mesa: relies on executable names in driconf

[flokli]

Nixpkgs version

• Unstable (26.05)

Describe the bug

Mesa ships (for what we care about here) a set of gl_renderer overrides to fix compatibility with some web security frameworks. See https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/38845 / https://gitlab.freedesktop.org/mesa/mesa/-/commit/f912db3f8dc0c0cb8cb2358e6ec79dd03b7a875d.

In some cases, these overrides do not trigger, as our binaries are called differently, due to the use of wrappers.

We should check for which browsers this fails to apply, and then see if --inherit-argv0 in the wrapper is sufficient, and if not, see if the unwrapped binary can be moved somewhere else so it still works.

We should go through this browser list and verify the workaround does successfully trigger.

On webkit-based browsers, chrome://gpu should show a "AGX G13/G14" substring in the GL_RENDERER variable
Firefox should, at about:support show the same string in the WebGL {1,2} Driver renderer variable.
The same can also be tested by visiting https://browserleaks.com/webgl.

Executables

(see https://gitlab.freedesktop.org/mesa/mesa/-/commit/f912db3f8dc0c0cb8cb2358e6ec79dd03b7a875d#9489c9ba7c9c6e53fb67125374e5c3ff3d141270_1375_1375 for the list of overrides)

• firefox (needs buildMozillaMach: set argv to unwrapped binary name #476929)
• firefox-esr (probably fixed by buildMozillaMach: set argv to unwrapped binary name #476929 too, testing)
• chromium (works)
• chromium-browser (we only have google-chrome and chromium)
• chrome (this is probably google-chrome, and there's no aarch64-linux binary, see https://issues.chromium.org/issues/40499531)
• vivaldi-bin (works, even though our wrapper is called vivaldi, running with --inherit-argv0, but the ran binary is called vivaldi-bin?)
• iceweasel (doesn't exist)
• epiphany (works)
• konqueror (kdePackages.konqueror works)
• falkon (kdePackages.gear.falkon works)
• seamonkey (do not exist in nixkpgs)
• waterfox (do not exist in nixkpgs)

Steps to reproduce

Run the specified browser on a Asahi Linux machine with NixOS.
Check chrome://gpu or about:support, and check what the vendor string says

Expected behaviour

It should contain "AGX G13/G14", and not "Apple M1" or "Apple M2".

Screenshots

No response

Relevant log output

Additional context

No response

System metadata

• system: "aarch64-linux"
• host os: Linux 6.18.2, NixOS, 26.05 (Yarara), 26.05pre-git
• multi-user?: yes
• sandbox: yes
• version: nix-env (Lix, like Nix) 2.93.3 System type: aarch64-linux Additional system types: x86_64-linux Features: gc, signed-caches System configuration file: /etc/nix/nix.conf User configuration files: /home/flokli/.config/nix/nix.conf:/etc/xdg/nix/nix.conf:/home/flokli/.nix-profile/etc/xdg/nix/nix.conf:/nix/profile/etc/xdg/nix/nix.conf:/home/flokli/.local/state/nix/profile/etc/xdg/nix/nix.conf:/etc/profiles/per-user/flokli/etc/xdg/nix/nix.conf:/nix/var/nix/profiles/default/etc/xdg/nix/nix.conf:/run/current-system/sw/etc/xdg/nix/nix.conf Store directory: /nix/store State directory: /nix/var/nix Data directory: /nix/store/2fi9912qkvr0s55kviaqq9lxl44ch33r-lix-2.93.3/share
• channels(root): "nixos"
• nixpkgs: /nix/var/nix/profiles/per-user/root/channels/nixos

Notify maintainers

---

Note for maintainers: Please tag this issue in your pull request description. (i.e. Resolves #ISSUE.)

I assert that this issue is relevant for Nixpkgs

• I assert that this is a bug and not a support request.
• I assert that this is not a duplicate of an existing issue.
• I assert that I have read the NixOS Code of Conduct and agree to abide by it.

Is this issue important to you?

Add a 👍 reaction to issues you find important.

[flokli]

So Falcon makes me believe --inherit-argv0 is sufficient, cause that's what it's doing, and it works:

/nix/store/gi00yvac0l0ldyjc6h0f9krln57ig17p-falkon-25.12.0/bin/falkon is a binary wrapper, with --inherit-argv0, calling /nix/store/gi00yvac0l0ldyjc6h0f9krln57ig17p-falkon-25.12.0/bin/.falkon-wrapped.

The workaround gets applied, I do see "AGX G13/G14" in https://browserleaks.com/webgl.

Edit: same for Konqueror.

[flokli]

So apparently we're only left with Firefox (and the ESR variant) not working.

@yuyuyureka, your report from nix-community/nixos-apple-silicon#387 (comment) was for Firefox?

[normalcea]

I can confirm that Firefox for me is consistently blocked for WSJ now (and my renderer string is "Mesa -- Apple M1 (G13G B1)"). The list created here does seem like this is the difference between using makeBinaryWrapper and makeWrapper but I haven't recompiled firefox with makeBinaryWrapper to test this out yet.

[flokli]

fix in #476929, PTAL.

[flokli]

I can confirm that Firefox for me is consistently blocked for WSJ now (and my renderer string is "Mesa -- Apple M1 (G13G B1)"). The list created here does seem like this is the difference between using makeBinaryWrapper and makeWrapper but I haven't recompiled firefox with makeBinaryWrapper to test this out yet.

makeBinaryWrapper vs makeWrapper makes no difference, but #476929 fixes it.

stable would also need a mesa 25.3 backport, in addition to that PR to be backported.