[Backport release-24.05] chromium: fetch src, {ungoogled-,}chromium,chromedriver: 130.0.6723.116 -> 131.0.6778.85, chromedriver: build from source #357925
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
emilylange
added
the
1.severity: security
emilylange
force-pushed
the
backport-357371-to-release-24.05
branch
from
59721b7 to
71c3d9a
Compare
emilylange
force-pushed
the
backport-357371-to-release-24.05
branch
from
71c3d9a to
40a4201
Compare
ofborg
bot
added
ofborg-internal-error
ofborg
bot
added
11.by: package-maintainer
I'm pretty sure this was a mistake — in Nixpkgs the target platform is the platform that the program being built should output executables for — i.e., it's only relevant for a compiler, which Chromium is not. Tested that cross-compilation of Electron still works. (cherry picked from commit a269b98)
Just like with Firefox, we need to make sure there's only a single version of LLVM involved in building Chromium, or we get errors like this: ld.lld: error: Invalid record (Producer: 'LLVM18.1.7' Reader: 'LLVM 17.0.6') Fixes: 23d4f83 ("cargo,clippy,rustc,rustfmt: 1.77.2 -> 1.78.0") (cherry picked from commit a717626)
(cherry picked from commit 9a95b60)
(cherry picked from commit 372fac0)
(cherry picked from commit 4919b62)
Darwin seems to need `unzip` and chokes on `autoPatchelfHook`. Because linux now builds from source, the package has been updated to remove references to Linux-specific settings and build options, remove the conditionals checking for darwin, and adjust the platforms to reflect that the binary chromedriver is darwin-only. Fixes NixOS#329202 (cherry picked from commit dc96961)
emilylange
force-pushed
the
backport-357371-to-release-24.05
branch
from
40a4201 to
4b07d0b
Compare
chromium expects nightly/bleeding edge rustc features which we enable in our stable rustc release by setting RUSTC_BOOTSTRAP=1. The default rustc in 24.05 however is too old even with that workaround, but thankfully we also have 1.80 as opt-in. So we use that. This is slightly closer to the rustc version we have in unstable (1.82) and unbreaks building the upcoming M131. Previously: bad7d0f
(cherry picked from commit d3a139b)
This is no longer used as we only differentiate between stable and ungoogled-chromium, which we already track in the "ungoogled" boolean. Beta and dev channels are gone for good. It's been a year since their removal in 59719f7. There is, however, an additional channel mapping in nixos/tests/chromium but that one is independent from this one here. (cherry picked from commit ebb40bd)
This builds upon Yureka's work to build electron from source. A lot of the newly introduced changes to the chromium derivation and update script are 1-to-1 copies or slight derivates of that work. Especially the newly added depot_tools.py to resolve the DEPS files does most of the heavy lifting and is an ever so slightly modified version of that section Yureka implemented in electron's update.py. Some coordination between the chromium and electron maintainers should allow us to deduplicate a lot of the duplicated code fairly easily in the future. That just wasn't a goal with this commit, due to time constraints and the urgency to switch away from the release tarballs. Instead of taking just a few hours for a tarball to be available for download after a release, it now takes multiple days at least. At the time of writing, roughly a week after M131 was released, the tarball is still not available. It's unclear if it will ever be. Reason for this are CI issues on Google's side. Note that virtually every release contains some security critical fixes. Also note that this commit is written with a lot of conditionals so the electron derivation doesn't change (just yet). The new update.mjs update script is still very much work-in-progress but gets the job done. Co-Authored-By: Yureka <yuka@yuka.dev> (cherry picked from commit 8dd2f1a)
https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop_12.html This update includes 12 security fixes. CVEs: CVE-2024-11110 CVE-2024-11111 CVE-2024-11112 CVE-2024-11113 CVE-2024-11114 CVE-2024-11115 CVE-2024-11116 CVE-2024-11117 (cherry picked from commit 875ae81)
https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop_12.html This update includes 12 security fixes. CVEs: CVE-2024-11110 CVE-2024-11111 CVE-2024-11112 CVE-2024-11113 CVE-2024-11114 CVE-2024-11115 CVE-2024-11116 CVE-2024-11117 (cherry picked from commit 54d69a3)
https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop_19.html This update includes 3 security fixes. CVEs: CVE-2024-11395 (cherry picked from commit eaa1bb9)
This patch extends the caching mechanism of the chromium update scripts to use cached dependencies of all attributes in the lockfile. When updating ungoogled-chromium for example, the update script will now use cached dependencies from vanilla chromium, usually meaning that no additional fetching has to be done. (cherry picked from commit 68d5161)
https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop_19.html This update includes 3 security fixes. CVEs: CVE-2024-11395 (cherry picked from commit bd84f1c)
emilylange
force-pushed
the
backport-357371-to-release-24.05
branch
from
4b07d0b to
2a396b1
Compare
|
13 tasks
This allows us to match the version the binaries use more closely.
For example, chromedriver darwin (binary) reports the following:
~~~bash
chromedriver --version
ChromeDriver 131.0.6778.85 (3d81e41b6f3ac8bcae63b32e8145c9eb0cd60a2d-refs/branch-heads/6778@{NixOS#2285})
~~~
while on Linux, where we build chromedriver based on the chromium
derivation from source and control the string ourselves:
~~~bash
chromedriver --version
ChromeDriver 131.0.6778.85 (131.0.6778.85-refs/heads/master@{#0})
~~~
With this commit, the version string now reports:
~~~bash
chromedriver --version
ChromeDriver 131.0.6778.85 (3d81e41b6f3ac8bcae63b32e8145c9eb0cd60a2d-refs/tags/131.0.6778.85@{#0})
~~~
This may seem like a small and unimportant detail, but turns out an
internal function within chromedriver depends on the git hash.
See https://chromium.googlesource.com/chromium/src/+/131.0.6778.85/chrome/test/chromedriver/chrome/browser_info.cc#172
This caused the tests of one package (single-file-cli) that use
selenium with chromium and chromedriver to fail in 24.05.
Only in 24.05, because 24.11 and unstable removed their test dependency
on chromedriver because it wasn't available for aarch64-linux at that
time.
~~~
Running phase: checkPhase
Serving HTTP on 127.0.0.1 port 8000 (http://127.0.0.1:8000/) ...
session not created
from unknown error: unrecognized Blink revision: 131.0.6778.85 URL: http://127.0.0.1:8000
Stack: SessionNotCreatedError: session not created
from unknown error: unrecognized Blink revision: 131.0.6778.85
at Object.throwDecodedError (/build/source/node_modules/selenium-webdriver/lib/error.js:524:15)
at parseHttpResponse (/build/source/node_modules/selenium-webdriver/lib/http.js:601:13)
at Executor.execute (/build/source/node_modules/selenium-webdriver/lib/http.js:529:28)
at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
~~~
(cherry picked from commit 2a765df)
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Partial backports of a few PRs that are needed for #357371 and #357691:
We need the new fetch from source to get chromium M131, chromedriver and chromium major version must stay in sync.
Chromium releases roughly once a week, so if we don't do it this way, chromedriver will be rendered incompatible, or we have to flag everything as insecure or the next few weeks until 24.05 is EOL will be a pain to backport.
This shouldn't cause any breakage.
nixpkgs-review will be posted below as usual.
Things done
nix.conf? (See Nix manual)sandbox = relaxedsandbox = truenix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage./result/bin/)