Mozilla brings Firefox Nightly as an RPM package for Linux

Contents

Mozilla has released Firefox Nightly as a native package for the Red Hat Package Manager (RPM) for the first time. This makes it significantly easier to install the developer version of the browser on RPM-based Linux distributions. Fedora from version 41, openSUSE, and Red Hat Enterprise Linux (RHEL) and its clones like Rocky Linux and AlmaLinux are supported.

Previously, users of RPM distributions had to rely on manual tarball downloads to use the latest Firefox Nightly versions. The new RPM packages, on the other hand, integrate directly into the system package managers dnf and zypper. Mozilla promises better performance through compiler-based optimizations and faster updates, as the packages are directly integrated into the release process. In addition, the binaries contain all security flags that were enabled during compilation.

Installation on Fedora and openSUSE

On Fedora 41 and newer with dnf5, installation is done by creating a new repository: sudo dnf config-manager addrepo --id=mozilla --set=baseurl=https://packages.mozilla.org/rpm/firefox --set=gpgcheck=0 --set=repo_gpgcheck=0, followed by sudo dnf makecache --refresh and sudo dnf install firefox-nightly.

openSUSE users use zypper: sudo zypper ar -G https://packages.mozilla.org/rpm/firefox mozilla, then sudo zypper refresh and finally sudo zypper install firefox-nightly. For RHEL and other distributions, users must create a manual repository file under /etc/yum.repos.d/mozilla.repo.

The Mozilla packages can be installed in parallel with the Firefox versions provided by the distribution without causing conflicts. Language packs are automatically installed for supported system languages. Additional language packs can be installed manually via sudo dnf install firefox-nightly-l10n-[code], for example, firefox-nightly-l10n-de for German. Available languages can be listed with dnf search firefox-nightly-l10n

GPG check temporarily disabled

A security drawback: The GPG signature check of the packages is currently disabled. The installation commands set the parameters gpgcheck=0 and repo_gpgcheck=0. Mozilla justifies this with bug 2009927, which has not yet been fixed. Until the problem is resolved, there is theoretically an increased security risk in man-in-the-middle attacks during package downloads. Mozilla does not provide a timeline for activating the signature check in the announcement.

The RPM packages are another step in Mozilla's strategy to take browser distribution into its hands. Since October 2023, the organization has been offering an APT repository for Debian-based distributions, which started before the release of Firefox 122. In December 2023, beta version 126 for Debian users followed.

Expansion to stable versions planned

Mozilla plans to extend the RPM offering to Firefox Beta and the stable version after a test phase and corresponding user feedback. Extended Support Releases (ESR) and possibly Thunderbird could also follow. However, the organization did not provide concrete timelines.

For users of RHEL clones like Rocky Linux or AlmaLinux, the new package offering means a significant increase in convenience. Previously, they had to rely on the often outdated Firefox versions of their distribution or on manual installations. The direct Mozilla packages now enable faster access to current features and security updates without distribution maintainers having to adapt the packages first.

(fo)