projects/android-toolchain/build

 #!/bin/bash
 [% c("var/set_default_env") -%]
-distdir=/var/tmp/dist/[% project %]
-export ANDROID_HOME=$distdir/android-sdk-linux
-export NDK_HOME=$ANDROID_HOME/ndk
 
-# Make directories
-mkdir -p $NDK_HOME $ANDROID_HOME
+distdir=$rootdir/[% project %]
+mkdir -p $distdir
 
-# Compiler Archives
-unzip -qq [% c("input_files_by_name/android_sdk_tools") %] -d $ANDROID_HOME
-mkdir -p $ANDROID_HOME/cmdline-tools
-unzip -qq [% c("input_files_by_name/android_commandlinetools") %] -d $ANDROID_HOME/cmdline-tools
-mv $ANDROID_HOME/cmdline-tools/cmdline-tools $ANDROID_HOME/cmdline-tools/[% c("var/commandlinetools_version_string") %]
-unzip -qq [% c("input_files_by_name/android_ndk_compiler")%] -d $NDK_HOME
-ln -s $NDK_HOME/android-ndk-r[% c("var/android_ndk_version") %][% c("var/android_ndk_revision") %] $NDK_HOME/[% c("var/android_ndk_version_build") %]
+mkdir $distdir/android-sdk-linux
+cd $distdir/android-sdk-linux
 
-# NDK Archive
-# Adjust cross compilation prefix for armv7a. Unfortunately, the compiler cross
-# compilation prefix and the one for all the other tools differ. Let's fix that
-# so we only have to take care of one. See: #33557 (comment 2674649).
-cd $NDK_HOME/android-ndk-r[% c("var/android_ndk_version") %][% c("var/android_ndk_revision") %]/toolchains/llvm/prebuilt/linux-x86_64/bin
-for f in `ls arm-linux-androideabi-*`; do
-  ln -s $f ${f//arm-linux-androideabi/armv7a-linux-androideabi}
-done
+# Command line tools
+mkdir -p cmdline-tools
+unzip -qq $rootdir/[% c("input_files_by_name/android_commandlinetools") %] -d cmdline-tools
+mv cmdline-tools/cmdline-tools cmdline-tools/[% c("var/commandlinetools_version_string") %]
 
-# Tool Archives
-cd $ANDROID_HOME
+# NDK
+mkdir ndk
+unzip -qq $rootdir/[% c("input_files_by_name/android_ndk_compiler")%] -d ndk
+ln -s android-ndk-r[% c("var/android_ndk_version") %][% c("var/android_ndk_revision") %] ndk/[% c("var/android_ndk_version_build") %]
 
-unzip -qq $rootdir/[% c("input_files_by_name/build_tools_33") %] -d $ANDROID_HOME
-mkdir -p build-tools/[% c("var/version_33") %]
-mv [% c("var/android_release_dir_33") %]/* build-tools/[% c("var/version_33") %]
+# Build tools
+mkdir build-tools
+unzip -qq $rootdir/[% c("input_files_by_name/build_tools") %] -d build-tools
+mv build-tools/[% c("var/android_release_dir") %] build-tools/[% c("version") %]
 
-unzip -qq $rootdir/[% c("input_files_by_name/build_tools_31") %] -d $ANDROID_HOME
-mkdir -p build-tools/[% c("var/version_31") %]
-mv [% c("var/android_release_dir_31") %]/* build-tools/[% c("var/version_31") %]
+# Platform
+mkdir platforms
+unzip -qq $rootdir/[% c("input_files_by_name/platform") %] -d platforms
 
-# Application Services needed build tools 30.0.2 for 99.
-# TODO: verify for 115.
-unzip -qq $rootdir/[% c("input_files_by_name/build_tools_30") %] -d $ANDROID_HOME
-mkdir -p build-tools/[% c("var/version_30") %]
-mv [% c("var/android_release_dir_30") %]/* build-tools/[% c("var/version_30") %]
-
-unzip -qq $rootdir/[% c("input_files_by_name/build_tools_29") %] -d $ANDROID_HOME
-mkdir -p build-tools/[% c("var/version_29") %]
-mv [% c("var/android_release_dir_29") %]/* build-tools/[% c("var/version_29") %]
-
-# Apart from GeckoView all other projects do still need build-tools 28.0.3 as
-# they are using the Gradle plugin 3.2.1 - 3.6.0 without specifying
-# `buildToolsVersion`.
-unzip -qq $rootdir/[% c("input_files_by_name/build_tools_28") %] -d $ANDROID_HOME
-mkdir -p build-tools/[% c("var/version_28") %]
-mv [% c("var/android_release_dir_28") %]/* build-tools/[% c("var/version_28") %]
-
-unzip -qq $rootdir/[% c("input_files_by_name/platform_33") %] -d $ANDROID_HOME
-mkdir -p platforms/android-[% c("var/android_api_level_33") %]
-mv [% c("var/android_release_dir_33") %]/* platforms/android-[% c("var/android_api_level_33") %]
-
-unzip -qq $rootdir/[% c("input_files_by_name/platform_31") %] -d $ANDROID_HOME
-mkdir -p platforms/android-[% c("var/android_api_level_31") %]
-mv [% c("var/android_release_dir_31") %]/* platforms/android-[% c("var/android_api_level_31") %]
-
-unzip -qq $rootdir/[% c("input_files_by_name/platform_30") %] -d $ANDROID_HOME
-mkdir -p platforms/android-[% c("var/android_api_level_30") %]
-mv [% c("var/android_release_dir_30") %]/* platforms/android-[% c("var/android_api_level_30") %]
-
-unzip -qq $rootdir/[% c("input_files_by_name/platform_29") %] -d $ANDROID_HOME
-mkdir -p platforms/android-[% c("var/android_api_level_29") %]
-mv [% c("var/android_release_dir_29") %]/* platforms/android-[% c("var/android_api_level_29") %]
-
-unzip -qq $rootdir/[% c("input_files_by_name/platform_tools") %] -d $ANDROID_HOME
+# Platform tools
+unzip -qq $rootdir/[% c("input_files_by_name/platform_tools") %]
 
 # That's a quirk required by GeckoView but let's have it here instead of in the
 # project's build script
 mkdir emulator
-cp tools/emulator emulator/
+touch emulator/emulator
+chmod +x emulator/emulator
 
-# Archive dist directory
-cd /var/tmp/dist
+cd $rootdir
 [% c('tar', {
-        tar_src => [ project ],
-        tar_args => '-caf ' _ dest_dir _ '/' _ c('filename'),
-        }) %]
+    tar_src => [ project ],
+    tar_args => '-caf ' _ dest_dir _ '/' _ c('filename'),
+  }) %]

projects/android-toolchain/config

 # vim: filetype=yaml sw=2
 # FIXME: Rework this whole mess
 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.[% c("compress_tar") %]'
-version: '[% c("var/version_28") %]+[% c("var/version_29") %]+[% c("var/version_30") %]+[% c("var/version_31") %]+[% c("var/version_33") %]'
-container:
-  use_container: 1
+version: '34.0.0'
 var:
-  version_33: 33.0.1
-  version_31: 31.0.0
-  version_30: 30.0.3
-  version_29: 29.0.2
-  version_28: 28.0.3
   setup: |
     mkdir -p /var/tmp/dist
     tar -C /var/tmp/dist -xf $rootdir/[% c("compiler_tarfile") %]
     export ANDROID_HOME=/var/tmp/dist/[% project %]/android-sdk-linux
-    export PATH=$PATH:$ANDROID_HOME/build-tools/[% c("var/version_33") %]
+    export PATH=$PATH:$ANDROID_HOME/build-tools/[% c("version") %]
     # By default we use the old NDK which is the one GeckoView is using.
     # However, we can overwrite that per project if needed (e.g.
     # application-services is currently on a newer NDK).
@@ -36,83 +29,43 @@ var:
       export PATH=$PATH:$GRADLE_HOME/bin
     [% END -%]
   google_repo: https://dl.google.com/android/repository
-  android_api_level_33: 33
-  android_platform_revision_33: 02
-  android_release_dir_33: android-13
-  android_api_level_31: 31
-  android_platform_revision_31: 01
-  android_release_dir_31: android-12
-  android_api_level_30: 30
-  android_platform_revision_30: 03
-  android_release_dir_30: android-11
-  android_api_level_29: 29
-  android_platform_revision_29: 04
-  android_release_dir_29: android-10
-  android_release_dir_28: android-9
-  android_ndk_version: 23
+  android_api_level: 34
+  android_release_dir: android-14
+  android_platform_revision: '03'
+  android_ndk_version: 26
   android_ndk_revision: c
-  android_ndk_version_build: 23.2.8568313
+  android_ndk_version_build: 26.2.11394342
   # We need the following two variables for get_build_tools, used by signing
   # scripts.
-  build_tools_33_filename: 'build-tools_r[% c("var/version_33") %]-linux.zip'
-  build_tools_33_sha256sum: 0fdf2746200ee21d50a837451350e14cb11a544cbb40be5e539a89164cf3b8e5
-  # XXX: In commit 83fffa1198c3cbeffec45028971896876e2133a5 mozilla
-  # replaced sdk-tools with commandlinetools. We try to do the same here,
-  # but it seems sdk-tools is still being used in the build, so we can't
-  # remove sdk-tools yet.
-  sdk_tools_version: 4333796
-  commandlinetools_version: 9477386
-  commandlinetools_version_string: 9.0
+  build_tools_version: 34
+  build_tools_filename: 'build-tools_r[% c("var/build_tools_version") %]-linux.zip'
+  build_tools_sha512sum: c28dd52f8eca82996726905617f3cb4b0f0aee1334417b450d296991d7112cab1288f5fd42c48a079ba6788218079f81caa3e3e9108e4a6f27163a1eb7f32bd7
+  commandlinetools_version: 11076708
+  commandlinetools_version_string: 12.0
 input_files:
-  - project: container-image
-  - URL: '[% c("var/google_repo") %]/[% c("var/build_tools_33_filename") %]'
-    name: build_tools_33
-    sha256sum: '[% c("var/build_tools_33_sha256sum") %]'
-  # Special: Google wasn't consistent with 31.0.0 and 31 between build tools and
-  # platform.
-  - URL: '[% c("var/google_repo") %]/build-tools_r31-linux.zip'
-    name: build_tools_31
-    sha256sum: f90c22f5562638a2e00762e1711eebd55e7f0a05232b65200d387307d057bfe8
-  - URL: '[% c("var/google_repo") %]/build-tools_r[% c("var/version_30") %]-linux.zip'
-    name: build_tools_30
-    sha256sum: 24593500aa95d2f99fb4f10658aae7e65cb519be6cd33fa164f15f27f3c4a2d6
-  - URL: '[% c("var/google_repo") %]/build-tools_r[% c("var/version_29") %]-linux.zip'
-    name: build_tools_29
-    sha256sum: 1e9393cbfd4a4b82e30e7f55ab38db4a5a3259db93d5821c63597bc74522fa08
-  - URL: '[% c("var/google_repo") %]/build-tools_r[% c("var/version_28") %]-linux.zip'
-    name: build_tools_28
-    sha256sum: 7954956a40633c88f693d638cbc23f68e9e2499dc7a4b7dfdaf6a3e91387749a
-  - URL: '[% c("var/google_repo") %]/platform-[% c("var/android_api_level_29") %]_r[% c("var/android_platform_revision_29") %].zip'
-    name: platform_29
-    sha256sum: c9eaf2ce4e8fa6f5a8036bd3c95363d003733bf0a1bd349718cadf802db44c69
-  - URL: '[% c("var/google_repo") %]/platform-[% c("var/android_api_level_30") %]_r[% c("var/android_platform_revision_30") %].zip'
-    name: platform_30
-    sha256sum: f3f5b75744dbf6ee6ed3e8174a71e513bfee502d0bc3463ea97e517bff68d84e
-  - URL: '[% c("var/google_repo") %]/platform-[% c("var/android_api_level_31") %]_r[% c("var/android_platform_revision_31") %].zip'
-    name: platform_31
-    sha256sum: 1d69fe1d7f9788d82ff3a374faf4f6ccc9d1d372aa84a86b5bcfb517523b0b3f
-  - URL: '[% c("var/google_repo") %]/platform-[% c("var/android_api_level_33") %]_r[% c("var/android_platform_revision_33") %].zip'
-    name: platform_33
-    sha256sum: f851b13fe89f8510a1250df5e8593e86176b2428f4f3cbe0e304a85818c07bc8
-  # ./mach bootstrap is fetching the latest version, so it does not seem to
-  # matter which particular version we are using. Pin to the one fitting best to
-  # SDK version/build-tools version.
-  - URL: '[% c("var/google_repo") %]/platform-tools_r[% c("var/version_33") %]-linux.zip'
-    name: platform_tools
-    sha256sum: a339548918c3ab31c4d88416c21cee753bd942040540216c06e640f4b6db3ae2
-  - URL: '[% c("var/google_repo") %]/sdk-tools-linux-[% c("var/sdk_tools_version") %].zip'
-    name: android_sdk_tools
-    sha256sum: 92ffee5a1d98d856634e8b71132e8a95d96c83a63fde1099be3d86df3106def9
+  # Hashes can be compared with https://gitlab.com/fdroid/android-sdk-transparency-log/-/blob/master/checksums.json
   - URL: '[% c("var/google_repo") %]/commandlinetools-linux-[% c("var/commandlinetools_version") %]_latest.zip'
     name: android_commandlinetools
-    sha256sum: bd1aa17c7ef10066949c88dc6c9c8d536be27f992a1f3b5a584f9bd2ba5646a0
+    sha256sum: 2d2d50857e4eb553af5a6dc3ad507a17adf43d115264b1afc116f95c92e5e258
   - URL: '[% c("var/google_repo") %]/android-ndk-r[% c("var/android_ndk_version") %][% c("var/android_ndk_revision") %]-linux.zip'
     name: android_ndk_compiler
-    sha256sum: 6ce94604b77d28113ecd588d425363624a5228d9662450c48d2e4053f8039242
+    sha256sum: 6d6e659834d28bb24ba7ae66148ad05115ebbad7dabed1af9b3265674774fcf6
+  - URL: '[% c("var/google_repo") %]/[% c("var/build_tools_filename") %]'
+    name: build_tools
+    sha512sum: '[% c("var/build_tools_sha512sum") %]'
+  - URL: '[% c("var/google_repo") %]/platform-[% c("var/android_api_level") %]-ext7_r[% c("var/android_platform_revision") %].zip'
+    name: platform
+    sha256sum: 16fdb74c55e59ae3ef52def135aec713508467bd56d7dabcd8c9be31fa8b20f3
+  # ./mach bootstrap is fetching the latest version, so it does not seem to
+  # matter which particular version we are using. Pin to the one fitting best to
+  # SDK version/build-tools version.
+  - URL: '[% c("var/google_repo") %]/platform-tools_r[% c("version") %]-linux.zip'
+    name: platform_tools
+    sha256sum: 8137c2834dea05cb64c1a8bc041ea00fcd43e3a8a29429ad4f25b8ee51efebf6
 steps:
   # The get_build_tools step is used by tools/signing/android-signing
   get_build_tools:
-    filename: 'android-[% c("var/build_tools_33_filename") %]'
+    filename: 'android-[% c("var/build_tools_filename") %]'
     get_build_tools: |
       #!/bin/bash
       set -e
@@ -120,6 +73,6 @@ steps:
     container:
       use_container: 0
     input_files:
-      - URL: '[% c("var/google_repo") %]/[% c("var/build_tools_33_filename") %]'
+      - URL: '[% c("var/google_repo") %]/[% c("var/build_tools_filename") %]'
         name: build_tools
-        sha256sum: '[% c("var/build_tools_33_sha256sum") %]'
+        sha512sum: '[% c("var/build_tools_sha512sum") %]'

projects/application-services/bug40485.diff

 diff --git a/components/support/nimbus-fml/src/intermediate_representation.rs b/components/support/nimbus-fml/src/intermediate_representation.rs
-index e61f8a728..c1e396cab 100644
+index 97d545672..249406a0c 100644
 --- a/components/support/nimbus-fml/src/intermediate_representation.rs
 +++ b/components/support/nimbus-fml/src/intermediate_representation.rs
-@@ -8,7 +8,7 @@ use crate::util::loaders::FilePath;
- use anyhow::{bail, Error, Result as AnyhowResult};
- use serde::{Deserialize, Serialize};
- use serde_json::{Map, Value};
--use std::collections::{BTreeSet, HashMap, HashSet};
-+use std::collections::{BTreeMap, BTreeSet, HashMap, HashSet};
- use std::fmt::Display;
- use std::slice::Iter;
- 
-@@ -191,10 +191,10 @@ pub struct FeatureManifest {
+@@ -237,10 +237,10 @@ pub struct FeatureManifest {
      pub(crate) about: AboutBlock,
  
      #[serde(default)]
@@ -25,58 +16,19 @@ index e61f8a728..c1e396cab 100644
  
  impl TypeFinder for FeatureManifest {
 diff --git a/components/support/nimbus-fml/src/parser.rs b/components/support/nimbus-fml/src/parser.rs
-index bb676f827..0d7e78583 100644
+index 49cace525..cdf692b86 100644
 --- a/components/support/nimbus-fml/src/parser.rs
 +++ b/components/support/nimbus-fml/src/parser.rs
-@@ -26,7 +26,7 @@ pub(crate) struct EnumVariantBody {
- #[serde(deny_unknown_fields)]
- pub(crate) struct EnumBody {
-     description: String,
--    variants: HashMap<String, EnumVariantBody>,
-+    variants: BTreeMap<String, EnumVariantBody>,
- }
- 
- #[derive(Debug, Deserialize, Serialize, Clone)]
-@@ -54,9 +54,9 @@ pub(crate) struct ObjectBody {
- #[serde(deny_unknown_fields)]
- pub(crate) struct Types {
-     #[serde(default)]
--    enums: HashMap<String, EnumBody>,
-+    enums: BTreeMap<String, EnumBody>,
-     #[serde(default)]
--    objects: HashMap<String, ObjectBody>,
-+    objects: BTreeMap<String, ObjectBody>,
- }
- 
- #[derive(Debug, Deserialize, Serialize, Clone, Default, PartialEq, Eq)]
-@@ -105,7 +105,7 @@ pub(crate) struct ImportBlock {
-     pub(crate) path: String,
-     pub(crate) channel: String,
-     #[serde(default)]
--    pub(crate) features: HashMap<String, Vec<DefaultBlock>>,
-+    pub(crate) features: BTreeMap<String, Vec<DefaultBlock>>,
- }
- 
- #[derive(Debug, Deserialize, Serialize, Clone)]
-@@ -134,7 +134,7 @@ pub(crate) struct ManifestFrontEnd {
-     #[serde(rename = "types")]
-     legacy_types: Option<Types>,
-     #[serde(default)]
--    features: HashMap<String, FeatureBody>,
-+    features: BTreeMap<String, FeatureBody>,
- 
-     #[serde(default)]
-     #[serde(alias = "include")]
-@@ -785,7 +785,7 @@ impl Parser {
+@@ -223,7 +223,7 @@ impl Parser {
          &self,
          current: &FilePath,
-         channel: &str,
+         channel: Option<&str>,
 -        imports: &mut HashMap<ModuleId, FeatureManifest>,
 +        imports: &mut BTreeMap<ModuleId, FeatureManifest>,
+         // includes: &mut HashSet<ModuleId>,
      ) -> Result<ModuleId> {
          let id = current.try_into()?;
-         if imports.contains_key(&id) {
-@@ -814,7 +814,7 @@ impl Parser {
+@@ -253,7 +253,7 @@ impl Parser {
          // This loop does the work of merging the default blocks back into the imported manifests.
          // We'll then attach all the manifests to the root (i.e. the one we're generating code for today), in `imports`.
          // We associate only the feature ids with the manifest we're loading in this method.
@@ -85,28 +37,12 @@ index bb676f827..0d7e78583 100644
  
          for block in &frontend.imports {
              // 1. Load the imported manifests in to the hash map.
-@@ -888,7 +888,7 @@ impl Parser {
+@@ -328,7 +328,7 @@ impl Parser {
          &self,
-         channel: &str,
+         channel: Option<&str>,
      ) -> Result<FeatureManifest, FMLError> {
 -        let mut manifests = HashMap::new();
 +        let mut manifests = BTreeMap::new();
          let id = self.load_imports(&self.source, channel, &mut manifests)?;
          let mut fm = manifests
              .remove(&id)
-@@ -1009,12 +1009,12 @@ impl Parser {
- }
- 
- fn merge_map<T: Clone>(
--    a: &HashMap<String, T>,
--    b: &HashMap<String, T>,
-+    a: &BTreeMap<String, T>,
-+    b: &BTreeMap<String, T>,
-     display_key: &str,
-     key: &str,
-     child_path: &FilePath,
--) -> Result<HashMap<String, T>> {
-+) -> Result<BTreeMap<String, T>> {
-     let mut set = HashSet::new();
- 
-     let (a, b) = if a.len() < b.len() { (a, b) } else { (b, a) };

projects/application-services/build

 #!/bin/bash
 [% c("var/set_default_env") -%]
+
 [% pc(c('var/compiler'), 'var/setup', {
     compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')),
     gradle_tarfile => c("input_files_by_name/gradle"),
-    ndk_version => c("var/ndk_version"),
   }) %]
+pushd /var/tmp/dist/android-toolchain/android-sdk-linux/build-tools/
+unzip $rootdir/'[% c("input_files_by_name/build_tools_30") %]'
+mv android-11 30.0.3
+popd
+
 distdir=/var/tmp/dist/[% project %]
 builddir=/var/tmp/build/[% project %]
 mkdir $distdir
 mkdir /var/tmp/build
 
-[% IF c("input_files_by_name/android_ndk") -%]
-  pushd $(dirname $ANDROID_NDK_HOME)
-  unzip -qq $rootdir/[% c("input_files_by_name/android_ndk") %]
-  # Without this link gradle will not find the NDK.
-  ln -s $(basename $ANDROID_NDK_HOME) [% c("var/ndk_version_build") %]
-  popd
-[% END -%]
-
-cd /var/tmp/dist
-tar -xf $rootdir/[% c('input_files_by_name/rust') %]
-tar -xf $rootdir/[% c('input_files_by_name/ninja') %]
+tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/rust') %]
+tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/ninja') %]
 export PATH=/var/tmp/dist/rust/bin:/var/tmp/dist/ninja:$PATH
 export RUST_ANDROID_GRADLE_PYTHON_COMMAND=python3
-cd $rootdir
 
-export JAVA_HOME=/usr/lib/jvm/java-1.11.0-openjdk-amd64
+export JAVA_HOME=/usr/lib/jvm/java-1.17.0-openjdk-amd64
+
+[% INCLUDE 'fake-git' %]
 
 [% IF !c('var/fetch_gradle_dependencies') %]
   gradle_repo=/var/tmp/dist/gradle-dependencies
@@ -37,22 +34,27 @@ export JAVA_HOME=/usr/lib/jvm/java-1.11.0-openjdk-amd64
 
 tar -C /var/tmp/build -xf [% project %]-[% c('version') %].tar.[% c('compress_tar') %]
 
-# Prepare the offline build.
-# Move the directory for hardcoding the path in .cargo/config.
 mv /var/tmp/build/[% project %]-[% c('version') %] $builddir
-tar -C $builddir -xf $rootdir/[% c('input_files_by_name/cargo_vendor') %]
 
-cat > pip.conf << 'EOF'
+cd $builddir
+
+# Prepare the offline build.
+
+tar -xf $rootdir/[% c('input_files_by_name/glean-wheels') %]
+export GLEAN_PYTHON_WHEELS_DIR=$builddir/glean-wheels
+# Setting GLEAN_PYTHON_WHEELS_DIR is not enough: a Rust build script will still
+# try to install Glean with pip.
+cat > $rootdir/pip.conf << 'EOF'
 [global]
 find-links = /var/tmp/build/application-services/glean-wheels
 index-url =
 no-index = yes
 EOF
 export PIP_CONFIG_FILE=$rootdir/pip.conf
-
-cd $builddir
+# Move the directory for hardcoding the path in .cargo/config.
+tar -C $builddir -xf $rootdir/[% c('input_files_by_name/cargo_vendor') %]
 # Make sure our vendored crates are used for offline builds.
-cat >> .cargo/config << 'EOF'
+cat >> .cargo/config.toml << 'EOF'
 
 [source.crates-io]
 replace-with = "vendored-sources"
@@ -64,15 +66,11 @@ directory = "/var/tmp/build/application-services/vendor"
 offline=true
 EOF
 
-patch -p1 < $rootdir/no-git.patch
-patch -p1 < $rootdir/bug40485.diff
-
 pushd libs
-mv $rootdir/[% c("input_files_by_name/nss") %] ./
-mv $rootdir/[% c("input_files_by_name/sqlcipher") %] ./
-mv $rootdir/bug_13028.patch ./
+ln -s $rootdir/[% c("input_files_by_name/nss") %] ./
+ln -s $rootdir/bug_13028.patch
 patch -p2 < $rootdir/apply-bug-13028.diff
-sed -i 's/NDK_VERSION=.*/NDK_VERSION=[% c("var/ndk_version_build") %]/g' android_defaults.sh
+patch -p2 < $rootdir/no-ndk-lookup.diff
 ./build-all.sh desktop
 ./build-all.sh android
 popd
@@ -84,13 +82,14 @@ popd
   $rootdir/gen_gradle_deps_file.sh gradle.log
   mv gradle-dependencies-list.txt '[% dest_dir _ "/" _ c("filename") %]'
 [% ELSE %]
-  # Prepare Glean dependencies for offline build
-  tar -xf $rootdir/[% c('input_files_by_name/glean-wheels') %]
   # We need to set `LC_ALL` and `LANG` to something that is not ASCII as encoding
   # otherwise `click` barfs. See: https://click.palletsprojects.com/python3/
   export LC_ALL=C.UTF-8
   export LANG=C.UTF-8
   patch -p1 < $rootdir/local-repository.diff
+  patch -p1 < $rootdir/ohttp-no-git.diff
+  patch -p1 < $rootdir/bug40485.diff
+  patch -p1 < $rootdir/offline-nimbus-fml.diff
   gradle_flags="--offline --no-daemon"
   gradle $gradle_flags assembleRelease
   gradle $gradle_flags publish

projects/application-services/config

 # vim: filetype=yaml sw=2
-version: 115.0
-git_hash: 78ab4ce85120f45a4b67b055936e401193eabd68
+version: 128.0.1
+git_hash: 0e4777f4133a98f44bca164fcf0406e8f706dbe4
 git_url: https://github.com/mozilla/application-services
 git_submodule: 1
 container:
@@ -8,35 +8,25 @@ container:
 
 var:
   # This should be updated when the list of gradle dependencies is changed.
-  gradle_dependencies_version: 10
-  gradle_version: 7.6.1
-  glean_parser: 7.1.0
-  ndk_version: 25c
-  ndk_version_build: 25.2.9519653
-  nss_version: 3.88.1
+  gradle_dependencies_version: 11
+  gradle_version: 8.8
+  glean_parser: 14.0.1
+  nss_version: '3.101'
   nspr_version: '4.35'
-  sqlcipher_version: 4.5.4
 
 steps:
   build:
     filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.[% c("compress_tar") %]'
     var:
       arch_deps:
-        # Needed to build nss and sqlcipher
+        # Needed to build NSS
         - gyp
-        - tcl
     input_files:
       - project: container-image
         pkg_type: build
       - project: '[% c("var/compiler") %]'
         name: '[% c("var/compiler") %]'
         pkg_type: build
-      # application-services is the only project for which we use a more recent
-      # NDK than GeckoView. So, download it here, rather than adding 1.5-2GB to
-      # each other Android project.
-      - URL: 'https://dl.google.com/android/repository/android-ndk-r[% c("var/ndk_version") %]-linux.zip'
-        name: android_ndk
-        sha256sum: 769ee342ea75f80619d985c2da990c48b3d8eaf45f48783a2d48870d04b46108
       - project: gradle
         name: gradle
         pkg_type: build
@@ -46,15 +36,16 @@ steps:
       - project: ninja
         name: ninja
         pkg_type: build
-      # See libs/build-all.sh to update these!
-      # Also, build them with application-services, since they need the NDK and
-      # we are using a different one from the other projects.
+      # Only Application Services currently requires build tools 30.0.3.
+      # So, download them only here, rather than adding them to the shared
+      # toolchain.
+      - URL: 'https://dl.google.com/android/repository/build-tools_r30.0.3-linux.zip'
+        name: build_tools_30
+        sha256sum: 24593500aa95d2f99fb4f10658aae7e65cb519be6cd33fa164f15f27f3c4a2d6
+      # NSS version ans sha256 are in libs/build-all.sh.
       - URL: 'https://ftp.mozilla.org/pub/security/nss/releases/NSS_[% c("var/nss_version") | replace("\\.", "_") %]_RTM/src/nss-[% c("var/nss_version") %]-with-nspr-[% c("var/nspr_version") %].tar.gz'
         name: nss
-        sha256sum: fcfa26d2738ec5b0cf72ab4be784eac832a75132cda2e295799c04d62a93607a
-      - URL: 'https://www.zetetic.net/sqlcipher/verify/[% c("var/sqlcipher_version") %]/sqlcipher-[% c("var/sqlcipher_version") %].zip'
-        name: sqlcipher
-        sha256sum: bb333b1dfa58d66634f263328a81d07d96395ca17f4e147ede4b723ea83ce5f8
+        sha256sum: 566faa9283ff3d9a7d6c44272df6e4330e3e06ca4e841a68840d31b27c9161c4
       - filename: 'gradle-dependencies-[% c("var/gradle_dependencies_version") %]'
         name: gradle-dependencies
         exec: '[% INCLUDE "fetch-gradle-dependencies" %]'
@@ -67,8 +58,7 @@ steps:
         project: application-services
         pkg_type: cargo_vendor
         norec:
-          sha256sum: 391e5ca72bfd0a66b0e821fe7c264567602853d4293cd3db39932184002419f2
-      - filename: no-git.patch
+          sha256sum: 92ce1131b35bf78d86362670ba7e4930ecdd1117694996d7cce850e4860f90b6
       - filename: local-repository.diff
         enable: '[% !c("var/fetch_gradle_dependencies") %]'
       - filename: gen_gradle_deps_file.sh
@@ -77,6 +67,11 @@ steps:
       - filename: apply-bug-13028.diff
       # Delete when this patch is included upstream
       - filename: bug40485.diff
+      - filename: no-ndk-lookup.diff
+      # as-ohttp-client lists both the version for ohttp and a git repo + rev,
+      # but this breaks the vendoring for offline builds.
+      - filename: ohttp-no-git.diff
+      - filename: offline-nimbus-fml.diff
 
   list_toolchain_updates:
     git_hash: 'v[% c("version") %]'

projects/application-services/list_toolchain_updates_checks

 #!/bin/bash
 
-# ndkVersion
-read -d '' p << 'EOF' || true
-if (m/^\\s*ndkVersion:\\s"([^"]*)",/) {
-  print $1;
-  exit;
-}
-EOF
-needed=$(cat build.gradle | perl -ne "$p")
-current='[% c("var/ndk_version_build") %]'
-check_update_needed ndkVersion "$needed" "$current"
-
-
 # compileSdkVersion
 read -d '' p << 'EOF' || true
 if (m/^\\s*compileSdkVersion:\\s([^"]*),/) {
@@ -20,7 +8,7 @@ if (m/^\\s*compileSdkVersion:\\s([^"]*),/) {
 }
 EOF
 needed=$(cat build.gradle | perl -ne "$p")
-current=33
+current=34
 check_update_needed compileSdkVersion "$needed" "$current"
 
 
@@ -58,15 +46,3 @@ EOF
 needed=$(cat libs/build-all.sh | perl -ne "$p")
 current='[% c("var/nss_version") %]-with-nspr-[% c("var/nspr_version") %]'
 check_update_needed nss-nspr "$needed" "$current"
-
-
-# sqlcipher
-read -d '' p << 'EOF' || true
-if (m/SQLCIPHER_VERSION="([^"]+)"/) {
-  print $1;
-  exit;
-}
-EOF
-needed=$(cat libs/build-all.sh | perl -ne "$p")
-current='[% c("var/sqlcipher_version") %]'
-check_update_needed sqlcipher "$needed" "$current"

projects/application-services/no-git.patch

-From 88fdf4a5e0510fe430e81b652621705d3de47746 Mon Sep 17 00:00:00 2001
-From: Georg Koppen <gk@torproject.org>
-Date: Mon, 6 Jul 2020 17:04:47 +0000
-Subject: [PATCH] no git
-
-
-diff --git a/build.gradle b/build.gradle
-index 6b16a91d..af8a3b6e 100644
---- a/build.gradle
-+++ b/build.gradle
-@@ -79,8 +79,7 @@ import com.sun.jna.Platform as DefaultPlatform
- //
- // Note we pass the path to the git-dir so that this still works when
- // used as a dependency substitution from e.g. android-components.
--ext.libsGitSha = "git --git-dir=${rootProject.rootDir}/.git diff --name-only main -- :/libs".execute().text.allWhitespace ?
--                 "git --git-dir=${rootProject.rootDir}/.git rev-parse HEAD:libs".execute().text.trim() : null
-+ext.libsGitSha = null
- 
- // Use in-tree libs from the source directory in CI or if the git SHA is unset; otherwise use
- // downloaded libs.
--- 
-2.27.0
-

projects/application-services/no-ndk-lookup.diff

+diff --git a/libs/android_defaults.sh b/libs/android_defaults.sh
+index 2cfcc4206..9e3d3de97 100755
+--- a/libs/android_defaults.sh
++++ b/libs/android_defaults.sh
+@@ -1,11 +1,7 @@
+ #!/usr/bin/env bash
+ 
+-# Find the NDK.
+-pushd ..
+-NDK_VERSION=$(./gradlew -q printNdkVersion | tail -1)
+-export ANDROID_NDK_HOME="$ANDROID_HOME/ndk/$NDK_VERSION"
+-export ANDROID_NDK_ROOT="$ANDROID_NDK_HOME"
+-popd || exit
++# Do not try to find the NDK, as it does not work offline.
++# We already define the needed variables in our environment.
+ 
+ if [[ -z "${ANDROID_NDK_API_VERSION:-}" ]]; then
+     export ANDROID_NDK_API_VERSION=21

projects/application-services/offline-nimbus-fml.diff

+diff --git a/tools/nimbus-gradle-plugin/src/main/groovy/org/mozilla/appservices/tooling/nimbus/NimbusAssembleToolsTask.groovy b/tools/nimbus-gradle-plugin/src/main/groovy/org/mozilla/appservices/tooling/nimbus/NimbusAssembleToolsTask.groovy
+index 67c9e66d0..6dd949c92 100644
+--- a/tools/nimbus-gradle-plugin/src/main/groovy/org/mozilla/appservices/tooling/nimbus/NimbusAssembleToolsTask.groovy
++++ b/tools/nimbus-gradle-plugin/src/main/groovy/org/mozilla/appservices/tooling/nimbus/NimbusAssembleToolsTask.groovy
+@@ -20,6 +20,11 @@ import org.gradle.api.tasks.Nested
+ import org.gradle.api.tasks.OutputFile
+ import org.gradle.api.tasks.TaskAction
+ 
++import java.nio.file.Files
++import java.nio.file.Path
++import java.nio.file.Paths
++import java.nio.file.StandardCopyOption
++
+ import javax.inject.Inject
+ 
+ import groovy.transform.Immutable
+@@ -84,46 +89,13 @@ abstract class NimbusAssembleToolsTask extends DefaultTask {
+ 
+     @TaskAction
+     void assembleTools() {
+-        def sources = [fetchSpec, *fetchSpec.fallbackSources.get()].collect {
+-            new Source(new URI(it.archive.get()), new URI(it.hash.get()))
+-        }
+-
+-        def successfulSource = sources.find { it.trySaveArchiveTo(archiveFile.get().asFile) }
+-        if (successfulSource == null) {
+-            throw new GradleException("Couldn't fetch archive from any of: ${sources*.archiveURI.collect { "`$it`" }.join(', ')}")
+-        }
+-
+-        // We get the checksum, although don't do anything with it yet;
+-        // Checking it here would be able to detect if the zip file was tampered with
+-        // in transit between here and the server.
+-        // It won't detect compromise of the CI server.
+-        try {
+-            successfulSource.saveHashTo(hashFile.get().asFile)
+-        } catch (IOException e) {
+-            throw new GradleException("Couldn't fetch hash from `${successfulSource.hashURI}`", e)
+-        }
+-
+-        def zipTree = archiveOperations.zipTree(archiveFile.get())
+-        def visitedFilePaths = []
+-        zipTree.matching {
+-            include unzipSpec.includePatterns.get()
+-        }.visit { FileVisitDetails details ->
+-            if (!details.directory) {
+-                if (visitedFilePaths.empty) {
+-                    details.copyTo(fmlBinary.get().asFile)
+-                    fmlBinary.get().asFile.setExecutable(true)
+-                }
+-                visitedFilePaths.add(details.relativePath)
+-            }
+-        }
+-
+-        if (visitedFilePaths.empty) {
+-            throw new GradleException("Couldn't find any files in archive matching unzip spec: (${unzipSpec.includePatterns.get().collect { "`$it`" }.join(' | ')})")
+-        }
+-
+-        if (visitedFilePaths.size() > 1) {
+-            throw new GradleException("Ambiguous unzip spec matched ${visitedFilePaths.size()} files in archive: ${visitedFilePaths.collect { "`$it`" }.join(', ')}")
++        String nimbusFmlPath = System.getenv("NIMBUS_FML");
++        if (nimbusFmlPath == null) {
++            throw new GradleException("NIMBUS_FML is not defined.")
+         }
++        Path source = Paths.get(nimbusFmlPath)
++        Path dest = fmlBinary.get().asFile.toPath()
++        Files.copy(source, dest, StandardCopyOption.REPLACE_EXISTING)
+     }
+ 
+     /**

projects/application-services/ohttp-no-git.diff

+diff --git a/components/as-ohttp-client/Cargo.toml b/components/as-ohttp-client/Cargo.toml
+index fd45a058b..b7070fc15 100644
+--- a/components/as-ohttp-client/Cargo.toml
++++ b/components/as-ohttp-client/Cargo.toml
+@@ -19,8 +19,8 @@ rusqlite = { workspace = true, features = ["bundled"] }
+ [dependencies.ohttp]
+ version = "0.4"
+ default-features = false
+-git = "https://github.com/martinthomson/ohttp.git"
+-rev = "fc3f4c787d1f6a6a87bf5194f7152cc906b02973"
++# git = "https://github.com/martinthomson/ohttp.git"
++# rev = "fc3f4c787d1f6a6a87bf5194f7152cc906b02973"
+ features = ["client", "server", "app-svc", "external-sqlite"]
+ 
+ [build-dependencies]

projects/browser/build.android

@@ -2,12 +2,12 @@
 [% c("var/set_default_env") -%]
 [% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %]
 
-tar -xf $rootdir/[% c('input_files_by_name/firefox-android') %]
+tar -xf $rootdir/[% c('input_files_by_name/fenix') %]
 
 assets_dir=assets
 ext_dir=$assets_dir/extensions
 qa_apk=[% dest_dir %]/[% c('filename') %]/[% c("var/project-name") %]-qa-[% c("var/osname") %]-[% c("version") %].apk
-apk=$rootdir/firefox-android/*-[% c("var/abi") %]-*.apk
+apk=$rootdir/geckoview/*-[% c("var/abi") %]-*.apk
 
 # tor-browser-build#40920
 sorted_baseline_apk=$(basename $apk .apk)_sorted_baseline.apk
@@ -52,7 +52,7 @@ mkdir apk
 pushd apk
 7zz x "$apk"
 cp -R ../assets ./
-find -type f -exec touch -m -t '[% USE date; date.format(pc("firefox-android", "timestamp"), format = "%Y%m%d%H%M") %]' {} \;
+find -type f -exec touch -m -t '[% USE date; date.format(pc("geckoview", "timestamp"), format = "%Y%m%d%H%M") %]' {} \;
 find -type f ! -name resources.arsc -printf '%P\n' | sort > ../files.txt
 7zz a -tzip -mx9 -mtc- -spf ../repacked.apk @../files.txt
 # resources.arsc must not be compressed as per the APK specifications

projects/browser/config

@@ -88,8 +88,9 @@ input_files:
     name: src-firefox
     pkg_type: src-tarballs
     enable: '[% c("var/macos") %]'
-  - project: firefox-android
-    name: firefox-android
+  - project: geckoview
+    name: fenix
+    pkg_type: build_apk
     enable: '[% c("var/android") %]'
   - project: tor-expert-bundle
     name: tor-expert-bundle

projects/cbindgen/config

 # vim: filetype=yaml sw=2
-version: 0.24.3
+version: 0.26.0
 git_url: https://github.com/eqrion/cbindgen
-git_hash: f43ccfc047a1a160267f32355c5e5e7154a2665a
+git_hash: 703b53c06f9fe2dbc0193d67626558cfa84a0f62
 container:
   use_container: 1
 
@@ -16,4 +16,4 @@ steps:
         project: cbindgen
         pkg_type: cargo_vendor
         norec:
-          sha256sum: 96057adf58cd75b968d2209a86de3ff8bf52a5024bac2f677673b388cb26475e
+          sha256sum: 50cf77f33397639e401e7139997ec088d3106c4d37b86ea2e89e4a9af2a99fce

projects/common/fake-git

+mkdir -p $rootdir/bin
+cat > $rootdir/bin/git << 'EOF'
+#!/bin/bash
+# Used to include the commit hash in the build
+if [ "$1" = "rev-parse" ]; then
+  if [[ "$*" == *"--short"* ]]; then
+    echo "[% c('abbrev') %]"
+  else
+    echo "[% IF c('var/git_commit') %][% c('var/git_commit') %][% ELSE %][% c('abbrev') %][% END %]"
+  fi
+  exit 0
+fi
+
+# If there are uncommitted files (checked with `git status --porcelain=v2`), the
+# build system will append a `+` to the commit hash. So, report a clean tree.
+if [ "$1" = "status" ]; then
+  exit 0
+fi
+
+# Try to catch any other calls by making them fail
+echo "fake-git: not implemented command $1"
+exit 1
+EOF
+chmod +x $rootdir/bin/git
+export PATH=$rootdir/bin:$PATH

projects/common/list_toolchain_updates-common-firefox-geckoview

@@ -12,9 +12,9 @@ read -d '' p << 'EOF' || true
 sub as_array {
   ref $_[0] eq 'ARRAY' ? $_[0] : [ $_[0] ];
 }
-my $d = YAML::XS::LoadFile('taskcluster/ci/toolchain/rust.yml');
+my $d = YAML::XS::LoadFile('taskcluster/kinds/toolchain/rust.yml');
 foreach my $t (keys %$d) {
-  my $talias = as_array($d->{$t}{run}{'toolchain-alias'});
+  my $talias = as_array($d->{$t}{run}{'toolchain-alias'}{'by-project'}{default});
   if (grep { $_ eq '[% toolchain_alias %]' } @$talias) {
     my $channel;
     foreach my $arg (@{$d->{$t}{run}{arguments}}) {
@@ -47,7 +47,7 @@ read -d '' p << 'EOF' || true
 sub as_array {
   ref $_[0] eq 'ARRAY' ? $_[0] : [ $_[0] ];
 }
-my $d = YAML::XS::LoadFile('taskcluster/ci/toolchain/clang.yml');
+my $d = YAML::XS::LoadFile('taskcluster/kinds/toolchain/clang.yml');
 my $clang_toolchain;
 my $clang_fetch;
 TOOLCHAIN: foreach my $t (keys %$d) {
@@ -81,7 +81,7 @@ if (!$clang_fetch) {
   exit 1;
 }
 
-my $fetch = YAML::XS::LoadFile('taskcluster/ci/fetch/toolchains.yml');
+my $fetch = YAML::XS::LoadFile('taskcluster/kinds/fetch/toolchains.yml');
 print $fetch->{$clang_fetch}{fetch}{revision};
 EOF
 needed=$(perl -MYAML::XS -e "$p")
@@ -103,7 +103,7 @@ check_update_needed cbindgen "$needed" "$current"
 
 # nasm
 read -d '' p << 'EOF' || true
-my $nasm = YAML::XS::LoadFile('taskcluster/ci/toolchain/nasm.yml');
+my $nasm = YAML::XS::LoadFile('taskcluster/kinds/toolchain/nasm.yml');
 my $linux64 = 'linux64-nasm';
 print substr $nasm->{$linux64}{'fetches'}{'fetch'}[0], 5;
 EOF
@@ -118,7 +118,7 @@ sub l {
   ref $_[0] eq 'ARRAY' ? $_[0] : [ $_[0] ];
 }
 
-my $d = YAML::XS::LoadFile('taskcluster/ci/toolchain/node.yml');
+my $d = YAML::XS::LoadFile('taskcluster/kinds/toolchain/node.yml');
 my $node_toolchain;
 T: foreach my $t (keys %$d) {
   foreach my $alias (@{l($d->{$t}{run}{'toolchain-alias'})}) {
@@ -135,7 +135,7 @@ T: foreach my $t (keys %$d) {
 
 exit 1 unless $node_toolchain;
 
-my $fetch = YAML::XS::LoadFile('taskcluster/ci/fetch/toolchains.yml');
+my $fetch = YAML::XS::LoadFile('taskcluster/kinds/fetch/toolchains.yml');
 my ($version) = $fetch->{$node_toolchain}{fetch}{url} =~ m|^https://nodejs.org/dist/v([^/]+)/|;
 print "$version\\n";
 EOF
@@ -152,5 +152,5 @@ if (m/^\\s*"Bootstrap currently only runs on Python ([^"]+)\\."/) {
 }
 EOF
 needed=$(cat python/mozboot/bin/bootstrap.py | perl -ne "$p")
-current="3.6+" # 3.6.0
+current="3.8+" # 3.11.x on Debian bookworm and on our python project
 check_update_needed python "$needed" "$current"

projects/firefox/build

@@ -13,6 +13,9 @@ mkdir -p [% out_dir %]
   # Setting up fxc2
   tar -C /var/tmp/dist -xf [% c('input_files_by_name/fxc2') %]
   export PATH="/var/tmp/dist/fxc2/bin:$PATH"
+
+  tar -C /var/tmp/dist -xf [% c('input_files_by_name/windows-rs') %]
+  export MOZ_WINDOWS_RS_DIR=/var/tmp/dist/windows-rs/
 [% END -%]
 
 tar -C /var/tmp/dist -xf [% c('input_files_by_name/rust') %]
@@ -296,8 +299,8 @@ cd $distdir
 [% IF c("var/linux") -%]
   mkdir -p $distdir/Debug/Browser
   # Strip and generate debuginfo for the firefox binary that we keep, all *.so
-  # files, the plugin-container, and the updater (see ticket #10126)
-  for LIB in Browser/*.so "Browser/[% c('var/exe_name') %].real" Browser/plugin-container [% IF c("var/updater_enabled") -%]Browser/updater[% END %]
+  # files, and the updater (see ticket #10126)
+  for LIB in Browser/*.so "Browser/[% c('var/exe_name') %].real" [% IF c("var/updater_enabled") -%]Browser/updater[% END %]
   do
     objcopy --only-keep-debug $LIB Debug/$LIB
     strip $LIB

projects/firefox/config

@@ -14,12 +14,12 @@ container:
   use_container: 1
 
 var:
-  firefox_platform_version: 115.12.0
+  firefox_platform_version: 128.0
   firefox_version: '[% c("var/firefox_platform_version") %]esr'
-  browser_series: '13.5'
+  browser_series: '14.0'
   browser_rebase: 1
   browser_branch: '[% c("var/browser_series") %]-[% c("var/browser_rebase") %]'
-  browser_build: 2
+  browser_build: 1
   branding_directory_prefix: 'tb'
   copyright_year: '[% exec("git show -s --format=%ci").remove("-.*") %]'
   nightly_updates_publish_dir: '[% c("var/nightly_updates_publish_dir_prefix") %]nightly-[% c("var/osname") %]'
@@ -83,7 +83,7 @@ steps:
         version: '[% c("abbrev") %]'
 
   list_toolchain_updates:
-    git_hash: tor-browser-115.0a1-13.0-1
+    git_hash: tor-browser-128.0b1-14.0-1
     tag_gpg_id: 0
     input_files: []
     container:
@@ -194,6 +194,11 @@ input_files:
     enable: '[% c("var/windows") %]'
     target_prepend:
       - torbrowser-windows-x86_64
+  - project: windows-rs
+    name: windows-rs
+    enable: '[% c("var/windows") %]'
+    norec:
+      sha256sum: b26e710d553733cd1202bf932624d51a43d1f8679217c97bd05c0248e0c1c090
   - filename: abicheck.cc
     enable: '[% c("var/linux") %]'
   - project: translation

projects/firefox/list_toolchain_updates_checks

@@ -9,7 +9,7 @@ sub l {
   ref $_[0] eq 'ARRAY' ? $_[0] : [ $_[0] ];
 }
 
-my $d = YAML::XS::LoadFile('taskcluster/ci/toolchain/macos-sdk.yml');
+my $d = YAML::XS::LoadFile('taskcluster/kinds/toolchain/macos-sdk.yml');
 
 my $sdk_version;
 foreach my $t (keys %$d) {
@@ -31,7 +31,7 @@ check_update_needed macos-sdk "$needed" "$current"
 
 # cctools
 read -d '' p << 'EOF' || true
-my $d = YAML::XS::LoadFile('taskcluster/ci/fetch/toolchains.yml');
+my $d = YAML::XS::LoadFile('taskcluster/kinds/fetch/toolchains.yml');
 print $d->{'cctools-port'}{fetch}{revision};
 EOF
 needed=$(perl -MYAML::XS -e "$p")
@@ -40,7 +40,7 @@ check_update_needed cctools "$needed" "$current"
 
 # libtapi
 read -d '' p << 'EOF' || true
-my $d = YAML::XS::LoadFile('taskcluster/ci/fetch/toolchains.yml');
+my $d = YAML::XS::LoadFile('taskcluster/kinds/fetch/toolchains.yml');
 print $d->{'libtapi'}{fetch}{revision};
 EOF
 needed=$(perl -MYAML::XS -e "$p")
@@ -54,7 +54,7 @@ check_update_needed libtapi "$needed" "$current"
 [% IF c("var/windows") %]
 # mingw-w64
 read -d '' p << 'EOF' || true
-my $d = YAML::XS::LoadFile('taskcluster/ci/fetch/toolchains.yml');
+my $d = YAML::XS::LoadFile('taskcluster/kinds/fetch/toolchains.yml');
 print $d->{'mingw-w64'}{fetch}{revision};
 EOF
 needed=$(perl -MYAML::XS -e "$p")
@@ -64,7 +64,7 @@ check_update_needed mingw-w64 "$needed" "$current"
 
 # fxc2
 read -d '' p << 'EOF' || true
-my $d = YAML::XS::LoadFile('taskcluster/ci/fetch/toolchains.yml');
+my $d = YAML::XS::LoadFile('taskcluster/kinds/fetch/toolchains.yml');
 print $d->{fxc2}{fetch}{revision};
 EOF
 needed=$(perl -MYAML::XS -e "$p")
@@ -78,7 +78,7 @@ check_update_needed fxc2 "$needed" "$current"
 [% IF c("var/rlbox") %]
 # wasi-sdk
 read -d '' p << 'EOF' || true
-my $d = YAML::XS::LoadFile('taskcluster/ci/fetch/toolchains.yml');
+my $d = YAML::XS::LoadFile('taskcluster/kinds/fetch/toolchains.yml');
 print $d->{'wasi-sdk'}{fetch}{revision};
 EOF
 needed=$(perl -MYAML::XS -e "$p")

projects/fxc2/config

 # vim: filetype=yaml sw=2
 version: '[% c("abbrev") %]'
 git_url: https://github.com/mozilla/fxc2.git
-git_hash: 807d26f4e4e9e9d0d0d6c1e05493b28eafb20e91
+git_hash: 63ad74b7faa7033f2c1be9cc1cd0225241a1a9a5
 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.[% c("compress_tar") %]'
 container:
   use_container: 1