aszlig
0aad4b7ee4
Overview of the updated versions: stable: 40.0.2214.91 -> 40.0.2214.115 beta: 41.0.2272.16 -> 41.0.2272.64 dev: 41.0.2272.16 -> 42.0.2305.3 Introduces 42.0.2305.3 as the new dev version, which no longer requires our user namespaces sandbox patch. Thanks to everyone participating in https://crbug.com/312380 for finally having this upstream. In the course of supporting the official namespace sandbox (that's what the user namespace sandbox is called), a few things needed to be fixed for version 42: * Add an updated nix_plugin_paths.patch, because the old one tries to patch the path for libpdf, which is now natively included in Chromium. * Don't copy libpdf.so to libexec path for version 42, it's no longer needed as it's completely built-in now. * Disable SUID sandbox directly in the source instead of going the easy route of passing --disable-setuid-sandbox. The reason is that with the command line flag a nasty nagbar will appear. Signed-off-by: aszlig <aszlig@redmoonstudios.org>
80 lines
1.9 KiB
Nix
80 lines
1.9 KiB
Nix
{ stdenv, fetchurl, python
|
|
, channel ? "stable"
|
|
, useOpenSSL # XXX
|
|
}:
|
|
|
|
with stdenv.lib;
|
|
|
|
with (import ./update.nix {
|
|
inherit (stdenv) system;
|
|
}).getChannel channel;
|
|
|
|
let
|
|
pre42 = versionOlder version "42.0.0.0";
|
|
in stdenv.mkDerivation {
|
|
name = "chromium-source-${version}";
|
|
|
|
src = fetchurl main;
|
|
|
|
buildInputs = [ python ]; # cannot patch shebangs otherwise
|
|
|
|
phases = [ "unpackPhase" "patchPhase" "installPhase" ];
|
|
|
|
opensslPatches = optional useOpenSSL openssl.patches;
|
|
|
|
prePatch = "patchShebangs .";
|
|
|
|
patches = if pre42 then [
|
|
./sandbox_userns_36.patch ./nix_plugin_paths.patch
|
|
] else [
|
|
./nix_plugin_paths_42.patch
|
|
];
|
|
|
|
postPatch = ''
|
|
sed -i -r \
|
|
-e 's/-f(stack-protector)(-all)?/-fno-\1/' \
|
|
-e 's|/bin/echo|echo|' \
|
|
-e "/python_arch/s/: *'[^']*'/: '""'/" \
|
|
build/common.gypi chrome/chrome_tests.gypi
|
|
'' + optionalString useOpenSSL ''
|
|
cat $opensslPatches | patch -p1 -d third_party/openssl/openssl
|
|
'' + optionalString (!pre42) ''
|
|
sed -i -e '/LOG.*no_suid_error/d' \
|
|
"$main/content/browser/browser_main_loop.cc"
|
|
'';
|
|
|
|
outputs = [ "out" "sandbox" "bundled" "main" ];
|
|
installPhase = ''
|
|
mkdir -p "$out" "$sandbox" "$bundled" "$main"
|
|
|
|
header "copying browser main sources to $main"
|
|
find . -mindepth 1 -maxdepth 1 \
|
|
\! -path ./sandbox \
|
|
\! -path ./third_party \
|
|
\! -path ./build \
|
|
\! -path ./tools \
|
|
\! -name '.*' \
|
|
-print | xargs cp -rt "$main"
|
|
stopNest
|
|
|
|
header "copying sandbox components to $sandbox"
|
|
cp -rt "$sandbox" sandbox/*
|
|
stopNest
|
|
|
|
header "copying third party sources to $bundled"
|
|
cp -rt "$bundled" third_party/*
|
|
stopNest
|
|
|
|
header "copying build requisites to $out"
|
|
cp -rt "$out" build tools
|
|
stopNest
|
|
|
|
rm -rf "$out/tools/gyp" # XXX: Don't even copy it in the first place.
|
|
'';
|
|
|
|
passthru = {
|
|
inherit version channel;
|
|
plugins = fetchurl binary;
|
|
};
|
|
}
|