Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chromium: 53 -> 54 #19565

Closed
wants to merge 1 commit into from
Closed

chromium: 53 -> 54 #19565

wants to merge 1 commit into from

Conversation

NeQuissimus
Copy link
Member

Motivation for this change

Update

Things done

Used update.sh

  • Tested using sandboxing
    (nix.useSandbox on NixOS,
    or option build-use-sandbox in nix.conf
    on non-NixOS)
  • Built on platform(s)
    • NixOS
    • OS X
    • Linux
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Fits CONTRIBUTING.md.

@mention-bot
Copy link

@NeQuissimus, thanks for your PR! By analyzing the history of the files in this pull request, we identified @grahamc and @aszlig to be potential reviewers.

@grahamc grahamc added the 9.needs: port to stable A PR needs a backport to the stable release. label Oct 15, 2016
@grahamc
Copy link
Member

grahamc commented Oct 15, 2016

Hrmmm not so simple this time :(

patching file chrome/common/chrome_paths.cc
Hunk #1 succeeded at 69 (offset 1 line).
Hunk #2 succeeded at 266 (offset 1 line).
Hunk #3 succeeded at 274 (offset 1 line).
Hunk #4 succeeded at 317 (offset 1 line).
Hunk #5 succeeded at 352 (offset 1 line).
sed: can't read chrome/chrome_tests.gypi: No such file or directory
builder for ‘/nix/store/ky882cjxnrnvdqggfs2c2px0342ansb1-chromium-55.0.2883.11.drv’ failed with exit code 2

@NeQuissimus
Copy link
Member Author

Oh, I only built stable...

@NeQuissimus
Copy link
Member Author

OK, I need help with this... :D

I don't even see your error when I build chromiumDev. It complains a lot about PepperFlash and I have spent a good amount of time on this and got nowhere...

I get these

/opt/google/chrome-unstable/PepperFlash: Not found in archive
chmod: cannot access 'PepperFlash/libpepflashplayer.so': No such file or directory
unable to read file PepperFlash/manifest.json: No such file or directory

Seemed to me that PepperFlash has been removed but I am not sure how I would go about fixing that. I don't think I understand the nix expressions for Chromium...

@bendlas
Copy link
Contributor

bendlas commented Oct 20, 2016

Continuing from #19678, shall we use this PR as a ticket for the chromium transition?

I took @aszlig 's work on porting to GN and tried to get it built: https://github.com/bendlas/nixpkgs/tree/chromium-gn
It compiles, but there is an rpath issue with linking, that I think I've identified as: #19680
If nobody beats me to it, I'll try to create a temporary gcc wrapper for chromium to deal with this until the issue is resolved.

I added a commit to deactivate PepperFlash, but for a complete port we'll probably need distribute NPAPI flash: https://blogs.adobe.com/flashplayer/2016/08/beta-news-flash-player-npapi-for-linux.html

@aszlig
Copy link
Member

aszlig commented Oct 23, 2016

@bendlas: Chromium has dropped support for the NPAPI a long time ago, so how do you exactly want to port it? Reviving the old (unsandboxed) NPAPI code?

@bendlas
Copy link
Contributor

bendlas commented Oct 23, 2016

@aszlig I probably misremembered. Probably because chromium dropped the PPAPI flash from the default plugin package at the same time where Adobe announced plans to keep NPAPI flash updated in the future. Shall we continue to support PPAPI flash, by downloading it directly from Adobe? What's upstream doing?

@aszlig
Copy link
Member

aszlig commented Oct 23, 2016

@bendlas: Ah, didn't get that in the first place... So the Chrome binary package doesn't include Pepperflash anymore, right? So yes, I'd get the (PPAPI) plugin directly from Adobe then and drop the plugin from the Chromium plugins package (leaving it to only include widevine).

@grahamc
Copy link
Member

grahamc commented Oct 26, 2016

(bug roundup highlighted this issue again, #19884) What's the status on updating the stable chromium?

@bendlas
Copy link
Contributor

bendlas commented Oct 26, 2016

@grahamc almost there, I could get a successful link with the @rspfile fix in nix-shell --pure, for some reason nix-build still doesn't set the rpath correctly. I'm investigating, but chromium builds are painfully slow

@bendlas
Copy link
Contributor

bendlas commented Oct 26, 2016

Link issue should be fixed, just running another build.
The issue with pepperflash seems, that google now wants to keep flashplayer updated via chrome://components https://forums.adobe.com/thread/2221587
If this works for NixOS as well, it would be net gain, otherwise, we need to devise a scheme to find out the most recent version of flash, in our update.sh. Adobe's download page doesn't seem very helpful about it.

@aszlig
Copy link
Member

aszlig commented Oct 26, 2016

@bendlas: I think it's better to completely decouple pepperflash from Chromium, like it has been back then with the NPAPI flash plugin, especially because Flash versions are no longer tied to Chromium versions (okay, to be more exact: I assume they aren't).

@bendlas
Copy link
Contributor

bendlas commented Oct 26, 2016

@aszlig if the auto-update via Component Updater works, wouldn't it be better to take advantage of this, to get faster security updates? I grepped GN flags for flash, but didn't find anything to control Component Updater. Let's see, what it does in a finished build, still waiting for that. Got to run in 15 minutes, unfortunately ...

@bendlas
Copy link
Contributor

bendlas commented Oct 26, 2016

EDIT: builds and run
EDIT2: huh, even though pepperflash is deactivated, it works in my build You have version 23,0,0,162 installed; doesn't show up in chrome://components/ though. What sorcery is this?

I rebased and squashed everything in master...bendlas:chromium-54

if somebody wants to take care of pepperflash right now, you can do so on top of that branch, otherwise I recommend pushing this w/o pepperflash, for now.

@NeQuissimus
Copy link
Member Author

Where are we at with this?

@bendlas can you send your progress as a PR? We should have a working up-to-date Chromium then, correct?

aszlig pushed a commit to aszlig/nixpkgs that referenced this pull request Nov 3, 2016
grahamc pushed a commit to grahamc/nixpkgs that referenced this pull request Nov 7, 2016
@aszlig aszlig closed this in b43142c Nov 9, 2016
aszlig added a commit that referenced this pull request Nov 9, 2016
This brings in the new stable version 54 which also introduces a lot of
security fixes:

  CVE-2016-5198: Out of bounds memory access in V8
  CVE-2016-5181: Universal XSS in Blink
  CVE-2016-5182: Heap overflow in Blink
  CVE-2016-5183: Use after free in PDFium
  CVE-2016-5184: Use after free in PDFium
  CVE-2016-5185: Use after free in Blink
  CVE-2016-5187: URL spoofing
  CVE-2016-5188: UI spoofing
  CVE-2016-5192: Cross-origin bypass in Blink
  CVE-2016-5189: URL spoofing
  CVE-2016-5186: Out of bounds read in DevTools
  CVE-2016-5191: Universal XSS in Bookmarks
  CVE-2016-5190: Use after free in Internals
  CVE-2016-5193: Scheme bypass

Detailed announcements about these changes can be found here (latest to
oldest):

https://googlechromereleases.blogspot.de/2016/11/stable-channel-update-for-desktop.html
https://googlechromereleases.blogspot.de/2016/10/stable-channel-update-for-desktop_20.html
https://googlechromereleases.blogspot.de/2016/10/stable-channel-update-for-desktop.html

The update process of Chromium has been a bit bumpy on our side, because
version 54 also did the switch from GYP to GN so it wasn't just a matter
of updating the upstream-info file.

I've tested the Flash plugin (which runs fine) and WideVine manually,
although I couldn't get WideVine to work (I was running this within a VM
though).

So if people want to use WideVine they need to use Chrome instead until
we got this sorted out.

VM test results along with builds for all platforms can be found here:

https://headcounter.org/hydra/eval/339328

I'm going to backport these changes to stable as soon as the
tests/builds succeed there as well.

Closes: #19565
Closes: #20120
aszlig pushed a commit to aszlig/nixpkgs that referenced this pull request Nov 9, 2016
aszlig added a commit that referenced this pull request Nov 9, 2016
This is the merge c67a7ee from master
but backported to stable, which brings a bunch of security updates to
Chromium:

  CVE-2016-5198: Out of bounds memory access in V8
  CVE-2016-5181: Universal XSS in Blink
  CVE-2016-5182: Heap overflow in Blink
  CVE-2016-5183: Use after free in PDFium
  CVE-2016-5184: Use after free in PDFium
  CVE-2016-5185: Use after free in Blink
  CVE-2016-5187: URL spoofing
  CVE-2016-5188: UI spoofing
  CVE-2016-5192: Cross-origin bypass in Blink
  CVE-2016-5189: URL spoofing
  CVE-2016-5186: Out of bounds read in DevTools
  CVE-2016-5191: Universal XSS in Bookmarks
  CVE-2016-5190: Use after free in Internals
  CVE-2016-5193: Scheme bypass

Detailed announcements about these changes can be found here (latest to
oldest):

https://googlechromereleases.blogspot.de/2016/11/stable-channel-update-for-desktop.html
https://googlechromereleases.blogspot.de/2016/10/stable-channel-update-for-desktop_20.html
https://googlechromereleases.blogspot.de/2016/10/stable-channel-update-for-desktop.html

The implementation of this backport differs in that we copy the
cc-wrapper to the Chromium directory and add support for handling
response files. Thanks to @bendlas for the work on this.

Tests and builds pass successfully on my Hydra at:

https://headcounter.org/hydra/eval/339329

Cc: @grahamc, @bendlas, @shlevy, @sternenseemann
Closes: #19565
Closes: #20120
@NeQuissimus NeQuissimus deleted the chromium_54 branch February 14, 2021 01:18
adrianpk added a commit to adrianpk/nixpkgs that referenced this pull request May 31, 2024
adrianpk added a commit to adrianpk/nixpkgs that referenced this pull request May 31, 2024
This is the merge c67a7ee from master
but backported to stable, which brings a bunch of security updates to
Chromium:

  CVE-2016-5198: Out of bounds memory access in V8
  CVE-2016-5181: Universal XSS in Blink
  CVE-2016-5182: Heap overflow in Blink
  CVE-2016-5183: Use after free in PDFium
  CVE-2016-5184: Use after free in PDFium
  CVE-2016-5185: Use after free in Blink
  CVE-2016-5187: URL spoofing
  CVE-2016-5188: UI spoofing
  CVE-2016-5192: Cross-origin bypass in Blink
  CVE-2016-5189: URL spoofing
  CVE-2016-5186: Out of bounds read in DevTools
  CVE-2016-5191: Universal XSS in Bookmarks
  CVE-2016-5190: Use after free in Internals
  CVE-2016-5193: Scheme bypass

Detailed announcements about these changes can be found here (latest to
oldest):

https://googlechromereleases.blogspot.de/2016/11/stable-channel-update-for-desktop.html
https://googlechromereleases.blogspot.de/2016/10/stable-channel-update-for-desktop_20.html
https://googlechromereleases.blogspot.de/2016/10/stable-channel-update-for-desktop.html

The implementation of this backport differs in that we copy the
cc-wrapper to the Chromium directory and add support for handling
response files. Thanks to @bendlas for the work on this.

Tests and builds pass successfully on my Hydra at:

https://headcounter.org/hydra/eval/339329

Cc: @grahamc, @bendlas, @shlevy, @sternenseemann
Closes: NixOS#19565
Closes: NixOS#20120
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

5 participants