chromium: use a less frightening updater script #89635
Labels
0.kind: bug
Something is broken
Comments
|
Oh yeah, that'd also be fine. Let's carry over discussion to that thread. |
flokli
pushed a commit
to alyssais/nixpkgs
that referenced
this issue
Sep 5, 2020
update.nix was a huuuuge hack, abusing checksum collisions, etc., and was extremely difficult to read and maintain, especially because values from update.nix were also used in the derivations themselves! I've replaced this with an implementation in Python, which I chose for readability. Rather than generating Nix, I chose to generate JSON, since Python can do that in the standard library and Nix can read it. I also set update.py as an updateScript, so Chromium can now automatically be updated! Fixes: NixOS#89635
primeos
pushed a commit
to primeos/nixpkgs
that referenced
this issue
Sep 23, 2020
update.nix was a huuuuge hack, abusing checksum collisions, etc., and was extremely difficult to read and maintain, especially because values from update.nix were also used in the derivations themselves! I've replaced this with an implementation in Python, which I chose for readability. Rather than generating Nix, I chose to generate JSON, since Python can do that in the standard library and Nix can read it. I also set update.py as an updateScript, so Chromium can now automatically be updated! Fixes: NixOS#89635 (cherry picked from commit de69b70)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
The chromium updater script uses a Nix fixed-output derivation doing network access, and makes use of a hash collision to emit contents that have the same sha1 hash.
Before ed8f3b5, this was MD5, and also used collisions.
While this is funny and cool, it's probably not a good idea to be this tooling essential to do things like security updates in a browser.
Before 28b289e, it was a 101 line bash script. Now we're with a 271 line nix script that is (at least for me) very hard to read.
@aszlig can you elaborate on if we really need a nix-based updater script, or can this be moved back to the 101 line bash script?
cc @primeos
The text was updated successfully, but these errors were encountered: