···107107 '';
108108 };
109109110110- environment.systemPackages = with pkgs;
111111- [ xdotool firefox chromium falkon midori ];
110110+ environment.systemPackages = with pkgs; [
111111+ xdotool
112112+ # Firefox was disabled here, because we needed to disable p11-kit support in nss,
113113+ # which is why it will not use the system certificate store for the time being.
114114+ # firefox
115115+ chromium
116116+ falkon
117117+ midori
118118+ ];
112119 };
113120114121 testScript = ''
···145152 with subtest("Unknown CA is untrusted in curl"):
146153 machine.fail("curl -fv https://bad.example.com")
147154148148- browsers = ["firefox", "chromium", "falkon", "midori"]
155155+ browsers = [
156156+ # Firefox was disabled here, because we needed to disable p11-kit support in nss,
157157+ # which is why it will not use the system certificate store for the time being.
158158+ # "firefox",
159159+ "chromium",
160160+ "falkon",
161161+ "midori"
162162+ ]
149163 errors = ["Security Risk", "not private", "Certificate Error", "Security"]
150164151165 machine.wait_for_x()
···116116 then overrideCC stdenv llvmPackages.clangUseLLVM
117117 else stdenv;
118118119119- nss_pkg = if lib.versionOlder ffversion "83" then nss_3_53 else nss;
119119+ # Disable p11-kit support in nss until our cacert packages has caught up exposing CKA_NSS_MOZILLA_CA_POLICY
120120+ # https://github.com/NixOS/nixpkgs/issues/126065
121121+ nss_pkg = if lib.versionOlder ffversion "83" then nss_3_53 else nss.override { useP11kit = false; };
120122121123 # --enable-release adds -ffunction-sections & LTO that require a big amount of
122124 # RAM and the 32-bit memory space cannot handle that linking
···2828 else "");
2929in stdenv.mkDerivation rec {
3030 pname = "signal-desktop";
3131- version = "5.4.0"; # Please backport all updates to the stable channel.
3131+ version = "5.4.1"; # Please backport all updates to the stable channel.
3232 # All releases have a limited lifetime and "expire" 90 days after the release.
3333 # When releases "expire" the application becomes unusable until an update is
3434 # applied. The expiration date for the current release can be extracted with:
···38383939 src = fetchurl {
4040 url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
4141- sha256 = "046xy033ars70ay5ryj39i5053py00xj92ajdg212pamq415z1zb";
4141+ sha256 = "1f1narpqj8gcyi4r574nqm1cbyi3azk1y7d1j300scr51gk74fq6";
4242 };
43434444 nativeBuildInputs = [