. See NOTE at SSL_SignatureSchemePrefSet call site.
+ static const SSLSignatureScheme sEnabledSignatureSchemes[] = {
++    ssl_sig_mldsa87,
++    ssl_sig_mldsa65,
++    ssl_sig_mldsa44,
+     ssl_sig_ecdsa_secp256r1_sha256,
+     ssl_sig_ecdsa_secp384r1_sha384,
+     ssl_sig_ecdsa_secp521r1_sha512,

SOURCES/firefox-enable-ml-dsa-signature-verification-for-certificate-chain-validation.patch

@@ -0,0 +1,239 @@
+diff --git a/security/nss/lib/mozpkix/include/pkix/pkixder.h b/security/nss/lib/mozpkix/include/pkix/pkixder.h
+index ac1ec24393..40eb5027af 100644
+--- a/security/nss/lib/mozpkix/include/pkix/pkixder.h
++++ b/security/nss/lib/mozpkix/include/pkix/pkixder.h
+@@ -488,7 +488,7 @@ inline Result OptionalExtensions(Reader& input, uint8_t tag,
+ Result DigestAlgorithmIdentifier(Reader& input,
+                                  /*out*/ DigestAlgorithm& algorithm);
+ 
+-enum class PublicKeyAlgorithm { RSA_PKCS1, RSA_PSS, ECDSA };
++enum class PublicKeyAlgorithm { RSA_PKCS1, RSA_PSS, ECDSA, MLDSA };
+ 
+ Result SignatureAlgorithmIdentifierValue(
+     Reader& input,
+diff --git a/security/nss/lib/mozpkix/include/pkix/pkixnss.h b/security/nss/lib/mozpkix/include/pkix/pkixnss.h
+index 6711959e71..b87e88a599 100644
+--- a/security/nss/lib/mozpkix/include/pkix/pkixnss.h
++++ b/security/nss/lib/mozpkix/include/pkix/pkixnss.h
+@@ -50,6 +50,13 @@ Result VerifyECDSASignedDataNSS(Input data, DigestAlgorithm digestAlgorithm,
+                                 Input signature, Input subjectPublicKeyInfo,
+                                 void* pkcs11PinArg);
+ 
++// Verifies the ML-DSA signature on the given data using the given ML-DSA
++// public key
++Result VerifyMLDSASignedDataNSS(Input data,
++                                Input signature,
++                                Input subjectPublicKeyInfo,
++                                void* pkcs11PinArg);
++
+ // Computes the digest of the given data using the given digest algorithm.
+ //
+ // item contains the data to hash.
+diff --git a/security/nss/lib/mozpkix/include/pkix/pkixtypes.h b/security/nss/lib/mozpkix/include/pkix/pkixtypes.h
+index 6a07d6e885..f24bd546e4 100644
+--- a/security/nss/lib/mozpkix/include/pkix/pkixtypes.h
++++ b/security/nss/lib/mozpkix/include/pkix/pkixtypes.h
+@@ -334,6 +334,10 @@ class TrustDomain {
+                                        Input signature,
+                                        Input subjectPublicKeyInfo) = 0;
+ 
++  virtual Result VerifyMLDSASignedData(Input data,
++                                       Input signature,
++                                       Input subjectPublicKeyInfo) = 0;
++
+   // Check that the validity duration is acceptable.
+   //
+   // Return Success if the validity duration is acceptable,
+diff --git a/security/nss/lib/mozpkix/lib/pkixc.cpp b/security/nss/lib/mozpkix/lib/pkixc.cpp
+index 5dea13c43e..f797a3b3a1 100644
+--- a/security/nss/lib/mozpkix/lib/pkixc.cpp
++++ b/security/nss/lib/mozpkix/lib/pkixc.cpp
+@@ -143,6 +143,15 @@ class CodeSigningTrustDomain final : public TrustDomain {
+         subjectPublicKeyInfo, nullptr);
+   }
+ 
++  virtual Result VerifyMLDSASignedData(Input data,
++                                       Input signature,
++                                       Input subjectPublicKeyInfo) override {
++    return VerifyMLDSASignedDataNSS(data,
++                                    signature,
++                                    subjectPublicKeyInfo,
++                                    nullptr);
++  }
++
+   virtual Result CheckValidityIsAcceptable(Time notBefore, Time notAfter,
+                                            EndEntityOrCA endEntityOrCA,
+                                            KeyPurposeId keyPurpose) override {
+diff --git a/security/nss/lib/mozpkix/lib/pkixcheck.cpp b/security/nss/lib/mozpkix/lib/pkixcheck.cpp
+index 8b7e1bf73e..4ce73f3944 100644
+--- a/security/nss/lib/mozpkix/lib/pkixcheck.cpp
++++ b/security/nss/lib/mozpkix/lib/pkixcheck.cpp
+@@ -118,6 +118,9 @@ CheckSignatureAlgorithm(TrustDomain& trustDomain,
+       // for any curve that we support, the chances of us encountering a curve
+       // during path building is too low to be worth bothering with.
+       break;
++
++    case der::PublicKeyAlgorithm::MLDSA:
++      break;
+     MOZILLA_PKIX_UNREACHABLE_DEFAULT_ENUM
+   }
+ 
+@@ -248,6 +251,24 @@ CheckSubjectPublicKeyInfoContents(Reader& input, TrustDomain& trustDomain,
+     0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01
+   };
+ 
++  // Params for pure ML-DSA-44 signature
++  // python DottedOIDToCode.py id-ml-dsa-44 2.16.840.1.101.3.4.3.17
++  static const uint8_t id_ml_dsa_44[] = {
++      0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x03, 0x11
++  };
++
++  // Params for pure ML-DSA-65 signature
++  // python DottedOIDToCode.py id-ml-dsa-65 2.16.840.1.101.3.4.3.18
++  static const uint8_t id_ml_dsa_65[] = {
++      0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x03, 0x12
++  };
++
++  // Params for pure ML-DSA-87 signature
++  // python DottedOIDToCode.py id-ml-dsa-87 2.16.840.1.101.3.4.3.19
++  static const uint8_t id_ml_dsa_87[] = {
++      0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x03, 0x13
++  };
++
+   if (algorithmOID.MatchRest(id_ecPublicKey)) {
+     // An id-ecPublicKey AlgorithmIdentifier has a parameter that identifes
+     // the curve being used. Although RFC 5480 specifies multiple forms, we
+@@ -361,6 +382,30 @@ CheckSubjectPublicKeyInfoContents(Reader& input, TrustDomain& trustDomain,
+     if (rv != Success) {
+       return rv;
+     }
++  } else if (algorithmOID.MatchRest(id_ml_dsa_44) ||
++             algorithmOID.MatchRest(id_ml_dsa_65) ||
++             algorithmOID.MatchRest(id_ml_dsa_87)) {
++
++    /*
++     * The ML-DSA AlgorithmIdentifier is expected to contain only the OID,
++     * with no parameters field present. According to the Internet-Draft
++     * https://www.ietf.org/archive/id/draft-ietf-lamps-dilithium-certificates-11.html
++     * (Section 3), the AlgorithmIdentifier for ML-DSA variants must omit the `parameters`
++     * field entirely.
++     * In DER encoding, the absence of the parameters field means that after parsing the
++     * OID, no additional bytes should remain. Calling `der::End(algorithm)` confirms that
++     * this constraint is satisfied and that the structure is correctly encoded.
++     */
++    rv = der::End(algorithm);
++    if (rv != Success) {
++      return rv;
++    }
++
++    Input rawPublicKey;
++    rv = subjectPublicKeyReader.SkipToEnd(rawPublicKey);
++    if (rv != Success) {
++      return rv;
++    }
+   } else {
+     return Result::ERROR_UNSUPPORTED_KEYALG;
+   }
+diff --git a/security/nss/lib/mozpkix/lib/pkixder.cpp b/security/nss/lib/mozpkix/lib/pkixder.cpp
+index 59454c7d3c..4ff45ed566 100644
+--- a/security/nss/lib/mozpkix/lib/pkixder.cpp
++++ b/security/nss/lib/mozpkix/lib/pkixder.cpp
+@@ -211,6 +211,24 @@ SignatureAlgorithmIdentifierValue(Reader& input,
+     0x00, 0xa2, 0x03, 0x02, 0x01, 0x40
+   };
+ 
++  // Params for pure ML-DSA-44 signature
++  // python DottedOIDToCode.py id-ml-dsa-44 2.16.840.1.101.3.4.3.17
++  static const uint8_t id_ml_dsa_44[] = {
++      0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x03, 0x11
++  };
++
++  // Params for pure ML-DSA-65 signature
++  // python DottedOIDToCode.py id-ml-dsa-65 2.16.840.1.101.3.4.3.18
++  static const uint8_t id_ml_dsa_65[] = {
++      0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x03, 0x12
++  };
++
++  // Params for pure ML-DSA-87 signature
++  // python DottedOIDToCode.py id-ml-dsa-87 2.16.840.1.101.3.4.3.19
++  static const uint8_t id_ml_dsa_87[] = {
++      0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x03, 0x13
++  };
++
+   // Matching is attempted based on a rough estimate of the commonality of the
+   // algorithm, to minimize the number of MatchRest calls.
+   if (algorithmID.MatchRest(sha256WithRSAEncryption)) {
+@@ -252,6 +270,10 @@ SignatureAlgorithmIdentifierValue(Reader& input,
+     } else {
+       return Result::ERROR_CERT_SIGNATURE_ALGORITHM_DISABLED;
+     }
++  } else if (algorithmID.MatchRest(id_ml_dsa_44) ||
++             algorithmID.MatchRest(id_ml_dsa_65) ||
++             algorithmID.MatchRest(id_ml_dsa_87)) {
++    publicKeyAlgorithm = PublicKeyAlgorithm::MLDSA;
+   } else {
+     return Result::ERROR_CERT_SIGNATURE_ALGORITHM_DISABLED;
+   }
+diff --git a/security/nss/lib/mozpkix/lib/pkixnss.cpp b/security/nss/lib/mozpkix/lib/pkixnss.cpp
+index 606ef708d8..31aa1ddd67 100644
+--- a/security/nss/lib/mozpkix/lib/pkixnss.cpp
++++ b/security/nss/lib/mozpkix/lib/pkixnss.cpp
+@@ -303,6 +303,44 @@ DigestBufNSS(Input item,
+   return Success;
+ }
+ 
++Result
++VerifyMLDSASignedDataNSS(Input data,
++                         Input signature,
++                         Input subjectPublicKeyInfo,
++                         void* pkcs11PinArg)
++{
++  ScopedSECKEYPublicKey publicKey;
++  SECKEYPublicKey *pubk = NULL;
++  SECOidTag signaturePolicyTag, hashPolicyTag;
++  Result rv = SubjectPublicKeyInfoToSECKEYPublicKey(subjectPublicKeyInfo,
++                                                    publicKey);
++  if (rv != Success) {
++    return rv;
++  }
++
++  pubk = publicKey.get();
++  SECItem signatureItem(UnsafeMapInputToSECItem(signature));
++  SECItem dataItem(UnsafeMapInputToSECItem(data));
++  CK_MECHANISM_TYPE mechanism;
++
++  switch (pubk->u.mldsa.paramSet) {
++    case SEC_OID_ML_DSA_44:
++    case SEC_OID_ML_DSA_65:
++    case SEC_OID_ML_DSA_87:
++      mechanism = CKM_ML_DSA;
++      signaturePolicyTag = pubk->u.mldsa.paramSet;
++      hashPolicyTag = SEC_OID_UNKNOWN;
++      break;
++    default:
++      return Result::ERROR_UNSUPPORTED_KEYALG;
++      break;
++  }
++
++  SECOidTag policyTags[2] = {signaturePolicyTag, hashPolicyTag};
++  return VerifySignedData(pubk, mechanism, nullptr, &signatureItem,
++                          &dataItem, policyTags, pkcs11PinArg);
++}
++
+ Result
+ MapPRErrorCodeToResult(PRErrorCode error)
+ {
+diff --git a/security/nss/lib/mozpkix/lib/pkixverify.cpp b/security/nss/lib/mozpkix/lib/pkixverify.cpp
+index 8cb58bf7de..ff132d89df 100644
+--- a/security/nss/lib/mozpkix/lib/pkixverify.cpp
++++ b/security/nss/lib/mozpkix/lib/pkixverify.cpp
+@@ -53,6 +53,9 @@ VerifySignedData(TrustDomain& trustDomain,
+     case der::PublicKeyAlgorithm::RSA_PSS:
+       return trustDomain.VerifyRSAPSSSignedData(signedData.data,
+           digestAlgorithm, signedData.signature, signerSubjectPublicKeyInfo);
++    case der::PublicKeyAlgorithm::MLDSA:
++      return trustDomain.VerifyMLDSASignedData(signedData.data,
++          signedData.signature, signerSubjectPublicKeyInfo);
+     MOZILLA_PKIX_UNREACHABLE_DEFAULT_ENUM
+   }
+ }

SOURCES/firefox-fix-build-with-system-pipewire.patch

@@ -0,0 +1,12 @@
+diff --git a/config/system-headers.mozbuild b/config/system-headers.mozbuild
+index 028002a1d0..9dcb50fe5e 100644
+--- a/config/system-headers.mozbuild
++++ b/config/system-headers.mozbuild
+@@ -310,6 +310,7 @@ system_headers = [
+     "getopt.h",
+     "gio/gdesktopappinfo.h",
+     "gio/gio.h",
++    "gio/gunixfdlist.h",
+     "glibconfig.h",
+     "glib.h",
+     "glib-object.h",

SOURCES/firefox-integrate-ml-dsa-signature-verification-for-pkix-certificate-chain-validation.patch

@@ -0,0 +1,244 @@
+diff --git a/netwerk/protocol/http/WebTransportCertificateVerifier.cpp b/netwerk/protocol/http/WebTransportCertificateVerifier.cpp
+index cc77864..1e978ef 100644
+--- a/netwerk/protocol/http/WebTransportCertificateVerifier.cpp
++++ b/netwerk/protocol/http/WebTransportCertificateVerifier.cpp
+@@ -53,6 +53,11 @@ class ServerCertHashesTrustDomain : public mozilla::pkix::TrustDomain {
+       mozilla::pkix::Input signature,
+       mozilla::pkix::Input subjectPublicKeyInfo) override;
+ 
++  virtual mozilla::pkix::Result VerifyMLDSASignedData(
++      mozilla::pkix::Input data,
++      mozilla::pkix::Input signature,
++      mozilla::pkix::Input subjectPublicKeyInfo) override;
++
+   virtual mozilla::pkix::Result DigestBuf(
+       mozilla::pkix::Input item, mozilla::pkix::DigestAlgorithm digestAlg,
+       /*out*/ uint8_t* digestBuf, size_t digestBufLen) override;
+@@ -151,6 +156,15 @@ mozilla::pkix::Result ServerCertHashesTrustDomain::VerifyECDSASignedData(
+   return mozilla::pkix::Result::FATAL_ERROR_LIBRARY_FAILURE;
+ }
+ 
++mozilla::pkix::Result ServerCertHashesTrustDomain::VerifyMLDSASignedData(
++    mozilla::pkix::Input data,
++    mozilla::pkix::Input signature,
++    mozilla::pkix::Input subjectPublicKeyInfo) {
++  MOZ_ASSERT_UNREACHABLE("not expecting this to be called");
++
++  return mozilla::pkix::Result::FATAL_ERROR_LIBRARY_FAILURE;
++}
++
+ mozilla::pkix::Result ServerCertHashesTrustDomain::DigestBuf(
+     mozilla::pkix::Input item, mozilla::pkix::DigestAlgorithm digestAlg,
+     /*out*/ uint8_t* digestBuf, size_t digestBufLen) {
+diff --git a/security/certverifier/CertVerifier.cpp b/security/certverifier/CertVerifier.cpp
+index ca33077..cb96f58 100644
+--- a/security/certverifier/CertVerifier.cpp
++++ b/security/certverifier/CertVerifier.cpp
+@@ -1048,10 +1048,14 @@ void HashSignatureParams(pkix::Input data, pkix::Input signature,
+                         sizeof(publicKeyAlgorithm)))) {
+     return;
+   }
+-  if (NS_FAILED(
++  // Digest algorithm is expected to be null since ML-DSA is not an hash and
++  // sign algorithm. Skip digestAlgorithm for ML-DSA.
++  if (publicKeyAlgorithm != der::PublicKeyAlgorithm::MLDSA) {
++    if (NS_FAILED(
+           digest.Update(reinterpret_cast<const uint8_t*>(&digestAlgorithm),
+                         sizeof(digestAlgorithm)))) {
+-    return;
++      return;
++    }
+   }
+   nsTArray<uint8_t> result;
+   if (NS_FAILED(digest.End(result))) {
+@@ -1064,12 +1068,19 @@ Result VerifySignedDataWithCache(
+     der::PublicKeyAlgorithm publicKeyAlg,
+     mozilla::glean::impl::DenominatorMetric telemetryDenominator,
+     mozilla::glean::impl::NumeratorMetric telemetryNumerator, Input data,
+-    DigestAlgorithm digestAlgorithm, Input signature,
++    std::optional<DigestAlgorithm> digestAlgorithm, Input signature,
+     Input subjectPublicKeyInfo, SignatureCache* signatureCache, void* pinArg) {
+   telemetryDenominator.Add(1);
+   Maybe<nsTArray<uint8_t>> sha512Hash;
++
++  // Currently, it is only acceptable for `digestAlgorithm` to be null when the
++  // public key algorithm is pure ML-DSA. Fail immediately otherwise.
++  if ((publicKeyAlg != der::PublicKeyAlgorithm::MLDSA) && !digestAlgorithm) {
++    return Result::ERROR_INVALID_ALGORITHM;
++  }
++
+   HashSignatureParams(data, signature, subjectPublicKeyInfo, publicKeyAlg,
+-                      digestAlgorithm, sha512Hash);
++                      digestAlgorithm.value_or(pkix::DigestAlgorithm::sha512), sha512Hash);
+   // If hashing the signature parameters succeeded, see if this signature is in
+   // the signature cache.
+   if (sha512Hash.isSome() &&
+@@ -1080,16 +1091,23 @@ Result VerifySignedDataWithCache(
+   Result result;
+   switch (publicKeyAlg) {
+     case der::PublicKeyAlgorithm::ECDSA:
+-      result = VerifyECDSASignedDataNSS(data, digestAlgorithm, signature,
+-                                        subjectPublicKeyInfo, pinArg);
++      result = VerifyECDSASignedDataNSS(data, digestAlgorithm.value(),
++                                        signature, subjectPublicKeyInfo,
++                                        pinArg);
+       break;
+     case der::PublicKeyAlgorithm::RSA_PKCS1:
+-      result = VerifyRSAPKCS1SignedDataNSS(data, digestAlgorithm, signature,
+-                                           subjectPublicKeyInfo, pinArg);
++      result = VerifyRSAPKCS1SignedDataNSS(data, digestAlgorithm.value(),
++                                           signature, subjectPublicKeyInfo,
++                                           pinArg);
+       break;
+     case der::PublicKeyAlgorithm::RSA_PSS:
+-      result = VerifyRSAPSSSignedDataNSS(data, digestAlgorithm, signature,
+-                                         subjectPublicKeyInfo, pinArg);
++      result = VerifyRSAPSSSignedDataNSS(data, digestAlgorithm.value(),
++                                         signature, subjectPublicKeyInfo,
++                                         pinArg);
++      break;
++    case der::PublicKeyAlgorithm::MLDSA:
++      result = VerifyMLDSASignedDataNSS(data, signature, subjectPublicKeyInfo,
++                                        pinArg);
+       break;
+     default:
+       MOZ_ASSERT_UNREACHABLE("unhandled public key algorithm");
+diff --git a/security/certverifier/CertVerifier.h b/security/certverifier/CertVerifier.h
+index 6432547..f9a0365 100644
+--- a/security/certverifier/CertVerifier.h
++++ b/security/certverifier/CertVerifier.h
+@@ -331,7 +331,7 @@ mozilla::pkix::Result VerifySignedDataWithCache(
+     mozilla::pkix::der::PublicKeyAlgorithm publicKeyAlg,
+     mozilla::glean::impl::DenominatorMetric telemetryDenominator,
+     mozilla::glean::impl::NumeratorMetric telemetryNumerator,
+-    mozilla::pkix::Input data, mozilla::pkix::DigestAlgorithm digestAlgorithm,
++    mozilla::pkix::Input data, std::optional<mozilla::pkix::DigestAlgorithm> digestAlgorithm,
+     mozilla::pkix::Input signature, mozilla::pkix::Input subjectPublicKeyInfo,
+     SignatureCache* signatureCache, void* pinArg);
+ 
+diff --git a/security/certverifier/NSSCertDBTrustDomain.cpp b/security/certverifier/NSSCertDBTrustDomain.cpp
+index 77c17c1..741892f 100644
+--- a/security/certverifier/NSSCertDBTrustDomain.cpp
++++ b/security/certverifier/NSSCertDBTrustDomain.cpp
+@@ -1541,6 +1541,17 @@ Result NSSCertDBTrustDomain::VerifyECDSASignedData(
+       signature, subjectPublicKeyInfo, mSignatureCache, mPinArg);
+ }
+ 
++Result NSSCertDBTrustDomain::VerifyMLDSASignedData(Input data,
++                                                   Input signature,
++                                                   Input subjectPublicKeyInfo)
++{
++  return VerifySignedDataWithCache(
++      der::PublicKeyAlgorithm::MLDSA,
++      mozilla::glean::cert_signature_cache::total,
++      mozilla::glean::cert_signature_cache::hits, data, std::nullopt,
++      signature, subjectPublicKeyInfo, mSignatureCache, mPinArg);
++}
++
+ Result NSSCertDBTrustDomain::CheckValidityIsAcceptable(
+     Time notBefore, Time notAfter, EndEntityOrCA endEntityOrCA,
+     KeyPurposeId keyPurpose) {
+diff --git a/security/certverifier/NSSCertDBTrustDomain.h b/security/certverifier/NSSCertDBTrustDomain.h
+index fc210f3..8d17a4f 100644
+--- a/security/certverifier/NSSCertDBTrustDomain.h
++++ b/security/certverifier/NSSCertDBTrustDomain.h
+@@ -197,6 +197,11 @@ class NSSCertDBTrustDomain : public mozilla::pkix::TrustDomain {
+       mozilla::pkix::Input signature,
+       mozilla::pkix::Input subjectPublicKeyInfo) override;
+ 
++  virtual Result VerifyMLDSASignedData(
++      mozilla::pkix::Input data,
++      mozilla::pkix::Input signature,
++      mozilla::pkix::Input subjectPublicKeyInfo) override;
++
+   virtual Result DigestBuf(mozilla::pkix::Input item,
+                            mozilla::pkix::DigestAlgorithm digestAlg,
+                            /*out*/ uint8_t* digestBuf,
+diff --git a/security/ct/CTLogVerifier.cpp b/security/ct/CTLogVerifier.cpp
+index d5e665a..4712137 100644
+--- a/security/ct/CTLogVerifier.cpp
++++ b/security/ct/CTLogVerifier.cpp
+@@ -99,6 +99,10 @@ class SignatureParamsTrustDomain final : public TrustDomain {
+     return pkix::Result::FATAL_ERROR_LIBRARY_FAILURE;
+   }
+ 
++  pkix::Result VerifyMLDSASignedData(Input, Input, Input) override {
++    return pkix::Result::FATAL_ERROR_LIBRARY_FAILURE;
++  }
++
+   pkix::Result CheckValidityIsAcceptable(Time, Time, EndEntityOrCA,
+                                          KeyPurposeId) override {
+     return pkix::Result::FATAL_ERROR_LIBRARY_FAILURE;
+diff --git a/security/ct/tests/gtest/CTTestUtils.cpp b/security/ct/tests/gtest/CTTestUtils.cpp
+index 6a25307..03d19f7 100644
+--- a/security/ct/tests/gtest/CTTestUtils.cpp
++++ b/security/ct/tests/gtest/CTTestUtils.cpp
+@@ -807,6 +807,15 @@ class OCSPExtensionTrustDomain : public TrustDomain {
+                                      subjectPublicKeyInfo, nullptr);
+   }
+ 
++  pkix::Result VerifyMLDSASignedData(Input data,
++                                     Input signature,
++                                     Input subjectPublicKeyInfo) override {
++    return VerifyMLDSASignedDataNSS(data,
++                                    signature,
++                                    subjectPublicKeyInfo,
++                                    nullptr);
++  }
++
+   pkix::Result CheckValidityIsAcceptable(Time, Time, EndEntityOrCA,
+                                          KeyPurposeId) override {
+     ADD_FAILURE();
+diff --git a/security/manager/ssl/AppTrustDomain.cpp b/security/manager/ssl/AppTrustDomain.cpp
+index ab49d7e..36e7e19 100644
+--- a/security/manager/ssl/AppTrustDomain.cpp
++++ b/security/manager/ssl/AppTrustDomain.cpp
+@@ -322,6 +322,16 @@ pkix::Result AppTrustDomain::VerifyECDSASignedData(
+                                   subjectPublicKeyInfo, nullptr);
+ }
+ 
++pkix::Result AppTrustDomain::VerifyMLDSASignedData(Input data,
++                                                   Input signature,
++                                                   Input subjectPublicKeyInfo)
++{
++  return VerifyMLDSASignedDataNSS(data,
++                                  signature,
++                                  subjectPublicKeyInfo,
++                                  nullptr);
++}
++
+ pkix::Result AppTrustDomain::CheckValidityIsAcceptable(
+     Time /*notBefore*/, Time /*notAfter*/, EndEntityOrCA /*endEntityOrCA*/,
+     KeyPurposeId /*keyPurpose*/) {
+diff --git a/security/manager/ssl/AppTrustDomain.h b/security/manager/ssl/AppTrustDomain.h
+index 4b0212e..083d5fb 100644
+--- a/security/manager/ssl/AppTrustDomain.h
++++ b/security/manager/ssl/AppTrustDomain.h
+@@ -80,6 +80,10 @@ class AppTrustDomain final : public mozilla::pkix::TrustDomain {
+                            mozilla::pkix::DigestAlgorithm digestAlg,
+                            /*out*/ uint8_t* digestBuf,
+                            size_t digestBufLen) override;
++  virtual Result VerifyMLDSASignedData(
++      mozilla::pkix::Input data,
++      mozilla::pkix::Input signature,
++      mozilla::pkix::Input subjectPublicKeyInfo) override;
+ 
+  private:
+   nsTArray<Span<const uint8_t>> mTrustedRoots;
+diff --git a/security/manager/ssl/TLSClientAuthCertSelection.cpp b/security/manager/ssl/TLSClientAuthCertSelection.cpp
+index 3a84b15..8450076 100644
+--- a/security/manager/ssl/TLSClientAuthCertSelection.cpp
++++ b/security/manager/ssl/TLSClientAuthCertSelection.cpp
+@@ -217,6 +217,12 @@ class ClientAuthCertNonverifyingTrustDomain final : public TrustDomain {
+       pkix::Input subjectPublicKeyInfo) override {
+     return pkix::Success;
+   }
++  virtual mozilla::pkix::Result VerifyMLDSASignedData(
++      pkix::Input data,
++      pkix::Input signature,
++      pkix::Input subjectPublicKeyInfo) override {
++    return pkix::Success;
++  }
+   virtual mozilla::pkix::Result CheckValidityIsAcceptable(
+       pkix::Time notBefore, pkix::Time notAfter,
+       pkix::EndEntityOrCA endEntityOrCA,

SOURCES/firefox-mozconfig

@@ -12,9 +12,7 @@ ac_add_options --enable-official-branding
 ac_add_options --enable-pulseaudio
 ac_add_options --enable-release
 ac_add_options --enable-system-ffi
-ac_add_options --without-sysroot
 ac_add_options --without-system-icu
-ac_add_options --without-wasm-sandboxed-libraries
 ac_add_options --with-system-jpeg
 ac_add_options --with-system-zlib
 ac_add_options --with-unsigned-addon-scopes=app,system

SOURCES/mozilla-bmo1170092.patch

@@ -1,6 +1,6 @@
-diff -up firefox-115.0.2/extensions/pref/autoconfig/src/nsReadConfig.cpp.1170092 firefox-115.0.2/extensions/pref/autoconfig/src/nsReadConfig.cpp
+diff -up firefox-140.0/extensions/pref/autoconfig/src/nsReadConfig.cpp.mozilla-bmo1170092 firefox-140.0/extensions/pref/autoconfig/src/nsReadConfig.cpp
---- firefox-115.0.2/extensions/pref/autoconfig/src/nsReadConfig.cpp.1170092	2023-07-10 21:08:53.000000000 +0200
+--- firefox-140.0/extensions/pref/autoconfig/src/nsReadConfig.cpp.mozilla-bmo1170092	2025-06-02 15:26:44.000000000 +0200
-+++ firefox-115.0.2/extensions/pref/autoconfig/src/nsReadConfig.cpp	2023-07-17 10:33:23.443355156 +0200
++++ firefox-140.0/extensions/pref/autoconfig/src/nsReadConfig.cpp	2025-06-04 13:24:00.344728697 +0200
 @@ -263,8 +263,20 @@ nsresult nsReadConfig::openAndEvaluateJS
      if (NS_FAILED(rv)) return rv;
  
@@ -23,10 +23,10 @@ diff -up firefox-115.0.2/extensions/pref/autoconfig/src/nsReadConfig.cpp.1170092
    } else {
      nsAutoCString location("resource://gre/defaults/autoconfig/");
      location += aFileName;
-diff -up firefox-115.0.2/modules/libpref/Preferences.cpp.1170092 firefox-115.0.2/modules/libpref/Preferences.cpp
+diff -up firefox-140.0/modules/libpref/Preferences.cpp.mozilla-bmo1170092 firefox-140.0/modules/libpref/Preferences.cpp
---- firefox-115.0.2/modules/libpref/Preferences.cpp.1170092	2023-07-10 21:09:00.000000000 +0200
+--- firefox-140.0/modules/libpref/Preferences.cpp.mozilla-bmo1170092	2025-06-02 15:26:51.000000000 +0200
-+++ firefox-115.0.2/modules/libpref/Preferences.cpp	2023-07-17 10:33:23.444355156 +0200
++++ firefox-140.0/modules/libpref/Preferences.cpp	2025-06-04 13:24:00.345430064 +0200
-@@ -4825,6 +4825,9 @@ nsresult Preferences::InitInitialObjects
+@@ -4914,6 +4914,9 @@ nsresult Preferences::InitInitialObjects
    //
    // Thus, in the omni.jar case, we always load app-specific default
    // preferences from omni.jar, whether or not `$app == $gre`.
@@ -36,10 +36,10 @@ diff -up firefox-115.0.2/modules/libpref/Preferences.cpp.1170092 firefox-115.0.2
  
    nsresult rv = NS_ERROR_FAILURE;
    UniquePtr<nsZipFind> find;
-diff -up firefox-115.0.2/toolkit/xre/nsXREDirProvider.cpp.1170092 firefox-115.0.2/toolkit/xre/nsXREDirProvider.cpp
+diff -up firefox-140.0/toolkit/xre/nsXREDirProvider.cpp.mozilla-bmo1170092 firefox-140.0/toolkit/xre/nsXREDirProvider.cpp
---- firefox-115.0.2/toolkit/xre/nsXREDirProvider.cpp.1170092	2023-07-10 22:57:20.000000000 +0200
+--- firefox-140.0/toolkit/xre/nsXREDirProvider.cpp.mozilla-bmo1170092	2025-06-02 15:27:00.000000000 +0200
-+++ firefox-115.0.2/toolkit/xre/nsXREDirProvider.cpp	2023-07-17 10:56:25.309692121 +0200
++++ firefox-140.0/toolkit/xre/nsXREDirProvider.cpp	2025-06-04 15:44:09.413562326 +0200
-@@ -72,6 +72,7 @@
+@@ -76,6 +76,7 @@
  #endif
  #ifdef XP_UNIX
  #  include <ctype.h>
@@ -47,7 +47,7 @@ diff -up firefox-115.0.2/toolkit/xre/nsXREDirProvider.cpp.1170092 firefox-115.0.
  #endif
  #ifdef XP_IOS
  #  include "UIKitDirProvider.h"
-@@ -478,6 +479,17 @@ nsXREDirProvider::GetFile(const char* aP
+@@ -462,6 +463,17 @@ nsXREDirProvider::GetFile(const char* aP
      rv = file->AppendNative(nsLiteralCString(PREF_OVERRIDE_DIRNAME));
      NS_ENSURE_SUCCESS(rv, rv);
      rv = EnsureDirectoryExists(file);
@@ -60,12 +60,12 @@ diff -up firefox-115.0.2/toolkit/xre/nsXREDirProvider.cpp.1170092 firefox-115.0.
 +    appInfo->GetName(appName);
 +    ToLowerCase(appName);
 +    sysConfigDir.Append(appName);
-+    NS_NewNativeLocalFile(sysConfigDir, false, getter_AddRefs(file));
++    NS_NewNativeLocalFile(sysConfigDir, getter_AddRefs(file));
 +    rv = EnsureDirectoryExists(file);
    } else {
      // We don't know anything about this property. Fail without warning, because
      // otherwise we'll get too much warning spam due to
-@@ -694,6 +706,16 @@ nsXREDirProvider::GetFiles(const char* a
+@@ -518,6 +530,16 @@ nsXREDirProvider::GetFiles(const char* a
      }
  #endif
  
@@ -82,9 +82,9 @@ diff -up firefox-115.0.2/toolkit/xre/nsXREDirProvider.cpp.1170092 firefox-115.0.
      rv = NS_NewArrayEnumerator(aResult, directories, NS_GET_IID(nsIFile));
    } else if (!strcmp(aProperty, NS_APP_CHROME_DIR_LIST)) {
      // NS_APP_CHROME_DIR_LIST is only used to get default (native) icons
-diff -up firefox-115.0.2/xpcom/io/nsAppDirectoryServiceDefs.h.1170092 firefox-115.0.2/xpcom/io/nsAppDirectoryServiceDefs.h
+diff -up firefox-140.0/xpcom/io/nsAppDirectoryServiceDefs.h.mozilla-bmo1170092 firefox-140.0/xpcom/io/nsAppDirectoryServiceDefs.h
---- firefox-115.0.2/xpcom/io/nsAppDirectoryServiceDefs.h.1170092	2023-07-10 21:09:13.000000000 +0200
+--- firefox-140.0/xpcom/io/nsAppDirectoryServiceDefs.h.mozilla-bmo1170092	2025-06-02 15:27:01.000000000 +0200
-+++ firefox-115.0.2/xpcom/io/nsAppDirectoryServiceDefs.h	2023-07-17 10:33:23.444355156 +0200
++++ firefox-140.0/xpcom/io/nsAppDirectoryServiceDefs.h	2025-06-04 13:24:00.346423861 +0200
 @@ -58,6 +58,7 @@
  #define NS_APP_PREFS_DEFAULTS_DIR_LIST "PrefDL"
  #define NS_APP_PREFS_OVERRIDE_DIR \

SOURCES/mozilla-bmo1636168-fscreen.patch

@@ -1,29 +1,28 @@
-diff -up firefox-128.0/widget/gtk/nsWindow.cpp.mozilla-bmo1636168-fscreen firefox-128.0/widget/gtk/nsWindow.cpp
+diff -up firefox-140.0/widget/gtk/nsWindow.cpp.mozilla-bmo1636168-fscreen firefox-140.0/widget/gtk/nsWindow.cpp
---- firefox-128.0/widget/gtk/nsWindow.cpp.mozilla-bmo1636168-fscreen	2024-07-04 18:20:43.000000000 +0200
+--- firefox-140.0/widget/gtk/nsWindow.cpp.mozilla-bmo1636168-fscreen	2025-06-02 15:27:00.000000000 +0200
-+++ firefox-128.0/widget/gtk/nsWindow.cpp	2024-07-16 14:54:21.026716936 +0200
++++ firefox-140.0/widget/gtk/nsWindow.cpp	2025-06-12 10:23:04.789578675 +0200
-@@ -174,7 +174,8 @@ const gint kEvents = GDK_TOUCHPAD_GESTUR
+@@ -196,7 +196,7 @@ constexpr gint kEvents =
-                      GDK_ENTER_NOTIFY_MASK | GDK_LEAVE_NOTIFY_MASK |
+     GDK_VISIBILITY_NOTIFY_MASK | GDK_ENTER_NOTIFY_MASK | GDK_LEAVE_NOTIFY_MASK |
-                      GDK_BUTTON_PRESS_MASK | GDK_BUTTON_RELEASE_MASK |
+     GDK_BUTTON_PRESS_MASK | GDK_BUTTON_RELEASE_MASK | GDK_SMOOTH_SCROLL_MASK |
-                      GDK_SMOOTH_SCROLL_MASK | GDK_TOUCH_MASK | GDK_SCROLL_MASK |
+     GDK_TOUCH_MASK | GDK_SCROLL_MASK | GDK_POINTER_MOTION_MASK |
--                     GDK_POINTER_MOTION_MASK | GDK_PROPERTY_CHANGE_MASK;
+-    GDK_PROPERTY_CHANGE_MASK;
-+                     GDK_POINTER_MOTION_MASK | GDK_PROPERTY_CHANGE_MASK |
++    GDK_PROPERTY_CHANGE_MASK | GDK_FOCUS_CHANGE_MASK;
-+                     GDK_FOCUS_CHANGE_MASK;
  
  /* utility functions */
  static bool is_mouse_in_window(GdkWindow* aWindow, gdouble aMouseX,
-@@ -430,7 +431,8 @@ nsWindow::nsWindow()
+@@ -454,7 +454,8 @@ nsWindow::nsWindow()
        mResizedAfterMoveToRect(false),
        mConfiguredClearColor(false),
        mGotNonBlankPaint(false),
 -      mNeedsToRetryCapturingMouse(false) {
 +      mNeedsToRetryCapturingMouse(false),
 +      mPendingFullscreen(false) {
-   mWindowType = WindowType::Child;
    mSizeConstraints.mMaxSize = GetSafeWindowSize(mSizeConstraints.mMaxSize);
  
-@@ -5374,6 +5376,19 @@ void nsWindow::OnWindowStateEvent(GtkWid
+   if (!gGlobalsInitialized) {
-       ClearTransparencyBitmap();
+@@ -5424,6 +5425,19 @@ void nsWindow::OnWindowStateEvent(GtkWid
-     }
+   if (mSizeMode != oldSizeMode && mWidgetListener) {
+     mWidgetListener->SizeModeChanged(mSizeMode);
    }
 +
 +  // Hack to ensure window switched to fullscreen - avoid to fail when starting
@@ -41,7 +40,7 @@ diff -up firefox-128.0/widget/gtk/nsWindow.cpp.mozilla-bmo1636168-fscreen firefo
  }
  
  void nsWindow::OnDPIChanged() {
-@@ -7526,6 +7541,7 @@ nsresult nsWindow::MakeFullScreen(bool a
+@@ -7239,6 +7253,7 @@ nsresult nsWindow::MakeFullScreen(bool a
  
      if (mKioskMonitor.isSome()) {
        KioskLockOnMonitor();
@@ -49,10 +48,10 @@ diff -up firefox-128.0/widget/gtk/nsWindow.cpp.mozilla-bmo1636168-fscreen firefo
      } else {
        gtk_window_fullscreen(GTK_WINDOW(mShell));
      }
-diff -up firefox-128.0/widget/gtk/nsWindow.h.mozilla-bmo1636168-fscreen firefox-128.0/widget/gtk/nsWindow.h
+diff -up firefox-140.0/widget/gtk/nsWindow.h.mozilla-bmo1636168-fscreen firefox-140.0/widget/gtk/nsWindow.h
---- firefox-128.0/widget/gtk/nsWindow.h.mozilla-bmo1636168-fscreen	2024-07-04 18:20:43.000000000 +0200
+--- firefox-140.0/widget/gtk/nsWindow.h.mozilla-bmo1636168-fscreen	2025-06-02 15:27:00.000000000 +0200
-+++ firefox-128.0/widget/gtk/nsWindow.h	2024-07-16 14:25:51.636952919 +0200
++++ firefox-140.0/widget/gtk/nsWindow.h	2025-06-12 10:18:42.354025723 +0200
-@@ -758,6 +758,7 @@ class nsWindow final : public nsBaseWidg
+@@ -786,6 +786,7 @@ class nsWindow final : public nsBaseWidg
     * move-to-rect callback we set mMovedAfterMoveToRect/mResizedAfterMoveToRect.
     */
    bool mWaitingForMoveToRectCallback : 1;

SOURCES/mozilla-bmo1670333.patch

@@ -1,7 +1,7 @@
-diff -up firefox-128.0/dom/media/mp4/MP4Demuxer.cpp.mozilla-bmo1670333 firefox-128.0/dom/media/mp4/MP4Demuxer.cpp
+diff -up firefox-140.0/dom/media/mp4/MP4Demuxer.cpp.mozilla-bmo1670333 firefox-140.0/dom/media/mp4/MP4Demuxer.cpp
---- firefox-128.0/dom/media/mp4/MP4Demuxer.cpp.mozilla-bmo1670333	2024-07-04 18:20:27.000000000 +0200
+--- firefox-140.0/dom/media/mp4/MP4Demuxer.cpp.mozilla-bmo1670333	2025-06-17 18:15:13.000000000 +0200
-+++ firefox-128.0/dom/media/mp4/MP4Demuxer.cpp	2024-07-16 13:49:10.475630426 +0200
++++ firefox-140.0/dom/media/mp4/MP4Demuxer.cpp	2025-06-18 10:17:47.394794429 +0200
-@@ -33,6 +33,8 @@ mozilla::LogModule* GetDemuxerLog() { re
+@@ -32,6 +32,8 @@ mozilla::LogModule* GetDemuxerLog() { re
    DDMOZ_LOG(gMediaDemuxerLog, mozilla::LogLevel::Debug, "::%s: " arg, \
              __func__, ##__VA_ARGS__)
  
@@ -11,9 +11,9 @@ diff -up firefox-128.0/dom/media/mp4/MP4Demuxer.cpp.mozilla-bmo1670333 firefox-1
  
  using TimeUnit = media::TimeUnit;
 @@ -419,6 +421,12 @@ already_AddRefed<MediaRawData> MP4TrackD
-           [[fallthrough]];
          case H264::FrameType::OTHER: {
-           bool keyframe = type == H264::FrameType::I_FRAME;
+           bool keyframe = type == H264::FrameType::I_FRAME_OTHER ||
+                           type == H264::FrameType::I_FRAME_IDR;
 +          if (gUseKeyframeFromContainer) {
 +            if (sample->mKeyframe && sample->mKeyframe != keyframe) {
 +              sample->mKeyframe = keyframe;
@@ -23,10 +23,10 @@ diff -up firefox-128.0/dom/media/mp4/MP4Demuxer.cpp.mozilla-bmo1670333 firefox-1
            if (sample->mKeyframe != keyframe) {
              NS_WARNING(nsPrintfCString("Frame incorrectly marked as %skeyframe "
                                         "@ pts:%" PRId64 " dur:%" PRId64
-diff -up firefox-128.0/dom/media/platforms/PDMFactory.cpp.mozilla-bmo1670333 firefox-128.0/dom/media/platforms/PDMFactory.cpp
+diff -up firefox-140.0/dom/media/platforms/PDMFactory.cpp.mozilla-bmo1670333 firefox-140.0/dom/media/platforms/PDMFactory.cpp
---- firefox-128.0/dom/media/platforms/PDMFactory.cpp.mozilla-bmo1670333	2024-07-04 18:20:26.000000000 +0200
+--- firefox-140.0/dom/media/platforms/PDMFactory.cpp.mozilla-bmo1670333	2025-06-17 18:15:13.000000000 +0200
-+++ firefox-128.0/dom/media/platforms/PDMFactory.cpp	2024-07-16 14:16:04.635809901 +0200
++++ firefox-140.0/dom/media/platforms/PDMFactory.cpp	2025-06-18 10:10:29.209789856 +0200
-@@ -62,6 +62,8 @@
+@@ -61,6 +61,8 @@
  
  #include <functional>
  
@@ -35,7 +35,7 @@ diff -up firefox-128.0/dom/media/platforms/PDMFactory.cpp.mozilla-bmo1670333 fir
  using DecodeSupport = mozilla::media::DecodeSupport;
  using DecodeSupportSet = mozilla::media::DecodeSupportSet;
  using MediaCodec = mozilla::media::MediaCodec;
-@@ -543,7 +545,7 @@ void PDMFactory::CreateRddPDMs() {
+@@ -573,7 +575,7 @@ void PDMFactory::CreateRddPDMs() {
  #ifdef MOZ_FFMPEG
    if (StaticPrefs::media_ffmpeg_enabled() &&
        StaticPrefs::media_rdd_ffmpeg_enabled() &&
@@ -44,7 +44,7 @@ diff -up firefox-128.0/dom/media/platforms/PDMFactory.cpp.mozilla-bmo1670333 fir
      mFailureFlags += GetFailureFlagBasedOnFFmpegStatus(
          FFmpegRuntimeLinker::LinkStatusCode());
    }
-@@ -719,7 +721,7 @@ void PDMFactory::CreateDefaultPDMs() {
+@@ -749,7 +751,7 @@ void PDMFactory::CreateDefaultPDMs() {
    StartupPDM(AgnosticDecoderModule::Create(),
               StaticPrefs::media_prefer_non_ffvpx());
  
@@ -53,10 +53,10 @@ diff -up firefox-128.0/dom/media/platforms/PDMFactory.cpp.mozilla-bmo1670333 fir
        !StartupPDM(GMPDecoderModule::Create(),
                    StaticPrefs::media_gmp_decoder_preferred())) {
      mFailureFlags += DecoderDoctorDiagnostics::Flags::GMPPDMFailedToStartup;
-diff -up firefox-128.0/dom/media/platforms/PDMFactory.h.mozilla-bmo1670333 firefox-128.0/dom/media/platforms/PDMFactory.h
+diff -up firefox-140.0/dom/media/platforms/PDMFactory.h.mozilla-bmo1670333 firefox-140.0/dom/media/platforms/PDMFactory.h
---- firefox-128.0/dom/media/platforms/PDMFactory.h.mozilla-bmo1670333	2024-07-04 18:20:26.000000000 +0200
+--- firefox-140.0/dom/media/platforms/PDMFactory.h.mozilla-bmo1670333	2025-06-17 18:15:13.000000000 +0200
-+++ firefox-128.0/dom/media/platforms/PDMFactory.h	2024-07-16 13:49:10.476630421 +0200
++++ firefox-140.0/dom/media/platforms/PDMFactory.h	2025-06-18 10:10:29.210054963 +0200
-@@ -98,6 +98,7 @@ class PDMFactory final {
+@@ -105,6 +105,7 @@ class PDMFactory final {
    RefPtr<PlatformDecoderModule> mNullPDM;
  
    DecoderDoctorDiagnostics::FlagsSet mFailureFlags;

SOURCES/mozilla-bmo1789216-disable-av1.patch

@@ -1,7 +1,7 @@
-diff -up firefox-128.0/media/ffvpx/libavcodec/allcodecs.c.mozilla-bmo1789216-disable-av1 firefox-128.0/media/ffvpx/libavcodec/allcodecs.c
+diff -up firefox-140.1.0/media/ffvpx/libavcodec/allcodecs.c.mozilla-bmo1789216-disable-av1 firefox-140.1.0/media/ffvpx/libavcodec/allcodecs.c
---- firefox-128.0/media/ffvpx/libavcodec/allcodecs.c.mozilla-bmo1789216-disable-av1	2024-06-12 15:03:01.000000000 +0200
+--- firefox-140.1.0/media/ffvpx/libavcodec/allcodecs.c.mozilla-bmo1789216-disable-av1	2025-07-14 19:14:53.000000000 +0200
-+++ firefox-128.0/media/ffvpx/libavcodec/allcodecs.c	2024-06-13 11:44:10.637215674 +0200
++++ firefox-140.1.0/media/ffvpx/libavcodec/allcodecs.c	2025-07-31 15:12:56.818469857 +0200
-@@ -764,8 +764,11 @@ extern const FFCodec ff_libaribb24_decod
+@@ -769,8 +769,11 @@ extern const FFCodec ff_libaribb24_decod
  extern const FFCodec ff_libcelt_decoder;
  extern const FFCodec ff_libcodec2_encoder;
  extern const FFCodec ff_libcodec2_decoder;
@@ -13,7 +13,7 @@ diff -up firefox-128.0/media/ffvpx/libavcodec/allcodecs.c.mozilla-bmo1789216-dis
  extern const FFCodec ff_libfdk_aac_encoder;
  extern const FFCodec ff_libfdk_aac_decoder;
  extern const FFCodec ff_libgsm_encoder;
-@@ -793,7 +796,6 @@ extern const FFCodec ff_libspeex_decoder
+@@ -800,7 +803,6 @@ extern const FFCodec ff_libspeex_decoder
  extern const FFCodec ff_libsvtav1_encoder;
  extern const FFCodec ff_libtheora_encoder;
  extern const FFCodec ff_libtwolame_encoder;
@@ -21,9 +21,9 @@ diff -up firefox-128.0/media/ffvpx/libavcodec/allcodecs.c.mozilla-bmo1789216-dis
  extern const FFCodec ff_libvo_amrwbenc_encoder;
  extern const FFCodec ff_libvorbis_encoder;
  extern const FFCodec ff_libvorbis_decoder;
-diff -up firefox-128.0/media/ffvpx/libavcodec/codec_list.c.mozilla-bmo1789216-disable-av1 firefox-128.0/media/ffvpx/libavcodec/codec_list.c
+diff -up firefox-140.1.0/media/ffvpx/libavcodec/codec_list.c.mozilla-bmo1789216-disable-av1 firefox-140.1.0/media/ffvpx/libavcodec/codec_list.c
---- firefox-128.0/media/ffvpx/libavcodec/codec_list.c.mozilla-bmo1789216-disable-av1	2024-06-13 11:40:12.668924117 +0200
+--- firefox-140.1.0/media/ffvpx/libavcodec/codec_list.c.mozilla-bmo1789216-disable-av1	2025-07-14 19:14:53.000000000 +0200
-+++ firefox-128.0/media/ffvpx/libavcodec/codec_list.c	2024-06-13 11:44:41.411253372 +0200
++++ firefox-140.1.0/media/ffvpx/libavcodec/codec_list.c	2025-07-31 15:12:56.820214239 +0200
 @@ -11,12 +11,14 @@ static const FFCodec * const codec_list[
  #if CONFIG_MP3_DECODER
      &ff_mp3_decoder,
@@ -39,9 +39,9 @@ diff -up firefox-128.0/media/ffvpx/libavcodec/codec_list.c.mozilla-bmo1789216-di
  #if CONFIG_LIBVORBIS_DECODER
      &ff_libvorbis_decoder,
  #endif
-diff -up firefox-128.0/media/ffvpx/libavcodec/moz.build.mozilla-bmo1789216-disable-av1 firefox-128.0/media/ffvpx/libavcodec/moz.build
+diff -up firefox-140.1.0/media/ffvpx/libavcodec/moz.build.mozilla-bmo1789216-disable-av1 firefox-140.1.0/media/ffvpx/libavcodec/moz.build
---- firefox-128.0/media/ffvpx/libavcodec/moz.build.mozilla-bmo1789216-disable-av1	2024-06-13 11:40:12.669924118 +0200
+--- firefox-140.1.0/media/ffvpx/libavcodec/moz.build.mozilla-bmo1789216-disable-av1	2025-07-14 19:14:53.000000000 +0200
-+++ firefox-128.0/media/ffvpx/libavcodec/moz.build	2024-06-13 11:45:22.867304151 +0200
++++ firefox-140.1.0/media/ffvpx/libavcodec/moz.build	2025-08-01 12:40:58.374987298 +0200
 @@ -94,7 +94,6 @@ if not CONFIG['MOZ_FFVPX_AUDIOONLY']:
          'imgconvert.c',
          'libaom.c',
@@ -50,24 +50,25 @@ diff -up firefox-128.0/media/ffvpx/libavcodec/moz.build.mozilla-bmo1789216-disab
          'libvpxdec.c',
          'libvpxenc.c',
          'mathtables.c',
-@@ -119,10 +118,16 @@ if not CONFIG['MOZ_FFVPX_AUDIOONLY']:
+@@ -120,16 +119,15 @@ if not CONFIG['MOZ_FFVPX_AUDIOONLY']:
-         'vp9recon.c',
          'vpx_rac.c',
      ]
--    USE_LIBS += [
+ 
--        'dav1d',
+-    if CONFIG["MOZ_SYSTEM_AV1"]:
--        'media_libdav1d_asm',
+-        CFLAGS += CONFIG['MOZ_SYSTEM_LIBDAV1D_CFLAGS']
--    ]
+-        CFLAGS += CONFIG['MOZ_SYSTEM_LIBAOM_CFLAGS']
-+    if CONFIG['MOZ_AV1']:
+-        OS_LIBS += CONFIG['MOZ_SYSTEM_LIBDAV1D_LIBS']
-+        USE_LIBS += [
+-        OS_LIBS += CONFIG['MOZ_SYSTEM_LIBAOM_LIBS']
-+            'dav1d',
+-    else:
-+            'media_libdav1d_asm',
++    if CONFIG["MOZ_AV1"]:
-+        ]
+         USE_LIBS += [
+             'dav1d',
+             'media_libdav1d_asm',
+         ]
 +        SOURCES += [
 +            'libdav1d.c',
 +        ]
 +
-+
+ 
      if CONFIG["MOZ_WIDGET_TOOLKIT"] == "gtk":
          LOCAL_INCLUDES += ['/media/mozva']
-         SOURCES += [

SOURCES/process-official-tarball

@@ -17,6 +17,12 @@ rm -vf ./process-tarball-dir/*/mobile/android/android-components/components/brow
 rm -vf ./process-tarball-dir/*/mobile/android/android-components/components/feature/addons/src/main/res/values-ur/strings.xml
 rm -vf ./process-tarball-dir/*/third_party/webkit/PerformanceTests/Speedometer3/resources/editors/dist/assets/codemirror-521de7ab.js
 rm -vf ./process-tarball-dir/*/third_party/python/pip/pip-24.0.dist-info/AUTHORS.txt
+rm -vf ./process-tarball-dir/*/dom/locks/test/crashtests/1908240.js
+
+# We uses system freetype2
+rm -vrf ./process-tarball-dir/*/modules/freetype2
+# We use system zlib
+rm -vrf ./process-tarball-dir/*/modules/zlib
 
 processed_tarball=${1/source/processed-source}
 

SOURCES/rhbz-1173156.patch

@@ -1,12 +1,12 @@
-diff -up firefox-60.5.0/extensions/auth/nsAuthSambaNTLM.cpp.rhbz-1173156 firefox-60.5.0/extensions/auth/nsAuthSambaNTLM.cpp
+diff -up firefox-140.0/extensions/auth/nsAuthSambaNTLM.cpp.rhbz-1173156 firefox-140.0/extensions/auth/nsAuthSambaNTLM.cpp
---- firefox-60.5.0/extensions/auth/nsAuthSambaNTLM.cpp.rhbz-1173156	2019-01-22 10:36:09.284069020 +0100
+--- firefox-140.0/extensions/auth/nsAuthSambaNTLM.cpp.rhbz-1173156	2025-06-02 15:26:45.000000000 +0200
-+++ firefox-60.5.0/extensions/auth/nsAuthSambaNTLM.cpp	2019-01-22 10:37:12.669757744 +0100
++++ firefox-140.0/extensions/auth/nsAuthSambaNTLM.cpp	2025-06-12 11:02:37.183715940 +0200
-@@ -161,7 +161,7 @@ nsresult nsAuthSambaNTLM::SpawnNTLMAuthH
+@@ -153,7 +153,7 @@ nsresult nsAuthSambaNTLM::SpawnNTLMAuthH
-   const char* username = PR_GetEnv("USER");
+     options.fds_to_remap.push_back(
-   if (!username) return NS_ERROR_FAILURE;
+         std::pair{fromChildPipeWrite.get(), STDOUT_FILENO});
+ 
+-    std::vector<std::string> argvVec{"ntlm_auth",        "--helper-protocol",
++    std::vector<std::string> argvVec{"/usr/bin/ntlm_auth",        "--helper-protocol",
+                                      "ntlmssp-client-1", "--use-cached-creds",
+                                      "--username",       username};
  
--  const char* const args[] = {"ntlm_auth",
-+  const char* const args[] = {"/usr/bin/ntlm_auth",
-                               "--helper-protocol",
-                               "ntlmssp-client-1",
-                               "--use-cached-creds",

SOURCES/rhbz-71999-fips-youtube.patch

@@ -0,0 +1,43 @@
+changeset:   781221:573380ae60a7
+tag:         tip
+user:        stransky <stransky@redhat.com>
+date:        Mon Mar 24 10:13:50 2025 +0100
+files:       dom/cache/CacheStorage.cpp dom/indexedDB/ActorsParent.cpp
+description:
+FIPS-youtube
+
+
+diff --git a/dom/cache/CacheStorage.cpp b/dom/cache/CacheStorage.cpp
+--- a/dom/cache/CacheStorage.cpp
++++ b/dom/cache/CacheStorage.cpp
+@@ -38,6 +38,7 @@
+ #include "nsURLParsers.h"
+ #include "js/Object.h"              // JS::GetClass
+ #include "js/PropertyAndElement.h"  // JS_DefineProperty
++#include "pk11pub.h"
+ 
+ namespace mozilla::dom::cache {
+ 
+@@ -581,7 +582,7 @@ bool CacheStorage::HasStorageAccess(UseC
+     if (!principal->IsSystemPrincipal() &&
+         principal->GetPrivateBrowsingId() !=
+             nsIScriptSecurityManager::DEFAULT_PRIVATE_BROWSING_ID &&
+-        !StaticPrefs::dom_cache_privateBrowsing_enabled()) {
++        (!StaticPrefs::dom_cache_privateBrowsing_enabled() || PK11_IsFIPS())) {
+       return false;
+     }
+   }
+diff --git a/dom/indexedDB/ActorsParent.cpp b/dom/indexedDB/ActorsParent.cpp
+--- a/dom/indexedDB/ActorsParent.cpp
++++ b/dom/indexedDB/ActorsParent.cpp
+@@ -14791,7 +14791,8 @@ nsresult FactoryOp::Open() {
+     mEnforcingQuota = mPersistenceType != PERSISTENCE_TYPE_PERSISTENT;
+ 
+     if (mOriginMetadata.mIsPrivate) {
+-      if (StaticPrefs::dom_indexedDB_privateBrowsing_enabled()) {
++      if (StaticPrefs::dom_indexedDB_privateBrowsing_enabled() &&
++          !PK11_IsFIPS()) {
+         // Explicitly disallow moz-extension urls from using the encrypted
+         // indexedDB storage mode when the caller is an extension (see Bug
+         // 1841806).
+

SOURCES/wasi.patch

@@ -0,0 +1,12 @@
+diff -up firefox-121.0.1/toolkit/moz.configure.wasi firefox-121.0.1/toolkit/moz.configure
+--- firefox-121.0.1/toolkit/moz.configure.wasi	2024-02-01 09:14:33.816548952 +0100
++++ firefox-121.0.1/toolkit/moz.configure	2024-02-01 09:15:53.264684309 +0100
+@@ -2663,7 +2663,7 @@ with only_when(requires_wasm_sandboxing
+     def wasi_sysroot_flags(wasi_sysroot):
+         if wasi_sysroot:
+             log.info("Using wasi sysroot in %s", wasi_sysroot)
+-            return ["--sysroot=%s" % wasi_sysroot]
++            return ["--sysroot=%s" % wasi_sysroot, "-nodefaultlibs",  "-lc", "-lwasi-emulated-process-clocks", "-lc++", "-lc++abi", "/home/jhorak/r/firefox/firefox-140.4.0-build/firefox-140.4.0/wasi-sdk-20/build/compiler-rt/lib/wasi/libclang_rt.builtins-wasm32.a"]
+         return []
+ 
+     set_config("WASI_SYSROOT", wasi_sysroot)

SOURCES/wasi.patch.template

@@ -0,0 +1,12 @@
+diff -up firefox-121.0.1/toolkit/moz.configure.wasi firefox-121.0.1/toolkit/moz.configure
+--- firefox-121.0.1/toolkit/moz.configure.wasi	2024-02-01 09:14:33.816548952 +0100
++++ firefox-121.0.1/toolkit/moz.configure	2024-02-01 09:15:53.264684309 +0100
+@@ -2663,7 +2663,7 @@ with only_when(requires_wasm_sandboxing
+     def wasi_sysroot_flags(wasi_sysroot):
+         if wasi_sysroot:
+             log.info("Using wasi sysroot in %s", wasi_sysroot)
+-            return ["--sysroot=%s" % wasi_sysroot]
++            return ["--sysroot=%s" % wasi_sysroot, "-nodefaultlibs",  "-lc", "-lwasi-emulated-process-clocks", "-lc++", "-lc++abi", "$LIBCLANG_RT"]
+         return []
+ 
+     set_config("WASI_SYSROOT", wasi_sysroot)