From: Stephan Hartmann Date: Wed, 13 Nov 2019 11:42:30 +0000 (+0100) Subject: www-client/chromium: security cleanup X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=5c0bfad7ccad3e625ffd73b625bd7b972711b21b;p=gentoo.git www-client/chromium: security cleanup Bug: https://bugs.gentoo.org/699676 Closes: https://github.com/gentoo/gentoo/pull/13628 Package-Manager: Portage-2.3.76, Repoman-2.3.16 Signed-off-by: Stephan Hartmann Signed-off-by: Mike Gilbert --- diff --git a/www-client/chromium/Manifest b/www-client/chromium/Manifest index 29bf420ed15a..25ef4c593822 100644 --- a/www-client/chromium/Manifest +++ b/www-client/chromium/Manifest @@ -1,5 +1,4 @@ DIST chromium-78-revert-noexcept-r1.patch.gz 12094 BLAKE2B 1fd0c939af773ed398c9ab14fa80b042b4237cabdbcb06425e4d1c72200ec49c3c1383cfc95013cce4df411b0a2397b79030d41a0379ae80a0c60bae1fbb5ffa SHA512 dcb62b82b34d5d6982762cacfe3ab7d3538d908b3befe7666f5d70d98ba4f979b5bf056e5c5343ed76aa744a643318fc5a75ddedfcb1b7de3e7c28eb2587439f -DIST chromium-78.0.3904.87.tar.xz 742861696 BLAKE2B f8e99207876d879dc74873950e3647d41f0c687a9cd6285f44d54a4c39ceac68d455a79c38f0c9c4815ad025b2b6fae95305f0bc47e2d4c0f2937810068ffe1e SHA512 9c59c01c7224771dd1db648a8cea6cda646062b4b172eb7bf0767a0b5ebead038697a8c0ec2c4ef758b876bb7a1c862223b8ef3c23308fd0c99752444305a713 DIST chromium-78.0.3904.97.tar.xz 742793812 BLAKE2B e7fada913f5831d805a50445da41ecbca7e27af52574ce242f427c0e4c83a74ae0283eb1667d74d39eb88f05e88e5a389945628666e24e26d635f74c43c8bc55 SHA512 e29312fe5c15eb6888a2e4d7e197c710d53feeecdf4e534c59f3db26973fee13f48880b46a7c3b132bb9989eb617db9c6138b809c3cb762332a9db25ad6d33dc DIST chromium-79.0.3945.29.tar.xz 778087092 BLAKE2B 5ebf337a5510e78cf52e317fa1080f2714be09a8514ec1b9188fbf195efb36016a4588eaba769e6ead0502fa2dadcddb9ccde51c313ad5dc99c92c0d18f92076 SHA512 8044996d23d05751b27ce7b01a1728149bf878b884a59bd039c4989a5b5c0ea0872733ffffc70e6908d45861a43ae7d18895718df3d38890c583fe222b65f1b5 DIST chromium-80.0.3962.2.tar.xz 788407196 BLAKE2B f7ece5f654f7b479ac4aad42e18dc2454c46b39353bdf6057c30aeb30714f033af21228269510ddd4ebb15b570987cdbe0d0ae67824368f205fbdb9308cbed07 SHA512 29460df7e6b8f4b01fea06faad236690739e250170c190ee991090fc300a3cbea034ebee50731485ac578d5f8c83cfc86e9438bd6ba91c686f17bea78dbf1e86 diff --git a/www-client/chromium/chromium-78.0.3904.87.ebuild b/www-client/chromium/chromium-78.0.3904.87.ebuild deleted file mode 100644 index de0984e85449..000000000000 --- a/www-client/chromium/chromium-78.0.3904.87.ebuild +++ /dev/null @@ -1,742 +0,0 @@ -# Copyright 2009-2019 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -EAPI=7 -PYTHON_COMPAT=( python2_7 ) - -CHROMIUM_LANGS="am ar bg bn ca cs da de el en-GB es es-419 et fa fi fil fr gu he - hi hr hu id it ja kn ko lt lv ml mr ms nb nl pl pt-BR pt-PT ro ru sk sl sr - sv sw ta te th tr uk vi zh-CN zh-TW" - -inherit check-reqs chromium-2 desktop flag-o-matic multilib ninja-utils pax-utils portability python-any-r1 readme.gentoo-r1 toolchain-funcs xdg-utils - -DESCRIPTION="Open-source version of Google Chrome web browser" -HOMEPAGE="http://chromium.org/" -SRC_URI="https://commondatastorage.googleapis.com/chromium-browser-official/${P}.tar.xz - https://dev.gentoo.org/~floppym/dist/chromium-78-revert-noexcept-r1.patch.gz -" - -LICENSE="BSD" -SLOT="0" -KEYWORDS="amd64 ~arm64 ~x86" -IUSE="+closure-compile component-build cups cpu_flags_arm_neon gnome-keyring +hangouts jumbo-build kerberos pic +proprietary-codecs pulseaudio selinux +suid +system-ffmpeg +system-icu +system-libvpx +tcmalloc widevine" -RESTRICT="!system-ffmpeg? ( proprietary-codecs? ( bindist ) )" -REQUIRED_USE="component-build? ( !suid )" - -COMMON_DEPEND=" - >=app-accessibility/at-spi2-atk-2.26:2 - app-arch/bzip2:= - cups? ( >=net-print/cups-1.3.11:= ) - >=dev-libs/atk-2.26 - dev-libs/expat:= - dev-libs/glib:2 - system-icu? ( >=dev-libs/icu-64:= ) - >=dev-libs/libxml2-2.9.4-r3:=[icu] - dev-libs/libxslt:= - dev-libs/nspr:= - >=dev-libs/nss-3.26:= - >=dev-libs/re2-0.2016.11.01:= - gnome-keyring? ( >=gnome-base/libgnome-keyring-3.12:= ) - >=media-libs/alsa-lib-1.0.19:= - media-libs/fontconfig:= - media-libs/freetype:= - >=media-libs/harfbuzz-2.4.0:0=[icu(-)] - media-libs/libjpeg-turbo:= - media-libs/libpng:= - system-libvpx? ( media-libs/libvpx:=[postproc,svc] ) - >=media-libs/openh264-1.6.0:= - pulseaudio? ( media-sound/pulseaudio:= ) - system-ffmpeg? ( - >=media-video/ffmpeg-4:= - || ( - media-video/ffmpeg[-samba] - >=net-fs/samba-4.5.10-r1[-debug(-)] - ) - !=net-fs/samba-4.5.12-r0 - media-libs/opus:= - ) - sys-apps/dbus:= - sys-apps/pciutils:= - virtual/udev - x11-libs/cairo:= - x11-libs/gdk-pixbuf:2 - x11-libs/gtk+:3[X] - x11-libs/libX11:= - x11-libs/libXcomposite:= - x11-libs/libXcursor:= - x11-libs/libXdamage:= - x11-libs/libXext:= - x11-libs/libXfixes:= - >=x11-libs/libXi-1.6.0:= - x11-libs/libXrandr:= - x11-libs/libXrender:= - x11-libs/libXScrnSaver:= - x11-libs/libXtst:= - x11-libs/pango:= - app-arch/snappy:= - media-libs/flac:= - >=media-libs/libwebp-0.4.0:= - sys-libs/zlib:=[minizip] - kerberos? ( virtual/krb5 ) -" -# For nvidia-drivers blocker, see bug #413637 . -RDEPEND="${COMMON_DEPEND} - ! gn leftovers - base/third_party/libevent - third_party/adobe - third_party/speech-dispatcher - third_party/usb_ids - third_party/xdg-utils - third_party/yasm/run_yasm.py - ) - if ! use system-ffmpeg; then - keeplibs+=( third_party/ffmpeg third_party/opus ) - fi - if ! use system-icu; then - keeplibs+=( third_party/icu ) - fi - if ! use system-libvpx; then - keeplibs+=( third_party/libvpx ) - keeplibs+=( third_party/libvpx/source/libvpx/third_party/x86inc ) - fi - if use tcmalloc; then - keeplibs+=( third_party/tcmalloc ) - fi - - # Remove most bundled libraries. Some are still needed. - build/linux/unbundle/remove_bundled_libraries.py "${keeplibs[@]}" --do-remove || die -} - -src_configure() { - # Calling this here supports resumption via FEATURES=keepwork - python_setup - - local myconf_gn="" - - # Make sure the build system will use the right tools, bug #340795. - tc-export AR CC CXX NM - - if [[ ${CHROMIUM_FORCE_CLANG} == yes ]] && ! tc-is-clang; then - # Force clang since gcc is pretty broken at the moment. - CC=${CHOST}-clang - CXX=${CHOST}-clang++ - strip-unsupported-flags - fi - - if tc-is-clang; then - myconf_gn+=" is_clang=true clang_use_chrome_plugins=false" - else - myconf_gn+=" is_clang=false" - append-cxxflags -fpermissive - fi - - # Define a custom toolchain for GN - myconf_gn+=" custom_toolchain=\"//build/toolchain/linux/unbundle:default\"" - - if tc-is-cross-compiler; then - tc-export BUILD_{AR,CC,CXX,NM} - myconf_gn+=" host_toolchain=\"//build/toolchain/linux/unbundle:host\"" - myconf_gn+=" v8_snapshot_toolchain=\"//build/toolchain/linux/unbundle:host\"" - else - myconf_gn+=" host_toolchain=\"//build/toolchain/linux/unbundle:default\"" - fi - - # GN needs explicit config for Debug/Release as opposed to inferring it from build directory. - myconf_gn+=" is_debug=false" - - # Component build isn't generally intended for use by end users. It's mostly useful - # for development and debugging. - myconf_gn+=" is_component_build=$(usex component-build true false)" - - # https://chromium.googlesource.com/chromium/src/+/lkcr/docs/jumbo.md - myconf_gn+=" use_jumbo_build=$(usex jumbo-build true false)" - - myconf_gn+=" use_allocator=$(usex tcmalloc \"tcmalloc\" \"none\")" - - # Disable nacl, we can't build without pnacl (http://crbug.com/269560). - myconf_gn+=" enable_nacl=false" - - # Use system-provided libraries. - # TODO: freetype -- remove sources (https://bugs.chromium.org/p/pdfium/issues/detail?id=733). - # TODO: use_system_hunspell (upstream changes needed). - # TODO: use_system_libsrtp (bug #459932). - # TODO: use_system_protobuf (bug #525560). - # TODO: use_system_ssl (http://crbug.com/58087). - # TODO: use_system_sqlite (http://crbug.com/22208). - - # libevent: https://bugs.gentoo.org/593458 - local gn_system_libraries=( - flac - fontconfig - freetype - # Need harfbuzz_from_pkgconfig target - #harfbuzz-ng - libdrm - libjpeg - libpng - libwebp - libxml - libxslt - openh264 - re2 - snappy - yasm - zlib - ) - if use system-ffmpeg; then - gn_system_libraries+=( ffmpeg opus ) - fi - if use system-icu; then - gn_system_libraries+=( icu ) - fi - if use system-libvpx; then - gn_system_libraries+=( libvpx ) - fi - build/linux/unbundle/replace_gn_files.py --system-libraries "${gn_system_libraries[@]}" || die - - # See dependency logic in third_party/BUILD.gn - myconf_gn+=" use_system_harfbuzz=true" - - # Optional dependencies. - myconf_gn+=" closure_compile=$(usex closure-compile true false)" - myconf_gn+=" enable_hangout_services_extension=$(usex hangouts true false)" - myconf_gn+=" enable_widevine=$(usex widevine true false)" - myconf_gn+=" use_cups=$(usex cups true false)" - myconf_gn+=" use_gnome_keyring=$(usex gnome-keyring true false)" - myconf_gn+=" use_kerberos=$(usex kerberos true false)" - myconf_gn+=" use_pulseaudio=$(usex pulseaudio true false)" - - # TODO: link_pulseaudio=true for GN. - - myconf_gn+=" fieldtrial_testing_like_official_build=true" - - # Never use bundled gold binary. Disable gold linker flags for now. - # Do not use bundled clang. - # Trying to use gold results in linker crash. - myconf_gn+=" use_gold=false use_sysroot=false linux_use_bundled_binutils=false use_custom_libcxx=false" - - # Disable forced lld, bug 641556 - myconf_gn+=" use_lld=false" - - ffmpeg_branding="$(usex proprietary-codecs Chrome Chromium)" - myconf_gn+=" proprietary_codecs=$(usex proprietary-codecs true false)" - myconf_gn+=" ffmpeg_branding=\"${ffmpeg_branding}\"" - - # Set up Google API keys, see http://www.chromium.org/developers/how-tos/api-keys . - # Note: these are for Gentoo use ONLY. For your own distribution, - # please get your own set of keys. Feel free to contact chromium@gentoo.org - # for more info. - local google_api_key="AIzaSyDEAOvatFo0eTgsV_ZlEzx0ObmepsMzfAc" - local google_default_client_id="329227923882.apps.googleusercontent.com" - local google_default_client_secret="vgKG0NNv7GoDpbtoFNLxCUXu" - myconf_gn+=" google_api_key=\"${google_api_key}\"" - myconf_gn+=" google_default_client_id=\"${google_default_client_id}\"" - myconf_gn+=" google_default_client_secret=\"${google_default_client_secret}\"" - - local myarch="$(tc-arch)" - - # Avoid CFLAGS problems, bug #352457, bug #390147. - if ! use custom-cflags; then - replace-flags "-Os" "-O2" - strip-flags - - # Prevent linker from running out of address space, bug #471810 . - if use x86; then - filter-flags "-g*" - fi - - # Prevent libvpx build failures. Bug 530248, 544702, 546984. - if [[ ${myarch} == amd64 || ${myarch} == x86 ]]; then - filter-flags -mno-mmx -mno-sse2 -mno-ssse3 -mno-sse4.1 -mno-avx -mno-avx2 - fi - fi - - if [[ $myarch = amd64 ]] ; then - myconf_gn+=" target_cpu=\"x64\"" - ffmpeg_target_arch=x64 - elif [[ $myarch = x86 ]] ; then - myconf_gn+=" target_cpu=\"x86\"" - ffmpeg_target_arch=ia32 - - # This is normally defined by compiler_cpu_abi in - # build/config/compiler/BUILD.gn, but we patch that part out. - append-flags -msse2 -mfpmath=sse -mmmx - elif [[ $myarch = arm64 ]] ; then - myconf_gn+=" target_cpu=\"arm64\"" - ffmpeg_target_arch=arm64 - elif [[ $myarch = arm ]] ; then - myconf_gn+=" target_cpu=\"arm\"" - ffmpeg_target_arch=$(usex cpu_flags_arm_neon arm-neon arm) - else - die "Failed to determine target arch, got '$myarch'." - fi - - # Make sure that -Werror doesn't get added to CFLAGS by the build system. - # Depending on GCC version the warnings are different and we don't want - # the build to fail because of that. - myconf_gn+=" treat_warnings_as_errors=false" - - # Disable fatal linker warnings, bug 506268. - myconf_gn+=" fatal_linker_warnings=false" - - # Bug 491582. - export TMPDIR="${WORKDIR}/temp" - mkdir -p -m 755 "${TMPDIR}" || die - - # https://bugs.gentoo.org/654216 - addpredict /dev/dri/ #nowarn - - #if ! use system-ffmpeg; then - if false; then - local build_ffmpeg_args="" - if use pic && [[ "${ffmpeg_target_arch}" == "ia32" ]]; then - build_ffmpeg_args+=" --disable-asm" - fi - - # Re-configure bundled ffmpeg. See bug #491378 for example reasons. - einfo "Configuring bundled ffmpeg..." - pushd third_party/ffmpeg > /dev/null || die - chromium/scripts/build_ffmpeg.py linux ${ffmpeg_target_arch} \ - --branding ${ffmpeg_branding} -- ${build_ffmpeg_args} || die - chromium/scripts/copy_config.sh || die - chromium/scripts/generate_gn.py || die - popd > /dev/null || die - fi - - einfo "Configuring Chromium..." - set -- gn gen --args="${myconf_gn} ${EXTRA_GN}" out/Release - echo "$@" - "$@" || die -} - -src_compile() { - # Final link uses lots of file descriptors. - ulimit -n 2048 - - # Calling this here supports resumption via FEATURES=keepwork - python_setup - - #"${EPYTHON}" tools/clang/scripts/update.py --force-local-build --gcc-toolchain /usr --skip-checkout --use-system-cmake --without-android || die - - # Build mksnapshot and pax-mark it. - local x - for x in mksnapshot v8_context_snapshot_generator; do - if tc-is-cross-compiler; then - eninja -C out/Release "host/${x}" - pax-mark m "out/Release/host/${x}" - else - eninja -C out/Release "${x}" - pax-mark m "out/Release/${x}" - fi - done - - # Even though ninja autodetects number of CPUs, we respect - # user's options, for debugging with -j 1 or any other reason. - eninja -C out/Release chrome chromedriver - use suid && eninja -C out/Release chrome_sandbox - - pax-mark m out/Release/chrome - - # Build manpage; bug #684550 - sed -e 's|@@PACKAGE@@|chromium-browser|g; - s|@@MENUNAME@@|Chromium|g;' \ - chrome/app/resources/manpage.1.in > \ - out/Release/chromium-browser.1 || die -} - -src_install() { - local CHROMIUM_HOME="/usr/$(get_libdir)/chromium-browser" - exeinto "${CHROMIUM_HOME}" - doexe out/Release/chrome - - if use suid; then - newexe out/Release/chrome_sandbox chrome-sandbox - fperms 4755 "${CHROMIUM_HOME}/chrome-sandbox" - fi - - doexe out/Release/chromedriver - - local sedargs=( -e "s:/usr/lib/:/usr/$(get_libdir)/:g" ) - sed "${sedargs[@]}" "${FILESDIR}/chromium-launcher-r3.sh" > chromium-launcher.sh || die - doexe chromium-launcher.sh - - # It is important that we name the target "chromium-browser", - # xdg-utils expect it; bug #355517. - dosym "${CHROMIUM_HOME}/chromium-launcher.sh" /usr/bin/chromium-browser - # keep the old symlink around for consistency - dosym "${CHROMIUM_HOME}/chromium-launcher.sh" /usr/bin/chromium - - dosym "${CHROMIUM_HOME}/chromedriver" /usr/bin/chromedriver - - # Allow users to override command-line options, bug #357629. - insinto /etc/chromium - newins "${FILESDIR}/chromium.default" "default" - - pushd out/Release/locales > /dev/null || die - chromium_remove_language_paks - popd - - insinto "${CHROMIUM_HOME}" - doins out/Release/*.bin - doins out/Release/*.pak - doins out/Release/*.so - - if ! use system-icu; then - doins out/Release/icudtl.dat - fi - - doins -r out/Release/locales - doins -r out/Release/resources - - if [[ -d out/Release/swiftshader ]]; then - insinto "${CHROMIUM_HOME}/swiftshader" - doins out/Release/swiftshader/*.so - fi - - # Install icons and desktop entry. - local branding size - for size in 16 24 32 48 64 128 256 ; do - case ${size} in - 16|32) branding="chrome/app/theme/default_100_percent/chromium" ;; - *) branding="chrome/app/theme/chromium" ;; - esac - newicon -s ${size} "${branding}/product_logo_${size}.png" \ - chromium-browser.png - done - - local mime_types="text/html;text/xml;application/xhtml+xml;" - mime_types+="x-scheme-handler/http;x-scheme-handler/https;" # bug #360797 - mime_types+="x-scheme-handler/ftp;" # bug #412185 - mime_types+="x-scheme-handler/mailto;x-scheme-handler/webcal;" # bug #416393 - make_desktop_entry \ - chromium-browser \ - "Chromium" \ - chromium-browser \ - "Network;WebBrowser" \ - "MimeType=${mime_types}\nStartupWMClass=chromium-browser" - sed -e "/^Exec/s/$/ %U/" -i "${ED}"/usr/share/applications/*.desktop || die - - # Install GNOME default application entry (bug #303100). - insinto /usr/share/gnome-control-center/default-apps - newins "${FILESDIR}"/chromium-browser.xml chromium-browser.xml - - # Install manpage; bug #684550 - doman out/Release/chromium-browser.1 - dosym chromium-browser.1 /usr/share/man/man1/chromium.1 - - readme.gentoo_create_doc -} - -pkg_postrm() { - xdg_icon_cache_update - xdg_desktop_database_update -} - -pkg_postinst() { - xdg_icon_cache_update - xdg_desktop_database_update - readme.gentoo_print_elog -}