Remove end-of-life spidermonkey versions (78, 91, 102)

[mweinelt]

Both package have reached their end of life together with their respective firefox versions and should be removed before NixOS 22.05.

• spidermonkey_68: spidermonkey_68: drop #153451
• spidermonkey_78: EOL since 2021/11
  • required in polkit, but updated to mozjs-91 in https://gitlab.freedesktop.org/polkit/polkit/-/commit/a6bedfd09b7bba753de7a107dc471da0db801858
• spidermonkey_91: EOL since 2022/09
• spidermonkey_102: EOL since 2023/09

https://endoflife.date/firefox

@lostnet @abbradar @ajs124

[lostnet]

Here's the other packages that I've been monitoring:

• gjs: ok It looks like gnome 42 will release in march, probably soon enough to get an official release of gjs w/moz-91 https://gitlab.gnome.org/GNOME/gjs/-/merge_requests/632

• couchdb: ok has moz-91 support in mainline but has not cut a 3.x release. feat(couchjs): add support for SpiderMonkey 91esr apache/couchdb#3852

• cjs: has been made aware they will need another rebase to gjs-1.72 Rebase off 1.70.0-4 (ubuntu 22.04) linuxmint/cjs#101 (comment)

• libproxy: has duktape support in mainline but planned its next release to have moz-91 support. Add Duktape support libproxy/libproxy#161

[dasJ]

I'd like to remind the people here that branch-off is scheduled for tomorrow and depending on how good the staging builds progress, we will branch off rather soon.

[lostnet]

cjs seems to be the limiting factor. I think libproxy has not been correctly configuring spidermonkey so it could just be removed as a dependency and no functionality would change. 91.9.1 is actually the first version I've seen that unequivocally deals with a spidermonkey defect as the CVE, and unless that was a recent regression it therefore means clearly insecure EOL versions. It would make sense to isolate the usage of 78 to dependents that can be confirmed to require no sandboxing ( or other separation of privileges) and otherwise mark it insecure? I have no access to a normal computer this weekend though so I probably can't try anything ahead of the release.

…

On Sat, 21 May 2022, 19:07 Janne Heß, ***@***.***> wrote: I'd like to remind the people here that branch-off is scheduled for tomorrow and depending on how good the staging builds progress, we will branch off rather soon. — Reply to this email directly, view it on GitHub <#157874 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAK3LPM7SJT7JS5A5WYHDWTVLEJ37ANCNFSM5NMX6W5Q> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[mweinelt]

Unrealistic to achieve and postponed to the 22.11 release cycle. Thanks for your research and documentation on the topic!

[lostnet]

libproxy could now be moved of 78 but cjs remains a problem as well as some other dependents.
So the refactor in #179822 still includes 78.

[ajs124]

libproxy could now be moved of 78

see #181917

[jtojnar]

Polkit done in #181264.