Chromium

> Hello Guix!

>

> Attached is a patch for Chromium, a popular web browser.

> It requires the new ld wrapper from 'core-updates' and a very powerful

> build machine (a quad-core Sandy Bridge Xeon uses 2-3 hours).

> Note that I cannot guarantee timely delivery of security updates. Major

> version upgrades are hugely painful, and almost always contain many

> high-severity fixes. Should we mention that in the description?

>

> Happy for any feedback.

>

> Hi Marius,

>

> Marius Bakke transcribed 43K bytes:

>> Hello Guix!

>>

>> Attached is a patch for Chromium, a popular web browser.

>

> Nice! I've been using this from your branch for a while now,

> works just fine :)

> Is this not affected by the chromium discussion which happened

> a while back? Can we include this? I'm all for this, because I

> mainly use it for websites where firefox/icecat doesn't work so

> well, and building it locally takes a very long time.

>> Note that I cannot guarantee timely delivery of security updates. Major

>> version upgrades are hugely painful, and almost always contain many

>> high-severity fixes. Should we mention that in the description?

>>

>> Happy for any feedback.

>>

>

> Shouldn't you mention defines in addition to the define-public aswell,

> or don't we do that?

> ng0 <ng0@infotropique.org> writes:

>

> > Hi Marius,

> >

> > Marius Bakke transcribed 43K bytes:

> >> Hello Guix!

> >>

> >> Attached is a patch for Chromium, a popular web browser.

> >

> > Nice! I've been using this from your branch for a while now,

> > works just fine :)

> > Is this not affected by the chromium discussion which happened

> > a while back? Can we include this? I'm all for this, because I

> > mainly use it for websites where firefox/icecat doesn't work so

> > well, and building it locally takes a very long time.

>

> I believe this is within the Free System Distribution Guidelines.

> DRM

> ("Widevine") is disabled at build time, and the Web Store is

> non-functional without the end user explicitly enabling it.

>

> There are some grey areas though. The browser may interact with certain

> non-free APIs (apart from regular browser duties) such as translation or

> prediction services. These features are optional, but some are enabled

> by default, and difficult to maintain patches for (I've tried).

>

> However, I have verified that it does not send any unsolicited requests

> with the current command-line options, apart from the very first launch

> which spawns a login prompt (help wanted!). Without either of those

> flags the browser "calls home" every time it starts.

>

> >> Note that I cannot guarantee timely delivery of security updates. Major

> >> version upgrades are hugely painful, and almost always contain many

> >> high-severity fixes. Should we mention that in the description?

> >>

> >> Happy for any feedback.

> >>

> >

> > Shouldn't you mention defines in addition to the define-public aswell,

> > or don't we do that?

>

> Not for new files (modules), typically. I don't think Magit can fill out

> those variable names (by pressing C on the hunks) either ;-) But it

> should probably go in web-browsers.scm anyway.

> ng0 <ng0@infotropique.org> writes:

>

> > Hi Marius,

> >

> > Marius Bakke transcribed 43K bytes:

> >> Hello Guix!

> >>

> >> Attached is a patch for Chromium, a popular web browser.

> >

> > Nice! I've been using this from your branch for a while now,

> > works just fine :)

> > Is this not affected by the chromium discussion which happened

> > a while back? Can we include this? I'm all for this, because I

> > mainly use it for websites where firefox/icecat doesn't work so

> > well, and building it locally takes a very long time.

>

> I believe this is within the Free System Distribution Guidelines. DRM

> ("Widevine") is disabled at build time, and the Web Store is

> non-functional without the end user explicitly enabling it.

>

> There are some grey areas though. The browser may interact with certain

> non-free APIs (apart from regular browser duties) such as translation or

> prediction services. These features are optional, but some are enabled

> by default, and difficult to maintain patches for (I've tried).

>

> However, I have verified that it does not send any unsolicited requests

> with the current command-line options, apart from the very first launch

> which spawns a login prompt (help wanted!). Without either of those

> flags the browser "calls home" every time it starts.

>

> >> Note that I cannot guarantee timely delivery of security updates. Major

> >> version upgrades are hugely painful, and almost always contain many

> >> high-severity fixes. Should we mention that in the description?

> >>

> >> Happy for any feedback.

> >>

> >

> > Shouldn't you mention defines in addition to the define-public aswell,

> > or don't we do that?

>

> Not for new files (modules), typically. I don't think Magit can fill out

> those variable names (by pressing C on the hunks) either ;-) But it

> should probably go in web-browsers.scm anyway.

> Marius Bakke transcribed 2.4K bytes:

> > ng0 <ng0@infotropique.org> writes:

> >

> > > Hi Marius,

> > >

> > > Marius Bakke transcribed 43K bytes:

> > >> Hello Guix!

> > >>

> > >> Attached is a patch for Chromium, a popular web browser.

> > >

> > > Nice! I've been using this from your branch for a while now,

> > > works just fine :)

> > > Is this not affected by the chromium discussion which happened

> > > a while back? Can we include this? I'm all for this, because I

> > > mainly use it for websites where firefox/icecat doesn't work so

> > > well, and building it locally takes a very long time.

> >

> > I believe this is within the Free System Distribution Guidelines. DRM

> > ("Widevine") is disabled at build time, and the Web Store is

> > non-functional without the end user explicitly enabling it.

> >

> > There are some grey areas though. The browser may interact with certain

> > non-free APIs (apart from regular browser duties) such as translation or

> > prediction services. These features are optional, but some are enabled

> > by default, and difficult to maintain patches for (I've tried).

> >

> > However, I have verified that it does not send any unsolicited requests

> > with the current command-line options, apart from the very first launch

> > which spawns a login prompt (help wanted!). Without either of those

> > flags the browser "calls home" every time it starts.

> >

> > >> Note that I cannot guarantee timely delivery of security updates. Major

> > >> version upgrades are hugely painful, and almost always contain many

> > >> high-severity fixes. Should we mention that in the description?

> > >>

> > >> Happy for any feedback.

> > >>

> > >

> > > Shouldn't you mention defines in addition to the define-public aswell,

> > > or don't we do that?

> >

> > Not for new files (modules), typically. I don't think Magit can fill out

> > those variable names (by pressing C on the hunks) either ;-) But it

> > should probably go in web-browsers.scm anyway.

>

> Unless someone else is already building this, I'm giving it a spin.

>

> I guess you changed some things since the version of yours I have in

> here: https://gitlab.com/ng0_guix/packages/blob/master/ng0/packages/chromium.scm

> so I have to rebuild it.

> It might take a while because I'm offloading to something much slower

> but which doesn't care about heat as much as a this one ;)

> ng0 transcribed 3.4K bytes:

> > Marius Bakke transcribed 2.4K bytes:

> > > ng0 <ng0@infotropique.org> writes:

> > >

> > > > Hi Marius,

> > > >

> > > > Marius Bakke transcribed 43K bytes:

> > > >> Hello Guix!

> > > >>

> > > >> Attached is a patch for Chromium, a popular web browser.

> > > >

> > > > Nice! I've been using this from your branch for a while now,

> > > > works just fine :)

> > > > Is this not affected by the chromium discussion which happened

> > > > a while back? Can we include this? I'm all for this, because I

> > > > mainly use it for websites where firefox/icecat doesn't work so

> > > > well, and building it locally takes a very long time.

> > >

> > > I believe this is within the Free System Distribution Guidelines. DRM

> > > ("Widevine") is disabled at build time, and the Web Store is

> > > non-functional without the end user explicitly enabling it.

> > >

> > > There are some grey areas though. The browser may interact with certain

> > > non-free APIs (apart from regular browser duties) such as translation or

> > > prediction services. These features are optional, but some are enabled

> > > by default, and difficult to maintain patches for (I've tried).

> > >

> > > However, I have verified that it does not send any unsolicited requests

> > > with the current command-line options, apart from the very first launch

> > > which spawns a login prompt (help wanted!). Without either of those

> > > flags the browser "calls home" every time it starts.

> > >

> > > >> Note that I cannot guarantee timely delivery of security updates. Major

> > > >> version upgrades are hugely painful, and almost always contain many

> > > >> high-severity fixes. Should we mention that in the description?

> > > >>

> > > >> Happy for any feedback.

> > > >>

> > > >

> > > > Shouldn't you mention defines in addition to the define-public aswell,

> > > > or don't we do that?

> > >

> > > Not for new files (modules), typically. I don't think Magit can fill out

> > > those variable names (by pressing C on the hunks) either ;-) But it

> > > should probably go in web-browsers.scm anyway.

> >

> > Unless someone else is already building this, I'm giving it a spin.

> >

> > I guess you changed some things since the version of yours I have in

> > here: https://gitlab.com/ng0_guix/packages/blob/master/ng0/packages/chromium.scm

> > so I have to rebuild it.

> > It might take a while because I'm offloading to something much slower

> > but which doesn't care about heat as much as a this one ;)

>

> Patch itself LGTM, I'm now waiting on the build to finish in the

> next couple of hours.

> ng0 transcribed 3.7K bytes:

> > ng0 transcribed 3.4K bytes:

> > > Marius Bakke transcribed 2.4K bytes:

> > > > ng0 <ng0@infotropique.org> writes:

> > > >

> > > > > Hi Marius,

> > > > >

> > > > > Marius Bakke transcribed 43K bytes:

> > > > >> Hello Guix!

> > > > >>

> > > > >> Attached is a patch for Chromium, a popular web browser.

> > > > >

> > > > > Nice! I've been using this from your branch for a while now,

> > > > > works just fine :)

> > > > > Is this not affected by the chromium discussion which happened

> > > > > a while back? Can we include this? I'm all for this, because I

> > > > > mainly use it for websites where firefox/icecat doesn't work so

> > > > > well, and building it locally takes a very long time.

> > > >

> > > > I believe this is within the Free System Distribution Guidelines. DRM

> > > > ("Widevine") is disabled at build time, and the Web Store is

> > > > non-functional without the end user explicitly enabling it.

> > > >

> > > > There are some grey areas though. The browser may interact with certain

> > > > non-free APIs (apart from regular browser duties) such as translation or

> > > > prediction services. These features are optional, but some are enabled

> > > > by default, and difficult to maintain patches for (I've tried).

> > > >

> > > > However, I have verified that it does not send any unsolicited requests

> > > > with the current command-line options, apart from the very first launch

> > > > which spawns a login prompt (help wanted!). Without either of those

> > > > flags the browser "calls home" every time it starts.

> > > >

> > > > >> Note that I cannot guarantee timely delivery of security updates. Major

> > > > >> version upgrades are hugely painful, and almost always contain many

> > > > >> high-severity fixes. Should we mention that in the description?

> > > > >>

> > > > >> Happy for any feedback.

> > > > >>

> > > > >

> > > > > Shouldn't you mention defines in addition to the define-public aswell,

> > > > > or don't we do that?

> > > >

> > > > Not for new files (modules), typically. I don't think Magit can fill out

> > > > those variable names (by pressing C on the hunks) either ;-) But it

> > > > should probably go in web-browsers.scm anyway.

> > >

> > > Unless someone else is already building this, I'm giving it a spin.

> > >

> > > I guess you changed some things since the version of yours I have in

> > > here: https://gitlab.com/ng0_guix/packages/blob/master/ng0/packages/chromium.scm

> > > so I have to rebuild it.

> > > It might take a while because I'm offloading to something much slower

> > > but which doesn't care about heat as much as a this one ;)

> >

> > Patch itself LGTM, I'm now waiting on the build to finish in the

> > next couple of hours.

>

> x86_64 architecture, builds fails at this point:

>

> [6247/27388] STAMP obj/mojo/common/common.stamp

> [6248/27388] ACTION //net/http:generate_transport_security_state(//build/toolchain/linux:x64)

> FAILED: gen/net/http/transport_security_state_static.h

> python ../../build/gn_run_binary.py transport_security_state_generator ../../net/http/transport_security_state_static.json ../../net/http/transport_security_state_static.pins ../../net/http/transport_security_state_static.template gen/net/http/transport_security_state_static.h

> ./transport_security_state_generator: error while loading shared libraries: libglib-2.0.so.0: cannot open shared object file: No such file or directory

> transport_security_state_generator failed with exit code 127

> [6249/27388] AR obj/sandbox/linux/libsandbox_services.a

> ninja: build stopped: subcommand failed.

> phase `build' failed after 1777.2 seconds

> builder for `/gnu/store/2afpy542vywbmk093dd1kzlfx74s2460-chromium-60.0.3112.90.drv' failed with exit code 1

> @ build-failed /gnu/store/2afpy542vywbmk093dd1kzlfx74s2460-chromium-60.0.3112.90.drv - 1 builder for `/gnu/store/2afpy542vywbmk093dd1kzlfx74s2460-chromium-60.0.3112.90.drv' failed with exit code 1

> derivation '/gnu/store/2afpy542vywbmk093dd1kzlfx74s2460-chromium-60.0.3112.90.drv' offloaded to '192.168.1.179' failed: build of `/gnu/store/2afpy542vywbmk093dd1kzlfx74s2460-chromium-60.0.3112.90.drv' failed

> @ build-failed /gnu/store/2afpy542vywbmk093dd1kzlfx74s2460-chromium-60.0.3112.90.drv - 1 builder for `/gnu/store/2afpy542vywbmk093dd1kzlfx74s2460-chromium-60.0.3112.90.drv' failed with exit code 100

> guix build: error: build failed: build of `/gnu/store/2afpy542vywbmk093dd1kzlfx74s2460-chromium-60.0.3112.90.drv' failed

>

> Have you experienced this before?

> x86_64 architecture, builds fails at this point:

>

> [6247/27388] STAMP obj/mojo/common/common.stamp

> [6248/27388] ACTION //net/http:generate_transport_security_state(//build/toolchain/linux:x64)

> FAILED: gen/net/http/transport_security_state_static.h

> python ../../build/gn_run_binary.py transport_security_state_generator ../../net/http/transport_security_state_static.json ../../net/http/transport_security_state_static.pins ../../net/http/transport_security_state_static.template gen/net/http/transport_security_state_static.h

> ./transport_security_state_generator: error while loading shared libraries: libglib-2.0.so.0: cannot open shared object file: No such file or directory

> transport_security_state_generator failed with exit code 127

> [6249/27388] AR obj/sandbox/linux/libsandbox_services.a

> ninja: build stopped: subcommand failed.

> phase `build' failed after 1777.2 seconds

> builder for `/gnu/store/2afpy542vywbmk093dd1kzlfx74s2460-chromium-60.0.3112.90.drv' failed with exit code 1

> @ build-failed /gnu/store/2afpy542vywbmk093dd1kzlfx74s2460-chromium-60.0.3112.90.drv - 1 builder for `/gnu/store/2afpy542vywbmk093dd1kzlfx74s2460-chromium-60.0.3112.90.drv' failed with exit code 1

> derivation '/gnu/store/2afpy542vywbmk093dd1kzlfx74s2460-chromium-60.0.3112.90.drv' offloaded to '192.168.1.179' failed: build of `/gnu/store/2afpy542vywbmk093dd1kzlfx74s2460-chromium-60.0.3112.90.drv' failed

> @ build-failed /gnu/store/2afpy542vywbmk093dd1kzlfx74s2460-chromium-60.0.3112.90.drv - 1 builder for `/gnu/store/2afpy542vywbmk093dd1kzlfx74s2460-chromium-60.0.3112.90.drv' failed with exit code 100

> guix build: error: build failed: build of `/gnu/store/2afpy542vywbmk093dd1kzlfx74s2460-chromium-60.0.3112.90.drv' failed

>

> Have you experienced this before?

> On Tue, Aug 08, 2017 at 03:44:22PM +0000, ng0 wrote:

> > x86_64 architecture, builds fails at this point:

> >

> > [6247/27388] STAMP obj/mojo/common/common.stamp

> > [6248/27388] ACTION //net/http:generate_transport_security_state(//build/toolchain/linux:x64)

> > FAILED: gen/net/http/transport_security_state_static.h

> > python ../../build/gn_run_binary.py transport_security_state_generator ../../net/http/transport_security_state_static.json ../../net/http/transport_security_state_static.pins ../../net/http/transport_security_state_static.template gen/net/http/transport_security_state_static.h

> > ./transport_security_state_generator: error while loading shared libraries: libglib-2.0.so.0: cannot open shared object file: No such file or directory

> > transport_security_state_generator failed with exit code 127

> > [6249/27388] AR obj/sandbox/linux/libsandbox_services.a

> > ninja: build stopped: subcommand failed.

> > phase `build' failed after 1777.2 seconds

> > builder for `/gnu/store/2afpy542vywbmk093dd1kzlfx74s2460-chromium-60.0.3112.90.drv' failed with exit code 1

> > @ build-failed /gnu/store/2afpy542vywbmk093dd1kzlfx74s2460-chromium-60.0.3112.90.drv - 1 builder for `/gnu/store/2afpy542vywbmk093dd1kzlfx74s2460-chromium-60.0.3112.90.drv' failed with exit code 1

> > derivation '/gnu/store/2afpy542vywbmk093dd1kzlfx74s2460-chromium-60.0.3112.90.drv' offloaded to '192.168.1.179' failed: build of `/gnu/store/2afpy542vywbmk093dd1kzlfx74s2460-chromium-60.0.3112.90.drv' failed

> > @ build-failed /gnu/store/2afpy542vywbmk093dd1kzlfx74s2460-chromium-60.0.3112.90.drv - 1 builder for `/gnu/store/2afpy542vywbmk093dd1kzlfx74s2460-chromium-60.0.3112.90.drv' failed with exit code 100

> > guix build: error: build failed: build of `/gnu/store/2afpy542vywbmk093dd1kzlfx74s2460-chromium-60.0.3112.90.drv' failed

> >

> > Have you experienced this before?

>

> Based on discussion on #guix, this package is based on core-updates. Did

> you try building it on core-updates?

> This built on aarch64 on core-updates in about 12.5 hours. I did need to

> add the following substitution* to the package definition.

> Hello Guix!

>

> Attached is a patch for Chromium, a popular web browser.

>

> It requires the new ld wrapper from 'core-updates' and a very powerful

> build machine (a quad-core Sandy Bridge Xeon uses 2-3 hours).

>

> Note that I cannot guarantee timely delivery of security updates. Major

> version upgrades are hugely painful, and almost always contain many

> high-severity fixes. Should we mention that in the description?

>

> Happy for any feedback.

> Marius Bakke transcribed 43K bytes:

>> Hello Guix!

>>

>> Attached is a patch for Chromium, a popular web browser.

>>

>> It requires the new ld wrapper from 'core-updates' and a very powerful

>> build machine (a quad-core Sandy Bridge Xeon uses 2-3 hours).

>>

>> Note that I cannot guarantee timely delivery of security updates. Major

>> version upgrades are hugely painful, and almost always contain many

>> high-severity fixes. Should we mention that in the description?

>>

>> Happy for any feedback.

>

> Hi,

>

> could this patch be merged into master now?

> It would be too bad to see this gathering digitial dust.

> ng0 <ng0@infotropique.org> skribis:

> > could this patch be merged into master now?

>

> Probably (I think at the time Marius submitted it the ‘ld’ wrapper

> enhancements were not in ‘master’ yet.)

>

> For the security aspect though, given that it’s a fairly critical

> component, I’d like to have Leo’s opinion. Thoughts?

> On Wed, Oct 11, 2017 at 09:52:46PM +0200, Ludovic Courtès wrote:

> > ng0 <ng0@infotropique.org> skribis:

> > > could this patch be merged into master now?

> >

> > Probably (I think at the time Marius submitted it the ‘ld’ wrapper

> > enhancements were not in ‘master’ yet.)

> >

> > For the security aspect though, given that it’s a fairly critical

> > component, I’d like to have Leo’s opinion. Thoughts?

>

> Any questions in particular?

>

> For me, the primary question is maintenance.

>

> As Marius pointed out when sending the patch, major version upgrades may

> be difficult, and timely delivery of security updates cannot be

> guaranteed. But these caveats apply to every package. [0] They aren't a

> reason to exclude Chromium from Guix.

>

> Now, if we add the Chromium package and then let if fall behind for

> weeks or months, that will be a problem, and we will need to remove it.

> It's relatively easy to remove packages of end-user applications, since

> it's rare that other packages depend on them.

>

> As always, I'm willing to help with security updates as much as my

> volunteer schedule allows.

>

> The other issue will be bugs caused by the use of non-bundled libraries.

> Presumably, important bugs are fixed in the bundled libraries before

> they are released by the upstream library (if ever). But again, this is

> an issue with all of our packages. We will address these issues when we

> find them.

>

> There was a new release last month, 61.0.3163. I'd like to try updating

> to it this weekend if I have the disk (does anyone know how much is

> required) and computing power. Then we can push :)

> [0] Users who really need to rely on the security of Chromium or Chrome

> should use the "official" installation from the Chromium or Google

> teams, and turn on auto-updates. Every update can be expected to fix

> critical bugs.

> On Wed, Oct 11, 2017 at 09:52:46PM +0200, Ludovic Courtès wrote:

>> ng0 <ng0@infotropique.org> skribis:

>> > could this patch be merged into master now?

>>

>> Probably (I think at the time Marius submitted it the ‘ld’ wrapper

>> enhancements were not in ‘master’ yet.)

>>

>> For the security aspect though, given that it’s a fairly critical

>> component, I’d like to have Leo’s opinion. Thoughts?

>

> Any questions in particular?

> For me, the primary question is maintenance.

>

> As Marius pointed out when sending the patch, major version upgrades may

> be difficult, and timely delivery of security updates cannot be

> guaranteed. But these caveats apply to every package. [0] They aren't a

> reason to exclude Chromium from Guix.

> Now, if we add the Chromium package and then let if fall behind for

> weeks or months, that will be a problem, and we will need to remove it.

> It's relatively easy to remove packages of end-user applications, since

> it's rare that other packages depend on them.

>

> As always, I'm willing to help with security updates as much as my

> volunteer schedule allows.

>

> The other issue will be bugs caused by the use of non-bundled libraries.

> Presumably, important bugs are fixed in the bundled libraries before

> they are released by the upstream library (if ever). But again, this is

> an issue with all of our packages. We will address these issues when we

> find them.

> There was a new release last month, 61.0.3163. I'd like to try updating

> to it this weekend if I have the disk (does anyone know how much is

> required) and computing power. Then we can push :)

> [0] Users who really need to rely on the security of Chromium or Chrome

> should use the "official" installation from the Chromium or Google

> teams, and turn on auto-updates. Every update can be expected to fix

> critical bugs.

> I think we should make sure that our package does not call home in any

> way. That’s what I expect from a security- and privacy-conscious

> distro.

> Ludovic Courtès <ludo@gnu.org> writes:

>

> > I think we should make sure that our package does not call home in any

> > way. That’s what I expect from a security- and privacy-conscious

> > distro.

>

> Currently, it calls home at first launch, prompting for a login. But

> I've verified that it does not send any unsolicited requests for

> subsequent startups, as long as the user does not change the

> command-line flags.

> Anyway I'm attaching the current iteration of this patch. Chromium 62

> is out today, I'll try to update this weekend and will push it after

> that in lieu of other feedback.

> Ludovic Courtès <ludo@gnu.org> writes:

>

>> I think we should make sure that our package does not call home in any

>> way. That’s what I expect from a security- and privacy-conscious

>> distro.

>

> Currently, it calls home at first launch, prompting for a login. But

> I've verified that it does not send any unsolicited requests for

> subsequent startups, as long as the user does not change the

> command-line flags.

> I tried picking two other Debian patches[0][1] to see if it helped with

> the annoying splash screen and decided to verify whether the browser

> still "calls home" from a clean profile. The last time I checked was

> many versions ago.

>

> After dismissing the sign-in dialog, the "New Tab Page" loads a regular

> Google search bar, and "pre-fills" two of the "most commonly used" slots

> with Chrome URLs, (still) downloading a bunch of data in the process.

>

> Not great, but maybe we could live with that if it was just for the

> first run (it wasn't; had to change search engine to prevent the New Tab

> Page from calling the mothership).

>

> To my great surprise, while watching tcpdump from a different window, it

> also called home *when I switched windows*. Every time the Chromium

> window was activated, some data was sent to Google servers.

>

> Going into settings and toggling the "Use a prediction service to help

> complete searches and URLs typed in the address bar" option (to off)

> disabled that behaviour.

>

> Not very confidence-instilling.

>

> I'm going to try to incorporate the "Inox Patchset"[2], which is a set

> of patches that attempts to remove all such misfeatures from Chromium.

> They seem to have managed to stay on top of recent Chromium development,

> unlike two other prominent privacy-focused "forks", so I'm optimistic.

>

> But it might take some weeks before the next update. Stay tuned..

>

> [0]

> <https://anonscm.debian.org/cgit/pkg-chromium/pkg-chromium.git/tree/debian/patches/disable/promo.patch>

> [1]

> <https://anonscm.debian.org/cgit/pkg-chromium/pkg-chromium.git/tree/debian/patches/disable/external-components.patch>

> [2] <https://github.com/gcarq/inox-patchset>

>> + (substitute* "chrome/common/chrome_paths.cc"

>> + (("/usr/share/chromium/extensions")

>> + ;; TODO: Add ~/.guix-profile.

>> + "/run/current-system/profile/share/chromium/extensions"))

>

> What's the idea behind this? Did you test it? Do you have any guix build-system

> using Chromium extensions as an example? So far this completely disables the

> installation of any plugins and addons.

>> + (mkdir-p bin)

>> + ;; Add a thin wrapper to prevent the user from inadvertently

>> + ;; installing non-free software through the Web Store.

>> + ;; TODO: Discover extensions from the profile and pass

>> + ;; something like "--disable-extensions-except=...".

>

> Same question here.

> If you need help, there's at least 3 users of Chromium now. I'd like to read

> your ideas on how to solve the TODOs, aswell as: Do you have any unpushed

> progress? Maybe we can team collaborate on this huge browser.

> Many thanks for your ongoing work with this (and the patience :))

> As this is 63, you you are keeping track of Debian, right? I tried

> to package 64 a couple of days ago because I wanted the workaround

> for some of the recent security clusterfucks, but Debian is still

> on 63 :/

> I hope they'll update their patchset soon.

> Testing and feedback welcome!

>

> Currently there are two "important" (blocking?) TODOs left:

>

> * Move the 'delete-bundled-software' phase to a source snippet.

> Repacking the ~500MiB compressed tarball is *really* expensive. It

> should also aid the licensing situation.

> * Delete the two default entries from the "most used" list on the New

> Tab page. The first run will download thumbnails for these sites,

> leaking data. One of them also leads to the disabled-by-default

> store, promoting non-free software.

>

> I'm optimistic that fixing the second item will make the browser not

> leak *any* data at launch with the default configuration. Which leads

> to a third item: writing a system test that verifies that launching

> Chromium does indeed not initiate any network traffic.

>

> Anyway, here is the latest patch:

>

> From f813b2d7ec0728a906720fa74bf9f442af6ab10d Mon Sep 17 00:00:00 2001

> From: Marius Bakke <mbakke@fastmail.com>

> Date: Wed, 12 Oct 2016 17:25:05 +0100

> Subject: [PATCH] gnu: Add chromium.

>

> * gnu/packages/chromium.scm: New file.

> * gnu/local.mk: Record it.

> Marius Bakke transcribed 39K bytes:

>

>> Testing and feedback welcome!

>>

>> Currently there are two "important" (blocking?) TODOs left:

>>

>> * Move the 'delete-bundled-software' phase to a source snippet.

>> Repacking the ~500MiB compressed tarball is *really* expensive. It

>> should also aid the licensing situation.

>> * Delete the two default entries from the "most used" list on the New

>> Tab page. The first run will download thumbnails for these sites,

>> leaking data. One of them also leads to the disabled-by-default

>> store, promoting non-free software.

>>

>> I'm optimistic that fixing the second item will make the browser not

>> leak *any* data at launch with the default configuration. Which leads

>> to a third item: writing a system test that verifies that launching

>> Chromium does indeed not initiate any network traffic.

>>

>> Anyway, here is the latest patch:

>>

>

>> From f813b2d7ec0728a906720fa74bf9f442af6ab10d Mon Sep 17 00:00:00 2001

>> From: Marius Bakke <mbakke@fastmail.com>

>> Date: Wed, 12 Oct 2016 17:25:05 +0100

>> Subject: [PATCH] gnu: Add chromium.

>>

>> * gnu/packages/chromium.scm: New file.

>> * gnu/local.mk: Record it.

>

> I think you forgot a package:

>

> gnu/packages/chromium.scm:664:5: icu4c-59.1: unbound variable

> Many thanks for your ongoing work with this (and the patience :))

> As this is 63, you you are keeping track of Debian, right? I tried

> to package 64 a couple of days ago because I wanted the workaround

> for some of the recent security clusterfucks, but Debian is still

> on 63 :/

> I hope they'll update their patchset soon.

> ng0 <ng0@n0.is> writes:

>

> > Marius Bakke transcribed 39K bytes:

> >

> >> Testing and feedback welcome!

> >>

> >> Currently there are two "important" (blocking?) TODOs left:

> >>

> >> * Move the 'delete-bundled-software' phase to a source snippet.

> >> Repacking the ~500MiB compressed tarball is *really* expensive. It

> >> should also aid the licensing situation.

> >> * Delete the two default entries from the "most used" list on the New

> >> Tab page. The first run will download thumbnails for these sites,

> >> leaking data. One of them also leads to the disabled-by-default

> >> store, promoting non-free software.

> >>

> >> I'm optimistic that fixing the second item will make the browser not

> >> leak *any* data at launch with the default configuration. Which leads

> >> to a third item: writing a system test that verifies that launching

> >> Chromium does indeed not initiate any network traffic.

> >>

> >> Anyway, here is the latest patch:

> >>

> >

> >> From f813b2d7ec0728a906720fa74bf9f442af6ab10d Mon Sep 17 00:00:00 2001

> >> From: Marius Bakke <mbakke@fastmail.com>

> >> Date: Wed, 12 Oct 2016 17:25:05 +0100

> >> Subject: [PATCH] gnu: Add chromium.

> >>

> >> * gnu/packages/chromium.scm: New file.

> >> * gnu/local.mk: Record it.

> >

> > I think you forgot a package:

> >

> > gnu/packages/chromium.scm:664:5: icu4c-59.1: unbound variable

>

> Indeed. This can now be changed to use the regular "icu4c" package.

> Tangentially, these kinds of problems are typical with new Chromium

> releases. In 63 or later, system harfbuzz had to be disabled. If we

> are going to carry this package, changes like these *will* be normal.

>

> Upstream only tests their releases with Clang, and with the bundled

> versions of packages, regardless of the unbundling script. Not great.

> ng0 <ng0@n0.is> writes:

>

> > Many thanks for your ongoing work with this (and the patience :))

> > As this is 63, you you are keeping track of Debian, right? I tried

> > to package 64 a couple of days ago because I wanted the workaround

> > for some of the recent security clusterfucks, but Debian is still

> > on 63 :/

> > I hope they'll update their patchset soon.

>

> Indeed Google did not add the Spectre mitigation to Chromium 63, even

> though the latest version was released after the fact.

>

> https://xlab.tencent.com/special/spectre/spectre_check.html

>

> For reasons that beat me, they only added it to the proprietary Chrome

> browser, which follows the same version number as Chromium.

>

> The attached patch adds Spectre mitigation to the current Chromium

> release. The patch was pulled from the Chrome 64 branch:

>

> From b011b57f357af97f3a003a3b1c481fc8bd2b869c Mon Sep 17 00:00:00 2001

> From: Marius Bakke <mbakke@fastmail.com>

> Date: Thu, 11 Jan 2018 14:36:47 +0100

> Subject: [PATCH] gnu: chromium: Add spectre mitigation.

>

> * gnu/packages/patches/chromium-spectre-mitigation.patch: New file.

> * gnu/local.mk (dist_patch_DATA): Register it.

> * gnu/packages/chromium.scm (chromium)[source]: Use it.

> ---

> gnu/local.mk | 1 +

> gnu/packages/chromium.scm | 3 ++-

> gnu/packages/patches/chromium-spectre-mitigation.patch | 13 +++++++++++++

> 3 files changed, 16 insertions(+), 1 deletion(-)

> create mode 100644 gnu/packages/patches/chromium-spectre-mitigation.patch

>

> diff --git a/gnu/local.mk b/gnu/local.mk

> index 513f64043..89dab227c 100644

> --- a/gnu/local.mk

> +++ b/gnu/local.mk

> @@ -575,6 +575,7 @@ dist_patch_DATA = \

> %D%/packages/patches/ceph-skip-collect-sys-info-test.patch \

> %D%/packages/patches/ceph-skip-unittest_blockdev.patch \

> %D%/packages/patches/chmlib-inttypes.patch \

> + %D%/packages/patches/chromium-spectre-mitigation.patch \

> %D%/packages/patches/clang-libc-search-path.patch \

> %D%/packages/patches/clang-3.8-libc-search-path.patch \

> %D%/packages/patches/clementine-use-openssl.patch \

> diff --git a/gnu/packages/chromium.scm b/gnu/packages/chromium.scm

> index dd040527b..1e9dba42e 100644

> --- a/gnu/packages/chromium.scm

> +++ b/gnu/packages/chromium.scm

> @@ -240,7 +240,8 @@

> %chromium-system-icu.patch

> %chromium-system-nspr.patch

> %chromium-system-libevent.patch

> - %chromium-disable-api-keys-warning.patch))

> + %chromium-disable-api-keys-warning.patch

> + (search-patch "chromium-spectre-mitigation.patch")))

> (modules '((srfi srfi-1)

> (guix build utils)))

> (snippet

> diff --git a/gnu/packages/patches/chromium-spectre-mitigation.patch b/gnu/packages/patches/chromium-spectre-mitigation.patch

> new file mode 100644

> index 000000000..a44a3bce4

> --- /dev/null

> +++ b/gnu/packages/patches/chromium-spectre-mitigation.patch

> @@ -0,0 +1,13 @@

> +diff --git a/content/public/common/content_features.cc b/content/public/common/content_features.cc

> +index 43feb76..33a49b8 100644

> +--- a/content/public/common/content_features.cc

> ++++ b/content/public/common/content_features.cc

> +@@ -308,7 +308,7 @@

> +

> + // http://tc39.github.io/ecmascript_sharedmem/shmem.html

> + const base::Feature kSharedArrayBuffer{"SharedArrayBuffer",

> +- base::FEATURE_ENABLED_BY_DEFAULT};

> ++ base::FEATURE_DISABLED_BY_DEFAULT};

> +

> + // An experiment to require process isolation for the sign-in origin,

> + // https://accounts.google.com. Launch bug: https://crbug.com/739418.

> --

> 2.15.1

>

> I just got a bug report for the build via:

>

> guix pull --url="https://c.n0.is/git/ng0/guix/guix.git" --branch="pretest/chromium"

> guix package --install chromium

>

> Failing with the attached build log excerpt. We are not FreeBSD, but I found

> this in the first 5 minutes: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=160935

> Maybe it helps to debug this, or maybe you've encountered this before.

>

> I myself have been able to build this without issues on two systems.

>

> All mentioned systems are GuixSD.

>

> This should be a blocker, but maybe a head-up in potential build issues.

> Marius Bakke transcribed 4.5K bytes:

> > ng0 <ng0@n0.is> writes:

> >

> > > Many thanks for your ongoing work with this (and the patience :))

> > > As this is 63, you you are keeping track of Debian, right? I tried

> > > to package 64 a couple of days ago because I wanted the workaround

> > > for some of the recent security clusterfucks, but Debian is still

> > > on 63 :/

> > > I hope they'll update their patchset soon.

> >

> > Indeed Google did not add the Spectre mitigation to Chromium 63, even

> > though the latest version was released after the fact.

> >

> > https://xlab.tencent.com/special/spectre/spectre_check.html

> >

> > For reasons that beat me, they only added it to the proprietary Chrome

> > browser, which follows the same version number as Chromium.

> >

> > The attached patch adds Spectre mitigation to the current Chromium

> > release. The patch was pulled from the Chrome 64 branch:

> >

>

> > From b011b57f357af97f3a003a3b1c481fc8bd2b869c Mon Sep 17 00:00:00 2001

> > From: Marius Bakke <mbakke@fastmail.com>

> > Date: Thu, 11 Jan 2018 14:36:47 +0100

> > Subject: [PATCH] gnu: chromium: Add spectre mitigation.

> >

> > * gnu/packages/patches/chromium-spectre-mitigation.patch: New file.

> > * gnu/local.mk (dist_patch_DATA): Register it.

> > * gnu/packages/chromium.scm (chromium)[source]: Use it.

> > ---

> > gnu/local.mk | 1 +

> > gnu/packages/chromium.scm | 3 ++-

> > gnu/packages/patches/chromium-spectre-mitigation.patch | 13 +++++++++++++

> > 3 files changed, 16 insertions(+), 1 deletion(-)

> > create mode 100644 gnu/packages/patches/chromium-spectre-mitigation.patch

> >

> > diff --git a/gnu/local.mk b/gnu/local.mk

> > index 513f64043..89dab227c 100644

> > --- a/gnu/local.mk

> > +++ b/gnu/local.mk

> > @@ -575,6 +575,7 @@ dist_patch_DATA = \

> > %D%/packages/patches/ceph-skip-collect-sys-info-test.patch \

> > %D%/packages/patches/ceph-skip-unittest_blockdev.patch \

> > %D%/packages/patches/chmlib-inttypes.patch \

> > + %D%/packages/patches/chromium-spectre-mitigation.patch \

> > %D%/packages/patches/clang-libc-search-path.patch \

> > %D%/packages/patches/clang-3.8-libc-search-path.patch \

> > %D%/packages/patches/clementine-use-openssl.patch \

> > diff --git a/gnu/packages/chromium.scm b/gnu/packages/chromium.scm

> > index dd040527b..1e9dba42e 100644

> > --- a/gnu/packages/chromium.scm

> > +++ b/gnu/packages/chromium.scm

> > @@ -240,7 +240,8 @@

> > %chromium-system-icu.patch

> > %chromium-system-nspr.patch

> > %chromium-system-libevent.patch

> > - %chromium-disable-api-keys-warning.patch))

> > + %chromium-disable-api-keys-warning.patch

> > + (search-patch "chromium-spectre-mitigation.patch")))

> > (modules '((srfi srfi-1)

> > (guix build utils)))

> > (snippet

> > diff --git a/gnu/packages/patches/chromium-spectre-mitigation.patch b/gnu/packages/patches/chromium-spectre-mitigation.patch

> > new file mode 100644

> > index 000000000..a44a3bce4

> > --- /dev/null

> > +++ b/gnu/packages/patches/chromium-spectre-mitigation.patch

> > @@ -0,0 +1,13 @@

> > +diff --git a/content/public/common/content_features.cc b/content/public/common/content_features.cc

> > +index 43feb76..33a49b8 100644

> > +--- a/content/public/common/content_features.cc

> > ++++ b/content/public/common/content_features.cc

> > +@@ -308,7 +308,7 @@

> > +

> > + // http://tc39.github.io/ecmascript_sharedmem/shmem.html

> > + const base::Feature kSharedArrayBuffer{"SharedArrayBuffer",

> > +- base::FEATURE_ENABLED_BY_DEFAULT};

> > ++ base::FEATURE_DISABLED_BY_DEFAULT};

> > +

> > + // An experiment to require process isolation for the sign-in origin,

> > + // https://accounts.google.com. Launch bug: https://crbug.com/739418.

> > --

> > 2.15.1

> >

>

>

>

>

> --

> ng0 :: https://ea.n0.is

> A88C8ADD129828D7EAC02E52E22F9BBFEE348588 :: https://ea.n0.is/keys/

> The attached patch adds Spectre mitigation to the current Chromium

> release. The patch was pulled from the Chrome 64 branch:

>

> From b011b57f357af97f3a003a3b1c481fc8bd2b869c Mon Sep 17 00:00:00 2001

> From: Marius Bakke <mbakke@fastmail.com>

> Date: Thu, 11 Jan 2018 14:36:47 +0100

> Subject: [PATCH] gnu: chromium: Add spectre mitigation.

>

> * gnu/packages/patches/chromium-spectre-mitigation.patch: New file.

> * gnu/local.mk (dist_patch_DATA): Register it.

> * gnu/packages/chromium.scm (chromium)[source]: Use it.

> Hi Marius,

>

> Marius Bakke <mbakke@fastmail.com> skribis:

>

>> The attached patch adds Spectre mitigation to the current Chromium

>> release. The patch was pulled from the Chrome 64 branch:

>>

>> From b011b57f357af97f3a003a3b1c481fc8bd2b869c Mon Sep 17 00:00:00 2001

>> From: Marius Bakke <mbakke@fastmail.com>

>> Date: Thu, 11 Jan 2018 14:36:47 +0100

>> Subject: [PATCH] gnu: chromium: Add spectre mitigation.

>>

>> * gnu/packages/patches/chromium-spectre-mitigation.patch: New file.

>> * gnu/local.mk (dist_patch_DATA): Register it.

>> * gnu/packages/chromium.scm (chromium)[source]: Use it.

>

> I didn’t really follow the whole discussion :-), but if what you have is

> now OK from the freedom and security viewpoints (including bundling),

> perhaps you can go ahead?

> Hi Marius,

>

> Marius Bakke <mbakke@fastmail.com> skribis:

>

> > The attached patch adds Spectre mitigation to the current Chromium

> > release. The patch was pulled from the Chrome 64 branch:

> >

> > From b011b57f357af97f3a003a3b1c481fc8bd2b869c Mon Sep 17 00:00:00 2001

> > From: Marius Bakke <mbakke@fastmail.com>

> > Date: Thu, 11 Jan 2018 14:36:47 +0100

> > Subject: [PATCH] gnu: chromium: Add spectre mitigation.

> >

> > * gnu/packages/patches/chromium-spectre-mitigation.patch: New file.

> > * gnu/local.mk (dist_patch_DATA): Register it.

> > * gnu/packages/chromium.scm (chromium)[source]: Use it.

>

> I didn’t really follow the whole discussion :-), but if what you have is

> now OK from the freedom and security viewpoints (including bundling),

> perhaps you can go ahead?

>

> Ludo’.

>

> Not sure what to put in the description. Can I hire Tobias for this? :P

> Marius!

>

> Marius Bakke wrote on 16/01/18 at 20:01:

>> Not sure what to put in the description. Can I hire Tobias for this? :P

>

> You probably don't want me writing what I think of Chromium.

> Tobias Geerinckx-Rice <me@tobias.gr> writes:

> > Marius Bakke wrote on 16/01/18 at 20:01:

> >> Not sure what to put in the description. Can I hire Tobias for this? :P

> >

> > You probably don't want me writing what I think of Chromium.

>

> LOL, fair enough.

>

> I tend to assume zero-knowledge when writing descriptions and have been

> playing on spins of "Chromium is a browser designed to spy on the user",

> but carrying software with that description does not reflect very well

> on us...besides, I've gone great lengths to remove those antifeatures.

>

> I'd like to make it very clear that users concerned about privacy should

> prefer GNU IceCat though... Suggestions welcome. :-)

> I believe this is pretty much ready. However Chromium 64 is due in one

> week, so I'll wait for that. Meanwhile I'll try to get rid of the

> default "most used" sites which links to the nonfree Web Store.

> Not sure what to put in the description. Can I hire Tobias for this? :P

>

> If there are no objections, expect to see this in 'master' in 1-2 weeks.

> If there are no objections, expect to see this in 'master' in 1-2 weeks.

> On Tue, Jan 16, 2018 at 20:01:34 +0100, Marius Bakke wrote:

>> If there are no objections, expect to see this in 'master' in 1-2 weeks.

>

> I want to express gratitude for your hard work on this---given that

> IceCat does not contain many of the FF devtool updates, Chromium is very

> desirable for web development. It's also needed for certain Node.js

> tools, like node-inspector.

>

> So, thank you!

> Mike Gerwitz <mtg@gnu.org> writes:

>

> > On Tue, Jan 16, 2018 at 20:01:34 +0100, Marius Bakke wrote:

> >> If there are no objections, expect to see this in 'master' in 1-2 weeks.

> >

> > I want to express gratitude for your hard work on this---given that

> > IceCat does not contain many of the FF devtool updates, Chromium is very

> > desirable for web development. It's also needed for certain Node.js

> > tools, like node-inspector.

> >

> > So, thank you!

>

> Thank *you* for the kind words! :-)

>

> Here is the latest iteration of this patch. New in this version:

>

> * Chromium 64 (duh).

> * The 'delete-bundled-software' phase has been moved to a snippet,

> shaving ~100MiB (~22%) off the compressed tarball size (and

> drastically reduces (de)compression time).

> * The New Tab page does not show any thumbnails for new profiles.

> I've also added more comments about the patches and other flags.

>

> Now, when launching the browser for the first time, it *still* connects

> to Google services. After a while it also does a lookup for AdWords...

> However subsequent launches are "silent" as long as the Web Store is

> disabled and "--disable-background-networking" is passed, like the

> wrapper script does.

>

> Incidentally, now that IceCat supports WebRTC (and somehow plugged the

> IP address leak[0]!), I no longer *need* this package. However, having

> multiple high quality browsers at hand is a huge advantage IMO, so I'd

> still like to have it in Guix.

>

> What do y'all think? Feedback on the snippet and description very

> welcome.

> [0] https://en.wikipedia.org/wiki/WebRTC#Concerns

> Marius Bakke transcribed 2.1K bytes:

>> Mike Gerwitz <mtg@gnu.org> writes:

>>

>> > On Tue, Jan 16, 2018 at 20:01:34 +0100, Marius Bakke wrote:

>> >> If there are no objections, expect to see this in 'master' in 1-2 weeks.

>> >

>> > I want to express gratitude for your hard work on this---given that

>> > IceCat does not contain many of the FF devtool updates, Chromium is very

>> > desirable for web development. It's also needed for certain Node.js

>> > tools, like node-inspector.

>> >

>> > So, thank you!

>>

>> Thank *you* for the kind words! :-)

>>

>> Here is the latest iteration of this patch. New in this version:

>>

>> * Chromium 64 (duh).

>> * The 'delete-bundled-software' phase has been moved to a snippet,

>> shaving ~100MiB (~22%) off the compressed tarball size (and

>> drastically reduces (de)compression time).

>> * The New Tab page does not show any thumbnails for new profiles.

>

> I think you forgot to attach the patches :)

> ng0 <ng0@n0.is> writes:

>

> > Marius Bakke transcribed 2.1K bytes:

> >> Mike Gerwitz <mtg@gnu.org> writes:

> >>

> >> > On Tue, Jan 16, 2018 at 20:01:34 +0100, Marius Bakke wrote:

> >> >> If there are no objections, expect to see this in 'master' in 1-2 weeks.

> >> >

> >> > I want to express gratitude for your hard work on this---given that

> >> > IceCat does not contain many of the FF devtool updates, Chromium is very

> >> > desirable for web development. It's also needed for certain Node.js

> >> > tools, like node-inspector.

> >> >

> >> > So, thank you!

> >>

> >> Thank *you* for the kind words! :-)

> >>

> >> Here is the latest iteration of this patch. New in this version:

> >>

> >> * Chromium 64 (duh).

> >> * The 'delete-bundled-software' phase has been moved to a snippet,

> >> shaving ~100MiB (~22%) off the compressed tarball size (and

> >> drastically reduces (de)compression time).

> >> * The New Tab page does not show any thumbnails for new profiles.

> >

> > I think you forgot to attach the patches :)

>

> Derp. I realized that and just used `git send-email`[0], but have

> attached it here for convenience since the debbugs web UI doesn't allow

> easy download of a raw message.

>

> [0] https://debbugs.gnu.org/cgi/bugreport.cgi?msg=131;bug=28004#131

>

> ng0 <ng0@n0.is> writes:

>

> > Marius Bakke transcribed 2.1K bytes:

> >> Mike Gerwitz <mtg@gnu.org> writes:

> >>

> >> > On Tue, Jan 16, 2018 at 20:01:34 +0100, Marius Bakke wrote:

> >> >> If there are no objections, expect to see this in 'master' in

> >> >> 1-2 weeks.

> >> >

> >> > I want to express gratitude for your hard work on this---given

> >> > that IceCat does not contain many of the FF devtool updates,

> >> > Chromium is very desirable for web development. It's also

> >> > needed for certain Node.js tools, like node-inspector.

> >> >

> >> > So, thank you!

> >>

> >> Thank *you* for the kind words! :-)

> >>

> >> Here is the latest iteration of this patch. New in this version:

> >>

> >> * Chromium 64 (duh).

> >> * The 'delete-bundled-software' phase has been moved to a snippet,

> >> shaving ~100MiB (~22%) off the compressed tarball size (and

> >> drastically reduces (de)compression time).

> >> * The New Tab page does not show any thumbnails for new profiles.

> >

> > I think you forgot to attach the patches :)

>

> Derp. I realized that and just used `git send-email`[0], but have

> attached it here for convenience since the debbugs web UI doesn't

> allow easy download of a raw message.

>

> [0] https://debbugs.gnu.org/cgi/bugreport.cgi?msg=131;bug=28004#131

>

> Now, when launching the browser for the first time, it *still* connects

> to Google services. After a while it also does a lookup for AdWords...

> Hi Marius,

>

> On Mon, 26 Feb 2018 21:06:57 +0100

> Marius Bakke <mbakke@fastmail.com> wrote:

>

> > ng0 <ng0@n0.is> writes:

> >

> > > Marius Bakke transcribed 2.1K bytes:

> > >> Mike Gerwitz <mtg@gnu.org> writes:

> > >>

> > >> > On Tue, Jan 16, 2018 at 20:01:34 +0100, Marius Bakke wrote:

> > >> >> If there are no objections, expect to see this in 'master' in

> > >> >> 1-2 weeks.

> > >> >

> > >> > I want to express gratitude for your hard work on this---given

> > >> > that IceCat does not contain many of the FF devtool updates,

> > >> > Chromium is very desirable for web development. It's also

> > >> > needed for certain Node.js tools, like node-inspector.

> > >> >

> > >> > So, thank you!

> > >>

> > >> Thank *you* for the kind words! :-)

> > >>

> > >> Here is the latest iteration of this patch. New in this version:

> > >>

> > >> * Chromium 64 (duh).

> > >> * The 'delete-bundled-software' phase has been moved to a snippet,

> > >> shaving ~100MiB (~22%) off the compressed tarball size (and

> > >> drastically reduces (de)compression time).

> > >> * The New Tab page does not show any thumbnails for new profiles.

> > >

> > > I think you forgot to attach the patches :)

> >

> > Derp. I realized that and just used `git send-email`[0], but have

> > attached it here for convenience since the debbugs web UI doesn't

> > allow easy download of a raw message.

> >

> > [0] https://debbugs.gnu.org/cgi/bugreport.cgi?msg=131;bug=28004#131

> >

>

>

> This looks like a lot of work. Thank you!

>

> I quickly tried to apply and build the patch and have two first remarks:

>

> The file says:

>

> ;;; Copyright © 2016, 2017, 2018 Marius Bakke <mbakke@fastmail.com>

>

> I haven't followed history, have you worked on this since 2016?

> One patch has a hash-mismatch:

>

> Starting download of /gnu/store/q8hlws48cjfcmz6i40jrnxn3kp750gy4-chromium-icu.patch

> From https://anonscm.debian.org/cgit/pkg-chromium/pkg-chromium.git/plain/debian/patches/system/icu.patch?id=debian/64.0.3282.119-2...

> icu.patch 2KiB 1.8MiB/s 00:00 [####################] 100.0%

> output path `/gnu/store/q8hlws48cjfcmz6i40jrnxn3kp750gy4-chromium-icu.patch' should have sha256 hash `0kf77d8lyma3w0xpgfv2k0c741zp6ii08gzllfja6d5s59c15ylv', instead has `19r0bpv2hapzq5m0m7rlz1dwn3h2ijgkilb2hmhw56qvwpbw0b59'

> @ build-failed /gnu/store/cqdllqn8ig5wnjn0yqvnh4vlzsvnpzv6-chromium-icu.patch.drv - 1 output path `/gnu/store/q8hlws48cjfcmz6i40jrnxn3kp750gy4-chromium-icu.patch' should have sha256 hash `0kf77d8lyma3w0xpgfv2k0c741zp6ii08gzllfja6d5s59c15ylv', instead has `19r0bpv2hapzq5m0m7rlz1dwn3h2ijgkilb2hmhw56qvwpbw0b59'

> cannot build derivation `/gnu/store/vacxbwsprcp52vp6q975450zi091dak2-chromium-64.0.3282.186.tar.xz.drv': 1 dependencies couldn't be built

> @ build-started /gnu/store/7q53inn1v32b5fain0h0wcrliclf0ff1-libvpx+experimental-1.7.0.drv - x86_64-linux /var/log/guix/drvs/7q//53inn1v32b5fain0h0wcrliclf0ff1-libvpx+experimental-1.7.0.drv.bz2

> cannot build derivation `/gnu/store/5qv7anaaqk4576pma9mhcsz1nhrx1n01-chromium-64.0.3282.186.drv': 1 dependencies couldn't be built

> guix build: error: build failed: build of `/gnu/store/5qv7anaaqk4576pma9mhcsz1nhrx1n01-chromium-64.0.3282.186.drv' failed

>

> I looked into the file and it looks reasonable, like a patch-file. It has no download errors.

>

> It starts like this:

>

> description: backwards compatibility for older versions of icu

> author: Michael Gilbert <mgilbert@debian.org>

>

> --- a/v8/src/runtime/runtime-intl.cc

> +++ b/v8/src/runtime/runtime-intl.cc

> @@ -627,7 +627,11 @@ RUNTIME_FUNCTION(Runtime_PluralRulesSele

>

> ...

>

> Can you check this file again?

> Björn

>

>

> On Mon, Feb 26, 2018 at 19:18:39 +0100, Marius Bakke wrote:

> > Now, when launching the browser for the first time, it *still* connects

> > to Google services. After a while it also does a lookup for AdWords...

>

> Do you know what code initiates this? Would it be easy to remove, and

> would that harm other functionality?

>

> Saying that it only runs the first time implies to me that there's a

> flag, and that perhaps the flag can either be permanently set or the

> conditional triggering this behavior removed.

>

> --

> Mike Gerwitz

> Free Software Hacker+Activist | GNU Maintainer & Volunteer

> GPG: D6E9 B930 028A 6C38 F43B 2388 FEF6 3574 5E6F 6D05

> https://mikegerwitz.com

> When we released a new stable version of Google Chrome last March, we tried to improve the transparency and privacy options of Google Chrome. One area where ve seen a lot of interest and questions is the RLZ library that is built into Google Chrome. RLZ gives us the ability to accurately measure the success of marketing promotions and distribution partnerships in order to meet our contractual and financial obligations. It assigns non-unique, non-personally identifiable promotion tracking labels to client products; these labels sometimes appear in Google search queries in Google Chrome.we

> Marius Bakke transcribed 43K bytes:

>> ng0 <ng0@n0.is> writes:

>>

>> > Marius Bakke transcribed 2.1K bytes:

>> >> Mike Gerwitz <mtg@gnu.org> writes:

>> >>

>> >> > On Tue, Jan 16, 2018 at 20:01:34 +0100, Marius Bakke wrote:

>> >> >> If there are no objections, expect to see this in 'master' in 1-2 weeks.

>> >> >

>> >> > I want to express gratitude for your hard work on this---given that

>> >> > IceCat does not contain many of the FF devtool updates, Chromium is very

>> >> > desirable for web development. It's also needed for certain Node.js

>> >> > tools, like node-inspector.

>> >> >

>> >> > So, thank you!

>> >>

>> >> Thank *you* for the kind words! :-)

>> >>

>> >> Here is the latest iteration of this patch. New in this version:

>> >>

>> >> * Chromium 64 (duh).

>> >> * The 'delete-bundled-software' phase has been moved to a snippet,

>> >> shaving ~100MiB (~22%) off the compressed tarball size (and

>> >> drastically reduces (de)compression time).

>> >> * The New Tab page does not show any thumbnails for new profiles.

>> >

>> > I think you forgot to attach the patches :)

>>

>> Derp. I realized that and just used `git send-email`[0], but have

>> attached it here for convenience since the debbugs web UI doesn't allow

>> easy download of a raw message.

>>

>> [0] https://debbugs.gnu.org/cgi/bugreport.cgi?msg=131;bug=28004#131

>>

>

> Comments inlined, some words ahead.

>

> I think it's good that we will be able to handle extensions via Guix.

> But: We should point it out that you won't be able to install extensions

> manually, via the store or as a file. People who betatested this got

> confused.

>> + (substitute* "chrome/common/chrome_paths.cc"

>> + (("/usr/share/chromium/extensions")

>> + ;; TODO: Add ~/.guix-profile.

>> + "/run/current-system/profile/share/chromium/extensions"))

>

> I don't know if I asked you about this in the past, but can you explain why you

> picked the run dir? I have to re-read the Gentoo eclass and Nix integration for this.

>> + (mkdir-p bin)

>> + ;; Add a thin wrapper to prevent the user from inadvertently

>> + ;; installing non-free software through the Web Store.

>> + ;; TODO: Discover extensions from the profile and pass

>> + ;; something like "--disable-extensions-except=...".

>

> To be able to work on this, can you (at least in this bug ticket,

> explain the TODO part a bit more?

> On Mon, Feb 26, 2018 at 19:18:39 +0100, Marius Bakke wrote:

>> Now, when launching the browser for the first time, it *still* connects

>> to Google services. After a while it also does a lookup for AdWords...

>

> Do you know what code initiates this? Would it be easy to remove, and

> would that harm other functionality?

> Saying that it only runs the first time implies to me that there's a

> flag, and that perhaps the flag can either be permanently set or the

> conditional triggering this behavior removed.

> Hi Marius,

>

> On Mon, 26 Feb 2018 21:06:57 +0100

> Marius Bakke <mbakke@fastmail.com> wrote:

>

>> ng0 <ng0@n0.is> writes:

>>

>> > Marius Bakke transcribed 2.1K bytes:

>> >> Mike Gerwitz <mtg@gnu.org> writes:

>> >>

>> >> > On Tue, Jan 16, 2018 at 20:01:34 +0100, Marius Bakke wrote:

>> >> >> If there are no objections, expect to see this in 'master' in

>> >> >> 1-2 weeks.

>> >> >

>> >> > I want to express gratitude for your hard work on this---given

>> >> > that IceCat does not contain many of the FF devtool updates,

>> >> > Chromium is very desirable for web development. It's also

>> >> > needed for certain Node.js tools, like node-inspector.

>> >> >

>> >> > So, thank you!

>> >>

>> >> Thank *you* for the kind words! :-)

>> >>

>> >> Here is the latest iteration of this patch. New in this version:

>> >>

>> >> * Chromium 64 (duh).

>> >> * The 'delete-bundled-software' phase has been moved to a snippet,

>> >> shaving ~100MiB (~22%) off the compressed tarball size (and

>> >> drastically reduces (de)compression time).

>> >> * The New Tab page does not show any thumbnails for new profiles.

>> >

>> > I think you forgot to attach the patches :)

>>

>> Derp. I realized that and just used `git send-email`[0], but have

>> attached it here for convenience since the debbugs web UI doesn't

>> allow easy download of a raw message.

>>

>> [0] https://debbugs.gnu.org/cgi/bugreport.cgi?msg=131;bug=28004#131

>>

>

>

> This looks like a lot of work. Thank you!

>

> I quickly tried to apply and build the patch and have two first remarks:

>

> The file says:

>

> ;;; Copyright © 2016, 2017, 2018 Marius Bakke <mbakke@fastmail.com>

>

> I haven't followed history, have you worked on this since 2016?

> One patch has a hash-mismatch:

>

> Starting download of /gnu/store/q8hlws48cjfcmz6i40jrnxn3kp750gy4-chromium-icu.patch

> From https://anonscm.debian.org/cgit/pkg-chromium/pkg-chromium.git/plain/debian/patches/system/icu.patch?id=debian/64.0.3282.119-2...

> icu.patch 2KiB 1.8MiB/s 00:00 [####################] 100.0%

> output path `/gnu/store/q8hlws48cjfcmz6i40jrnxn3kp750gy4-chromium-icu.patch' should have sha256 hash `0kf77d8lyma3w0xpgfv2k0c741zp6ii08gzllfja6d5s59c15ylv', instead has `19r0bpv2hapzq5m0m7rlz1dwn3h2ijgkilb2hmhw56qvwpbw0b59'

> @ build-failed /gnu/store/cqdllqn8ig5wnjn0yqvnh4vlzsvnpzv6-chromium-icu.patch.drv - 1 output path `/gnu/store/q8hlws48cjfcmz6i40jrnxn3kp750gy4-chromium-icu.patch' should have sha256 hash `0kf77d8lyma3w0xpgfv2k0c741zp6ii08gzllfja6d5s59c15ylv', instead has `19r0bpv2hapzq5m0m7rlz1dwn3h2ijgkilb2hmhw56qvwpbw0b59'

> cannot build derivation `/gnu/store/vacxbwsprcp52vp6q975450zi091dak2-chromium-64.0.3282.186.tar.xz.drv': 1 dependencies couldn't be built

> @ build-started /gnu/store/7q53inn1v32b5fain0h0wcrliclf0ff1-libvpx+experimental-1.7.0.drv - x86_64-linux /var/log/guix/drvs/7q//53inn1v32b5fain0h0wcrliclf0ff1-libvpx+experimental-1.7.0.drv.bz2

> cannot build derivation `/gnu/store/5qv7anaaqk4576pma9mhcsz1nhrx1n01-chromium-64.0.3282.186.drv': 1 dependencies couldn't be built

> guix build: error: build failed: build of `/gnu/store/5qv7anaaqk4576pma9mhcsz1nhrx1n01-chromium-64.0.3282.186.drv' failed

>

> I looked into the file and it looks reasonable, like a patch-file. It has no download errors.

>

> It starts like this:

>

> description: backwards compatibility for older versions of icu

> author: Michael Gilbert <mgilbert@debian.org>

>

> --- a/v8/src/runtime/runtime-intl.cc

> +++ b/v8/src/runtime/runtime-intl.cc

> @@ -627,7 +627,11 @@ RUNTIME_FUNCTION(Runtime_PluralRulesSele

>

> ...

>

> Can you check this file again?

> Björn Höfling <bjoern.hoefling@bjoernhoefling.de> writes:

> > One patch has a hash-mismatch:

> >

> > Starting download

> > of /gnu/store/q8hlws48cjfcmz6i40jrnxn3kp750gy4-chromium-icu.patch

> > From

> > https://anonscm.debian.org/cgit/pkg-chromium/pkg-chromium.git/plain/debian/patches/system/icu.patch?id=debian/64.0.3282.119-2...

> > icu.patch 2KiB 1.8MiB/s 00:00

> > [####################] 100.0% output path

> > `/gnu/store/q8hlws48cjfcmz6i40jrnxn3kp750gy4-chromium-icu.patch'

> > should have sha256 hash

> > `0kf77d8lyma3w0xpgfv2k0c741zp6ii08gzllfja6d5s59c15ylv', instead has

> > `19r0bpv2hapzq5m0m7rlz1dwn3h2ijgkilb2hmhw56qvwpbw0b59' @

>

> Whoops, indeed. I had an older patch in my store and apparently

> forgot to update the hash.

>

> The correct hash for %chromium-system-icu.patch is:

>

> 19r0bpv2hapzq5m0m7rlz1dwn3h2ijgkilb2hmhw56qvwpbw0b59

>

> Thanks for letting me know! I'll send an updated patch later, with

> some other minor improvements.

> Björn Höfling <bjoern.hoefling@bjoernhoefling.de> writes:

>

> > Hi Marius,

> >

> > On Mon, 26 Feb 2018 21:06:57 +0100

> > Marius Bakke <mbakke@fastmail.com> wrote:

> >

> >> ng0 <ng0@n0.is> writes:

> >>

> >> > Marius Bakke transcribed 2.1K bytes:

> >> >> Mike Gerwitz <mtg@gnu.org> writes:

> >> >>

> >> >> > On Tue, Jan 16, 2018 at 20:01:34 +0100, Marius Bakke wrote:

> >> >> >> If there are no objections, expect to see this in 'master' in

> >> >> >> 1-2 weeks.

> >> >> >

> >> >> > I want to express gratitude for your hard work on this---given

> >> >> > that IceCat does not contain many of the FF devtool updates,

> >> >> > Chromium is very desirable for web development. It's also

> >> >> > needed for certain Node.js tools, like node-inspector.

> >> >> >

> >> >> > So, thank you!

> >> >>

> >> >> Thank *you* for the kind words! :-)

> >> >>

> >> >> Here is the latest iteration of this patch. New in this version:

> >> >>

> >> >> * Chromium 64 (duh).

> >> >> * The 'delete-bundled-software' phase has been moved to a snippet,

> >> >> shaving ~100MiB (~22%) off the compressed tarball size (and

> >> >> drastically reduces (de)compression time).

> >> >> * The New Tab page does not show any thumbnails for new profiles.

> >> >

> >> > I think you forgot to attach the patches :)

> >>

> >> Derp. I realized that and just used `git send-email`[0], but have

> >> attached it here for convenience since the debbugs web UI doesn't

> >> allow easy download of a raw message.

> >>

> >> [0] https://debbugs.gnu.org/cgi/bugreport.cgi?msg=131;bug=28004#131

> >>

> >

> >

> > This looks like a lot of work. Thank you!

> >

> > I quickly tried to apply and build the patch and have two first remarks:

> >

> > The file says:

> >

> > ;;; Copyright © 2016, 2017, 2018 Marius Bakke <mbakke@fastmail.com>

> >

> > I haven't followed history, have you worked on this since 2016?

>

> Yeah, I started this shortly after going full-GuixSD in October 2016.

> But I didn't submit it until now because I didn't think it met Guix's

> standards (and still think it's questionable due to privacy concerns).

>

> > One patch has a hash-mismatch:

> >

> > Starting download of /gnu/store/q8hlws48cjfcmz6i40jrnxn3kp750gy4-chromium-icu.patch

> > From https://anonscm.debian.org/cgit/pkg-chromium/pkg-chromium.git/plain/debian/patches/system/icu.patch?id=debian/64.0.3282.119-2...

> > icu.patch 2KiB 1.8MiB/s 00:00 [####################] 100.0%

> > output path `/gnu/store/q8hlws48cjfcmz6i40jrnxn3kp750gy4-chromium-icu.patch' should have sha256 hash `0kf77d8lyma3w0xpgfv2k0c741zp6ii08gzllfja6d5s59c15ylv', instead has `19r0bpv2hapzq5m0m7rlz1dwn3h2ijgkilb2hmhw56qvwpbw0b59'

> > @ build-failed /gnu/store/cqdllqn8ig5wnjn0yqvnh4vlzsvnpzv6-chromium-icu.patch.drv - 1 output path `/gnu/store/q8hlws48cjfcmz6i40jrnxn3kp750gy4-chromium-icu.patch' should have sha256 hash `0kf77d8lyma3w0xpgfv2k0c741zp6ii08gzllfja6d5s59c15ylv', instead has `19r0bpv2hapzq5m0m7rlz1dwn3h2ijgkilb2hmhw56qvwpbw0b59'

> > cannot build derivation `/gnu/store/vacxbwsprcp52vp6q975450zi091dak2-chromium-64.0.3282.186.tar.xz.drv': 1 dependencies couldn't be built

> > @ build-started /gnu/store/7q53inn1v32b5fain0h0wcrliclf0ff1-libvpx+experimental-1.7.0.drv - x86_64-linux /var/log/guix/drvs/7q//53inn1v32b5fain0h0wcrliclf0ff1-libvpx+experimental-1.7.0.drv.bz2

> > cannot build derivation `/gnu/store/5qv7anaaqk4576pma9mhcsz1nhrx1n01-chromium-64.0.3282.186.drv': 1 dependencies couldn't be built

> > guix build: error: build failed: build of `/gnu/store/5qv7anaaqk4576pma9mhcsz1nhrx1n01-chromium-64.0.3282.186.drv' failed

> >

> > I looked into the file and it looks reasonable, like a patch-file. It has no download errors.

> >

> > It starts like this:

> >

> > description: backwards compatibility for older versions of icu

> > author: Michael Gilbert <mgilbert@debian.org>

> >

> > --- a/v8/src/runtime/runtime-intl.cc

> > +++ b/v8/src/runtime/runtime-intl.cc

> > @@ -627,7 +627,11 @@ RUNTIME_FUNCTION(Runtime_PluralRulesSele

> >

> > ...

> >

> > Can you check this file again?

>

> Whoops, indeed. I had an older patch in my store and apparently forgot

> to update the hash.

>

> The correct hash for %chromium-system-icu.patch is:

>

> 19r0bpv2hapzq5m0m7rlz1dwn3h2ijgkilb2hmhw56qvwpbw0b59

>

> Thanks for letting me know! I'll send an updated patch later, with some

> other minor improvements.

> I think we found it to be good enough to be included in master, or did I miss anything?

>

> Would be nice if I could drop my local patch (and building). The team around Taler seems

> to be interested in it as well as far as I can remember our chats in Leipzig.

> ng0 <ng0@n0.is> writes:

>

> > I think we found it to be good enough to be included in master, or did I miss anything?

> >

> > Would be nice if I could drop my local patch (and building). The team around Taler seems

> > to be interested in it as well as far as I can remember our chats in Leipzig.

>

> Reading up on GNU Taler, Chromium seems like a poor choice for an

> anonymous payment system. Why not GNU IceCat? I don't see Chromium

> becoming stable enough for guaranteed privacy any time soon. And a full

> fork would require a large maintenance team.

> Unfortunately I got busy after the latest update, and haven't had time

> to work on 65 yet. I will send an update once I get around to it, and

> also try some other Inox patches and see if they help with the "first

> launch" issue -- hopefully within a week or two.

> Reading up on GNU Taler, Chromium seems like a poor choice for an

> anonymous payment system. Why not GNU IceCat? I don't see Chromium

> becoming stable enough for guaranteed privacy any time soon. And a full

> fork would require a large maintenance team.

> > Reading up on GNU Taler, Chromium seems like a poor choice for an

> > anonymous payment system. Why not GNU IceCat? I don't see Chromium

> > becoming stable enough for guaranteed privacy any time soon. And a full

> > fork would require a large maintenance team.

>

> +1 (I agree with you).

> Guix!). As we are already offtopic: Want Cross-Browser support

> so that the Browser *extension* (Taler is not *a* Browser) runs

> in legacy old cruft Icecat base and newer Firefox (which shares

> extension format with Chrome?

> Good, there's something to work on in Taler if you want it.

>

> Again, I am not a Taler developer, reach out to them.

> Attached is a patch for Chromium 65.

> Hello! I'd like to speak up in favor of getting Chromium merged into

> Guix master. As a web developer, sometimes I have to test things

> against multiple browsers. Having Chromium in GuixSD would help me out

> a lot.

>

> It looks like a mountain of hard work has been put into this. Could we

> get it merged rather than have that work languish?

> The other remaining issue is that some data is sent to Google whenever

> you start the browser for the first time.

> I don't think that's a blocker

> The other remaining issue is that some data is sent to Google whenever

> you start the browser for the first time.

> I don't think that's a blocker

> some nonsense

> Marius!

>

> On 2018-04-24 20:08, Marius Bakke wrote:

>> The other remaining issue is that some data is sent to Google whenever

>> you start the browser for the first time.

>

> Sounds great! What data, exactly?

> The reason I don't think it's a blocking issue, is because Chromium is

> a massive project and I cannot guarantee that it will never "call

> home". So while I am intent on fixing the issue, especially since it's

> easy to test (chromium --user-data-dir=/tmp/foo), it's just one of many

> "call home" scenarios/antifeatures. And if you enable extensions or log

> in all bets are off. Even Inox, which goes great lengths to de-google

> it, admits that they can't guarantee privacy.

> Other scenarios include checking for IPv6 availability, testing for

> captive portal, etc. And I think it even falls back to Google DNS if

> the system resolver is unresponsive. :-(

> The reason I don't think it's a blocking issue, is because Chromium is

> a massive project and I cannot guarantee that it will never "call

> home". So while I am intent on fixing the issue, especially since it's

> easy to test (chromium --user-data-dir=/tmp/foo), it's just one of many

> "call home" scenarios/antifeatures. And if you enable extensions or log

> in all bets are off. Even Inox, which goes great lengths to de-google

> it, admits that they can't guarantee privacy.

> Christopher Lemmer Webber <cwebber@dustycloud.org> writes:

>

> > Hello! I'd like to speak up in favor of getting Chromium merged into

> > Guix master. As a web developer, sometimes I have to test things

> > against multiple browsers. Having Chromium in GuixSD would help me out

> > a lot.

> >

> > It looks like a mountain of hard work has been put into this. Could we

> > get it merged rather than have that work languish?

>

> Hello!

>

> I use this browser a lot, so it's hardly languishing.

>

> There was a recent discussion[0] about the Pale Moon browser, where it

> was pointed out that the FSDG[1] requires that any third-party

> repositories must be committed to only free software.

>

> [0] https://lists.gnu.org/archive/html/guix-devel/2018-03/msg00319.html

> [1] https://www.gnu.org/distros/free-system-distribution-guidelines.html#license-rules

>

> Unfortunately there are UI links to the Chrome "Web Store" still. It's

> not possible to install from it without setting the

> CHROMIUM_ENABLE_WEB_STORE variable, but I'm not sure if that is

> sufficient. It's unfortunate if an unsuspecting user stumbles into the

> Web Store and tries to install something (free or not) and only then

> finds out that it does not work.

>

> The other remaining issue is that some data is sent to Google whenever

> you start the browser for the first time. I don't think that's a

> blocker, but it's certainly something we should aim to fix.

>

> Attached are updates for 66. The first is an interdiff from the

> previous 65 patch; the other is the full "squashed" patch for

> convenience.

>

> New in this version:

>

> * The snippet will now error if a preserved directory is not present.

> * Chromium again requires a git revision of libvpx.

> * The "safe browsing" feature requires the nonfree "unrar" program(!!),

> as such it has been compiled out. Luckily "Inox" already had a patch

> to make the thing actually build with that flag disabled.

> * Cosmetic rearrangement of patches to follow Debian and Inox patch order.

>

> From a6ce5ebc121f129c3097f1f105b6a4de925b43e9 Mon Sep 17 00:00:00 2001

> From: Marius Bakke <mbakke@fastmail.com>

> Date: Tue, 17 Apr 2018 03:54:56 +0200

> Subject: [PATCH] Chromium 66 update.

> Marius Bakke transcribed 69K bytes:

> > Christopher Lemmer Webber <cwebber@dustycloud.org> writes:

> >

> > > Hello! I'd like to speak up in favor of getting Chromium merged into

> > > Guix master. As a web developer, sometimes I have to test things

> > > against multiple browsers. Having Chromium in GuixSD would help me out

> > > a lot.

> > >

> > > It looks like a mountain of hard work has been put into this. Could we

> > > get it merged rather than have that work languish?

> >

> > Hello!

> >

> > I use this browser a lot, so it's hardly languishing.

> >

> > There was a recent discussion[0] about the Pale Moon browser, where it

> > was pointed out that the FSDG[1] requires that any third-party

> > repositories must be committed to only free software.

> >

> > [0] https://lists.gnu.org/archive/html/guix-devel/2018-03/msg00319.html

> > [1] https://www.gnu.org/distros/free-system-distribution-guidelines.html#license-rules

> >

> > Unfortunately there are UI links to the Chrome "Web Store" still. It's

> > not possible to install from it without setting the

> > CHROMIUM_ENABLE_WEB_STORE variable, but I'm not sure if that is

> > sufficient. It's unfortunate if an unsuspecting user stumbles into the

> > Web Store and tries to install something (free or not) and only then

> > finds out that it does not work.

> >

> > The other remaining issue is that some data is sent to Google whenever

> > you start the browser for the first time. I don't think that's a

> > blocker, but it's certainly something we should aim to fix.

> >

> > Attached are updates for 66. The first is an interdiff from the

> > previous 65 patch; the other is the full "squashed" patch for

> > convenience.

> >

> > New in this version:

> >

> > * The snippet will now error if a preserved directory is not present.

> > * Chromium again requires a git revision of libvpx.

> > * The "safe browsing" feature requires the nonfree "unrar" program(!!),

> > as such it has been compiled out. Luckily "Inox" already had a patch

> > to make the thing actually build with that flag disabled.

> > * Cosmetic rearrangement of patches to follow Debian and Inox patch order.

> >

>

> > From a6ce5ebc121f129c3097f1f105b6a4de925b43e9 Mon Sep 17 00:00:00 2001

> > From: Marius Bakke <mbakke@fastmail.com>

> > Date: Tue, 17 Apr 2018 03:54:56 +0200

> > Subject: [PATCH] Chromium 66 update.

> >

>

> Good progress :)

>

> However, I'm a friend of bundling patches. Patches you have in a known location

> don't run away, like "addmissingblinktools":

>

> Starting download of /gnu/store/1djisy58jqjajbfcrd32vf7hrg9qvzwa-add-missing-blink-tools.patch

> From https://bazaar.launchpad.net/~chromium-team/chromium-browser/bionic-stable/download/head:/addmissingblinktools-20180416203514-02f50sz15c2mn6ei-1/add-missing-blink-tools.patch...

> download failed "https://bazaar.launchpad.net/~chromium-team/chromium-browser/bionic-stable/download/head:/addmissingblinktools-20180416203514-02f50sz15c2mn6ei-1/add-missing-blink-tools.patch" 404 "Not Found"

>

> Starting download of /gnu/store/1djisy58jqjajbfcrd32vf7hrg9qvzwa-add-missing-blink-tools.patch

> From http://mirror.hydra.gnu.org/file/add-missing-blink-tools.patch/sha256/1im2l1g6g9mangpfphbkg6zxyglbfwbkm5jxv122yxqgm6vxzz6s...

> download failed "http://mirror.hydra.gnu.org/file/add-missing-blink-tools.patch/sha256/1im2l1g6g9mangpfphbkg6zxyglbfwbkm5jxv122yxqgm6vxzz6s" 404 "Not Found"

>

> Starting download of /gnu/store/1djisy58jqjajbfcrd32vf7hrg9qvzwa-add-missing-blink-tools.patch

> From http://tarballs.nixos.org/sha256/1im2l1g6g9mangpfphbkg6zxyglbfwbkm5jxv122yxqgm6vxzz6s...

> download failed "http://tarballs.nixos.org/sha256/1im2l1g6g9mangpfphbkg6zxyglbfwbkm5jxv122yxqgm6vxzz6s" 404 "Not Found"

> failed to download "/gnu/store/1djisy58jqjajbfcrd32vf7hrg9qvzwa-add-missing-blink-tools.patch" from "https://bazaar.launchpad.net/~chromium-team/chromium-browser/bionic-stable/download/head:/addmissingblinktools-20180416203514-02f50sz15c2mn6ei-1/add-missing-blink-tools.patch"

> builder for `/gnu/store/5hbv5vgnla974qiw6kakc28a4k35h96n-add-missing-blink-tools.patch.drv' failed to produce output path `/gnu/store/1djisy58jqjajbfcrd32vf7hrg9qvzwa-add-missing-blink-tools.patch'

> cannot build derivation `/gnu/store/2z8i7b4l4l0p5b3pj4swdl2pvbdj5q24-chromium-66.0.3359.117.tar.xz.drv': 1 dependencies couldn't be built

> cannot build derivation `/gnu/store/4fxkp0aa1vr2b9fbl9kw8l8ijw0zrd25-chromium-66.0.3359.117.drv': 1 dependencies couldn't be built

> guix package: error: build failed: build of `/gnu/store/4fxkp0aa1vr2b9fbl9kw8l8ijw0zrd25-chromium-66.0.3359.117.drv' failed

>

>

>

> Marius Bakke transcribed 69K bytes:

>> Christopher Lemmer Webber <cwebber@dustycloud.org> writes:

>>

>> > Hello! I'd like to speak up in favor of getting Chromium merged into

>> > Guix master. As a web developer, sometimes I have to test things

>> > against multiple browsers. Having Chromium in GuixSD would help me out

>> > a lot.

>> >

>> > It looks like a mountain of hard work has been put into this. Could we

>> > get it merged rather than have that work languish?

>>

>> Hello!

>>

>> I use this browser a lot, so it's hardly languishing.

>>

>> There was a recent discussion[0] about the Pale Moon browser, where it

>> was pointed out that the FSDG[1] requires that any third-party

>> repositories must be committed to only free software.

>>

>> [0] https://lists.gnu.org/archive/html/guix-devel/2018-03/msg00319.html

>> [1] https://www.gnu.org/distros/free-system-distribution-guidelines.html#license-rules

>>

>> Unfortunately there are UI links to the Chrome "Web Store" still. It's

>> not possible to install from it without setting the

>> CHROMIUM_ENABLE_WEB_STORE variable, but I'm not sure if that is

>> sufficient. It's unfortunate if an unsuspecting user stumbles into the

>> Web Store and tries to install something (free or not) and only then

>> finds out that it does not work.

>>

>> The other remaining issue is that some data is sent to Google whenever

>> you start the browser for the first time. I don't think that's a

>> blocker, but it's certainly something we should aim to fix.

>>

>> Attached are updates for 66. The first is an interdiff from the

>> previous 65 patch; the other is the full "squashed" patch for

>> convenience.

>>

>> New in this version:

>>

>> * The snippet will now error if a preserved directory is not present.

>> * Chromium again requires a git revision of libvpx.

>> * The "safe browsing" feature requires the nonfree "unrar" program(!!),

>> as such it has been compiled out. Luckily "Inox" already had a patch

>> to make the thing actually build with that flag disabled.

>> * Cosmetic rearrangement of patches to follow Debian and Inox patch order.

>>

>

>> From a6ce5ebc121f129c3097f1f105b6a4de925b43e9 Mon Sep 17 00:00:00 2001

>> From: Marius Bakke <mbakke@fastmail.com>

>> Date: Tue, 17 Apr 2018 03:54:56 +0200

>> Subject: [PATCH] Chromium 66 update.

> >

>

> Good progress :)

>

> However, I'm a friend of bundling patches. Patches you have in a known location

> don't run away, like "addmissingblinktools":

>

> Starting download of /gnu/store/1djisy58jqjajbfcrd32vf7hrg9qvzwa-add-missing-blink-tools.patch

> From https://bazaar.launchpad.net/~chromium-team/chromium-browser/bionic-stable/download/head:/addmissingblinktools-20180416203514-02f50sz15c2mn6ei-1/add-missing-blink-tools.patch...

> download failed "https://bazaar.launchpad.net/~chromium-team/chromium-browser/bionic-stable/download/head:/addmissingblinktools-20180416203514-02f50sz15c2mn6ei-1/add-missing-blink-tools.patch" 404 "Not Found"

>

> Starting download of /gnu/store/1djisy58jqjajbfcrd32vf7hrg9qvzwa-add-missing-blink-tools.patch

> From http://mirror.hydra.gnu.org/file/add-missing-blink-tools.patch/sha256/1im2l1g6g9mangpfphbkg6zxyglbfwbkm5jxv122yxqgm6vxzz6s...

> download failed "http://mirror.hydra.gnu.org/file/add-missing-blink-tools.patch/sha256/1im2l1g6g9mangpfphbkg6zxyglbfwbkm5jxv122yxqgm6vxzz6s" 404 "Not Found"

>

> Starting download of /gnu/store/1djisy58jqjajbfcrd32vf7hrg9qvzwa-add-missing-blink-tools.patch

> From http://tarballs.nixos.org/sha256/1im2l1g6g9mangpfphbkg6zxyglbfwbkm5jxv122yxqgm6vxzz6s...

> download failed "http://tarballs.nixos.org/sha256/1im2l1g6g9mangpfphbkg6zxyglbfwbkm5jxv122yxqgm6vxzz6s" 404 "Not Found"

> failed to download "/gnu/store/1djisy58jqjajbfcrd32vf7hrg9qvzwa-add-missing-blink-tools.patch" from "https://bazaar.launchpad.net/~chromium-team/chromium-browser/bionic-stable/download/head:/addmissingblinktools-20180416203514-02f50sz15c2mn6ei-1/add-missing-blink-tools.patch"

> builder for `/gnu/store/5hbv5vgnla974qiw6kakc28a4k35h96n-add-missing-blink-tools.patch.drv' failed to produce output path `/gnu/store/1djisy58jqjajbfcrd32vf7hrg9qvzwa-add-missing-blink-tools.patch'

> cannot build derivation `/gnu/store/2z8i7b4l4l0p5b3pj4swdl2pvbdj5q24-chromium-66.0.3359.117.tar.xz.drv': 1 dependencies couldn't be built

> cannot build derivation `/gnu/store/4fxkp0aa1vr2b9fbl9kw8l8ijw0zrd25-chromium-66.0.3359.117.drv': 1 dependencies couldn't be built

> guix package: error: build failed: build of `/gnu/store/4fxkp0aa1vr2b9fbl9kw8l8ijw0zrd25-chromium-66.0.3359.117.drv' failed