public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [rpms/chromium] epel9-next: - update to 127.0.6533.72
@ 2026-08-07 16:06 Than Ngo
0 siblings, 0 replies; only message in thread
From: Than Ngo @ 2026-08-07 16:06 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/chromium
Branch : epel9-next
Commit : 5b27efc518c86b93dd2f30e877536599ed07beac
Author : Than Ngo <than@redhat.com>
Date : 2024-07-24T23:45:03+02:00
Stats : +241/-21 in 5 file(s)
URL : https://src.fedoraproject.org/rpms/chromium/c/5b27efc518c86b93dd2f30e877536599ed07beac?branch=epel9-next
Log:
- update to 127.0.6533.72
* CVE-2024-6988: Use after free in Downloads
* CVE-2024-6989: Use after free in Loader
* CVE-2024-6991: Use after free in Dawn
* CVE-2024-6992: Out of bounds memory access in ANGLE
* CVE-2024-6993: Inappropriate implementation in Canvas
* CVE-2024-6994: Heap buffer overflow in Layout
* CVE-2024-6995: Inappropriate implementation in Fullscreen
* CVE-2024-6996: Race in Frames
* CVE-2024-6997: Use after free in Tabs
* CVE-2024-6998: Use after free in User Education
* CVE-2024-6999: Inappropriate implementation in FedCM
* CVE-2024-7000: Use after free in CSS. Reported by Anonymous
* CVE-2024-7001: Inappropriate implementation in HTML
* CVE-2024-7003: Inappropriate implementation in FedCM
* CVE-2024-7004: Insufficient validation of untrusted input in Safe Browsing
* CVE-2024-7005: Insufficient validation of untrusted input in Safe
- remove unsupported use_gold, use_goma
- enable bootstrap for epel as gn is old (need to update gn on epel)
- enable bundleicu and bundledav1d (need to update icu and dav1d)
- apply upstream patches to fix build issues with ninja-1.21.1 (fedora >39)
- pipewire is old on el8, new version is required, disable it temporary
---
diff --git a/chromium-127-ninja-1.21.1-deps-part0.patch b/chromium-127-ninja-1.21.1-deps-part0.patch
new file mode 100644
index 0000000..52581fd
--- /dev/null
+++ b/chromium-127-ninja-1.21.1-deps-part0.patch
@@ -0,0 +1,44 @@
+commit 4ca70656fde83d2db6ed5a8ac9ec9e7443846924
+Author: Lei Zhang <thestig@chromium.org>
+Date: Wed Jun 26 16:35:34 2024 +0000
+
+ Move chrome/browser/ui:webui_name_variants to public_deps
+
+ The chrome/browser/ui build target contains webui_contents_wrapper.h,
+ which included the generated webui_name_variants.h header. For this to
+ work correctly, the build system must process the webui_name_variants
+ target first and generate webui_name_variants.h. To do this reliably,
+ without having to depend on webui_name_variants in all targets that
+ transitively include webui_contents_wrapper.h, make it a public_deps.
+
+ Bug: 40253918, 346711540, 346699817, 345645751
+ Change-Id: I6e0b573427cda1b2b408702f139b2c9e83f05045
+ Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5646245
+ Reviewed-by: Anthony Vallée-Dubois <anthonyvd@chromium.org>
+ Commit-Queue: Lei Zhang <thestig@chromium.org>
+ Cr-Commit-Position: refs/heads/main@{#1319828}
+
+diff --git a/chrome/browser/ui/BUILD.gn b/chrome/browser/ui/BUILD.gn
+index 46648a4c2194e..0883714163a31 100644
+--- a/chrome/browser/ui/BUILD.gn
++++ b/chrome/browser/ui/BUILD.gn
+@@ -6436,7 +6436,6 @@ static_library("ui") {
+ }
+
+ deps += [
+- ":webui_name_variants",
+ "side_search:side_search_tab_data_proto",
+ "//base",
+ "//chrome/browser:main_extra_parts",
+@@ -6495,7 +6494,10 @@ static_library("ui") {
+ "//ui/lottie",
+ "//ui/views:buildflags",
+ ]
+- public_deps += [ "//ui/base/dragdrop/mojom:mojom_headers" ]
++ public_deps += [
++ ":webui_name_variants",
++ "//ui/base/dragdrop/mojom:mojom_headers",
++ ]
+
+ allow_circular_includes_from += [ "//chrome/browser/ui/views" ]
+
diff --git a/chromium-127-ninja-1.21.1-deps-part1.patch b/chromium-127-ninja-1.21.1-deps-part1.patch
new file mode 100644
index 0000000..6d62b32
--- /dev/null
+++ b/chromium-127-ninja-1.21.1-deps-part1.patch
@@ -0,0 +1,62 @@
+commit 50d63ffee3f7f1b1b9303363742ad8ebbfec31fa
+Author: Lei Zhang <thestig@chromium.org>
+Date: Wed Jun 26 21:27:51 2024 +0000
+
+ Make more deps entries public_deps in chrome/browser/ui/BUILD.gn
+
+ The chrome/browser/ui build target includes several buildflag headers.
+ For this to work correctly, the build system must be able to generate
+ the buildflag headers first. To do this reliably, without having to
+ depend on buildflag targets in all targets that transitively include the
+ headers that includes buildflag heaers, make these dependencies
+ public_deps.
+
+ For //components/paint_preview/buildflags, remove the deps entry, as it
+ is already in public_deps.
+
+ Bug: 40253918, 346711540, 346699817, 345645751
+ Change-Id: I00e78a430f2e99aa3732406882b352d31e3d7da7
+ Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5647662
+ Commit-Queue: Lei Zhang <thestig@chromium.org>
+ Reviewed-by: Peter Kasting <pkasting@chromium.org>
+ Cr-Commit-Position: refs/heads/main@{#1320033}
+
+diff --git a/chrome/browser/ui/BUILD.gn b/chrome/browser/ui/BUILD.gn
+index bc6a7c03ecd1c..74f92f0431494 100644
+--- a/chrome/browser/ui/BUILD.gn
++++ b/chrome/browser/ui/BUILD.gn
+@@ -415,8 +415,10 @@ static_library("ui") {
+ "//chrome/browser/ui/tabs:tab_enums",
+ "//components/cross_device/logging",
+ "//components/dom_distiller/core",
++ "//components/enterprise/buildflags",
+ "//components/paint_preview/buildflags",
+ "//components/safe_browsing:buildflags",
++ "//components/segmentation_platform/public",
+ "//components/sync",
+ "//components/sync_user_events",
+ "//components/translate/content/browser",
+@@ -533,7 +535,6 @@ static_library("ui") {
+ "//components/embedder_support:browser_util",
+ "//components/encrypted_messages:encrypted_message_proto",
+ "//components/enterprise",
+- "//components/enterprise/buildflags:buildflags",
+ "//components/error_page/content/browser",
+ "//components/facilitated_payments/core/features",
+ "//components/favicon/content",
+@@ -644,7 +645,6 @@ static_library("ui") {
+ "//components/security_interstitials/core:unsafe_resource",
+ "//components/security_state/content",
+ "//components/security_state/core",
+- "//components/segmentation_platform/public",
+ "//components/send_tab_to_self",
+ "//components/sessions",
+ "//components/sharing_message",
+@@ -2119,7 +2119,6 @@ static_library("ui") {
+ "//components/omnibox/browser:mojo_bindings",
+ "//components/page_load_metrics/browser",
+ "//components/paint_preview/browser",
+- "//components/paint_preview/buildflags",
+ "//components/paint_preview/common",
+ "//components/paint_preview/public",
+ "//components/password_manager/content/common",
diff --git a/chromium-127-ninja-1.21.1-deps-part2.patch b/chromium-127-ninja-1.21.1-deps-part2.patch
new file mode 100644
index 0000000..8cfce7a
--- /dev/null
+++ b/chromium-127-ninja-1.21.1-deps-part2.patch
@@ -0,0 +1,37 @@
+commit 2c101186b60ed50f2ba4feaa2e963bd841bcca47
+Author: Takuto Ikuta <tikuta@chromium.org>
+Date: Fri Jun 21 06:23:27 2024 +0000
+
+ chrome/browser: add missing dependency
+
+ This is to fix build error due to missing dependency when we update
+ ninja to 1.12.
+ e.g. https://ci.chromium.org/ui/p/chromium/builders/build/linux-build-perf-no-rbe/1690/overview
+
+ Bug: 346711540, 346699817, 345645751, 40253918
+ Change-Id: Ife0a4e09969a4ad2e61dfc1598c9a63ac0b2abd5
+ Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5641516
+ Reviewed-by: Anthony Vallée-Dubois <anthonyvd@chromium.org>
+ Commit-Queue: Takuto Ikuta <tikuta@chromium.org>
+ Auto-Submit: Takuto Ikuta <tikuta@chromium.org>
+ Reviewed-by: Lei Zhang <thestig@chromium.org>
+ Cr-Commit-Position: refs/heads/main@{#1317790}
+
+diff --git a/chrome/browser/ui/views/side_panel/BUILD.gn b/chrome/browser/ui/views/side_panel/BUILD.gn
+index 96f2c30a6dd22..2957730277a29 100644
+--- a/chrome/browser/ui/views/side_panel/BUILD.gn
++++ b/chrome/browser/ui/views/side_panel/BUILD.gn
+@@ -201,5 +201,13 @@ source_set("side_panel") {
+ "//ui/gfx:color_utils",
+ "//ui/gfx/geometry:geometry_skia",
+ "//ui/webui",
++
++ # TODO(crbug.com/346711540,crbug.com/346699817,crbug.com/345645751):
++ # Use //chrome/browser/ui instead after fixing cyclic dependency.
++ "//chrome/browser/ui:webui_name_variants",
++ "//components/enterprise/buildflags",
++ "//components/paint_preview/buildflags",
++ "//components/segmentation_platform/public/proto",
++ "//components/webapps/common:mojo_bindings",
+ ]
+ }
diff --git a/chromium-127-ninja-1.21.1-deps-part3.patch b/chromium-127-ninja-1.21.1-deps-part3.patch
new file mode 100644
index 0000000..bfb46d9
--- /dev/null
+++ b/chromium-127-ninja-1.21.1-deps-part3.patch
@@ -0,0 +1,49 @@
+commit f2b43c18b8ecfc3ddc49c42c062d796c8b563984
+Author: Takuto Ikuta <tikuta@chromium.org>
+Date: Wed Jul 3 09:00:47 2024 +0000
+
+ chrome/browser/ui: add missing dependency
+
+ This is to fix build error due to missing dependency when we update
+ ninja to 1.12.
+ e.g. https://ci.chromium.org/ui/p/chromium/builders/build.shadow/win-build-perf-developer/1/overview
+
+ Bug: 40253918, 345645751, 346694160, 346709958, 346707816
+ Change-Id: I3ede8e345aef5d6d2d8bf5b155601650828bc817
+ Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5644627
+ Reviewed-by: Hidehiko Abe <hidehiko@chromium.org>
+ Auto-Submit: Takuto Ikuta <tikuta@chromium.org>
+ Commit-Queue: Takuto Ikuta <tikuta@chromium.org>
+ Reviewed-by: Lei Zhang <thestig@chromium.org>
+ Cr-Commit-Position: refs/heads/main@{#1322655}
+
+diff --git a/chrome/browser/ui/views/side_panel/BUILD.gn b/chrome/browser/ui/views/side_panel/BUILD.gn
+index 2957730277a29..2680a77d855d5 100644
+--- a/chrome/browser/ui/views/side_panel/BUILD.gn
++++ b/chrome/browser/ui/views/side_panel/BUILD.gn
+@@ -202,12 +202,24 @@ source_set("side_panel") {
+ "//ui/gfx/geometry:geometry_skia",
+ "//ui/webui",
+
+- # TODO(crbug.com/346711540,crbug.com/346699817,crbug.com/345645751):
++ # TODO(crbug.com/345645751): Use //chrome/browser instead after fixing cyclic dependency.
++ "//components/enterprise/common/proto:connectors_proto",
++
++ # TODO(crbug.com/346711540,crbug.com/346699817,crbug.com/345645751,
++ # crbug.com/346694160,crbug.com/346709958,crbug.com/346707816):
+ # Use //chrome/browser/ui instead after fixing cyclic dependency.
++ "//chrome/browser/cart:mojo_bindings",
++ "//chrome/browser/companion/visual_query",
+ "//chrome/browser/ui:webui_name_variants",
++ "//chrome/browser/ui/webui/side_panel/bookmarks:mojo_bindings",
++ "//chrome/browser/ui/webui/side_panel/customize_chrome:mojo_bindings",
++ "//chrome/browser/ui/webui/side_panel/reading_list:mojo_bindings",
+ "//components/enterprise/buildflags",
++ "//components/page_image_service/mojom:mojo_bindings",
+ "//components/paint_preview/buildflags",
+ "//components/segmentation_platform/public/proto",
++ "//components/user_education/webui",
+ "//components/webapps/common:mojo_bindings",
++ "//ui/webui/resources/cr_components/commerce:mojo_bindings",
+ ]
+ }
diff --git a/chromium.spec b/chromium.spec
index 7750c4d..47fe68e 100644
--- a/chromium.spec
+++ b/chromium.spec
@@ -1,4 +1,5 @@
%define _lto_cflags %{nil}
+%global _default_patch_fuzz 2
# enable|disable system build flags
%global system_build_flags 0
@@ -22,6 +23,10 @@
# enable|disble bootstrap
%global bootstrap 0
+# workaround for old gn on rhel, it causes build error: unknown function filter_labels_include()
+%if 0%{?rhel}
+%global bootstrap 1
+%endif
# Fancy build status, so we at least know, where we are..
# %1 where
@@ -75,7 +80,7 @@
# v4l2_codec only enable for fedora aarch64
%global use_v4l2_codec 0
-# libva is too old on el8.
+# libva is too old on el8
%if 0%{?rhel} == 8
%global use_vaapi 0
%endif
@@ -102,10 +107,6 @@
%endif
%endif
-# Seems like we might need this sometimes
-# Practically, no. But it's here in case we do.
-%global use_gold 0
-
%global build_clear_key_cdm 0
# Disabled because of Google, starting with Chromium 88.
@@ -196,6 +197,8 @@
%global bundlelibaom 1
%global bundlelibavif 1
%global bundlesnappy 1
+%global bundleicu 1
+%global bundledav1d 1
%global bundlepylibs 0
%global bundlelibxslt 0
%global bundleflac 0
@@ -226,7 +229,6 @@
%global bundlefontconfig 1
%global bundleffmpegfree 1
%global bundlebrotli 1
-%global bundleicu 1
%global bundlelibopenjpeg2 1
%global bundlelibtiff 1
%global bundlecrc32c 1
@@ -235,14 +237,11 @@
%else
%if 0%{?fedora} > 38 || 0%{?rhel} > 9
%global bundlebrotli 0
-%global bundleicu 0
%global bundlelibwebp 0
%else
%global bundlebrotli 1
-%global bundleicu 1
%global bundlelibwebp 1
%endif
-%global bundledav1d 0
%global bundlelibpng 0
%global bundlelibjpeg 0
%global bundlelibdrm 0
@@ -295,8 +294,8 @@
%endif
Name: chromium%{chromium_channel}
-Version: 126.0.6478.182
-Release: 2%{?dist}
+Version: 127.0.6533.72
+Release: 1%{?dist}
Summary: A WebKit (Blink) powered web browser that Google doesn't want you to use
Url: http://www.chromium.org/Home
License: BSD-3-Clause AND LGPL-2.1-or-later AND Apache-2.0 AND IJG AND MIT AND GPL-2.0-or-later AND ISC AND OpenSSL AND (MPL-1.1 OR GPL-2.0-only OR LGPL-2.0-only)
@@ -471,6 +470,12 @@ Patch412: fix-unknown-warning-option-messages.diff
# error: undefined symbol: llvm::MCAsmInfoXCOFF::MCAsmInfoXCOFF()
Patch413: fix-swiftshader-compile.patch
+# upstream patches
+Patch501: chromium-127-ninja-1.21.1-deps-part0.patch
+Patch502: chromium-127-ninja-1.21.1-deps-part1.patch
+Patch503: chromium-127-ninja-1.21.1-deps-part2.patch
+Patch504: chromium-127-ninja-1.21.1-deps-part3.patch
+
# Use chromium-latest.py to generate clean tarball from released build tarballs, found here:
# http://build.chromium.org/buildbot/official/
# For Chromium Fedora use chromium-latest.py --stable --ffmpegclean --ffmpegarm
@@ -635,8 +640,9 @@ BuildRequires: pciutils-devel
BuildRequires: pulseaudio-libs-devel
# For screen sharing on Wayland
-%if 0%{?fedora} || 0%{?rhel} >= 8
-BuildRequires: pkgconfig(libpipewire-0.3)
+# pipewire is old on el8, chromium needs new version, disable it temporary
+%if 0%{?fedora} || 0%{?rhel} > 8
+BuildRequires: pipewire-devel
%endif
# for /usr/bin/appstream-util
@@ -1179,11 +1185,19 @@ Qt6 UI for chromium.
%patch -P413 -p1 -b .fix-swiftshader-compile
%endif
+%if 0%{?fedora} > 39
+%patch -P501 -p1 -b .ninja-1.21.1-deps
+%patch -P502 -p1 -b .ninja-1.21.1-deps
+%patch -P503 -p1 -b .ninja-1.21.1-deps
+%patch -P504 -p1 -b .ninja-1.21.1-deps
+%endif
+
# Change shebang in all relevant files in this directory and all subdirectories
# See `man find` for how the `-exec command {} +` syntax works
find -type f \( -iname "*.py" \) -exec sed -i '1s=^#! */usr/bin/\(python\|env python\)[23]\?=#!%{chromium_pybin}=' {} +
# Add correct path for nodejs binary
+rm -rf third_party/node/linux/node-linux-x64*
%if ! %{system_nodejs}
pushd third_party/node/linux
%ifarch x86_64
@@ -1311,7 +1325,6 @@ CHROMIUM_CORE_GN_DEFINES=""
CHROMIUM_CORE_GN_DEFINES+=' custom_toolchain="//build/toolchain/linux/unbundle:default"'
CHROMIUM_CORE_GN_DEFINES+=' host_toolchain="//build/toolchain/linux/unbundle:default"'
CHROMIUM_CORE_GN_DEFINES+=' is_debug=false dcheck_always_on=false dcheck_is_configurable=false'
-CHROMIUM_CORE_GN_DEFINES+=' use_goma=false'
CHROMIUM_CORE_GN_DEFINES+=' enable_nacl=false'
CHROMIUM_CORE_GN_DEFINES+=' system_libdir="%{_lib}"'
@@ -1354,12 +1367,6 @@ CHROMIUM_CORE_GN_DEFINES+=" rustc_version=\"$rustc_version\""
CHROMIUM_CORE_GN_DEFINES+=' use_sysroot=false'
-%if %{use_gold}
-CHROMIUM_CORE_GN_DEFINES+=' use_gold=true'
-%else
-CHROMIUM_CORE_GN_DEFINES+=' use_gold=false'
-%endif
-
%ifarch aarch64
CHROMIUM_CORE_GN_DEFINES+=' target_cpu="arm64"'
%endif
@@ -1429,8 +1436,10 @@ CHROMIUM_BROWSER_GN_DEFINES+=' use_vaapi=false'
CHROMIUM_BROWSER_GN_DEFINES+=' use_v4l2_codec=true'
%endif
-%if 0%{?fedora} || 0%{?rhel} >= 8
+%if 0%{?fedora} || 0%{?rhel} > 8
CHROMIUM_BROWSER_GN_DEFINES+=' rtc_use_pipewire=true rtc_link_pipewire=true'
+%else
+CHROMIUM_BROWSER_GN_DEFINES+=' rtc_use_pipewire=false rtc_link_pipewire=false'
%endif
%if ! %{bundlelibjpeg}
@@ -1979,6 +1988,25 @@ getent group chrome-remote-desktop >/dev/null || groupadd -r chrome-remote-deskt
%endif
%changelog
+* Wed Jul 24 2024 Than Ngo <than@redhat.com> - 127.0.6533.72-1
+- update to 127.0.6533.72
+ * CVE-2024-6988: Use after free in Downloads
+ * CVE-2024-6989: Use after free in Loader
+ * CVE-2024-6991: Use after free in Dawn
+ * CVE-2024-6992: Out of bounds memory access in ANGLE
+ * CVE-2024-6993: Inappropriate implementation in Canvas
+ * CVE-2024-6994: Heap buffer overflow in Layout
+ * CVE-2024-6995: Inappropriate implementation in Fullscreen
+ * CVE-2024-6996: Race in Frames
+ * CVE-2024-6997: Use after free in Tabs
+ * CVE-2024-6998: Use after free in User Education
+ * CVE-2024-6999: Inappropriate implementation in FedCM
+ * CVE-2024-7000: Use after free in CSS. Reported by Anonymous
+ * CVE-2024-7001: Inappropriate implementation in HTML
+ * CVE-2024-7003: Inappropriate implementation in FedCM
+ * CVE-2024-7004: Insufficient validation of untrusted input in Safe Browsing
+ * CVE-2024-7005: Insufficient validation of untrusted input in Safe
+
* Sat Jul 20 2024 Than Ngo <than@redhat.com> - 126.0.6478.182-2
- fix condition for is_cfi/use_thin_lto on aarch64/ppc64le
- update powerpc patches
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-08-07 16:06 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-08-07 16:06 [rpms/chromium] epel9-next: - update to 127.0.6533.72 Than Ngo
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox