1730487 - Update to Matrix SDK v12.4.1

Status: RESOLVED FIXED

(Chat Core :: Matrix, task)

Comment 1

[Martin Giger [:freaktechnik]]

Attachment: Bug 1730487 - Update matrix-js-sdk to v12.4.1. r=clokep

Comment 2

[Patrick Cloke [:clokep]]

Do we want to uplift this to beta (93.0)? Bug 1716062 landed in 92, but it seems that bug 1716065 is in 94. Matrix isn't enabled there though so I could go either way.

I don't think it makes sense to uplift this to ESR since Matrix is not enabled there (and we don't enable any of the crypto components).

Comment 3

[Patrick Cloke [:clokep]]

More info: https://matrix.org/blog/2021/09/13/vulnerability-disclosure-key-sharing and https://twitter.com/matrixdotorg/status/1437442776254328836

Comment 4

[Martin Giger [:freaktechnik]]

Is there something we should do on the bug to mark it as important security thing and so it also gets mentioned in the beta changelog or whatever?

Comment 5

[Patrick Cloke [:clokep]]

I talked to Rob a bit about this and security fixes don't get called out in changelogs, they get linked off to a separate document. Since this was never on release though it isn't clear we need any of that.

Comment 6

[Rob Lemley [:rjl]]

Securik

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/b991fd76b3f4
Update matrix-js-sdk to v12.4.1. r=clokep

Comment 8

[Pulsebot]

Backout by [e-mail]:
https://hg.mozilla.org/comm-central/rev/d53b2fc3bf6b
Backed out changeset b991fd76b3f4 for causing build failures. r=backout a=rjl

Comment 9

[Rob Lemley [:rjl]]

I backed this out because of packaging failures.

package> ERROR: The following duplicated files are not allowed:
package> modules/matrix/matrix_sdk/crypto/keybackup.js
package> modules/matrix/matrix_sdk/crypto/store/base.js
package> modules/matrix/matrix_sdk/store/index.js
package> modules/matrix/matrix_sdk/store/indexeddb-backend.js
package> modules/matrix/matrix_sdk/types/IIdentityServerProvider.js
package> modules/matrix/matrix_sdk/types/requests.js
package> modules/matrix/matrix_sdk/types/signed.js
package> modules/matrix/matrix_sdk/types/spaces.js

Preferably, the duplicated files go away. If that really cannot be done, as a last resort they can be added to allowed-dupes.mn.

(Can't it be combined into a monolithic file like the "browser" version on Github? Seems like that would be easier to deal with and there won't be issues like this.)

Comment 10

[Martin Giger [:freaktechnik]]

(In reply to Rob Lemley [:rjl] from comment #9)

I backed this out because of packaging failures.

package> ERROR: The following duplicated files are not allowed:
package> modules/matrix/matrix_sdk/crypto/keybackup.js
package> modules/matrix/matrix_sdk/crypto/store/base.js
package> modules/matrix/matrix_sdk/store/index.js
package> modules/matrix/matrix_sdk/store/indexeddb-backend.js
package> modules/matrix/matrix_sdk/types/IIdentityServerProvider.js
package> modules/matrix/matrix_sdk/types/requests.js
package> modules/matrix/matrix_sdk/types/signed.js
package> modules/matrix/matrix_sdk/types/spaces.js

Preferably, the duplicated files go away. If that really cannot be done, as a last resort they can be added to allowed-dupes.mn.

Ugh, thank you typescript and babel for generating empty modules with an empty exports object. Is it enough if I just remove their moz.build declaration? Presumably we won't try to package the files then. Sadly it doesn't seem like there's any way to avoid them being generated in the first place.

(Can't it be combined into a monolithic file like the "browser" version on Github? Seems like that would be easier to deal with and there won't be issues like this.)

I'd rather not, our build is already different enough from any official build of the library.

Comment 11

[Martin Giger [:freaktechnik]]

I think this should be safe to check in again, here's a try build I did without those useless files in the moz.build: https://treeherder.mozilla.org/jobs?repo=try-comm-central&revision=8af8f0f25bc9fc26507580ab20e7b22053173aec&selectedTaskRun=ACaxWHPTT5eoA8NH1WE3Uw.0

Comment 12

[Martin Giger [:freaktechnik]]

Setting 91 as wontfix since the only thing we did there was enable the crypto backend, but no UI around it yet. However, in 92 we started showing encryption status and such.

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/65b997803513
Update matrix-js-sdk to v12.4.1. r=clokep