- Mozilla Thunderbird 78.9.1

* Support recipient aliases for OpenPGP encryption
  * The key and signature parts of the message security popup on a
    received message could not be selected for copy/paste
  * Various UX and theme improvements
  MFSA 2021-13
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh mechanism
    to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used to
    confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaThunderbird?expand=0&rev=584

MozillaThunderbird.changes

@@ -1,3 +1,22 @@
+-------------------------------------------------------------------
+Sat Apr 10 11:39:37 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>
+
+- Mozilla Thunderbird 78.9.1
+  * Support recipient aliases for OpenPGP encryption
+  * The key and signature parts of the message security popup on a
+    received message could not be selected for copy/paste
+  * Various UX and theme improvements
+  MFSA 2021-13
+  * CVE-2021-23991 (bmo#1673240)
+    An attacker may use Thunderbird's OpenPGP key refresh mechanism
+    to poison an existing key
+  * MOZ-2021-23992 (bmo#1666236)
+    A crafted OpenPGP key with an invalid user ID could be used to
+    confuse the user
+  * CVE-2021-23993 (bmo#1666360)
+    Inability to send encrypted OpenPGP email after importing a
+    crafted OpenPGP key
+
 -------------------------------------------------------------------
 Sat Mar 20 09:20:00 UTC 2021 - Wolfgang Rosenauer <wr@rosenauer.org>
 

MozillaThunderbird.spec

@@ -26,8 +26,8 @@
 # major 69
 # mainver %major.99
 %define major          78
-%define mainver        %major.9.0
+%define mainver        %major.9.1
-%define orig_version   78.9.0
+%define orig_version   78.9.1
 %define orig_suffix    %{nil}
 %define update_channel release
 %define source_prefix  thunderbird-%{orig_version}
@@ -61,12 +61,13 @@
 %define __requires_exclude ^(libmoz.*|liblgpllibs.*|libxul.*|libldap.*|libldif.*|libprldap.*)$
 %define localize 1
 %define crashreporter 0
-%if 0%{?sle_version} > 150100
-# pipewire is too old on Leap <=15.1
-# Activate only on everything newer
 %define with_pipewire0_3 1
-%else
+%define wayland_supported 1
+%if 0%{?sle_version} > 0 && 0%{?sle_version} < 150200
+# pipewire is too old on Leap <=15.1
 %define with_pipewire0_3 0
+# Wayland is too old on Leap <=15.1 as well
+%define wayland_supported 0
 %endif
 
 Name:           %{pkgname}
@@ -399,10 +400,10 @@ ac_add_options --libdir=%{_libdir}
 ac_add_options --includedir=%{_includedir}
 ac_add_options --enable-application=comm/mail
 ac_add_options --enable-release
-%if 0%{?sle_version} < 150200
+%if 0%{wayland_supported}
-ac_add_options --enable-default-toolkit=cairo-gtk3
-%else
 ac_add_options --enable-default-toolkit=cairo-gtk3-wayland
+%else
+ac_add_options --enable-default-toolkit=cairo-gtk3
 %endif
 # bmo#1441155 - Disable the generation of Rust debug symbols on Linux32
 %ifarch %ix86 %arm
@@ -555,6 +556,7 @@ mkdir --parents %{buildroot}%{_bindir}/
 sed "s:%%PREFIX:%{_prefix}:g
 s:%%PROGDIR:%{progdir}:g
 s:%%APPNAME:%{progname}:g
+s:%%WAYLAND_SUPPORTED:%{wayland_supported}:g
 s:%%PROFILE:.thunderbird:g" \
   %{SOURCE3} > %{buildroot}%{progdir}/%{progname}.sh
 chmod 755 %{buildroot}%{progdir}/%{progname}.sh

mozilla.sh.in

@@ -81,8 +81,12 @@ export LIBXCB_ALLOW_SLOPPY_LOCK=1
 # disable Gnome crash dialog (doesn't make sense anyway)
 export GNOME_DISABLE_CRASH_DIALOG=1
 
+# Wayland
+# Only supported on newer systems
+WAYLAND_SUPPORTED=%WAYLAND_SUPPORTED
+
 # $XDG_SESSION_TYPE should contain either x11 or wayland
-if [ "$XDG_SESSION_TYPE" = "wayland" ]; then
+if [ $WAYLAND_SUPPORTED -eq 1 ] && [ "$XDG_SESSION_TYPE" = "wayland" ]; then
   export MOZ_ENABLE_WAYLAND=1
 fi
 

tar_stamps

@@ -1,10 +1,10 @@
 PRODUCT="thunderbird"
 CHANNEL="esr78"
-VERSION="78.9.0"
+VERSION="78.9.1"
 VERSION_SUFFIX=""
-PREV_VERSION="78.8.1"
+PREV_VERSION="78.9.0"
 PREV_VERSION_SUFFIX=""
 #SKIP_LOCALES="" # Uncomment to skip l10n and compare-locales-generation
 RELEASE_REPO="https://hg.mozilla.org/releases/comm-esr78"
-RELEASE_TAG="1a5cd2aa11de609116f258b413afcf113ed72f3a"
+RELEASE_TAG="f3f1f4a0e32abbc74dfac8c697044c10d0d25cad"
-RELEASE_TIMESTAMP="20210322094744"
+RELEASE_TIMESTAMP="20210406220621"

thunderbird-78.9.0.source.tar.xz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:8015a7f78b1644578f398b5ab670637c70890ab2bade35ba321d47d099ed3ac0
-size 353051768

thunderbird-78.9.0.source.tar.xz.asc

@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABCgAdFiEECXsxMHeuYqAvhNpN8aZmj7t9Vy4FAmBYvqEACgkQ8aZmj7t9
-Vy4sGQ/+NqKuAV9uNnY6OZsv8eZFRCwjLrpKj5YGnvZec/Qw0sSFuT6kqRbd0AlS
-KHm2ptULeF6Hg9dyNGiktQw/wuK7ON45OmKFwSE9HSTTBTCOKPxrGpb6KZNMXmiu
-adUuJTe3BokxPduS08fyA+k6lgB5dooNsXr4sAFjOuSbGkcPaDuE9gwnjp21REe9
-3DD7xVIt/NjdqEPJX2uDp6PBfDUvq1cLCLng9bvX5vGW3ang4D17y3ABnZerky8f
-873EXhIj1F1WQNROL6ZaRXThLwFLIwSn6z6jLK/uh1x8lNEpT8sQnVZ0wkA1VmHR
-lxnAekLbfkUecFg3xfhkSbC8WJO1FVibn8c7qIa8Jw6oQgJaE8Wk/+KMiYpBne0P
-v/RGmeexUR1kw2QxWV0FUpPDuCKfA2m0DDBv4lkg9V3PsDo0s2l0bAdLuEJ8HeKW
-3E1z5dE6FPwQU5Po1QPZY4A2lU35r26Sm21vRM8MZ9fD0/vqHMUhrjOX5fND1ZU/
-N/KlWUgmmn+00mfbJa5fNivoLaVxtQ94tMmd+cjOkVOBCG/h4cd8kRBh/3Q/7mph
-rDXiYz+nB6raJjMS/AZ6N1Np6n6LMxY0dBBZ3ojybRxGFLqARZLplPHNX9UnRJty
-7p/XWAKwx4qEIeDzIILaRpj3wb4k4hp3wjS3KO5esTq8aqu/IxA=
-=xgdi
------END PGP SIGNATURE-----

thunderbird-78.9.1.source.tar.xz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:6be0daf439ea5aeef0fd1619511cb1af4f1ba056823910475adc17e60069317d
+size 358277740

thunderbird-78.9.1.source.tar.xz.asc

@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCgAdFiEECXsxMHeuYqAvhNpN8aZmj7t9Vy4FAmBtDnYACgkQ8aZmj7t9
+Vy6aFBAAk6+BtL2bIuUb6HqrddNEimR+357IS4KCYBE6iojdQJlCxBhvQ/X2FvHT
+GPcgntd/eECQrw1ubDPASCThiGmTF29C8kFMmt91gM+q1ddkqHeQEQxH3dMyIdf3
+e+fuygTXMB/CWBUz0e0/NXnOrDwWJ2wW8/xK6Rztt0F87N8db9VVyJDH5rGVKZ0P
+I3uI/HKWHJbtAuxbtdd0Bhnd2DcRkPwu+OJDJJo+7uDfnuxpGLS1iYQ9/VvW+0J0
+1g+OzgLOAHD/UY0tkonsW1WlxN7OkcKMEDzZEpEyFVtoyY7lnJLTZXy3tP58fAX6
+TXFBNa6eTmVqIXMT6OdA32RCh+X4sNUZujtSjTsRs93dQf4m3jnp1n6t3WiV8Y1e
+WPCf8TIITmVHP+Y391Gk4XlOz2B1x76LEFKT7YnsiscxYEcCC4lTPwuPmZRWOQfg
+PnMTqyTU+cB3WoJjsukmupTEfEkRqGV4hTqdFWolkpjXwh/J81IsxjiN2Dwf05Ss
+7K0jvWCV+qjMzpOMZTU+K6+pm60LGurnnevXqjarjD1E4eVBLFaLxuD2ruLtdAbG
+gXWRJ4nccwAuDX/PP8nHWBFT+DqHkdM18TlMtScL6RIub8EknFD219FP8hUri2+i
+g40SG2iPJb/F5L0cTbhCWuujOoVYqegWUQpf+K4ra3BTSLONbew=
+=TXIb
+-----END PGP SIGNATURE-----