Commit Graph

75 Commits

Author SHA1 Message Date
Nicolas Truessel
74fd4de956 chromium: 58.0.3029.110 -> 59.0.3071.86 2017-06-11 13:26:03 +02:00
Herwig Hochleitner
1fe7bd9ed6 chromium: softlink system nodejs into third_party
somehow, the build seems to have changed with chromium 58, to not auto
download the node binary. It is needed to generate webui files and we
can substitute our own.
2017-05-20 16:03:05 +02:00
Herwig Hochleitner
bafcf4226e chromium: add bootstrap gn patch 2017-05-20 16:03:01 +02:00
Nikolay Amiantov
748e7b287b chromium: update dev and beta
chromiumBeta: 56.0.2924.76 -> 57.0.2987.21
chromiumDev: 57.0.2987.19 -> 58.0.3000.4
2017-02-08 22:52:40 +03:00
Nikolay Amiantov
c5b07975d8 chromium.mkDerivation: update flags
* Remove libselinux flag: it's no longer supported;
* Use new gold flags.
2017-02-08 22:52:40 +03:00
Nikolay Amiantov
003fa8fed5 gn: remove
Chromium depends on bundled versioon of gn. It's also chromium-specific build
tool, so it's not feasible to package.
2017-02-08 22:52:40 +03:00
Nikolay Amiantov
b2eb9f4a96 chromium.mkDerivation: run {pre,post}Configure
This allows us to add custom steps.
2017-02-08 22:52:37 +03:00
Nikolay Amiantov
781022de46 chromium.mkDerivation: use ninja from nativeBuildInputs
Also move Python packages there.
2017-02-08 22:47:13 +03:00
Frederik Rietdijk
b28689f453 chromium: use python2 2016-11-24 22:28:04 +01:00
aszlig
6f8a72bbff
chromium: Add Gtk 3 for versions >= 56
Versions before 56 already had experimental support for Gtk 3 and since
version 56, Gtk 3 _seemed_ to become the default. Although it's now
requiring *both* Gtk 2 and Gtk3, so let's supply the dependency for now
to get it to build.

In the future however we might want to add use_gtk3 to the GN flags and
get rid of Gtk 2 completely.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-11-09 00:58:33 +01:00
aszlig
d2e60d1f93
chromium: Fix building with WineVine components
Before version 54, the WideVine CDM plugin was built unconditionally and
it seems since version 54 this now is dependent upon a GYP/GN flag on
whether to include the CDM shared library or not.

Also, we now use a patch from Gentoo which should hopefully get the CDM
plugin to work properly, at least according to their bugtracker:

https://bugs.gentoo.org/show_bug.cgi?id=547630

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-11-09 00:58:29 +01:00
aszlig
5f53fddf1e
chromium: Remove some libs from system depenencies
Seems that these libraries aren't the ones Chromium is expecting to be,
so let's switch to use the bundled version of these libraries instead.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-11-08 20:12:14 +01:00
aszlig
8391241e0c
chromium: Build with GN unconditionally
Previously I've added the extra file common-gn.nix in addition to
common.nix, so we can possibly have a smooth transition from current
stable to the new version 54.

Unfortunately, version 53 is already EOL and we have to move to version
54 as soon as possible so we can only use GN and thus it doesn't make
sense to provide expressions for GYP anymore.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-11-08 20:12:11 +01:00
aszlig
5f18ccb001
chromium: Remove flag for hiDPISupport
This should now be the upstream default and there also is no more flag
for GN to set it, so we'll no longer need it on our side as well.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-11-08 20:12:07 +01:00
aszlig
7a3a16dd80
chromium: Remove plugin paths patch for version 50
The oldest version we build is version 53, so we no longer need this
patch.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-11-08 20:11:56 +01:00
Frederik Rietdijk
f64b574e1d chromium: use python2
gyp still depends on python 2 although that might change soon
https://codereview.chromium.org/1454433002/
2016-10-22 16:47:21 +02:00
Kirill Boltaev
bccd75094f treewide: explicitly specify gtk and related package versions 2016-09-12 18:26:06 +03:00
Eelco Dolstra
78178d5854 systemd: Separate lib output
This moves libsystemd.so and libudev.so into systemd.lib, and gets rid
of libudev (which just contained a copy of libudev.so and the udev
headers). It thus reduces the closure size of all packages that
(indirectly) depend on libsystemd, of which there are quite a few (for
instance, PulseAudio and dbus). For example, it reduces the closure of
Blender from 430.8 to 400.8 MiB.
2016-09-05 19:17:14 +02:00
obadz
cd063d774e chromium: fix "Aw, snap!" after glibc 2.24 upgrade
See https://bugzilla.redhat.com/show_bug.cgi?id=1361157#c8
cc @domenkozar @aszlig
2016-08-23 11:56:11 +01:00
obadz
20f009d56d chromium: split the sandbox into a seperate output (take 2)
Fixup of 231ed9e
2016-08-06 14:42:13 +01:00
obadz
231ed9edd9 chromium: split the sandbox into a separate output
Related to #17460 and 66d5edf
Triggers a rebuild of Chromium
2016-08-06 10:29:56 +01:00
obadz
66d5edf654 chromium: add nixos module security.chromiumSuidSandbox
Closes #17460

Changed the wrapper derivation to produce a second output containing the sandbox.
Add a launch wrapper to try and locate the sandbox (either in /var/setuid-wrappers or in /nix/store).
This launch wrapper also sheds libredirect.so from LD_PRELOAD as Chromium does not tolerate it.

Does not trigger a Chromium rebuild.

cc @cleverca22 @joachifm @jasom
2016-08-06 10:27:47 +01:00
obadz
d6528a1b7f chromium: fixup commit 33557ac
Helps with #17460

@cleverca22 saw calls to SetuidSandboxHost::GetSandboxBinaryPath so we
patch this function instead.

cc @joachifm
2016-08-05 10:55:48 +01:00
obadz
33557acb36 chromium: add ability to control which sandbox is used
First step towards addressing #17460

In order to be able to run the SUID sandbox, which is good for security
and required to run Chromium with any kind of reasonable sandboxing when
using grsecurity kernels, we want to be able to control where the
sandbox comes from in the Chromium wrapper. This commit patches the
appropriate bit of source and adds the same old sandbox to the wrapper
(so it should be a no-op)
2016-08-04 20:37:35 +01:00
Scott R. Parish
1f1f0f049b chromium: Update to latest stable, beta, and dev channels
stable 51.0.2704.63 => 51.0.2704.103
beta   51.0.2704.63 => 52.0.2743.41
dev    52.0.2743.10 => 53.0.2767.4

This addresses 15 security fixes, including:

 * High   CVE-2015-1696: Cross-origin bypass in Extension bindings. Credit to
                         anonymous.
 * High   CVE-2015-1697: Cross-origin bypass in Blink. Credit to Mariusz
                         Mlynski.
 * Medium CVE-2016-1698: Information leak in Extension bindings. Credit to
                         Rob Wu.
 * Medium CVE-2016-1699: Parameter sanitization failure in DevTools. Credit
                         to Gregory Panakkal.
 * Medium CVE-2016-1700: Use-after-free in Extensions. Credit to Rob Wu.
 * Medium CVE-2016-1701: Use-after-free in Autofill. Credit to Rob Wu.
 * Medium CVE-2016-1702: Out-of-bounds read in Skia. Credit to cloudfuzzer.

See: http://googlechromereleases.blogspot.com/2016/06/stable-channel-update.html
2016-06-19 19:50:45 -07:00
aszlig
79d18eb604
chromium: Update dev channel to v52.0.2743.10
With this update we need to rebase the nix_plugin_paths patch, which was
done by @srp and I took it from his comment at:

https://github.com/NixOS/nixpkgs/pull/15762#issuecomment-222230677

Other than that, using libjpeg from nixpkgs fails to link:

https://headcounter.org/hydra/build/1114273

Rather than just using versionAtLeast to check for >= version 52, we're
matching on the explicit version number. That way we can make sure that
we (try to) build with system libjpeg again so we can keep it out of the
overall Chromium build time.

Built and tested using the VM tests on my Hydra at:

https://headcounter.org/hydra/eval/322006

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-05-28 19:15:39 +02:00
aszlig
c7a3645e7b
chromium: Remove stuff for versions <= v51
We're already on version 52, so there really is no need to keep all
those conditionals and old patches anymore.

Tested dropping the unconditional build_fixes_46.patch via the Chromium
VM tests.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-05-28 19:04:22 +02:00
Vladimír Čunát
d1df28f8e5 Merge 'staging' into closure-size
This is mainly to get the update of bootstrap tools.
Otherwise there were mysterious segfaults:
https://github.com/NixOS/nixpkgs/pull/7701#issuecomment-203389817
2016-04-07 14:40:51 +02:00
Vladimír Čunát
ab15a62c68 Merge branch 'master' into closure-size
Beware that stdenv doesn't build. It seems something more will be needed
than just resolution of merge conflicts.
2016-04-01 10:06:01 +02:00
aszlig
ef753d210e
chromium: Update all channels to latest versions
Overview of the updated versions:

stable: 49.0.2623.87 -> 49.0.2623.110
beta:   50.0.2661.26 -> 50.0.2661.49
dev:    50.0.2661.18 -> 51.0.2693.2

Most notably, this includes a series of urgent security fixes:

 * CVE-2016-1646: Out-of-bounds read in V8. Credit to Wen Xu from
                  Tencent KeenLab.
 * CVE-2016-1647: Use-after-free in Navigation. Credit to anonymous.
 * CVE-2016-1648: Use-after-free in Extensions. Credit to anonymous.
 * CVE-2016-1649: Buffer overflow in libANGLE. Credit to lokihardt
                  working with HP's Zero Day Initiative / Pwn2Own.
 * CVE-2016-1650: Denial of service in PageCaptureSaveAsMHTMLFunction

The official release announcement with details about these fixes can be
found here:

http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_24.html

Beta and stable could be also affected, although I didn't do a detailed
check whether that's the case.

As this introduces Chromium 51 as the dev version, I had to make the
following changes to make it build:

 * libexif got removed, so let's do that on our end as well.
   See https://codereview.chromium.org/1803883002 for details.
 * Chromium doesn't seem to compile with our version of libpng, so let's
   resort to the bundled libpng for now.
 * site_engagement_ui.cc uses isnan outside of std namespace, so
   we're fixing that in postPatch using sed.

I have successfully built all versions on i686-linux and x86_64-linux
and tested it using the VM tests.

Test reports can be found at the following evaluation of my Hydra:

https://headcounter.org/hydra/eval/314584

Thanks to @grahamc for reporting this.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Reported-by: Graham Christensen <graham@grahamc.com>
Fixes: #14299
2016-03-30 15:24:39 +02:00
aszlig
f9fff51c2a
chromium: Link using gold linker flags
I originally wanted to do this a long time (a31301d) but IIRC back then
it didn't compile. Nowadays with the splitup of the gold linking flags
and the binutils integration, it's merely just a switch to flip, so
let's do that.

Only tested it by building against the current Chromium stable version
on 64bit, because right now builds on Hydra seem to time out (because of
this?) anyway so we have nothing to lose here.

The linking time was hereby reduced from >30 minutes (I didn't measure
it exactly but looked half an hour later to the build progress and it
was *still* linking) to about a few seconds, which I guess is even
though the measurement is quite bogus a tremendous improvement
nonetheless.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-03-28 11:41:13 +02:00
aszlig
1f497204f7
chromium: Show status about precompiling .py files
Only a aesthetics thingy, but also corrects the comment, because we're
essentially precompiling .py files, NOT the .pyc files (the latter are
the results).

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-03-20 18:44:56 +01:00
aszlig
4f981b4f84
chromium: Move source/default.nix into common.nix
This addresses #12794 so that we now have only a single tarball where we
base our build on instead of splitting the source into different outputs
first and then reference the outputs.

The reason I did this in the first place is that we previously built the
sandbox as a different derivation and unpacking the whole source tree
just for building the sandbox was a bit too much.

As we now have namespaces sandbox built in by default we no longer have
that derivation anymore. It still might come up however if we want to
build NaCl as a separate derivation (see #8560), but splitting the
source code into things only NaCl might require is already too much work
and doesn't weight out the benefits.

Another issue with the source splitup is that Hydra now has an output
limit for non-fixed-output derivations which we're already hitting.

Tested the build against the stable channel and it went well, but I
haven't tested running the browser.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-03-20 17:50:17 +01:00
aszlig
985df3900d
chromium/common.nix: Remove unreferenced attrs
We're going to refactor things anyway, so let's first get rid of
everything that's not used anymore.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-03-20 17:01:58 +01:00
aszlig
f7e2171937
chromium/common: Shut up about precompiling .pyc's
The errors are completely non-fatal and only cause a particular file to
be not precompiled. Unfortunately this can lead to confusion to whether
these errors are real errors or not, so let's shut it up completely
because they're *not* real errors.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-03-13 12:22:18 +01:00
Vladimír Čunát
f9f6f41bff Merge branch 'master' into closure-size
TODO: there was more significant refactoring of qtbase and plasma 5.5
on master, and I'm deferring pointing to correct outputs to later.
2015-12-31 09:53:02 +01:00
Domen Kožar
6da327b433 Chromium updates 2015-12-29 19:32:38 +01:00
Luca Bruno
5b0352a6a4 Merge branch 'master' into closure-size 2015-12-11 18:31:00 +01:00
Ambroz Bizjak
b9093f1c64 chromium: Updates, fixes #11492
Built and run Beta and Stable locally. Dev is surrently superseded by Stable so
it doesn't matter much.

- Dev: 47.0.2508.0 -> 48.0.2564.22
- Beta: 46.0.2490.64 -> 48.0.2564.23
- Stable: 45.0.2454.101 -> 47.0.2526.73

Changed the SSL dependencies to the supported configuration on Linux (according
to Torne @Freenode/#chromium-support).

- NSS is a dependency since it is used to access the ceritiface store.
- Dropped system OpenSSL support, the bundled BoringSSL is used.

This probably fixes issue #10555. Note that without this adjustment the build
fails even.

Dropped uneeded old patches.
2015-12-07 14:52:15 +01:00
Vladimír Čunát
333d69a5f0 Merge staging into closure-size
The most complex problems were from dealing with switches reverted in
the meantime (gcc5, gmp6, ncurses6).
It's likely that darwin is (still) broken nontrivially.
2015-11-20 14:32:58 +01:00
obadz
d90040afd8 chromium: add enable_hangout_services_extension=true to fix screensharing bug
as suggested in: https://code.google.com/p/chromium/issues/detail?id=416856#c53
2015-10-07 20:39:22 +01:00
Vladimír Čunát
b44d846990 udev: complete rework
- systemd puts all into one output now (except for man),
  because I wasn't able to fix all systemd/udev refernces
  for NixOS to work well
- libudev is now by default *copied* into another path,
  which is what most packages will use as build input :-)
- pkgs.udev = [ libudev.out libudev.dev ]; because there are too many
  references that just put `udev` into build inputs (to rewrite them all),
  also this made "${udev}/foo" fail at *evaluation* time
  so it's easier to catch and change to something more specific
2015-10-04 10:03:53 +02:00
Vladimír Čunát
5227fb1dd5 Merge commit staging+systemd into closure-size
Many non-conflict problems weren't (fully) resolved in this commit yet.
2015-10-03 13:33:37 +02:00
aszlig
a80437e236
chromium: Remove out-of-tree sandbox derivation.
Since 0aad4b7, we no longer need to have an external sandbox binary,
because the upstream implementation of the user namespace sandbox no
longer needs an external sandbox binary.

In our implementation of the user namespace sandbox, we (ab)used the
setuid sandbox to run non-setuid and set up user namespaces instead.

Because our implementation is no longer needed, we can safely drop the
external binary entirely.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2015-07-04 02:31:44 +02:00
aszlig
7143f34970
chromium: Drop references to version 42 and below.
Since 7d217e3 the lowest version number is 43, so all those conditionals
are no longer needed.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2015-06-23 03:35:30 +02:00
aszlig
cadd675e7a
chromium: Disable "hotwording" by default.
There has been some recent news about that component extension on hacker
news:

https://news.ycombinator.com/item?id=9724409

Even though on our side it won't work, because we don't have NaCl
enabled by default or even working (I honestly haven't tested if it even
builds if enabled), we might get to the point where we can build with
NaCl enabled.

But until and even after that day, we want to have explicit control on
whether this extension is enabled.

Please also have a look at these two issues explaining the details
(about component extensions and the hotwording extension in particular):

https://crbug.com/491435
https://crbug.com/500922

Fixes issue #8358.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2015-06-23 03:35:30 +02:00
Ambroz Bizjak
58fd4f672f Chromium: Update and build fixes.
Changes included:
- Update versions.
- Use gyp package not gyp_svn1977.
- Remove icu from buildInputs, since this causes a build error due to inferference with use_system_icu=false.
- Remove the hack that inserts the absolute path into gyp files, and pass `--depth .` to gyp. This resolves the `third_party/angle` gyp error.
- Do a normal copy of the source code not a symlink copy. This resolves some link error where the symlinks interfere with relative paths (seems like because gyp resolves symlinks first). Note, this used to be worked around with the absolute path insertion hack.
- Change the bucketURL in update.nix to https (for more secure updates).
2015-06-11 18:23:58 +02:00
William A. Kennington III
b07929b0a3 Use libpulseaudio instead of pulseaudio 2015-05-29 14:32:56 -07:00
aszlig
b26de39252
gyp: Revive old SVN version to build Chromium.
Works around regression from a305e6855d.

We're also marking it lowPrio to make sure nobody will accidentally
reference it using nix-env -i.

Until we have fixed #7402, we're going to build with the old gyp version
to prevent being affected by https://crbug.com/462153.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2015-05-22 11:37:40 +02:00
Vladimír Čunát
b7c3c25218 fix ${udev} references (and a few others) 2015-05-05 11:52:08 +02:00