Help build the last independent browser.
7
Replies
0
Boosts
https://wiki.mozilla.org/Software_Update:MAR
THEY FUCKING RIPPED OFF THE ZIP FILE FORMAT
Why not use ZIP or some other standard file format?
This question was given a fair amount of consideration. Ultimately, we decided to go with a custom file format because using
libjarwould have required a fair bit of hacking.
that's why you don't use "libjar", which is for java programs, but the rust zip crate that I FUCKING BUILT
Writing custom code was a simpler option, and it resulted in less code (mar_read.c is less than 300 lines of code).
that's so much more than the examples in https://docs.rs/zip
Moreover, the update system does not need a standard file format.
yeah, it needs a bullshit one
@hipsterelectron it worked for Quake2 let them cook??
/s
https://firefox-source-docs.mozilla.org/tools/update-verify/index.html
Update verify is test that runs before each Firefox Release (excluding Nightlies) are shipped. Its main purpose is to ensure that users who receive the release through an update MAR (Mozilla ARchive) end up in the same place as a fresh install would get them. This helps us to ensure that partial MARs work in future updates, and that code signatures are valid regardless of how a user arrived at a new version.
not something that requires a standard format
the only diff they added since 2015 is wrong https://wiki.mozilla.org/index.php?title=Software_Update%3AMAR&type=revision&diff=1197510&oldid=1100385
2: RSA-PKCS1-SHA384 (4096 bits / 512 bytes)
the fact that SHA-384 makes use of the same 512-byte block as SHA-512 is a fun fact at best and not remotely correct when presented in this fashion
The elements stored in the archive are
bzip2compressed binary diffs, generated using a variation of bsdiff. So, being able to unpack the archive file using standard tools wouldn't be very useful in and of itself.
https://docs.rs/zip/latest/zip/read/struct.ZipArchive.html#method.by_index_raw
we have a method for that actually
anyway the .sig files they provided are not valid signature data. i have no clue what they are
but more importantlly i have no way to check their fucking .asc signature because I CAN'T FUCKING FIND THEIR PUBLIC KEY ANYWHERE ON THEIR ENTIRE FUCKING WEBSITE
gpg: assuming signed data in 'firefox-157.0a1.en-US.linux-x86_64.tar.xz'
gpg: Signature made Thu 03 Sep 2026 07:53:43 PM EDT
gpg: using RSA key 827E658608679618CD349F93678E455D76767AA3
gpg: Can't check signature: No public key
