Security

Mozilla maintains the Firefox ESR branch with security-only updates for roughly a year per release. Riding ESR means Cryolite inherits the shortest, most auditable delta between cycles: when something changes upstream, it is almost always a security fix, not a feature wave. That makes the 42-day rebuild cadence cheap and the weekly watch precise.

secwatch-weekly.sh runs on a systemd timer. It fetches Mozilla's public firefox_esr product-details feed and compares the newest published ESR against the pinned base tag:

• upstream unchanged → log and exit
• upstream newer → stage cryolite/pending/REPORT.md and trigger FORCE_CYCLE=1 immediately
• feed unreachable → fail loudly, never silently skip

The report is plain markdown, staged in the tree, and visible in every status page. No dashboards to trust; just files you can read.

• sourceballs GPG-verified against Mozilla's release key and sha256-pinned by makeicecat
• release configuration: --enable-release, no debug symbols, component build off
• updater disabled — updates arrive by rebuilding, not by the browser mutating itself
• crash reporter disabled — no crash data ever leaves the machine
• telemetry and Mozilla data collection removed at the source level by the GNU patch set
• every artifact published with SHA256SUMS

Security issues in the Cryolite layer (patches, scripts, packaging) go to the AcreetionOS security contact on the acreetionos.org site. Issues in Gecko itself belong upstream — Mozilla's bounty program covers ESR, and GNU IceCat issues belong in the gnuzilla bug tracker. We forward, we don't sit on bugs.