chore(bump): Firefox 152.0 -> 152.0.1 (security point release) (#74)

152.0.1 ships a JS JIT fix (js/src/jit/CacheIR.cpp — the likely CVE), cert/addon
blocklist updates (onecrl / intermediates / addons-bloomfilters), and startup-
cache + macOS print-dialog stability fixes.

Conflict forecast (Phase 3, FIREFOX_152_0_RELEASE..FIREFOX_152_0_1_RELEASE): the
152.0.1 delta (299 files, almost all Android l10n) is FULLY DISJOINT from gjoa's
patched surface — zero patches affected, every patch applies unchanged. NSS +
Cargo.lock untouched (no flake NSS-floor bump).

- gjoa.json: firefox 152.0 -> 152.0.1; displayVersion -> 0.3.3.
- configs/firefox-152.0.1.sha256: pinned source hash (bff037bd...502f15e),
  matches the official archive SHA256SUMS (GPG sig not verifiable in this env;
  CI re-verifies against the pin at build).
- patch baselines retrofitted to 152.0.1 (incl 3 that were stale at 151.0.1).

Ships as v0.3.3 (security).

Author: tompassarelli

configs/firefox-152.0.1.sha256

@@ -0,0 +1,14 @@
+# Pinned SHA-256 of the Firefox source tarball for FF_VERSION 152.0.1.
+#
+# This is an in-repo trust anchor (committed, reviewed) that is INDEPENDENT of
+# the live SHA256SUMS Mozilla serves from the same origin as the tarball. The
+# download/verify path asserts the live checksum against THIS pinned value, so
+# an origin/TLS compromise that serves a backdoored tarball + matching
+# SHA256SUMS still fails verification (the attacker cannot change this file).
+#
+# Format is `sha256sum -c` compatible: `<hash>  <path-as-listed-in-SHA256SUMS>`.
+# To bump FF_VERSION: add a configs/firefox-<version>.sha256 with the value from
+# https://archive.mozilla.org/pub/firefox/releases/<version>/SHA256SUMS, after
+# verifying that file's GPG signature (SHA256SUMS.asc) against Mozilla's
+# release-signing key fingerprint 14F26682D0916CDD81E37B6D61B7B526D98F0353.
+bff037bd04f0df25a330daa7133bea6eee5a02b7ce39da30581580271502f15e  source/firefox-152.0.1.source.tar.xz

gjoa.json

@@ -4,12 +4,12 @@
   "binaryName": "gjoa",
   "appId": "gjoa",
   "vendor": "tompassarelli",
-  "displayVersion": "0.3.2",
+  "displayVersion": "0.3.3",
   "license": "MPL-2.0",
   "github": "tompassarelli/gjoa",
   "firefox": {
-    "version": "152.0",
-    "candidate": "152.0",
+    "version": "152.0.1",
+    "candidate": "152.0.1",
     "candidateBuild": 1
   },
   "branding": {

patches/0001-browser-components-mozbuild-include-gjoa.patch

@@ -1,5 +1,5 @@
 # gjoa-patch:
-#   baseline-firefox: 151.0.1
+#   baseline-firefox: 152.0.1
 #   touches:
 #     - browser/components/moz.build
 #

patches/0002-browser-glue-import-gjoa-loader.patch

@@ -1,5 +1,5 @@
 # gjoa-patch:
-#   baseline-firefox: 151.0.1
+#   baseline-firefox: 152.0.1
 #   touches:
 #     - browser/components/BrowserGlue.sys.mjs
 #

patches/0007-enable-sqlite-fts5.patch

@@ -1,5 +1,5 @@
 # gjoa-patch:
-#   baseline-firefox: 151.0.1
+#   baseline-firefox: 152.0.1
 #   touches:
 #     - third_party/sqlite3/src/moz.build
 #

patches/0008-content-classifier-cosmetic-filtering.patch

@@ -1,5 +1,5 @@
 # gjoa-patch:
-#   baseline-firefox: 152.0
+#   baseline-firefox: 152.0.1
 #   touches:
 #     - Cargo.lock
 #     - toolkit/components/content-classifier/ContentClassifierService.cpp

patches/0009-dark-mode-engine-color-inversion.patch

@@ -1,5 +1,5 @@
 # gjoa-patch:
-#   baseline-firefox: 152.0
+#   baseline-firefox: 152.0.1
 #   touches:
 #     - servo/components/style/values/specified/color.rs
 #     - servo/components/style/device/gecko.rs

patches/0010-dark-mode-island-scrim.patch

@@ -1,5 +1,5 @@
 # gjoa-patch:
-#   baseline-firefox: 152.0
+#   baseline-firefox: 152.0.1
 #   touches:
 #     - servo/components/style/properties/computed_value_flags.rs
 #     - servo/components/style/style_adjuster.rs

patches/0011-newtab-redirector-gjoa.patch

@@ -1,5 +1,5 @@
 # gjoa-patch:
-#   baseline-firefox: 152.0
+#   baseline-firefox: 152.0.1
 #   touches:
 #     - browser/components/newtab/AboutNewTabRedirector.sys.mjs
 #