History

Michael Weiss 531decc11d chromium: 86.0.4240.111 -> 86.0.4240.183 https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop.html This update includes 10 security fixes. Google is aware of reports that an exploit for CVE-2020-16009 exists in the wild. CVEs: CVE-2020-16004 CVE-2020-16005 CVE-2020-16006 CVE-2020-16007 CVE-2020-16008 CVE-2020-16009 CVE-2020-16011		2020-11-03 11:14:20 +01:00
..
patches	chromium: Drop the libwebp include patch	2020-10-15 14:33:15 +02:00
browser.nix	chromiumDev: Mark as broken for now	2020-10-23 19:47:43 +02:00
common.nix	chromium: use official build settings (#101467 )	2020-10-24 12:27:40 +02:00
default.nix	chromium: Drop useVaapi (was deprecated)	2020-10-29 13:48:38 +01:00
plugins.nix	flashplayer: 32.0.0.433 -> 32.0.0.445	2020-10-13 21:13:22 +09:00
README.md	chromiumDev: Mark as broken for now	2020-10-23 19:47:43 +02:00
update.py	chromium: update.py: Keep the channel order consistent	2020-09-10 12:30:03 +02:00
upstream-info.json	chromium: 86.0.4240.111 -> 86.0.4240.183	2020-11-03 11:14:20 +01:00

README.md

Maintainers

TODO: We need more maintainers:
- https://github.com/NixOS/nixpkgs/issues/78450
- If you just want to help out without becoming a maintainer:
  - Look for open Nixpkgs issues or PRs related to Chromium
  - Make your own PRs (but please try to make reviews as easy as possible)
Primary maintainer (responsible for updating Chromium): @primeos
Testers (test all stable channel updates)
- nixos-unstable:
  - x86_64: @danielfullmer
  - aarch64: @thefloweringash
- Stable channel:
  - x86_64: @Frostman
Other relevant packages:
- chromiumBeta and chromiumDev: For testing purposes (not build on Hydra)
- google-chrome, google-chrome-beta, google-chrome-dev: Updated via Chromium's upstream-info.json
- ungoogled-chromium: Based on chromium (the expressions are regularly copied over and patched accordingly)

Upstream links

Source code: https://source.chromium.org/chromium/chromium/src
Bugs: https://bugs.chromium.org/p/chromium/issues/list
Release updates: https://chromereleases.googleblog.com/
- Available as Atom or RSS feed (filter for "Stable Channel Update for Desktop")
- Channel overview: https://omahaproxy.appspot.com/
- Release schedule: https://chromiumdash.appspot.com/schedule

Updating Chromium

Simply run ./pkgs/applications/networking/browsers/chromium/update.py to update upstream-info.json. After updates it is important to test at least nixosTests.chromium (or basic manual testing) and google-chrome (which reuses upstream-info.json).

Backports

All updates are considered security critical and should be ported to the stable channel ASAP. When there is a new stable release the old one should receive security updates for roughly one month. After that it is important to mark Chromium as insecure (see 69e4ae56c4b for an example; it is important that the tested job still succeeds and that all browsers that use upstream-info.json are marked as insecure).

Major version updates

Unfortunately, Chromium regularly breaks on major updates and might need various patches. Either due to issues with the Nix build sandbox (e.g. we cannot fetch dependencies via the network and do not use standard FHS paths) or due to missing upstream fixes that need to be backported.

Good sources for such patches and other hints:

If the build fails immediately due to unknown compiler flags this usually means that a new major release of LLVM is required.

Beta and Dev channels

Those channels are only used to test and fix builds in advance. They may be broken at times and must not delay stable channel updates.