Auto sync2gitlab import of thunderbird-102.6.0-2.el8_7.src.rpm

2023-01-15 11:44:51 +00:00 · 2023-01-15 11:44:51 +00:00 · 1d452d0cb5
commit 1d452d0cb5
parent f19e3b075d
73 changed files with 41597 additions and 2371 deletions
--- a/.gitignore
+++ b/.gitignore
@ -3,3 +3,7 @@
 /nss-3.67.0-7.el8_1.src.rpm
 /thunderbird-91.8.0.processed-source.tar.xz
 /thunderbird-langpacks-91.8.0-20220405.tar.xz
+/nspr-4.34.0-3.el8_1.src.rpm
+/nss-3.79.0-6.el8_1.src.rpm
+/thunderbird-102.6.0.processed-source.tar.xz
+/thunderbird-langpacks-102.6.0-20221213.tar.xz
--- a/0001-GLIBCXX-fix-for-GCC-12.patch
+++ b/0001-GLIBCXX-fix-for-GCC-12.patch
@ -0,0 +1,44 @@
+From efd5bc0715e5477318be95a76811cda0a89e8289 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Emilio=20Cobos=20=C3=81lvarez?= <emilio@crisal.io>
+Date: Fri, 4 Mar 2022 12:00:26 +0100
+Subject: [PATCH] GLIBCXX fix for GCC 12?
+
+---
+ build/unix/stdc++compat/stdc++compat.cpp | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/build/unix/stdc++compat/stdc++compat.cpp b/build/unix/stdc++compat/stdc++compat.cpp
+index 0180f6bcfa998..8d7a542ff11f0 100644
+--- a/build/unix/stdc++compat/stdc++compat.cpp
+++ b/build/unix/stdc++compat/stdc++compat.cpp
+@@ -24,6 +24,7 @@
+    GLIBCXX_3.4.27 is from gcc 10
+    GLIBCXX_3.4.28 is from gcc 10
+    GLIBCXX_3.4.29 is from gcc 11
+   GLIBCXX_3.4.30 is from gcc 12
+ 
+ This file adds the necessary compatibility tricks to avoid symbols with
+ version GLIBCXX_3.4.20 and bigger, keeping binary compatibility with
+@@ -69,6 +70,19 @@ void __attribute__((weak)) __throw_bad_array_new_length() { MOZ_CRASH(); }
+ }  // namespace std
+ #endif
+ 
+#if _GLIBCXX_RELEASE >= 12
+namespace std {
+
+/* This avoids the GLIBCXX_3.4.30 symbol version. */
+void __attribute__((weak))
+__glibcxx_assert_fail(const char* __file, int __line, const char* __function,
+                      const char* __condition) {
+  MOZ_CRASH();
+}
+
+}  // namespace std
+#endif
+
+ /* While we generally don't build with exceptions, we have some host tools
+  * that do use them. libstdc++ from GCC 5.0 added exception constructors with
+  * char const* argument. Older versions only have a constructor with
+-- 
+2.35.1
+
--- a/D158770.diff
+++ b/D158770.diff
@ -0,0 +1,25 @@
+diff --git a/parser/expat/lib/xmlparse.c b/parser/expat/lib/xmlparse.c
+--- a/parser/expat/lib/xmlparse.c
+++ b/parser/expat/lib/xmlparse.c
+@@ -5652,12 +5652,18 @@
+   else
+ #endif /* XML_DTD */
+   {
+     processor = contentProcessor;
+     /* see externalEntityContentProcessor vs contentProcessor */
+-    return doContent(parser, parentParser ? 1 : 0, encoding, s, end,
+-                     nextPtr, (XML_Bool)!ps_finalBuffer);
+    result = doContent(parser, parser->m_parentParser ? 1 : 0,
+                       parser->m_encoding, s, end, nextPtr,
+                       (XML_Bool)! parser->m_parsingStatus.finalBuffer);
+    if (result == XML_ERROR_NONE) {
+      if (! storeRawNames(parser))
+        return XML_ERROR_NO_MEMORY;
+    }
+    return result;
+   }
+ }
+ 
+ static enum XML_Error PTRCALL
+ errorProcessor(XML_Parser parser,
+
--- a/D161379.diff
+++ b/D161379.diff
@ -0,0 +1,322 @@
+diff -up comm/third_party/moz.build.D161379.diff comm/third_party/moz.build
+--- comm/third_party/moz.build.D161379.diff	2022-10-14 21:45:15.000000000 +0200
+++ comm/third_party/moz.build	2022-11-10 11:49:44.194016978 +0100
+@@ -11,9 +11,11 @@ if CONFIG["TB_LIBOTR_PREBUILT"]:
+ 
+ if CONFIG["MZLA_LIBRNP"]:
+     DIRS += [
+-        "botan",
+         "bzip2",
+         "json-c",
+         "rnp",
+         "zlib",
+     ]
+    if CONFIG["MZLA_LIBRNP_BACKEND"] == "botan":
+        DIRS += [ "botan" ]
+
+diff -up comm/third_party/openpgp.configure.D161379.diff comm/third_party/openpgp.configure
+--- comm/third_party/openpgp.configure.D161379.diff	2022-11-10 11:49:37.605024129 +0100
+++ comm/third_party/openpgp.configure	2022-11-10 11:49:44.194016978 +0100
+@@ -199,16 +199,136 @@ with only_when(in_tree_librnp):
+         set_config("MZLA_BZIP2_CFLAGS", bzip2_flags.cflags)
+         set_config("MZLA_BZIP2_LIBS", bzip2_flags.ldflags)
+ 
+-    # BOTAN --with-system-botan
+-    system_lib_option(
+-        "--with-system-botan",
+-        help="Use system Botan for librnp (located with pkgconfig)",
+-    )
+-
+-    botan_pkg = pkg_check_modules(
+-        "MZLA_BOTAN", "botan-2 >= 2.8.0", when="--with-system-botan"
+-    )
+-    set_config("MZLA_SYSTEM_BOTAN", depends_if(botan_pkg)(lambda _: True))
+    # librnp crypto backend selection
+    option("--with-librnp-backend",
+           help="Build librnp with the selected backend: {botan, openssl}",
+           default="botan")
+
+    @depends("--with-librnp-backend")
+    def librnp_backend(backend):
+        allowed = ("botan", "openssl")
+        if backend[0] in allowed:
+            return backend[0]
+        else:
+            die(f"Unsupported librnp backend {backend[0]}.")
+
+    set_config("MZLA_LIBRNP_BACKEND", librnp_backend)
+
+    @depends(librnp_backend)
+    def rnp_botan(backend):
+        return backend == "botan"
+
+    @depends(librnp_backend)
+    def rnp_openssl(backend):
+        return backend == "openssl"
+
+    # Botan backend (--with-system-botan)
+    with only_when(rnp_botan):
+        system_lib_option(
+            "--with-system-botan",
+            help="Use system Botan for librnp (located with pkgconfig)",
+        )
+
+        botan_pkg = pkg_check_modules(
+            "MZLA_BOTAN", "botan-2 >= 2.8.0", when="--with-system-botan"
+        )
+        set_config("MZLA_SYSTEM_BOTAN", depends_if(botan_pkg)(lambda _: True))
+
+
+    # OpenSSL backend
+    with only_when(rnp_openssl):
+        option(
+            "--with-openssl",
+            nargs=1,
+            help="OpenSSL library prefix (when not found by pkgconfig)"
+        )
+        openssl_pkg = pkg_check_modules(
+            "MZLA_LIBRNP_OPENSSL",
+            "openssl > 1.1.1",
+            allow_missing=True,
+            config=False
+        )
+        @depends_if("--with-openssl", openssl_pkg)
+        @imports(_from="os.path", _import="isdir")
+        @imports(_from="os.path", _import="join")
+        def openssl_flags(openssl_prefix, openssl_pkg):
+            if openssl_prefix:
+                openssl_prefix = openssl_prefix[0]
+                include = join(openssl_prefix, "include")
+                lib = join(openssl_prefix, "lib")
+                if not isdir(lib):
+                    lib = join(openssl_prefix, "lib64")
+                if isdir(include) and isdir(lib):
+                    log.info(f"Using OpenSSL at {openssl_prefix}.")
+                    return namespace(
+                        cflags=(f"-I{include}",),
+                        ldflags=(f"-L{lib}", "-lssl", "-lcrypto"),
+                    )
+            if openssl_pkg:
+                return namespace(
+                    cflags=openssl_pkg.cflags,
+                    ldflags=openssl_pkg.libs,
+                )
+        set_config("MZLA_LIBRNP_OPENSSL_CFLAGS", openssl_flags.cflags)
+        set_config("MZLA_LIBRNP_OPENSSL_LIBS", openssl_flags.ldflags)
+
+
+        @depends(c_compiler, openssl_flags)
+        @imports(_from="textwrap", _import="dedent")
+        def openssl_version(compiler, openssl_flags):
+            log.info("Checking for OpenSSL >= 1.1.1")
+            if openssl_flags is None:
+                die("OpenSSL not found. Must be locatable with pkg-config or use --with-openssl.")
+
+            def ossl_hexver(hex_str):
+                # See opensshlv.h for description of OPENSSL_VERSION_NUMBER
+                MIN_OSSL_VER = 0x1010100f  # Version 1.1.1
+                ver_as_int = int(hex_str[:-1], 16)
+                ossl_major = (ver_as_int & 0xf0000000) >> 28
+                ossl_minor = (ver_as_int & 0x0ff00000) >> 20
+                ossl_fix = (ver_as_int & 0x000ff000) >> 12
+                ossl_patch = chr(96 + (ver_as_int & 0x00000ff0) >> 4)  # as a letter a-z
+                ver_as_str = f"{ossl_major}.{ossl_minor}.{ossl_fix}{ossl_patch}"
+                if ver_as_int < MIN_OSSL_VER:
+                    die(f"OpenSSL version {ver_as_str} is too old.")
+                return ver_as_str
+
+            check = dedent(
+                """\
+            #include <openssl/opensslv.h>
+            #ifdef OPENSSL_VERSION_STR
+            OPENSSL_VERSION_STR
+            #elif defined(OPENSSL_VERSION_NUMBER)
+            OPENSSL_VERSION_NUMBER
+            #else
+            #error Unable to determine OpenSSL version.
+            #endif
+                """
+            )
+            result = try_preprocess(
+                compiler.wrapper
+                + [compiler.compiler]
+                + compiler.flags
+                + list(openssl_flags.cflags),
+                "C",
+                check
+            )
+            if result:
+                openssl_ver = result.splitlines()[-1]
+                if openssl_ver.startswith("0x"):
+                    # OpenSSL 1.x.x - like 0x1010107fL
+                    openssl_ver = ossl_hexver(openssl_ver)
+                else:
+                    # OpenSSL 3.x.x - quoted version like "3.0.7"
+                    openssl_ver = openssl_ver.replace('"', "")
+                    major_version = openssl_ver.split(".")[0]
+                    if major_version != "3":
+                        die("Unrecognized OpenSSL version {openssl_version} found. Require >= 1.1.1 or 3.x.x")
+
+                log.info(f"Found OpenSSL {openssl_ver}.")
+                return openssl_ver
+
+        set_config("MZLA_LIBRNP_OPENSSL_VERSION", openssl_version)
+ 
+     # Checks for building librnp itself
+     # =================================
+diff -up comm/third_party/rnp/moz.build.D161379.diff comm/third_party/rnp/moz.build
+--- comm/third_party/rnp/moz.build.D161379.diff	2022-11-10 11:49:43.682017534 +0100
+++ comm/third_party/rnp/moz.build	2022-11-10 11:51:22.878909880 +0100
+@@ -36,17 +36,53 @@ if CONFIG["CC_TYPE"] == "clang-cl":
+         "/EHs",
+     ]
+ 
+LOCAL_INCLUDES = [
+    "include",
+    "src",
+    "src/common",
+    "src/lib",
+]
+
+IQuote(
+    "{}/src/lib".format(OBJDIR),
+    "{}/src/lib".format(SRCDIR),
+)
+
+# Set up defines for src/lib/config.h
+ rnp_defines = {
+     "HAVE_BZLIB_H": True,
+     "HAVE_ZLIB_H": True,
+-    "CRYPTO_BACKEND_OPENSSL": True,
+-    "ENABLE_AEAD": True,
+-    "ENABLE_TWOFISH": True,
+-    "ENABLE_BRAINPOOL": True,
+     "ENABLE_IDEA": True,
+     "PACKAGE_BUGREPORT": '"https://bugzilla.mozilla.org/enter_bug.cgi?product=Thunderbird"',
+     "PACKAGE_STRING": '"rnp {}"'.format(CONFIG["MZLA_LIBRNP_FULL_VERSION"])
+ }
+if CONFIG["MZLA_LIBRNP_BACKEND"] == "botan":
+    LOCAL_INCLUDES += ["!../botan/build/include"]
+    if CONFIG["MZLA_SYSTEM_BOTAN"]:
+        CXXFLAGS += CONFIG["MZLA_BOTAN_CFLAGS"]
+
+    rnp_defines.update({
+        "CRYPTO_BACKEND_BOTAN": True,
+        "ENABLE_AEAD": True,
+        "ENABLE_TWOFISH": True,
+        "ENABLE_BRAINPOOL": True,
+    })
+elif CONFIG["MZLA_LIBRNP_BACKEND"] == "openssl":
+    CXXFLAGS += CONFIG["MZLA_LIBRNP_OPENSSL_CFLAGS"]
+    OS_LIBS += CONFIG["MZLA_LIBRNP_OPENSSL_LIBS"]
+
+    rnp_defines.update({
+        "CRYPTO_BACKEND_OPENSSL": True,
+        # Not supported with RNP+OpenSSL https://github.com/rnpgp/rnp/issues/1642
+        "ENABLE_AEAD": False,
+        # Not supported by OpenSSL https://github.com/openssl/openssl/issues/2046
+        "ENABLE_TWOFISH": False,
+        # Supported, but not with RHEL's OpenSSL, disabled for now;
+        "ENABLE_BRAINPOOL": False,
+    })
+    if CONFIG["MZLA_LIBRNP_OPENSSL_VERSION"][0] == "3":
+        rnp_defines["CRYPTO_BACKEND_OPENSSL3"] = True
+
+ GeneratedFile(
+     "src/lib/config.h",
+     script="/comm/python/rocbuild/process_cmake_define_files.py",
+@@ -57,23 +93,6 @@ GeneratedFile(
+     ],
+ )
+ 
+-LOCAL_INCLUDES = [
+-    "include",
+-    "src",
+-    "src/common",
+-    "src/lib",
+-]
+-
+-IQuote(
+-    "{}/src/lib".format(OBJDIR),
+-    "{}/src/lib".format(SRCDIR),
+-)
+-
+-if CONFIG["MZLA_SYSTEM_BOTAN"]:
+-    CXXFLAGS += CONFIG["MZLA_BOTAN_CFLAGS"]
+-else:
+-    LOCAL_INCLUDES += ["!../botan/build/include"]
+-
+ if CONFIG["MOZ_SYSTEM_ZLIB"]:
+     CXXFLAGS += CONFIG["MOZ_ZLIB_CFLAGS"]
+ else:
+@@ -109,29 +128,16 @@ SOURCES += [
+     "src/common/time-utils.cpp",
+     "src/lib/crypto.cpp",
+     "src/lib/crypto/backend_version.cpp",
+-    "src/lib/crypto/bn.cpp",
+     "src/lib/crypto/cipher.cpp",
+-    "src/lib/crypto/cipher_botan.cpp",
+-    "src/lib/crypto/dsa.cpp",
+-    "src/lib/crypto/ec.cpp",
+     "src/lib/crypto/ec_curves.cpp",
+-    "src/lib/crypto/ecdh.cpp",
+     "src/lib/crypto/ecdh_utils.cpp",
+-    "src/lib/crypto/ecdsa.cpp",
+-    "src/lib/crypto/eddsa.cpp",
+-    "src/lib/crypto/elgamal.cpp",
+-    "src/lib/crypto/hash.cpp",
+     "src/lib/crypto/hash_common.cpp",
+     "src/lib/crypto/hash_sha1cd.cpp",
+-    "src/lib/crypto/mem.cpp",
+     "src/lib/crypto/mpi.cpp",
+-    "src/lib/crypto/rng.cpp",
+-    "src/lib/crypto/rsa.cpp",
+     "src/lib/crypto/s2k.cpp",
+     "src/lib/crypto/sha1cd/sha1.c",
+     "src/lib/crypto/sha1cd/ubc_check.c",
+     "src/lib/crypto/signatures.cpp",
+-    "src/lib/crypto/symmetric.cpp",
+     "src/lib/fingerprint.cpp",
+     "src/lib/generate-key.cpp",
+     "src/lib/json-utils.cpp",
+@@ -159,4 +165,40 @@ SOURCES += [
+     "src/librepgp/stream-write.cpp",
+ ]
+ 
+if CONFIG["MZLA_LIBRNP_BACKEND"] == "botan":
+    SOURCES += [
+        "src/lib/crypto/bn.cpp",
+        "src/lib/crypto/cipher_botan.cpp",
+        "src/lib/crypto/dsa.cpp",
+        "src/lib/crypto/ec.cpp",
+        "src/lib/crypto/ecdh.cpp",
+        "src/lib/crypto/ecdsa.cpp",
+        "src/lib/crypto/eddsa.cpp",
+        "src/lib/crypto/elgamal.cpp",
+        "src/lib/crypto/hash.cpp",
+        "src/lib/crypto/mem.cpp",
+        "src/lib/crypto/rng.cpp",
+        "src/lib/crypto/rsa.cpp",
+        "src/lib/crypto/symmetric.cpp",
+    ]
+if CONFIG["MZLA_LIBRNP_BACKEND"] == "openssl":
+    SOURCES += [
+        "src/lib/crypto/bn_ossl.cpp",
+        "src/lib/crypto/cipher_ossl.cpp",
+        "src/lib/crypto/dl_ossl.cpp",
+        "src/lib/crypto/dsa_ossl.cpp",
+        "src/lib/crypto/ec_ossl.cpp",
+        "src/lib/crypto/ecdh_ossl.cpp",
+        "src/lib/crypto/ecdsa_ossl.cpp",
+        "src/lib/crypto/eddsa_ossl.cpp",
+        "src/lib/crypto/elgamal_ossl.cpp",
+        "src/lib/crypto/hash_crc24.cpp",
+        "src/lib/crypto/hash_ossl.cpp",
+        "src/lib/crypto/mem_ossl.cpp",
+        "src/lib/crypto/rng_ossl.cpp",
+        "src/lib/crypto/rsa_ossl.cpp",
+        "src/lib/crypto/s2k_ossl.cpp",
+        "src/lib/crypto/symmetric_ossl.cpp",
+    ]
+
+ DIRS += ["src/rnp", "src/rnpkeys"]
--- a/D161895.diff
+++ b/D161895.diff
@ -0,0 +1,49 @@
+diff --git a/third_party/openpgp.configure b/third_party/openpgp.configure
+--- a/third_party/openpgp.configure
+++ b/third_party/openpgp.configure
+@@ -198,21 +198,27 @@
+         )
+         set_config("MZLA_BZIP2_CFLAGS", bzip2_flags.cflags)
+         set_config("MZLA_BZIP2_LIBS", bzip2_flags.ldflags)
+ 
+     # librnp crypto backend selection
+    @depends(target_is_linux)
+    def librnp_backend_choices(is_linux):
+        if is_linux:
+            return ("botan", "openssl")
+        else:
+            return ("botan",)
+
+     option("--with-librnp-backend",
+-           help="Build librnp with the selected backend: {botan, openssl}",
+           help="Build librnp with the selected backend",
+           choices=librnp_backend_choices,
+           nargs=1,
+            default="botan")
+ 
+     @depends("--with-librnp-backend")
+     def librnp_backend(backend):
+-        allowed = ("botan", "openssl")
+-        if backend[0] in allowed:
+        if backend:
+             return backend[0]
+-        else:
+-            die(f"Unsupported librnp backend {backend[0]}.")
+ 
+     set_config("MZLA_LIBRNP_BACKEND", librnp_backend)
+ 
+     @depends(librnp_backend)
+     def rnp_botan(backend):
+@@ -273,10 +279,11 @@
+         set_config("MZLA_LIBRNP_OPENSSL_LIBS", openssl_flags.ldflags)
+ 
+ 
+         @depends(c_compiler, openssl_flags)
+         @imports(_from="textwrap", _import="dedent")
+        @imports(_from="__builtin__", _import="chr")
+         def openssl_version(compiler, openssl_flags):
+             log.info("Checking for OpenSSL >= 1.1.1")
+             if openssl_flags is None:
+                 die("OpenSSL not found. Must be locatable with pkg-config or use --with-openssl.")
+ 
+
--- a/backport-rnp-0.16.2-to-esr102-a-bug-1753683.patch
+++ b/backport-rnp-0.16.2-to-esr102-a-bug-1753683.patch
@ -0,0 +1,81 @@
+# HG changeset patch
+# User Daniel <daniel@thunderbird.net>
+# Date 1658184582 0
+#      Mon Jul 18 22:49:42 2022 +0000
+# Node ID 9998ed5c2bcee289b03828eba670053614fa26da
+# Parent  e572bc3cfa07492189aec439e98378b0811ae3bb
+Bug 1753683 - Replace distutils (deprecated) with packaging. r=rjl
+
+Differential Revision: https://phabricator.services.mozilla.com/D152123
+
+diff --git a/comm/python/thirdroc/thirdroc/__init__.py b/comm/python/thirdroc/thirdroc/__init__.py
+--- a/comm/python/thirdroc/thirdroc/__init__.py
+++ b/comm/python/thirdroc/thirdroc/__init__.py
+@@ -3,11 +3,11 @@
+ # file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ 
+ from __future__ import print_function, absolute_import
+ 
+ import re
+-from distutils.version import StrictVersion
+from packaging.version import parse
+ 
+ VTAG_RE = re.compile(r"^v\d+\.\d+\.\d+$")
+ 
+ 
+ def tag2version(tag):
+@@ -22,16 +22,16 @@ def tag2version(tag):
+         raise Exception("Invalid tag {}".format(tag))
+ 
+ 
+ def get_latest_version(*versions):
+     """
+-    Given a list of versions (that must parse with distutils.version.StrictVersion,
+    Given a list of versions (that must parse with packaging.version.parse),
+     return the latest/newest version.
+     :param list versions:
+-    :return StrictVersion:
+    :return Version:
+     """
+-    version_list = [StrictVersion(tag2version(v)) for v in versions]
+    version_list = [parse(tag2version(v)) for v in versions]
+     version_list.sort()
+     return version_list[-1]
+ 
+ 
+ def latest_version(*versions):
+diff --git a/comm/python/thirdroc/thirdroc/rnp.py b/comm/python/thirdroc/thirdroc/rnp.py
+--- a/comm/python/thirdroc/thirdroc/rnp.py
+++ b/comm/python/thirdroc/thirdroc/rnp.py
+@@ -6,11 +6,11 @@ from __future__ import absolute_import
+ 
+ import os
+ from io import StringIO
+ from datetime import date
+ import re
+-from distutils.version import StrictVersion
+from packaging.version import parse
+ 
+ from mozbuild.preprocessor import Preprocessor
+ 
+ 
+ def rnp_source_update(rnp_root, version_str, revision, timestamp, bug_report):
+@@ -21,14 +21,14 @@ def rnp_source_update(rnp_root, version_
+     :param string version_str: latest version
+     :param string revision: revision hash (short form)
+     :param float timestamp: UNIX timestamp from revision
+     :param string bug_report: where to report bugs for this RNP build
+     """
+-    version = StrictVersion(version_str)
+-    version_major = version.version[0]
+-    version_minor = version.version[1]
+-    version_patch = version.version[2]
+    version = parse(version_str)
+    version_major = version.major
+    version_minor = version.minor
+    version_patch = version.micro
+     date_str = date.fromtimestamp(float(timestamp)).strftime("%Y%m%d")
+     revision_short = revision[:8]
+     version_full = "{}+git{}.{}.MZLA".format(version_str, date_str, revision_short)
+ 
+     defines = dict(
--- a/backport-rnp-0.16.2-to-esr102-b-bug-1790446.patch
+++ b/backport-rnp-0.16.2-to-esr102-b-bug-1790446.patch
@ -0,0 +1,118 @@
+# HG changeset patch
+# User Rob Lemley <rob@thunderbird.net>
+# Date 1662996130 0
+#      Mon Sep 12 15:22:10 2022 +0000
+# Node ID 5dfb405f325609c62215f9d74e01dba029b84611
+# Parent  9998ed5c2bcee289b03828eba670053614fa26da
+Bug 1790446 - Stop rewriting RNP config.h.in when updating the source from upstream. r=dandarnell
+
+Differential Revision: https://phabricator.services.mozilla.com/D157151
+
+diff --git a/comm/python/thirdroc/thirdroc/rnp.py b/comm/python/thirdroc/thirdroc/rnp.py
+--- a/comm/python/thirdroc/thirdroc/rnp.py
+++ b/comm/python/thirdroc/thirdroc/rnp.py
+@@ -11,19 +11,18 @@ import re
+ from packaging.version import parse
+ 
+ from mozbuild.preprocessor import Preprocessor
+ 
+ 
+-def rnp_source_update(rnp_root, version_str, revision, timestamp, bug_report):
+def rnp_source_update(rnp_root, version_str, revision, timestamp):
+     """
+     Update RNP source files: generate version.h and mangle config.h.in
+     :param rnp_root:
+     :type rnp_root:
+     :param string version_str: latest version
+     :param string revision: revision hash (short form)
+     :param float timestamp: UNIX timestamp from revision
+-    :param string bug_report: where to report bugs for this RNP build
+     """
+     version = parse(version_str)
+     version_major = version.major
+     version_minor = version.minor
+     version_patch = version.micro
+@@ -36,20 +35,17 @@ def rnp_source_update(rnp_root, version_
+         RNP_VERSION_MINOR=version_minor,
+         RNP_VERSION_PATCH=version_patch,
+         RNP_VERSION=version_str,
+         RNP_VERSION_FULL=version_full,
+         RNP_VERSION_COMMIT_TIMESTAMP=str(timestamp),
+-        BUGREPORT_EMAIL=bug_report,
+     )
+     src_lib = os.path.join(rnp_root, "src", "lib")
+     version_h_in = os.path.join(src_lib, "version.h.in")
+     version_h = os.path.join(src_lib, "version.h")
+-    config_h_in = os.path.join(src_lib, "config.h.in")
+     readme_rnp = os.path.join(rnp_root, "..", "README.rnp")
+ 
+     generate_version_h(version_h_in, version_h, defines)
+-    mangle_config_h_in(config_h_in, defines)
+     update_readme(readme_rnp, revision)
+ 
+ 
+ def rnp_preprocess(tmpl, dest, defines):
+     """
+@@ -79,30 +75,10 @@ def generate_version_h(template, destina
+     with open(template) as tmpl:
+         with open(destination, "w") as dest:
+             rnp_preprocess(tmpl, dest, defines)
+ 
+ 
+-def mangle_config_h_in(template, defines):
+-    """
+-    Mangle RNP's config.h.in so that it will work with CONFIGURE_DEFINE_FILES
+-    :param string template: path to config.h.in
+-    :param dict defines: result of get_defines()
+-    """
+-    with open(template) as tmpl:
+-        tmp_string = StringIO()
+-        rnp_preprocess(tmpl, tmp_string, defines)
+-
+-    tmp_string.seek(0)
+-
+-    with open(template, "w") as dest:
+-        for line in tmp_string:
+-            if line.startswith("#cmakedefine"):
+-                line = line.replace("#cmakedefine", "#undef")
+-            dest.write(line)
+-        dest.write("\n")
+-
+-
+ def update_readme(path, revision):
+     """
+     Updates the commit hash in README.rnp
+     :param string path: Path to README.rnp
+     :param string revision: revision to insert
+diff --git a/comm/third_party/update_rnp.sh b/comm/third_party/update_rnp.sh
+--- a/comm/third_party/update_rnp.sh
+++ b/comm/third_party/update_rnp.sh
+@@ -42,26 +42,23 @@ TAGLIST=$(git -C "${RNPgit}" tag --list 
+ 
+ LATEST_VERSION=$($THIRDROC latest_version $TAGLIST)
+ REVISION=$(git -C "${RNPgit}" rev-parse --verify HEAD)
+ TIMESTAMP=$(git -C "${RNPgit}" show -s --format=%ct)
+ 
+-BUGREPORT="https://bugzilla.mozilla.org/enter_bug.cgi?product=Thunderbird"
+-
+ # Cleanup rnp checkout
+ rm -rf ${RNPgit}/{.git,.github,.cirrus.yml,.clang-format,.gitignore}
+ rm -rf ${RNPgit}/{_config.yml,docker.sh,ci,cmake,git-hooks,travis.sh,vcpkg.txt}
+ rm -rf ${RNPgit}/{Brewfile,CMakeLists.txt,CMakeSettings.json}
+ 
+ # Do the switch
+ rm -rf rnp
+ mv "${RNPgit}" rnp
+-# Build version.h/config.h.in
+# Build version.h
+ $THIRDROC rnp_source_update rnp/ \
+   "${LATEST_VERSION}" \
+   "${REVISION}" \
+-  "${TIMESTAMP}" \
+-  "${BUGREPORT}"
+  "${TIMESTAMP}"
+ 
+ # Restore moz.build
+ hg revert rnp/moz.build rnp/module.ver rnp/rnp.symbols rnp/src/lib/rnp/rnp_export.h \
+   rnp/src/rnp/moz.build  rnp/src/rnpkeys/moz.build
+ 
--- a/backport-rnp-0.16.2-to-esr102-c-bug-1790446.patch
+++ b/backport-rnp-0.16.2-to-esr102-c-bug-1790446.patch
@ -0,0 +1,185 @@
+# HG changeset patch
+# User Rob Lemley <rob@thunderbird.net>
+# Date 1662996529 0
+#      Mon Sep 12 15:28:49 2022 +0000
+# Node ID c9e44c0a569253884961ad2e18fae23f5ed0f6dc
+# Parent  5dfb405f325609c62215f9d74e01dba029b84611
+Bug 1790446 - Add build script to preprocess CMake config.h templates. r=dandarnell
+
+
+
+Right now config.h.in is rewritten when the RNP source is updated.
+This has caused problems when new lines are added to it.
+
+Depends on D157151
+
+Differential Revision: https://phabricator.services.mozilla.com/D157152
+
+diff --git a/comm/python/rocbuild/process_cmake_define_files.py b/python/rocb/commuild/process_cmake_define_files.py
+new file mode 100644
+--- /dev/null
+++ b/comm/python/rocbuild/process_cmake_define_files.py
+@@ -0,0 +1,103 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+from __future__ import absolute_import, print_function, unicode_literals
+
+import argparse
+import os
+import re
+import sys
+from buildconfig import topsrcdir, topobjdir
+from mozbuild.backend.configenvironment import PartialConfigEnvironment
+
+
+def define_type(string):
+    vals = string.split("=", 1)
+    if len(vals) == 1:
+        vals.append(1)
+    elif vals[1].isdecimal():
+        vals[1] = int(vals[1])
+    return tuple(vals)
+
+
+def process_cmake_define_file(output, input_file, extra_defines):
+    """Creates the given config header. A config header is generated by
+    taking the corresponding source file and replacing some #define/#undef
+    occurences:
+        "#undef NAME" is turned into "#define NAME VALUE"
+        "#cmakedefine NAME" is turned into "#define NAME VALUE"
+        "#define NAME" is unchanged
+        "#define NAME ORIGINAL_VALUE" is turned into "#define NAME VALUE"
+        "#undef UNKNOWN_NAME" is turned into "/* #undef UNKNOWN_NAME */"
+        "#cmakedefine UNKNOWN_NAME" is turned into "/* #undef UNKNOWN_NAME */"
+        Whitespaces are preserved.
+    """
+
+    path = os.path.abspath(input_file)
+
+    config = PartialConfigEnvironment(topobjdir)
+
+    defines = dict(config.defines.iteritems())
+    defines.update(extra_defines)
+
+    with open(path, "r") as input_file:
+        r = re.compile(
+            r'^\s*#\s*(?P<cmd>[a-z]+)(?:\s+(?P<name>\S+)(?:\s+(?P<value>("[^"]+"|\S+)))?)?',
+            re.U,
+        )
+        for line in input_file:
+            m = r.match(line)
+            if m:
+                cmd = m.group("cmd")
+                name = m.group("name")
+                value = m.group("value")
+                if name:
+                    if cmd == "define":
+                        if value and name in defines:
+                            line = (
+                                line[: m.start("value")]
+                                + str(defines[name])
+                                + line[m.end("value") :]
+                            )
+                    elif cmd in ("undef", "cmakedefine"):
+                        if name in defines:
+                            line = (
+                                line[: m.start("cmd")]
+                                + "define"
+                                + line[m.end("cmd") : m.end("name")]
+                                + " "
+                                + str(defines[name])
+                                + line[m.end("name") :]
+                            )
+                        else:
+                            line = (
+                                "/* #undef "
+                                + line[m.start("name") : m.end("name")]
+                                + " */"
+                                + line[m.end("name") :]
+                            )
+
+            output.write(line)
+
+
+def main(output, *argv):
+    parser = argparse.ArgumentParser(description="Process define files.")
+
+    parser.add_argument("input", help="Input define file.")
+    parser.add_argument(
+        "-D",
+        type=define_type,
+        action="append",
+        dest="extra_defines",
+        default=[],
+        help="Additional defines not set at configure time.",
+    )
+
+    args = parser.parse_args(argv)
+
+    return process_cmake_define_file(output, args.input, args.extra_defines)
+
+
+if __name__ == "__main__":
+    sys.exit(main(*sys.argv))
+diff --git a/comm/third_party/rnp/moz.build b/third_party/rnp/moz.b/commuild
+--- a/comm/third_party/rnp/moz.build
+++ b/comm/third_party/rnp/moz.build
+@@ -34,19 +34,27 @@ COMPILE_FLAGS["WARNINGS_CFLAGS"] += [
+ if CONFIG["CC_TYPE"] == "clang-cl":
+     CXXFLAGS += [
+         "/EHs",
+     ]
+ 
+-DEFINES["_GNU_SOURCE"] = True
+-
+-DEFINES["HAVE_BZLIB_H"] = True
+-DEFINES["HAVE_ZLIB_H"] = True
+-DEFINES["MOZ_RNP_DIST_INFO"] = rnp_dist_info
+-
+-CONFIGURE_DEFINE_FILES += [
+rnp_defines = {
+    "HAVE_BZLIB_H": True,
+    "HAVE_ZLIB_H": True,
+    "CRYPTO_BACKEND_BOTAN": True,
+    "ENABLE_AEAD": True,
+    "ENABLE_TWOFISH": True,
+    "ENABLE_BRAINPOOL": True,
+}
+GeneratedFile(
+     "src/lib/config.h",
+-]
+    script="/comm/python/rocbuild/process_cmake_define_files.py",
+    inputs=["src/lib/config.h.in"],
+    flags=[
+        "-D%s=%s" % (k, "1" if v is True else v)
+        for k, v in rnp_defines.items()
+    ],
+)
+ 
+ LOCAL_INCLUDES = [
+     "include",
+     "src",
+     "src/common",
+diff --git a/comm/third_party/rnpdefs.mozbuild b/third_party/rnpdefs.mozb/commuild
+--- a/comm/third_party/rnpdefs.mozbuild
+++ b/comm/third_party/rnpdefs.mozbuild
+@@ -16,17 +16,10 @@ rnp_dist_info = "{} {} rnp".format(
+ COMPILE_FLAGS["OS_CFLAGS"] = []
+ COMPILE_FLAGS["OS_CXXFLAGS"] = []
+ COMPILE_FLAGS["OS_INCLUDES"] = []
+ COMPILE_FLAGS["CLANG_PLUGIN"] = []
+ 
+-DEFINES["RNP_NO_DEPRECATED"] = True
+-DEFINES["CRYPTO_BACKEND_BOTAN"] = True
+-DEFINES["ENABLE_AEAD"] = True
+-DEFINES["ENABLE_TWOFISH"] = True
+-DEFINES["ENABLE_BRAINPOOL"] = True
+-
+-
+ if CONFIG["COMPILE_ENVIRONMENT"]:
+     COMPILE_FLAGS["MOZ_HARDENING_CFLAGS"] = []
+ 
+ if CONFIG["CC_TYPE"] == "clang-cl":
+     CFLAGS += [
--- a/backport-rnp-0.16.2-to-esr102-d-bug-1790446.patch
+++ b/backport-rnp-0.16.2-to-esr102-d-bug-1790446.patch
@ -0,0 +1,77 @@
+# HG changeset patch
+# User Rob Lemley <rob@thunderbird.net>
+# Date 1662997034 0
+#      Mon Sep 12 15:37:14 2022 +0000
+# Node ID 17dc6bb322b5d40299bba0a90d59c0593137d4f6
+# Parent  c9e44c0a569253884961ad2e18fae23f5ed0f6dc
+Bug 1790446 - Get RNP version during configure and set in config.h. r=dandarnell
+
+
+
+
+Depends on D157152
+
+Differential Revision: https://phabricator.services.mozilla.com/D157153
+
+diff --git a/comm/third_party/openpgp.configure b/comm/third_party/openpgp.configure
+--- a/comm/third_party/openpgp.configure
+++ b/comm/third_party/openpgp.configure
+@@ -86,10 +86,42 @@ with only_when("--enable-compile-environ
+     set_config("MZLA_LIBRNP", depends_if(in_tree_librnp)(lambda _: True))
+     set_define("MZLA_LIBRNP", depends_if(in_tree_librnp)(lambda _: True))
+ 
+ 
+ with only_when(in_tree_librnp):
+
+    @depends(build_environment, c_compiler)
+    @imports(_from="textwrap", _import="dedent")
+    @imports(_from="os.path", _import="join")
+    def rnp_version_string(build_env, compiler):
+        log.info("Determining librnp version from version.h.")
+        include_path = join(
+            build_env.topsrcdir, "comm", "third_party", "rnp", "src", "lib"
+        )
+        check = dedent(
+            """\
+        #include "version.h"
+        RNP_VERSION_STRING_FULL
+        """
+        )
+        result = try_preprocess(
+            compiler.wrapper
+            + [compiler.compiler]
+            + compiler.flags
+            + ["-I", include_path],
+            "C",
+            check,
+        )
+        if result:
+            rnp_version = result.splitlines()[-1]
+            rnp_version = rnp_version.replace('"', "")
+        else:
+            raise FatalCheckError("Unable to determine RNP version string.")
+        return rnp_version
+
+    set_config("MZLA_LIBRNP_FULL_VERSION", rnp_version_string)
+
+     # JSON-C --with-system-json
+     system_lib_option(
+         "--with-system-jsonc",
+         help="Use system JSON-C for librnp (located with pkgconfig)",
+     )
+diff --git a/comm/third_party/rnp/moz.build b/third_party/rnp/moz.b/commuild
+--- a/comm/third_party/rnp/moz.build
+++ b/comm/third_party/rnp/moz.build
+@@ -41,10 +41,12 @@ rnp_defines = {
+     "HAVE_ZLIB_H": True,
+     "CRYPTO_BACKEND_BOTAN": True,
+     "ENABLE_AEAD": True,
+     "ENABLE_TWOFISH": True,
+     "ENABLE_BRAINPOOL": True,
+    "PACKAGE_BUGREPORT": '"https://bugzilla.mozilla.org/enter_bug.cgi?product=Thunderbird"',
+    "PACKAGE_STRING": '"rnp {}"'.format(CONFIG["MZLA_LIBRNP_FULL_VERSION"])
+ }
+ GeneratedFile(
+     "src/lib/config.h",
+     script="/comm/python/rocbuild/process_cmake_define_files.py",
+     inputs=["src/lib/config.h.in"],
--- a/backport-rnp-0.16.2-to-esr102-e-bug-1790116.patch
+++ b/backport-rnp-0.16.2-to-esr102-e-bug-1790116.patch
@ -0,0 +1,58 @@
+# HG changeset patch
+# User Rob Lemley <rob@thunderbird.net>
+# Date 1663866047 14400
+#      Thu Sep 22 13:00:47 2022 -0400
+# Node ID 8c718243f4e83fc18dfc88bf5d817c5c18f13937
+# Parent  17dc6bb322b5d40299bba0a90d59c0593137d4f6
+Bug 1790116 - update_rnp.sh changes for RNP v0.16.2. r=kaie
+
+The changes in bug_1768424.patch are now included upstream in
+https://github.com/rnpgp/rnp/commit/ac6f58ef7ccea270b735b53f87da2c3ca5b34290.
+
+bug_1763641.patch removed per bug 1790116 comment 26.
+
+disable_obsolete_ciphers.patch no longer needed, use security rules instead.
+
+Differential Revision: https://phabricator.services.mozilla.com/D157010
+
+diff --git a/comm/third_party/update_rnp.sh b/comm/third_party/update_rnp.sh
+--- a/comm/third_party/update_rnp.sh
+++ b/comm/third_party/update_rnp.sh
+@@ -43,11 +43,11 @@ TAGLIST=$(git -C "${RNPgit}" tag --list 
+ LATEST_VERSION=$($THIRDROC latest_version $TAGLIST)
+ REVISION=$(git -C "${RNPgit}" rev-parse --verify HEAD)
+ TIMESTAMP=$(git -C "${RNPgit}" show -s --format=%ct)
+ 
+ # Cleanup rnp checkout
+-rm -rf ${RNPgit}/{.git,.github,.cirrus.yml,.clang-format,.gitignore}
+rm -rf ${RNPgit}/{.git,.github,.cirrus.yml,.clang-format,.gitignore,.codespellrc}
+ rm -rf ${RNPgit}/{_config.yml,docker.sh,ci,cmake,git-hooks,travis.sh,vcpkg.txt}
+ rm -rf ${RNPgit}/{Brewfile,CMakeLists.txt,CMakeSettings.json}
+ 
+ # Do the switch
+ rm -rf rnp
+@@ -60,17 +60,17 @@ mv "${RNPgit}" rnp
+ 
+ # Restore moz.build
+ hg revert rnp/moz.build rnp/module.ver rnp/rnp.symbols rnp/src/lib/rnp/rnp_export.h \
+   rnp/src/rnp/moz.build  rnp/src/rnpkeys/moz.build
+ 
+-# Reapply Thunderbird patch to disable obsolete ciphers
+-PATCH_FILES=("patches/rnp/disable_obsolete_ciphers.patch" \
+-             "patches/rnp/bug_1763641.patch" \
+-             "patches/rnp/bug_1768424.patch")
+-for PATCH_FILE in "${PATCH_FILES[@]}"; do
+-  patch -p2 -i "${PATCH_FILE}" -N -r "${MY_TEMP_DIR}/${PATCH_FILE}.rej"
+-done
+# Patch librnp - currently not needed
+#PATCH_FILES=("patches/rnp/disable_obsolete_ciphers.patch")
+#for PATCH_FILE in "${PATCH_FILES[@]}"; do
+#  # shellcheck disable=SC2086
+#  echo "Applying patch $(basename ${PATCH_FILE})"
+#  patch -p2 -i "${PATCH_FILE}" -N -r "${MY_TEMP_DIR}/${PATCH_FILE}.rej"
+#done
+ 
+ # Patch sometimes creates backup files that are not wanted.
+ find rnp -name '*.orig' -exec rm -f '{}' \;
+ 
+ rm -rf "${MY_TEMP_DIR}"
--- a/backport-rnp-0.16.2-to-esr102-f-bug-1790116.patch
+++ b/backport-rnp-0.16.2-to-esr102-f-bug-1790116.patch
--- a/backport-rnp-0.16.2-to-esr102-g-bug-1790116.patch
+++ b/backport-rnp-0.16.2-to-esr102-g-bug-1790116.patch
@ -0,0 +1,77 @@
+# HG changeset patch
+# User Rob Lemley <rob@thunderbird.net>
+# Date 1663866531 14400
+#      Thu Sep 22 13:08:51 2022 -0400
+# Node ID a863c22903a3fa4c71360920ed77ac31f1fa5d01
+# Parent  3625a887f020a9a3cb3ad96e5107bfeacd54386e
+Bug 1790116 - Update rnp_export.h. r=kaie
+
+The CMake code that generates this file changed with RNP 0.16. The local copy
+needs to be regenerated.
+
+File generated with CMake using clang.
+
+Differential Revision: https://phabricator.services.mozilla.com/D157053
+
+diff --git a/comm/third_party/rnp/src/lib/rnp/rnp_export.h b/third_party/rnp/src/lib/comm/rnp/rnp_export.h
+--- a/comm/third_party/rnp/src/lib/rnp/rnp_export.h
+++ b/comm/third_party/rnp/src/lib/rnp/rnp_export.h
+@@ -1,42 +1,42 @@
+ 
+-#ifndef RNP_API_H
+-#define RNP_API_H
+#ifndef RNP_EXPORT
+#define RNP_EXPORT
+ 
+ #ifdef RNP_STATIC
+ #  define RNP_API
+-#  define RNP_RNP_NO_EXPORT
+#  define RNP_NO_EXPORT
+ #else
+ #  ifndef RNP_API
+ #    ifdef librnp_EXPORTS
+         /* We are building this library */
+-#      define RNP_API __attribute__((visibility("default")))
+#      define RNP_API 
+ #    else
+         /* We are using this library */
+-#      define RNP_API __attribute__((visibility("default")))
+#      define RNP_API 
+ #    endif
+ #  endif
+ 
+-#  ifndef RNP_RNP_NO_EXPORT
+-#    define RNP_RNP_NO_EXPORT __attribute__((visibility("hidden")))
+#  ifndef RNP_NO_EXPORT
+#    define RNP_NO_EXPORT 
+ #  endif
+ #endif
+ 
+-#ifndef RNP_RNP_DEPRECATED
+-#  define RNP_RNP_DEPRECATED __attribute__ ((__deprecated__))
+#ifndef RNP_DEPRECATED
+#  define RNP_DEPRECATED __attribute__ ((__deprecated__))
+ #endif
+ 
+-#ifndef RNP_RNP_DEPRECATED_EXPORT
+-#  define RNP_RNP_DEPRECATED_EXPORT RNP_API RNP_RNP_DEPRECATED
+#ifndef RNP_DEPRECATED_EXPORT
+#  define RNP_DEPRECATED_EXPORT RNP_API RNP_DEPRECATED
+ #endif
+ 
+-#ifndef RNP_RNP_DEPRECATED_NO_EXPORT
+-#  define RNP_RNP_DEPRECATED_NO_EXPORT RNP_RNP_NO_EXPORT RNP_RNP_DEPRECATED
+#ifndef RNP_DEPRECATED_NO_EXPORT
+#  define RNP_DEPRECATED_NO_EXPORT RNP_NO_EXPORT RNP_DEPRECATED
+ #endif
+ 
+ #if 0 /* DEFINE_NO_DEPRECATED */
+-#  ifndef RNP_RNP_NO_DEPRECATED
+-#    define RNP_RNP_NO_DEPRECATED
+#  ifndef RNP_NO_DEPRECATED
+#    define RNP_NO_DEPRECATED
+ #  endif
+ #endif
+ 
+-#endif /* RNP_API_H */
+#endif /* RNP_EXPORT */
--- a/backport-rnp-0.16.2-to-esr102-h-bug-1790116.patch
+++ b/backport-rnp-0.16.2-to-esr102-h-bug-1790116.patch
@ -0,0 +1,34 @@
+# HG changeset patch
+# User Rob Lemley <rob@thunderbird.net>
+# Date 1663866531 14400
+#      Thu Sep 22 13:08:51 2022 -0400
+# Node ID 0798506e89ab0ad98d5826effe2087c2e2560d0b
+# Parent  a863c22903a3fa4c71360920ed77ac31f1fa5d01
+Bug 1790116 - Do not compile SM2 crypto with librnp. r=kaie
+
+
+
+The CMake configuration in rnp/src/lib/CMakeLists.txt does not include
+src/lib/crypto/sm2.cpp unless ENABLE_SM2 is defined.
+Thunderbird builds do not set ENABLE_SM2, so there's no need to build this
+file.
+
+Depends on D157053
+
+Differential Revision: https://phabricator.services.mozilla.com/D157154
+
+diff --git a/comm/third_party/rnp/moz.build b/third_party/rnp/moz.b/commuild
+--- a/comm/third_party/rnp/moz.build
+++ b/comm/third_party/rnp/moz.build
+@@ -128,11 +128,10 @@ SOURCES += [
+     "src/lib/crypto/s2k.cpp",
+     "src/lib/crypto/sha1cd/hash_sha1cd.cpp",
+     "src/lib/crypto/sha1cd/sha1.c",
+     "src/lib/crypto/sha1cd/ubc_check.c",
+     "src/lib/crypto/signatures.cpp",
+-    "src/lib/crypto/sm2.cpp",
+     "src/lib/crypto/symmetric.cpp",
+     "src/lib/fingerprint.cpp",
+     "src/lib/generate-key.cpp",
+     "src/lib/json-utils.cpp",
+     "src/lib/key-provider.cpp",
--- a/backport-rnp-0.16.2-to-esr102-i-bug-1790116.patch
+++ b/backport-rnp-0.16.2-to-esr102-i-bug-1790116.patch
@ -0,0 +1,262 @@
+# HG changeset patch
+# User Rob Lemley <rob@thunderbird.net>
+# Date 1663866557 14400
+#      Thu Sep 22 13:09:17 2022 -0400
+# Node ID 121afb4ed9b0e282cf6690736ffadf1498578434
+# Parent  0798506e89ab0ad98d5826effe2087c2e2560d0b
+Bug 1790116 - mozbuild changes for RNP v0.16.2. r=kaie
+hash_sha1cd.cpp moved up to its parent directory.
+
+ENABLE_IDEA needs to be set to keep support enabled.
+https://github.com/rnpgp/rnp/commit/17972d0238919d4abf88b04debce95844be4716d
+
+Update rnp_symbols.py to not include deprecated functions.
+Added new symbols to rnp.symbols for export.
+
+Differential Revision: https://phabricator.services.mozilla.com/D157012
+
+diff --git a/comm/python/thirdroc/thirdroc/rnp_symbols.py b/python/thirdroc/thirdroc/rnp_symb/commols.py
+--- a/comm/python/thirdroc/thirdroc/rnp_symbols.py
+++ b/comm/python/thirdroc/thirdroc/rnp_symbols.py
+@@ -14,30 +14,75 @@ the third_party/rnp/include/rnp/rnp.h fo
+ Also note that APIs that are marked deprecated are not checked for.
+ 
+ Dependencies: Only Python 3
+ 
+ Running:
+-  python3 rnp_symbols.py
+  python3 rnp_symbols.py [-h] [rnp.h path] [rnp.symbols path]
+ 
+-Output will be on stdout, this is to give the developer the opportunity to compare the old and
+-new versions and check for accuracy.
+Both file path arguments are optional. By default, the header file will be
+read from "comm/third_party/rnp/include/rnp/rnp.h" and the symbols file will
+be written to "comm/third_party/rnp/rnp.symbols".
+
+Path arguments are relative to the current working directory, the defaults
+will be determined based on the location of this script.
+
+Either path argument can be '-' to use stdin or stdout respectively.
+ """
+ 
+-from __future__ import absolute_import, print_function
+-
+import argparse
+ import sys
+ import os
+ import re
+ 
+ HERE = os.path.dirname(__file__)
+ TOPSRCDIR = os.path.abspath(os.path.join(HERE, "../../../../"))
+-RNPSRCDIR = os.path.join(TOPSRCDIR, "comm/third_party/rnp")
+THIRD_SRCDIR = os.path.join(TOPSRCDIR, "comm/third_party")
+HEADER_FILE_REL = "rnp/include/rnp/rnp.h"
+HEADER_FILE = os.path.join(THIRD_SRCDIR, HEADER_FILE_REL)
+SYMBOLS_FILE_REL = "rnp/rnp.symbols"
+SYMBOLS_FILE = os.path.join(THIRD_SRCDIR, SYMBOLS_FILE_REL)
+ 
+ 
+ FUNC_DECL_RE = re.compile(r"^RNP_API\s+.*?([a-zA-Z0-9_]+)\(.*$")
+ 
+ 
+class FileArg:
+    """Based on argparse.FileType from the Python standard library.
+    Modified to not open the filehandles until the open() method is
+    called.
+    """
+
+    def __init__(self, mode="r"):
+        self._mode = mode
+        self._fp = None
+        self._file = None
+
+    def __call__(self, string):
+        # the special argument "-" means sys.std{in,out}
+        if string == "-":
+            if "r" in self._mode:
+                self._fp = sys.stdin.buffer if "b" in self._mode else sys.stdin
+            elif "w" in self._mode:
+                self._fp = sys.stdout.buffer if "b" in self._mode else sys.stdout
+            else:
+                raise ValueError(f"Invalid mode {self._mode} for stdin/stdout")
+        else:
+            if "r" in self._mode:
+                if not os.path.isfile(string):
+                    raise ValueError(f"Cannot read file {string}, does not exist.")
+            elif "w" in self._mode:
+                if not os.access(string, os.W_OK):
+                    raise ValueError(f"Cannot write file {string}, permission denied.")
+            self._file = string
+        return self
+
+    def open(self):
+        if self._fp:
+            return self._fp
+        return open(self._file, self._mode)
+
+
+ def get_func_name(line):
+     """
+     Extract the function name from a RNP_API function declaration.
+     Examples:
+     RNP_API rnp_result_t rnp_enable_debug(const char *file);
+@@ -46,24 +91,41 @@ def get_func_name(line):
+     """
+     m = FUNC_DECL_RE.match(line)
+     return m.group(1)
+ 
+ 
+-def extract_func_defs(filename):
+def extract_func_defs(filearg):
+     """
+     Look for RNP_API in the header file to find the names of the symbols that should be exported
+     """
+-    with open(filename) as fp:
+    with filearg.open() as fp:
+         for line in fp:
+-            if line.startswith("RNP_API"):
+            if line.startswith("RNP_API") and "RNP_DEPRECATED" not in line:
+                 func_name = get_func_name(line)
+                 yield func_name
+ 
+ 
+ if __name__ == "__main__":
+-    if len(sys.argv) > 1:
+-        FILENAME = sys.argv[1]
+-    else:
+-        FILENAME = os.path.join(RNPSRCDIR, "include/rnp/rnp.h")
+    parser = argparse.ArgumentParser(
+        description="Update rnp.symbols file from rnp.h",
+        epilog="To use stdin or stdout pass '-' for the argument.",
+    )
+    parser.add_argument(
+        "header_file",
+        default=HEADER_FILE,
+        type=FileArg("r"),
+        nargs="?",
+        help=f"input path to rnp.h header file (default: {HEADER_FILE_REL})",
+    )
+    parser.add_argument(
+        "symbols_file",
+        default=SYMBOLS_FILE,
+        type=FileArg("w"),
+        nargs="?",
+        help=f"output path to symbols file (default: {SYMBOLS_FILE_REL})",
+    )
+ 
+-    for f in sorted(list(extract_func_defs(FILENAME))):
+-        print(f)
+    args = parser.parse_args()
+
+    with args.symbols_file.open() as out_fp:
+        for symbol in sorted(list(extract_func_defs(args.header_file))):
+            out_fp.write(f"{symbol}\n")
+diff --git a/comm/third_party/rnp/moz.build b/third_party/rnp/moz.b/commuild
+--- a/comm/third_party/rnp/moz.build
+++ b/comm/third_party/rnp/moz.build
+@@ -41,10 +41,11 @@ rnp_defines = {
+     "HAVE_ZLIB_H": True,
+     "CRYPTO_BACKEND_BOTAN": True,
+     "ENABLE_AEAD": True,
+     "ENABLE_TWOFISH": True,
+     "ENABLE_BRAINPOOL": True,
+    "ENABLE_IDEA": True,
+     "PACKAGE_BUGREPORT": '"https://bugzilla.mozilla.org/enter_bug.cgi?product=Thunderbird"',
+     "PACKAGE_STRING": '"rnp {}"'.format(CONFIG["MZLA_LIBRNP_FULL_VERSION"])
+ }
+ GeneratedFile(
+     "src/lib/config.h",
+@@ -119,16 +120,16 @@ SOURCES += [
+     "src/lib/crypto/ecdsa.cpp",
+     "src/lib/crypto/eddsa.cpp",
+     "src/lib/crypto/elgamal.cpp",
+     "src/lib/crypto/hash.cpp",
+     "src/lib/crypto/hash_common.cpp",
+    "src/lib/crypto/hash_sha1cd.cpp",
+     "src/lib/crypto/mem.cpp",
+     "src/lib/crypto/mpi.cpp",
+     "src/lib/crypto/rng.cpp",
+     "src/lib/crypto/rsa.cpp",
+     "src/lib/crypto/s2k.cpp",
+-    "src/lib/crypto/sha1cd/hash_sha1cd.cpp",
+     "src/lib/crypto/sha1cd/sha1.c",
+     "src/lib/crypto/sha1cd/ubc_check.c",
+     "src/lib/crypto/signatures.cpp",
+     "src/lib/crypto/symmetric.cpp",
+     "src/lib/fingerprint.cpp",
+diff --git a/comm/third_party/rnp/rnp.symbols b/third_party/rnp/rnp.symb/commols
+--- a/comm/third_party/rnp/rnp.symbols
+++ b/comm/third_party/rnp/rnp.symbols
+@@ -37,10 +37,11 @@ rnp_import_keys
+ rnp_import_signatures
+ rnp_input_destroy
+ rnp_input_from_callback
+ rnp_input_from_memory
+ rnp_input_from_path
+rnp_input_from_stdin
+ rnp_key_25519_bits_tweak
+ rnp_key_25519_bits_tweaked
+ rnp_key_add_uid
+ rnp_key_allows_usage
+ rnp_key_export
+@@ -75,10 +76,11 @@ rnp_key_get_uid_count
+ rnp_key_get_uid_handle_at
+ rnp_key_handle_destroy
+ rnp_key_have_public
+ rnp_key_have_secret
+ rnp_key_is_compromised
+rnp_key_is_expired
+ rnp_key_is_locked
+ rnp_key_is_primary
+ rnp_key_is_protected
+ rnp_key_is_retired
+ rnp_key_is_revoked
+@@ -112,10 +114,11 @@ rnp_op_encrypt_set_cipher
+ rnp_op_encrypt_set_compression
+ rnp_op_encrypt_set_creation_time
+ rnp_op_encrypt_set_expiration_time
+ rnp_op_encrypt_set_file_mtime
+ rnp_op_encrypt_set_file_name
+rnp_op_encrypt_set_flags
+ rnp_op_encrypt_set_hash
+ rnp_op_generate_add_pref_cipher
+ rnp_op_generate_add_pref_compression
+ rnp_op_generate_add_pref_hash
+ rnp_op_generate_add_usage
+@@ -169,10 +172,11 @@ rnp_op_verify_get_signature_at
+ rnp_op_verify_get_signature_count
+ rnp_op_verify_get_symenc_at
+ rnp_op_verify_get_symenc_count
+ rnp_op_verify_get_used_recipient
+ rnp_op_verify_get_used_symenc
+rnp_op_verify_set_flags
+ rnp_op_verify_signature_get_handle
+ rnp_op_verify_signature_get_hash
+ rnp_op_verify_signature_get_key
+ rnp_op_verify_signature_get_status
+ rnp_op_verify_signature_get_times
+@@ -185,21 +189,24 @@ rnp_output_to_armor
+ rnp_output_to_callback
+ rnp_output_to_file
+ rnp_output_to_memory
+ rnp_output_to_null
+ rnp_output_to_path
+rnp_output_to_stdout
+ rnp_output_write
+ rnp_recipient_get_alg
+ rnp_recipient_get_keyid
+ rnp_remove_security_rule
+ rnp_request_password
+ rnp_result_to_string
+ rnp_save_keys
+rnp_set_timestamp
+ rnp_signature_get_alg
+ rnp_signature_get_creation
+ rnp_signature_get_expiration
+ rnp_signature_get_hash_alg
+rnp_signature_get_key_fprint
+ rnp_signature_get_keyid
+ rnp_signature_get_signer
+ rnp_signature_get_type
+ rnp_signature_handle_destroy
+ rnp_signature_is_valid
--- a/backport-rnp-0.16.2-to-esr102-j-bug-1790662.patch
+++ b/backport-rnp-0.16.2-to-esr102-j-bug-1790662.patch
@ -0,0 +1,32 @@
+# HG changeset patch
+# User Rob Lemley <rob@thunderbird.net>
+# Date 1663091141 0
+#      Tue Sep 13 17:45:41 2022 +0000
+# Node ID fbc2cf15893e40959b04d22c9efa4d424aeb5c4f
+# Parent  121afb4ed9b0e282cf6690736ffadf1498578434
+Bug 1790662 - Update librnp compiler include path for new location of json-c's json.h r=dandarnell
+
+
+json.h from json-c is now a preprocessed file and is found in the object directory
+rather than the source directory.
+
+Depends on D157961
+
+Differential Revision: https://phabricator.services.mozilla.com/D157962
+
+diff --git a/comm/third_party/rnp/moz.build b/third_party/rnp/moz.b/commuild
+--- a/comm/third_party/rnp/moz.build
+++ b/comm/third_party/rnp/moz.build
+@@ -81,11 +81,11 @@ else:
+ 
+ if CONFIG["MZLA_SYSTEM_JSONC"]:
+     CXXFLAGS += CONFIG["MZLA_JSONC_CFLAGS"]
+ else:
+     IQuote("{}/../json-c".format(OBJDIR))
+-    LOCAL_INCLUDES += ["../json-c"]
+    LOCAL_INCLUDES += ["!../json-c", "../json-c"]
+ 
+ if CONFIG["MZLA_SYSTEM_BZIP2"]:
+     CXXFLAGS += CONFIG["MZLA_BZIP2_CFLAGS"]
+ else:
+     LOCAL_INCLUDES += ["../bzip2"]
--- a/backport-rnp-0.16.2-to-esr102-k-bug-1790662.patch
+++ b/backport-rnp-0.16.2-to-esr102-k-bug-1790662.patch
--- a/backport-rnp-0.16.2-to-esr102-l-bug-1791195.patch
+++ b/backport-rnp-0.16.2-to-esr102-l-bug-1791195.patch
@ -0,0 +1,450 @@
+# HG changeset patch
+# User Kai Engert <kaie@kuix.de>
+# Date 1666897160 -7200
+#      Thu Oct 27 20:59:20 2022 +0200
+# Node ID af0b1f5e4c7710f824c6141103e516ca60bc78aa
+# Parent  adfbf6378df82c8b2e087427a48ddc5cbe13aadd
+Bug 1791195 - Add RNP security rules to obsolete our patches to RNP. r=mkmelin,o.nickolay
+
+diff --git a/comm/mail/extensions/openpgp/content/modules/RNP.jsm b/comm/mail/extensions/openpgp/content/modules/RNP.jsm
+--- a/comm/mail/extensions/openpgp/content/modules/RNP.jsm
+++ b/comm/mail/extensions/openpgp/content/modules/RNP.jsm
+@@ -1863,12 +1863,12 @@ var RNP = {
+ 
+     if (keyBlockStr.length > RNP.maxImportKeyBlockSize) {
+       throw new Error("rejecting big keyblock");
+     }
+ 
+-    let tempFFI = new RNPLib.rnp_ffi_t();
+-    if (RNPLib.rnp_ffi_create(tempFFI.address(), "GPG", "GPG")) {
+    let tempFFI = RNPLib.prepare_ffi();
+    if (!tempFFI) {
+       throw new Error("Couldn't initialize librnp.");
+     }
+ 
+     let pubKey;
+     if (!this.importToFFI(tempFFI, keyBlockStr, true, false, permissive)) {
+@@ -1892,12 +1892,12 @@ var RNP = {
+ 
+     if (keyBlockStr.length > RNP.maxImportKeyBlockSize) {
+       throw new Error("rejecting big keyblock");
+     }
+ 
+-    let tempFFI = new RNPLib.rnp_ffi_t();
+-    if (RNPLib.rnp_ffi_create(tempFFI.address(), "GPG", "GPG")) {
+    let tempFFI = RNPLib.prepare_ffi();
+    if (!tempFFI) {
+       throw new Error("Couldn't initialize librnp.");
+     }
+ 
+     let keyList = null;
+     if (!this.importToFFI(tempFFI, keyBlockStr, pubkey, seckey, permissive)) {
+@@ -1929,12 +1929,12 @@ var RNP = {
+   async mergePublicKeyBlocks(fingerprint, ...keyBlocks) {
+     if (keyBlocks.some(b => b.length > RNP.maxImportKeyBlockSize)) {
+       throw new Error("keyBlock too big");
+     }
+ 
+-    let tempFFI = new RNPLib.rnp_ffi_t();
+-    if (RNPLib.rnp_ffi_create(tempFFI.address(), "GPG", "GPG")) {
+    let tempFFI = RNPLib.prepare_ffi();
+    if (!tempFFI) {
+       throw new Error("Couldn't initialize librnp.");
+     }
+ 
+     const pubkey = true;
+     const seckey = false;
+@@ -2067,12 +2067,12 @@ var RNP = {
+     let result = {};
+     result.exitCode = -1;
+     result.importedKeys = [];
+     result.errorMsg = "";
+ 
+-    let tempFFI = new RNPLib.rnp_ffi_t();
+-    if (RNPLib.rnp_ffi_create(tempFFI.address(), "GPG", "GPG")) {
+    let tempFFI = RNPLib.prepare_ffi();
+    if (!tempFFI) {
+       throw new Error("Couldn't initialize librnp.");
+     }
+ 
+     // TODO: check result
+     if (this.importToFFI(tempFFI, keyBlockStr, pubkey, seckey, permissive)) {
+@@ -3115,12 +3115,12 @@ var RNP = {
+    *
+    */
+   export_pubkey_strip_sigs_uids(expKey, keepUserIDs, out_binary) {
+     let expKeyId = this.getKeyIDFromHandle(expKey);
+ 
+-    let tempFFI = new RNPLib.rnp_ffi_t();
+-    if (RNPLib.rnp_ffi_create(tempFFI.address(), "GPG", "GPG")) {
+    let tempFFI = RNPLib.prepare_ffi();
+    if (!tempFFI) {
+       throw new Error("Couldn't initialize librnp.");
+     }
+ 
+     let exportFlags =
+       RNPLib.RNP_KEY_EXPORT_SUBKEYS | RNPLib.RNP_KEY_EXPORT_PUBLIC;
+@@ -3399,12 +3399,12 @@ var RNP = {
+       ))
+     ) {
+       throw new Error("rnp_output_to_armor failed:" + rv);
+     }
+ 
+-    let tempFFI = new RNPLib.rnp_ffi_t();
+-    if (RNPLib.rnp_ffi_create(tempFFI.address(), "GPG", "GPG")) {
+    let tempFFI = RNPLib.prepare_ffi();
+    if (!tempFFI) {
+       throw new Error("Couldn't initialize librnp.");
+     }
+ 
+     let internalPassword = await OpenPGPMasterpass.retrieveOpenPGPPassword();
+ 
+diff --git a/comm/mail/extensions/openpgp/content/modules/RNPLib.jsm b/mail/extensions/openpgp/content/modules/RNPLib/comm.jsm
+--- a/comm/mail/extensions/openpgp/content/modules/RNPLib.jsm
+++ b/comm/mail/extensions/openpgp/content/modules/RNPLib.jsm
+@@ -13,11 +13,11 @@ XPCOMUtils.defineLazyModuleGetters(this,
+   OpenPGPMasterpass: "chrome://openpgp/content/modules/masterpass.jsm",
+   Services: "resource://gre/modules/Services.jsm",
+   setTimeout: "resource://gre/modules/Timer.jsm",
+ });
+ 
+-const MIN_RNP_VERSION = [0, 16, 0];
+const MIN_RNP_VERSION = [0, 16, 2];
+ 
+ var systemOS = Services.appinfo.OS.toLowerCase();
+ var abi = ctypes.default_abi;
+ 
+ // Open librnp. Determine the path to the chrome directory and look for it
+@@ -149,10 +149,12 @@ function enableRNPLibJS() {
+   // this must be delayed until after "librnp" is initialized
+ 
+   RNPLib = {
+     path: librnpPath,
+ 
+    // Handle to the RNP library and primary key data store.
+    // Kept at null if init fails.
+     ffi: null,
+ 
+     // returns rnp_input_t, destroy using rnp_input_destroy
+     async createInputFromPath(path) {
+       // IOUtils.read always returns an array.
+@@ -265,13 +267,204 @@ function enableRNPLibJS() {
+       const min_version = this.rnp_version_for(...MIN_RNP_VERSION);
+       const this_version = this.rnp_version();
+       return Boolean(this_version >= min_version);
+     },
+ 
+    /**
+     * Prepare an RNP library handle, and in addition set all the
+     * application's preferences for library behavior.
+     *
+     * Other application code should NOT call rnp_ffi_create directly,
+     * but obtain an RNP library handle from this function.
+     */
+    prepare_ffi() {
+      let ffi = new rnp_ffi_t();
+      if (this._rnp_ffi_create(ffi.address(), "GPG", "GPG")) {
+        return null;
+      }
+
+      // Treat MD5 as insecure.
+      if (
+        this.rnp_add_security_rule(
+          ffi,
+          this.RNP_FEATURE_HASH_ALG,
+          this.RNP_ALGNAME_MD5,
+          this.RNP_SECURITY_OVERRIDE,
+          0,
+          this.RNP_SECURITY_INSECURE
+        )
+      ) {
+        return null;
+      }
+
+      // Use RNP's default rule for SHA1 used with data signatures,
+      // and use our override to allow it for key signatures.
+      if (
+        this.rnp_add_security_rule(
+          ffi,
+          this.RNP_FEATURE_HASH_ALG,
+          this.RNP_ALGNAME_SHA1,
+          this.RNP_SECURITY_VERIFY_KEY | this.RNP_SECURITY_OVERRIDE,
+          0,
+          this.RNP_SECURITY_DEFAULT
+        )
+      ) {
+        return null;
+      }
+
+      /*
+      // Security rules API does not yet support PK and SYMM algs.
+      //
+      // If a hash algorithm is already disabled at build time,
+      // and an attempt is made to set a security rule for that
+      // algorithm, then RNP returns a failure.
+      //
+      // Ideally, RNP should allow these calls (regardless of build time
+      // settings) to define an application security rule, that is
+      // independent of the configuration used for building the
+      // RNP library.
+
+      if (
+        this.rnp_add_security_rule(
+          ffi,
+          this.RNP_FEATURE_HASH_ALG,
+          this.RNP_ALGNAME_SM3,
+          this.RNP_SECURITY_OVERRIDE,
+          0,
+          this.RNP_SECURITY_PROHIBITED
+        )
+      ) {
+        return null;
+      }
+
+      if (
+        this.rnp_add_security_rule(
+          ffi,
+          this.RNP_FEATURE_PK_ALG,
+          this.RNP_ALGNAME_SM2,
+          this.RNP_SECURITY_OVERRIDE,
+          0,
+          this.RNP_SECURITY_PROHIBITED
+        )
+      ) {
+        return null;
+      }
+
+      if (
+        this.rnp_add_security_rule(
+          ffi,
+          this.RNP_FEATURE_SYMM_ALG,
+          this.RNP_ALGNAME_SM4,
+          this.RNP_SECURITY_OVERRIDE,
+          0,
+          this.RNP_SECURITY_PROHIBITED
+        )
+      ) {
+        return null;
+      }
+      */
+
+      return ffi;
+    },
+
+    /**
+     * Test the correctness of security rules, in particular, test
+     * if the given hash algorithm is allowed at the given time.
+     *
+     * This is an application consistency test. If the behavior isn't
+     * according to the expectation, the function throws an error.
+     *
+     * @param {string} hashAlg - Test this hash algorithm
+     * @param {time_t} time - Test status at this timestamp
+     * @param {boolean} keySigAllowed - Test if using the hash algorithm
+     *  is allowed for signatures found inside OpenPGP keys.
+     * @param {boolean} dataSigAllowed - Test if using the hash algorithm
+     *  is allowed for signatures on data.
+     */
+    _confirmSecurityRule(hashAlg, time, keySigAllowed, dataSigAllowed) {
+      let level = new ctypes.uint32_t();
+      let flag = new ctypes.uint32_t();
+
+      flag.value = this.RNP_SECURITY_VERIFY_DATA;
+      let testDataSuccess = false;
+      if (
+        !RNPLib.rnp_get_security_rule(
+          this.ffi,
+          this.RNP_FEATURE_HASH_ALG,
+          hashAlg,
+          time,
+          flag.address(),
+          null,
+          level.address()
+        )
+      ) {
+        if (dataSigAllowed) {
+          testDataSuccess = level.value == RNPLib.RNP_SECURITY_DEFAULT;
+        } else {
+          testDataSuccess = level.value < RNPLib.RNP_SECURITY_DEFAULT;
+        }
+      }
+
+      if (!testDataSuccess) {
+        throw new Error("security configuration for data signatures failed");
+      }
+
+      flag.value = this.RNP_SECURITY_VERIFY_KEY;
+      let testKeySuccess = false;
+      if (
+        !RNPLib.rnp_get_security_rule(
+          this.ffi,
+          this.RNP_FEATURE_HASH_ALG,
+          hashAlg,
+          time,
+          flag.address(),
+          null,
+          level.address()
+        )
+      ) {
+        if (keySigAllowed) {
+          testKeySuccess = level.value == RNPLib.RNP_SECURITY_DEFAULT;
+        } else {
+          testKeySuccess = level.value < RNPLib.RNP_SECURITY_DEFAULT;
+        }
+      }
+
+      if (!testKeySuccess) {
+        throw new Error("security configuration for key signatures failed");
+      }
+    },
+
+    /**
+     * Perform tests that the RNP library behaves according to the
+     * defined security rules.
+     * If a problem is found, the function throws an error.
+     */
+    _sanityCheckSecurityRules() {
+      let time_t_now = Math.round(Date.now() / 1000);
+      let ten_years_in_seconds = 10 * 365 * 24 * 60 * 60;
+      let ten_years_future = time_t_now + ten_years_in_seconds;
+
+      this._confirmSecurityRule(this.RNP_ALGNAME_MD5, time_t_now, false, false);
+      this._confirmSecurityRule(
+        this.RNP_ALGNAME_MD5,
+        ten_years_future,
+        false,
+        false
+      );
+
+      this._confirmSecurityRule(this.RNP_ALGNAME_SHA1, time_t_now, true, false);
+      this._confirmSecurityRule(
+        this.RNP_ALGNAME_SHA1,
+        ten_years_future,
+        true,
+        false
+      );
+    },
+
+     async init() {
+-      this.ffi = new rnp_ffi_t();
+-      if (this.rnp_ffi_create(this.ffi.address(), "GPG", "GPG")) {
+      this.ffi = this.prepare_ffi();
+      if (!this.ffi) {
+         throw new Error("Couldn't initialize librnp.");
+       }
+ 
+       this.rnp_ffi_set_log_fd(this.ffi, 2); // stderr
+ 
+@@ -286,10 +479,18 @@ function enableRNPLibJS() {
+         null
+       );
+ 
+       let { pubRingPath, secRingPath } = this.getFilenames();
+ 
+      try {
+        this._sanityCheckSecurityRules();
+      } catch (e) {
+        // Disable all RNP operation
+        this.ffi = null;
+        throw e;
+      }
+
+       await this.loadWithFallback(pubRingPath, this.RNP_LOAD_SAVE_PUBLIC_KEYS);
+       await this.loadWithFallback(secRingPath, this.RNP_LOAD_SAVE_SECRET_KEYS);
+ 
+       let pubnum = new ctypes.size_t();
+       this.rnp_get_public_key_count(this.ffi, pubnum.address());
+@@ -481,10 +682,14 @@ function enableRNPLibJS() {
+      * @param {string} path - The file path to save to.
+      * @param {number} keyRingFlag - RNP_LOAD_SAVE_PUBLIC_KEYS or
+      *   RNP_LOAD_SAVE_SECRET_KEYS.
+      */
+     async saveKeyRing(path, keyRingFlag) {
+      if (!this.ffi) {
+        return;
+      }
+
+       let oldPath = path + ".old";
+ 
+       // Ignore failure, oldPath might not exist yet.
+       await IOUtils.copy(path, oldPath).catch(() => {});
+ 
+@@ -540,10 +745,13 @@ function enableRNPLibJS() {
+         tmpPath: path + ".tmp-new",
+       });
+     },
+ 
+     async saveKeys() {
+      if (!this.ffi) {
+        return;
+      }
+       let { pubRingPath, secRingPath } = this.getFilenames();
+ 
+       let saveThem = async () => {
+         await this.saveKeyRing(pubRingPath, this.RNP_LOAD_SAVE_PUBLIC_KEYS);
+         await this.saveKeyRing(secRingPath, this.RNP_LOAD_SAVE_SECRET_KEYS);
+@@ -600,11 +808,13 @@ function enableRNPLibJS() {
+       abi,
+       ctypes.char.ptr
+     ),
+ 
+     // Get a RNP library handle.
+-    rnp_ffi_create: librnp.declare(
+    // Mark with leading underscore, to clarify that this function
+    // shouldn't be called directly - you should call prepare_ffi().
+    _rnp_ffi_create: librnp.declare(
+       "rnp_ffi_create",
+       abi,
+       rnp_result_t,
+       rnp_ffi_t.ptr,
+       ctypes.char.ptr,
+@@ -1713,10 +1923,22 @@ function enableRNPLibJS() {
+       ctypes.uint32_t.ptr,
+       ctypes.uint64_t.ptr,
+       ctypes.uint32_t.ptr
+     ),
+ 
+    rnp_add_security_rule: librnp.declare(
+      "rnp_add_security_rule",
+      abi,
+      rnp_result_t,
+      rnp_ffi_t,
+      ctypes.char.ptr,
+      ctypes.char.ptr,
+      ctypes.uint32_t,
+      ctypes.uint64_t,
+      ctypes.uint32_t
+    ),
+
+     rnp_result_t,
+     rnp_ffi_t,
+     rnp_password_cb_t,
+     rnp_input_t,
+     rnp_output_t,
+@@ -1748,11 +1970,26 @@ function enableRNPLibJS() {
+ 
+     RNP_KEY_SIGNATURE_NON_SELF_SIG: 4,
+ 
+     RNP_SUCCESS: 0x00000000,
+ 
+    RNP_FEATURE_SYMM_ALG: "symmetric algorithm",
+     RNP_FEATURE_HASH_ALG: "hash algorithm",
+    RNP_FEATURE_PK_ALG: "public key algorithm",
+    RNP_ALGNAME_MD5: "MD5",
+    RNP_ALGNAME_SHA1: "SHA1",
+    RNP_ALGNAME_SM2: "SM2",
+    RNP_ALGNAME_SM3: "SM3",
+    RNP_ALGNAME_SM4: "SM4",
+
+    RNP_SECURITY_OVERRIDE: 1,
+    RNP_SECURITY_VERIFY_KEY: 2,
+    RNP_SECURITY_VERIFY_DATA: 4,
+    RNP_SECURITY_REMOVE_ALL: 65536,
+
+    RNP_SECURITY_PROHIBITED: 0,
+    RNP_SECURITY_INSECURE: 1,
+     RNP_SECURITY_DEFAULT: 2,
+ 
+     /* Common error codes */
+     RNP_ERROR_GENERIC: 0x10000000, // 268435456
+     RNP_ERROR_BAD_FORMAT: 0x10000001, // 268435457
--- a/backport-rnp-0.16.2-to-esr102-m-bug-1791195.patch
+++ b/backport-rnp-0.16.2-to-esr102-m-bug-1791195.patch
@ -0,0 +1,85 @@
+# HG changeset patch
+# User Kai Engert <kaie@kuix.de>
+# Date 1664378971 0
+#      Wed Sep 28 15:29:31 2022 +0000
+# Node ID 98bde42cf14e966da1cdf098e2d0917032c0f327
+# Parent  af0b1f5e4c7710f824c6141103e516ca60bc78aa
+Bug 1791195 - Adjust OpenPGP signature handling for RNP >= 0.16.2. r=mkmelin
+
+Differential Revision: https://phabricator.services.mozilla.com/D158270
+
+diff --git a/comm/mail/extensions/openpgp/content/modules/RNP.jsm b/comm/mail/extensions/openpgp/content/modules/RNP.jsm
+--- a/comm/mail/extensions/openpgp/content/modules/RNP.jsm
+++ b/comm/mail/extensions/openpgp/content/modules/RNP.jsm
+@@ -1150,22 +1150,25 @@ var RNP = {
+ 
+     result.exitCode = RNPLib.rnp_op_verify_execute(verify_op);
+ 
+     let rnpCannotDecrypt = false;
+     let queryAllEncryptionRecipients = false;
+    let stillUndecidedIfSignatureIsBad = false;
+ 
+     let useDecodedData;
+     let processSignature;
+     switch (result.exitCode) {
+       case RNPLib.RNP_SUCCESS:
+         useDecodedData = true;
+         processSignature = true;
+         break;
+       case RNPLib.RNP_ERROR_SIGNATURE_INVALID:
+-        result.statusFlags |= EnigmailConstants.BAD_SIGNATURE;
+        // Either the signing key is unavailable, or the signature is
+        // indeed bad. Must check signature status below.
+        stillUndecidedIfSignatureIsBad = true;
+         useDecodedData = true;
+-        processSignature = false;
+        processSignature = true;
+         break;
+       case RNPLib.RNP_ERROR_SIGNATURE_EXPIRED:
+         useDecodedData = true;
+         processSignature = false;
+         result.statusFlags |= EnigmailConstants.EXPIRED_SIGNATURE;
+@@ -1320,13 +1323,30 @@ var RNP = {
+           options.fromAddr,
+           options.msgDate,
+           verify_op,
+           result
+         );
+
+        if (
+          (result.statusFlags &
+            (EnigmailConstants.GOOD_SIGNATURE |
+              EnigmailConstants.UNCERTAIN_SIGNATURE |
+              EnigmailConstants.EXPIRED_SIGNATURE |
+              EnigmailConstants.BAD_SIGNATURE)) !=
+          0
+        ) {
+          // A decision was already made.
+          stillUndecidedIfSignatureIsBad = false;
+        }
+       }
+     }
+ 
+    if (stillUndecidedIfSignatureIsBad) {
+      // We didn't find more details above, so conclude it's bad.
+      result.statusFlags |= EnigmailConstants.BAD_SIGNATURE;
+    }
+
+     RNPLib.rnp_input_destroy(input_from_memory);
+     RNPLib.rnp_output_destroy(output_to_memory);
+     RNPLib.rnp_op_verify_destroy(verify_op);
+ 
+     if (
+@@ -1458,10 +1478,12 @@ var RNP = {
+     let have_signer_key = false;
+     let use_signer_key = false;
+ 
+     if (query_signer) {
+       if (RNPLib.rnp_op_verify_signature_get_key(sig, signer_key.address())) {
+        // If sig_status isn't RNP_ERROR_KEY_NOT_FOUND then we must
+        // be able to obtain the signer key.
+         throw new Error("rnp_op_verify_signature_get_key");
+       }
+ 
+       have_signer_key = true;
+       use_signer_key = !this.isBadKey(signer_key);
--- a/backport-rnp-use-openssl.patch
+++ b/backport-rnp-use-openssl.patch
@ -0,0 +1,12 @@
+diff -up thunderbird-102.4.0/comm/third_party/rnp/moz.build.rnp-openssl thunderbird-102.4.0/comm/third_party/rnp/moz.build
+--- thunderbird-102.4.0/comm/third_party/rnp/moz.build.rnp-openssl	2022-11-01 14:36:02.940726858 +0100
+++ thunderbird-102.4.0/comm/third_party/rnp/moz.build	2022-11-01 14:36:23.091726917 +0100
+@@ -39,7 +39,7 @@ if CONFIG["CC_TYPE"] == "clang-cl":
+ rnp_defines = {
+     "HAVE_BZLIB_H": True,
+     "HAVE_ZLIB_H": True,
+-    "CRYPTO_BACKEND_BOTAN": True,
+    "CRYPTO_BACKEND_OPENSSL": True,
+     "ENABLE_AEAD": True,
+     "ENABLE_TWOFISH": True,
+     "ENABLE_BRAINPOOL": True,
--- a/build-aarch64-skia.patch
+++ b/build-aarch64-skia.patch
@ -0,0 +1,45 @@
+diff -up firefox-72.0/gfx/skia/skia/include/private/SkHalf.h.aarch64-skia firefox-72.0/gfx/skia/skia/include/private/SkHalf.h
+--- firefox-72.0/gfx/skia/skia/include/private/SkHalf.h.aarch64-skia	2020-01-02 22:33:02.000000000 +0100
+++ firefox-72.0/gfx/skia/skia/include/private/SkHalf.h	2020-01-03 09:00:37.537296105 +0100
+@@ -40,7 +40,7 @@ static inline Sk4h SkFloatToHalf_finite_
+ 
+ static inline Sk4f SkHalfToFloat_finite_ftz(uint64_t rgba) {
+     Sk4h hs = Sk4h::Load(&rgba);
+-#if !defined(SKNX_NO_SIMD) && defined(SK_CPU_ARM64)
+#if 0 // !defined(SKNX_NO_SIMD) && defined(SK_CPU_ARM64)
+     float32x4_t fs;
+     asm ("fcvtl %[fs].4s, %[hs].4h   \n"   // vcvt_f32_f16(...)
+         : [fs] "=w" (fs)                   // =w: write-only NEON register
+@@ -62,7 +62,7 @@ static inline Sk4f SkHalfToFloat_finite_
+ }
+ 
+ static inline Sk4h SkFloatToHalf_finite_ftz(const Sk4f& fs) {
+-#if !defined(SKNX_NO_SIMD) && defined(SK_CPU_ARM64)
+#if 0 // !defined(SKNX_NO_SIMD) && defined(SK_CPU_ARM64)
+     float32x4_t vec = fs.fVec;
+     asm ("fcvtn %[vec].4h, %[vec].4s  \n"   // vcvt_f16_f32(vec)
+         : [vec] "+w" (vec));                // +w: read-write NEON register
+diff -up firefox-72.0/gfx/skia/skia/src/opts/SkRasterPipeline_opts.h.aarch64-skia firefox-72.0/gfx/skia/skia/src/opts/SkRasterPipeline_opts.h
+--- firefox-72.0/gfx/skia/skia/src/opts/SkRasterPipeline_opts.h.aarch64-skia	2020-01-03 09:00:37.538296107 +0100
+++ firefox-72.0/gfx/skia/skia/src/opts/SkRasterPipeline_opts.h	2020-01-03 10:11:41.259219508 +0100
+@@ -1087,7 +1087,7 @@ SI F from_half(U16 h) {
+ }
+ 
+ SI U16 to_half(F f) {
+-#if defined(JUMPER_IS_NEON) && defined(SK_CPU_ARM64) \
+#if 0 //defined(JUMPER_IS_NEON) && defined(SK_CPU_ARM64) \
+     && !defined(SK_BUILD_FOR_GOOGLE3)  // Temporary workaround for some Google3 builds.
+     return vcvt_f16_f32(f);
+ 
+diff -up firefox-72.0/gfx/skia/skia/third_party/skcms/src/Transform_inl.h.aarch64-skia firefox-72.0/gfx/skia/skia/third_party/skcms/src/Transform_inl.h
+--- firefox-72.0/gfx/skia/skia/third_party/skcms/src/Transform_inl.h.aarch64-skia	2020-01-03 09:00:37.538296107 +0100
+++ firefox-72.0/gfx/skia/skia/third_party/skcms/src/Transform_inl.h	2020-01-03 10:11:53.513250979 +0100
+@@ -183,8 +183,6 @@ SI F F_from_Half(U16 half) {
+ SI U16 Half_from_F(F f) {
+ #if defined(USING_NEON_FP16)
+     return bit_pun<U16>(f);
+-#elif defined(USING_NEON_F16C)
+-    return (U16)vcvt_f16_f32(f);
+ #elif defined(USING_AVX512F)
+     return (U16)_mm512_cvtps_ph((__m512 )f, _MM_FROUND_CUR_DIRECTION );
+ #elif defined(USING_AVX_F16C)
--- a/build-arm-libaom.patch
+++ b/build-arm-libaom.patch
@ -0,0 +1,12 @@
+diff -up firefox-73.0/media/libaom/moz.build.old firefox-73.0/media/libaom/moz.build
+--- firefox-73.0/media/libaom/moz.build.old	2020-02-07 23:13:28.000000000 +0200
+++ firefox-73.0/media/libaom/moz.build	2020-02-17 10:30:08.509805092 +0200
+@@ -55,7 +55,7 @@ elif CONFIG['CPU_ARCH'] == 'arm':
+ 
+     for f in SOURCES:
+         if f.endswith('neon.c'):
+-            SOURCES[f].flags += CONFIG['VPX_ASFLAGS']
+            SOURCES[f].flags += CONFIG['NEON_FLAGS']
+ 
+     if CONFIG['OS_TARGET'] == 'Android':
+         # For cpu-features.h
--- a/build-arm-libopus.patch
+++ b/build-arm-libopus.patch
@ -0,0 +1,12 @@
+diff -up firefox-66.0/media/libopus/silk/arm/arm_silk_map.c.old firefox-66.0/media/libopus/silk/arm/arm_silk_map.c
+--- firefox-66.0/media/libopus/silk/arm/arm_silk_map.c.old	2019-03-12 21:07:35.356677522 +0100
+++ firefox-66.0/media/libopus/silk/arm/arm_silk_map.c	2019-03-12 21:07:42.937693394 +0100
+@@ -28,7 +28,7 @@ POSSIBILITY OF SUCH DAMAGE.
+ # include "config.h"
+ #endif
+ 
+-#include "main_FIX.h"
+#include "fixed/main_FIX.h"
+ #include "NSQ.h"
+ #include "SigProc_FIX.h"
+ 
--- a/build-ascii-decode-fail-rhel7.patch
+++ b/build-ascii-decode-fail-rhel7.patch
@ -0,0 +1,45 @@
+diff -up firefox-102.0/third_party/python/PyYAML/lib3/yaml/reader.py.build-ascii-decode-fail-rhel7 firefox-102.0/third_party/python/PyYAML/lib3/yaml/reader.py
+--- firefox-102.0/third_party/python/PyYAML/lib3/yaml/reader.py.build-ascii-decode-fail-rhel7	2022-06-23 09:11:39.000000000 +0200
+++ firefox-102.0/third_party/python/PyYAML/lib3/yaml/reader.py	2022-08-16 13:24:31.697757209 +0200
+@@ -73,6 +73,8 @@ class Reader(object):
+             self.name = "<unicode string>"
+             self.check_printable(stream)
+             self.buffer = stream+'\0'
+            #self.encoding = 'utf-8'
+            #self.raw_decode = codecs.utf_8_decode
+         elif isinstance(stream, bytes):
+             self.name = "<byte string>"
+             self.raw_buffer = stream
+@@ -83,6 +85,11 @@ class Reader(object):
+             self.eof = False
+             self.raw_buffer = None
+             self.determine_encoding()
+        print("DEBUG_OUTPUT:")
+        print(self.name)
+        print(self.encoding)
+        print(self.stream)
+        #print(self.stream.read())
+ 
+     def peek(self, index=0):
+         try:
+diff -up firefox-102.0/toolkit/components/nimbus/generate/generate_feature_manifest.py.build-ascii-decode-fail-rhel7 firefox-102.0/toolkit/components/nimbus/generate/generate_feature_manifest.py
+--- firefox-102.0/toolkit/components/nimbus/generate/generate_feature_manifest.py.build-ascii-decode-fail-rhel7	2022-08-16 14:16:33.432529817 +0200
+++ firefox-102.0/toolkit/components/nimbus/generate/generate_feature_manifest.py	2022-08-17 08:01:38.175878171 +0200
+@@ -37,7 +37,7 @@ def generate_feature_manifest(fd, input_
+     write_fm_js_headers(fd)
+     nimbus_dir_path = pathlib.Path(input_file).parent
+     try:
+-        with open(input_file, "r") as yaml_input:
+        with open(input_file, "r", encoding="utf-8") as yaml_input:
+             data = yaml.safe_load(yaml_input)
+             with pathlib.Path(nimbus_dir_path, FEATURE_MANIFEST_SCHEMA).open() as f:
+                 schema = json.load(f)
+@@ -92,7 +92,7 @@ def generate_platform_feature_manifest(f
+         )
+ 
+     try:
+-        with open(input_file, "r") as yaml_input:
+        with open(input_file, "r", encoding="utf-8") as yaml_input:
+             data = yaml.safe_load(yaml_input)
+             fd.write(file_structure(data))
+     except (IOError) as e:
--- a/build-big-endian-errors.patch
+++ b/build-big-endian-errors.patch
@ -0,0 +1,57 @@
+diff -up firefox-102.0/third_party/libwebrtc/common_audio/wav_file.cc.big-endian-errors firefox-102.0/third_party/libwebrtc/common_audio/wav_file.cc
+--- firefox-102.0/third_party/libwebrtc/common_audio/wav_file.cc.big-endian-errors	2022-08-17 13:19:53.056891028 +0200
+++ firefox-102.0/third_party/libwebrtc/common_audio/wav_file.cc	2022-08-17 13:19:57.251879556 +0200
+@@ -89,9 +89,6 @@ void WavReader::Reset() {
+ 
+ size_t WavReader::ReadSamples(const size_t num_samples,
+                               int16_t* const samples) {
+-#ifndef WEBRTC_ARCH_LITTLE_ENDIAN
+-#error "Need to convert samples to big-endian when reading from WAV file"
+-#endif
+ 
+   size_t num_samples_left_to_read = num_samples;
+   size_t next_chunk_start = 0;
+@@ -129,9 +126,6 @@ size_t WavReader::ReadSamples(const size
+ }
+ 
+ size_t WavReader::ReadSamples(const size_t num_samples, float* const samples) {
+-#ifndef WEBRTC_ARCH_LITTLE_ENDIAN
+-#error "Need to convert samples to big-endian when reading from WAV file"
+-#endif
+ 
+   size_t num_samples_left_to_read = num_samples;
+   size_t next_chunk_start = 0;
+@@ -213,9 +207,6 @@ WavWriter::WavWriter(FileWrapper file,
+ }
+ 
+ void WavWriter::WriteSamples(const int16_t* samples, size_t num_samples) {
+-#ifndef WEBRTC_ARCH_LITTLE_ENDIAN
+-#error "Need to convert samples to little-endian when writing to WAV file"
+-#endif
+ 
+   for (size_t i = 0; i < num_samples; i += kMaxChunksize) {
+     const size_t num_remaining_samples = num_samples - i;
+@@ -243,9 +234,6 @@ void WavWriter::WriteSamples(const int16
+ }
+ 
+ void WavWriter::WriteSamples(const float* samples, size_t num_samples) {
+-#ifndef WEBRTC_ARCH_LITTLE_ENDIAN
+-#error "Need to convert samples to little-endian when writing to WAV file"
+-#endif
+ 
+   for (size_t i = 0; i < num_samples; i += kMaxChunksize) {
+     const size_t num_remaining_samples = num_samples - i;
+diff -up firefox-102.0/third_party/libwebrtc/common_audio/wav_header.cc.big-endian-errors firefox-102.0/third_party/libwebrtc/common_audio/wav_header.cc
+--- firefox-102.0/third_party/libwebrtc/common_audio/wav_header.cc.big-endian-errors	2022-08-17 13:18:04.688187393 +0200
+++ firefox-102.0/third_party/libwebrtc/common_audio/wav_header.cc	2022-08-17 13:18:22.451138816 +0200
+@@ -26,10 +26,6 @@
+ namespace webrtc {
+ namespace {
+ 
+-#ifndef WEBRTC_ARCH_LITTLE_ENDIAN
+-#error "Code not working properly for big endian platforms."
+-#endif
+-
+ #pragma pack(2)
+ struct ChunkHeader {
+   uint32_t ID;
--- a/build-debuginfo-fix.patch
+++ b/build-debuginfo-fix.patch
@ -1,24 +0,0 @@
-diff -up firefox-91.0.1/third_party/libwebrtc/webrtc/modules/audio_processing/utility/ooura_fft.cc.debuginfo-fix firefox-91.0.1/third_party/libwebrtc/webrtc/modules/audio_processing/utility/ooura_fft.cc
--- firefox-91.0.1/third_party/libwebrtc/webrtc/modules/audio_processing/utility/ooura_fft.cc.debuginfo-fix	2021-09-01 11:11:46.738285751 +0200
-+++ firefox-91.0.1/third_party/libwebrtc/webrtc/modules/audio_processing/utility/ooura_fft.cc	2021-09-01 11:11:56.127319530 +0200
-@@ -21,7 +21,7 @@
-  *  be found in the AUTHORS file in the root of the source tree.
-  */
- 
-#include "modules/audio_processing//utility/ooura_fft.h"
-+#include "modules/audio_processing/utility/ooura_fft.h"
- 
- #include <math.h>
- 
-diff -up firefox-91.0.1/third_party/libwebrtc/webrtc/modules/audio_processing/utility/ooura_fft_sse2.cc.debuginfo-fix firefox-91.0.1/third_party/libwebrtc/webrtc/modules/audio_processing/utility/ooura_fft_sse2.cc
--- firefox-91.0.1/third_party/libwebrtc/webrtc/modules/audio_processing/utility/ooura_fft_sse2.cc.debuginfo-fix	2021-09-01 11:12:26.513428847 +0200
-+++ firefox-91.0.1/third_party/libwebrtc/webrtc/modules/audio_processing/utility/ooura_fft_sse2.cc	2021-09-01 11:12:32.117449009 +0200
-@@ -8,7 +8,7 @@
-  *  be found in the AUTHORS file in the root of the source tree.
-  */
- 
-#include "modules/audio_processing//utility/ooura_fft.h"
-+#include "modules/audio_processing/utility/ooura_fft.h"
- 
- #include <emmintrin.h>
- 
--- a/build-disable-elfhack.patch
+++ b/build-disable-elfhack.patch
@ -0,0 +1,12 @@
+diff -up firefox-97.0/toolkit/moz.configure.disable-elfhack firefox-97.0/toolkit/moz.configure
+--- firefox-97.0/toolkit/moz.configure.disable-elfhack	2022-02-08 09:58:47.518047952 +0100
+++ firefox-97.0/toolkit/moz.configure	2022-02-08 10:17:49.552945956 +0100
+@@ -1273,7 +1273,7 @@ with only_when("--enable-compile-environ
+             help="{Enable|Disable} elf hacks",
+         )
+ 
+-        set_config("USE_ELF_HACK", depends_if("--enable-elf-hack")(lambda _: True))
+        set_config("USE_ELF_HACK", depends_if("--enable-elf-hack")(lambda _: False))
+ 
+ 
+ @depends(build_environment)
--- a/build-mozconfig-fix.patch
+++ b/build-mozconfig-fix.patch
@ -1,12 +0,0 @@
-diff -up mozilla-release-c61f5f5ead48c78a80c80db5c489bdc7cfaf8175/python/mozbuild/mozbuild/mozconfig.py.mozconfig-fix mozilla-release-c61f5f5ead48c78a80c80db5c489bdc7cfaf8175/python/mozbuild/mozbuild/mozconfig.py
--- mozilla-release-c61f5f5ead48c78a80c80db5c489bdc7cfaf8175/python/mozbuild/mozbuild/mozconfig.py.mozconfig-fix	2018-03-13 17:22:19.018466884 +0100
-+++ mozilla-release-c61f5f5ead48c78a80c80db5c489bdc7cfaf8175/python/mozbuild/mozbuild/mozconfig.py	2018-03-13 17:23:57.379559640 +0100
-@@ -446,7 +446,7 @@ class MozconfigLoader(object):
-                             value = value[1:]
- 
-                         # Lines with a quote not ending in a quote are multi-line.
-                        if has_quote and not value.endswith("'"):
-+                        if has_quote and not value.endswith(("'", ";")):
-                             in_variable = name
-                             current.append(value)
-                             continue
--- a/build-nss-version.patch
+++ b/build-nss-version.patch
@ -1,24 +0,0 @@
-diff -up firefox-91.0.1/build/moz.configure/nspr.configure.nss-nspr-downgrade firefox-91.0.1/build/moz.configure/nspr.configure
--- firefox-91.0.1/build/moz.configure/nspr.configure.nss-nspr-downgrade	2021-08-25 13:17:26.265307060 +0200
-+++ firefox-91.0.1/build/moz.configure/nspr.configure	2021-08-25 13:17:28.161313632 +0200
-@@ -50,7 +50,7 @@ set_define("JS_WITHOUT_NSPR", True, when
- def nspr_minver(js_standalone):
-     if js_standalone:
-         return "nspr >= 4.10"
-    return "nspr >= 4.32"
-+    return "nspr >= 4.31"
- 
- 
- nspr_pkg = pkg_check_modules("NSPR", nspr_minver, when="--with-system-nspr")
-diff -up firefox-91.0.1/build/moz.configure/nss.configure.nss-nspr-downgrade firefox-91.0.1/build/moz.configure/nss.configure
--- firefox-91.0.1/build/moz.configure/nss.configure.nss-nspr-downgrade	2021-08-25 13:17:45.049372175 +0200
-+++ firefox-91.0.1/build/moz.configure/nss.configure	2021-08-25 13:17:37.763346918 +0200
-@@ -9,7 +9,7 @@ option("--with-system-nss", help="Use sy
- imply_option("--with-system-nspr", True, when="--with-system-nss")
- 
- nss_pkg = pkg_check_modules(
-    "NSS", "nss >= 3.68", when="--with-system-nss", config=False
-+    "NSS", "nss >= 3.67", when="--with-system-nss", config=False
- )
- 
- set_config("MOZ_SYSTEM_NSS", True, when="--with-system-nss")
--- a/build-ppc64le-inline.patch
+++ b/build-ppc64le-inline.patch
@ -1,27 +0,0 @@
-diff -up firefox-68.1.0/js/xpconnect/src/XPCWrappedNative.cpp.ppc64le-inline firefox-68.1.0/js/xpconnect/src/XPCWrappedNative.cpp
--- firefox-68.1.0/js/xpconnect/src/XPCWrappedNative.cpp.ppc64le-inline	2019-08-26 18:52:28.000000000 +0200
-+++ firefox-68.1.0/js/xpconnect/src/XPCWrappedNative.cpp	2019-08-29 08:49:57.695687874 +0200
-@@ -1092,7 +1092,11 @@ class MOZ_STACK_CLASS CallMethodHelper f
-   MOZ_ALWAYS_INLINE bool GetOutParamSource(uint8_t paramIndex,
-                                            MutableHandleValue srcp) const;
- 
-+#if (__GNUC__ && __linux__ && __PPC64__ && _LITTLE_ENDIAN)
-+  bool GatherAndConvertResults();
-+#else
-   MOZ_ALWAYS_INLINE bool GatherAndConvertResults();
-+#endif
- 
-   MOZ_ALWAYS_INLINE bool QueryInterfaceFastPath();
- 
-@@ -1139,7 +1143,11 @@ class MOZ_STACK_CLASS CallMethodHelper f
- 
-   ~CallMethodHelper();
- 
-+#if (__GNUC__ && __linux__ && __PPC64__ && _LITTLE_ENDIAN)
-+  bool Call();
-+#else
-   MOZ_ALWAYS_INLINE bool Call();
-+#endif
- 
-   // Trace implementation so we can put our CallMethodHelper in a Rooted<T>.
-   void trace(JSTracer* aTrc);
--- a/build-remove-dav1d-from-wayland-dep.patch
+++ b/build-remove-dav1d-from-wayland-dep.patch
@ -0,0 +1,49 @@
+diff -up firefox-102.0/media/ffvpx/config_common.h.dav1d-remove firefox-102.0/media/ffvpx/config_common.h
+--- firefox-102.0/media/ffvpx/config_common.h.dav1d-remove	2022-08-08 12:48:33.218128539 +0200
+++ firefox-102.0/media/ffvpx/config_common.h	2022-08-08 12:48:52.986003374 +0200
+@@ -24,15 +24,11 @@
+ #undef CONFIG_VP8_VAAPI_HWACCEL
+ #undef CONFIG_VP9_VAAPI_HWACCEL
+ #undef CONFIG_AV1_VAAPI_HWACCEL
+-#undef CONFIG_LIBDAV1D
+-#undef CONFIG_AV1_DECODER
+ #define CONFIG_VAAPI 1
+ #define CONFIG_VAAPI_1 1
+ #define CONFIG_VP8_VAAPI_HWACCEL 1
+ #define CONFIG_VP9_VAAPI_HWACCEL 1
+ #define CONFIG_AV1_VAAPI_HWACCEL 1
+-#define CONFIG_LIBDAV1D 1
+-#define CONFIG_AV1_DECODER 1
+ #endif
+ 
+ #endif
+diff -up firefox-102.0/media/ffvpx/libavcodec/moz.build.dav1d-remove firefox-102.0/media/ffvpx/libavcodec/moz.build
+--- firefox-102.0/media/ffvpx/libavcodec/moz.build.dav1d-remove	2022-08-08 12:44:24.098710736 +0200
+++ firefox-102.0/media/ffvpx/libavcodec/moz.build	2022-08-08 12:46:42.635828719 +0200
+@@ -104,17 +104,23 @@ if not CONFIG['MOZ_FFVPX_AUDIOONLY']:
+     ]
+     if CONFIG['MOZ_WAYLAND']:
+         LOCAL_INCLUDES += ['/media/mozva']
+        if CONFIG['MOZ_DAV1D_ASM']:
+            SOURCES += [
+                'libdav1d.c',
+            ]
+         SOURCES += [
+             'atsc_a53.c',
+-            'libdav1d.c',
+             'vaapi_av1.c',
+             'vaapi_decode.c',
+             'vaapi_vp8.c',
+             'vaapi_vp9.c',
+         ]
+        if CONFIG['MOZ_DAV1D_ASM']:
+            USE_LIBS += [
+                'dav1d',
+                'media_libdav1d_asm',
+            ]
+         USE_LIBS += [
+-          'dav1d',
+-          'media_libdav1d_asm',
+           'mozva'
+         ]
+ 
--- a/build-rhel7-lower-node-min-version.patch
+++ b/build-rhel7-lower-node-min-version.patch
@ -0,0 +1,11 @@
+--- thunderbird-102.4.0/python/mozbuild/mozbuild/nodeutil.py.build-rhel7-lower-node-min-version	2022-10-14 21:42:10.000000000 +0200
+++ thunderbird-102.4.0/python/mozbuild/mozbuild/nodeutil.py	2022-10-17 18:49:44.490667820 +0200
+@@ -13,7 +13,7 @@ from mozboot.util import get_tools_dir
+ from mozfile import which
+ from six import PY3
+ 
+-NODE_MIN_VERSION = StrictVersion("10.24.1")
+NODE_MIN_VERSION = StrictVersion("10.24.0")
+ NPM_MIN_VERSION = StrictVersion("6.14.12")
+ 
+ 
--- a/disable-openh264-download.patch
+++ b/disable-openh264-download.patch
@ -0,0 +1,39 @@
+diff -up firefox-81.0/toolkit/modules/GMPInstallManager.jsm.old firefox-81.0/toolkit/modules/GMPInstallManager.jsm
+--- firefox-81.0/toolkit/modules/GMPInstallManager.jsm.old	2020-09-25 10:39:04.769458703 +0200
+++ firefox-81.0/toolkit/modules/GMPInstallManager.jsm	2020-09-25 10:39:22.038504747 +0200
+@@ -54,10 +54,6 @@ function getScopedLogger(prefix) {
+ 
+ const LOCAL_GMP_SOURCES = [
+   {
+-    id: "gmp-gmpopenh264",
+-    src: "chrome://global/content/gmp-sources/openh264.json",
+-  },
+-  {
+     id: "gmp-widevinecdm",
+     src: "chrome://global/content/gmp-sources/widevinecdm.json",
+   },
+diff --git a/toolkit/content/jar.mn b/toolkit/content/jar.mn
+--- a/toolkit/content/jar.mn
+++ b/toolkit/content/jar.mn
+@@ -108,7 +108,6 @@ toolkit.jar:
+ #ifdef XP_MACOSX
+    content/global/macWindowMenu.js
+ #endif
+-   content/global/gmp-sources/openh264.json    (gmp-sources/openh264.json)
+    content/global/gmp-sources/widevinecdm.json (gmp-sources/widevinecdm.json)
+ 
+ # Third party files
+diff --git a/toolkit/modules/GMPInstallManager.jsm b/toolkit/modules/GMPInstallManager.jsm
+--- a/toolkit/modules/GMPInstallManager.jsm
+++ b/toolkit/modules/GMPInstallManager.jsm
+@@ -238,6 +234,9 @@ GMPInstallManager.prototype = {
+    *                 downloaderr, verifyerr or previouserrorencountered
+    */
+   installAddon(gmpAddon) {
+    if (gmpAddon.isOpenH264) {
+      return Promise.reject({ type: "disabled" });
+    }
+     if (this._deferred) {
+       let log = getScopedLogger("GMPInstallManager.installAddon");
+       log.error("previous error encountered");
+
--- a/disable-openpgp-in-thunderbird.patch
+++ b/disable-openpgp-in-thunderbird.patch
@ -1,28 +1,12 @@
-diff --git a/comm/mail/extensions/openpgp/content/BondOpenPGP.jsm b/comm/mail/extensions/openpgp/content/BondOpenPGP.jsm
--- a/comm/mail/extensions/openpgp/content/BondOpenPGP.jsm
-+++ b/comm/mail/extensions/openpgp/content/BondOpenPGP.jsm
-@@ -53,20 +53,23 @@ var BondOpenPGP = {
- 
-   // if null, we haven't yet read the pref
-   // if true, pref was enabled and we already triggered init
-   _isEnabled: null,
- 
+diff -up thunderbird-102.2.1/comm/mail/extensions/openpgp/content/BondOpenPGP.jsm.disable-openpgp-in-thunderbird thunderbird-102.2.1/comm/mail/extensions/openpgp/content/BondOpenPGP.jsm
+--- thunderbird-102.2.1/comm/mail/extensions/openpgp/content/BondOpenPGP.jsm.disable-openpgp-in-thunderbird	2022-09-12 14:33:54.995339932 +0200
+++ thunderbird-102.2.1/comm/mail/extensions/openpgp/content/BondOpenPGP.jsm	2022-09-12 14:39:26.784999636 +0200
+@@ -51,6 +51,8 @@ var BondOpenPGP = {
   _alreadyTriedInit: false, // if already true, we will not try again
 
-   setIsEnabledFromPref() {
-    this._isEnabled = Services.prefs.getBoolPref("mail.openpgp.enable");
-+    return false;
-+    //this._isEnabled = Services.prefs.getBoolPref("mail.openpgp.enable");
-   },
- 
   async init() {
+    // We don't have support for the opengpg in rhel ATM.
 +    return;
-+
-     if (!MailConstants.MOZ_OPENPGP) {
+     if (this._alreadyTriedInit) {
+       // We have previously attempted to init, don't try again.
       return;
-     }
- 
-     // We never shut off after pref change, disabling requires restart.
-     // If null, it means we're here for the first time, read the pref.
-     // If false, it could mean the pref was now turned on at runtime.
-     // In both scenarios, null and false, we reread the pref to check
--- a/expat-CVE-2022-25235.patch
+++ b/expat-CVE-2022-25235.patch
@ -1,49 +0,0 @@
-diff -up thunderbird-91.7.0/parser/expat/lib/xmltok.c.expat-CVE-2022-25235 thunderbird-91.7.0/parser/expat/lib/xmltok.c
--- thunderbird-91.7.0/parser/expat/lib/xmltok.c.expat-CVE-2022-25235	2022-03-02 17:57:38.364361168 +0100
-+++ thunderbird-91.7.0/parser/expat/lib/xmltok.c	2022-03-02 17:58:22.235512399 +0100
-@@ -65,13 +65,6 @@
-                       + ((((byte)[2]) >> 5) & 1)] \
-          & (1u << (((byte)[2]) & 0x1F)))
- 
-#define UTF8_GET_NAMING(pages, p, n) \
-  ((n) == 2 \
-  ? UTF8_GET_NAMING2(pages, (const unsigned char *)(p)) \
-  : ((n) == 3 \
-     ? UTF8_GET_NAMING3(pages, (const unsigned char *)(p)) \
-     : 0))
-
- /* Detection of invalid UTF-8 sequences is based on Table 3.1B
-    of Unicode 3.2: http://www.unicode.org/unicode/reports/tr28/
-    with the additional restriction of not allowing the Unicode
-diff -up thunderbird-91.7.0/parser/expat/lib/xmltok_impl.c.expat-CVE-2022-25235 thunderbird-91.7.0/parser/expat/lib/xmltok_impl.c
--- thunderbird-91.7.0/parser/expat/lib/xmltok_impl.c.expat-CVE-2022-25235	2022-03-02 17:57:38.365361172 +0100
-+++ thunderbird-91.7.0/parser/expat/lib/xmltok_impl.c	2022-03-02 18:04:51.240853247 +0100
-@@ -34,7 +34,7 @@
-    case BT_LEAD ## n: \
-      if (end - ptr < n) \
-        return XML_TOK_PARTIAL_CHAR; \
-     if (!IS_NAME_CHAR(enc, ptr, n)) { \
-+     if (IS_INVALID_CHAR(enc, ptr, n) || ! IS_NAME_CHAR(enc, ptr, n)) { \
-        *nextTokPtr = ptr; \
-        return XML_TOK_INVALID; \
-      } \
-@@ -62,7 +62,7 @@
-    case BT_LEAD ## n: \
-      if (end - ptr < n) \
-        return XML_TOK_PARTIAL_CHAR; \
-     if (!IS_NMSTRT_CHAR(enc, ptr, n)) { \
-+     if (IS_INVALID_CHAR(enc, ptr, n) || ! IS_NMSTRT_CHAR(enc, ptr, n)) { \
-        *nextTokPtr = ptr; \
-        return XML_TOK_INVALID; \
-      } \
-@@ -1090,6 +1090,10 @@ PREFIX(prologTok)(const ENCODING *enc, c
-   case BT_LEAD ## n: \
-     if (end - ptr < n) \
-       return XML_TOK_PARTIAL_CHAR; \
-+    if (IS_INVALID_CHAR(enc, ptr, n)) {                                        \
-+      *nextTokPtr = ptr;                                                       \
-+      return XML_TOK_INVALID;                                                  \
-+    }                                                                          \
-     if (IS_NMSTRT_CHAR(enc, ptr, n)) { \
-       ptr += n; \
-       tok = XML_TOK_NAME; \
--- a/expat-CVE-2022-25236.patch
+++ b/expat-CVE-2022-25236.patch
@ -1,40 +0,0 @@
-diff -up thunderbird-91.7.0/parser/expat/lib/xmlparse.c.expat-CVE-2022-25236 thunderbird-91.7.0/parser/expat/lib/xmlparse.c
--- thunderbird-91.7.0/parser/expat/lib/xmlparse.c.expat-CVE-2022-25236	2022-03-02 18:08:40.085642028 +0100
-+++ thunderbird-91.7.0/parser/expat/lib/xmlparse.c	2022-03-02 18:13:31.838667958 +0100
-@@ -700,8 +700,7 @@ XML_ParserCreate(const XML_Char *encodin
- XML_Parser XMLCALL
- XML_ParserCreateNS(const XML_Char *encodingName, XML_Char nsSep)
- {
-  XML_Char tmp[2];
-  *tmp = nsSep;
-+  XML_Char tmp[2] = {nsSep, 0};
-   return XML_ParserCreate_MM(encodingName, NULL, tmp);
- }
- #endif
-@@ -1276,8 +1275,7 @@ XML_ExternalEntityParserCreate(XML_Parse
-      would be otherwise.
-   */
-   if (ns) {
-    XML_Char tmp[2];
-    *tmp = namespaceSeparator;
-+    XML_Char tmp[2] = {parser->m_namespaceSeparator, 0};
-     parser = parserCreate(encodingName, &parser->m_mem, tmp, newDtd);
-   }
-   else {
-@@ -3667,6 +3665,16 @@ addBinding(XML_Parser parser, PREFIX *pr
-     if (!mustBeXML && isXMLNS
-         && (len > xmlnsLen || uri[len] != xmlnsNamespace[len]))
-       isXMLNS = XML_FALSE;
-+    // NOTE: While Expat does not validate namespace URIs against RFC 3986,
-+    //       we have to at least make sure that the XML processor on top of
-+    //       Expat (that is splitting tag names by namespace separator into
-+    //       2- or 3-tuples (uri-local or uri-local-prefix)) cannot be confused
-+    //       by an attacker putting additional namespace separator characters
-+    //       into namespace declarations.  That would be ambiguous and not to
-+    //       be expected.
-+    if (parser->m_ns && (uri[len] == parser->m_namespaceSeparator)) {
-+      return XML_ERROR_SYNTAX;
-+    }
-   }
-   isXML = isXML && len == xmlLen;
-   isXMLNS = isXMLNS && len == xmlnsLen;
--- a/expat-CVE-2022-25315.patch
+++ b/expat-CVE-2022-25315.patch
@ -1,24 +0,0 @@
-diff -up thunderbird-91.7.0/parser/expat/lib/xmlparse.c.expat-CVE-2022-25315 thunderbird-91.7.0/parser/expat/lib/xmlparse.c
--- thunderbird-91.7.0/parser/expat/lib/xmlparse.c.expat-CVE-2022-25315	2022-03-02 18:17:50.966583254 +0100
-+++ thunderbird-91.7.0/parser/expat/lib/xmlparse.c	2022-03-02 18:19:27.636924735 +0100
-@@ -2479,6 +2479,7 @@ storeRawNames(XML_Parser parser)
-   while (tag) {
-     int bufSize;
-     int nameLen = sizeof(XML_Char) * (tag->name.strLen + 1);
-+    size_t rawNameLen;
-     char *rawNameBuf = tag->buf + nameLen;
-     /* Stop if already stored.  Since tagStack is a stack, we can stop
-        at the first entry that has already been copied; everything
-@@ -2490,7 +2491,11 @@ storeRawNames(XML_Parser parser)
-     /* For re-use purposes we need to ensure that the
-        size of tag->buf is a multiple of sizeof(XML_Char).
-     */
-    bufSize = nameLen + ROUND_UP(tag->rawNameLength, sizeof(XML_Char));
-+    rawNameLen = ROUND_UP(tag->rawNameLength, sizeof(XML_Char));
-+    /* Detect and prevent integer overflow. */
-+    if (rawNameLen > (size_t)INT_MAX - nameLen)
-+      return XML_FALSE;
-+    bufSize = nameLen + (int)rawNameLen;
-     if (bufSize > tag->bufEnd - tag->buf) {
-       char *temp = (char *)REALLOC(tag->buf, bufSize);
-       if (temp == NULL)
--- a/fedora-shebang-build.patch
+++ b/fedora-shebang-build.patch
@ -0,0 +1,9 @@
+diff -up firefox-73.0/build/unix/run-mozilla.sh.old firefox-73.0/build/unix/run-mozilla.sh
+--- firefox-73.0/build/unix/run-mozilla.sh.old	2020-02-12 09:58:00.150895904 +0100
+++ firefox-73.0/build/unix/run-mozilla.sh	2020-02-12 09:58:06.505860696 +0100
+@@ -1,4 +1,4 @@
+-#!/bin/sh
+#!/usr/bin/sh
+ #
+ # This Source Code Form is subject to the terms of the Mozilla Public
+ # License, v. 2.0. If a copy of the MPL was not distributed with this
--- a/firefox-gcc-build.patch
+++ b/firefox-gcc-build.patch
@ -0,0 +1,38 @@
+--- firefox-80.0.1/toolkit/crashreporter/google-breakpad/src/third_party/lss/linux_syscall_support.h	2020-08-31 10:04:19.000000000 -0400
+++ firefox-80.0.1/toolkit/crashreporter/google-breakpad/src/third_party/lss/linux_syscall_support.h	2020-09-12 07:24:35.298931628 -0400
+@@ -1962,7 +1962,7 @@ struct kernel_statfs {
+                            LSS_ENTRYPOINT                                     \
+                            "pop %%ebx"                                        \
+                            args                                               \
+-                           : "esp", "memory");                                \
+                           : "memory");                                       \
+       LSS_RETURN(type,__res)
+     #undef  _syscall0
+     #define _syscall0(type,name)                                              \
+@@ -2019,7 +2019,7 @@ struct kernel_statfs {
+                              : "i" (__NR_##name), "ri" ((long)(arg1)),        \
+                                "c" ((long)(arg2)), "d" ((long)(arg3)),        \
+                                "S" ((long)(arg4)), "D" ((long)(arg5))         \
+-                             : "esp", "memory");                              \
+                             : "memory");                                     \
+         LSS_RETURN(type,__res);                                               \
+       }
+     #undef  _syscall6
+@@ -2041,7 +2041,7 @@ struct kernel_statfs {
+                              : "i" (__NR_##name),  "0" ((long)(&__s)),        \
+                                "c" ((long)(arg2)), "d" ((long)(arg3)),        \
+                                "S" ((long)(arg4)), "D" ((long)(arg5))         \
+-                             : "esp", "memory");                              \
+                             : "memory");                                     \
+         LSS_RETURN(type,__res);                                               \
+       }
+     LSS_INLINE int LSS_NAME(clone)(int (*fn)(void *), void *child_stack,
+@@ -2127,7 +2127,7 @@ struct kernel_statfs {
+                            : "0"(-EINVAL), "i"(__NR_clone),
+                              "m"(fn), "m"(child_stack), "m"(flags), "m"(arg),
+                              "m"(parent_tidptr), "m"(newtls), "m"(child_tidptr)
+-                           : "esp", "memory", "ecx", "edx", "esi", "edi");
+                           : "memory", "ecx", "edx", "esi", "edi");
+       LSS_RETURN(int, __res);
+     }
+
--- a/firefox-nss-addon-hack.patch
+++ b/firefox-nss-addon-hack.patch
@ -0,0 +1,19 @@
+diff -up firefox-84.0.2/security/certverifier/NSSCertDBTrustDomain.cpp.nss-hack firefox-84.0.2/security/certverifier/NSSCertDBTrustDomain.cpp
+--- firefox-84.0.2/security/certverifier/NSSCertDBTrustDomain.cpp.nss-hack      2021-01-11 12:12:02.585514543 +0100
+++ firefox-84.0.2/security/certverifier/NSSCertDBTrustDomain.cpp       2021-01-11 12:47:50.345984582 +0100
+@@ -1619,6 +1619,15 @@ SECStatus InitializeNSS(const nsACString
+     return srv;
+   }
+
+  /* Sets the NSS_USE_ALG_IN_ANY_SIGNATURE bit.
+   * does not change NSS_USE_ALG_IN_CERT_SIGNATURE,
+   * so policy will still disable use of sha1 in
+   * certificate related signature processing. */
+  srv = NSS_SetAlgorithmPolicy(SEC_OID_SHA1, NSS_USE_ALG_IN_ANY_SIGNATURE, 0);
+  if (srv != SECSuccess) {
+    NS_WARNING("Unable to use SHA1 for Add-ons, expect broken/disabled Add-ons. See https://bugzilla.redhat.com/show_bug.cgi?id=1908018 for details.");
+  }
+
+   if (nssDbConfig == NSSDBConfig::ReadWrite) {
+     UniquePK11SlotInfo slot(PK11_GetInternalKeySlot());
+     if (!slot) {
--- a/firefox-nss-version.patch
+++ b/firefox-nss-version.patch
@ -0,0 +1,11 @@
+--- thunderbird-102.6.0/build/moz.configure/nss.configure.firefox-nss-version	2022-12-09 19:00:45.849518718 +0100
+++ thunderbird-102.6.0/build/moz.configure/nss.configure	2022-12-09 19:02:47.739198796 +0100
+@@ -9,7 +9,7 @@ system_lib_option("--with-system-nss", h
+ imply_option("--with-system-nspr", True, when="--with-system-nss")
+ 
+ nss_pkg = pkg_check_modules(
+-    "NSS", "nss >= 3.79.2", when="--with-system-nss", config=False
+    "NSS", "nss >= 3.79", when="--with-system-nss", config=False
+ )
+ 
+ set_config("MOZ_SYSTEM_NSS", True, when="--with-system-nss")
--- a/get-calendar-langpacks.sh
+++ b/get-calendar-langpacks.sh
@ -1,126 +0,0 @@
-#!/bin/bash
-#set -x
-set -e
-usage()
-{
-cat << EOF
-usage: $0 options
-
-This script downloads calendar langpacks for Thunderbird.
-
-OPTIONS:
-   -h      Show this message
-   -v      Version string (7.0.1)
-   -b      Build number (1, 2, 3)
-   -r      Reuse downloaded files (when you don't want to redownload)
-EOF
-}
-
-VER=
-BUILDNUM=
-LANG_DATE=`date "+%Y%m%d"`
-while getopts “hv:b:r” OPTION
-do
-     case $OPTION in
-         h)
-             usage
-             exit 1
-             ;;
-         v)
-             VER=$OPTARG
-             ;;
-         b)
-             BUILDNUM=$OPTARG
-             ;;
-         ?)
-             usage
-             exit
-             ;;
-     esac
-done
-
-if [ -z "$VER" -o -z "$BUILDNUM"  ]
-then
-     echo "Missing version or build number."
-     usage
-     exit 1
-fi
-
-WHITE='\033[1;33m'
-NC='\033[0m' # No Color
-
-LOCALES=`curl -f https://archive.mozilla.org/pub/thunderbird/candidates/$VER-candidates/build$BUILDNUM/linux-i686/ | grep "a href"|sed -e "s|.*/\([^/]*\)/\".*|\1|"|tail -n+2 |grep -v xpi`
-#echo $LOCALES
-rm -rf lightning-langpacks
-mkdir -p lightning-langpacks
-cd lightning-langpacks
-LOCALE_COUNT=`echo $LOCALES| tr ' ' '\n' | wc -l`
-LOCALE_NUM=0
-for lang in $LOCALES; do
-  LOCALE_NUM=$((LOCALE_NUM+1))
-  echo -e "${WHITE}Processing calendar locale: $lang ($LOCALE_NUM/$LOCALE_COUNT)${NC}"
-  mkdir -p extracted_lightning
-  mkdir -p calendar-locales
-  #echo Downloading TB binary for locale: $lang
-  wget --quiet https://archive.mozilla.org/pub/thunderbird/candidates/$VER-candidates/build$BUILDNUM/linux-i686/$lang/thunderbird-$VER.tar.bz2
-
-  cd extracted_lightning
-  tar -xf ../thunderbird-$VER.tar.bz2 thunderbird/distribution/extensions/\{e2fda1a4-762b-4020-b5ad-a41df1933103\}.xpi
-  set +e
-  unzip -qq thunderbird/distribution/extensions/\{e2fda1a4-762b-4020-b5ad-a41df1933103\}.xpi
-  set -e
-  LIGHTNING_VERSION=`cat app.ini |grep "^Version="|sed -e 's/Version=//'`
-  BUILD_ID=`cat app.ini |grep "^BuildID="|sed -e 's/BuildID=//'`
-  MAX_VERSION=`cat app.ini |grep MaxVersion|sed -e s/MaxVersion=//`
-  MIN_VERSION=`cat app.ini |grep MinVersion|sed -e s/MinVersion=//`
-  rm -rf thunderbird
-  mkdir -p ../calendar-locales/chrome
-  cp -r chrome/calendar-$lang ../calendar-locales/chrome
-  cp -r chrome/lightning-$lang ../calendar-locales/chrome
-  cd -
-
-  cd calendar-locales
-  # create manifest
-  cat > manifest.json <<EOL
-{
-  "languages": {
-    "$lang": {
-      "chrome_resources": {
-        "calendar": "chrome/calendar-$lang/locale/$lang/calendar/",
-        "lightning": "chrome/lightning-$lang/locale/$lang/lightning/"
-      },
-      "version": "$LIGHTNING_VERSION"
-    }
-  },
-  "applications": {
-    "gecko": {
-      "strict_min_version": "$MIN_VERSION",
-      "id": "langpack-cal-$lang@lightning.mozilla.org",
-      "strict_max_version": "$MAX_VERSION"
-    }
-  },
-  "langpack_id": "$lang",
-  "version": "7.$LIGHTNING_VERSION.$BUILD_ID",
-  "name": "$lang Language Pack Calendar",
-  "manifest_version": 2,
-  "sources": {
-    "browser": {
-      "base_path": "browser/"
-    }
-  },
-  "author": "Mozilla.cz (contributors: Pavel Cvrček, Pavel Franc, Michal Stanke, Michal Vašíček)",
-  "description": "Language pack for Thunderbird for $lang, this was repacked by Fedora/RHEL package maintainer from original binaries."
-}
-
-EOL
-  zip --quiet -r ../langpack-cal-$lang@lightning.mozilla.org.xpi *
-  cd -
-  rm -rf calendar-locales
-  rm -rf extracted_lightning
-
-  rm -f thunderbird-$VER.tar.bz2
-done
-echo "Creating lightning-langpacks-$VER.tar.xz..."
-tar cJf ../lightning-langpacks-$VER.tar.xz *.xpi
-cd ..
-rm -rf lightning-langpacks
--- a/1
+++ b/1
@ -0,0 +1 @@
+AIzaSyB2h2OuRcUgy5N-5hsZqiPW6sH3n_rptiQ
--- a/mozilla-1170092.patch
+++ b/mozilla-1170092.patch
@ -1,6 +1,6 @@
-diff -up firefox-91.0/extensions/pref/autoconfig/src/nsReadConfig.cpp.1170092 firefox-91.0/extensions/pref/autoconfig/src/nsReadConfig.cpp
--- firefox-91.0/extensions/pref/autoconfig/src/nsReadConfig.cpp.1170092	2021-07-27 23:29:57.000000000 +0200
-+++ firefox-91.0/extensions/pref/autoconfig/src/nsReadConfig.cpp	2021-07-29 16:20:44.164513998 +0200
+diff -up firefox-87.0/extensions/pref/autoconfig/src/nsReadConfig.cpp.1170092 firefox-87.0/extensions/pref/autoconfig/src/nsReadConfig.cpp
+--- firefox-87.0/extensions/pref/autoconfig/src/nsReadConfig.cpp.1170092	2021-03-18 14:48:36.000000000 +0100
+++ firefox-87.0/extensions/pref/autoconfig/src/nsReadConfig.cpp	2021-03-22 19:20:02.429310184 +0100
@@ -249,8 +249,20 @@ nsresult nsReadConfig::openAndEvaluateJS
     if (NS_FAILED(rv)) return rv;
 
@ -23,22 +23,23 @@ diff -up firefox-91.0/extensions/pref/autoconfig/src/nsReadConfig.cpp.1170092 fi
   } else {
     nsAutoCString location("resource://gre/defaults/autoconfig/");
     location += aFileName;
-diff -up firefox-91.0/modules/libpref/Preferences.cpp.1170092 firefox-91.0/modules/libpref/Preferences.cpp
--- firefox-91.0/modules/libpref/Preferences.cpp.1170092	2021-07-27 23:30:34.000000000 +0200
-+++ firefox-91.0/modules/libpref/Preferences.cpp	2021-07-29 16:20:44.166514005 +0200
-@@ -4553,6 +4553,8 @@ nsresult Preferences::InitInitialObjects
+diff -up firefox-87.0/modules/libpref/Preferences.cpp.1170092 firefox-87.0/modules/libpref/Preferences.cpp
+--- firefox-87.0/modules/libpref/Preferences.cpp.1170092	2021-03-18 14:48:54.000000000 +0100
+++ firefox-87.0/modules/libpref/Preferences.cpp	2021-03-22 19:20:02.429310184 +0100
+@@ -4499,6 +4499,9 @@ nsresult Preferences::InitInitialObjects
   //
   // Thus, in the omni.jar case, we always load app-specific default
   // preferences from omni.jar, whether or not `$app == $gre`.
+  //
 +  // At very end load configuration from system config location:
 +  // - /etc/firefox/pref/*.js
 
   nsresult rv = NS_ERROR_FAILURE;
   UniquePtr<nsZipFind> find;
-diff -up firefox-91.0/toolkit/xre/nsXREDirProvider.cpp.1170092 firefox-91.0/toolkit/xre/nsXREDirProvider.cpp
--- firefox-91.0/toolkit/xre/nsXREDirProvider.cpp.1170092	2021-07-27 23:30:56.000000000 +0200
-+++ firefox-91.0/toolkit/xre/nsXREDirProvider.cpp	2021-07-29 16:26:20.071628932 +0200
-@@ -71,6 +71,7 @@
+diff -up firefox-87.0/toolkit/xre/nsXREDirProvider.cpp.1170092 firefox-87.0/toolkit/xre/nsXREDirProvider.cpp
+--- firefox-87.0/toolkit/xre/nsXREDirProvider.cpp.1170092	2021-03-18 14:52:00.000000000 +0100
+++ firefox-87.0/toolkit/xre/nsXREDirProvider.cpp	2021-03-22 19:37:56.574480347 +0100
+@@ -65,6 +65,7 @@
 #endif
 #ifdef XP_UNIX
 #  include <ctype.h>
@ -46,7 +47,7 @@ diff -up firefox-91.0/toolkit/xre/nsXREDirProvider.cpp.1170092 firefox-91.0/tool
 #endif
 #ifdef XP_IOS
 #  include "UIKitDirProvider.h"
-@@ -550,6 +551,21 @@ nsXREDirProvider::GetFile(const char* aP
+@@ -552,6 +553,21 @@ nsXREDirProvider::GetFile(const char* aP
       }
     }
   }
@ -68,26 +69,26 @@ diff -up firefox-91.0/toolkit/xre/nsXREDirProvider.cpp.1170092 firefox-91.0/tool
   if (NS_FAILED(rv) || !file) return NS_ERROR_FAILURE;
 
   if (ensureFilePermissions) {
-@@ -827,6 +843,16 @@ nsresult nsXREDirProvider::GetFilesInter
-       LoadDirIntoArray(mXULAppDir, kAppendBackgroundTasksPrefDir, directories);
+@@ -874,6 +890,16 @@ nsresult nsXREDirProvider::GetFilesInter
     }
 #endif
+ 
 +    // Add /etc/<application>/pref/ directory if it exists
 +    nsCOMPtr<nsIFile> systemPrefDir;
 +    rv = NS_GetSpecialDirectory(NS_APP_PREFS_SYSTEM_CONFIG_DIR,
 +                                getter_AddRefs(systemPrefDir));
 +    if (NS_SUCCEEDED(rv)) {
 +      rv = systemPrefDir->AppendNative(nsLiteralCString("pref"));
-+      if (NS_SUCCEEDED(rv)) {
+      if (NS_SUCCEEDED(rv))
 +        directories.AppendObject(systemPrefDir);
 +      }
-+    }
- 
+
     rv = NS_NewArrayEnumerator(aResult, directories, NS_GET_IID(nsIFile));
   } else if (!strcmp(aProperty, NS_APP_CHROME_DIR_LIST)) {
-diff -up firefox-91.0/xpcom/io/nsAppDirectoryServiceDefs.h.1170092 firefox-91.0/xpcom/io/nsAppDirectoryServiceDefs.h
--- firefox-91.0/xpcom/io/nsAppDirectoryServiceDefs.h.1170092	2021-07-27 23:31:38.000000000 +0200
-+++ firefox-91.0/xpcom/io/nsAppDirectoryServiceDefs.h	2021-07-29 16:20:44.168514012 +0200
+     // NS_APP_CHROME_DIR_LIST is only used to get default (native) icons
+diff -up firefox-87.0/xpcom/io/nsAppDirectoryServiceDefs.h.1170092 firefox-87.0/xpcom/io/nsAppDirectoryServiceDefs.h
+--- firefox-87.0/xpcom/io/nsAppDirectoryServiceDefs.h.1170092	2021-03-18 14:51:58.000000000 +0100
+++ firefox-87.0/xpcom/io/nsAppDirectoryServiceDefs.h	2021-03-22 19:20:02.430310213 +0100
@@ -59,6 +59,7 @@
 #define NS_APP_PREFS_DEFAULTS_DIR_LIST "PrefDL"
 #define NS_APP_PREFS_OVERRIDE_DIR \
--- a/mozilla-1516803.patch
+++ b/mozilla-1516803.patch
@ -0,0 +1,15 @@
+diff -up firefox-84.0/security/sandbox/linux/moz.build.1516803 firefox-84.0/security/sandbox/linux/moz.build
+--- firefox-84.0/security/sandbox/linux/moz.build.1516803	2020-12-10 16:17:55.425139545 +0100
+++ firefox-84.0/security/sandbox/linux/moz.build	2020-12-10 16:29:21.945860841 +0100
+@@ -114,9 +114,8 @@ if CONFIG["CC_TYPE"] in ("clang", "gcc")
+ # gcc lto likes to put the top level asm in syscall.cc in a different partition
+ # from the function using it which breaks the build.  Work around that by
+ # forcing there to be only one partition.
+-for f in CONFIG["OS_CXXFLAGS"]:
+-    if f.startswith("-flto") and CONFIG["CC_TYPE"] != "clang":
+-        LDFLAGS += ["--param lto-partitions=1"]
+if CONFIG['CC_TYPE'] != 'clang':
+    LDFLAGS += ['--param', 'lto-partitions=1']
+ 
+ DEFINES["NS_NO_XPCOM"] = True
+ DisableStlWrapping()
--- a/mozilla-1669639.patch
+++ b/mozilla-1669639.patch
@ -0,0 +1,14 @@
+--- firefox-81.0.1/build/mach_initialize.py.old	2020-10-06 14:16:06.212974910 +0200
+++ firefox-81.0.1/build/mach_initialize.py	2020-10-06 14:19:03.313179557 +0200
+@@ -507,7 +507,10 @@ class ImportHook(object):
+         # doesn't happen or because it doesn't matter).
+         if not os.path.exists(module.__file__[:-1]):
+             if os.path.exists(module.__file__):
+-                os.remove(module.__file__)
+                try:
+                    os.remove(module.__file__)
+                except:
+                    pass
+             del sys.modules[module.__name__]
+             module = self(name, globals, locals, fromlist, level)
+ 
--- a/mozilla-1670333.patch
+++ b/mozilla-1670333.patch
@ -0,0 +1,68 @@
+diff -up firefox-99.0/dom/media/mp4/MP4Demuxer.cpp.1670333 firefox-99.0/dom/media/mp4/MP4Demuxer.cpp
+--- firefox-99.0/dom/media/mp4/MP4Demuxer.cpp.1670333	2022-03-31 01:24:44.000000000 +0200
+++ firefox-99.0/dom/media/mp4/MP4Demuxer.cpp	2022-04-04 09:58:35.606351546 +0200
+@@ -31,6 +31,8 @@ mozilla::LogModule* GetDemuxerLog() { re
+   DDMOZ_LOG(gMediaDemuxerLog, mozilla::LogLevel::Debug, "::%s: " arg, \
+             __func__, ##__VA_ARGS__)
+ 
+extern bool gUseKeyframeFromContainer;
+
+ namespace mozilla {
+ 
+ DDLoggedTypeDeclNameAndBase(MP4TrackDemuxer, MediaTrackDemuxer);
+@@ -394,6 +396,12 @@ already_AddRefed<MediaRawData> MP4TrackD
+           [[fallthrough]];
+         case H264::FrameType::OTHER: {
+           bool keyframe = type == H264::FrameType::I_FRAME;
+          if (gUseKeyframeFromContainer) {
+            if (sample->mKeyframe && sample->mKeyframe != keyframe) {
+              sample->mKeyframe = keyframe;
+            }
+            break;
+          }
+           if (sample->mKeyframe != keyframe) {
+             NS_WARNING(nsPrintfCString("Frame incorrectly marked as %skeyframe "
+                                        "@ pts:%" PRId64 " dur:%" PRId64
+diff -up firefox-99.0/dom/media/platforms/PDMFactory.cpp.1670333 firefox-99.0/dom/media/platforms/PDMFactory.cpp
+--- firefox-99.0/dom/media/platforms/PDMFactory.cpp.1670333	2022-03-31 01:24:44.000000000 +0200
+++ firefox-99.0/dom/media/platforms/PDMFactory.cpp	2022-04-04 10:09:57.383419125 +0200
+@@ -58,6 +58,8 @@
+ 
+ #include <functional>
+ 
+bool gUseKeyframeFromContainer = false;
+
+ namespace mozilla {
+ 
+ #define PDM_INIT_LOG(msg, ...) \
+@@ -495,7 +497,7 @@ void PDMFactory::CreateRddPDMs() {
+ #ifdef MOZ_FFMPEG
+   if (StaticPrefs::media_ffmpeg_enabled() &&
+       StaticPrefs::media_rdd_ffmpeg_enabled() &&
+-      !CreateAndStartupPDM<FFmpegRuntimeLinker>()) {
+      !(mFFmpegUsed = CreateAndStartupPDM<FFmpegRuntimeLinker>())) {
+     mFailureFlags += GetFailureFlagBasedOnFFmpegStatus(
+         FFmpegRuntimeLinker::LinkStatusCode());
+   }
+@@ -602,8 +604,9 @@ void PDMFactory::CreateDefaultPDMs() {
+ 
+   CreateAndStartupPDM<AgnosticDecoderModule>();
+ 
+-  if (StaticPrefs::media_gmp_decoder_enabled() &&
+  if (StaticPrefs::media_gmp_decoder_enabled() && !mFFmpegUsed &&
+       !CreateAndStartupPDM<GMPDecoderModule>()) {
+    gUseKeyframeFromContainer = true;
+     mFailureFlags += DecoderDoctorDiagnostics::Flags::GMPPDMFailedToStartup;
+   }
+ }
+diff -up firefox-99.0/dom/media/platforms/PDMFactory.h.1670333 firefox-99.0/dom/media/platforms/PDMFactory.h
+--- firefox-99.0/dom/media/platforms/PDMFactory.h.1670333	2022-03-31 01:24:44.000000000 +0200
+++ firefox-99.0/dom/media/platforms/PDMFactory.h	2022-04-04 09:58:35.606351546 +0200
+@@ -121,6 +121,7 @@ class PDMFactory final {
+   RefPtr<PlatformDecoderModule> mNullPDM;
+ 
+   DecoderDoctorDiagnostics::FlagsSet mFailureFlags;
+  bool mFFmpegUsed = false;
+ 
+   friend class RemoteVideoDecoderParent;
+   static void EnsureInit();
--- a/mozilla-1775202.patch
+++ b/mozilla-1775202.patch
@ -0,0 +1,17 @@
+diff --git a/third_party/libwebrtc/moz.build b/third_party/libwebrtc/moz.build
+index 8579f8bb3622..d9ca79d4fcb8 100644
+--- a/third_party/libwebrtc/moz.build
+++ b/third_party/libwebrtc/moz.build
+@@ -520,7 +520,10 @@ if CONFIG["CPU_ARCH"] == "ppc64" and CONFIG["OS_TARGET"] == "Linux":
+         "/third_party/libwebrtc/api/audio_codecs/isac/audio_decoder_isac_float_gn",
+         "/third_party/libwebrtc/api/audio_codecs/isac/audio_encoder_isac_float_gn",
+         "/third_party/libwebrtc/modules/audio_coding/isac_c_gn",
+-        "/third_party/libwebrtc/modules/audio_coding/isac_gn"
+        "/third_party/libwebrtc/modules/audio_coding/isac_gn",
+        "/third_party/libwebrtc/modules/desktop_capture/desktop_capture_generic_gn",
+        "/third_party/libwebrtc/modules/desktop_capture/desktop_capture_gn",
+        "/third_party/libwebrtc/modules/desktop_capture/primitives_gn"
+     ]
+ 
+ if CONFIG["CPU_ARCH"] == "x86" and CONFIG["OS_TARGET"] == "Linux":
+
--- a/mozilla-bmo1005535.patch
+++ b/mozilla-bmo1005535.patch
@ -1,7 +1,20 @@
-diff -up firefox-78.0/gfx/skia/skia/src/gpu/GrColor.h.mozilla.bmo1005535 firefox-78.0/gfx/skia/skia/src/gpu/GrColor.h
--- firefox-78.0/gfx/skia/skia/src/gpu/GrColor.h.mozilla.bmo1005535	2020-06-25 16:16:34.459083304 +0200
-+++ firefox-78.0/gfx/skia/skia/src/gpu/GrColor.h	2020-06-25 16:17:00.968174743 +0200
-@@ -64,7 +64,7 @@ static inline GrColor GrColorPackRGBA(un
+# HG changeset patch
+# User Steve Singer <steve@ssinger.info>
+# Date 1558451540 -7200
+#      Tue May 21 17:12:20 2019 +0200
+# Node ID 433beec63e6b5f409683af20a0c1ab137cc7bfad
+# Parent  c0fdccc716e80a6d289c94f5d507ae141c62a3bf
+Bug 1005535 - Get skia GPU building on big endian.
+
+diff --git a/gfx/skia/skia/src/gpu/GrColor.h b/gfx/skia/skia/src/gpu/GrColor.h
+--- a/gfx/skia/skia/src/gpu/GrColor.h
+++ b/gfx/skia/skia/src/gpu/GrColor.h
+@@ -59,17 +59,17 @@ static inline GrColor GrColorPackRGBA(un
+ #define GrColorUnpackG(color)   (((color) >> GrColor_SHIFT_G) & 0xFF)
+ #define GrColorUnpackB(color)   (((color) >> GrColor_SHIFT_B) & 0xFF)
+ #define GrColorUnpackA(color)   (((color) >> GrColor_SHIFT_A) & 0xFF)
+ 
+ /**
  *  Since premultiplied means that alpha >= color, we construct a color with
  *  each component==255 and alpha == 0 to be "illegal"
  */
@ -10,3 +23,8 @@ diff -up firefox-78.0/gfx/skia/skia/src/gpu/GrColor.h.mozilla.bmo1005535 firefox
 
 /** Normalizes and coverts an uint8_t to a float. [0, 255] -> [0.0, 1.0] */
 static inline float GrNormalizeByteToFloat(uint8_t value) {
+     static const float ONE_OVER_255 = 1.f / 255.f;
+     return value * ONE_OVER_255;
+ }
+ 
+ /** Used to pick vertex attribute types. */
--- a/mozilla-bmo1504834-part1.patch
+++ b/mozilla-bmo1504834-part1.patch
@ -1,7 +1,16 @@
-diff -up firefox-78.0/gfx/2d/DrawTargetSkia.cpp.mozilla-bmo1504834-part1 firefox-78.0/gfx/2d/DrawTargetSkia.cpp
--- firefox-78.0/gfx/2d/DrawTargetSkia.cpp.mozilla-bmo1504834-part1	2020-06-17 04:18:58.000000000 +0200
-+++ firefox-78.0/gfx/2d/DrawTargetSkia.cpp	2020-06-25 16:52:29.824532769 +0200
-@@ -135,8 +135,7 @@ static IntRect CalculateSurfaceBounds(co
+# HG changeset patch
+# Parent  b5471d23321d16a0bacc25b7afd27d2e16adba1a
+Taken from https://bugzilla.mozilla.org/show_bug.cgi?id=1504834
+
+diff --git a/gfx/2d/DrawTargetSkia.cpp b/gfx/2d/DrawTargetSkia.cpp
+--- a/gfx/2d/DrawTargetSkia.cpp
+++ b/gfx/2d/DrawTargetSkia.cpp
+@@ -130,18 +130,17 @@ static IntRect CalculateSurfaceBounds(co
+   Rect sampledBounds = inverse.TransformBounds(*aBounds);
+   if (!sampledBounds.ToIntRect(&bounds)) {
+     return surfaceBounds;
+   }
+ 
   return surfaceBounds.Intersect(bounds);
 }
 
@ -11,10 +20,20 @@ diff -up firefox-78.0/gfx/2d/DrawTargetSkia.cpp.mozilla-bmo1504834-part1 firefox
 
 static bool VerifyRGBXFormat(uint8_t* aData, const IntSize& aSize,
                              const int32_t aStride, SurfaceFormat aFormat) {
-diff -up firefox-78.0/gfx/2d/Types.h.mozilla-bmo1504834-part1 firefox-78.0/gfx/2d/Types.h
--- firefox-78.0/gfx/2d/Types.h.mozilla-bmo1504834-part1	2020-06-25 16:52:29.826532776 +0200
-+++ firefox-78.0/gfx/2d/Types.h	2020-06-25 16:55:02.942063616 +0200
-@@ -90,15 +90,8 @@ enum class SurfaceFormat : int8_t {
+   if (aFormat != SurfaceFormat::B8G8R8X8 || aSize.IsEmpty()) {
+     return true;
+   }
+   // We should've initialized the data to be opaque already
+   // On debug builds, verify that this is actually true.
+diff --git a/gfx/2d/Types.h b/gfx/2d/Types.h
+--- a/gfx/2d/Types.h
+++ b/gfx/2d/Types.h
+@@ -84,25 +84,18 @@ enum class SurfaceFormat : int8_t {
+   Depth,
+ 
+   // This represents the unknown format.
+   UNKNOWN,
+ 
 // The following values are endian-independent synonyms. The _UINT32 suffix
 // indicates that the name reflects the layout when viewed as a uint32_t
 // value.
@ -30,10 +49,20 @@ diff -up firefox-78.0/gfx/2d/Types.h.mozilla-bmo1504834-part1 firefox-78.0/gfx/2
 
   // The following values are OS and endian-independent synonyms.
   //
-diff -up firefox-78.0/gfx/skia/skia/third_party/skcms/skcms.cc.mozilla-bmo1504834-part1 firefox-78.0/gfx/skia/skia/third_party/skcms/skcms.cc
--- firefox-78.0/gfx/skia/skia/third_party/skcms/skcms.cc.mozilla-bmo1504834-part1	2020-06-17 04:18:58.000000000 +0200
-+++ firefox-78.0/gfx/skia/skia/third_party/skcms/skcms.cc	2020-06-25 16:54:02.993855444 +0200
-@@ -30,6 +30,8 @@
+   // TODO(aosmond): When everything blocking bug 1581828 has been resolved, we
+   // can make this use R8B8G8A8 and R8B8G8X8 for non-Windows platforms.
+   OS_RGBA = A8R8G8B8_UINT32,
+   OS_RGBX = X8R8G8B8_UINT32
+ };
+diff --git a/gfx/skia/skia/third_party/skcms/skcms.cc b/gfx/skia/skia/third_party/skcms/skcms.cc
+--- a/gfx/skia/skia/third_party/skcms/skcms.cc
+++ b/gfx/skia/skia/third_party/skcms/skcms.cc
+@@ -25,16 +25,18 @@
+         // it'd be a lot slower.  But we want all those headers included so we
+         // can use their features after runtime checks later.
+         #include <smmintrin.h>
+         #include <avxintrin.h>
+         #include <avx2intrin.h>
         #include <avx512fintrin.h>
         #include <avx512dqintrin.h>
     #endif
@ -42,17 +71,27 @@ diff -up firefox-78.0/gfx/skia/skia/third_party/skcms/skcms.cc.mozilla-bmo150483
 #endif
 
 // sizeof(x) will return size_t, which is 32-bit on some machines and 64-bit on others.
-@@ -280,20 +282,28 @@ enum {
+ // We have better testing on 64-bit machines, so force 32-bit machines to behave like 64-bit.
+ //
+ // Please do not use sizeof() directly, and size_t only when required.
+ // (We have no way of enforcing these requests...)
+ #define SAFE_SIZEOF(x) ((uint64_t)sizeof(x))
+@@ -275,30 +277,38 @@ enum {
+     skcms_Signature_sf32 = 0x73663332,
+     // XYZ is also a PCS signature, so it's defined in skcms.h
+     // skcms_Signature_XYZ = 0x58595A20,
+ };
+ 
 static uint16_t read_big_u16(const uint8_t* ptr) {
     uint16_t be;
     memcpy(&be, ptr, sizeof(be));
 -#if defined(_MSC_VER)
-    return _byteswap_ushort(be);
 +#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
 +    return be;
- #else
+#else
 +    #if defined(_MSC_VER)
-+    return _byteswap_ushort(be);
+     return _byteswap_ushort(be);
+-#else
 +    #else
     return __builtin_bswap16(be);
 +    #endif
@ -63,15 +102,20 @@ diff -up firefox-78.0/gfx/skia/skia/third_party/skcms/skcms.cc.mozilla-bmo150483
     uint32_t be;
     memcpy(&be, ptr, sizeof(be));
 -#if defined(_MSC_VER)
-    return _byteswap_ulong(be);
 +#if __BYTE_ORDER == __ORDER_BIG_ENDIAN__
 +    return be;
- #else
+#else
 +    #if defined(_MSC_VER)
-+    return _byteswap_ulong(be);
+     return _byteswap_ulong(be);
+-#else
 +    #else
     return __builtin_bswap32(be);
 +    #endif
 #endif
 }
 
+ static int32_t read_big_i32(const uint8_t* ptr) {
+     return (int32_t)read_big_u32(ptr);
+ }
+ 
+ static float read_big_fixed(const uint8_t* ptr) {
--- a/mozilla-bmo1504834-part2.patch
+++ b/mozilla-bmo1504834-part2.patch
@ -1,88 +0,0 @@
-# HG changeset patch
-# Parent  36563351309ddbc6c29559ba50a41d005f925abb
-Skia does not support big endian. The places to fix are too numerous and upstream (skia, not Mozilla)
-has no interest in maintaining big endian.
-So here we try to swizzle the input for skia, so that skia always works on LE, and when it comes
-out again, we transform back to BE.
-
-diff -r 36563351309d gfx/2d/ConvolutionFilter.cpp
--- a/gfx/2d/ConvolutionFilter.cpp	Mon Sep 09 17:59:28 2019 +0200
-+++ b/gfx/2d/ConvolutionFilter.cpp	Tue Sep 10 08:25:13 2019 +0200
-@@ -35,9 +35,38 @@
-   return true;
- }
- 
-+static void ByteSwapArray(uint8_t *u8Array, int32_t size) {
-+    uint32_t *array = reinterpret_cast<uint32_t*>(u8Array);
-+    for (int pxl = 0; pxl < size; ++pxl) {
-+        // Use an endian swap to move the bytes, i.e. BGRA -> ARGB.
-+        uint32_t rgba = array[pxl];
-+        array[pxl] = NativeEndian::swapToLittleEndian(rgba);
-+    }
-+}
-+
- void ConvolutionFilter::ConvolveHorizontally(const uint8_t* aSrc, uint8_t* aDst,
-                                              bool aHasAlpha) {
-+#if MOZ_BIG_ENDIAN
-+    int outputSize = mFilter->numValues();
-+
-+    // Input size isn't handed in, so we have to calculate it quickly
-+    int inputSize = 0;
-+    for (int xx = 0; xx < outputSize; ++xx) {
-+        // Get the filter that determines the current output pixel.
-+        int filterOffset, filterLength;
-+        mFilter->FilterForValue(xx, &filterOffset, &filterLength);
-+        inputSize = std::max(inputSize, filterOffset + filterLength);
-+    }
-+
-+    ByteSwapArray((uint8_t*)aSrc, inputSize);
-+#endif
-+
-   SkOpts::convolve_horizontally(aSrc, *mFilter, aDst, aHasAlpha);
-+
-+#if MOZ_BIG_ENDIAN
-+    ByteSwapArray((uint8_t*)aSrc, inputSize);
-+    ByteSwapArray(aDst, outputSize);
-+#endif
- }
- 
- void ConvolutionFilter::ConvolveVertically(uint8_t* const* aSrc, uint8_t* aDst,
-@@ -49,8 +78,26 @@
-   int32_t filterLength;
-   auto filterValues =
-       mFilter->FilterForValue(aRowIndex, &filterOffset, &filterLength);
-+
-+#if MOZ_BIG_ENDIAN
-+  for (int filterY = 0; filterY < filterLength; filterY++) {
-+      // Skia only knows LE, so we have to swizzle the input
-+    ByteSwapArray(aSrc[filterY], aRowSize);
-+  }
-+#endif
-+
-   SkOpts::convolve_vertically(filterValues, filterLength, aSrc, aRowSize, aDst,
-                               aHasAlpha);
-+
-+#if MOZ_BIG_ENDIAN
-+  // After skia is finished, we swizzle back to BE, in case
-+  // the input is used again somewhere else
-+  for (int filterY = 0; filterY < filterLength; filterY++) {
-+    ByteSwapArray(aSrc[filterY], aRowSize);
-+  }
-+  // The destination array as well
-+  ByteSwapArray(aDst, aRowSize);
-+#endif
- }
- 
- /* ConvolutionFilter::ComputeResizeFactor is derived from Skia's
-diff -r 36563351309d gfx/skia/skia/include/core/SkPreConfig.h
--- a/gfx/skia/skia/include/core/SkPreConfig.h	Mon Sep 09 17:59:28 2019 +0200
-+++ b/gfx/skia/skia/include/core/SkPreConfig.h	Tue Sep 10 08:25:13 2019 +0200
-@@ -73,7 +73,7 @@
-       defined(__ppc__) || defined(__hppa) || \
-       defined(__PPC__) || defined(__PPC64__) || \
-       defined(_MIPSEB) || defined(__ARMEB__) || \
-      defined(__s390__) || \
-+      defined(__s390__) || defined(__s390x__) || \
-       (defined(__sh__) && defined(__BIG_ENDIAN__)) || \
-       (defined(__ia64) && defined(__BIG_ENDIAN__))
-          #define SK_CPU_BENDIAN
--- a/mozilla-bmo1504834-part3.patch
+++ b/mozilla-bmo1504834-part3.patch
@ -1,12 +1,17 @@
 # HG changeset patch
-# Parent  aecb4600e5da17443b224c79eee178c1d8e155e3
+# Parent  d1d66f7e4d0e7fd45e91e4fcee07555e72046d48
 For FF68, AntiAliasing of XULTexts seem to be broken on big endian (s390x). Text and icons of the sandwich-menu to the
 right of the address bar, as well as plugin-windows appears transparant, which usually means unreadable (white on white).

-diff -r aecb4600e5da gfx/skia/skia/include/private/SkNx.h
--- a/gfx/skia/skia/include/private/SkNx.h	Tue Aug 20 09:46:55 2019 +0200
-+++ b/gfx/skia/skia/include/private/SkNx.h	Mon Sep 09 10:04:06 2019 +0200
-@@ -238,7 +238,18 @@
+diff --git a/gfx/skia/skia/include/private/SkNx.h b/gfx/skia/skia/include/private/SkNx.h
+--- a/gfx/skia/skia/include/private/SkNx.h
+++ b/gfx/skia/skia/include/private/SkNx.h
+@@ -233,17 +233,28 @@ struct SkNx<1,T> {
+     AI SkNx operator<<(int bits) const { return fVal << bits; }
+     AI SkNx operator>>(int bits) const { return fVal >> bits; }
+ 
+     AI SkNx operator+(const SkNx& y) const { return fVal + y.fVal; }
+     AI SkNx operator-(const SkNx& y) const { return fVal - y.fVal; }
     AI SkNx operator*(const SkNx& y) const { return fVal * y.fVal; }
     AI SkNx operator/(const SkNx& y) const { return fVal / y.fVal; }
 
@ -25,10 +30,20 @@ diff -r aecb4600e5da gfx/skia/skia/include/private/SkNx.h
     AI SkNx operator|(const SkNx& y) const { return FromBits(ToBits(fVal) | ToBits(y.fVal)); }
     AI SkNx operator^(const SkNx& y) const { return FromBits(ToBits(fVal) ^ ToBits(y.fVal)); }
 
-diff -r aecb4600e5da gfx/skia/skia/src/opts/SkBlitMask_opts.h
--- a/gfx/skia/skia/src/opts/SkBlitMask_opts.h	Tue Aug 20 09:46:55 2019 +0200
-+++ b/gfx/skia/skia/src/opts/SkBlitMask_opts.h	Mon Sep 09 10:04:06 2019 +0200
-@@ -203,7 +203,13 @@
+     AI SkNx operator==(const SkNx& y) const { return FromBits(fVal == y.fVal ? ~0 : 0); }
+     AI SkNx operator!=(const SkNx& y) const { return FromBits(fVal != y.fVal ? ~0 : 0); }
+     AI SkNx operator<=(const SkNx& y) const { return FromBits(fVal <= y.fVal ? ~0 : 0); }
+     AI SkNx operator>=(const SkNx& y) const { return FromBits(fVal >= y.fVal ? ~0 : 0); }
+     AI SkNx operator< (const SkNx& y) const { return FromBits(fVal <  y.fVal ? ~0 : 0); }
+diff --git a/gfx/skia/skia/src/opts/SkBlitMask_opts.h b/gfx/skia/skia/src/opts/SkBlitMask_opts.h
+--- a/gfx/skia/skia/src/opts/SkBlitMask_opts.h
+++ b/gfx/skia/skia/src/opts/SkBlitMask_opts.h
+@@ -198,17 +198,23 @@ namespace SK_OPTS_NS {
+                                        const SkAlpha* mask, size_t maskRB,
+                                        int w, int h) {
+         auto fn = [](const Sk4px& d, const Sk4px& aa) {
+             //   = (s + d(1-sa))aa + d(1-aa)
+             //   = s*aa + d(1-sa*aa)
             //   ~~~>
             // a = 1*aa + d(1-1*aa) = aa + d(1-aa)
             // c = 0*aa + d(1-1*aa) =      d(1-aa)
@ -42,3 +57,8 @@ diff -r aecb4600e5da gfx/skia/skia/src/opts/SkBlitMask_opts.h
                  + d.approxMulDiv255(aa.inv());
         };
         while (h --> 0) {
+             Sk4px::MapDstAlpha(w, dst, mask, fn);
+             dst  +=  dstRB / sizeof(*dst);
+             mask += maskRB / sizeof(*mask);
+         }
+     }
--- a/mozilla-bmo1504834-part4.patch
+++ b/mozilla-bmo1504834-part4.patch
@ -1,30 +0,0 @@
-# HG changeset patch
-# Parent  46ea866ca3acb8bb5e1709ceb799b9c94f591dec
-Problem description: Tab-titles that are too long to fit into a tab get faded out.
-                     On big endian this is broken and instead of fading out, the 
-                     tab gets white and the font transparent, leading to an unreadable
-                     tab-title
-Solution: This is not a real solution, but a hack. The real solution would have been
-          to byte-swap the correct buffer, but I could not find it.
-          So the next best thing is to deactivate the fading-effect. Now all tab-titles
-          are readable, albeit not as pretty to look at as they could be. 
-Side-effects: I have not yet found an unwanted side-effect.
-
-diff -r 46ea866ca3ac -r 6ef20eee3f8f gfx/2d/DrawTargetSkia.cpp
--- a/gfx/2d/DrawTargetSkia.cpp	Tue Oct 22 12:27:22 2019 +0200
-+++ b/gfx/2d/DrawTargetSkia.cpp	Thu Oct 31 09:11:56 2019 +0100
-@@ -1861,6 +1861,14 @@
-       SkCanvas::kPreserveLCDText_SaveLayerFlag |
-           (aCopyBackground ? SkCanvas::kInitWithPrevious_SaveLayerFlag : 0));
- 
-+#if MOZ_BIG_ENDIAN
-+  // Pushing a layer where an aMask is defined produces wrong output.
-+  // We _should_ endian swap the data, but I couldn't find a workable way to do so
-+  // Therefore I deactivate those layers in the meantime.
-+  // The result is: Tab-titles that are longer than the available space should be faded out.
-+  //                The fading doesn't work, so we deactivate the fading-effect here.
-+  if (!aMask)
-+#endif
-   mCanvas->saveLayer(saveRec);
- 
-   SetPermitSubpixelAA(aOpaque);
--- a/mozilla-bmo1554971.patch
+++ b/mozilla-bmo1554971.patch
@ -1,12 +0,0 @@
-diff -up firefox-91.0/toolkit/components/extensions/schemas/runtime.json.mozilla-bmo1554971 firefox-91.0/toolkit/components/extensions/schemas/runtime.json
--- firefox-91.0/toolkit/components/extensions/schemas/runtime.json.mozilla-bmo1554971	2021-07-29 17:20:08.523253193 +0200
-+++ firefox-91.0/toolkit/components/extensions/schemas/runtime.json	2021-07-29 17:21:23.517498581 +0200
-@@ -64,7 +64,7 @@
-       {
-         "id": "PlatformArch",
-         "type": "string",
-        "enum": ["aarch64", "arm", "ppc64", "s390x", "sparc64", "x86-32", "x86-64"],
-+        "enum": ["aarch64", "arm", "ppc64", "ppc64le", "s390x", "sparc64", "x86-32", "x86-64"],
-         "allowedContexts": ["content", "devtools"],
-         "description": "The machine's processor architecture."
-       },
--- a/mozilla-bmo1602730.patch
+++ b/mozilla-bmo1602730.patch
@ -1,28 +0,0 @@
-diff -r 6ef20eee3f8f gfx/layers/basic/BasicCompositor.cpp
--- a/gfx/layers/basic/BasicCompositor.cpp	Thu Oct 31 09:11:56 2019 +0100
-+++ b/gfx/layers/basic/BasicCompositor.cpp	Wed Dec 11 16:16:09 2019 +0100
-@@ -693,9 +693,13 @@
- 
-   RefPtr<SourceSurface> sourceMask;
-   Matrix maskTransform;
-+  // Setting an alpha-mask here breaks the URL-bar on big endian (s390x)
-+  // if the typed URL is too long for the textbox (automatic scrolling needed)
-+#if MOZ_LITTLE_ENDIAN
-   if (aTransform.Is2D()) {
-     SetupMask(aEffectChain, dest, offset, sourceMask, maskTransform);
-   }
-+#endif
- 
-   CompositionOp blendMode = CompositionOp::OP_OVER;
-   if (Effect* effect =
-diff -r 6ef20eee3f8f gfx/layers/composite/CompositableHost.cpp
--- a/gfx/layers/composite/CompositableHost.cpp	Thu Oct 31 09:11:56 2019 +0100
-+++ b/gfx/layers/composite/CompositableHost.cpp	Wed Dec 11 16:16:09 2019 +0100
-@@ -91,6 +91,7 @@
-   }
-   MOZ_ASSERT(source);
- 
-+  // Alternatively: Comment out these lines where the alpha-mask is set
-   RefPtr<EffectMask> effect =
-       new EffectMask(source, source->GetSize(), aTransform);
-   aEffects.mSecondaryEffects[EffectTypes::MASK] = effect;
--- a/mozilla-bmo1626236.patch
+++ b/mozilla-bmo1626236.patch
@ -1,86 +0,0 @@
-# HG changeset patch
-# User msirringhaus@suse.de
-# Date 1582805876 -3600
-#      Thu Feb 27 13:17:56 2020 +0100
-# Node ID cc3d09abea31068e57f1ab918782f9f86fc6a158
-# Parent  9cd90914846f667f18babc491a74c164ae5d6e9f
-imported patch decoder_workaround.patch
-
-diff -r 9cd90914846f image/decoders/nsGIFDecoder2.cpp
--- a/image/decoders/nsGIFDecoder2.cpp	Thu Feb 27 12:57:14 2020 +0100
-+++ b/image/decoders/nsGIFDecoder2.cpp	Fri Mar 27 13:06:18 2020 +0100
-@@ -422,6 +422,9 @@
-   MOZ_ASSERT(mSwizzleFn);
-   uint8_t* data = reinterpret_cast<uint8_t*>(aColormap);
-   mSwizzleFn(data, data, aColors);
-+#if MOZ_BIG_ENDIAN()
-+  SwizzleRow(SurfaceFormat::A8R8G8B8, SurfaceFormat::B8G8R8A8)(data, data, aColors);
-+#endif
- }
- 
- LexerResult nsGIFDecoder2::DoDecode(SourceBufferIterator& aIterator,
-diff -r 9cd90914846f image/decoders/nsJPEGDecoder.cpp
--- a/image/decoders/nsJPEGDecoder.cpp	Thu Feb 27 12:57:14 2020 +0100
-+++ b/image/decoders/nsJPEGDecoder.cpp	Fri Mar 27 13:06:18 2020 +0100
-@@ -263,6 +263,9 @@
-         case JCS_YCbCr:
-           // By default, we will output directly to BGRA. If we need to apply
-           // special color transforms, this may change.
-+#if MOZ_BIG_ENDIAN()
-+          mInfo.out_color_space = MOZ_JCS_EXT_NATIVE_ENDIAN_XRGB;
-+#else
-           switch (SurfaceFormat::OS_RGBX) {
-             case SurfaceFormat::B8G8R8X8:
-               mInfo.out_color_space = JCS_EXT_BGRX;
-@@ -277,6 +280,7 @@
-               mState = JPEG_ERROR;
-               return Transition::TerminateFailure();
-           }
-+#endif
-           break;
-         case JCS_CMYK:
-         case JCS_YCCK:
-diff -r 9cd90914846f image/decoders/nsPNGDecoder.cpp
--- a/image/decoders/nsPNGDecoder.cpp	Thu Feb 27 12:57:14 2020 +0100
-+++ b/image/decoders/nsPNGDecoder.cpp	Fri Mar 27 13:06:18 2020 +0100
-@@ -361,7 +361,7 @@
-                                    IResumable* aOnResume) {
-   MOZ_ASSERT(!HasError(), "Shouldn't call DoDecode after error!");
- 
-  return mLexer.Lex(aIterator, aOnResume,
-+  LexerResult res = mLexer.Lex(aIterator, aOnResume,
-                     [=](State aState, const char* aData, size_t aLength) {
-                       switch (aState) {
-                         case State::PNG_DATA:
-@@ -371,6 +371,14 @@
-                       }
-                       MOZ_CRASH("Unknown State");
-                     });
-+
-+#if MOZ_BIG_ENDIAN()
-+  if(res.is<TerminalState>() && res.as<TerminalState>() == TerminalState::SUCCESS) {
-+      NativeEndian::swapToLittleEndianInPlace<uint32_t>((uint32_t*)(mImageData), mImageDataLength / 4);
-+  }
-+#endif
-+
-+  return res;
- }
- 
- LexerTransition<nsPNGDecoder::State> nsPNGDecoder::ReadPNGData(
-diff -r 9cd90914846f image/decoders/nsWebPDecoder.cpp
--- a/image/decoders/nsWebPDecoder.cpp	Thu Feb 27 12:57:14 2020 +0100
-+++ b/image/decoders/nsWebPDecoder.cpp	Fri Mar 27 13:06:18 2020 +0100
-@@ -237,7 +237,12 @@
-   // WebP doesn't guarantee that the alpha generated matches the hint in the
-   // header, so we always need to claim the input is BGRA. If the output is
-   // BGRX, swizzling will mask off the alpha channel.
-+#if MOZ_BIG_ENDIAN()
-+  mBuffer.colorspace = MODE_ARGB;
-+  SurfaceFormat inFormat = mFormat;
-+#else
-   SurfaceFormat inFormat = SurfaceFormat::OS_RGBA;
-+#endif
- 
-   SurfacePipeFlags pipeFlags = SurfacePipeFlags();
-   if (mFormat == SurfaceFormat::OS_RGBA &&
-
--- a/mozilla-bmo849632.patch
+++ b/mozilla-bmo849632.patch
@ -1,16 +1,24 @@
+# HG changeset patch
+# Parent  3de59fe1b8708c01e134ce698c4232b8a854f617
 Problem:  webGL sites are displayed in the wrong color (usually blue-ish)
 Solution: Problem is with skia once again. Output of webgl seems endian-correct, but skia only
          knows how to deal with little endian.
          So we swizzle the output of webgl after reading it from readpixels()
 Note:     This does not fix all webGL sites, but is a step in the right direction
-diff -r 6b017d3e9733 gfx/gl/GLContext.h
--- a/gfx/gl/GLContext.h    Mon Sep 09 10:04:05 2019 +0200
-+++ b/gfx/gl/GLContext.h    Wed Nov 13 17:13:04 2019 +0100
-@@ -1551,6 +1551,13 @@
+
+diff --git a/gfx/gl/GLContext.h b/gfx/gl/GLContext.h
+--- a/gfx/gl/GLContext.h
+++ b/gfx/gl/GLContext.h
+@@ -1548,16 +1548,23 @@ class GLContext : public GenericAtomicRe
+     AFTER_GL_CALL;
+   }
+ 
+   void raw_fReadPixels(GLint x, GLint y, GLsizei width, GLsizei height,
+                        GLenum format, GLenum type, GLvoid* pixels) {
     BEFORE_GL_CALL;
     mSymbols.fReadPixels(x, y, width, height, format, type, pixels);
     OnSyncCall();
-+#if MOZ_BIG_ENDIAN
+#if MOZ_BIG_ENDIAN()
 +    uint8_t* itr = (uint8_t*)pixels;
 +    for (GLsizei i = 0; i < width * height; i++) {
 +      NativeEndian::swapToLittleEndianInPlace((uint32_t*)itr, 1);
@ -21,3 +29,7 @@ diff -r 6b017d3e9733 gfx/gl/GLContext.h
     mHeavyGLCallsSinceLastFlush = true;
   }
 
+   void fReadPixels(GLint x, GLint y, GLsizei width, GLsizei height,
+                    GLenum format, GLenum type, GLvoid* pixels);
+ 
+  public:
--- a/mozilla-bmo998749.patch
+++ b/mozilla-bmo998749.patch
@ -27,4 +27,3 @@ diff -r 506857dace0a -r 34676feac1a5 gfx/2d/FilterProcessing.h
 
 class FilterProcessing {
  public:
-
--- a/mozilla-build-arm.patch
+++ b/mozilla-build-arm.patch
@ -0,0 +1,14 @@
+diff -up firefox-52.0/gfx/skia/skia/include/core/SkPreConfig.h.arm firefox-52.0/gfx/skia/skia/include/core/SkPreConfig.h
+--- firefox-52.0/gfx/skia/skia/include/core/SkPreConfig.h.arm	2017-03-03 13:53:52.480754536 +0100
+++ firefox-52.0/gfx/skia/skia/include/core/SkPreConfig.h	2017-03-03 13:56:01.476018102 +0100
+@@ -203,6 +203,10 @@
+     #define SK_ARM_HAS_CRC32
+ #endif
+ 
+#if defined(__aarch64__)
+    #undef SK_ARM_HAS_NEON
+#endif
+
+ //////////////////////////////////////////////////////////////////////
+ 
+ #if !defined(SKIA_IMPLEMENTATION)
--- a/mozilla-s390-context.patch
+++ b/mozilla-s390-context.patch
@ -3,16 +3,21 @@
 # Date 1558452408 -7200
 #      Tue May 21 17:26:48 2019 +0200
 # Node ID 602e92722e765a3c238d3b96b26c0c8063b5eeb4
-# Parent  a3cc550d25e3a04d906f516928cbcbe50efd585e
+# Parent  136e1f2c44a3099b3e49a576fa62c8ad77aa431e
 [mq]: mozilla-s390-context.patch

-diff -r a3cc550d25e3 -r 602e92722e76 js/src/wasm/WasmSignalHandlers.cpp
--- a/js/src/wasm/WasmSignalHandlers.cpp	Tue May 21 17:22:06 2019 +0200
-+++ b/js/src/wasm/WasmSignalHandlers.cpp	Tue May 21 17:26:48 2019 +0200
-@@ -154,6 +154,10 @@
- #    define R01_sig(p) ((p)->uc_mcontext.gp_regs[1])
+diff --git a/js/src/wasm/WasmSignalHandlers.cpp b/js/src/wasm/WasmSignalHandlers.cpp
+--- a/js/src/wasm/WasmSignalHandlers.cpp
+++ b/js/src/wasm/WasmSignalHandlers.cpp
+@@ -157,16 +157,20 @@ using mozilla::DebugOnly;
 #      define R32_sig(p) ((p)->uc_mcontext.gp_regs[32])
 #    endif
+ #    if defined(__linux__) && defined(__loongarch__)
+ #      define EPC_sig(p) ((p)->uc_mcontext.pc)
+ #      define RRA_sig(p) ((p)->uc_mcontext.gregs[1])
+ #      define RSP_sig(p) ((p)->uc_mcontext.gregs[3])
+ #      define RFP_sig(p) ((p)->uc_mcontext.gregs[22])
+ #    endif
 +#  if defined(__linux__) && defined(__s390x__)
 +#    define GR_sig(p,x) ((p)->uc_mcontext.gregs[x])
 +#    define PSWa_sig(p) ((p)->uc_mcontext.psw.addr)
@ -20,17 +25,29 @@ diff -r a3cc550d25e3 -r 602e92722e76 js/src/wasm/WasmSignalHandlers.cpp
 #  elif defined(__NetBSD__)
 #    define EIP_sig(p) ((p)->uc_mcontext.__gregs[_REG_EIP])
 #    define EBP_sig(p) ((p)->uc_mcontext.__gregs[_REG_EBP])
-@@ -385,8 +389,13 @@
+ #    define ESP_sig(p) ((p)->uc_mcontext.__gregs[_REG_ESP])
+ #    define RIP_sig(p) ((p)->uc_mcontext.__gregs[_REG_RIP])
+ #    define RSP_sig(p) ((p)->uc_mcontext.__gregs[_REG_RSP])
+ #    define RBP_sig(p) ((p)->uc_mcontext.__gregs[_REG_RBP])
+ #    define R11_sig(p) ((p)->uc_mcontext.__gregs[_REG_R11])
+@@ -399,16 +403,20 @@ struct macos_aarch64_context {
 #    define PC_sig(p) R32_sig(p)
 #    define SP_sig(p) R01_sig(p)
 #    define FP_sig(p) R01_sig(p)
+ #  elif defined(__loongarch__)
+ #    define PC_sig(p) EPC_sig(p)
+ #    define FP_sig(p) RFP_sig(p)
+ #    define SP_sig(p) RSP_sig(p)
+ #    define LR_sig(p) RRA_sig(p)
 +#  elif defined(__s390x__)
 +#    define PC_sig(p) PSWa_sig(p)
 +#    define SP_sig(p) GR_sig(p, 15)
 +#    define FP_sig(p) GR_sig(p, 11)
 #  endif
 
-+
 static void SetContextPC(CONTEXT* context, uint8_t* pc) {
 #  ifdef PC_sig
   *reinterpret_cast<uint8_t**>(&PC_sig(context)) = pc;
+ #  else
+   MOZ_CRASH();
+ #  endif
--- a/mozilla-s390x-skia-gradient.patch
+++ b/mozilla-s390x-skia-gradient.patch
@ -49,4 +49,3 @@ diff -r acf59ea86dd1 gfx/skia/skia/src/shaders/gradients/Sk4fLinearGradient.cpp
     }
 }
 
-
--- a/3
+++ b/3
@ -1,3 +1,2 @@
 #!/bin/sh
-#exec /usr/bin/node "$@" 2>&1 | cat -
-exec $MOZ_NODEJS "$@" 2>&1 | cat -
+exec node "$@" 2>&1 | cat -
--- a/one_swizzle_to_rule_them_all.patch
+++ b/one_swizzle_to_rule_them_all.patch
@ -0,0 +1,34 @@
+# HG changeset patch
+# User M. Sirringhaus <msirringhaus@suse.de>
+# Date 1645518286 -3600
+#      Tue Feb 22 09:24:46 2022 +0100
+# Node ID 494640792b4677f6462e95b90a54a4e22aeb738b
+# Parent  81832d035e101471dcf52dd91de287268add7a91
+imported patch one_swizzle_to_rule_them_all.patch
+
+Index: firefox-102.0/gfx/webrender_bindings/RenderCompositorSWGL.cpp
+===================================================================
+--- firefox-102.0.orig/gfx/webrender_bindings/RenderCompositorSWGL.cpp
+++ firefox-102.0/gfx/webrender_bindings/RenderCompositorSWGL.cpp
+@@ -7,6 +7,7 @@
+ #include "RenderCompositorSWGL.h"
+ 
+ #include "mozilla/gfx/Logging.h"
+#include "mozilla/gfx/Swizzle.h"
+ #include "mozilla/widget/CompositorWidget.h"
+ 
+ #ifdef MOZ_WIDGET_GTK
+@@ -235,6 +237,13 @@ void RenderCompositorSWGL::CommitMappedB
+   }
+   mDT->Flush();
+ 
+#if MOZ_BIG_ENDIAN()
+  // One swizzle to rule them all.
+  gfx::SwizzleData(mMappedData, mMappedStride, gfx::SurfaceFormat::B8G8R8A8,
+                   mMappedData, mMappedStride, gfx::SurfaceFormat::A8R8G8B8,
+                   mDT->GetSize());
+#endif
+
+   // Done with the DT. Hand it back to the widget and clear out any trace of it.
+   mWidget->EndRemoteDrawingInRegion(mDT, mDirtyRegion);
+   mDirtyRegion.SetEmpty();
--- a/pgo.patch
+++ b/pgo.patch
@ -0,0 +1,115 @@
+diff -up firefox-99.0/build/moz.configure/lto-pgo.configure.pgo firefox-99.0/build/moz.configure/lto-pgo.configure
+--- firefox-99.0/build/moz.configure/lto-pgo.configure.pgo	2022-03-31 01:24:38.000000000 +0200
+++ firefox-99.0/build/moz.configure/lto-pgo.configure	2022-04-04 10:15:45.387694143 +0200
+@@ -247,8 +247,8 @@ def lto(
+             cflags.append("-flto")
+             ldflags.append("-flto")
+         else:
+-            cflags.append("-flto=thin")
+-            ldflags.append("-flto=thin")
+            cflags.append("-flto")
+            ldflags.append("-flto")
+ 
+         if target.os == "Android" and value == "cross":
+             # Work around https://github.com/rust-lang/rust/issues/90088
+@@ -264,7 +264,7 @@ def lto(
+         if value == "full":
+             cflags.append("-flto")
+         else:
+-            cflags.append("-flto=thin")
+            cflags.append("-flto")
+         # With clang-cl, -flto can only be used with -c or -fuse-ld=lld.
+         # AC_TRY_LINKs during configure don't have -c, so pass -fuse-ld=lld.
+         cflags.append("-fuse-ld=lld")
+diff -up firefox-99.0/build/pgo/profileserver.py.pgo firefox-99.0/build/pgo/profileserver.py
+--- firefox-99.0/build/pgo/profileserver.py.pgo	2022-03-31 01:24:38.000000000 +0200
+++ firefox-99.0/build/pgo/profileserver.py	2022-04-04 10:15:45.387694143 +0200
+@@ -11,7 +11,7 @@ import glob
+ import subprocess
+ 
+ import mozcrash
+-from mozbuild.base import MozbuildObject, BinaryNotFoundException
+from mozbuild.base import MozbuildObject, BinaryNotFoundException, BuildEnvironmentNotFoundException
+ from mozfile import TemporaryDirectory
+ from mozhttpd import MozHttpd
+ from mozprofile import FirefoxProfile, Preferences
+@@ -87,9 +87,22 @@ if __name__ == "__main__":
+     locations = ServerLocations()
+     locations.add_host(host="127.0.0.1", port=PORT, options="primary,privileged")
+ 
+-    old_profraw_files = glob.glob("*.profraw")
+-    for f in old_profraw_files:
+-        os.remove(f)
+    using_gcc = False
+    try:
+        if build.config_environment.substs.get('CC_TYPE') == 'gcc':
+            using_gcc = True
+    except BuildEnvironmentNotFoundException:
+        pass
+
+    if using_gcc:
+        for dirpath, _, filenames in os.walk('.'):
+            for f in filenames:
+                if f.endswith('.gcda'):
+                    os.remove(os.path.join(dirpath, f))
+    else:
+        old_profraw_files = glob.glob('*.profraw')
+        for f in old_profraw_files:
+            os.remove(f)
+ 
+     with TemporaryDirectory() as profilePath:
+         # TODO: refactor this into mozprofile
+@@ -212,6 +225,10 @@ if __name__ == "__main__":
+             print("Firefox exited successfully, but produced a crashreport")
+             sys.exit(1)
+ 
+        print('Copying profile data....')
+        os.system('pwd');
+        os.system('tar cf profdata.tar.gz `find . -name "*.gcda"`; cd ..; tar xf instrumented/profdata.tar.gz;');
+
+         llvm_profdata = env.get("LLVM_PROFDATA")
+         if llvm_profdata:
+             profraw_files = glob.glob("*.profraw")
+diff -up firefox-99.0/build/unix/mozconfig.unix.pgo firefox-99.0/build/unix/mozconfig.unix
+--- firefox-99.0/build/unix/mozconfig.unix.pgo	2022-03-31 01:24:38.000000000 +0200
+++ firefox-99.0/build/unix/mozconfig.unix	2022-04-04 10:15:45.387694143 +0200
+@@ -4,6 +4,15 @@ if [ -n "$FORCE_GCC" ]; then
+     CC="$MOZ_FETCHES_DIR/gcc/bin/gcc"
+     CXX="$MOZ_FETCHES_DIR/gcc/bin/g++"
+ 
+    if [ -n "$MOZ_PGO" ]; then
+        if [ -z "$USE_ARTIFACT" ]; then
+            ac_add_options --enable-lto
+        fi
+        export AR="$topsrcdir/gcc/bin/gcc-ar"
+        export NM="$topsrcdir/gcc/bin/gcc-nm"
+        export RANLIB="$topsrcdir/gcc/bin/gcc-ranlib"
+    fi
+
+     # We want to make sure we use binutils and other binaries in the tooltool
+     # package.
+     mk_add_options "export PATH=$MOZ_FETCHES_DIR/gcc/bin:$PATH"
+diff -up firefox-99.0/extensions/spellcheck/src/moz.build.pgo firefox-99.0/extensions/spellcheck/src/moz.build
+--- firefox-99.0/extensions/spellcheck/src/moz.build.pgo	2022-03-31 01:24:50.000000000 +0200
+++ firefox-99.0/extensions/spellcheck/src/moz.build	2022-04-04 10:15:45.387694143 +0200
+@@ -28,3 +28,5 @@ EXPORTS.mozilla += [
+     "mozInlineSpellChecker.h",
+     "mozSpellChecker.h",
+ ]
+
+CXXFLAGS += ['-fno-devirtualize']
+diff -up firefox-99.0/toolkit/components/terminator/nsTerminator.cpp.pgo firefox-99.0/toolkit/components/terminator/nsTerminator.cpp
+--- firefox-99.0/toolkit/components/terminator/nsTerminator.cpp.pgo	2022-04-04 10:15:45.387694143 +0200
+++ firefox-99.0/toolkit/components/terminator/nsTerminator.cpp	2022-04-04 10:19:07.022239556 +0200
+@@ -466,6 +466,11 @@ void nsTerminator::StartWatchdog() {
+   }
+ #endif
+ 
+  // Disable watchdog for PGO train builds - writting profile information at
+  // exit may take time and it is better to make build hang rather than
+  // silently produce poorly performing binary.
+  crashAfterMS = INT32_MAX;
+
+   UniquePtr<Options> options(new Options());
+   // crashAfterTicks is guaranteed to be > 0 as
+   // crashAfterMS >= ADDITIONAL_WAIT_BEFORE_CRASH_MS >> HEARTBEAT_INTERVAL_MS
--- a/python-missing-utimensat.patch
+++ b/python-missing-utimensat.patch
@ -1,12 +0,0 @@
-diff -up python3/Python-3.6.8/configure.old python3/Python-3.6.8/configure
--- Python-3.6.8/configure.old	2019-10-01 12:56:35.074551835 +0200
-+++ Python-3.6.8/configure	2019-10-01 12:56:44.240517798 +0200
-@@ -11438,7 +11438,7 @@ for ac_func in alarm accept4 setitimer g
-  sigaction sigaltstack siginterrupt sigpending sigrelse \
-  sigtimedwait sigwait sigwaitinfo snprintf strftime strlcpy symlinkat sync \
-  sysconf tcgetpgrp tcsetpgrp tempnam timegm times tmpfile tmpnam tmpnam_r \
- truncate uname unlinkat unsetenv utimensat utimes waitid waitpid wait3 wait4 \
-+ truncate uname unlinkat unsetenv utimes waitid waitpid wait3 wait4 \
-  wcscoll wcsftime wcsxfrm wmemcmp writev _getpty
- do :
-   as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
--- a/rhbz-1219542-s390-build.patch
+++ b/rhbz-1219542-s390-build.patch
@ -0,0 +1,23 @@
+diff -up firefox-55.0/js/src/old-configure.in.rhbz-1219542-s390 firefox-55.0/js/src/old-configure.in
+--- firefox-55.0/js/src/old-configure.in.rhbz-1219542-s390	2017-07-31 18:20:48.000000000 +0200
+++ firefox-55.0/js/src/old-configure.in	2017-08-02 14:31:32.190243669 +0200
+@@ -541,7 +541,7 @@ case "$host" in
+ 
+ *-linux*|*-kfreebsd*-gnu|*-gnu*)
+     HOST_CFLAGS="$HOST_CFLAGS -DXP_UNIX"
+-    HOST_OPTIMIZE_FLAGS="${HOST_OPTIMIZE_FLAGS=-O3}"
+    HOST_OPTIMIZE_FLAGS="${HOST_OPTIMIZE_FLAGS=-O1}"
+     ;;
+ 
+ *)
+@@ -617,8 +617,8 @@ case "$target" in
+ 
+ *-*linux*)
+     if test "$GNU_CC" -o "$GNU_CXX"; then
+-        MOZ_PGO_OPTIMIZE_FLAGS="-O3"
+-        MOZ_OPTIMIZE_FLAGS="-O3"
+        MOZ_PGO_OPTIMIZE_FLAGS="-O1"
+        MOZ_OPTIMIZE_FLAGS="-O1"
+         if test -z "$CLANG_CC"; then
+            MOZ_OPTIMIZE_FLAGS="-freorder-blocks $MOZ_OPTIMIZE_FLAGS"
+         fi
--- a/rhbz-1354671.patch
+++ b/rhbz-1354671.patch
@ -0,0 +1,12 @@
+diff -up firefox-70.0/layout/base/PresShell.h.1354671 firefox-70.0/layout/base/PresShell.h
+--- firefox-70.0/layout/base/PresShell.h.1354671	2019-10-22 12:33:12.987775587 +0200
+++ firefox-70.0/layout/base/PresShell.h	2019-10-22 12:36:39.999366086 +0200
+@@ -257,7 +257,7 @@ class PresShell final : public nsStubDoc
+    * to the same aSize value.  AllocateFrame is infallible and will abort
+    * on out-of-memory.
+    */
+-  void* AllocateFrame(nsQueryFrame::FrameIID aID, size_t aSize) {
+  void* __attribute__((optimize("no-lifetime-dse"))) AllocateFrame(nsQueryFrame::FrameIID aID, size_t aSize) {
+ #define FRAME_ID(classname, ...)                                  \
+   static_assert(size_t(nsQueryFrame::FrameIID::classname##_id) == \
+                     size_t(eArenaObjectID_##classname),           \
--- a/10
+++ b/10
@ -1,5 +1,5 @@
-SHA512 (cbindgen-vendor.tar.xz) = 9cb4a590584c53386a14deb1f1faf7b67ff8f312eff4a8dccab710738183c504387d69fa660021b495ed61603f4df1db689f35234c61e2e886962e40aab20c95
-SHA512 (nspr-4.32.0-1.el8_1.src.rpm) = c181a19bc24aeb62aed1745a6a43ae8aa2ee0d903aa16cb6ec7d385286e60f6426049cc9669459434377a215f329502ffe6fc48a1edc52d5b3283ebc259e9dca
-SHA512 (nss-3.67.0-7.el8_1.src.rpm) = 15361c596fc4f2e4afc7d40d48c37886cad93849821d2bcad8213f34035a6951be127b436b6799083f2b4adb18a68870dbe273177d2d670eda9cc9680e6d6f63
-SHA512 (thunderbird-91.8.0.processed-source.tar.xz) = 4f469bb13f23d1170bbd9b52dd1323896b8da02a74c9085072fdc475054dcf2f5e69be08259edc0d466dc482974290ddb3270615e78487e6aa5aef95bd029867
-SHA512 (thunderbird-langpacks-91.8.0-20220405.tar.xz) = 9d194379c25afb2d4e26dabd16a94b30b26f386dbe2970a9e1d32a5e9cf923f4e430f275f7f1bb185e34f1170344dbea86dbe8c80411c6c898e4a848fbfd922d
+SHA512 (cbindgen-vendor.tar.xz) = 590e27b6c093a5c1bd839ca39c68537097d0849087a4a385ee6d7b180e9ceadbbb8974fa997f5f75af03e2c243a2f232d0d4c4c46e253ea464521b76c6886067
+SHA512 (nspr-4.34.0-3.el8_1.src.rpm) = fe4715694c297cd8cefa577946358a90103bde73e78a3fdf13d202a3791736e8a48fbece09ee3d15f6d81ae051e26d96400b03bb6bf8630715746c5e1a643543
+SHA512 (nss-3.79.0-6.el8_1.src.rpm) = 5887d0f306045adf7c6f3389840fff2e2732e5a15ec5e22cf885e578105b54d9e753c237e7730c2d3f0990728b10123c653e8d18a8b8dd0174bfb5b443eab7ef
+SHA512 (thunderbird-102.6.0.processed-source.tar.xz) = 6ee16b1e37579e7760ff728fdc94be4754f610d39881cc462ae681b74dee313955c07fed7ea7ee132d5ca36b17f36bdfe46730b5af6aab6ff4e2334f301e351d
+SHA512 (thunderbird-langpacks-102.6.0-20221213.tar.xz) = d6c807f4fe9eac61a57c26f07ef3d2844fdf836d52fd01f2d5373242a4ecf691c26eb62ec3812adeca73b21e4903eca88e4d303cef0c96b86de428f4fdde1b38
--- a/svg-rendering.patch
+++ b/svg-rendering.patch
@ -0,0 +1,29 @@
+# HG changeset patch
+# User M. Sirringhaus <msirringhaus@suse.de>
+# Date 1645518286 -3600
+#      Tue Feb 22 09:24:46 2022 +0100
+# Node ID 81832d035e101471dcf52dd91de287268add7a91
+# Parent  66f7ce16eb4965108687280e5443edd610631efb
+imported patch svg-rendering.patch
+
+diff --git a/image/imgFrame.cpp b/image/imgFrame.cpp
+--- a/image/imgFrame.cpp
+++ b/image/imgFrame.cpp
+@@ -372,6 +372,17 @@ nsresult imgFrame::InitWithDrawable(gfxD
+     return NS_ERROR_OUT_OF_MEMORY;
+   }
+ 
+#if MOZ_BIG_ENDIAN()
+  if (aBackend == gfx::BackendType::SKIA && canUseDataSurface) {
+      // SKIA is lying about what format it returns on big endian
+      for (int ii=0; ii < mRawSurface->GetSize().Height()*mRawSurface->Stride() / 4; ++ii) {
+        uint32_t *vals = (uint32_t*)(mRawSurface->GetData());
+        uint32_t val = ((vals[ii] << 8) & 0xFF00FF00 ) | ((vals[ii] >> 8) & 0xFF00FF );
+        vals[ii] = (val << 16) | (val >> 16);
+      }
+  }
+#endif
+
+   if (!canUseDataSurface) {
+     // We used an offscreen surface, which is an "optimized" surface from
+     // imgFrame's perspective.
--- a/8
+++ b/8
@ -12,19 +12,23 @@ ac_add_options --enable-chrome-format=omni
 ac_add_options --enable-pulseaudio
 ac_add_options --without-system-icu
 ac_add_options --enable-release
-ac_add_options --update-channel=release
 ac_add_options --allow-addon-sideload
 ac_add_options --with-system-jpeg
 ac_add_options --enable-js-shell
 ac_add_options --with-unsigned-addon-scopes=app,system
-
+ac_add_options --without-sysroot
+# investigate this one:
+ac_add_options --without-wasm-sandboxed-libraries
 ac_add_options --with-mozilla-api-keyfile=../mozilla-api-key
 ac_add_options --with-google-location-service-api-keyfile=../google-api-key
 ac_add_options --with-google-safebrowsing-api-keyfile=../google-api-key
 ac_add_options --disable-crashreporter
+ac_add_options --enable-official-branding
+ac_add_options --disable-bootstrap

 export BUILD_OFFICIAL=1
 export MOZILLA_OFFICIAL=1
+export MOZ_UPDATE_CHANNEL=release
 mk_add_options BUILD_OFFICIAL=1
 mk_add_options MOZ_CO_PROJECT=mail
 mk_add_options MOZILLA_OFFICIAL=1
--- a/thunderbird-redhat-default-prefs.js.rhel7
+++ b/thunderbird-redhat-default-prefs.js.rhel7
--- a/thunderbird-symbolic.svg
+++ b/thunderbird-symbolic.svg
@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   width="16"
+   height="16"
+   viewBox="0 0 4.2333332 4.2333335"
+   version="1.1"
+   id="svg826"
+   inkscape:version="0.92+devel unknown"
+   sodipodi:docname="thunderbird-symbolic.svg">
+  <defs
+     id="defs820" />
+  <sodipodi:namedview
+     id="base"
+     pagecolor="#555753"
+     bordercolor="#666666"
+     borderopacity="1.0"
+     inkscape:pageopacity="1"
+     inkscape:pageshadow="2"
+     inkscape:zoom="32"
+     inkscape:cx="14.909311"
+     inkscape:cy="6.5299379"
+     inkscape:document-units="mm"
+     inkscape:current-layer="layer1"
+     inkscape:document-rotation="0"
+     showgrid="false"
+     units="px"
+     inkscape:window-width="1920"
+     inkscape:window-height="1136"
+     inkscape:window-x="1920"
+     inkscape:window-y="27"
+     inkscape:window-maximized="1"
+     inkscape:snap-global="true" />
+  <metadata
+     id="metadata823">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+        <dc:title></dc:title>
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <g
+     inkscape:label="Layer 1"
+     inkscape:groupmode="layer"
+     id="layer1"
+     transform="translate(0,-292.76664)">
+    <path
+       style="fill:#bebebe;fill-opacity:1;stroke-width:0.50472808;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:1.00945637, 3.02836921000000014"
+       d="M 6.2871094 0.6796875 C 5.4163558 0.91578892 4.8510898 1.5936957 4.5292969 2.1464844 C 2.421315 3.2450921 0.99225272 5.3610823 0.9921875 7.7949219 C 0.99477587 10.359489 2.3110205 12.446765 4.71875 13.445312 C 3.4595645 12.812546 2.2935825 11.525048 1.9707031 10.179688 C 1.7935937 9.4417327 1.7111632 8.3804473 1.7871094 7.8671875 C 2.0153769 8.1799434 2.3679623 8.3686337 2.6191406 8.3535156 C 2.4938628 8.2316259 2.1405878 7.2674351 2.2246094 6.7109375 C 2.3603578 5.8118257 3.1848776 4.5727304 3.6171875 4.3652344 C 3.5950724 4.1994643 3.6227354 4.5729785 3.6347656 4.6757812 C 3.6727178 5.0001403 3.7890738 5.2722323 3.7246094 5.5625 C 3.6729882 5.7950165 3.4515893 6.0294455 3.4980469 6.4824219 C 3.5108599 6.6073731 3.6284702 6.8445848 3.7539062 6.9277344 C 3.7535036 6.9231566 3.7580261 6.9016692 3.7578125 6.8964844 C 4.1688563 6.4878098 4.2988638 6.3923311 4.8164062 6.1835938 C 5.3947783 5.9504725 5.7292796 5.4840924 6.5429688 5.3242188 C 7.1567719 5.2036518 7.7980995 5.4618768 8.4160156 5.4316406 C 8.9595412 5.4051839 9.6230469 5.3164062 9.6230469 5.3164062 C 9.6230469 5.3164062 10.529591 6.3734458 10.554688 8.0839844 C 10.561372 8.5399466 10.393117 9.2581935 10.080078 9.6074219 C 10.10866 9.6301636 10.842076 9.8181331 11.496094 8.9296875 L 11.496094 8.9277344 C 11.500502 8.9217421 11.509138 8.9123452 11.513672 8.90625 C 11.511804 8.9162203 11.509634 8.919117 11.507812 8.9296875 C 11.082979 11.395346 10.343305 12.786026 9.3730469 13.716797 L 9.3652344 13.716797 C 9.1593686 13.914136 8.9415569 14.089651 8.7167969 14.253906 C 8.6515695 14.300524 8.584386 14.344389 8.5175781 14.388672 C 8.3185959 14.523496 8.1179918 14.6549 7.9042969 14.771484 C 7.453226 15.017472 9.0852392 14.946167 10.126953 14.476562 C 10.157938 14.470814 10.189917 14.46715 10.220703 14.460938 C 9.8033537 14.744465 9.3535156 15 9.3535156 15 C 9.3535156 15 10.890634 14.899538 11.974609 13.804688 C 11.975453 13.803262 11.975783 13.800425 11.976562 13.798828 C 13.818222 12.736706 15.007176 10.687802 15.007812 8.21875 C 15.005272 5.4392694 13.347542 2.9608845 10.865234 2.0253906 C 9.9215437 1.5797455 8.881353 1.3464382 7.8261719 1.34375 C 7.5325222 1.3437527 7.2448312 1.3664635 6.9609375 1.4003906 C 6.9469035 1.339967 6.9417802 1.323023 6.9726562 1.203125 C 6.8504944 1.2378967 6.8589251 1.2466706 6.7519531 1.2988281 C 6.7527631 1.1850643 6.7593232 1.2159555 6.7519531 1.0976562 C 6.5269885 1.1694673 6.5079647 1.1993654 6.3398438 1.3085938 C 6.3964573 1.0867355 6.399826 1.1278526 6.5527344 0.88671875 C 6.3493259 0.94186206 6.0726487 1.1030774 5.7460938 1.4511719 C 5.8509855 1.1114301 5.9907037 1.0292938 6.2871094 0.6796875 z "
+       transform="matrix(0.26458333,0,0,0.26458333,0,292.76664)"
+       id="path24330" />
+    <path
+       style="color:#000000;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:medium;line-height:normal;font-family:sans-serif;font-variant-ligatures:normal;font-variant-position:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-alternates:normal;font-variant-east-asian:normal;font-feature-settings:normal;text-indent:0;text-align:start;text-decoration:none;text-decoration-line:none;text-decoration-style:solid;text-decoration-color:#000000;letter-spacing:normal;word-spacing:normal;text-transform:none;writing-mode:lr-tb;direction:ltr;text-orientation:mixed;dominant-baseline:auto;baseline-shift:baseline;text-anchor:start;white-space:normal;shape-padding:0;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;vector-effect:none;fill:#bebebe;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:0.26511249;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;filter-blend-mode:normal;filter-gaussianBlur-deviation:0;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate;opacity:1"
+       d="M 0.81054688 293.97852 L 0.59179688 294.12695 L 1.4453125 295.40234 L 2.9335938 294.85156 L 2.8417969 294.60352 L 1.5507812 295.08008 L 0.81054688 293.97852 z "
+       id="path24387" />
+    <path
+       style="color:#000000;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:medium;line-height:normal;font-family:sans-serif;font-variant-ligatures:normal;font-variant-position:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-alternates:normal;font-variant-east-asian:normal;font-feature-settings:normal;text-indent:0;text-align:start;text-decoration:none;text-decoration-line:none;text-decoration-style:solid;text-decoration-color:#000000;letter-spacing:normal;word-spacing:normal;text-transform:none;writing-mode:lr-tb;direction:ltr;text-orientation:mixed;dominant-baseline:auto;baseline-shift:baseline;text-anchor:start;white-space:normal;shape-padding:0;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;vector-effect:none;fill:#bebebe;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:0.99999994px;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+       d="m 1.7871094,9.8730469 0.1210937,0.5820311 -0.1230469,-0.02344 c 0,0 0.2754046,0.874485 0.8561662,1.437975 0.5080908,0.49319 0.9335266,1.121624 2.1243026,1.601087 C 4.3317049,12.663641 4.1812012,12.346136 3.9980469,11.6875 l 0.2128906,0.07031 C 4.5424397,12.049861 4.8536251,12.30456 5.5800781,12.4375 5.4786992,12.266213 5.448324,12.238135 5.3847656,12.142578 l 4.7363284,1.554688 0.316406,-0.945313 z"
+       transform="matrix(0.26458333,0,0,0.26458333,0,292.76664)"
+       id="path24379"
+       inkscape:connector-curvature="0"
+       sodipodi:nodetypes="cccccccccccc" />
+  </g>
+</svg>
--- a/thunderbird.sh.in
+++ b/thunderbird.sh.in
@ -35,6 +35,22 @@ MOZ_PROGRAM="$MOZ_DIST_BIN/thunderbird"
 MOZ_LANGPACKS_DIR="$MOZ_DIST_BIN/langpacks"
 MOZ_EXTENSIONS_PROFILE_DIR="$HOME/.mozilla/extensions/{3550f703-e582-4d05-9a08-453d09bdfdc6}"

+##
+## Enable Wayland backend?
+##
+%DISABLE_WAYLAND_PLACEHOLDER%
+
+if ! [ $MOZ_DISABLE_WAYLAND ] && [ "$WAYLAND_DISPLAY" ]; then
+  if [ "$XDG_CURRENT_DESKTOP" == "GNOME" ]; then
+    export MOZ_ENABLE_WAYLAND=1
+  fi
+##  Enable Wayland on KDE/Sway
+##
+  if [ "$XDG_SESSION_TYPE" == "wayland" ]; then
+    export MOZ_ENABLE_WAYLAND=1
+  fi
+fi
+
 ##
 ## Set MOZ_ENABLE_PANGO is no longer used because Pango is enabled by default
 ## you may use MOZ_DISABLE_PANGO=1 to force disabling of pango
@ -123,23 +139,4 @@ fi
 NSS_SSL_CBC_RANDOM_IV=${NSS_SSL_CBC_RANDOM_IV-1}
 export NSS_SSL_CBC_RANDOM_IV

-# Linux version specific environment variables
-%RHEL_ENV_VARS%
-
-# Make sure at-spi-bus is running
-if ! dbus-send --session            \
-     --dest=org.freedesktop.DBus    \
-     --type=method_call             \
-     --print-reply                  \
-     /org/freedesktop/DBus          \
-     org.freedesktop.DBus.ListNames \
-     | grep org.a11y.Bus > /dev/null; then
-    if [ -f "$MOZ_LIB_DIR/firefox/bundled/libexec/at-spi-bus-launcher" ]; then
-        echo "Starting a11y dbus service..."
-        $MOZ_LIB_DIR/firefox/bundled/libexec/at-spi-bus-launcher &
-    else
-        echo "Running without a11y support!"
-    fi
-fi
-
 exec $MOZ_PROGRAM "$@"
--- a/thunderbird.spec
+++ b/thunderbird.spec