Commit Graph

398 Commits

Author SHA1 Message Date
aszlig
c3d82f0fbf
chromium/updater: Fix eval error on stdenv.is32bit
There is no stdenv.is32bit, so let's just use !stdenv.is64bit.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-03-05 03:16:26 +01:00
aszlig
8d5accb691
chromium/updater: Fix getting latest versions
Comparing the current version with the version in sources list and
accidentally swapping the version arguments isn't going to get very far
because every new version that will come up will then be treated as "we
already have that version".

So we're now using versionOlder and also a check whether the version is
the *same* as the one in sources.nix.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-03-05 02:55:00 +01:00
Luca Bruno
5f8311775c chromium: add StartupWMClass to desktop file. Fixes #12433 2016-02-29 20:42:58 +01:00
aszlig
54b4912566
chromium: Regenerate sources.nix with new updater
No changes in functionality, but to make future source updates a bit
easier on the eyes when viewing the diff.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-02-26 20:55:17 +01:00
aszlig
28b289efa6
chromium: Refactor updater entirely in Nix
The update.sh shell script now is only a call to nix-build, which does
all the hard work of updating the Chromium source channels and the
plugins. It results in a store path with the new sources.nix that
replaces the already existing sources.nix.

Along the way, this has led to a quite massive workaround, which abuses
MD5 collisions to detect whether an URL is existing, because something
like builtins.tryEval (builtins.fetchurl url) unfortunately doesn't
work. Further explanations and implementation details are documented in
the actual implementation.

The drawback of this is that we don't have nice status messages anymore,
but on the upside we have a more robust generation of the sources.nix
file, which now also should work properly on missing upstream
sources/binaries.

This also makes it much easier to implement fetching non-GNU/Linux
versions of Chromium and we have all values from omahaproxy available as
an attribute set (see the csv2nix and channels attributes in the update
attribute).

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-02-26 20:55:17 +01:00
aszlig
716b79d3a5
chromium: Provide SHA256s for beta/dev plugins
As stated in the parent commit, the 32bit Chrome package is not
available upstream, so let's at least provide the SHA256 hash for the
64bit package.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-02-26 10:55:51 +01:00
aszlig
459642b8de
chromium/updater: Allow a single plugin arch
Until now, if we have a failure to fetch either the 32bit Debian package
or the 64bit Debian package, neither of these will be put into
sources.nix.

Unfortunately the beta/dev channels do not have a 32bit Debian package,
so even though there is a 64bit Debian package available we don't get
plugins *at* *all*.

This also introduces a nicer error message rather than just failing with
an assertion in fetchurl because we did not provide url/urls.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-02-26 10:55:51 +01:00
Graham Christensen
712d59225e chromium{,Beta,Dev}: 48.0.2564.97 -> 48.0.2564.116
From the debian security mailing list:

Several vulnerabilities have been discovered in the chromium web browser.

CVE-2016-1622

    It was discovered that a maliciously crafted extension could bypass
    the Same Origin Policy.

CVE-2016-1623

    Mariusz Mlynski discovered a way to bypass the Same Origin Policy.

CVE-2016-1624

    lukezli discovered a buffer overflow issue in the Brotli library.

CVE-2016-1625

    Jann Horn discovered a way to cause the Chrome Instant feature to
    navigate to unintended destinations.

CVE-2016-1626

    An out-of-bounds read issue was discovered in the openjpeg library.

CVE-2016-1627

    It was discovered that the Developer Tools did not validate URLs.

CVE-2016-1628

    An out-of-bounds read issue was discovered in the pdfium library.

CVE-2016-1629

    A way to bypass the Same Origin Policy was discovered in Blink/WebKit,
    along with a way to escape the chromium sandbox.
2016-02-25 12:00:12 -06:00
Nathan Zadoks
2610986991 chromium/plugins: use jshon for extracting the Flash version from JSON 2016-02-19 12:31:08 +01:00
Cole Mickens
a5a5c1d9cd chromium/plugins: Fix widevine substitution
Fixes: #12840
Related to: 61042a5

61042a5 changes the replaced token from $something to @something@. This
commit repeats that change in one additional location used by the
WideVine plugin
2016-02-15 18:04:16 -08:00
Vladimír Čunát
d039c87984 Merge branch 'master' into closure-size 2016-02-14 08:33:51 +01:00
aszlig
61042a5b6a
chromium/plugins: Use @var@ for passing variables
There is already a pull request from @colemickens, who has just reversed
the variable references $flash and $flashVersion but the fix is kinda
fragile as he points out himself in #12713.

The reason the wrong substition was made is that both variables begin
with the same name and we do a simple replace instead of a more
complicated one using builtins.match.

So staying simple but to still not raising issues with other variables
that begin with the same name I'm now using @var@ instead, like we use
in substituteAll and other substituters (like the ones in CMake or
autotools) deal with it.

Note that I'm not using $var$ here to make sure it doesn't get confused
with real shell variables.

So with this fix in place, the wrapper now has the following flags:

  --ppapi-flash-path=/nix/store/.../lib/libpepflashplayer.so
  --ppapi-flash-version=20.0.0.294

Previously we had (#12710):

  --ppapi-flash-path=/nix/store/.../lib/libpepflashplayer.so
  --ppapi-flash-version=/nix/store/...-binary-plugins-flashVersion

Thanks to @colemickens for reporting and putting up a pull request.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Fixes: #12710
Fixes: #12713
2016-02-02 17:39:08 +01:00
aszlig
ff90f52375
chromium: Remove import-from-derivation again
This reverts commit f7af2272a2.

We're going to fix #12710 properly by reintroducing 38c77bb and fixing
the shell variable substitution.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-02-02 17:39:08 +01:00
Tony White
8491d0d1ca chromium: 47.0.2526.106 - > 48.0.2564.97
- Fixes CVE-2016-1612 CVE-2016-1613 CVE-2016-1614 CVE-2016-1615
  CVE-2016-1616 CVE-2016-1617 CVE-2016-1618 CVE-2016-1619 CVE-2016-1620.
- Moves chromium stable and beta channels up one version major.
  vcunat made dev channel stay for now, as it wouldn't download otherwise.
  This is most of PR #12717.
2016-02-01 12:12:07 +01:00
Vladimír Čunát
f7af2272a2 Revert "chromium: Do not rely on import-from-derivation"
This reverts commit 38c77bb72c.
In this form it causes problems #12710.
2016-01-31 10:03:57 +01:00
Vladimír Čunát
716aac2519 Merge branch 'staging' into closure-size 2016-01-19 09:55:31 +01:00
aszlig
85dd89f6eb
chromium: Remove myself from maintainers
Working on Chromium really drives me nuts due to its build time, also I
really don't have quite a lot of time these days to properly maintain it
anymore.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-01-18 03:35:28 +01:00
aszlig
38c77bb72c
chromium: Do not rely on import-from-derivation
This has been introduced by me in 690a845 and discovered by @vcunat in
his comment over at:

690a845de9 (commitcomment-14209868)

It's really a bit ugly to have builds running during evaluation, but
back when I made that commit the reason was to avoid having to shell
quote the hell out of it (see the comment in mkPluginInfo for the
reason).

Now we propagate plugin flags and environment variables as a list of
arguments in a plain file that's appended verbatim to makeWrapper, so
it shouldn't do any builds anymore during instantiation.

I have tested this with both just WideVine and just Flash enabled as
well as both in combination and none of the plugins and the output seems
correct. However I didn't test to run Chromium with the new
implementation.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Reported-by: Vladimír Čunát <vcunat@gmail.com>
2016-01-18 03:35:28 +01:00
Vladimír Čunát
f9f6f41bff Merge branch 'master' into closure-size
TODO: there was more significant refactoring of qtbase and plasma 5.5
on master, and I'm deferring pointing to correct outputs to later.
2015-12-31 09:53:02 +01:00
Domen Kožar
6da327b433 Chromium updates 2015-12-29 19:32:38 +01:00
Ambroz Bizjak
03cf5e6627 chromium: Updates.
- dev: 48.0.2564.22 -> 49.0.2587.3
- beta: 48.0.2564.23 -> 48.0.2564.41
- stable: 47.0.2526.73 -> 47.0.2526.80
2015-12-13 17:00:13 +01:00
Luca Bruno
5b0352a6a4 Merge branch 'master' into closure-size 2015-12-11 18:31:00 +01:00
Ambroz Bizjak
b9093f1c64 chromium: Updates, fixes #11492
Built and run Beta and Stable locally. Dev is surrently superseded by Stable so
it doesn't matter much.

- Dev: 47.0.2508.0 -> 48.0.2564.22
- Beta: 46.0.2490.64 -> 48.0.2564.23
- Stable: 45.0.2454.101 -> 47.0.2526.73

Changed the SSL dependencies to the supported configuration on Linux (according
to Torne @Freenode/#chromium-support).

- NSS is a dependency since it is used to access the ceritiface store.
- Dropped system OpenSSL support, the bundled BoringSSL is used.

This probably fixes issue #10555. Note that without this adjustment the build
fails even.

Dropped uneeded old patches.
2015-12-07 14:52:15 +01:00
Vladimír Čunát
333d69a5f0 Merge staging into closure-size
The most complex problems were from dealing with switches reverted in
the meantime (gcc5, gmp6, ncurses6).
It's likely that darwin is (still) broken nontrivially.
2015-11-20 14:32:58 +01:00
Domen Kožar
5c37ce8aa7 Merge pull request #10562 from obadz/chromium-srtp-crash-fix
Revert "chromium: 45.0.2454.101 -> 46.0.2490.71"
2015-10-29 10:54:26 +01:00
Brian McKenna
492ccdd52d chromium: include WideVine patch to get NetFlix
Close #10444, fixes #8749.
For some reason it's more involved than just setting gyp configuration,
we also have to set some definitions in widevine_cdm_version.h according
to the comments left in the file. Arch Linux does this already and so we
should probably just use the patch they created while getting Netflix to
work:

https://code.google.com/p/chromium/issues/detail?id=429452#c16
2015-10-29 07:30:04 +01:00
Cillian de Róiste
063c27ec77 chromium: remove myself from the maintainers list 2015-10-24 13:11:02 +02:00
obadz
2b7c156079 Revert "chromium: 45.0.2454.101 -> 46.0.2490.71"
This reverts commit 0ad0fbdf8a.

This upgrade causes "Aw, Snap" crashes on websites that use srtp
such as Google Hangouts.

Details: https://github.com/NixOS/nixpkgs/issues/10555
2015-10-23 17:01:37 +01:00
Domen Kožar
b7088df010 Merge pull request #10277 from obadz/chromium-screensharing-bugfix
chromium: add enable_hangout_services_extension=true
2015-10-21 21:14:56 +02:00
William A. Kennington III
0ad0fbdf8a chromium: 45.0.2454.101 -> 46.0.2490.71 2015-10-15 13:13:56 -07:00
William A. Kennington III
fc69fadfe4 chromiumBeta: 46.0.2490.52 -> 46.0.2490.64 2015-10-15 13:13:55 -07:00
obadz
d90040afd8 chromium: add enable_hangout_services_extension=true to fix screensharing bug
as suggested in: https://code.google.com/p/chromium/issues/detail?id=416856#c53
2015-10-07 20:39:22 +01:00
Vladimír Čunát
b44d846990 udev: complete rework
- systemd puts all into one output now (except for man),
  because I wasn't able to fix all systemd/udev refernces
  for NixOS to work well
- libudev is now by default *copied* into another path,
  which is what most packages will use as build input :-)
- pkgs.udev = [ libudev.out libudev.dev ]; because there are too many
  references that just put `udev` into build inputs (to rewrite them all),
  also this made "${udev}/foo" fail at *evaluation* time
  so it's easier to catch and change to something more specific
2015-10-04 10:03:53 +02:00
William A. Kennington III
759c86c817 chromiumBeta: 46.0.2490.42 -> 46.0.2490.52 2015-10-03 22:22:21 -07:00
Vladimír Čunát
5227fb1dd5 Merge commit staging+systemd into closure-size
Many non-conflict problems weren't (fully) resolved in this commit yet.
2015-10-03 13:33:37 +02:00
William A. Kennington III
383377437e chromium: Updates
Built and run locally

  - Beta: 46.0.2490.33 -> 46.0.2490.42
  - Stable: 45.0.2454.99 -> 45.0.2454.101
2015-09-30 13:22:38 -07:00
Eelco Dolstra
4b664cb922 chromium-dev: Revert to 47.0.2508.0
47.0.2516.0 doesn't build.

http://hydra.nixos.org/build/26422610
http://hydra.nixos.org/build/26422600
2015-09-28 15:40:13 +02:00
William A. Kennington III
abb4088c6c chromium: Updates
- stable: 45.0.2454.93 -> 45.0.2454.99
  - dev:    47.0.2508.0  -> 47.0.2516.0
2015-09-23 12:30:00 -07:00
Domen Kožar
94e3e1195e chromium: remove preferLocalBuild
It's another attempt to fix chromium builds.

See http://hydra.nixos.org/build/26086977/nixlog/4/raw

Unpacking sources is actually taking more than 2h so build fails.
Instead, rather build it remotely and then copy over the output as
we don't have limits for download time.

See 089bdce621 for reference

cc @aszlig

(cherry picked from commit cef54e7d67)
Signed-off-by: Domen Kožar <domen@dev.si>
2015-09-20 11:16:42 +02:00
William A. Kennington III
fda452c56c chromium: Updates
- dev: 47.0.2503.0 -> 47.0.2508.0
  - beta: 46.0.2490.22 -> 46.0.2490.33
  - stable: 45.0.2454.85 -> 45.0.2454.93
2015-09-17 15:51:32 -07:00
William A. Kennington III
27f0664960 chromiumBeta: Update 2015-09-13 20:23:21 -07:00
William A. Kennington III
71ec4dbd45 chromium: Dev / Beta Updates 2015-09-08 15:19:48 -07:00
William A. Kennington III
b55a4df70f chromium: Updates
This bumps the stable and dev track forward a version
2015-09-01 21:22:34 -07:00
William A. Kennington III
8712a2d8d1 chromium: Updates 2015-08-21 11:05:11 -07:00
aszlig
e4c2f97a27
Merge pull request #9269 from @jraygauthier.
Although I couldn't test this because I'm not using a DE, nobody else
than the one submitting the pull request has commented on this. So if it
should break the icon for other people, nobody would probably start an
assassination because of this and the commit can be easily reverted if
it should break the icon.
2015-08-20 13:02:55 +02:00
Raymond Gauthier
cff84b2a71 chromium: improvement.
Fixed `*.desktop` refering to nix store for its icon.
2015-08-15 18:32:30 -04:00
William A. Kennington III
4ed131efb3 chromiumBeta: 45.0.2454.26 -> 45.0.2454.37 2015-08-14 13:46:37 -07:00
William A. Kennington III
6a3b25dbd3 chromium: Updates 2015-08-11 16:08:34 -07:00
aszlig
471cdd15e2
chromium: Update beta and dev channels.
Overview of the updated versions:

beta: 45.0.2454.15 -> 45.0.2454.26
dev:  45.0.2454.15 -> 46.0.2471.2

Changes for getting beta and dev channel to build:

 * The reference for chrome::FILE_FLASH_PLUGIN doesn't exist anymore in
   version 46, because it has been dropped upstream, see the following
   review URL:

   https://codereview.chromium.org/1255943002

   We set the PPAPI Flash path using a command line flag anyway, so it
   doesn't hurt us if we don't patch that path (which was an old
   artifact from the NSAPI->PPAPI conversion anyway).

Changes for the dev channel only:

 * It seems that in the SCM, chrome/test/data/webui/ contains a lot of
   files, however they are missing in the tarball.

   This has been reported upstream at: https://crbug.com/515917

   Our fix is to just not include webui/i18n_process_css_test.html at
   all, to avoid the configure (gyp) phase to fail, because we're not
   building tests anyway.

All channels built and tested by my Hydra instance at:

https://headcounter.org/hydra/eval/218978

Test reports:

x86:    https://headcounter.org/hydra/build/723341/download/1/log.html
x86_64: https://headcounter.org/hydra/build/723342/download/1/log.html

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2015-08-11 12:17:38 +02:00
William A. Kennington III
5c6aa391fc chromium: Cleanup old patch and update stable 2015-08-05 19:27:29 -07:00
William A. Kennington III
370add9d80 chromium: update.sh Shouldn't use cached hashes as they often change upstream for the same version 2015-08-05 19:25:56 -07:00
Benjamin Staffin
501f667958 chromium: fix opening URLs from associated mime types
It helps to actually pass the URL to chromium :)

Related to #4370
2015-08-04 14:39:17 -07:00
Benjamin Staffin
f098967293 chromium: Fix widevine ppapi plugin loading
See "Running a plugin in Chrome" section at:
https://www.chromium.org/developers/design-documents/pepper-plugin-implementation

The colon between the plugin's description and its mime type is indeed
supposed to be a semicolon, according to that design doc.
2015-08-03 20:37:35 -07:00
William A. Kennington III
85134cc386 chromium: Updates 2015-07-30 12:12:08 -07:00
aszlig
8d34b4a46a
chromium: Add another mirror for Chrome deb.
The only mirror left which still has the .deb for 44.0.2403.89 is
http://mirror.pcbeta.com/, but that one doesn't seem to be reachable
from certain contries.

And according to @CestDiego, it doesn't seem to be reachable from within
the US.

Closes #9021, thanks to @CestDiego for reporting.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Reported-by: Diego Berrocal <cestdiego@gmail.com>
Tested-by: Diego Berrocal <cestdiego@gmail.com>
2015-07-30 19:57:38 +02:00
William A. Kennington III
6cb708c3b3 chromium: Bump 2015-07-26 12:38:34 -07:00
William A. Kennington III
551a26dad1 chromium: Update stable 43 -> 44 2015-07-21 21:59:28 -07:00
William A. Kennington III
35f8386e78 chromium-dev: Update 2015-07-20 18:08:29 -07:00
William A. Kennington III
ec5f94fbcc chromium: Minor updates
Notably a version bump for
 Flash Player to 18.0.0.209-r1
2015-07-15 17:55:11 -07:00
aszlig
bc5ce1f1b0
chromium: Update stable and beta channels.
Overview of the updated versions:

stable: 43.0.2357.125 -> 43.0.2357.130
beta:   44.0.2403.52  -> 44.0.2403.61

For the beta channel the following changes were necessary:

 * Drop all patches which were added in c290595 because they apply to
   44.0.2403.52 only. The shipped version of Blink was older than the
   one used for Chromium itself and thus contained just the
   cherry-picked patches from upstream Blink.

 * The ffmpegsumo library is now statically linked the same way as in
   the dev version, so let's not try to put it into the output store
   path.

All channels were built successfully on my Hydra at:

https://headcounter.org/hydra/eval/187176

VM tests did also pass and can be found at:

x86:    https://headcounter.org/hydra/build/707636
x86_64: https://headcounter.org/hydra/build/707637

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2015-07-04 02:31:45 +02:00
aszlig
7e6d6e034d
chromium: Disable setuid sandbox without errors.
Just silencing the error will not prevent Chromium from trying to start
up the SUID sandbox anyway, thus flooding stderr with:

LaunchProcess: failed to execvp:

After digging a bit in the source code I found out that the SUID sandbox
binary is indeed used, but only for setting oom_score_adj within the
user namespace (as "root"). So let's build the sandbox binary and of
course don't set setuid bit.

These annoying error messages were originally introduced by 0aad4b7 and
I'm deeply sorry for annoying you guys out there with them.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2015-07-04 02:31:45 +02:00
aszlig
a80437e236
chromium: Remove out-of-tree sandbox derivation.
Since 0aad4b7, we no longer need to have an external sandbox binary,
because the upstream implementation of the user namespace sandbox no
longer needs an external sandbox binary.

In our implementation of the user namespace sandbox, we (ab)used the
setuid sandbox to run non-setuid and set up user namespaces instead.

Because our implementation is no longer needed, we can safely drop the
external binary entirely.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2015-07-04 02:31:44 +02:00
aszlig
97ddd04ca9
chromium: Remove obsolete sandbox_userns_36.patch.
The file is no longer referenced since 6a8afa4 and thus can be safely
dropped.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2015-07-04 02:31:44 +02:00
aszlig
7143f34970
chromium: Drop references to version 42 and below.
Since 7d217e3 the lowest version number is 43, so all those conditionals
are no longer needed.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2015-06-23 03:35:30 +02:00
aszlig
cadd675e7a
chromium: Disable "hotwording" by default.
There has been some recent news about that component extension on hacker
news:

https://news.ycombinator.com/item?id=9724409

Even though on our side it won't work, because we don't have NaCl
enabled by default or even working (I honestly haven't tested if it even
builds if enabled), we might get to the point where we can build with
NaCl enabled.

But until and even after that day, we want to have explicit control on
whether this extension is enabled.

Please also have a look at these two issues explaining the details
(about component extensions and the hotwording extension in particular):

https://crbug.com/491435
https://crbug.com/500922

Fixes issue #8358.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2015-06-23 03:35:30 +02:00
aszlig
c290595e5b
chromium: Update all channels to latest versions.
Overview of the updated versions:

stable: 43.0.2357.124 -> 43.0.2357.125
beta:   44.0.2403.39  -> 44.0.2403.52  [1]
dev:    45.0.2421.0   -> 45.0.2431.0   [2]

[1] Beta channel fixes:

    I had to fetch a patch from a newer revision of Blink (r195908), see
    https://codereview.chromium.org/1157943002/ for more information
    about the patch.

    Here is the failing build log:

    https://headcounter.org/hydra/build/704037/nixlog/2

    Another fix for Blink, was needed in order to get it to build,
    see: https://codereview.chromium.org/1156113007/

    Also I needed to revert https://codereview.chromium.org/1150543002/
    using another patch, because the build won't succeed and bail out
    with WEBRTC_VIDEO_CODEC_FALLBACK_SOFTWARE not being found (it's only
    used once in the source, but isn't defined anywhere). Here are the
    trybot results:

    https://chromium-cq-status.appspot.com/patch-status/1150543002/20001

[2] Dev channel fixes:

    The "ffmpegsumo" shared library is now no longer built, because it
    is now statically linked against Chromium, for details see:

    https://codereview.chromium.org/1141703002

All channels built and tested on my Hydra at:

https://headcounter.org/hydra/eval/178458

Test reports:

x86:    https://headcounter.org/hydra/build/704908/download/1/log.html
x86_64: https://headcounter.org/hydra/build/704914/download/1/log.html

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2015-06-23 03:35:30 +02:00
aszlig
af54ddf8b6
chromium: Drop plugin_paths patch for old versions.
The patch was for versions prior to version 22, so we no longer need it.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2015-06-11 19:54:11 +02:00
aszlig
6a8afa4bb3
chromium: Fix plugin_paths patch for version 44.
The pepper effects plugin has been removed and migrated to NaCl, so I'm
just dropping the hunk of that patch.

Upstream reviow URL: https://codereview.chromium.org/1085393003

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2015-06-11 19:54:11 +02:00
Ambroz Bizjak
58fd4f672f Chromium: Update and build fixes.
Changes included:
- Update versions.
- Use gyp package not gyp_svn1977.
- Remove icu from buildInputs, since this causes a build error due to inferference with use_system_icu=false.
- Remove the hack that inserts the absolute path into gyp files, and pass `--depth .` to gyp. This resolves the `third_party/angle` gyp error.
- Do a normal copy of the source code not a symlink copy. This resolves some link error where the symlinks interfere with relative paths (seems like because gyp resolves symlinks first). Note, this used to be worked around with the absolute path insertion hack.
- Change the bucketURL in update.nix to https (for more secure updates).
2015-06-11 18:23:58 +02:00
William A. Kennington III
b07929b0a3 Use libpulseaudio instead of pulseaudio 2015-05-29 14:32:56 -07:00
aszlig
b26de39252
gyp: Revive old SVN version to build Chromium.
Works around regression from a305e6855d.

We're also marking it lowPrio to make sure nobody will accidentally
reference it using nix-env -i.

Until we have fixed #7402, we're going to build with the old gyp version
to prevent being affected by https://crbug.com/462153.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2015-05-22 11:37:40 +02:00
Vladimír Čunát
b7c3c25218 fix ${udev} references (and a few others) 2015-05-05 11:52:08 +02:00
aszlig
310da1b4da
chromium/update: Remove reference to <nixpkgs>.
We shouldn't make assumptions on what is set by NIX_PATH in order to
make it easier to rename that Nix path reference.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2015-04-29 08:22:48 +02:00
aszlig
fce7113345
chromium: Add missing dependency on libcap.
After the pulseaudio refactor in NixOS/nixpkgs@a2a3508, libcap is no
longer propagated to chromium anymore. And we need to have libcap for
the renderer sandbox.

Build log: https://hydra.nixos.org/build/21689759/nixlog/1/raw

What makes me wonder is that given that this was propagated by
pulseaudio noone either seemed to have disabled pulseaudio support for
Chromium or just didn't report the build failure.

Half-assed testing done against all channels, because it builds the
sandbox and we can't break an already broken build twice (or maybe we
can, who knows...).

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2015-04-27 07:24:11 +02:00
William A. Kennington III
a5ae04f179 chromium: Update
Tested that chromium, chromiumBeta, chromiumDev all build
2015-03-12 12:32:32 -07:00
aszlig
089bdce621
Re-re-revert "chromium: remove preferLocalBuild".
This reverts commit 0696b0ef78.

Okay, now finally, let's get this straight. We actually *want*
preferLocalBuild, *because* we have improved the source splitup in
c92dbffeac.

The idea is to use local builds in order to prevent the source being
pushed to a remote machine, splitted up there (and thus copied again)
and then being copied *again* FROM the remote machine.

"DOH!" - as @edolstra or @rbvermaa would call it... and good d^Hnight.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2015-02-22 08:31:25 +01:00
aszlig
0696b0ef78
Re-revert "chromium: remove preferLocalBuild".
This reverts commit 26f024626c.

I actually wasn't reading the "remove" in the commit message, so sorry
for the brainfart/noise.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2015-02-22 08:07:23 +01:00
aszlig
26f024626c
Revert "chromium: remove preferLocalBuild"
This reverts commit fdb5cf8107.

The reason I'm reverting this is that the implications this had on the
IO load of Hydra are fixed by c92dbffeac.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2015-02-22 07:55:33 +01:00
aszlig
c92dbffeac
chromium: Split up the source tarball on the fly.
So far we've done the source code split up by using the generic
unpackPhase and copying it all over into the different outputs.

However, this had the problem of generating the I/O load of about three
times the size of the source tree: First at fetchurl of the tarball
(although it's not as much because it's compressed), second at
unpackPhase and third at installPhase.

Now we don't use installPhase anymore and directly unpack into the
output paths, which unfortunately becomes quite a bit more complex
because we need to transform the paths of the tar file on the fly.

I've also tried using GNU Tar's --to-command option to even untar *and*
patch it at the same time, but forking for every single file in the
tarball gets REALLY slow and also gets even more complex than this two
stage approach because you need to make sure that the patch file is
applied correctly, for example for files that don't yet exist but are to
be created by the patch file.

We're using --anchored and --no-wildcards-match-slash here to prevent
accidentally excluding files we don't want to exclude. One example is
something like v8/tools/gyp/v8.gyp.

So the current approach is some compromise between complexity and speed
and should hopefully get rid of the Hydra build timeouts by lowering I/O
load.

See here for examples of builds having this issue:

http://hydra.nixos.org/build/19045023
http://hydra.nixos.org/build/19044973
http://hydra.nixos.org/build/19044968
http://hydra.nixos.org/build/19045019

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2015-02-22 07:52:53 +01:00
aszlig
0aad4b7ee4
chromium: Update all channels to latest versions.
Overview of the updated versions:

stable: 40.0.2214.91 -> 40.0.2214.115
beta:   41.0.2272.16 -> 41.0.2272.64
dev:    41.0.2272.16 -> 42.0.2305.3

Introduces 42.0.2305.3 as the new dev version, which no longer requires
our user namespaces sandbox patch. Thanks to everyone participating in
https://crbug.com/312380 for finally having this upstream.

In the course of supporting the official namespace sandbox (that's what
the user namespace sandbox is called), a few things needed to be fixed
for version 42:

 * Add an updated nix_plugin_paths.patch, because the old
   one tries to patch the path for libpdf, which is now natively included
   in Chromium.

 * Don't copy libpdf.so to libexec path for version 42, it's no longer
   needed as it's completely built-in now.

 * Disable SUID sandbox directly in the source instead of going the easy
   route of passing --disable-setuid-sandbox. The reason is that with
   the command line flag a nasty nagbar will appear.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2015-02-22 07:52:52 +01:00
Domen Kožar
fdb5cf8107 chromium: remove preferLocalBuild due to intense IO in VM tests
(cherry picked from commit 84bd62da0a)
Signed-off-by: Domen Kožar <domen@dev.si>
2015-02-06 12:08:43 +01:00
Shea Levy
c45372f038 Merge commit 'cfb29ab882323d379aba20a95020c7c24f883eae'
Partial staging merge, including cc-wrapper fixes

Conflicts:
	pkgs/applications/audio/spotify/default.nix
	pkgs/build-support/cc-wrapper/default.nix
	pkgs/development/compilers/cryptol/1.8.x.nix
2015-02-02 21:14:28 -05:00
aszlig
9343f6f461
chromium: Ensure runtime deps for enabled plugins.
We're propagating the plugin flags by importing from another Nix
expression file, which in turn exports the Nix path to the wrapper. This
causes that the store path isn't referenced in the wrapper and the path
isn't recognized by scanning the wrapper script (only those already
referenced at build time are).

So let's add the activated plugins to the buildInputs of the wrapper.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2015-01-26 09:31:03 +01:00
aszlig
ced5afc38c
chromium: Update all channels to latest versions.
This brings a new stable version 40.0.2214.91 along with a beta update
to version 41.0.2272.16, the dev channel is still stuck at version
41.0.2272.12 and within the next days will jump to version 42.

For this reason, I've done some cheating here and brought the beta
channel in par with the dev channel, because dev is older than beta on
OmahaProxy.

Here's an overview of the channel upgrades:

stable: 39.0.2171.65 -> 40.0.2214.91 [1]
beta:   40.0.2214.10 -> 41.0.2272.16 [1] [2] [3]
dev:    41.0.2224.3  -> 41.0.2272.16 [1] [2] [3]

[1]: We needed to patch in locations of lib{pci,udev}.so, because
     Chromium tries to load them at runtime. For version 41 startup will
     fail if it is unable to load libudev, but it also has the advantage
     that this fixes GPU detection using libpci in the stable version,
     which in turn could fix a few bugs on NixOS.

[2]: The upstream Debian package for the binary plugins now uses XZ
     compression for the enclosed data tarball.

[3]: Chromium 41 needs {shapshot,natives}_blob.bin in order to start up,
     so let's cp it among with the .pak files to avoid adding a
     conditional for version 40.

The release annoucement of the stable channel update can be found here:

http://googlechromereleases.blogspot.de/2015/01/stable-update.html

Note that this release contains 62 security fixes(!) and I'm hereby
apologizing for the delay of this update.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2015-01-26 09:31:03 +01:00
Eric Seidel
f3c6827373 rename all occurrences of stdenv.cc.gcc to stdenv.cc.cc 2015-01-14 20:27:55 -08:00
aszlig
536feffc68
chromium: Fix userns patch for kernel 3.18.2.
Writing the gid_map is already non-fatal, but the actual sandbox process
still tries to setresgid() to nogroup (usually 65534). This however
fails, because if user namespace sandboxing is present, the namespace
doesn't have CAP_SETGID at this point.

Fortunately, the effective GID is already 65534, so we just need to
check whether the target gid matches and only(!) setresgid() if it
doesn't.

So if someone would run a SUID version of the sandbox, it would still
work nonetheless without a negative impact on security.

Fixes #5730, thanks to @wizeman for reporting and initial debugging.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2015-01-13 06:18:10 +01:00
William A. Kennington III
afeef240dc kerberos: Use default kerberos instead of krb5 2014-12-30 00:05:12 -08:00
John Wiegley
28b6fb61e6 Change occurrences of gcc to the more general cc
This is done for the sake of Yosemite, which does not have gcc, and yet
this change is also compatible with Linux.
2014-12-26 11:06:21 -06:00
aszlig
597373bbd5
chromium: Precompile pycs instead of deleting.
This is more of an attempt rather than a real fix (or maybe it is? let's
see) for the corrupted .pyc files during build. I believe the reason we
get these are likely due to several instances of the Python interpreter
that run in parallel and one of these processes might still be writing
the .pyc file.

So, rather than deleting all .pyc files, we now precompile then in order
to avoid any build process trying to generate any .pyc file.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2014-12-25 07:10:12 +01:00
Domen Kožar
4124a0bd9c chromium: enable cups by default 2014-12-07 14:56:18 +01:00
Ricardo M. Correia
d4b4bae307 Update my maintainership 2014-11-29 02:15:39 +01:00
aszlig
78a73ab041
chromium: Remove .py[co] files prior to building.
Thanks to @iElectric for the notification, although I'm not really sure
whether this will fix the following failed Hydra build:

http://hydra.nixos.org/build/17609086/nixlog/1/raw

The reason is that this failure doesn't happen on every build, but let's
see whether it will happen again now.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2014-11-27 17:55:19 +01:00
Domen Kožar
412a2e21fb chromium: set two additional mimetypes for desktop icon 2014-11-26 20:56:29 +01:00
aszlig
28b29f173d
chromium: Switch to using bundled protobuf.
This is a response to 1fdefd5562.

We are already using bundled protobuf for the beta and dev channels and
it also breaks regularly with about every new Chromium release, so let's
use bundled protobuf for all channels now.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2014-11-25 14:14:58 +01:00
aszlig
690a845de9
chromium: Use Nix expressions for plugin settings.
We now create Nix expressions within the plugin output path(s) which
then will be imported and incorporated into the wrapper. This makes it
easier for other plugins to provide configuration settings to the main
Chromium wrapper.

Of course, in order to allow for external plugins we need to allow
passing a list of plugins to the Chromium derivation, but right now we
keep it internal and only use it for things such as NaCl (as soon as we
support it, of course).

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2014-11-25 14:14:43 +01:00
aszlig
518173ac24
chromium: Shorten line length of name attribute.
No feature change, I'm just very nitpicky if it comes to lines with more
than 79 characters.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2014-11-25 14:14:43 +01:00
aszlig
7eb4d3a3a9
chromium: Switch to use open-source PDF plugin.
The Chromium PDF plugin is now available as open source software and is
already included in the Chromium source tree in current stable, so there
is no need to extract it from the Chrome binary package anymore.

See release announcement at http://blog.foxitsoftware.com/?p=641

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2014-11-22 04:26:18 +01:00
aszlig
1b84fbf0ca
chromium: Allow env vars for passing plugin paths.
Introduces environment variables to set plugin base paths. The schema
for these is like NIX_CHROMIUM_PLUGIN_PATH_<N>. Where <N> is the path
type we want to change, the supported (full) variable names are:

 * NIX_CHROMIUM_PLUGIN_PATH_ALL
 * NIX_CHROMIUM_PLUGIN_PATH_PEPPERFLASH
 * NIX_CHROMIUM_PLUGIN_PATH_FILEFLASH
 * NIX_CHROMIUM_PLUGIN_PATH_PDF
 * NIX_CHROMIUM_PLUGIN_PATH_FILE_EFFECTS
 * NIX_CHROMIUM_PLUGIN_PATH_NACL
 * NIX_CHROMIUM_PLUGIN_PATH_PNACL
 * NIX_CHROMIUM_PLUGIN_PATH_WIDEVINE

Whereas NIX_CHROMIUM_PLUGIN_PATH_ALL is the plugin base path for every
path which is not set explicitly, so by setting ..._ALL and not setting
..._WIDEVINE, the widevine plugin will be searched in the directory
specified using ..._ALL.

Right now, the only plugin where this is used is widevine, and it still
doesn't properly work yet.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2014-11-22 04:26:17 +01:00
aszlig
2495e819aa
chromium: Update all channels to latest versions.
With this commit, the following new upstream versions are introduced:

stable: 38.0.2125.101 -> 39.0.2171.65
beta:   39.0.2171.19  -> 40.0.2214.10
dev:    40.0.2182.3   -> 41.0.2224.3

We can now remove missing_alg_import.patch, because version 39 is nom
stable and thus fixes the missing include directive upstream.

However, starting with version 40, we hit a few bugs with system
protobuf, so we're disabling it for every version >=40 to avoid
runtime/startup errors.

Here is the stable channel announcement for version 39 on the official
blog:

http://googlechromereleases.blogspot.de/2014/11/stable-channel-update_18.html

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2014-11-22 03:45:10 +01:00
Domen Kožar
9a48f6f9ef Revert "chromium: update dev, beta, stable channels"
This reverts commit 32df2a0838.

See
32df2a0838 (commitcomment-8260774)
2014-10-22 17:42:29 +02:00