path: root/libre/icecat/PKGBUILD

# Maintainer (arch:firefox): Jan Alexander Steffens (heftig) <heftig@archlinux.org>
# Contributor: Ionut Biru <ibiru@archlinux.org>
# Contributor: Jakub Schmidtke <sjakub@gmail.com>
# Contributor: Henry Jensen <hjensen@connochaetos.org>
# Maintainer (archarm:firefox): Kevin Mihelich <kevin@archlinuxarm.org>
# Maintainer (arch32:firefox): Andreas Baumann <mail@andreasbaumann.cc>
# Contributor: Erich Eckner <git@eckner.net>
# Contributor: Andreas Grapentin <andreas@grapentin.org>
# Contributor: Luke Shumaker <lukeshu@parabola.nu>
# Contributor: André Silva <emulatorman@hyperbola.info>
# Contributor: Márcio Silva <coadde@hyperbola.info>
# Contributor: fauno <fauno@kiwwwi.com.ar>
# Contributor: vando <facundo@esdebian.org>
# Contributor: Figue <ffigue at gmail>
# Contributor: evr <evanroman at gmail>
# Contributor: Muhammad 'MJ' Jassim <UnbreakableMJ@gmail.com>
# Contributor: vando <facundo@esdebian.org>
# Contributor: taro-k <taro-k@movasense_com>
# Contributor: Michał Masłowski <mtjm@mtjm.eu>
# Contributor: Luke R. <g4jc@openmailbox.org>
# Contributor: Isaac David <isacdaavid@isacdaavid.info>
# Contributor: bill-auger <bill-auger@programmer.net>
# Contributor: grizzlyuser <grizzlyuser@protonmail.com>


# NOTE: icecat (60.7 < V <= current) are not complete upstream releases.
#       Upstream releases normally have $_upstream_ver ending in '-gnu<N>'.
#       Those builds are based on gnuzilla VCS development sources
#       with parabola patches applied (offered upstream).
#         https://git.parabola.nu/~bill-auger/icecat.git/log/?h=parabola
# NOTE: Occasionally (v102.4.0), a versioned source-ball is published.
#       However, like the upstream VCS, they are denoted as 'testing' and are not signed.
#       We should still prefer the versioned source-balls. Besides the usually reason
#       (always prefer versioned source-balls to VCS builds), they are a significant
#       reduction in workload; because gnuzilla can not be compiled from VCS. We first
#       need to run the makeicecat.sh script to prepare the source-ball, then sign it and
#       publish it, which takes hours. If versioned source-balls become the norm again,
#       these NOTEs can be deleted, along with the LOCs commented with "(VCS builds)".
#       Until then, whenever building from an upstream source-ball, any un-merged patches
#       should be re-implemented in abslibre (eg: 'enable-sync.patch')m and deleted
#       again (and 'dummy-sig'), if building from VCS again.


# NOTE: This PKGBUILD is kept in-sync, as closely as possible,
#       with arch{,arm,32} (firefox), and parabola {iceweasel,icecat},
#       for the sake of documentation and cleaner diffs.
#       That also helps to identify which changes were made by Parabola vs upstream.
#       Therefore, this PKGBUILD may declare blacklisted dependencies, non-free sources,
#       or include code for anti-features; but those will be filtered-out subsequently.
#       Any code which implements an anti-feature should be commented-out;
#       and include an 'anti-feature' comment, for clarity.
#       Any blacklisted dependencies and non-free sources should be filtered,
#       and include a 'non-free' comment, for clarity.
#       Without those over-rides, the resulting program may not be FSDG-fit.
#       Do not circumvent those over-rides, if compiling for the Parabola repos.


pkgname=icecat
_upstream_ver=115.3.1-gnu1
_upstream_ver=${_upstream_ver/-gnu[0-9]/-pre1} # (VCS builds)
pkgver=${_upstream_ver//-/_}
pkgrel=1
pkgdesc="the GNU web browser, derived from Mozilla Firefox ESR"
url=http://www.gnu.org/software/gnuzilla/
arch=(x86_64)
arch+=(
  armv7h
  i686)
license=(
  GPL
  LGPL
  MPL
)
depends=(
  dbus-glib
  ffmpeg
  gtk3
  libpulse
  libxt
  mime-types
  nss
  ttf-font
)
makedepends=(
  cbindgen
  clang
  diffutils
  dump_syms
  imake
  inetutils
  jack
  lld
  llvm
  mesa
  nasm
  nodejs
  python
  rust
  unzip
  wasi-compiler-rt
  wasi-libc
  wasi-libc++
  wasi-libc++abi
  xorg-server-xvfb
  yasm
  zip
)
makedepends+=(
  python-typing_extensions
)
optdepends=(
  'hunspell-en_US: Spell checking, American English'
  'libnotify: Notification integration'
  'networkmanager: Location detection via available WiFi networks'
  'pulseaudio: Audio support'
  'speech-dispatcher: Text-to-Speech'
  'xdg-desktop-portal: Screensharing with Wayland'
)
options=(
  !debug
  !emptydirs
  !lto
  !makeflags
  !strip
)
source=(https://repo.parabola.nu/other/${pkgname}/${pkgname}-${_upstream_ver}.tar.bz2{,.sig} # (VCS builds)
)
source+=(
  icecat.desktop
  icecat-safe.desktop
  vendor.js.in
  zstandard-0.21.0.diff
)
source_i686=(
  avoid-libxul-OOM-python-check.patch
  rust-static-disable-network-test-on-static-libraries.patch
  firefox-111.0.1-fdlibm.patch
  fix-i686-build-moz-1792159.patch
  fix-i686-xsimd-incomplete.patch
)
validpgpkeys+=('3954A7AB837D0EA9CFA9798925DB7D9B5A8D4B40') # bill-auger (VCS builds)
sha256sums=('44a39b0364da3dfed1f2bad5d7bbf353e7b4c506d8ec8e27a89dec0ef161066e'
            'SKIP'
)
sha256sums+=('e00dbf01803cdd36fd9e1c0c018c19bb6f97e43016ea87062e6134bdc172bc7d'
             '33dd309eeb99ec730c97ba844bf6ce6c7840f7d27da19c82389cdefee8c20208'
             '8e113fd2730be3fd11b2a24918dd62e8741513cf4dce9819d8eae358c5411adc'
             'aa663d899e924f4979114584cad671dad3b93dd9b0dfe28bb1cf11ddf92e6d47') # zstandard-0.21.0.diff
sha256sums_i686=('2f0c81a38c4578f68f5456b618fe84a78974072821488173eb55e0e72287e353'
                 '10c5276eab2e87f400a6ec15d7ffbef3b0407ee888dea36f1128927ca55b9041'
                 'ed3bb281697af7c4353a34067ffb4b18a971d40757bef2d6af3c8bf2d28d42d1'
                 '2fb39374fd3d80eea9e346032a2a4b2bc2e357dee7380855b24bcf19b1335d06'
                 'c3ce181fbb0142055aa6dd17f3cda2ba6a1e54d7a689a8c6e9cce76aa40e6544')


## compiler and optimization tweaks ##

# disable PGO
# try this if the build hangs indefinitely - known past causes:
#   * resource exhaustion
#   * a test which misbehaves in environments without networking
readonly _SKIP_PGO=$(case "${CARCH}" in armv7h|i686) echo 1 ;; *) echo 0 ;; esac)

# use GCC vs LLVM
# trying one or the other, may resolve sporadic compiler/linker discrepancies
readonly _USE_ALT_COMPILER=$(case "${CARCH}" in armv7h) echo 1 ;; *) echo 0 ;; esac)

# use 'bfd' linker vs 'lld'
# most significantly, this also disables LTO and debugging
# try this if the build freezes or crashes due to resource exhaustion
# FIXME: x86_64 FTBS with LTO due to resource exhaustion
#        luke added a swapfile to beefcake, because this build crashed the server
#        apparently, a measly 32GB RAM is no longer sufficient to contain this beast
#        the system no longer crashes now; but the build process gets killed instead
#        > clang-15: error: unable to execute command: Killed
readonly _USE_ALT_LINKER=$(case "${CARCH}" in i686|x86_64) echo 1 ;; *) echo 0 ;; esac)


## dependency tweaks ##

case "${CARCH}" in
armv7h)
  makedepends=( ${makedepends[*]/wasi-*/} ) # armv7h has no wasi compiler

  depends+=( libicudata.so libicui18n.so libicuuc.so ) # --with-system-icu
  ;;
i686)
  # checking for nodejs... /usr/bin/node: error while loading shared libraries: libicui18n.so.72
  makedepends+=( icu72 )
  # wasm-ld: error: cannot open /usr/lib/clang/15.0.7/lib/wasi/libclang_rt.builtins-wasm32.a: No such file or directory
  makedepends=( ${makedepends[*]/wasi-compiler-rt/wasi-compiler-rt=15.0.7} ) # dustbin
  ;;
esac


## helpers ##

_check_build_config() {
  pushd "${srcdir}"/${pkgname}-${pkgver%%_*} > /dev/null

  echo "Checking build configuration..."

  # Each of the [ARCH-SPECIFIC CONFIG] branches in prepare(), should have prepared a
  # $srcdir/mozconfig file with any arch-specific changes to the Arch x86_64 PKGBUILD.
  # Finally, that file should have been copied to $srcdir/firefox-$pkgver/.mozconfig
  grep '^ac_add_options --with-distribution-id=nu.parabola' .mozconfig &> /dev/null || \
  ! echo "cannot continue without a .mozconfig file"                                || return 1

  if ! [[ "${CARCH}" =~ ^(aarch64|armv7h)$ ]] # ARM has no --disable-eme option
  then grep '^ac_add_options --disable-eme' .mozconfig &> /dev/null   || \
       ! echo ".mozconfig file was not properly treated per the FSDG" || return 1
  fi

  # Configure produces mozinfo.json that reflects current configuration.
  # See build/docs/mozinfo.rst
  ./mach configure

  # In this test, jq collects values of the following keys of mozinfo.json into array,
  # and checks if any of them are not equal to false, in which case it returns "true".
  # E.g. if the value of any key is true or null (in case the key is missing from mozinfo.json),
  # that means the build configuration has to be reworked.
  local obj_directory=$(./mach environment | sed -En '/object directory:/{n;s/^\s+//;p;}')
  local antifeature_keys=(.crashreporter .datareporting .healthreport .normandy .telemetry .updater)
  local antifeatures=()
  echo "obj_directory is: ${obj_directory}"
  for key in ${antifeature_keys[@]}
  do  if   jq -e "${key} != false" "${obj_directory}"/mozinfo.json &> /dev/null
      then antifeatures+=(${key})
      fi
  done
  if   (( ${#antifeatures[@]} ))
  then echo "Some anti-features are not disabled in build configuration files - aborting:"
       printf "  - %s is enabled\n" ${antifeatures[*]}
       return 1
  fi

  popd > /dev/null
}

_check_patching() {
  return 0 # let's assume that icecat is already FSDG-fit upstream
}


## business ##

prepare() {
  mkdir mozbuild
  cd "$srcdir/$pkgname-${pkgver%%_*}"


  ## technical patching ##

  # Unbreak build with python-zstandard 0.21.0
  echo "applying zstandard-0.21.0.diff"
  patch -Np1 -i ../zstandard-0.21.0.diff

  # Use system python-typing-extensions instead of the old vendored one to avoid
  # unresolvable dependency versions. They are probably downloaded when network
  # connectivity is enabled at built time, but that is not the case for Parabola.
  rm -rfv third_party/python/typing_extensions

  # arch-specific technical patching
  case ${CARCH} in
  aarch64|armv7h)
    # Error: immediate expression requires a # prefix -- `pld [r0,1792]'
    #        mozilla #1787405 and #1791267
    sed -i "s|# 'LIBYUV_DISABLE_NEON',|'LIBYUV_DISABLE_NEON',|" media/libyuv/libyuv/libyuv.gyp
    ! grep "# 'LIBYUV_DISABLE_NEON'," media/libyuv/libyuv/libyuv.gyp || ! echo "error patching media/libyuv/libyuv/libyuv.gyp" || exit 1

    # FIXME: armv7h FTBS
    # ld.lld: error: undefined hidden symbol: I422ToARGBRow_Any_NEON
    #   also: I422ToARGBRow_NEON I444ToARGBRow_Any_NEON I444ToARGBRow_NEON
    # referenced by Unified_cpp_gfx_ycbcr0.cpp
    # toolkit/library/build/../../../gfx/ycbcr/Unified_cpp_gfx_ycbcr0.o:(YUVBuferIter_Init)
    # ld.lld: error: undefined hidden symbol: ScaleARGBCols_NEON
    #  also: InterpolateRow_NEON ScaleARGBFilterCols_NEON ScaleARGBRowDownEven_NEON
    #        ScaleARGBCols_Any_NEON InterpolateRow_Any_NEON ScaleARGBFilterCols_Any_NEON
    #        ScaleARGBRowDown2_Any_NEON ScaleARGBRowDownEvenBox_NEON
    #        ScaleARGBRowDownEven_Any_NEON ScaleARGBRowDown2Box_NEON
    #        ScaleARGBRowDownEvenBox_Any_NEON ScaleARGBRowDown2_NEON
    #        ScaleARGBRowDown2Box_Any_NEON ScaleARGBRowDown2Linear_Any_NEON
    #        ScaleARGBRowDown2Linear_NEON
    # obj/toolkit/library/build/../../../gfx/ycbcr/Unified_cpp_gfx_ycbcr0.o:(YUVToARGBScale)
    ;;
  i686)
    # readelf: Error: Unable to seek to 0x801db328 for section headers
    echo "applying avoid-libxul-OOM-python-check.patch"
    patch -p1 -i ../avoid-libxul-OOM-python-check.patch

    # test failure in rust code (complaining about network functions) when PGO is used,
    # see https://bugzilla.mozilla.org/show_bug.cgi?id=1565757
    echo "applying rust-static-disable-network-test-on-static-libraries.patch"
    patch -p1 -i ../rust-static-disable-network-test-on-static-libraries.patch

    # FIXME: this patch is probably temporary - it comes from mozilla
    #          https://bugzilla.mozilla.org/show_bug.cgi?id=1729459
    #        /build/iceweasel/src/firefox-96.0.1/modules/fdlibm/src/math_private.h:34:21:
    #          error: conflicting declaration ‘typedef __double_t double_t’
    #        /usr/include/math.h:156:21: note: previous declaration as ‘typedef long double double_t’
    echo "applying firefox-111.0.1-fdlibm.patch"
    patch -p1 -i "$srcdir/firefox-111.0.1-fdlibm.patch"

    # js/src/jit/shared/AtomicOperations-shared-jit.cpp:88:9: error: ‘AtomicCopyByteUnsynchronized’ was not declared in this scope; did you mean ‘AtomicMemcpyUpUnsynchronized’?
    echo "applying fix-i686-build-moz-1792159.patch"
    patch -p1 -i "$srcdir/fix-i686-build-moz-1792159.patch"

    # https://bugs.archlinux32.org/index.php?do=details&task_id=332
    # dom/base/nsTextFragmentGeneric.h:38:16: error: ‘any’ is not a member of ‘xsimd’
    # dom/base/nsTextFragmentGeneric.h:16:70: error: incomplete type ‘xsimd::batch<short int, xsimd::sse2>’ used in nested name specifier
    # dom/base/nsTextFragmentGeneric.h:35:31: error: ‘xsimd::batch<short int, xsimd::sse2> vectmask’ has incomplete type
    # dom/base/nsTextFragmentGeneric.h:37:64: error: incomplete type ‘xsimd::batch<short int, xsimd::sse2>’ used in nested name specifier
    echo "applying fix-i686-xsimd-incomplete.patch"
    patch -p1 -i "$srcdir/fix-i686-xsimd-incomplete.patch"
    ;;
  x86_64)
    ;;
  esac


  ## general configuration ##

  # echo -n "$_google_api_key" >google-api-key   # anti-feature
  # echo -n "$_mozilla_api_key" >mozilla-api-key # anti-feature

  cat >../mozconfig <<END
ac_add_options --enable-application=browser
mk_add_options MOZ_OBJDIR=${PWD@Q}/obj

ac_add_options --prefix=/usr
ac_add_options --enable-release
ac_add_options --enable-hardening
ac_add_options --enable-optimize
ac_add_options --enable-rust-simd
ac_add_options --enable-linker=lld
ac_add_options --disable-elf-hack
ac_add_options --disable-bootstrap
ac_add_options --with-wasi-sysroot=/usr/share/wasi-sysroot

# Branding
ac_add_options --enable-official-branding         # icecat branding
ac_add_options --enable-update-channel=release
ac_add_options --with-distribution-id=nu.parabola # branding over-ride
                                                  # --with-branding= n/a for icecat
ac_add_options --with-app-name=${pkgname}         # branding over-ride
ac_add_options --with-app-basename=${pkgname}     # branding over-ride
ac_add_options --with-unsigned-addon-scopes=app,system
ac_add_options --allow-addon-sideload
# export MOZILLA_OFFICIAL=1                       # branding over-ride
export MOZ_APP_REMOTINGNAME=${pkgname//-/}
export MOZ_TELEMETRY_REPORTING=
export MOZ_REQUIRE_SIGNING=

# Keys
# ac_add_options --with-google-location-service-api-keyfile=${PWD@Q}/google-api-key # anti-feature
# ac_add_options --with-google-safebrowsing-api-keyfile=${PWD@Q}/google-api-key     # anti-feature
# ac_add_options --with-mozilla-api-keyfile=${PWD@Q}/mozilla-api-key                # anti-feature

# System libraries
ac_add_options --with-system-nspr
ac_add_options --with-system-nss

# Features
ac_add_options --enable-alsa
ac_add_options --enable-jack
ac_add_options --disable-crashreporter # anti-feature
ac_add_options --disable-updater
ac_add_options --disable-tests
ac_add_options --disable-eme           # anti-feature
END


  ## [ARCH-SPECIFIC CONFIG] ##

  if   (( _USE_ALT_COMPILER ))
  then cat >> ../mozconfig <<END
export CC=gcc
export CXX=g++
export AR=gcc-ar
export NM=gcc-nm
export RANLIB=gcc-ranlib
END
  fi

  if   (( _USE_ALT_LINKER ))
  then sed -i '/cargo_rustc_flags += -Clto/d' config/makefiles/rust.mk
       cat >> ../mozconfig <<END
ac_add_options --disable-linker=lld
ac_add_options --enable-linker=bfd
ac_add_options --disable-lto
ac_add_options --disable-rust-simd
ac_add_options --disable-debug
ac_add_options --disable-debug-symbols
END
  fi

  case ${CARCH} in
  aarch64|armv7h)
    # experimental/version-specific hacks #

    # ld.lld: error: undefined hidden symbol: std::type_info::operator==(std::type_info const&) const
    echo 'ac_add_options --with-system-icu' >> ../mozconfig


    # archarm configuration #

    # archarm recipe has mozconfig over-rides under the 'general configuration' section
    # NOTE: '--disable-eme' is currently an invalid option for armv7h.
    #       It must be deleted in order to compile.
    #       If ever it becomes valid, it should not be deleted below.
    sed -i '
      /--enable-hardening/d
      /--enable-optimize/d
      /--enable-rust-simd/d
      s| --with-wasi-sysroot=.*| --without-wasm-sandboxed-libraries|
      /--disable-eme/d
    ' ../mozconfig

    if [[ $CARCH == "armv7h" ]]; then
      echo "ac_add_options --disable-elf-hack" >> .mozconfig
      # https://bugzilla.redhat.com/show_bug.cgi?id=1641623
      echo "ac_add_options --disable-av1" >> .mozconfig
      # reduce jobs due to RAM constraints
      MAKEFLAGS="-j4"
      # disable hard-coded LTO
      sed -i '/cargo_rustc_flags += -Clto/d' config/makefiles/rust.mk
      sed -i '/RUSTFLAGS += -Cembed-bitcode=yes/d' config/makefiles/rust.mk
      # increase codegen-units due to RAM constraints
      sed -i 's/codegen-units=1/codegen-units=16/' config/makefiles/rust.mk
      # webrtc on ARMv7 implies android, so disable it
      echo "ac_add_options --disable-webrtc" >> .mozconfig
    elif [[ $CARCH == "aarch64" ]]; then
      echo 'ac_add_options --enable-rust-simd' >> .mozconfig
    fi

    echo 'ac_add_options --enable-optimize="-g0 -O2"' >> .mozconfig
    echo "mk_add_options MOZ_MAKE_FLAGS=\"${MAKEFLAGS}\"" >> .mozconfig

    # archarm `export` commands are under the '[ARCH-SPECIFIC BUILD ENV]' section

    # archarm patching is under the 'technical patching' section

    # At this point in the recipe, the arch, arch32, and parabola PKGBUILDs
    # have prepared a temporary ${srcdir}/mozconfig; but the archarm PKGBUILD
    # writes directly to the final firefox-$pkgver/.mozconfig.
    # We allowed .mozconfig to be written above, only to minimize the diff against archarm.
    # For consistency across arches, we append those changes to ${srcdir}/mozconfig now.
    # ${srcdir}/mozconfig will clobber firefox-$pkgver/.mozconfig later, during build().
    cat .mozconfig >> ../mozconfig
    ;;
  i686)
    # experimental/version-specific hacks #


    # arch32 configuration #

    # arch32 `export` commands are under the '[ARCH-SPECIFIC BUILD ENV]' section

    # arch32 recipe has mozconfig over-rides in mozconfig-i686.patch
    # in this recipe, the '_USE_ALT_LINKER' block includes most of them
    cat >>../mozconfig <<END
ac_add_options --disable-webrtc
END

    # arch32 patching is under the 'technical patching' section
    ;;
  x86_64)
    ;;
  *) echo "no [ARCH-SPECIFIC CONFIG] for arch: ${CARCH}" ; return 1 ;
    ;;
  esac


  ## search-engines ##

  # let's use icecat's default search-engines


  ## libre patching ##

  # let's assume that icecat is already FSDG-fit upstream


  ## patching sanity checks ##
  _check_patching
}

build() {
  cd "$srcdir/$pkgname-${pkgver%%_*}"

  ## build env ##

  export MOZ_NOSPAM=1
  export MOZBUILD_STATE_PATH="$srcdir/mozbuild"
  # export MOZ_ENABLE_FULL_SYMBOLS=1                    # anti-feature
  export MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE=system # parabola policy

  # LTO needs more open files
  ulimit -n 4096


  ## [ARCH-SPECIFIC BUILD ENV] ##

  case ${CARCH} in
  aarch64|armv7h)
    export MOZ_DEBUG_FLAGS=" "
    export CFLAGS+=" -g0"
    export CXXFLAGS+=" -g0"
    export LDFLAGS+=" -Wl,--no-keep-memory"
    export RUSTFLAGS="-Cdebuginfo=0"
    ;;
  i686)
    # -fno-plt with cross-LTO -> LLVM ERROR: Function Import: link error
    CFLAGS="${CFLAGS/-fno-plt/}"
    CXXFLAGS="${CXXFLAGS/-fno-plt/}"

    # try hard to tell ld and rust not to use too much memory (no lto, no debug info, etc.)
    export RUSTFLAGS+=" -Cdebuginfo=0 -Clto=off"
    export LDFLAGS+=" -Wl,--no-keep-memory " # -Wl,--reduce-memory-overheads -Wl,--max-cache-size=16384000 "
    export MOZ_SOURCE_CHANGESET="DEVEDITION_${pkgver//./_}_RELEASE"

#     export MOZ_MAKE_FLAGS=-j2

    # libvpx has some hard-coded compiler flags for MMX, SSE, SSE2, use the correct one
    # per CARCH (75.0 uses an intrisic _mm_empty now, which required the corresponding
    # architecture flag to be preset - before it was merely embedding some assembly
    # code with EMMS
    export CFLAGS+=" -mmmx"
    export CXXFLAGS+=" -mmmx"
    ;;
  x86_64)
    ;;
  *) echo "no [ARCH-SPECIFIC BUILD ENV] for arch: ${CARCH}" ; return 1 ;
    ;;
  esac
  export CFLAGS
  export CXXFLAGS


  ## [ARCH-SPECIFIC BUILD CONFIG] ##

  case ${CARCH} in
  aarch64|armv7h)
    ;;
  i686)
    # avoid excessive debug symbols in rust leading to out-of-memory situations
    sed -i "s/debug_info = '\''2'\''/debug_info = '\''0'\''/" build/moz.configure/toolchain.configure
    ;;
  x86_64)
    ;;
  *) echo "no [ARCH-SPECIFIC BUILD CONFIG] for arch: ${CARCH}" ; return 1 ;
    ;;
  esac


  ## PGO build ##

  if (( _SKIP_PGO ))
  then
    # skipping "3-tier PGO" "instrumented browser"; so the final .mozconfig is ready now
    cp ../mozconfig .mozconfig
  else
    # Do 3-tier PGO
    echo "Building instrumented browser..."
    cat >.mozconfig ../mozconfig - <<END
ac_add_options --enable-profile-generate=cross
END
    _check_build_config
    ./mach build

    echo "Profiling instrumented browser..."
    ./mach package
    LLVM_PROFDATA=llvm-profdata \
      JARLOG_FILE="$PWD/jarlog" \
      xvfb-run -s "-screen 0 1920x1080x24 -nolisten local" \
      ./mach python build/pgo/profileserver.py

    stat -c "Profile data found (%s bytes)" merged.profdata
    test -s merged.profdata

    stat -c "Jar log found (%s bytes)" jarlog
    test -s jarlog

    echo "Removing instrumented browser..."
    ./mach clobber

    echo "Building optimized browser..."
    cat >.mozconfig ../mozconfig - <<END
ac_add_options --enable-lto=cross
ac_add_options --enable-profile-use=cross
ac_add_options --with-pgo-profile-path=${PWD@Q}/merged.profdata
ac_add_options --with-pgo-jarlog=${PWD@Q}/jarlog
END
  fi # _SKIP_PGO


  ## sanity checks ##

  _check_build_config


  ## main build ##

  (( ! _SKIP_PGO )) || echo "Building optimized browser..."
  ./mach build

  # echo "Building symbol archive..." # anti-feature
  # ./mach buildsymbols               # anti-feature
}

package() {
  export MOZBUILD_STATE_PATH="$srcdir/mozbuild"         # needed for `libremakepkg -R`
  export MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE=system # needed for `libremakepkg -R`

  cd "$srcdir/$pkgname-${pkgver%%_*}"
  DESTDIR="$pkgdir" ./mach install

  local vendorjs="$pkgdir/usr/lib/$pkgname/browser/defaults/preferences/vendor.js"
  install -Dvm644 /dev/stdin "$vendorjs" <<END
// Use LANG environment variable to choose locale
pref("intl.locale.requested", "");

// Use system-provided dictionaries
pref("spellchecker.dictionary_path", "/usr/share/hunspell");

// Disable default browser checking.
pref("browser.shell.checkDefaultBrowser", false);

// Don't disable extensions in the application directory
pref("extensions.autoDisableScopes", 11);

// Enable GNOME Shell search provider
pref("browser.gnome-search-provider.enabled", true);
END

  # Parabola additions to vendor.js
  cat "${srcdir}"/vendor.js.in >> "${vendorjs}"

  local distini="$pkgdir/usr/lib/$pkgname/distribution/distribution.ini"
  install -Dvm644 /dev/stdin "$distini" <<END
[Global]
id=parabola
version=${_upstream_ver}
about=${pkgname^} for Parabola GNU/Linux-libre
about.en-US=${pkgname^} for Parabola GNU/Linux-libre
about.eo=${pkgname^} por Parabola GNU/Linux-libre
about.es-ES=${pkgname^} para Parabola GNU/Linux-libre
about.gl=${pkgname^} para Parabola GNU/Linux-libre
about.pt-BR=${pkgname^} para Parabola GNU/Linux-libre

[Preferences]
app.distributor=parabola
app.distributor.channel=$pkgname
app.partner.parabola=parabola
END

  local i theme=official
  for i in 16 22 24 32 48 64 128 256; do
    install -Dvm644 browser/branding/$theme/default$i.png \
      "$pkgdir/usr/share/icons/hicolor/${i}x${i}/apps/$pkgname.png"
  done
  install -Dvm644 browser/branding/$theme/content/about-logo.png \
    "$pkgdir/usr/share/icons/hicolor/192x192/apps/$pkgname.png"
  install -Dvm644 browser/branding/$theme/content/about-logo@2x.png \
    "$pkgdir/usr/share/icons/hicolor/384x384/apps/$pkgname.png"
  install -Dvm644 browser/branding/$theme/content/about-wordmark.svg \
    "$pkgdir/usr/share/icons/hicolor/scalable/apps/$pkgname.svg"
  install -Dvm644 browser/branding/$theme/content/identity-icons-brand.svg \
    "$pkgdir/usr/share/icons/hicolor/symbolic/apps/$pkgname-symbolic.svg"
  install -Dvm644 browser/branding/official/default48.png \
    "$pkgdir/usr/share/pixmaps/icecat.png"

  install -Dvm644 ../$pkgname.desktop \
    "$pkgdir/usr/share/applications/$pkgname.desktop"

  # Install a wrapper to avoid confusion about binary path
  install -Dvm755 /dev/stdin "$pkgdir/usr/bin/$pkgname" <<END
#!/bin/sh
exec /usr/lib/$pkgname/$pkgname "\$@"
END


  ## [ARCH-SPECIFIC INSTALL] ##

  case ${CARCH} in
  aarch64|armv7h)
    ;;
  i686)
    # libxul.so cannot find it's libraries
    install -dm 755 "${pkgdir}/etc/ld.so.conf.d"
    echo "/usr/lib/${pkgname}" > "${pkgdir}"/etc/ld.so.conf.d/${pkgname}.conf
    ;;
  x86_64)
    ;;
  *) echo "no [ARCH-SPECIFIC INSTALL] for arch: ${CARCH}" ; return 1 ;
    ;;
  esac

  # Replace duplicate binary with wrapper
  # https://bugzilla.mozilla.org/show_bug.cgi?id=658850
  ln -srfv "$pkgdir/usr/bin/$pkgname" "$pkgdir/usr/lib/$pkgname/$pkgname-bin"

  # Use system certificates
  local nssckbi="$pkgdir/usr/lib/$pkgname/libnssckbi.so"
  if [[ -e $nssckbi ]]; then
    ln -srfv "$pkgdir/usr/lib/libnssckbi.so" "$nssckbi"
  fi

  # Configure GNOME Shell search provider
  local sprovider="$pkgdir/usr/share/gnome-shell/search-providers/$pkgname.search-provider.ini"
  install -Dvm644 /dev/stdin "$sprovider" <<END
[Shell Search Provider]
DesktopId=$pkgname.desktop
BusName=org.mozilla.${pkgname//-/}.SearchProvider
ObjectPath=/org/mozilla/${pkgname//-/}/SearchProvider
Version=2
END

  # export SOCORRO_SYMBOL_UPLOAD_TOKEN_FILE="$startdir/.crash-stats-api.token" # anti-feature
  # if [[ -f $SOCORRO_SYMBOL_UPLOAD_TOKEN_FILE ]]; then                        # anti-feature
  #   make -C obj uploadsymbols                                                # anti-feature
  # else                                                                       # anti-feature
  #   cp -fvt "$startdir" obj/dist/*crashreporter-symbols-full.tar.zst         # anti-feature
  # fi
}