diff --git a/.firefox.metadata b/.firefox.metadata
index 47dd99d..37c649f 100644
--- a/.firefox.metadata
+++ b/.firefox.metadata
@@ -1,6 +1,6 @@
18a8f30a0356c751b8d0ea6f76e764cab13ee046 SOURCES/Python-2.7.13.tar.xz
-efe1e11501ff3d30b96ece94f6a73e21f31f28c9 SOURCES/firefox-60.2.2esr.source.tar.xz
-6b8cc9281137b633d377c5ea1e9aca3afa27f2f1 SOURCES/firefox-langpacks-60.2.2esr-20181002.tar.xz
+0fa5a71ce2cb90ea4be719a92645aa09dff3721f SOURCES/firefox-60.4.0esr.source.tar.xz
+9d86cb1d4ccc300f5033e3fdb87c8d5fe5cd4786 SOURCES/firefox-langpacks-60.4.0esr-20181205.tar.xz
6724218efbb1f3fa14541cb2f255970b98446a45 SOURCES/firefox-symbolic.svg
0de63f863b158454b9429234b52ed28a397ec45c SOURCES/gtk3-private-3.22.26-1.el6.src.rpm
e188ab1a444697bc649e223c28389d82ca94c472 SOURCES/libffi-3.0.13-18.el7_3.src.rpm
diff --git a/.gitignore b/.gitignore
index 4936acf..c45903b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,6 @@
SOURCES/Python-2.7.13.tar.xz
-SOURCES/firefox-60.2.2esr.source.tar.xz
-SOURCES/firefox-langpacks-60.2.2esr-20181002.tar.xz
+SOURCES/firefox-60.4.0esr.source.tar.xz
+SOURCES/firefox-langpacks-60.4.0esr-20181205.tar.xz
SOURCES/firefox-symbolic.svg
SOURCES/gtk3-private-3.22.26-1.el6.src.rpm
SOURCES/libffi-3.0.13-18.el7_3.src.rpm
diff --git a/README.debrand b/README.debrand
deleted file mode 100644
index 01c46d2..0000000
--- a/README.debrand
+++ /dev/null
@@ -1,2 +0,0 @@
-Warning: This package was configured for automatic debranding, but the changes
-failed to apply.
diff --git a/SOURCES/build-disable-elfhack.patch b/SOURCES/build-disable-elfhack.patch
new file mode 100644
index 0000000..172ecf0
--- /dev/null
+++ b/SOURCES/build-disable-elfhack.patch
@@ -0,0 +1,12 @@
+diff -up firefox-63.0/toolkit/moz.configure.disable-elfhack firefox-63.0/toolkit/moz.configure
+--- firefox-63.0/toolkit/moz.configure.disable-elfhack 2018-10-18 13:35:35.870039190 +0200
++++ firefox-63.0/toolkit/moz.configure 2018-10-18 13:36:41.682515492 +0200
+@@ -1010,7 +1010,7 @@ with only_when('--enable-compile-environ
+ help='Disable elf hacks')
+
+ set_config('USE_ELF_HACK',
+- depends_if('--enable-elf-hack')(lambda _: True))
++ depends_if('--enable-elf-hack')(lambda _: False))
+
+
+ @depends(check_build_environment)
diff --git a/SOURCES/build-nss-version.patch b/SOURCES/build-nss-version.patch
index 734005d..58e62c9 100644
--- a/SOURCES/build-nss-version.patch
+++ b/SOURCES/build-nss-version.patch
@@ -5,7 +5,7 @@ diff -up firefox-60.1.0/old-configure.in.nss-version firefox-60.1.0/old-configur
_USE_SYSTEM_NSS=1 )
if test -n "$_USE_SYSTEM_NSS"; then
-- AM_PATH_NSS(3.36.4, [MOZ_SYSTEM_NSS=1], [AC_MSG_ERROR([you don't have NSS installed or your version is too old])])
+- AM_PATH_NSS(3.36.6, [MOZ_SYSTEM_NSS=1], [AC_MSG_ERROR([you don't have NSS installed or your version is too old])])
+ AM_PATH_NSS(3.36.0, [MOZ_SYSTEM_NSS=1], [AC_MSG_ERROR([you don't have NSS installed or your version is too old])])
fi
diff --git a/SOURCES/mozilla-1475775-key3-revert.patch b/SOURCES/mozilla-1475775-key3-revert.patch
deleted file mode 100644
index 5ab7cbc..0000000
--- a/SOURCES/mozilla-1475775-key3-revert.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-diff --git a/security/manager/ssl/nsNSSComponent.cpp b/security/manager/ssl/nsNSSComponent.cpp
---- a/security/manager/ssl/nsNSSComponent.cpp
-+++ b/security/manager/ssl/nsNSSComponent.cpp
-@@ -1654,6 +1654,51 @@
- }
- return AttemptToRenamePKCS11ModuleDB(profilePath, sqlModuleDBFilename);
- }
-+
-+// When we changed from the old dbm database format to the newer sqlite
-+// implementation, the upgrade process left behind the existing files. Suppose a
-+// user had not set a password for the old key3.db (which is about 99% of
-+// users). After upgrading, both the old database and the new database are
-+// unprotected. If the user then sets a password for the new database, the old
-+// one will not be protected. In this scenario, we should probably just remove
-+// the old database (it would only be relevant if the user downgraded to a
-+// version of Firefox before 58, but we have to trade this off against the
-+// user's old private keys being unexpectedly unprotected after setting a
-+// password).
-+// This was never an issue on Android because we always used the new
-+// implementation.
-+static void
-+MaybeCleanUpOldNSSFiles(const nsACString& profilePath)
-+{
-+ UniquePK11SlotInfo slot(PK11_GetInternalKeySlot());
-+ if (!slot) {
-+ return;
-+ }
-+ // Unfortunately we can't now tell the difference between "there already was a
-+ // password when the upgrade happened" and "there was not a password but then
-+ // the user added one after upgrading".
-+ bool hasPassword = PK11_NeedLogin(slot.get()) &&
-+ !PK11_NeedUserInit(slot.get());
-+ if (!hasPassword) {
-+ return;
-+ }
-+ nsCOMPtr<nsIFile> dbFile = do_CreateInstance("@mozilla.org/file/local;1");
-+ if (!dbFile) {
-+ return;
-+ }
-+ nsresult rv = dbFile->InitWithNativePath(profilePath);
-+ if (NS_FAILED(rv)) {
-+ return;
-+ }
-+ NS_NAMED_LITERAL_CSTRING(keyDBFilename, "key3.db");
-+ rv = dbFile->AppendNative(keyDBFilename);
-+ if (NS_FAILED(rv)) {
-+ return;
-+ }
-+ // Since this isn't a directory, the `recursive` argument to `Remove` is
-+ // irrelevant.
-+ Unused << dbFile->Remove(false);
-+}
- #endif // ifndef ANDROID
-
- // Given a profile directory, attempt to initialize NSS. If nocertdb is true,
-@@ -1685,6 +1730,9 @@
- SECStatus srv = ::mozilla::psm::InitializeNSS(profilePath, false, !safeMode);
- if (srv == SECSuccess) {
- MOZ_LOG(gPIPNSSLog, LogLevel::Debug, ("initialized NSS in r/w mode"));
-+#ifndef ANDROID
-+ MaybeCleanUpOldNSSFiles(profilePath);
-+#endif // ifndef ANDROID
- return NS_OK;
- }
- #ifndef ANDROID
-
diff --git a/SPECS/firefox.spec b/SPECS/firefox.spec
index 4fd4d27..dd09789 100644
--- a/SPECS/firefox.spec
+++ b/SPECS/firefox.spec
@@ -1,16 +1,22 @@
+# Set for local builds only
+%global disable_toolsets 0
+
# Use system nspr/nss? FIXME
%global system_nss 1
%define use_bundled_ffi 0
%define use_bundled_python 1
+%define bundle_gnome_extension 0
# Don't use system hunspell for now
%global system_hunspell 0
%global system_sqlite 0
+%global use_llvmts 1
%if 0%{?rhel} > 6
%global system_ffi 1
%else
%global system_ffi 0
+%global use_llvmts 0
%endif
%if 0%{?rhel} < 8
%global use_dts 1
@@ -29,6 +35,12 @@
%global llvm_version 6.0
%endif
+%if 0%{?disable_toolsets}
+%global use_rustts 0
+%global use_dts 0
+%global use_llvmts 0
+%endif
+
# Use system cairo?
%global system_cairo 0
@@ -127,8 +139,8 @@
Summary: Mozilla Firefox Web browser
Name: firefox
-Version: 60.2.2
-Release: 2%{?pre_tag}%{?dist}
+Version: 60.4.0
+Release: 1%{?pre_tag}%{?dist}
URL: https://www.mozilla.org/firefox/
License: MPLv1.1 or GPLv2+ or LGPLv2+
%if 0%{?rhel} == 7
@@ -140,7 +152,7 @@ ExclusiveArch: i686 x86_64 ppc64 s390x
Source0: https://hg.mozilla.org/releases/mozilla-release/archive/firefox-%{version}%{?pre_version}.source.tar.xz
%if %{build_langpacks}
-Source1: firefox-langpacks-%{version}%{?pre_version}-20181002.tar.xz
+Source1: firefox-langpacks-%{version}%{?pre_version}-20181205.tar.xz
%endif
Source10: firefox-mozconfig
Source12: firefox-redhat-default-prefs.js
@@ -179,6 +191,7 @@ Patch40: build-aarch64-skia.patch
Patch41: build-debug-qcms.patch
Patch43: xulrunner-24.0-jemalloc-ppc.patch
Patch44: firefox-disable-dbus-remote.patch
+Patch45: build-disable-elfhack.patch
# Fedora/RHEL specific patches
Patch215: firefox-enable-addons.patch
@@ -194,8 +207,6 @@ Patch402: mozilla-1196777.patch
Patch406: mozilla-256180.patch
Patch413: mozilla-1353817.patch
Patch415: mozilla-1436242.patch
-# Removing this patch could lead to deletion of passwords from user profile!
-Patch416: mozilla-1475775-key3-revert.patch
# Debian patches
@@ -246,16 +257,16 @@ BuildRequires: devtoolset-%{dts_version}-gcc-c++
BuildRequires: devtoolset-%{dts_version}-gcc
BuildRequires: devtoolset-%{dts_version}-binutils
BuildRequires: devtoolset-%{dts_version}-libatomic-devel
-%if 0%{?rhel} == 7
+%if 0%{?use_llvmts}
BuildRequires: llvm-toolset-%{llvm_version}
BuildRequires: llvm-toolset-%{llvm_version}-llvm-devel
%endif
%endif
%if 0%{?use_rustts}
BuildRequires: rust-toolset-%{rst_version}-cargo
-BuildRequires: rust-toolset-%{rst_version}-rust
+BuildRequires: rust-toolset-%{rst_version}-rust >= 1.24
%endif
-%if 0%{?rhel} == 8
+%if 0%{?use_llvmts}
BuildRequires: llvm-toolset-%{llvm_version}
BuildRequires: llvm-toolset-%{llvm_version}-llvm-devel
%endif
@@ -377,6 +388,34 @@ This package contains results of tests executed during build.
#---------------------------------------------------------------------
+%if %{?bundle_gnome_extension}
+%package -n firefox-gnome-shell-extension
+%global firefox_gnome_shell_addon_name addon-751081-latest.xpi
+Summary: Support for managing GNOME Shell Extensions through web browsers
+Requires: %{name}%{?_isa} = %{version}-%{release}
+
+License: GPLv3+
+URL: https://wiki.gnome.org/Projects/GnomeShellIntegrationForChrome
+Source2: https://addons.mozilla.org/firefox/downloads/latest/gnome-shell-integration/platform:2/%{firefox_gnome_shell_addon_name}
+
+Requires: dbus
+Requires: gnome-icon-theme
+Requires: gnome-shell
+Requires: hicolor-icon-theme
+Requires: mozilla-filesystem
+Requires: python3-gobject-base
+Requires: python3-requests
+
+
+%description -n firefox-gnome-shell-extension
+Browser extension for Firefox and native host messaging connector that provides
+integration with GNOME Shell and the corresponding extensions repository
+https://extensions.gnome.org.
+
+%files -n firefox-gnome-shell-extension
+%{mozappdir}/distribution/extensions/chrome-gnome-shell@gnome.org.xpi
+%endif # bundle_gnome_extension
+
%prep
%setup -q -T -c -n python -a 100
%setup -q -n %{tarballdir}
@@ -395,6 +434,9 @@ This package contains results of tests executed during build.
%if 0%{?rhel} == 6
%patch44 -p1 -b .disable-dbus-remote
%endif
+%if 0%{?rhel} == 8
+%patch45 -p1 -b .disable-elfhack
+%endif
%patch3 -p1 -b .arm
%patch4 -p1 -b .build-mozconfig-fix
@@ -411,7 +453,6 @@ This package contains results of tests executed during build.
# This needs to stay for the future releases
%if 0%{?rhel} < 8
%patch230 -p1 -b .1503632-nss
-%patch416 -R -p1 -b .1475775-key3-revert
%endif
#ARM run-time patch
@@ -1026,6 +1067,13 @@ sed -i -e "s/\[Crash Reporter\]/[Crash Reporter]\nEnabled=1/" %{buildroot}/%{moz
rm -f %{buildroot}%{mozappdirdev}/sdk/lib/libmozjs.so
rm -f %{buildroot}%{mozappdirdev}/sdk/lib/libmozalloc.so
rm -f %{buildroot}%{mozappdirdev}/sdk/lib/libxul.so
+
+%if %{bundle_gnome_extension}
+# Gnome extension
+%{__mkdir_p} %{buildroot}%{mozappdir}/distribution/extensions
+%{__cp} -p %{SOURCE2} %{buildroot}%{mozappdir}/distribution/extensions/chrome-gnome-shell@gnome.org.xpi
+chmod 644 %{buildroot}%{mozappdir}/distribution/extensions/chrome-gnome-shell@gnome.org.xpi
+%endif
#---------------------------------------------------------------------
@@ -1151,6 +1199,15 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
#---------------------------------------------------------------------
%changelog
+* Wed Dec 5 2018 Jan Horak <jhorak@redhat.com> - 60.4.0-1
+- Update to 60.4.0 ESR
+
+* Tue Dec 4 2018 Jan Horak <jhorak@redhat.com> - 60.3.0-2
+- Added firefox-gnome-shell-extension
+
+* Fri Oct 19 2018 Jan Horak <jhorak@redhat.com> - 60.3.0-1
+- Update to 60.3.0 ESR
+
* Wed Oct 10 2018 Jan Horak <jhorak@redhat.com> - 60.2.2-2
- Added patch for rhbz#1633932