[iceweasel]: move v97.0.2 to libre-testing

see note in the 'revert v98 branding' commit, and
https://lists.parabola.nu/pipermail/dev/2022-March/008200.html

2 files changed, 508 insertions, 462 deletions

diff --git a/libre-testing/iceweasel/PKGBUILD b/libre-testing/iceweasel/PKGBUILD
index 089cce366..006579d60 100644
--- a/libre-testing/iceweasel/PKGBUILD
+++ b/libre-testing/iceweasel/PKGBUILD
@@ -1,223 +1,523 @@
-# Maintainer (Arch:firefox): Jan Alexander Steffens (heftig) <jan.steffens@gmail.com>
-# Contributor (Arch:firefox): Ionut Biru <ibiru@archlinux.org>
-# Contributor (Arch:firefox): Jakub Schmidtke <sjakub@gmail.com>
-
-# Contributor (ConnochaetOS): Henry Jensen <hjensen@connochaetos.org>
-
-# Maintainer: Andreas Grapentin <andreas@grapentin.org>
-# Maintainer: Luke Shumaker <lukeshu@parabola.nu>
+# Maintainer (arch): Jan Alexander Steffens (heftig) <heftig@archlinux.org>
+# Contributor: Ionut Biru <ibiru@archlinux.org>
+# Contributor: Jakub Schmidtke <sjakub@gmail.com>
+# Contributor: Henry Jensen <hjensen@connochaetos.org>
+# Maintainer (archarm): Kevin Mihelich <kevin@archlinuxarm.org>
+# Maintainer (arch32): Andreas Baumann <mail@andreasbaumann.cc>
+# Contributor: Erich Eckner <git@eckner.net>
+# Contributor: Andreas Grapentin <andreas@grapentin.org>
+# Contributor: Luke Shumaker <lukeshu@parabola.nu>
 # Contributor: André Silva <emulatorman@hyperbola.info>
 # Contributor: Márcio Silva <coadde@hyperbola.info>
 # Contributor: fauno <fauno@kiwwwi.com.ar>
 # Contributor: vando <facundo@esdebian.org>
 # Contributor: Figue <ffigue at gmail>
+# Contributor: evr <evanroman at gmail>
+# Contributor: Muhammad 'MJ' Jassim <UnbreakableMJ@gmail.com>
 # Contributor: taro-k <taro-k@movasense_com>
 # Contributor: Michał Masłowski <mtjm@mtjm.eu>
 # Contributor: Luke R. <g4jc@openmailbox.org>
 # Contributor: Isaac David <isacdaavid@isacdaavid.info>
 # Contributor: bill-auger <bill-auger@programmer.net>
-# Contributor: evr <evanroman at gmail>
-# Contributor: Muhammad 'MJ' Jassim <UnbreakableMJ@gmail.com>
+# Contributor: grizzlyuser <grizzlyuser@protonmail.com>
 
-# Rational for inclusion in [libre]:
+
+# parabola changes and rationale
+# FSDG:
 #  - Modify the addons pages to use GNU IceCat plugins sources, rather
-#    than addons.mozilla.org, which hosts non-free addons.
-#  - Disable EME, which is implemented via the non-free libWideVine
-#    CDM.
-#
-# The above changes cause us to run afoul of the Firefox trademark
-# policy[1], so making those changes also requires us to:
-#  - Rebrand to Iceweasel
+#    than addons.mozilla.org, which hosts non-free addons
+#  - Disable EME, which is implemented via the non-free libWideVine CDM
+#  - Disable Normandy that let Mozilla push messages with recommendations
+#    of nonfree software
+#  - Make Remote Settings work completely offline using local data
+#  - Rebrand to Iceweasel, per the mozilla trademark policy,
+#    due to these FSDG changes
 #
-# While we're at it, while not strictly nescessary for FSDG
-# compliance:
+# technical:
+#  - build i686 with GCC instead of clang
+#  - disable rust-SIMD, LTO, PGO, and skip profiling build for armv7h and i686
+#  - allow skipping profiling build for x86_64 (_x86_64_skip_pgo)
+#  - prefer as many system libs as possible, over their vendored couterparts
+# 
+# privacy:
 #  - Remove Google API keys and usage
 #  - Disable Mozilla telemetry and crash reporting (good manners
-#    because of all of the other patching we're doing
-#
-# [1]: https://www.mozilla.org/en-US/foundation/trademarks/policy/
-#
-# IMPORTANT NOTICE:
-#   libremakepkg *will* choke on this package, unless sufficient space is
-#   provided in /tmp.
-#
-#   currently, at least 4.2MiB are required.
+#    because of all of the other patching we're doing)
+
+
 pkgname=iceweasel
-replaces=('firefox')
 epoch=1
-pkgver=65.0.1
+pkgver=97.0.2
 pkgrel=1
-pkgrel+=.parabola1.testing1
-_brandingver=${pkgver%.*}
-_brandingrel=1
-pkgdesc="Libre standalone web browser based on Mozilla Firefox"
+pkgrel+=.parabola4
+_brandingver=95.0-1
+pkgdesc="Standalone web browser derived from Mozilla Firefox"
 arch=(x86_64)
-arch+=(i686 armv7h)
+arch+=(armv7h i686)
 license=(MPL GPL LGPL)
-url="https://wiki.parabola.nu/$pkgname"
-depends=(gtk3 mozilla-common libxt startup-notification mime-types dbus-glib
-         ffmpeg nss ttf-font libpulse sqlite libvpx icu)
-makedepends=(unzip zip diffutils python2-setuptools yasm mesa imake inetutils
-             xorg-server-xvfb autoconf2.13 rust mercurial clang llvm jack gtk2
-             python nodejs python2-psutil cbindgen nasm)
-makedepends+=(mozilla-searchplugins quilt libxslt imagemagick)
+url="https://wiki.parabola.nu/Iceweasel"
+depends=(gtk3 libxt mime-types dbus-glib ffmpeg nss ttf-font libpulse)
+makedepends=(unzip zip diffutils yasm mesa imake inetutils xorg-server-xvfb
+             autoconf2.13 rust clang llvm jack nodejs cbindgen nasm
+             python-setuptools python-psutil python-zstandard lld dump_syms
+             wasi-compiler-rt wasi-libc wasi-libc++ wasi-libc++abi)
+makedepends+=(quilt libxslt imagemagick git jq python-jsonschema)
+makedepends+=(libvpx=1.11.0-1)
+makedepends_i686=(gcc10)
+[[ "${CARCH}" == i686 ]] && makedepends=( ${makedepends[*]/jack/jack2} )
+makedepends_i686+=(wasi-compiler-rt=12.0.1 wasi-libc++=12.0.1 wasi-libc++abi=12.0.1) # wasi-libc=???)
 optdepends=('networkmanager: Location detection via available WiFi networks'
             'libnotify: Notification integration'
             'pulseaudio: Audio support'
             'speech-dispatcher: Text-to-Speech'
-            'hunspell-en_US: Spell checking, American English')
-options=(!emptydirs !makeflags !debug)
-_repo=https://hg.mozilla.org/mozilla-unified
-source=("hg+$_repo#tag=FIREFOX_${pkgver//./_}_RELEASE"
+            'hunspell-en_US: Spell checking, American English'
+            'xdg-desktop-portal: Screensharing with Wayland')
+replaces=('firefox')
+options=(!emptydirs !makeflags !strip !lto !debug) # FIXME: make debug package
+source=(https://archive.mozilla.org/pub/firefox/releases/${pkgver}/source/firefox-${pkgver}.source.tar.xz{,.asc}
+        0001-Use-remoting-name-for-GDK-application-names.patch
         $pkgname.desktop)
-source+=(https://repo.parabola.nu/other/iceweasel/${pkgname}_${_brandingver}-${_brandingrel}.branding.tar.xz{,.sig}
-         libre-searchengines.patch
-         libre.patch)
-sha256sums=('SKIP'
-            'ed350ef2f528b999a621f7080fa80948be6b351e67ce32529fb32bcf47bb21fa'
-            '4e4d52addfb0de4b4439e959e5c35194e35a6840a21dcf6b20c46604ae7f6482'
+source+=(https://repo.parabola.nu/other/iceweasel/${pkgname}_${_brandingver}.branding.tar.xz{,.sig}
+         9001-FSDG-always-sync-remote-settings-with-local-dump.patch
+         9002-FSDG-preference-defaults.patch
+         9003-FSDG-misc.patch
+         process-json-files.py
+         vendor.js.in)
+source_armv7h=(build-arm-libopus.patch)
+source_i686=('avoid-libxul-OOM-python-check.patch'
+             'rust-static-disable-network-test-on-static-libraries.patch'
+             'firefox-93.0_x86_math_private_20211110.patch')
+sha256sums=('c9f127741beabde78b021dc95b1740259d01677d461400682cb30e072126f075'
             'SKIP'
-            '871222c88dfd240b1805b28c98ca7431bd2b87be1ff4dbb06caa6407b106b803'
-            '4a4667d99ab50b1990de6833e9647ddd428d9206e422c7cc3754d4f80aeb8038')
+            '8de6c0ecc70d2763936be6df4b91a3d2e806765bf510f987d6f2ffa2377c3f01'
+            '9cdc2602661717712092d28bb494e5b48e518cb930898aca85eaf21f91f7ef58')
+sha256sums+=('d1b9d98cea5356df97fc5c221830de1ced8f826cb39fac9427c407e3eae54c02'
+             'SKIP'
+             'a4e3c3869085cb282cb5a0fcb64e816c0415f25d4792a62c4f1d599d3111b23c'
+             'cb3079a0dc30321183bf8e112532c6f2aad045f68103f8d422c9691137aa770e'
+             '39e3a5e1ad137e21f842a44d7e3bd24050292d2b41fe59b4e7c7dfed52a195dd'
+             '9386f1c50506cd20ab6d212335d5e4417faeb2aea371dd46f2d107d171e80b83'
+             'c93ce98e1cb64033079343ff1f3037fab6a3bc6d3eb5bc14c5edb70e2d45965d')
+sha256sums_armv7h=('2d4d91f7e35d0860225084e37ec320ca6cae669f6c9c8fe7735cdbd542e3a7c9')
+sha256sums_i686=('2f0c81a38c4578f68f5456b618fe84a78974072821488173eb55e0e72287e353'
+                 '10c5276eab2e87f400a6ec15d7ffbef3b0407ee888dea36f1128927ca55b9041'
+                 '84836b905d23a6cfdd955b9312bbb794e5329af36963c81572195039c68291fc')
+validpgpkeys=('14F26682D0916CDD81E37B6D61B7B526D98F0353') # Mozilla Software Releases <release@mozilla.com>
 validpgpkeys+=('BFA8008A8265677063B11BF47171986E4B745536') # Andreas Grapentin
+validpgpkeys+=('3954A7AB837D0EA9CFA9798925DB7D9B5A8D4B40') # bill-auger
+
+
+# PGO requires networking
+_should_skip_pgo_armv7h=1 # disable for armv7h - always
+_should_skip_pgo_i686=1   # disable for i686   - always
+_should_skip_pgo_x86_64=0 # disable for x86_64 - libremakepkg
+eval "_should_skip_pgo=\$_should_skip_pgo_${CARCH}"
+
+
+_check_build_config() {
+  pushd "$srcdir/firefox-${pkgver%_*}" > /dev/null
+
+  echo "Checking build configuration..."
+
+  # Configure produces mozinfo.json that reflects current configuration.
+  # See build/docs/mozinfo.rst
+  ./mach configure
+
+  # In this test, jq collects values of the following keys of mozinfo.json into array,
+  # and checks if any of them are not equal to false, in which case it returns "true".
+  # E.g. if the value of any key is true or null (in case the key is missing from mozinfo.json),
+  # that means the build configuration has to be reworked.
+  local obj_directory=$(./mach environment | sed -En '/object directory:/{n;s/^\s+//;p;}')
+  local antifeature_keys=(.crashreporter .datareporting .healthreport .normandy .telemetry .updater)
+  local antifeatures=()
+  echo "obj_directory is: ${obj_directory}"
+  for key in ${antifeature_keys[@]}
+  do  jq -e "${key} != false" "${obj_directory}"/mozinfo.json && antifeatures+=(${key})
+  done
+  if   (( ${#antifeatures[@]} ))
+  then echo "Some anti-features are not disabled in build configuration files, aborting:"
+       for key in ${antifeatures[@]} ; do echo "  - ${key} is enabled" ; done ;
+       return 1
+  fi
+
+  popd > /dev/null
+}
 
 prepare() {
   mkdir mozbuild
-  cd mozilla-unified
+  cd firefox-$pkgver
 
-  cat >.mozconfig <<END
+  # https://bugzilla.mozilla.org/show_bug.cgi?id=1530052
+  patch -Np1 -i ../0001-Use-remoting-name-for-GDK-application-names.patch
+
+  cat >../mozconfig <<END
 ac_add_options --enable-application=browser
+mk_add_options MOZ_OBJDIR=${PWD@Q}/obj
 
 ac_add_options --prefix=/usr
 ac_add_options --enable-release
-ac_add_options --enable-linker=gold
 ac_add_options --enable-hardening
 ac_add_options --enable-optimize
 ac_add_options --enable-rust-simd
-ac_add_options --enable-lto
-export MOZ_PGO=1
-export CC=clang
-export CXX=clang++
-export AR=llvm-ar
-export NM=llvm-nm
-export RANLIB=llvm-ranlib
+ac_add_options --enable-linker=lld
+ac_add_options --disable-elf-hack
+ac_add_options --disable-bootstrap
+ac_add_options --with-wasi-sysroot=/usr/share/wasi-sysroot
 
 # Branding
 ac_add_options --disable-official-branding
 ac_add_options --with-branding=browser/branding/iceweasel
 ac_add_options --enable-update-channel=release
 ac_add_options --with-distribution-id=nu.parabola
+ac_add_options --with-unsigned-addon-scopes=app,system
+ac_add_options --allow-addon-sideload
+export MOZ_APP_NAME=$pkgname
+export MOZ_APP_REMOTINGNAME=${pkgname}
+export MOZ_TELEMETRY_REPORTING=
+export MOZ_REQUIRE_SIGNING=
 
 # System libraries
-ac_add_options --enable-system-ffi
-ac_add_options --enable-system-sqlite
-ac_add_options --with-system-bz2
-ac_add_options --with-system-icu
-ac_add_options --with-system-jpeg
-ac_add_options --with-system-libvpx
 ac_add_options --with-system-nspr
 ac_add_options --with-system-nss
-ac_add_options --with-system-zlib
 
 # Features
 ac_add_options --enable-alsa
 ac_add_options --enable-jack
-ac_add_options --enable-startup-notification
 ac_add_options --disable-crashreporter
-ac_add_options --disable-gconf
 ac_add_options --disable-updater
+ac_add_options --disable-tests
 ac_add_options --disable-eme
 END
 
-  if [[ $CARCH = arm* ]]; then
-    sed -i '/--enable-linker=gold/d' .mozconfig
-    cat >> .mozconfig <<- END
-	ac_add_options --enable-optimize="-g -O2 -fno-schedule-insns"
-	END
-  fi # end [[ $CARCH = arm* ]]
-
-  if [[ $CARCH = i686 ]]; then
-    sed -i '/--enable-linker=gold/d' .mozconfig
-  fi # Because gold linker is alergic to some of the compile options set below to limit memory use.
-
-  ## Rebranding
-  local brandingdir="$srcdir/$pkgname-$_brandingver"
-  rm -rf -- browser/branding/$pkgname
-  cp -aT -- $brandingdir/branding browser/branding/$pkgname
-  # patching
-  export QUILT_PATCHES=$brandingdir/patches
-  export QUILT_REFRESH_ARGS='-p ab --no-timestamps --no-index'
-  export QUILT_DIFF_ARGS='--no-timestamps'
-  quilt push -av
+
+  ## [ARCH-SPECIFIC CONFIG] ##
+
+  case ${CARCH} in
+    armv7h)
+      sed -i '
+        /--enable-hardening/d
+        /--enable-optimize/d
+        /--enable-rust-simd/d
+        s|--with-wasi-sysroot=/usr/share/wasi-sysroot|--without-wasm-sandboxed-libraries|
+      ' ../mozconfig
+
+      cat >>../mozconfig <<END
+export CC=clang
+export CXX=clang++
+ac_add_options --disable-elf-hack
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=1641623
+ac_add_options --disable-av1
+ac_add_options --enable-optimize="-g0 -O2"
+mk_add_options MOZ_MAKE_FLAGS='-j1'
+END
+
+      # mozbuild.configure.options.InvalidOptionError: --disable-eme is not available in this configuration
+      # EME is disabled anyway in the built package, but better check if it exists for ARM each new release.
+      sed -i 's|ac_add_options --disable-eme||' ../mozconfig
+
+      echo "applying build-arm-libopus.patch"
+      patch -p1 -i ../build-arm-libopus.patch
+    ;;
+    i686)
+      # disable LTO and use gcc toolchain (clang has issues on IA32)
+      # disable SIMD (SSE2 for i686)
+      export MOZ_SOURCE_CHANGESET="DEVEDITION_${pkgver//./_}_RELEASE"
+      cat >>../mozconfig <<END
+ac_add_options --disable-linker=lld
+ac_add_options --enable-linker=bfd
+ac_add_options --disable-lto
+ac_add_options --disable-rust-simd
+export CC=gcc-10
+export CXX=g++-10
+export AR=gcc-ar-10
+export NM=gcc-nm-10
+export RANLIB=gcc-ranlib-10
+END
+
+      # readelf: Error: Unable to seek to 0x801db328 for section headers
+      echo "applying avoid-libxul-OOM-python-check.patch"
+      patch -p1 -i ../avoid-libxul-OOM-python-check.patch
+
+      # test failure in rust code (complaining about network functions) when PGO is used,
+      # see https://bugzilla.mozilla.org/show_bug.cgi?id=1565757
+      echo "applying rust-static-disable-network-test-on-static-libraries.patch"
+      patch -p1 -i ../rust-static-disable-network-test-on-static-libraries.patch
+
+      # FIXME: this patch is probably temporary - it comes from mozilla
+      #          https://bugzilla.mozilla.org/show_bug.cgi?id=1729459
+      #        /build/iceweasel/src/firefox-96.0.1/modules/fdlibm/src/math_private.h:34:21:
+      #          error: conflicting declaration ‘typedef __double_t double_t’
+      #        /usr/include/math.h:156:21: note: previous declaration as ‘typedef long double double_t’
+      echo "applying firefox-93.0_x86_math_private_20211110.patch"
+      patch -p1 -i ../firefox-93.0_x86_math_private_20211110.patch
+    ;;
+    x86_64)
+    ;;
+    *) echo "no [ARCH-SPECIFIC CONFIG] for arch: ${CARCH}" ; return 1 ;
+    ;;
+  esac
+
+
+  ## branding ##
+
+  echo "applying parabola branding"
+  local brandingsrcdir="${srcdir}"/${pkgname}-${_brandingver/-*}
+  local brandingdestdir=browser/branding/${pkgname}
+  rm -rf -- ${brandingdestdir}
+  cp -aT -- ${brandingsrcdir}/branding ${brandingdestdir}
+  cp "${brandingdestdir}"/iceweasel_logo.svg "${brandingdestdir}"/content/aboutlogins.svg
+  cp "${brandingdestdir}"/iceweasel_logo.svg "${brandingdestdir}"/content/about-logo.svg
+
+  # produce icons
+  for i in 16 22 24 32 48 64 128 192 256 384; do
+    rsvg-convert -w ${i} -h ${i} "${brandingsrcdir}"/branding/${pkgname}_icon.svg \
+                 -o "${brandingdestdir}"/default${i}.png
+  done
+
+  # custom new tab page
+  # FIXME: the newtab page (aka "Start Page") has changed significantly
+  #        the new upstream start page ('activity-streams') is an add-on now
+  #        it must be forked and customized externally, then copied into the browser tree
+  #        see: the branding-dev-build/ dir on the '68.0' branch of the branding git repo
+  #        some of the branding components above and commented out below may no longer be used
+  #        the following section aims to restore something similar
+  #          to the previous parabola-branded "start page"
+  #        once it is working well, all of these comments should be removed
+  #          and any unused branding components may be deleted from the branding package
   # Put "Start Page" branding images in the source code
   #install -m644 -t browser/base/content/abouthome -- \
-  #  "$brandingdir/branding"/{drm-free,gnu_headshadow,parabola-banner}.png
+  #  "${brandingsrcdir}/branding"/{drm-free,gnu_headshadow,parabola-banner}.png
   #install -m644 -t browser/extensions/onboarding/content/img -- \
-  #   "$brandingdir/branding/watermark.svg"
-  # produce icons
-  for i in 16 22 24 32 48 64 128 192 256 384; do
-    rsvg-convert -w $i -h $i "$brandingdir/branding/${pkgname}_icon.svg" \
-      -o "browser/branding/iceweasel/default$i.png"
+  #   "${brandingsrcdir}/branding/watermark.svg"
+
+  # process default Top Sites and their icons
+  local tippytopdir=browser/components/newtab/data/content/tippytop
+  find ${tippytopdir} -type f      \
+       -not -name 'wikipedia-org*' \
+       -not -name 'top_sites.json' \
+       -exec rm -v {} \;
+  for image in "${brandingsrcdir}"/tippytop/*.svg; do
+    local outname=$(basename -s .svg "${image}")
+    local size=$(identify -format '%wx%h' ${tippytopdir}/images/wikipedia-org@2x.png)
+    local background=$( [[ "${outname}" == 'gnu' ]] && echo 'white' || echo 'none' )
+    magick -density 300 ${image}                           \
+           -gravity center -resize ${size} -extent ${size} \
+           "${tippytopdir}/images/${outname}@2x.png"
+
+    size=256x256
+    magick -density 300 -background ${background} ${image} \
+           -gravity center -resize ${size} -extent ${size} \
+           -define icon:auto-resize=64,48,32,16            \
+           "${tippytopdir}/favicons/${outname}.ico"
   done
 
-  # Remove remaining non-free bits
-  patch -Np1 -i "$srcdir/libre.patch"
-
-  #sed -i 's/Adobe Flash/SWF Player/g' -- \
-  #  browser/base/content/pageinfo/permissions.js \
-  #  browser/base/content/browser-plugins.js
-  #sed -e '/"displayName": "Flash"/     s/Flash/SWF Player/'     \
-  #    -e '/"displayName": "Shockwave"/ s/Shockwave/DCR Player/' \
-  #    -e '/"displayName": "QuickTime"/ s/QuickTime/MOV Player/' \
-  #    -e '/installLinux/ s/true/false/' \
-  #    -i -- browser/base/content/browser-plugins.js
-  # re-use 'abouthome' page for 'newtab' page
-  #install -d browser/base/content/newtab
-  #cat browser/base/content/abouthome/aboutHome.xhtml > browser/base/content/newtab/newTab.xhtml
-
-  # Load our searchplugins
-  patch -Np1 -i "$srcdir/libre-searchengines.patch"
-  rm -rvf -- browser/components/search/searchplugins/{*.xml,images/}
-  cp -av -- /usr/lib/mozilla/searchplugins/* browser/components/search/searchplugins/
+  # apply branding patches
+  export QUILT_PATCHES="${brandingsrcdir}"/patches
+  export QUILT_REFRESH_ARGS='-p ab --no-timestamps --no-index'
+  export QUILT_DIFF_ARGS='--no-timestamps'
+  export QUILT_PC="${srcdir}"/.pc
+  quilt push -av
+
+
+  ## searchengines ##
+
+  pushd browser/components/search/extensions
+
+  # Patch search-engines configs
+  sed -i 's|https://duckduckgo.com/|https://html.duckduckgo.com/html/|' ddg/manifest.json
+
+  # Removing URL parameters that let DuckDuckGo know the place in UI
+  # the search was ran from (like address bar, context menu, etc.)
+  local jq_cmd='del(.chrome_settings_overrides.search_provider.params)'
+  jq "${jq_cmd}" ddg/manifest.json > manifest.json.tmp
+  ! diff manifest.json.tmp ddg/manifest.json > /dev/null
+  mv manifest.json.tmp ddg/manifest.json
+
+  # Delete unused search engine configs
+  find -mindepth 1 -maxdepth 1 \
+       -not -name ddg \
+       -not -name wikipedia \
+       -exec rm -frv {} \;
+
+  popd
+
+
+  ## libre patching ##
+
+  # Upstream tarball can contain some ignored cruft,
+  # including binaries (for example, python3).
+  echo 'Removing files specified in .gitignore...'
+  git init && git clean -dfX \
+    -e '!ipc/chromium/src/third_party/libevent/evconfig-private.h' \
+    -e '!toolkit/crashreporter/google-breakpad/src/third_party/lss/' \
+    -e '!third_party/python/**/*.egg-info/'
+  rm -rf .git
+
+  # Remove test-related networking dumps, because they contain code from
+  # some Amazon webpage with no clear licensing, thus nonfree.
+  # Also they interfere with checking of Remote Settings patching done later,
+  # because communication with RS server has been captured in them too.
+  rm python/mozperftest/mozperftest/system/example.zip
+  rm testing/mozbase/mozproxy/tests/files/mitm5-linux-firefox-amazon.zip
+
+  # Disable/neutralize Remote Settings (as best we can)
+  echo "applying 9001-FSDG-always-sync-remote-settings-with-local-dump.patch"
+  patch -Np1 --no-backup-if-mismatch -i ../9001-FSDG-always-sync-remote-settings-with-local-dump.patch
+
+  # Verify Remote Settings patching
+  local settings_server='firefox.settings.services.mozilla.com'
+  ! grep -qr $settings_server || { echo 'Remote Settings patching needs rework'; return 1; }
 
   # Disable various components at the source level
-  sed -i 's/;1/;0/' toolkit/components/telemetry/TelemetryStartup.manifest
+  sed -i 's/;1/;0/' toolkit/components/telemetry/components.conf
+  sed -Ei 's/((MOZ_SERVICES_HEALTHREPORT|MOZ_NORMANDY).+)True/\1False/' browser/moz.configure
   #sed -i 's/;1/;0/' browser/experiments/Experiments.manifest
   #sed -i '/pocket/d'          browser/extensions/moz.build
   #sed -i '/activity-stream/d' browser/extensions/moz.build
+
+  python ../process-json-files.py "${srcdir}"/firefox-${pkgver} "${brandingsrcdir}"
+
+  echo "applying 9002-FSDG-preference-defaults.patch"
+  patch -Np1 --no-backup-if-mismatch -i "${srcdir}"/9002-FSDG-preference-defaults.patch
+
+  # Remove remaining non-free bits
+  echo "applying 9003-FSDG-misc.patch"
+  patch -Np1 --no-backup-if-mismatch -i "${srcdir}"/9003-FSDG-misc.patch
 }
 
 build() {
-  cd mozilla-unified
+  cd firefox-$pkgver
+
+  ## build env ##
 
-  export MOZ_SOURCE_REPO="$_repo"
   export MOZ_NOSPAM=1
   export MOZBUILD_STATE_PATH="$srcdir/mozbuild"
-
-  if [[ $CARCH = i686 ]]; then
-    export RUSTFLAGS+=" -Cdebuginfo=0 -Clto=off" 
-    export LDFLAGS+=" -Wl,--no-keep-memory -Wl,--reduce-memory-overheads"
-    echo "Fixing x32 memory limits"
-  fi #Fix Memory issue
+  export MACH_USE_SYSTEM_PYTHON=1
 
   # LTO needs more open files
   ulimit -n 4096
 
+  # clang-{9,10,11} -> error: unknown argument: '-fvar-tracking-assignments'
+  CFLAGS="${CFLAGS/-fvar-tracking-assignments/}"
+  CXXFLAGS="${CXXFLAGS/-fvar-tracking-assignments/}"
+
+
+  ## [ARCH-SPECIFIC BUILD ENV] ##
+
+  case ${CARCH} in
+    armv7h)
+      export MOZ_DEBUG_FLAGS=" "
+      export CFLAGS+=" -g0"
+      export CXXFLAGS+=" -g0"
+      export LDFLAGS+=" -Wl,--no-keep-memory"
+      export RUSTFLAGS="-Cdebuginfo=0"
+    ;;
+    i686)
+      # -fno-plt with cross-LTO -> LLVM ERROR: Function Import: link error
+      CFLAGS="${CFLAGS/-fno-plt/}"
+      CXXFLAGS="${CXXFLAGS/-fno-plt/}"
+
+      # disable LTO (clang has issues on IA32)
+      export RUSTFLAGS+=" -Cdebuginfo=0 -Clto=off"
+      export LDFLAGS+=" -Wl,--no-keep-memory -Wl,--reduce-memory-overheads"
+
+      # libvpx has some hard-coded compiler flags for MMX, SSE, SSE2, use the correct one
+      # per CARCH (75.0 uses an intrisic _mm_empty now, which required the corresponding
+      # architecture flag to be preset - before it was merely embedding some assembly
+      # code with EMMS
+      export CFLAGS+=" -mmmx"
+      export CXXFLAGS+=" -mmmx"
+    ;;
+    x86_64)
+    ;;
+    *) echo "no [ARCH-SPECIFIC BUILD ENV] for arch: ${CARCH}" ; return 1 ;
+    ;;
+  esac
+  export CFLAGS
+  export CXXFLAGS
+
+
+  ## [ARCH-SPECIFIC BUILD CONFIG] ##
+
+  case ${CARCH} in
+    armv7h)
+    ;;
+    i686)
+      # avoid excessive debug symbols in rust leading to out-of-memory situations
+      sed -i "s/debug_info = '\''2'\''/debug_info = '\''0'\''/" build/moz.configure/toolchain.configure
+    ;;
+    x86_64)
+    ;;
+    *) echo "no [ARCH-SPECIFIC BUILD CONFIG] for arch: ${CARCH}" ; return 1 ;
+    ;;
+  esac
+
+
+  ## PGO build ##
+
+  if (( $_should_skip_pgo ))
+  then
+    # skipping "3-tier PGO" "instrumented browser", to avoid OOM problems;
+    # so we have the final .mozconfig now
+    cp ../mozconfig .mozconfig
+  else
+    # Do 3-tier PGO
+    echo "Building instrumented browser..."
+    cat >.mozconfig ../mozconfig - <<END
+ac_add_options --enable-profile-generate=cross
+END
+    _check_build_config
+    ./mach build
+
+    echo "Profiling instrumented browser..."
+    ./mach package
+    LLVM_PROFDATA=llvm-profdata \
+      JARLOG_FILE="$PWD/jarlog" \
+      xvfb-run -s "-screen 0 1920x1080x24 -nolisten local" \
+      ./mach python build/pgo/profileserver.py
+
+    if [[ ! -s merged.profdata ]]; then
+      echo "No profile data produced."
+      return 1
+    fi
+
+    if [[ ! -s jarlog ]]; then
+      echo "No jar log produced."
+      return 1
+    fi
+
+    echo "Removing instrumented browser..."
+    ./mach clobber
+
+    cat >.mozconfig ../mozconfig - <<END
+ac_add_options --enable-lto=cross
+ac_add_options --enable-profile-use=cross
+ac_add_options --with-pgo-profile-path=${PWD@Q}/merged.profdata
+ac_add_options --with-pgo-jarlog=${PWD@Q}/jarlog
+END
+  fi # $_should_skip_pgo
+
+
+  ## sanity checks ##
+
+  # each of the [ARCH-SPECIFIC BUILD CONFIG] branches above should have created .mozconfig
+  [[ ! -f .mozconfig ]] && echo ".mozconfig file not found in source root" && return 1
+  _check_build_config
+
+
+  ## main build ##
+
+  echo "Building optimized browser..."
   ./mach build
-  ./mach buildsymbols
 }
 
 package() {
-  local _icu_ver
-  _icu_ver=$(pacman -S --print-format='%v' icu)
-  depends+=("icu>=${_icu_ver}" "icu<$((${_icu_ver%%.*} + 1))")
-
-  cd mozilla-unified
+  cd firefox-$pkgver
   DESTDIR="$pkgdir" ./mach install
-  find . -name '*crashreporter-symbols-full.zip' -exec cp -fvt "$startdir" {} +
 
-  _vendorjs="$pkgdir/usr/lib/$pkgname/browser/defaults/preferences/vendor.js"
-  install -Dm644 /dev/stdin "$_vendorjs" <<END
+  local vendorjs="$pkgdir/usr/lib/$pkgname/browser/defaults/preferences/vendor.js"
+  install -Dvm644 /dev/stdin "$vendorjs" <<END
 // Use LANG environment variable to choose locale
 pref("intl.locale.requested", "");
 
@@ -227,326 +527,19 @@ pref("spellchecker.dictionary_path", "/usr/share/hunspell");
 // Disable default browser checking.
 pref("browser.shell.checkDefaultBrowser", false);
 
-// Don't disable our bundled extensions in the application directory
+// Don't disable extensions in the application directory
 pref("extensions.autoDisableScopes", 11);
-pref("extensions.shownSelectionUI", true);
 END
 
   # Parabola additions to vendor.js
-  #
-  # TODO: Go through this and figure out what's nescessary, remove
-  # most of it.  This is mostly cargo-cult BS.  For example, disabling
-  # all the EME stuff... that's already off because of `--disable-eme`
-  # in `.mozconfig`.  Some of these settings no longer exist.  Some of
-  # these settings don't do anything on GNU/Linux.
-  #
-  # However, they don't seem to be causing any of the critical issues.
-  local _shortver=$(cut -d. -f1,2 <<<"$pkgver")
-  cat >> "$_vendorjs" <<END
-// Disable "alt" as a shortcut key to open full menu bar. Conflicts with "alt" as a modifier
-pref("ui.key.menuAccessKeyFocuses", false);
-
-// Disable the GeoLocation API for content
-pref("geo.enabled", false);
-
-// Make sure that the request URL of the GeoLocation backend is empty
-pref("geo.wifi.uri", "");
-
-// Disable Freedom Violating DRM Feature
-pref("browser.eme.ui.enabled", false);
-// EME
-pref("media.eme.enabled", false);
-pref("media.eme.apiVisible", false);
-
-// Google Widevine DRM
-// https://blog.mozilla.org/futurereleases/2016/04/08/mozilla-to-test-widevine-cdm-in-firefox-nightly/
-// https://wiki.mozilla.org/QA/Widevine_CDM
-// https://bugzilla.mozilla.org/show_bug.cgi?id=1288580
-pref("media.gmp-widevinecdm.visible", false);
-pref("media.gmp-widevinecdm.enabled", false);
-pref("media.gmp-widevinecdm.autoupdate", false);
-
-// Default to classic view for about:newtab
-pref("browser.newtabpage.enhanced", false);
-pref("browser.newtabpage.activity-stream.enabled", false);
-
-// Poodle attack
-pref("security.tls.version.min", 1);
-
-// Don't call home for blacklisting
-pref("extensions.blocklist.enabled", false);
-
-// Disable plugin installer
-pref("plugins.hide_infobar_for_missing_plugin", true);
-pref("plugins.hide_infobar_for_outdated_plugin", true);
-pref("plugins.notifyMissingFlash", false);
-
-//https://developer.mozilla.org/en-US/docs/Web/API/MediaSource
-//pref("media.mediasource.enabled",true);
-
-// Speeding it up
-pref("network.http.pipelining", true);
-pref("network.http.proxy.pipelining", true);
-pref("network.http.pipelining.maxrequests", 10);
-pref("nglayout.initialpaint.delay", 0);
-
-// Disable third party cookies
-pref("network.cookie.cookieBehavior", 1);
-
-// Prevent EULA dialog to popup on first run
-pref("browser.EULA.override", true);
-
-// Set useragent to Firefox compatible
-//pref("general.useragent.compatMode.firefox", true);
-// Spoof the useragent to a generic one
-pref("general.useragent.compatMode.firefox", true);
-// Spoof the useragent to a generic one
-pref("general.useragent.override", "Mozilla/5.0 (Windows NT 6.1; rv:$_shortver) Gecko/20100101 Firefox/$_shortver");
-pref("general.appname.override", "Netscape");
-pref("general.appversion.override", "$_shortver");
-pref("general.buildID.override", "Gecko/20100101");
-pref("general.oscpu.override", "Windows NT 6.1");
-pref("general.platform.override", "Win32");
-
-// Privacy & Freedom Issues
-// https://webdevelopmentaid.wordpress.com/2013/10/21/customize-privacy-settings-in-mozilla-firefox-part-1-aboutconfig/
-// https://panopticlick.eff.org
-// http://ip-check.info
-// http://browserspy.dk
-// https://wiki.mozilla.org/Fingerprinting
-// http://www.browserleaks.com
-// http://fingerprint.pet-portal.eu
-pref("privacy.donottrackheader.enabled", true);
-pref("privacy.donottrackheader.value", 1);
-pref("dom.ipc.plugins.flash.subprocess.crashreporter.enabled", false);
-
-// CIS 2.1.1 Disable Auto Update / Balrog
-pref("app.update.auto", false);
-pref("app.update.checkInstallTime", false);
-pref("app.update.enabled", false);
-pref("app.update.staging.enabled", false);
-pref("app.update.url", "about:blank");
-pref("media.gmp-manager.certs.1.commonName", "");
-pref("media.gmp-manager.certs.2.commonName", "");
-// Disable Gecko media plugins: https://wiki.mozilla.org/GeckoMediaPlugins
-pref("media.gmp-manager.url", "http://127.0.0.1/");
-pref("media.gmp-manager.url.override", "data:text/plain,");
-pref("media.gmp-provider.enabled", false);
-// Don't install openh264 codec
-pref("media.gmp-gmpopenh264.enabled", false);
-pref("media.gmp-eme-adobe.enabled", false);
-pref("media.peerconnection.video.h264_enabled", false);
-
-// CIS 2.3.4 Block Reported Web Forgeries
-// http://kb.mozillazine.org/Browser.safebrowsing.enabled
-// http://kb.mozillazine.org/Safe_browsing
-// https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work
-// http://forums.mozillazine.org/viewtopic.php?f=39&t=2711237&p=12896849#p12896849
-pref("browser.safebrowsing.enabled", false);
-
-// CIS 2.3.5 Block Reported Attack Sites
-// http://kb.mozillazine.org/Browser.safebrowsing.malware.enabled
-pref("browser.safebrowsing.malware.enabled", false);
-
-// Disable safe browsing remote lookups for downloaded files.
-// This leaks information to google.
-// https://www.mozilla.org/en-US/firefox/39.0/releasenotes/
-// https://wiki.mozilla.org/Security/Application_Reputation
-pref("browser.safebrowsing.downloads.remote.enabled", false);
-pref("browser.safebrowsing.appRepURL", "about:blank");
-pref("browser.safebrowsing.provider.mozilla.gethashURL", "about:blank");
-pref("browser.safebrowsing.provider.mozilla.updateURL", "about:blank");
-pref("browser.safebrowsing.downloads.remote.block_dangerous", false);
-pref("browser.safebrowsing.downloads.remote.block_dangerous_host", false);
-pref("browser.safebrowsing.downloads.remote.block_potentially_unwanted", false);
-pref("browser.safebrowsing.downloads.remote.block_uncommon", false);
-pref("browser.safebrowsing.downloads.remote.enabled", false);
-pref("browser.safebrowsing.downloads.remote.url", "about:blank");
-pref("browser.safebrowsing.provider.google.gethashURL", "about:blank");
-pref("browser.safebrowsing.provider.google.updateURL", "about:blank");
-pref("browser.safebrowsing.provider.google.lists", "about:blank");
-
-// https://bugzilla.mozilla.org/show_bug.cgi?id=1025965
-pref("browser.safebrowsing.phishing.enabled", false);
-pref("browser.safebrowsing.provider.google4.lists", "about:blank");
-pref("browser.safebrowsing.provider.google4.updateURL", "about:blank");
-pref("browser.safebrowsing.provider.google4.gethashURL", "about:blank");
-pref("browser.safebrowsing.provider.google4.reportURL", "about:blank");
-pref("browser.safebrowsing.provider.mozilla.lists", "about:blank");
-
-// Disable Microsoft Family Safety MiTM support
-// https://bugzilla.mozilla.org/show_bug.cgi?id=1239166
-// https://wiki.mozilla.org/SecurityEngineering/Untrusted_Certificates_in_Windows_Child_Mode
-// https://hg.mozilla.org/releases/mozilla-release/file/ddb37c386bb2ffa180117b4d30ca3b41a8af233c/security/manager/ssl/nsNSSComponent.cpp#l782
-pref("security.family_safety.mode", 0);
-// https://bugzilla.mozilla.org/show_bug.cgi?id=1265113
-// https://hg.mozilla.org/releases/mozilla-release/rev/d9659c22b3c5
-// https://bugzilla.mozilla.org/show_bug.cgi?id=1298883
-pref("security.enterprise_roots.enabled", false);
-
-//pref("services.sync.privacyURL", "https://www.gnu.org/software/gnuzilla/");
-pref("social.enabled", false);
-pref("social.remote-install.enabled", false);
-pref("datareporting.healthreport.uploadEnabled", false);
-pref("datareporting.healthreport.about.reportUrl", "127.0.0.1");
-pref("datareporting.healthreport.documentServerURI", "127.0.0.1");
-pref("healthreport.uploadEnabled", false);
-pref("social.toast-notifications.enabled", false);
-pref("datareporting.policy.dataSubmissionEnabled", false);
-pref("datareporting.healthreport.service.enabled", false);
-pref("browser.slowStartup.notificationDisabled", true);
-pref("network.http.sendRefererHeader", 2);
-//pref("network.http.referer.spoofSource", true);
-//http://grack.com/blog/2010/01/06/3rd-party-cookies-dom-storage-and-privacy/
-//pref("dom.storage.enabled", false);
-pref("dom.event.clipboardevents.enabled",false);
-pref("network.prefetch-next", false);
-pref("network.dns.disablePrefetch", true);
-pref("network.http.sendSecureXSiteReferrer", false);
-pref("toolkit.telemetry.archive.enabled", false);
-pref("toolkit.telemetry.bhrPing.enabled", false);
-pref("toolkit.telemetry.enabled", false);
-pref("toolkit.telemetry.unified", false);
-pref("toolkit.telemetry.newProfilePing.enabled", false);
-pref("toolkit.telemetry.firstShutdownPing.enabled", false);
-pref("toolkit.telemetry.server", "127.0.0.1");
-pref("app.shield.optoutstudies.enabled", false);
-pref("experiments.enabled", false);
-pref("experiments.manifest.uri", "127.0.0.1");
-pref("extensions.pocket.enabled", false);
-pref("extensions.pocket.api", "127.0.0.1");
-// Do not tell what plugins do we have enabled: https://mail.mozilla.org/pipermail/firefox-dev/2013-November/001186.html
-pref("plugins.enumerable_names", "");
-pref("plugin.state.flash", 0);
-// Do not autoupdate search engines
-pref("browser.search.update", false);
-// Warn when the page tries to redirect or refresh
-//pref("accessibility.blockautorefresh", true);
-pref("dom.battery.enabled", false);
-pref("device.sensors.enabled", false);
-pref("camera.control.face_detection.enabled", false);
-pref("camera.control.autofocus_moving_callback.enabled", false);
-pref("network.http.speculative-parallel-limit", 0);
-// No search suggestions
-pref("browser.urlbar.userMadeSearchSuggestionsChoice", true);
-pref("browser.search.suggest.enabled", false);
-
-// Crypto hardening
-// https://gist.github.com/haasn/69e19fc2fe0e25f3cff5
-// General settings
-//pref("security.tls.unrestricted_rc4_fallback", false);
-//pref("security.tls.insecure_fallback_hosts.use_static_list", false);
-//pref("security.tls.version.min", 1);
-//pref("security.ssl.require_safe_negotiation", true);
-//pref("security.ssl.treat_unsafe_negotiation_as_broken", true);
-//pref("security.ssl3.rsa_seed_sha", true);
-//pref("security.OCSP.enabled", 1);
-//pref("security.OCSP.require", true);
-
-
-// WebRTC
-pref("media.peerconnection.enabled", false);
-pref("media.peerconnection.ice.default_address_only", true);
-
-pref("font.default.x-western", "sans-serif");
-
-// Preferences for the Get Add-ons panel and search engines
-pref("extensions.webservice.discoverURL", "https://directory.fsf.org/wiki/GNU_IceCat");
-pref("extensions.getAddons.search.url", "https://directory.fsf.org/wiki/GNU_IceCat");
-pref("browser.search.searchEnginesURL", "https://directory.fsf.org/wiki/GNU_IceCat");
-
-// Mobile
-pref("privacy.announcements.enabled", false);
-pref("browser.snippets.enabled", false);
-pref("browser.snippets.syncPromo.enabled", false);
-pref("identity.mobilepromo.android", "https://f-droid.org/repository/browse/?fdid=org.gnu.icecat&");
-pref("browser.snippets.geoUrl", "http://127.0.0.1/");
-pref("browser.snippets.updateUrl", "http://127.0.0.1/");
-pref("browser.snippets.statsUrl", "http://127.0.0.1/");
-pref("datareporting.policy.firstRunTime", 0);
-pref("datareporting.policy.dataSubmissionPolicyVersion", 2);
-pref("browser.webapps.checkForUpdates", 0);
-pref("browser.webapps.updateCheckUrl", "http://127.0.0.1/");
-pref("app.faqURL", "http://libreplanet.org/wiki/Group:IceCat/FAQ");
-
-// PFS url
-pref("pfs.datasource.url", "http://gnuzilla.gnu.org/plugins/PluginFinderService.php?mimetype=%PLUGIN_MIMETYPE%");
-pref("pfs.filehint.url", "http://gnuzilla.gnu.org/plugins/PluginFinderService.php?mimetype=%PLUGIN_MIMETYPE%");
-
-// Geolocation depends on third party services
-pref("geo.enabled", false);
-pref("geo.wifi.uri", "");
-
-// Disable heartbeat
-pref("browser.selfsupport.url", "");
-
-// Disable Link to FireFox Marketplace, currently loaded with non-free "apps"
-pref("browser.apps.URL", "");
-
-// Use old style preferences, that allow javascript to be disabled
-pref("browser.preferences.inContent",false);
-
-// Don't download ads for the newtab page
-pref("browser.newtabpage.directory.source", "");
-pref("browser.newtabpage.directory.ping", "");
-pref("browser.newtabpage.introShown", true);
-
-// Disable home snippets
-pref("browser.aboutHomeSnippets.updateUrl", "data:text/html");
-
-// Disable hardware acceleration and WebGL
-//pref("layers.acceleration.disabled", false);
-pref("webgl.disabled", false);
-
-// Disable SSDP
-pref("browser.casting.enabled", false);
-
-// Disable directory service
-pref("social.directories", "");
-pref("social.whitelist", "");
-pref("social.shareDirectory", "");
-
-// Disable Pocket integration
-pref("browser.pocket.api", "about:blank");
-pref("browser.pocket.enabled", false);
-pref("browser.pocket.enabledLocales", "about:blank");
-pref("browser.pocket.oAuthConsumerKey", "about:blank");
-pref("browser.pocket.site", "about:blank");
-pref("browser.pocket.useLocaleList", false);
-pref("extensions.pocket.enabled", false);
-
-// Do not require xpi extensions to be signed by Mozilla
-pref("xpinstall.signatures.required", false);
-
-// Disable File and Directory Entries API (Imported from Edge/Chromium)
-// https://developer.mozilla.org/en-US/Firefox/Releases/50#Files_and_directories
-// https://developer.mozilla.org/en-US/docs/Web/API/File_and_Directory_Entries_API
-// https://developer.mozilla.org/en-US/docs/Web/API/File_and_Directory_Entries_API/Introduction
-// https://developer.mozilla.org/en-US/docs/Web/API/File_and_Directory_Entries_API/Firefox_support
-// https://bugzilla.mozilla.org/show_bug.cgi?id=1265767
-pref("dom.webkitBlink.filesystem.enabled", false);
-// https://developer.mozilla.org/en-US/docs/Web/API/HTMLInputElement/webkitdirectory
-// https://bugzilla.mozilla.org/show_bug.cgi?id=1258489
-// https://hg.mozilla.org/releases/mozilla-release/rev/133af19777be
-pref("dom.webkitBlink.dirPicker.enabled", false);
-
-// Directory Upload API, webkitdirectory
-// https://bugzilla.mozilla.org/show_bug.cgi?id=1188880
-// https://bugzilla.mozilla.org/show_bug.cgi?id=907707
-// https://wicg.github.io/directory-upload/proposal.html
-pref("dom.input.dirpicker", false);
-
-// fix alsa sound sandbox issue for iceweasel-58
-// https://labs.parabola.nu/issues/1628
-pref("security.sandbox.content.syscall_whitelist", "16");
-END
+  cat "${srcdir}"/vendor.js.in >> "${vendorjs}"
 
-  _distini="$pkgdir/usr/lib/$pkgname/distribution/distribution.ini"
-  install -Dm644 /dev/stdin "$_distini" <<END
+  local distini="$pkgdir/usr/lib/$pkgname/distribution/distribution.ini"
+  install -Dvm644 /dev/stdin "$distini" <<END
 [Global]
 id=parabola
 version=1.0
-about=Parabola Iceweasel for Parabola GNU/Linux-libre
+about=Iceweasel for Parabola GNU/Linux-libre
 
 [Preferences]
 app.distributor=parabola
@@ -554,24 +547,47 @@ app.distributor.channel=$pkgname
 app.partner.parabola=parabola
 END
 
+  local i
   for i in 16 22 24 32 48 64 128 192 256 384; do
-    install -Dm644 browser/branding/$pkgname/default$i.png \
+    install -Dvm644 browser/branding/$pkgname/default$i.png \
       "$pkgdir/usr/share/icons/hicolor/${i}x${i}/apps/$pkgname.png"
   done
-  install -Dm644 "browser/branding/$pkgname/${pkgname}_icon.svg" \
+  install -Dvm644 "browser/branding/$pkgname/${pkgname}_icon.svg" \
     "$pkgdir/usr/share/icons/hicolor/scalable/apps/$pkgname.svg"
 
-  install -Dm644 ../$pkgname.desktop \
+  install -Dvm644 ../$pkgname.desktop \
     "$pkgdir/usr/share/applications/$pkgname.desktop"
 
   # Install a wrapper to avoid confusion about binary path
-  install -Dm755 /dev/stdin "$pkgdir/usr/bin/$pkgname" <<END
+  install -Dvm755 /dev/stdin "$pkgdir/usr/bin/$pkgname" <<END
 #!/bin/sh
 exec /usr/lib/$pkgname/$pkgname "\$@"
 END
 
+
+  ## [ARCH-SPECIFIC INSTALL] ##
+
+  case ${CARCH} in
+    armv7h)
+    ;;
+    i686)
+      # libxul.so cannot find it's libraries
+      install -dm 755 "${pkgdir}"/etc/ld.so.conf.d
+      echo "/usr/lib/${pkgname}" > "${pkgdir}"/etc/ld.so.conf.d/${pkgname}.conf
+    ;;
+    x86_64)
+    ;;
+    *) echo "no [ARCH-SPECIFIC INSTALL] for arch: ${CARCH}" ; return 1 ;
+    ;;
+  esac
+
   # Replace duplicate binary with wrapper
   # https://bugzilla.mozilla.org/show_bug.cgi?id=658850
-  ln -srf "$pkgdir/usr/bin/$pkgname" \
-    "$pkgdir/usr/lib/$pkgname/$pkgname-bin"
+  ln -srfv "$pkgdir/usr/bin/$pkgname" "$pkgdir/usr/lib/$pkgname/$pkgname-bin"
+
+  # Use system certificates
+  local nssckbi="$pkgdir/usr/lib/$pkgname/libnssckbi.so"
+  if [[ -e $nssckbi ]]; then
+    ln -srfv "$pkgdir/usr/lib/libnssckbi.so" "$nssckbi"
+  fi
 }
diff --git a/libre-testing/iceweasel/iceweasel.desktop b/libre-testing/iceweasel/iceweasel.desktop
index ab230ba5a..f47d7a4f8 100644
--- a/libre-testing/iceweasel/iceweasel.desktop
+++ b/libre-testing/iceweasel/iceweasel.desktop
@@ -2,7 +2,7 @@
 Version=1.0
 Name=Iceweasel
 GenericName=Web Browser
-GenericName[ar]=متصفح وِب
+GenericName[ar]=متصفح ويب
 GenericName[ast]=Restolador Web
 GenericName[bn]=ওয়েব ব্রাউজার
 GenericName[ca]=Navegador web
@@ -19,7 +19,7 @@ GenericName[gl]=Navegador Web
 GenericName[he]=דפדפן אינטרנט
 GenericName[hr]=Web preglednik
 GenericName[hu]=Webböngésző
-GenericName[it]=Browser Web
+GenericName[it]=Browser web
 GenericName[ja]=ウェブ・ブラウザ
 GenericName[ko]=웹 브라우저
 GenericName[ku]=Geroka torê
@@ -42,8 +42,8 @@ GenericName[uk]=Веб-браузер
 GenericName[vi]=Trình duyệt Web
 GenericName[zh_CN]=网络浏览器
 GenericName[zh_TW]=網路瀏覽器
-Comment=Browse the Web
-Comment[ar]=تصفح الوِب
+Comment=Browse the World Wide Web
+Comment[ar]=تصفح الشبكة العنكبوتية العالمية
 Comment[ast]=Restola pela Rede
 Comment[bn]=ইন্টারনেট ব্রাউজ করুন
 Comment[ca]=Navegueu per el web
@@ -83,15 +83,44 @@ Comment[uk]=Перегляд сторінок Інтернету
 Comment[vi]=Để duyệt các trang web
 Comment[zh_CN]=浏览互联网
 Comment[zh_TW]=瀏覽網際網路
+Keywords=Internet;WWW;Browser;Web;Explorer
+Keywords[ar]=انترنت;إنترنت;متصفح;ويب;وب
+Keywords[ast]=Internet;WWW;Restolador;Web;Esplorador
+Keywords[ca]=Internet;WWW;Navegador;Web;Explorador;Explorer
+Keywords[cs]=Internet;WWW;Prohlížeč;Web;Explorer
+Keywords[da]=Internet;Internettet;WWW;Browser;Browse;Web;Surf;Nettet
+Keywords[de]=Internet;WWW;Browser;Web;Explorer;Webseite;Site;surfen;online;browsen
+Keywords[el]=Internet;WWW;Browser;Web;Explorer;Διαδίκτυο;Περιηγητής;Ιντερνετ
+Keywords[es]=Explorador;Internet;WWW
+Keywords[fi]=Internet;WWW;Browser;Web;Explorer;selain;Internet-selain;internetselain;verkkoselain;netti;surffaa
+Keywords[fr]=Internet;WWW;Browser;Web;Explorer;Fureteur;Surfer;Navigateur
+Keywords[he]=דפדפן;אינטרנט;רשת;אתרים;אתר;פיירפוקס;מוזילה;
+Keywords[hr]=Internet;WWW;preglednik;Web
+Keywords[hu]=Internet;WWW;Böngésző;Web;Háló;Net;Explorer
+Keywords[it]=Internet;WWW;Browser;Web;Navigatore
+Keywords[is]=Internet;WWW;Vafri;Vefur;Netvafri;Flakk
+Keywords[ja]=Internet;WWW;Web;インターネット;ブラウザ;ウェブ;エクスプローラ
+Keywords[nb]=Internett;WWW;Nettleser;Explorer;Web;Browser;Nettside
+Keywords[nl]=Internet;WWW;Browser;Web;Explorer;Verkenner;Website;Surfen;Online
+Keywords[pt]=Internet;WWW;Browser;Web;Explorador;Navegador
+Keywords[pt_BR]=Internet;WWW;Browser;Web;Explorador;Navegador
+Keywords[ru]=Internet;WWW;Browser;Web;Explorer;интернет;браузер;веб
+Keywords[sk]=Internet;WWW;Prehliadač;Web;Explorer
+Keywords[sl]=Internet;WWW;Browser;Web;Explorer;Brskalnik;Splet
+Keywords[tr]=İnternet;WWW;Tarayıcı;Web;Gezgin;Web sitesi;Site;sörf;çevrimiçi;tara
+Keywords[uk]=Internet;WWW;Browser;Web;Explorer;Інтернет;мережа;переглядач;оглядач;браузер;веб;перегляд
+Keywords[vi]=Internet;WWW;Browser;Web;Explorer;Trình duyệt;Trang web
+Keywords[zh_CN]=Internet;WWW;Browser;Web;Explorer;网页;浏览;上网;火狐;互联网;网站;
+Keywords[zh_TW]=Internet;WWW;Browser;Web;Explorer;網際網路;網路;瀏覽器;上網;網頁;火狐
 Exec=/usr/lib/iceweasel/iceweasel %u
 Icon=iceweasel
 Terminal=false
+X-MultipleArgs=false
 Type=Application
-MimeType=text/html;text/xml;application/xhtml+xml;application/vnd.mozilla.xul+xml;text/mml;x-scheme-handler/http;x-scheme-handler/https;
+MimeType=text/html;text/xml;application/xhtml+xml;x-scheme-handler/http;x-scheme-handler/https;application/x-xpinstall;application/pdf;application/json;
 StartupNotify=true
-StartupWMClass=Iceweasel
+StartupWMClass=iceweasel
 Categories=Network;WebBrowser;
-Keywords=web;browser;internet;
 Actions=new-window;new-private-window;
 
 [Desktop Action new-window]
@@ -309,3 +338,4 @@ Name[xh]=Ifestile yangasese entsha
 Name[zh_CN]=新建隐私浏览窗口
 Name[zh_TW]=新增隱私視窗
 Exec=/usr/lib/iceweasel/iceweasel --private-window %u
+