icecat-38.3.0_gnu1-4: disable general crypto hardening settings for now

* fix connection to HTTPS Parabola website -> https://lists.parabola.nu/pipermail/assist/2015-October/000534.html
* fix bug #842 -> https://labs.parabola.nu/issues/842

2 files changed, 62 insertions, 3 deletions

diff --git a/libre/icecat/PKGBUILD b/libre/icecat/PKGBUILD
index ba25fe111..4491f7b54 100644
--- a/libre/icecat/PKGBUILD
+++ b/libre/icecat/PKGBUILD
@@ -15,7 +15,7 @@ _pgo=true
 pkgname=icecat
 _pkgver=38.3.0-gnu1
 pkgver=${_pkgver//-/_}
-pkgrel=3
+pkgrel=4
 
 pkgdesc="GNU IceCat, the standalone web browser based on Mozilla Firefox."
 arch=(i686 x86_64)
@@ -43,7 +43,8 @@ source=(http://ftp.gnu.org/gnu/gnuzilla/${_pkgver%-*}/$pkgname-$_pkgver.tar.bz2{
         freetype261.patch
         vendor.js
         $pkgname-fixed-loading-icon.png
-        remove-google-play-services-support.patch)
+        remove-google-play-services-support.patch
+        disable-general-crypto-hardening-settings.patch)
 sha256sums=('08fe9724a84aef2182265b230c68fa37a36a5d93ffd5118ec0739718dc71a66e'
             'SKIP'
             '33a8cf07373c63a0bea70ec2c3983d2cca990752c0f946cb5dbd91f1e2b6410f'
@@ -55,7 +56,8 @@ sha256sums=('08fe9724a84aef2182265b230c68fa37a36a5d93ffd5118ec0739718dc71a66e'
             'd3796311f93328fc8494d75a2123d29e51d52c3f01ffea0977efbfbe12171809'
             '977aa49b940f1da049cefa2878a63ac6669a78e63e9d55bb11db7b8f8fb64c33'
             '68e3a5b47c6d175cc95b98b069a15205f027cab83af9e075818d38610feb6213'
-            '9e651b0f7e7d9d663e8b24077d52bad15f011871747743aff60d6e2d7a45ae5b')
+            '9e651b0f7e7d9d663e8b24077d52bad15f011871747743aff60d6e2d7a45ae5b'
+            'bec42e12cca826d9b60dfd6176eebad2604cac97152f8bb7c03893642bc86a3d')
 validpgpkeys=('A57369A8BABC2542B5A0368C3C76EED7D7E04784') # Ruben Rodriguez
 
 prepare() {
@@ -100,6 +102,11 @@ prepare() {
   # https://bugzilla.mozilla.org/show_bug.cgi?id=841734
   cp "$srcdir/$pkgname-fixed-loading-icon.png" \
     browser/themes/linux/tabbrowser/loading.png
+
+  # Disable general crypto hardening settings for now
+  # https://lists.parabola.nu/pipermail/assist/2015-October/000534.html
+  # https://labs.parabola.nu/issues/842
+  patch -Np1 -i "$srcdir/disable-general-crypto-hardening-settings.patch"
 }
 
 build() {
diff --git a/libre/icecat/disable-general-crypto-hardening-settings.patch b/libre/icecat/disable-general-crypto-hardening-settings.patch
new file mode 100644
index 000000000..d84cdd2ea
--- /dev/null
+++ b/libre/icecat/disable-general-crypto-hardening-settings.patch
@@ -0,0 +1,52 @@
+diff -Nur icecat-38.3.0.orig/browser/app/profile/icecat.js icecat-38.3.0/browser/app/profile/icecat.js
+--- icecat-38.3.0.orig/browser/app/profile/icecat.js	2015-10-12 20:42:13.000000000 -0300
++++ icecat-38.3.0/browser/app/profile/icecat.js	2015-10-29 14:03:09.377208716 -0300
+@@ -2046,14 +2046,14 @@
+ // Crypto hardening
+ // https://gist.github.com/haasn/69e19fc2fe0e25f3cff5
+ //General settings
+-pref("security.tls.unrestricted_rc4_fallback", false);
+-pref("security.tls.insecure_fallback_hosts.use_static_list", false);
+-pref("security.tls.version.min", 1);
+-pref("security.ssl.require_safe_negotiation", true);
+-pref("security.ssl.treat_unsafe_negotiation_as_broken", true);
+-pref("security.ssl3.rsa_seed_sha", true);
+-pref("security.OCSP.enabled", 1);
+-pref("security.OCSP.require", true);
++//pref("security.tls.unrestricted_rc4_fallback", false);
++//pref("security.tls.insecure_fallback_hosts.use_static_list", false);
++//pref("security.tls.version.min", 1);
++//pref("security.ssl.require_safe_negotiation", true);
++//pref("security.ssl.treat_unsafe_negotiation_as_broken", true);
++//pref("security.ssl3.rsa_seed_sha", true);
++//pref("security.OCSP.enabled", 1);
++//pref("security.OCSP.require", true);
+ //Disable unnecessary protocols
+ pref("security.ssl3.rsa_rc4_128_sha", false);
+ pref("security.ssl3.rsa_rc4_128_md5", false);
+diff -Nur icecat-38.3.0.orig/mobile/android/app/mobile.js icecat-38.3.0/mobile/android/app/mobile.js
+--- icecat-38.3.0.orig/mobile/android/app/mobile.js	2015-10-12 20:42:14.000000000 -0300
++++ icecat-38.3.0/mobile/android/app/mobile.js	2015-10-29 14:03:24.623133800 -0300
+@@ -1008,14 +1008,14 @@
+ // Crypto hardening
+ // https://gist.github.com/haasn/69e19fc2fe0e25f3cff5
+ //General settings
+-pref("security.tls.unrestricted_rc4_fallback", false);
+-pref("security.tls.insecure_fallback_hosts.use_static_list", false);
+-pref("security.tls.version.min", 1);
+-pref("security.ssl.require_safe_negotiation", true);
+-pref("security.ssl.treat_unsafe_negotiation_as_broken", true);
+-pref("security.ssl3.rsa_seed_sha", true);
+-pref("security.OCSP.enabled", 1);
+-pref("security.OCSP.require", true);
++//pref("security.tls.unrestricted_rc4_fallback", false);
++//pref("security.tls.insecure_fallback_hosts.use_static_list", false);
++//pref("security.tls.version.min", 1);
++//pref("security.ssl.require_safe_negotiation", true);
++//pref("security.ssl.treat_unsafe_negotiation_as_broken", true);
++//pref("security.ssl3.rsa_seed_sha", true);
++//pref("security.OCSP.enabled", 1);
++//pref("security.OCSP.require", true);
+ //Disable unnecessary protocols
+ pref("security.ssl3.rsa_rc4_128_sha", false);
+ pref("security.ssl3.rsa_rc4_128_md5", false);