cryolite / pipeline

The pipeline

Seven steps from Mozilla's sourceball to a promoted artifact — all script, no heroics.

Steps

  1. PinResolve the newest vX.Y.Z-gnuN tag from the gnuzilla repository (git ls-remote) and pin the cycle to it.
  2. Transformmakeicecat downloads Mozilla's Firefox ESR sourceball, verifies the GPG signature and sha256, applies the GNU patch set and freedom layer, and emits icecat-X.Y.Z/.
  3. ImportThe tree moves to src/ and becomes a git repo with a single baseline commit — the pristine reference every patch is measured against.
  4. Brandtools/cryolite-brand.sh runs the mechanical IceCat→Cryolite pass: file renames, string seds, crystal artwork, wordmarks. One script, auditable end to end.
  5. PatchDiscrete patches from cryolite/patches/*.patch apply with git apply --3way. Any conflict stops the line — fix forward, never force.
  6. Build./mach build with the release mozconfig: official branding path, --enable-release, symbols off, updater and crash reporter off.
  7. TestThe smoke gate: --version must answer, headless render must produce a screenshot. Failures stop the promotion.
  8. Promotedist/bin is packed to cryolite/dist/<version>/cryolite-<version>.tar.xz with SHA256SUMS, and current is repointed.

Cadence

  • Scheduled cycles — every 42 days, mirroring Fluorite. The old tree and binaries are deleted, not upgraded.
  • Security respins — the weekly watcher stages an out-of-cycle rebuild whenever Mozilla publishes a newer ESR than the pinned base.
  • Reproducibility — every artifact is traceable to exactly one gnuzilla tag, one brand script revision and one patch set.
$ ./fetch-icecat.sh                # first pull: gnuzilla + makeicecat + src/
$ ./cryolite-release.sh FORCE_CYCLE=1
$ ./publish-downloads.sh           # stage for the downloads site

Repository layout

firefox/
””” env.sh                 # shared knobs (JOBS, cadence, mozconfig)
””” lib/common.sh          # helpers: tags, makeicecat, patches, build, promote
””” fetch-icecat.sh        # initial pull -> src/
””” cryolite-release.sh    # the 42-day cycle
””” secwatch-weekly.sh     # ESR watch + out-of-cycle respins
””” publish-downloads.sh   # stage artifacts for the downloads site
””” gnuzilla/              # upstream gnuzilla checkout (makeicecat)
””” cryolite/
”””   patches/             # the reviewable patch layer
”””   pending/             # staged reports + incoming patches
”””   dist/<version>/      # promoted artifacts + SHA256SUMS
””” src/                   # imported tree (disposable, rebuilt each cycle)