Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ungoogled-chromium: 87.0.4280.141 -> 88.0.4324.104 #111340

Merged
merged 1 commit into from Feb 1, 2021
Merged

ungoogled-chromium: 87.0.4280.141 -> 88.0.4324.104 #111340

merged 1 commit into from Feb 1, 2021

Conversation

primeos
Copy link
Member

@primeos primeos commented Jan 30, 2021 •
edited

Unfortunately this requires a crazy hack to support building with
Google's proprietary Widevine DRM technology as that requires fetching
the Google Chrome sources (see also 86ff1e4).
The hack is required because ungoogled-chromium doesn't always use tags
that correspond to a Google Chrome release.

Motivation for this change

@squalus I noticed that the latest ungoogled-chromium broke my update script. This PR should work (not tested though) but the implementation sucks... :o Maybe you have a better idea what to do here (feel free to replace my PR)?

Some other approaches I could think of:

  • Stop supporting DRM for ungoogled-chromium
    • There are known users of that combination but since Widevine is a proprietary DRM technology from Google it might be for the best to not even allow it. But then again I can understand why people need Widevine... But maybe they could use Chromium for that.
    • Also: The obligatory fuck DRM (why do we have such stupid shit...):
      https://social.primeos.dev/notice/A1r2eAhOl893jAnbNY
  • Check if it's possible to fetch an official build of Google Chrome 88.0.4324.104
  • Ignore the first ungoogled-chromium release for a new major version (the rest of the releases seem to match Google Chrome / Chromium stable channel releases)
Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.

@primeos
ungoogled-chromium: 87.0.4280.141 -> 88.0.4324.104
268600e 
Unfortunately this requires a crazy hack to support building with
Google's proprietary Widevine DRM technology as that requires fetching
the Google Chrome sources (see also 86ff1e4).
The hack is required because ungoogled-chromium doesn't always use tags
that correspond to a Google Chrome release.
@ofborg ofborg bot requested a review from squalus January 30, 2021 18:43
@primeos primeos marked this pull request as ready for review January 31, 2021 13:41
@primeos
Copy link
Member Author

primeos commented Jan 31, 2021

Didn't test the DRM part, but nix-build nixos/tests/chromium.nix -A ungoogled succeeds.

@primeos
Copy link
Member Author

primeos commented Feb 1, 2021

I also tried building ungoogled-chromium.override { enableWideVine = true; } and it succeeds. It isn't pretty but let's give it a try for the lack of a better alternative.

@squalus btw I'm considering to handle ungoogled-chromium updates as well to get the security fixes ASAP but I could only test if the NixOS VM test (nix-build nixos/tests/chromium.nix -A ungoogled) succeeds. And I'd backport ungoogled-chromium security updates without additional testing because we're already testing Chromium on the unstable and stable channels as well as ungoogled-chromium on the unstable channel so the risks should be very low. You'd of course still remain the primary maintainer as I could only handle automatic updates that don't break the build. Does that sound good to you or would you rather handle all updates?

@primeos primeos merged commit 3151fd5 into NixOS:master Feb 1, 2021
@primeos primeos mentioned this pull request Feb 1, 2021
Merged
10 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@squalus squalus Awaiting requested review from squalus

Assignees
No one assigned
Labels
1.severity: security 10.rebuild-darwin: 0 10.rebuild-linux: 1-10 10.rebuild-linux: 1 11.by: package-maintainer
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
1 participant
@primeos