Build pin: the Firefox package is still built from a chromium commit without the RFC 9457 fix #8

New issue

Closed

opened 2026-10-01 10:47:19 +00:00 by tiagoagueda · 0 comments

tiagoagueda commented

2026-10-01 10:47:19 +00:00

Owner

Found on 2026-09-29 in a read-only review of postulo-firefox at e531dfbc5, comparing source.json with the history of postulo-chromium at 7998de372.

postulo/postulo-chromium#1 was closed by postulo-chromium 7998de3 with the words "postulo-firefox builds from this source and takes the fix with its next build". It does not: source.json pins a fixed commit older than the fix, and npm run check:pin reports the gap without failing. Every Firefox package CI builds today still shows the refusal summary instead of the refused field.

Where: source.json:3 ("ref": "72512fdaaa426177b8c8511675072018233eb910"); scripts/check-pin.mjs:71-80, the no-tag branch, which only console.logs behind main, now at ….
What happens:
1. source.json was last changed in 52c8313 (2026-09-16) and pins postulo-chromium 72512fd.
2. postulo-chromium 7998de3 (2026-09-21, "Closes #1") is the only commit after it. It makes refusalFor read RFC 9457 errors, adds scope and retryAfter, and asks for application/problem+json in Accept.
3. postulo-chromium has no tag, so check-pin.mjs takes the no-tag branch, prints that the pin is behind main and exits 0. CI (.forgejo/workflows/ci.yml) stays green and packages the old source.
Why it matters: a Firefox user whose capture is refused for a field reads "Refused: title. See errors for what is wrong with each.", a sentence that sends them to something they cannot see, while the Chromium build names the field and the reason. The README calls the two builds one extension, and the closed issue says the fix reached both.
Fix: move the pin to 7998de3724248a61a1202e4f441e99e2346d8666 (or later). So that a fix to the shared source cannot skip Firefox unnoticed again until postulo-chromium cuts its first tag, make the no-tag branch of check-pin.mjs fail when the pin is behind main and the commits in between touch src/, or at least fail outside a release with a message naming the commits. Once tags exist, the existing latest-tag rule covers this.

Related to postulo/postulo-chromium#1 (closed), whose fix never reached the Firefox build, and to #3 and #4, which both plan to move the pin for their own changes but not for this one.

Done when

source.json pins a postulo-chromium commit that contains 7998de3.
scripts/check-pin.mjs exits non-zero when, with no tag, the pin is behind main by commits that change src/ (checked by hand or by a small script test against a fixture of ls-remote output).

Found on 2026-09-29 in a read-only review of postulo-firefox at e531dfbc5, comparing `source.json` with the history of postulo-chromium at 7998de372. postulo/postulo-chromium#1 was closed by postulo-chromium `7998de3` with the words "postulo-firefox builds from this source and takes the fix with its next build". It does not: `source.json` pins a fixed commit older than the fix, and `npm run check:pin` reports the gap without failing. Every Firefox package CI builds today still shows the refusal summary instead of the refused field. - **Where:** `source.json:3` (`"ref": "72512fdaaa426177b8c8511675072018233eb910"`); `scripts/check-pin.mjs:71-80`, the no-tag branch, which only `console.log`s `behind main, now at …`. - **What happens:** 1. `source.json` was last changed in `52c8313` (2026-09-16) and pins postulo-chromium `72512fd`. 2. postulo-chromium `7998de3` (2026-09-21, "Closes #1") is the only commit after it. It makes `refusalFor` read RFC 9457 `errors`, adds `scope` and `retryAfter`, and asks for `application/problem+json` in `Accept`. 3. postulo-chromium has no tag, so `check-pin.mjs` takes the no-tag branch, prints that the pin is behind main and exits 0. CI (`.forgejo/workflows/ci.yml`) stays green and packages the old source. - **Why it matters:** a Firefox user whose capture is refused for a field reads "Refused: title. See `errors` for what is wrong with each.", a sentence that sends them to something they cannot see, while the Chromium build names the field and the reason. The README calls the two builds one extension, and the closed issue says the fix reached both. - **Fix:** move the pin to `7998de3724248a61a1202e4f441e99e2346d8666` (or later). So that a fix to the shared source cannot skip Firefox unnoticed again until postulo-chromium cuts its first tag, make the no-tag branch of `check-pin.mjs` fail when the pin is behind main and the commits in between touch `src/`, or at least fail outside a release with a message naming the commits. Once tags exist, the existing latest-tag rule covers this. Related to postulo/postulo-chromium#1 (closed), whose fix never reached the Firefox build, and to #3 and #4, which both plan to move the pin for their own changes but not for this one. ## Done when - `source.json` pins a postulo-chromium commit that contains `7998de3`. - `scripts/check-pin.mjs` exits non-zero when, with no tag, the pin is behind main by commits that change `src/` (checked by hand or by a small script test against a fixture of `ls-remote` output).

tiagoagueda added this to the 0.6.0 milestone

2026-10-01 10:47:19 +00:00

tiagoagueda added the

bug

label

2026-10-01 10:47:19 +00:00

tiagoagueda referenced this issue from a commit

2026-10-04 15:21:01 +00:00

Build from the chromium commit that has the fixes, and fail when the pin falls behind

tiagoagueda closed this issue

2026-10-04 15:21:01 +00:00

tiagoagueda referenced this issue from Postulo/postulo-thunderbird