Backport Thunderbird 91 to 20.04 LTS and 18.04 LTS

[Olivier Tilloy]

Similarly to bug #1895643, which was about upgrading thunderbird from 68 to 78 in all supported Ubuntu releases, this bug is to track the update from thunderbird 78 to 91 in hirsute, focal and bionic.

The rationale is that series 78 will soon be out of support (the last release, 78.14.0, was made public on September 7, 2021).

Thunderbird follows the Firefox ESR release cycle, and the next/current series is 91 (already available in impish and jammy).

User-facing announcement: https://discourse.ubuntu.com/t/thunderbird-lts-update-78-to-91/25391.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Clemens Drüe (druee)]

This is now a security issue. As the vulnerability CVE-2021-38503 is currently actively exploited and will not be fixed in 1.78 series, which is EOL (see https://www.mozilla.org/en-US/security/advisories/mfsa2021-50/)
The latest version available in focal and focal-updates repositories is 1.78.13 (even not the latest available version of the 1.78 series).

This is a show stopper for an LTS edition; please fix rapidly!

[Simon Iremonger (ubuntu-iremonger)]

For what its' worth, the Focal system's provided packages do not meet the following build-deps of the *debian* Thunderbird 91.3.0 package;-

cbindgen (>= 0.19)
debhelper-compat (= 13)
libnspr4-dev (>= 2:4.32~)
libnss3-dev (>= 2:3.68~)
nodejs (>= 10.19.0)

Merely overriding the version dependencies in debian control file [which can just automatically referring to latest version needlessly] is not sufficient, an internal check *actually* requires e.g. nspr >=4.32 . These packages may need backporting or whatever, or the ubuntu packages may work differently to get around these limitations for building (in any case build-deps and runtime-deps may be another matter...).

[Clemens Drüe (druee)]

As far as I can see nspr does not require any special version, so could be upgraded easily, at least from 4.25 to 4.32.

[Olivier Tilloy (osomon)]

Ubuntu packages do things a bit differently:

 - cbindgen is vendored in the source tarball (currently at version 0.19)
 - builds and uses the bundled nspr, not the system one
 - builds and uses the bundled nss, not the system one
 - the nodejs requirement is 10.23.1; a newer version was backported to bionic and focal under the name nodejs-mozilla

[Simon Iremonger (ubuntu-iremonger)]

Both debian and ubuntu seem to have some sort of problem with Thunderbird not managing to build on all architectures, or so, in the latest versions in packages. databases.
I notice launchpad has built 91.3.0 packages for ubuntu jamil (presumably equivalent to debian sid or so)...
Do let us all know about any 'testing' packages ready to try out =).

[Olivier Tilloy (osomon)]

Thanks Simon, I will comment here when there are packages ready for wider testing. I have managed to successfully build thunderbird 91.3.0 for all supported architectures on hirsute, focal and bionic, but I want to give it some basic testing before opening it up.

[Simon Iremonger (ubuntu-iremonger)]

Thunderbird (and Firefox-ESR) 91.4 has been released by Debian with no problems, I believe either current or LTS or both had another package updated in order to support these updates, though I can't seem to find which it is now.

[Simon Iremonger (ubuntu-iremonger)]

Debian now have 91.5.0-2 in sid and seem to have long since sorted the portability/architecture issues.
@osomon -- Please let us all have a test-package for Ubuntu update testing.

[Olivier Tilloy (osomon)]

Simon, there are thunderbird 91.5.0 updates ready for testing in https://launchpad.net/~ubuntu-mozilla-security/+archive/ubuntu/ppa. Please use that PPA only for testing updates, it is NOT recommended to keep it enabled permanently. Feedback welcome!

[Launchpad Janitor (janitor)]

This bug was fixed in the package thunderbird - 1:91.5.0+build1-0ubuntu0.21.04.1

---------------
thunderbird (1:91.5.0+build1-0ubuntu0.21.04.1) hirsute; urgency=medium

  * New upstream stable release (91.5.0build1)

thunderbird (1:91.4.0+build2-0ubuntu0.21.04.1) hirsute; urgency=medium

  * New upstream stable release (91.4.0build2)

  [ Rico Tzschichholz ]
  * Bump dump_sys to bf7f6bd855eb6ecb233b52bfa7b2c975b7026540 (LP: #1945770)
    - debian/build/create-tarball.py

thunderbird (1:91.3.2+build1-0ubuntu0.21.04.1) hirsute; urgency=medium

  * New upstream stable release (91.3.2build1)

thunderbird (1:91.3.1+build1-0ubuntu0.21.04.1) hirsute; urgency=medium

  * New upstream stable release (91.3.1build1)

thunderbird (1:91.3.0+build2-0ubuntu0.21.04.2) hirsute; urgency=medium

  * Remove obsolete patch
    - debian/patches/s390x-workaround-sqlite3-clang-optimization-hang.patch

thunderbird (1:91.3.0+build2-0ubuntu0.21.04.1) hirsute; urgency=medium

  * New upstream stable release (91.3.0build2) (LP: #1949605)
    - debian/config/branch.mk
  * Build with clang 13 where available, and drop clang 8
    - debian/build/rules.mk
    - debian/control{,.in}
  * Update the list of shipped locales (add Latvian)
    - debian/config/locales.{all,shipped}
  * Bump build dependency on rustc >= 1.51.0 and cargo >= 0.52
    - debian/control{,.in}
  * Bump build dependency on nodejs >= 10.23.1
    - debian/control{,.in}
  * Bump build dependency on python3 >= 3.6
    - debian/control{,.in}
  * Remove build dependency on libgtk2.0-dev
    - debian/control{,.in}
  * Vendor dump_syms in the source tarball
    - debian/build/create-tarball.py
    - debian/build/rules.mk
    - debian/config/mozconfig.in
    - debian/control{,.in}
  * Update excludes list for the source tarball creation
    - debian/config/tarball.conf
  * Add packaging ignore options
    - debian/source/options
  * Remove the obsolete messagingmenu extension
    - debian/messagingmenu
    - debian/rules
    - debian/thunderbird.install.in
  * Update the default value of the extensions.autoDisableScopes preference and
    build with --with-unsigned-addon-scopes=app to continue allowing
    side-loading system-wide extensions (langpacks)
    - debian/vendor.js
    - debian/config/mozconfig.in
  * Stop building icudt67b.dat on s390x
    - debian/build/rules.mk
    - debian/control{,.in}
  * Build with MACH_USE_SYSTEM_PYTHON=1
    - debian/build/rules.mk
  * Build with thin LTO on armhf to work around OOM failures on Launchpad
    builders
    - debian/build/rules.mk
    - debian/patches/armhf-rustc-thin-lto.patch
  * Unconditionally reduce rustc's debuginfo level to 1 to prevent OOM failures
    on Launchpad builders (this affects all architectures)
    - debian/patches/reduce-rust-debuginfo.patch
  * Remove obsolete patches
    - debian/patches/armhf-disable-unaligned-fp-access-emulation.patch
    - debian/patches/reduce-rust-optlevel-on-ppc64el.patch
  * Update patches
    - armhf-reduce-linker-memory-use.patch
    - rust-drop-dll-checksums.patch
    - support-coinstallable-trunk-build.patch
  * Fix non-fatal stracktrace in the apport hook (LP: #1943234)
    - debian/apport/source_thunderbird.py.i...

[Launchpad Janitor (janitor)]

This bug was fixed in the package thunderbird - 1:91.5.0+build1-0ubuntu0.18.04.1

---------------
thunderbird (1:91.5.0+build1-0ubuntu0.18.04.1) bionic; urgency=medium

  * New upstream stable release (91.5.0build1)

thunderbird (1:91.4.0+build2-0ubuntu0.18.04.1) bionic; urgency=medium

  * New upstream stable release (91.4.0build2)

  [ Rico Tzschichholz ]
  * Bump dump_sys to bf7f6bd855eb6ecb233b52bfa7b2c975b7026540 (LP: #1945770)
    - debian/build/create-tarball.py

thunderbird (1:91.3.2+build1-0ubuntu0.18.04.1) bionic; urgency=medium

  * New upstream stable release (91.3.2build1)

thunderbird (1:91.3.1+build1-0ubuntu0.18.04.1) bionic; urgency=medium

  * New upstream stable release (91.3.1build1)

thunderbird (1:91.3.0+build2-0ubuntu0.18.04.1) bionic; urgency=medium

  * New upstream stable release (91.3.0build2) (LP: #1949605)
    - debian/config/branch.mk

  [ Olivier Tilloy ]
  * Build with clang 13 where available, and drop clang 8
    - debian/build/rules.mk
    - debian/control{,.in}
  * Update the list of shipped locales (add Latvian)
    - debian/config/locales.{all,shipped}
  * Bump build dependency on rustc >= 1.51.0 and cargo >= 0.52
    - debian/control{,.in}
  * Bump build dependency on nodejs-mozilla >= 10.23.1
    - debian/control{,.in}
  * Bump build dependency on python3 >= 3.6
    - debian/control{,.in}
  * Remove build dependency on libgtk2.0-dev
    - debian/control{,.in}
  * Vendor dump_syms in the source tarball
    - debian/build/create-tarball.py
    - debian/build/rules.mk
    - debian/config/mozconfig.in
    - debian/control{,.in}
  * Update excludes list for the source tarball creation
    - debian/config/tarball.conf
  * Add packaging ignore options
    - debian/source/options
  * Remove the obsolete messagingmenu extension
    - debian/messagingmenu
    - debian/rules
    - debian/thunderbird.install.in
  * Update the default value of the extensions.autoDisableScopes preference and
    build with --with-unsigned-addon-scopes=app to continue allowing
    side-loading system-wide extensions (langpacks)
    - debian/vendor.js
    - debian/config/mozconfig.in
  * Stop building icudt67b.dat on s390x
    - debian/build/rules.mk
    - debian/control{,.in}
  * Build with MACH_USE_SYSTEM_PYTHON=1
    - debian/build/rules.mk
  * Build with thin LTO on armhf and i386 to work around OOM failures on
    Launchpad builders
    - debian/build/rules.mk
    - debian/patches/armhf-rustc-thin-lto.patch
  * Unconditionally reduce rustc's debuginfo level to 1 to prevent OOM failures
    on Launchpad builders (this affects all architectures)
    - debian/patches/reduce-rust-debuginfo.patch
  * Remove obsolete patches
    - debian/patches/armhf-disable-unaligned-fp-access-emulation.patch
    - debian/patches/reduce-rust-optlevel-on-ppc64el.patch
    - debian/patches/s390x-workaround-sqlite3-clang-optimization-hang.patch
    - debian/patches/upstream-icu-fixes.patch
  * Update patches
    - debian/patches/armhf-reduce-linker-memory-use.patch
    - debian/patches/rust-drop-dll-checksums.patch
    - debian/patches/support-coinstallable-trunk-build.patch
    - debian/patches/unity-menubar.patch
  * Enable native Wayland support (LP: #...

[Launchpad Janitor (janitor)]

This bug was fixed in the package thunderbird - 1:91.5.0+build1-0ubuntu0.20.04.1

---------------
thunderbird (1:91.5.0+build1-0ubuntu0.20.04.1) focal; urgency=medium

  * New upstream stable release (91.5.0build1)

thunderbird (1:91.4.0+build2-0ubuntu0.20.04.1) focal; urgency=medium

  * New upstream stable release (91.4.0build2)

  [ Rico Tzschichholz ]
  * Bump dump_sys to bf7f6bd855eb6ecb233b52bfa7b2c975b7026540 (LP: #1945770)
    - debian/build/create-tarball.py

thunderbird (1:91.3.2+build1-0ubuntu0.20.04.1) focal; urgency=medium

  * New upstream stable release (91.3.2build1)

thunderbird (1:91.3.1+build1-0ubuntu0.20.04.1) focal; urgency=medium

  * New upstream stable release (91.3.1build1)

thunderbird (1:91.3.0+build2-0ubuntu0.20.04.3) focal; urgency=medium

  * Remove obsolete patch
    - debian/patches/s390x-workaround-sqlite3-clang-optimization-hang.patch

thunderbird (1:91.3.0+build2-0ubuntu0.20.04.2) focal; urgency=medium

  * Fix FTBFS on ppc64el (LP: #1930315)
    - debian/patches/ppc64el-clang10-no-fast-math.patch
  * Fix FTBFS on ppc64el
    - debian/patches/libpixman-disable-vmx.patch

thunderbird (1:91.3.0+build2-0ubuntu0.20.04.1) focal; urgency=medium

  * New upstream stable release (91.3.0build2) (LP: #1949605)
    - debian/config/branch.mk
  * Build with clang 13 where available, and drop clang 8
    - debian/build/rules.mk
    - debian/control{,.in}
  * Update the list of shipped locales (add Latvian)
    - debian/config/locales.{all,shipped}
  * Bump build dependency on rustc >= 1.51.0 and cargo >= 0.52
    - debian/control{,.in}
  * Bump build dependency on nodejs-mozilla >= 10.23.1
    - debian/control{,.in}
  * Bump build dependency on python3 >= 3.6
    - debian/control{,.in}
  * Remove build dependency on libgtk2.0-dev
    - debian/control{,.in}
  * Vendor dump_syms in the source tarball
    - debian/build/create-tarball.py
    - debian/build/rules.mk
    - debian/config/mozconfig.in
    - debian/control{,.in}
  * Update excludes list for the source tarball creation
    - debian/config/tarball.conf
  * Add packaging ignore options
    - debian/source/options
  * Remove the obsolete messagingmenu extension
    - debian/messagingmenu
    - debian/rules
    - debian/thunderbird.install.in
  * Update the default value of the extensions.autoDisableScopes preference and
    build with --with-unsigned-addon-scopes=app to continue allowing
    side-loading system-wide extensions (langpacks)
    - debian/vendor.js
    - debian/config/mozconfig.in
  * Stop building icudt67b.dat on s390x
    - debian/build/rules.mk
    - debian/control{,.in}
  * Build with MACH_USE_SYSTEM_PYTHON=1
    - debian/build/rules.mk
  * Build with thin LTO on armhf to work around OOM failures on Launchpad
    builders
    - debian/build/rules.mk
    - debian/patches/armhf-rustc-thin-lto.patch
  * Unconditionally reduce rustc's debuginfo level to 1 to prevent OOM failures
    on Launchpad builders (this affects all architectures)
    - debian/patches/reduce-rust-debuginfo.patch
  * Remove obsolete patches
    - debian/patches/armhf-disable-unaligned-fp-access-emulation.patch
    - debian/patches/reduce-rust-optlevel-on-ppc64el.patch
  * Update pat...

[Simon Iremonger (ubuntu-iremonger)]

Hrrm, I was about to test and then discovered package released already, though can say all is good so-far. I notice ports (e.g. arm64) not all getting new build... Hope situation is now improved for ongoing updates, at least.

[Olivier Tilloy (osomon)]

> I notice ports (e.g. arm64) not all getting new build...

The update was built and published for all supported releases (bionic, focal, hirsute, impish) and architectures. Could it be that you're using a mirror that hasn't been updated yet?

[Simon Iremonger (ubuntu-iremonger)]

I had noticed, on packages.ubuntu.com/thunderbird -- that the new 91.5 wasn't on all architectures, however it is now. Potentially I was noticing what is still the case, that base versions of distro focal,hirsute,impish have an old version in [ports] but an updated single version in -updates on all arches confusingly!.

In any case, all seems to be good now,... Hoping situation improved for being able to release new series more easily in future etc. With thanks!.

[Simon Iremonger (ubuntu-iremonger)]

Thunderbird in Ubuntu is now lagging-behind on Security, Debian have released 102.3.0 as an LTS update, ubuntu version is some versions behind in 91.x ..
https://www.ubuntuupdates.org/ppa/ubuntu_mozilla_security would suggest 102.2.2 at least started to be prepared?
Hope this nudge helps =).

[Rolando Gorgs (rolandogorgs)]

The Thunderbird story goes on here:
https://bugs.launchpad.net/ubuntu/+source/thunderbird/+bug/1990886

;-)