Bug#973848: chromium: Unsupported version, many security bugs unfixed

[Michel Le Bihan]

Hello,

I updated the patch disabling openh264:
https://salsa.debian.org/mimi8/chromium/-/blob/master/debian/patches/disable/openh264.patch

I was able to build Chromium with proprietary codec support, but
without openh264.

Michel Le Bihan

On Mon, 14 Dec 2020 21:04:00 +0100 Michel Le Bihan  wrote:
> Hello,
> 
> > I suspect that debian's libvpx might need to be build with
> experimental features enabled (similar to a previous bug report), in
> order to include the absent header files.
> 
> This will build the lib, but the header isn't correctly exported. They
> don't export the header file for that and the internal header used by
> Chromium requires many other internal headers.
> 
> > Are you sure that fixes/sequence-point.patch is necessary? I don't
> recall getting any warnings related to this when compiling.
> 
> I don't know. I don't see the warning mentioned in the commit without
> that patch, but I also don't see the commit in Chromium that could
> change that.
> 
> > Looking at the last couple of commits for the file affected by the
> ozone problem [1], it appears to be already fixed upstream.
> 
> Great! That will make one less patch to update on next release!
> 
> I'm still missing 4 patches:
> buster/icu63: Without that one it might be difficult to get the update
> in Buster
> system/vpx: It's better to use system libs it it isn't too difficult.
> There is one commit in Chromium introducing the usage of that
> experimental feature. Maybe the patch could revert it?
> system/harfbuzz: I didn't investigate what's wrong with it. Just used
> in tree version.
> A patch for proprietary codecs + system ffmpeg.
> 
> Maybe more will be needed for Lintian warnings and errors.
> 
> Does anybody have any of the mentioned patches updated/written? It
> would avoid duplicate work. I know those are the most difficult patches
> to update.
> 
> Michel Le Bihan
> 
> 
> 

Bug#973848: chromium: Unsupported version, many security bugs unfixed

[Jeff Blake]

Hi,

Good work everyone, I've read the thread with interest.

One patch I would question the need for is fixes/inspector.patch.

I'm not sure if it originally fixed a bug (it's in the fixes folder) or was 
desirable for some other reason, but things build fine without it.

It might be better to omit it for the sake of simplicity and reduced 
maintenance burden.


Regards,

Jeff Blake 

Bug#973848: chromium: Unsupported version, many security bugs unfixed

[Jan Luca Naumann]

Hey,

I have uploaded my stuff to
https://salsa.debian.org/janluca-guest/chromium

We can meet in IRC or Matrix. I am janluca on irc.oftc.net.

Best,
Jan

On Mon, 14 Dec 2020 13:59:53 +0100 Michel Le Bihan 
wrote:
> Hello,
> 
> My work is in this repo:
> https://salsa.debian.org/mimi8/chromium/-/tree/master
> 
> I'm updating the commit every time I make a change. Making a new commit
> for each file doesn't really make sense, since those are separate files
> anyway.
> 
> 
> There is another repo from another person that also started work:
> https://github.com/berkley4/ungoogled-chromium-debian/commits/87.0.4280.88
> 
> And another one somebody told me about yesterday:
> https://www.zap.org.au/git-browser/debian-packages/pkg-chromium-browser.git/
> 
> Could you please commit your work to a fork of the Chromium repo on
> Salsa so we can compare patches?
> 
> Also, maybe we could meet on IRC/XMPP/Matrix or somewhere?
> 
> Michel Le Bihan
> 

Bug#973848: chromium: Unsupported version, many security bugs unfixed

[Michel Le Bihan]

Hello,

> I suspect that debian's libvpx might need to be build with
experimental features enabled (similar to a previous bug report), in
order to include the absent header files.

This will build the lib, but the header isn't correctly exported. They
don't export the header file for that and the internal header used by
Chromium requires many other internal headers.

> Are you sure that fixes/sequence-point.patch is necessary? I don't
recall getting any warnings related to this when compiling.

I don't know. I don't see the warning mentioned in the commit without
that patch, but I also don't see the commit in Chromium that could
change that.

> Looking at the last couple of commits for the file affected by the
ozone problem [1], it appears to be already fixed upstream.

Great! That will make one less patch to update on next release!

I'm still missing 4 patches:
buster/icu63: Without that one it might be difficult to get the update
in Buster
system/vpx: It's better to use system libs it it isn't too difficult.
There is one commit in Chromium introducing the usage of that
experimental feature. Maybe the patch could revert it?
system/harfbuzz: I didn't investigate what's wrong with it. Just used
in tree version.
A patch for proprietary codecs + system ffmpeg.

Maybe more will be needed for Lintian warnings and errors.

Does anybody have any of the mentioned patches updated/written? It
would avoid duplicate work. I know those are the most difficult patches
to update.

Michel Le Bihan

Bug#973848: chromium: Unsupported version, many security bugs unfixed

[Michel Le Bihan]

Hello,

My work is in this repo:
https://salsa.debian.org/mimi8/chromium/-/tree/master

I'm updating the commit every time I make a change. Making a new commit
for each file doesn't really make sense, since those are separate files
anyway.


There is another repo from another person that also started work:
https://github.com/berkley4/ungoogled-chromium-debian/commits/87.0.4280.88

And another one somebody told me about yesterday:
https://www.zap.org.au/git-browser/debian-packages/pkg-chromium-browser.git/

Could you please commit your work to a fork of the Chromium repo on
Salsa so we can compare patches?

Also, maybe we could meet on IRC/XMPP/Matrix or somewhere?

Michel Le Bihan

On Mon, 14 Dec 2020 13:12:06 +0100 Jan Luca Naumann  
wrote:
> Hallo everybody,
> 
> I have done some of the work as well since I have not seen your message
> about your efforts. I have uploaded a working build for unstable to
> mentors including updated version of the patches:
> 
> https://mentors.debian.net/package/chromium/
> 
> This version is using the vendor-shipped version of libvpx which should
> be changed but maybe we can put together the work done so far in a Git
> repo and fixes the remaining stuff?
> 
> Best,
> Jan
> 
> On Sun, 13 Dec 2020 14:45:01 -0800 David Worsham  wrote:
> >  Hi there,
> > 
> > Thank you for all of the great work on this so far!
> > 
> > I'm interested in helping with this effort, and very familiar with C++ code
> > and processes in Google code (though not specifically Chromium).  I have
> > gotten the 83/84 versions in unstable/experimental building locally in a
> > container as a sanity check.  I also have a fork on salsa to work from
> > now:  https://salsa.debian.org/arbreng/chromium
> > 
> > However, I am very new to Debian packaging and so not sure what the "ideal"
> > workspace setup and workflow is for this kind of work.  I just kinda made
> > things up as I went along yesterday.  If one of ya'll could walk me through
> > it that would be greatly appreciated - I only know what I learned from
> > the debian Wiki.  I know how to build and hack on Chromium itself -- it's
> > just the packaging bits that are still a bit mystifying to me.
> > 
> > Thanks again for all the effort!
> 
> 

Bug#973848: chromium: Unsupported version, many security bugs unfixed

[Jeff Blake]

On Sat, 12 Dec 2020 19:47:32 +0100 Michel Le Bihan  wrote:
> Hello,
> 
> Thank you for your reply. libvpx got updated in Debian, but I can't use
> it because it's missing a lib. I also had issues with harfbuzz, so I'm
> using bundled versions of those libs as you are. I also used your ozone
> patch because it is match cleaner than mine. With that I was able to
> build Chromium, but with many lint errors and many missing patches.
> 
> BTW, have you tried opening a bug upstream or submitting your ozone
> patch upstream?
> 
> Michel Le Bihan

Hi,

I suspect that debian's libvpx might need to be build with experimental 
features enabled (similar to a previous bug report), in order to include 
the absent header files.

Are you sure that fixes/sequence-point.patch is necessary? I don't recall 
getting any warnings related to this when compiling.

Looking at the last couple of commits for the file affected by the ozone 
problem [1], it appears to be already fixed upstream.

[1] - https://tinyurl.com/yc8y4ah4


Regards,

Jeff

Bug#973848: chromium: Unsupported version, many security bugs unfixed

[Jan Luca Naumann]

Hallo everybody,

I have done some of the work as well since I have not seen your message
about your efforts. I have uploaded a working build for unstable to
mentors including updated version of the patches:

https://mentors.debian.net/package/chromium/

This version is using the vendor-shipped version of libvpx which should
be changed but maybe we can put together the work done so far in a Git
repo and fixes the remaining stuff?

Best,
Jan

On Sun, 13 Dec 2020 14:45:01 -0800 David Worsham  wrote:
>  Hi there,
> 
> Thank you for all of the great work on this so far!
> 
> I'm interested in helping with this effort, and very familiar with C++ code
> and processes in Google code (though not specifically Chromium).  I have
> gotten the 83/84 versions in unstable/experimental building locally in a
> container as a sanity check.  I also have a fork on salsa to work from
> now:  https://salsa.debian.org/arbreng/chromium
> 
> However, I am very new to Debian packaging and so not sure what the "ideal"
> workspace setup and workflow is for this kind of work.  I just kinda made
> things up as I went along yesterday.  If one of ya'll could walk me through
> it that would be greatly appreciated - I only know what I learned from
> the debian Wiki.  I know how to build and hack on Chromium itself -- it's
> just the packaging bits that are still a bit mystifying to me.
> 
> Thanks again for all the effort!

Bug#973848: chromium: Unsupported version, many security bugs unfixed

[David Worsham]

 Hi there,

Thank you for all of the great work on this so far!

I'm interested in helping with this effort, and very familiar with C++ code
and processes in Google code (though not specifically Chromium).  I have
gotten the 83/84 versions in unstable/experimental building locally in a
container as a sanity check.  I also have a fork on salsa to work from
now:  https://salsa.debian.org/arbreng/chromium

However, I am very new to Debian packaging and so not sure what the "ideal"
workspace setup and workflow is for this kind of work.  I just kinda made
things up as I went along yesterday.  If one of ya'll could walk me through
it that would be greatly appreciated - I only know what I learned from
the debian Wiki.  I know how to build and hack on Chromium itself -- it's
just the packaging bits that are still a bit mystifying to me.

Thanks again for all the effort!

On Sat, 12 Dec 2020 19:47:32 +0100 Michel Le Bihan 
wrote:
> Hello,
>
> Thank you for your reply. libvpx got updated in Debian, but I can't use
> it because it's missing a lib. I also had issues with harfbuzz, so I'm
> using bundled versions of those libs as you are. I also used your ozone
> patch because it is match cleaner than mine. With that I was able to
> build Chromium, but with many lint errors and many missing patches.
>
> BTW, have you tried opening a bug upstream or submitting your ozone
> patch upstream?
>
> Michel Le Bihan
>
> On Wed, 9 Dec 2020 04:34:39 + Jeff Blake  wrote:
> > On Tue, 08 Dec 2020 12:33:57 +0100 Michel Le Bihan 
wrote:
> > > Hello,
> > >
> > > I started work on updating the chromium package (you can see my work
> > > here:
> > >
https://salsa.debian.org/mimi8/chromium/-/commit/af70b14701aaf6bdb34e23af01657676e27ba5d4
>

> > ), but got stuck because `libvpx` is too old in Debian testing. It
> > > needs to be updated before I can continue work.
> > >
> > > Michel Le Bihan
> > >
> > >
> > >
> >
> > I've managed to successfully update the ungoogled-chromium debian
package [1], which is based upon
> > the official debian package.
> >
> > Until libvpx is updated (or a new release is made) you could use
Chromium's bundled version of libvpx [2].
> >
> > Feel free to have a look around my repo, as you might well encounter
some of the same problems that
> > I had in getting things to build.
> >
> >
> > Jeff Blake 
> >
> >
> > [1]
https://github.com/berkley4/ungoogled-chromium-debian/commits/87.0.4280.88
>

>
> > [2]
https://github.com/berkley4/ungoogled-chromium-debian/commit/05ffc529e685817aac8a9c5bb419daba17204a66
>

>
> >
> >
>
>
>
>

Bug#973848: chromium: Unsupported version, many security bugs unfixed

[Michel Le Bihan]

Hello,

Thank you for your reply. libvpx got updated in Debian, but I can't use
it because it's missing a lib. I also had issues with harfbuzz, so I'm
using bundled versions of those libs as you are. I also used your ozone
patch because it is match cleaner than mine. With that I was able to
build Chromium, but with many lint errors and many missing patches.

BTW, have you tried opening a bug upstream or submitting your ozone
patch upstream?

Michel Le Bihan

On Wed, 9 Dec 2020 04:34:39 + Jeff Blake  wrote:
> On Tue, 08 Dec 2020 12:33:57 +0100 Michel Le Bihan  wrote:
> > Hello,
> > 
> > I started work on updating the chromium package (you can see my work
> > here:
> > https://salsa.debian.org/mimi8/chromium/-/commit/af70b14701aaf6bdb34e23af01657676e27ba5d4
> > ), but got stuck because `libvpx` is too old in Debian testing. It
> > needs to be updated before I can continue work.
> > 
> > Michel Le Bihan
> > 
> > 
> > 
> 
> I've managed to successfully update the ungoogled-chromium debian package 
> [1], which is based upon 
> the official debian package.
> 
> Until libvpx is updated (or a new release is made) you could use Chromium's 
> bundled version of libvpx [2].
> 
> Feel free to have a look around my repo, as you might well encounter some of 
> the same problems that 
> I had in getting things to build.
> 
> 
> Jeff Blake 
> 
> 
> [1] https://github.com/berkley4/ungoogled-chromium-debian/commits/87.0.4280.88
> 
> [2] 
> https://github.com/berkley4/ungoogled-chromium-debian/commit/05ffc529e685817aac8a9c5bb419daba17204a66
> 
> 
> 

Bug#973848: chromium: Unsupported version, many security bugs unfixed

[Jeff Blake]

On Tue, 08 Dec 2020 12:33:57 +0100 Michel Le Bihan  wrote:
> Hello,
> 
> I started work on updating the chromium package (you can see my work
> here:
> https://salsa.debian.org/mimi8/chromium/-/commit/af70b14701aaf6bdb34e23af01657676e27ba5d4
> ), but got stuck because `libvpx` is too old in Debian testing. It
> needs to be updated before I can continue work.
> 
> Michel Le Bihan
> 
> 
> 

I've managed to successfully update the ungoogled-chromium debian package [1], 
which is based upon 
the official debian package.

Until libvpx is updated (or a new release is made) you could use Chromium's 
bundled version of libvpx [2].

Feel free to have a look around my repo, as you might well encounter some of 
the same problems that 
I had in getting things to build.


Jeff Blake 


[1] https://github.com/berkley4/ungoogled-chromium-debian/commits/87.0.4280.88

[2] 
https://github.com/berkley4/ungoogled-chromium-debian/commit/05ffc529e685817aac8a9c5bb419daba17204a66

Bug#973848: chromium: Unsupported version, many security bugs unfixed

[Michel Le Bihan]

Hello,

I started work on updating the chromium package (you can see my work
here:
https://salsa.debian.org/mimi8/chromium/-/commit/af70b14701aaf6bdb34e23af01657676e27ba5d4
), but got stuck because `libvpx` is too old in Debian testing. It
needs to be updated before I can continue work.

Michel Le Bihan