diff options
22 files changed, 1073 insertions, 402 deletions
diff --git a/pkgs/applications/networking/browsers/chromium/browser.nix b/pkgs/applications/networking/browsers/chromium/browser.nix new file mode 100644 index 000000000000..a4b99bc58023 --- /dev/null +++ b/pkgs/applications/networking/browsers/chromium/browser.nix @@ -0,0 +1,40 @@ +{ stdenv, mkChromiumDerivation }: + +with stdenv.lib; + +mkChromiumDerivation (base: rec { + name = "chromium-browser"; + packageName = "chromium"; + buildTargets = [ "chrome" ]; + + installPhase = '' + ensureDir "$libExecPath" + cp -v "$buildPath/"*.pak "$libExecPath/" + cp -v "$buildPath/icudtl.dat" "$libExecPath/" + cp -vR "$buildPath/locales" "$buildPath/resources" "$libExecPath/" + cp -v $buildPath/libffmpegsumo.so "$libExecPath/" + + cp -v "$buildPath/chrome" "$libExecPath/$packageName" + + mkdir -vp "$out/share/man/man1" + cp -v "$buildPath/chrome.1" "$out/share/man/man1/$packageName.1" + + for icon_file in chrome/app/theme/chromium/product_logo_*[0-9].png; do + num_and_suffix="''${icon_file##*logo_}" + icon_size="''${num_and_suffix%.*}" + expr "$icon_size" : "^[0-9][0-9]*$" || continue + logo_output_prefix="$out/share/icons/hicolor" + logo_output_path="$logo_output_prefix/''${icon_size}x''${icon_size}/apps" + mkdir -vp "$logo_output_path" + cp -v "$icon_file" "$logo_output_path/$packageName.png" + done + ''; + + meta = { + description = "An open source web browser from Google"; + homepage = http://www.chromium.org/; + maintainers = with maintainers; [ goibhniu chaoflow aszlig wizeman ]; + license = licenses.bsd3; + platforms = platforms.linux; + }; +}) diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix new file mode 100644 index 000000000000..7bed83ac4c6d --- /dev/null +++ b/pkgs/applications/networking/browsers/chromium/common.nix @@ -0,0 +1,201 @@ +{ stdenv, fetchurl, ninja, which + +# default dependencies +, bzip2, flac, speex, icu, libopus +, libevent, expat, libjpeg, snappy +, libpng, libxml2, libxslt +, xdg_utils, yasm, minizip, libwebp +, libusb1, libexif, pciutils + +, python, pythonPackages, perl, pkgconfig +, nspr, udev, krb5 +, utillinux, alsaLib +, gcc, bison, gperf +, glib, gtk, dbus_glib +, libXScrnSaver, libXcursor, libXtst, mesa +, protobuf, speechd, libXdamage + +# optional dependencies +, libgcrypt ? null # gnomeSupport || cupsSupport + +# package customization +, enableSELinux ? false, libselinux ? null +, enableNaCl ? false +, useOpenSSL ? false, nss ? null, openssl ? null +, gnomeSupport ? false, gnome ? null +, gnomeKeyringSupport ? false, libgnome_keyring3 ? null +, proprietaryCodecs ? true +, cupsSupport ? false +, pulseSupport ? false, pulseaudio ? null + +, source +, plugins +}: + +buildFun: + +with stdenv.lib; + +let + # The additional attributes for creating derivations based on the chromium + # source tree. + extraAttrs = buildFun base; + + mkGypFlags = + let + sanitize = value: + if value == true then "1" + else if value == false then "0" + else "${value}"; + toFlag = key: value: "-D${key}=${sanitize value}"; + in attrs: concatStringsSep " " (attrValues (mapAttrs toFlag attrs)); + + gypFlagsUseSystemLibs = { + use_system_bzip2 = true; + use_system_flac = true; + use_system_libevent = true; + use_system_libexpat = true; + use_system_libexif = true; + use_system_libjpeg = true; + use_system_libpng = true; + use_system_libwebp = true; + use_system_libxml = true; + use_system_opus = true; + use_system_snappy = true; + use_system_speex = true; + use_system_ssl = useOpenSSL; + use_system_stlport = true; + use_system_xdg_utils = true; + use_system_yasm = true; + use_system_zlib = false; + use_system_protobuf = true; + + use_system_harfbuzz = false; + use_system_icu = false; # Doesn't support ICU 52 yet. + use_system_libusb = false; # http://crbug.com/266149 + use_system_skia = false; + use_system_sqlite = false; # http://crbug.com/22208 + use_system_v8 = false; + }; + + opusWithCustomModes = libopus.override { + withCustomModes = !versionOlder source.version "35.0.0.0"; + }; + + defaultDependencies = [ + bzip2 flac speex icu opusWithCustomModes + libevent expat libjpeg snappy + libpng libxml2 libxslt + xdg_utils yasm minizip libwebp + libusb1 libexif + ]; + + # build paths and release info + packageName = extraAttrs.packageName or extraAttrs.name; + buildType = "Release"; + buildPath = "out/${buildType}"; + libExecPath = "$out/libexec/${packageName}"; + + base = rec { + name = "${packageName}-${version}"; + inherit (source) version; + inherit packageName buildType buildPath; + src = source; + + buildInputs = defaultDependencies ++ [ + which + python perl pkgconfig + nspr udev + (if useOpenSSL then openssl else nss) + utillinux alsaLib + gcc bison gperf krb5 + glib gtk dbus_glib + libXScrnSaver libXcursor libXtst mesa + pciutils protobuf speechd libXdamage + pythonPackages.gyp pythonPackages.ply pythonPackages.jinja2 + ] ++ optional gnomeKeyringSupport libgnome_keyring3 + ++ optionals gnomeSupport [ gnome.GConf libgcrypt ] + ++ optional enableSELinux libselinux + ++ optional cupsSupport libgcrypt + ++ optional pulseSupport pulseaudio; + + # XXX: Wait for https://crbug.com/239107 and https://crbug.com/239181 to + # be fixed, then try again to unbundle everything into separate + # derivations. + prePatch = '' + cp -dsr --no-preserve=mode "${source.main}"/* . + cp -dsr --no-preserve=mode "${source.sandbox}" sandbox + cp -dr "${source.bundled}" third_party + chmod -R u+w third_party + + # Hardcode source tree root in all gyp files + find -iname '*.gyp*' \( -type f -o -type l \) \ + -exec sed -i -e 's|<(DEPTH)|'"$(pwd)"'|g' {} + \ + -exec chmod u+w {} + + ''; + + postPatch = '' + sed -i -e '/base::FilePath exe_dir/,/^ *} *$/c \ + sandbox_binary = base::FilePath(getenv("CHROMIUM_SANDBOX_BINARY_PATH")); + ' content/browser/browser_main_loop.cc + ''; + + gypFlags = mkGypFlags (gypFlagsUseSystemLibs // { + linux_use_gold_binary = false; + linux_use_gold_flags = false; + proprietary_codecs = false; + use_gnome_keyring = gnomeKeyringSupport; + use_gconf = gnomeSupport; + use_gio = gnomeSupport; + use_pulseaudio = pulseSupport; + disable_nacl = !enableNaCl; + use_openssl = useOpenSSL; + selinux = enableSELinux; + use_cups = cupsSupport; + linux_sandbox_chrome_path="${libExecPath}/${packageName}"; + werror = ""; + + # Google API keys, see: + # http://www.chromium.org/developers/how-tos/api-keys + # Note: These are for NixOS/nixpkgs use ONLY. For your own distribution, + # please get your own set of keys. + google_api_key = "AIzaSyDGi15Zwl11UNe6Y-5XW_upsfyw31qwZPI"; + google_default_client_id = "404761575300.apps.googleusercontent.com"; + google_default_client_secret = "9rIFQjfnkykEmqb6FfjJQD1D"; + + } // optionalAttrs proprietaryCodecs { + # enable support for the H.264 codec + proprietary_codecs = true; + ffmpeg_branding = "Chrome"; + } // optionalAttrs (stdenv.system == "x86_64-linux") { + target_arch = "x64"; + python_arch = "x86-64"; + } // optionalAttrs (stdenv.system == "i686-linux") { + target_arch = "ia32"; + python_arch = "ia32"; + } // (extraAttrs.gypFlags or {})); + + configurePhase = '' + # This is to ensure expansion of $out. + libExecPath="${libExecPath}" + python build/linux/unbundle/replace_gyp_files.py ${gypFlags} + python build/gyp_chromium -f ninja --depth "$(pwd)" ${gypFlags} + ''; + + buildPhase = let + CC = "${gcc}/bin/gcc"; + CXX = "${gcc}/bin/g++"; + in '' + CC="${CC}" CC_host="${CC}" \ + CXX="${CXX}" CXX_host="${CXX}" \ + LINK_host="${CXX}" \ + "${ninja}/bin/ninja" -C "${buildPath}" \ + -j$NIX_BUILD_CORES -l$NIX_BUILD_CORES \ + ${concatStringsSep " " (extraAttrs.buildTargets or [])} + ''; + }; + +# Remove some extraAttrs we supplied to the base attributes already. +in stdenv.mkDerivation (base // removeAttrs extraAttrs [ + "name" "gypFlags" "buildTargets" +]) diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix index 213e75ee6efa..9e906191afe4 100644 --- a/pkgs/applications/networking/browsers/chromium/default.nix +++ b/pkgs/applications/networking/browsers/chromium/default.nix @@ -1,287 +1,85 @@ -{ stdenv, fetchurl, makeWrapper, ninja, which - -# default dependencies -, bzip2, flac, speex -, libevent, expat, libjpeg -, libpng, libxml2, libxslt -, xdg_utils, yasm, zlib -, libusb1, libexif, pciutils - -, python, pythonPackages, perl, pkgconfig -, nspr, udev, krb5 -, utillinux, alsaLib -, gcc, bison, gperf -, glib, gtk, dbus_glib -, libXScrnSaver, libXcursor, libXtst, mesa -, protobuf, speechd, libXdamage - -# optional dependencies -, libgcrypt ? null # gnomeSupport || cupsSupport +{ newScope, stdenv, makeWrapper, makeDesktopItem # package customization , channel ? "stable" -, enableSELinux ? false, libselinux ? null +, enableSELinux ? false , enableNaCl ? false -, useOpenSSL ? false, nss ? null, openssl ? null -, gnomeSupport ? false, gconf ? null -, gnomeKeyringSupport ? false, libgnome_keyring ? null +, useOpenSSL ? false +, gnomeSupport ? false +, gnomeKeyringSupport ? false , proprietaryCodecs ? true +, enablePepperFlash ? false +, enablePepperPDF ? false , cupsSupport ? false -, pulseSupport ? false, pulseaudio ? null +, pulseSupport ? false }: -with stdenv.lib; - let - src = with getAttr channel (import ./sources.nix); stdenv.mkDerivation { - name = "chromium-source-${version}"; + callPackage = newScope chromium; - src = fetchurl { - inherit url sha256; + chromium = { + source = callPackage ./source { + inherit channel; + # XXX: common config + inherit useOpenSSL; }; - buildInputs = [ python ]; # cannot patch shebangs otherwise - - phases = [ "unpackPhase" "patchPhase" "installPhase" ]; - - opensslPatches = optional useOpenSSL openssl.patches; - - prePatch = "patchShebangs ."; - - patches = singleton ./sandbox_userns_31.patch; - - postPatch = '' - sed -i -r \ - -e 's/-f(stack-protector)(-all)?/-fno-\1/' \ - -e 's|/bin/echo|echo|' \ - -e "/python_arch/s/: *'[^']*'/: '""'/" \ - build/common.gypi chrome/chrome_tests.gypi - sed -i '/not RunGN/,+1d' build/gyp_chromium - sed -i -e 's|/usr/bin/gcc|gcc|' \ - third_party/WebKit/Source/build/scripts/scripts.gypi \ - third_party/WebKit/Source/build/scripts/preprocessor.pm - '' + optionalString useOpenSSL '' - cat $opensslPatches | patch -p1 -d third_party/openssl/openssl - '' + optionalString (!versionOlder version "34.0.0.0") '' - sed -i '/import.*depot/d' build/gyp_chromium - ''; - - outputs = [ "out" "sandbox" "bundled" "main" ]; - installPhase = '' - ensureDir "$out" "$sandbox" "$bundled" "$main" - - header "copying browser main sources to $main" - find . -mindepth 1 -maxdepth 1 \ - \! -path ./sandbox \ - \! -path ./third_party \ - \! -path ./build \ - \! -path ./tools \ - \! -name '.*' \ - -print | xargs cp -rt "$main" - stopNest - - header "copying sandbox components to $sandbox" - cp -rt "$sandbox" sandbox/* - stopNest - - header "copying third party sources to $bundled" - cp -rt "$bundled" third_party/* - stopNest - - header "copying build requisites to $out" - cp -rt "$out" build tools - stopNest + mkChromiumDerivation = callPackage ./common.nix { + inherit enableSELinux enableNaCl useOpenSSL gnomeSupport + gnomeKeyringSupport proprietaryCodecs cupsSupport + pulseSupport; + }; - rm -rf "$out/tools/gyp" # XXX: Don't even copy it in the first place. - ''; + browser = callPackage ./browser.nix { }; + sandbox = callPackage ./sandbox.nix { }; - passthru = { - inherit version; + plugins = callPackage ./plugins.nix { + inherit enablePepperFlash enablePepperPDF; }; }; - mkGypFlags = - let - sanitize = value: - if value == true then "1" - else if value == false then "0" - else "${value}"; - toFlag = key: value: "-D${key}=${sanitize value}"; - in attrs: concatStringsSep " " (attrValues (mapAttrs toFlag attrs)); - - gypFlagsUseSystemLibs = { - use_system_bzip2 = true; - use_system_flac = true; - use_system_libevent = true; - use_system_libexpat = true; - use_system_libexif = true; - use_system_libjpeg = true; - use_system_libpng = false; # PNG dlopen() version conflict - use_system_libusb = true; - use_system_libxml = true; - use_system_speex = true; - use_system_ssl = useOpenSSL; - use_system_stlport = true; - use_system_xdg_utils = true; - use_system_yasm = true; - use_system_zlib = false; # http://crbug.com/143623 - use_system_protobuf = true; - - use_system_harfbuzz = false; - use_system_icu = false; - use_system_libwebp = false; # http://crbug.com/133161 - use_system_skia = false; - use_system_sqlite = false; # http://crbug.com/22208 - use_system_v8 = false; + desktopItem = makeDesktopItem { + name = "Chromium"; + exec = "chromium"; + icon = "chromium"; + comment = "An open source web browser from Google"; + desktopName = "Chromium"; + genericName = "Web browser"; + mimeType = stdenv.lib.concatStringsSep ";" [ + "text/html" + "text/xml" + "application/xhtml+xml" + "x-scheme-handler/http" + "x-scheme-handler/https" + "x-scheme-handler/ftp" + "x-scheme-handler/mailto" + "x-scheme-handler/webcal" + ]; + categories = "Network;WebBrowser"; }; - defaultDependencies = [ - bzip2 flac speex - libevent expat libjpeg - libpng libxml2 libxslt - xdg_utils yasm zlib - libusb1 libexif - ]; - - sandbox = import ./sandbox.nix { - inherit stdenv; - src = src.sandbox; - binary = "${packageName}_sandbox"; - }; +in stdenv.mkDerivation { + name = "chromium-${channel}-${chromium.browser.version}"; - # build paths and release info - packageName = "chromium"; - buildType = "Release"; - buildPath = "out/${buildType}"; - libExecPath = "$out/libexec/${packageName}"; - sandboxPath = "${sandbox}/bin/${packageName}_sandbox"; + buildInputs = [ makeWrapper ]; -in stdenv.mkDerivation rec { - name = "${packageName}-${src.version}"; - inherit packageName src; - - buildInputs = defaultDependencies ++ [ - which makeWrapper - python perl pkgconfig - nspr udev - (if useOpenSSL then openssl else nss) - utillinux alsaLib - gcc bison gperf krb5 - glib gtk dbus_glib - libXScrnSaver libXcursor libXtst mesa - pciutils protobuf speechd libXdamage - pythonPackages.gyp - ] ++ optional gnomeKeyringSupport libgnome_keyring - ++ optionals gnomeSupport [ gconf libgcrypt ] - ++ optional enableSELinux libselinux - ++ optional cupsSupport libgcrypt - ++ optional pulseSupport pulseaudio; - - prePatch = '' - # XXX: Figure out a way how to split these properly. - #cpflags="-dsr --no-preserve=mode" - cpflags="-dr" - cp $cpflags "${src.main}"/* . - cp $cpflags "${src.bundled}" third_party - cp $cpflags "${src.sandbox}" sandbox - chmod -R u+w . # XXX! - ''; - - postPatch = '' - sed -i -e '/base::FilePath exe_dir/,/^ *} *$/c \ - sandbox_binary = \ - base::FilePath("'"${sandboxPath}"'"); - ' content/browser/browser_main_loop.cc - ''; - - gypFlags = mkGypFlags (gypFlagsUseSystemLibs // { - linux_use_gold_binary = false; - linux_use_gold_flags = false; - proprietary_codecs = false; - use_gnome_keyring = gnomeKeyringSupport; - use_gconf = gnomeSupport; - use_gio = gnomeSupport; - use_pulseaudio = pulseSupport; - disable_nacl = !enableNaCl; - use_openssl = useOpenSSL; - selinux = enableSELinux; - use_cups = cupsSupport; - linux_sandbox_path="${sandboxPath}"; - linux_sandbox_chrome_path="${libExecPath}/${packageName}"; - werror = ""; - - # Google API keys, see http://www.chromium.org/developers/how-tos/api-keys. - # Note: These are for NixOS/nixpkgs use ONLY. For your own distribution, - # please get your own set of keys. - google_api_key = "AIzaSyDGi15Zwl11UNe6Y-5XW_upsfyw31qwZPI"; - google_default_client_id = "404761575300.apps.googleusercontent.com"; - google_default_client_secret = "9rIFQjfnkykEmqb6FfjJQD1D"; - - } // optionalAttrs proprietaryCodecs { - # enable support for the H.264 codec - proprietary_codecs = true; - ffmpeg_branding = "Chrome"; - } // optionalAttrs (stdenv.system == "x86_64-linux") { - target_arch = "x64"; - python_arch = "x86-64"; - } // optionalAttrs (stdenv.system == "i686-linux") { - target_arch = "ia32"; - python_arch = "ia32"; - }); - - configurePhase = '' - python build/gyp_chromium -f ninja --depth "$(pwd)" ${gypFlags} - ''; - - buildPhase = let - CC = "${gcc}/bin/gcc"; - CXX = "${gcc}/bin/g++"; + buildCommand = let + browserBinary = "${chromium.browser}/libexec/chromium/chromium"; + sandboxBinary = "${chromium.sandbox}/bin/chromium-sandbox"; in '' - CC="${CC}" CC_host="${CC}" \ - CXX="${CXX}" CXX_host="${CXX}" \ - LINK_host="${CXX}" \ - "${ninja}/bin/ninja" -C "${buildPath}" \ - -j$NIX_BUILD_CORES -l$NIX_BUILD_CORES \ - chrome ${optionalString (!enableSELinux) "chrome_sandbox"} - ''; - - installPhase = '' - ensureDir "${libExecPath}" - cp -v "${buildPath}/"*.pak "${libExecPath}/" - ${optionalString (!versionOlder src.version "34.0.0.0") '' - cp -v "${buildPath}/icudtl.dat" "${libExecPath}/" - ''} - cp -vR "${buildPath}/locales" "${buildPath}/resources" "${libExecPath}/" - cp -v ${buildPath}/libffmpegsumo.so "${libExecPath}/" - - cp -v "${buildPath}/chrome" "${libExecPath}/${packageName}" + ensureDir "$out/bin" "$out/share/applications" - mkdir -vp "$out/bin" - makeWrapper "${libExecPath}/${packageName}" "$out/bin/${packageName}" + ln -s "${chromium.browser}/share" "$out/share" + makeWrapper "${browserBinary}" "$out/bin/chromium" \ + --set CHROMIUM_SANDBOX_BINARY_PATH "${sandboxBinary}" \ + --add-flags "${chromium.plugins.flagsEnabled}" - mkdir -vp "$out/share/man/man1" - cp -v "${buildPath}/chrome.1" "$out/share/man/man1/${packageName}.1" - - for icon_file in chrome/app/theme/chromium/product_logo_*[0-9].png; do - num_and_suffix="''${icon_file##*logo_}" - icon_size="''${num_and_suffix%.*}" - expr "$icon_size" : "^[0-9][0-9]*$" || continue - logo_output_prefix="$out/share/icons/hicolor" - logo_output_path="$logo_output_prefix/''${icon_size}x''${icon_size}/apps" - mkdir -vp "$logo_output_path" - cp -v "$icon_file" "$logo_output_path/${packageName}.png" - done + cp -v "${desktopItem}/share/applications/"* "$out/share/applications" ''; - passthru = { - inherit sandbox; - }; + inherit (chromium.browser) meta packageName; - meta = { - description = "An open source web browser from Google"; - homepage = http://www.chromium.org/; - maintainers = with maintainers; [ goibhniu chaoflow aszlig wizeman ]; - license = licenses.bsd3; - platforms = platforms.linux; + passthru = { + mkDerivation = chromium.mkChromiumDerivation; }; } diff --git a/pkgs/applications/networking/browsers/chromium/plugins.nix b/pkgs/applications/networking/browsers/chromium/plugins.nix new file mode 100644 index 000000000000..f760b06fe24b --- /dev/null +++ b/pkgs/applications/networking/browsers/chromium/plugins.nix @@ -0,0 +1,78 @@ +{ stdenv +, enablePepperFlash ? false +, enablePepperPDF ? false + +, source +}: + +with stdenv.lib; + +let + plugins = stdenv.mkDerivation { + name = "chromium-binary-plugins"; + + # XXX: Only temporary and has to be version-specific + src = source.plugins; + + phases = [ "unpackPhase" "patchPhase" "checkPhase" "installPhase" ]; + outputs = [ "pdf" "flash" ]; + + unpackCmd = let + chan = if source.channel == "dev" then "chrome-unstable" + else if source.channel == "stable" then "chrome" + else "chrome-${source.channel}"; + in '' + ensureDir plugins + ar p "$src" data.tar.lzma | tar xJ -C plugins --strip-components=4 \ + ./opt/google/${chan}/PepperFlash \ + ./opt/google/${chan}/libpdf.so + ''; + + doCheck = true; + checkPhase = '' + ! find -iname '*.so' -exec ldd {} + | grep 'not found' + ''; + + patchPhase = let + rpaths = [ stdenv.gcc.gcc ]; + mkrpath = p: "${makeSearchPath "lib64" p}:${makeSearchPath "lib" p}"; + in '' + for sofile in PepperFlash/libpepflashplayer.so libpdf.so; do + chmod +x "$sofile" + patchelf --set-rpath "${mkrpath rpaths}" "$sofile" + done + ''; + + installPhase = let + pdfName = "Chrome PDF Viewer"; + pdfDescription = "Portable Document Format"; + pdfMimeTypes = concatStringsSep ";" [ + "application/pdf" + "application/x-google-chrome-print-preview-pdf" + ]; + pdfInfo = "#${pdfName}#${pdfDescription};${pdfMimeTypes}"; + in '' + install -vD libpdf.so "$pdf/lib/libpdf.so" + ensureDir "$pdf/nix-support" + echo "--register-pepper-plugins='$pdf/lib/libpdf.so${pdfInfo}'" \ + > "$pdf/nix-support/chromium-flags" + + flashVersion="$( + sed -n -r 's/.*"version": "([^"]+)",.*/\1/p' PepperFlash/manifest.json + )" + + install -vD PepperFlash/libpepflashplayer.so \ + "$flash/lib/libpepflashplayer.so" + ensureDir "$flash/nix-support" + echo "--ppapi-flash-path='$flash/lib/libpepflashplayer.so'" \ + "--ppapi-flash-version=$flashVersion" \ + > "$flash/nix-support/chromium-flags" + ''; + + passthru.flagsEnabled = let + enabledPlugins = optional enablePepperFlash plugins.flash + ++ optional enablePepperPDF plugins.pdf; + getFlags = plugin: "$(< ${plugin}/nix-support/chromium-flags)"; + in concatStringsSep " " (map getFlags enabledPlugins); + }; +in plugins diff --git a/pkgs/applications/networking/browsers/chromium/sandbox.nix b/pkgs/applications/networking/browsers/chromium/sandbox.nix index b43385e86338..b470ed633253 100644 --- a/pkgs/applications/networking/browsers/chromium/sandbox.nix +++ b/pkgs/applications/networking/browsers/chromium/sandbox.nix @@ -1,12 +1,13 @@ -{ stdenv, src, binary }: +{ stdenv, source }: stdenv.mkDerivation { - name = "chromium-sandbox-${src.version}"; - inherit src; + name = "chromium-sandbox-${source.version}"; + src = source.sandbox; patchPhase = '' sed -i -e '/#include.*base_export/c \ #define BASE_EXPORT __attribute__((visibility("default"))) + /#include/s|sandbox/linux|'"$(pwd)"'/linux| ' linux/suid/*.[hc] ''; @@ -15,6 +16,6 @@ stdenv.mkDerivation { ''; installPhase = '' - install -svD sandbox "$out/bin/${binary}" + install -svD sandbox "$out/bin/chromium-sandbox" ''; } diff --git a/pkgs/applications/networking/browsers/chromium/source/default.nix b/pkgs/applications/networking/browsers/chromium/source/default.nix new file mode 100644 index 000000000000..2c7e7277b814 --- /dev/null +++ b/pkgs/applications/networking/browsers/chromium/source/default.nix @@ -0,0 +1,79 @@ +{ stdenv, fetchurl, python +, channel ? "stable" +, useOpenSSL # XXX +}: + +with stdenv.lib; + +with (import ./update.nix { + inherit (stdenv) system; +}).getChannel channel; + +stdenv.mkDerivation { + name = "chromium-source-${version}"; + + src = fetchurl main; + + buildInputs = [ python ]; # cannot patch shebangs otherwise + + phases = [ "unpackPhase" "patchPhase" "installPhase" ]; + + opensslPatches = optional useOpenSSL openssl.patches; + + prePatch = "patchShebangs ."; + + patches = if (versionOlder version "36.0.0.0") + then singleton ./sandbox_userns_31.patch + else singleton ./sandbox_userns_36.patch; + + postPatch = '' + sed -i -r \ + -e 's/-f(stack-protector)(-all)?/-fno-\1/' \ + -e 's|/bin/echo|echo|' \ + -e "/python_arch/s/: *'[^']*'/: '""'/" \ + build/common.gypi chrome/chrome_tests.gypi + sed -i -e '/not RunGN/,+1d' -e '/import.*depot/d' build/gyp_chromium + sed -i -e 's|/usr/bin/gcc|gcc|' \ + third_party/WebKit/Source/build/scripts/scripts.gypi \ + third_party/WebKit/Source/build/scripts/preprocessor.pm + '' + optionalString useOpenSSL '' + cat $opensslPatches | patch -p1 -d third_party/openssl/openssl + '' + optionalString (!versionOlder version "34.0.0.0") '' + ''; + + outputs = [ "out" "sandbox" "bundled" "main" ]; + installPhase = '' + ensureDir "$out" "$sandbox" "$bundled" "$main" + + header "copying browser main sources to $main" + find . -mindepth 1 -maxdepth 1 \ + \! -path ./sandbox \ + \! -path ./third_party \ + \! -path ./build \ + \! -path ./tools \ + \! -name '.*' \ + -print | xargs cp -rt "$main" + stopNest + + header "copying sandbox components to $sandbox" + cp -rt "$sandbox" sandbox/* + stopNest + + header "copying third party sources to $bundled" + cp -rt "$bundled" third_party/* + stopNest + + header "copying build requisites to $out" + cp -rt "$out" build tools + stopNest + + rm -rf "$out/tools/gyp" # XXX: Don't even copy it in the first place. + ''; + + preferLocalBuild = true; + + passthru = { + inherit version channel; + plugins = fetchurl binary; + }; +} diff --git a/pkgs/applications/networking/browsers/chromium/sandbox_userns_31.patch b/pkgs/applications/networking/browsers/chromium/source/sandbox_userns_31.patch index 490c1a9cebe9..490c1a9cebe9 100644 --- a/pkgs/applications/networking/browsers/chromium/sandbox_userns_31.patch +++ b/pkgs/applications/networking/browsers/chromium/source/sandbox_userns_31.patch diff --git a/pkgs/applications/networking/browsers/chromium/source/sandbox_userns_36.patch b/pkgs/applications/networking/browsers/chromium/source/sandbox_userns_36.patch new file mode 100644 index 000000000000..a8f3ed0befd4 --- /dev/null +++ b/pkgs/applications/networking/browsers/chromium/source/sandbox_userns_36.patch @@ -0,0 +1,293 @@ +commit 3c80951744293441c2e66345ef7d82c199f4600e +Author: aszlig <aszlig@redmoonstudios.org> +Date: Thu May 16 14:17:56 2013 +0200 + + zygote: Add support for user namespaces on Linux. + + The implementation is done by patching the Zygote host to execute the sandbox + binary with CLONE_NEWUSER and setting the uid and gid mapping so that the child + process is using uid 0 and gid 0 which map to the current user of the parent. + Afterwards, the sandbox will continue as if it was called as a setuid binary. + + In addition, this adds new_user_namespace as an option in process_util in order + to set the UID and GID mapping correctly. The reason for this is that just + passing CLONE_NEWUSER to clone_flags doesn't help in LaunchProcess(), because + without setting the mappings exec*() will clear the process's capability sets. + + If the kernel doesn't support unprivileged user namespaces and the sandbox + binary doesn't have the setuid flag, the Zygote main process will run without a + sandbox. This is to mimic the behaviour if no SUID sandbox binary path is set. + + Signed-off-by: aszlig <aszlig@redmoonstudios.org> + +diff --git a/base/process/launch.cc b/base/process/launch.cc +index 81748f5..930f20f 100644 +--- a/base/process/launch.cc ++++ b/base/process/launch.cc +@@ -26,6 +26,7 @@ LaunchOptions::LaunchOptions() + #if defined(OS_LINUX) + , clone_flags(0) + , allow_new_privs(false) ++ , new_user_namespace(false) + #endif // OS_LINUX + #if defined(OS_CHROMEOS) + , ctrl_terminal_fd(-1) +diff --git a/base/process/launch.h b/base/process/launch.h +index 9e39fba..00e4c79 100644 +--- a/base/process/launch.h ++++ b/base/process/launch.h +@@ -115,6 +115,9 @@ struct BASE_EXPORT LaunchOptions { + // By default, child processes will have the PR_SET_NO_NEW_PRIVS bit set. If + // true, then this bit will not be set in the new child process. + bool allow_new_privs; ++ ++ // If true, start the process in a new user namespace. ++ bool new_user_namespace; + #endif // defined(OS_LINUX) + + #if defined(OS_CHROMEOS) +diff --git a/base/process/launch_posix.cc b/base/process/launch_posix.cc +index fe4da1a..7f118b8 100644 +--- a/base/process/launch_posix.cc ++++ b/base/process/launch_posix.cc +@@ -40,6 +40,10 @@ + + #if defined(OS_LINUX) + #include <sys/prctl.h> ++#include <sched.h> ++#if !defined(CLONE_NEWUSER) ++#define CLONE_NEWUSER 0x10000000 ++#endif + #endif + + #if defined(OS_CHROMEOS) +@@ -301,13 +305,23 @@ bool LaunchProcess(const std::vector<std::string>& argv, + + pid_t pid; + #if defined(OS_LINUX) +- if (options.clone_flags) { ++ int map_pipe_fd[2]; ++ int flags = options.clone_flags; ++ ++ if (options.new_user_namespace) { ++ flags |= CLONE_NEWUSER; ++ if (pipe(map_pipe_fd) < 0) { ++ DPLOG(ERROR) << "user namespace pipe"; ++ return false; ++ } ++ } ++ ++ if (options.clone_flags || options.new_user_namespace) { + // Signal handling in this function assumes the creation of a new + // process, so we check that a thread is not being created by mistake + // and that signal handling follows the process-creation rules. +- RAW_CHECK( +- !(options.clone_flags & (CLONE_SIGHAND | CLONE_THREAD | CLONE_VM))); +- pid = syscall(__NR_clone, options.clone_flags, 0, 0, 0); ++ RAW_CHECK(!(flags & (CLONE_SIGHAND | CLONE_THREAD | CLONE_VM))); ++ pid = syscall(__NR_clone, flags, 0, 0, 0); + } else + #endif + { +@@ -328,6 +342,21 @@ bool LaunchProcess(const std::vector<std::string>& argv, + // DANGER: no calls to malloc or locks are allowed from now on: + // http://crbug.com/36678 + ++#if defined(OS_LINUX) ++ if (options.new_user_namespace) { ++ // Close the write end of the pipe so we get an EOF when the parent closes ++ // the FD. This is to avoid race conditions when the UID/GID mappings are ++ // written _after_ execvp(). ++ close(map_pipe_fd[1]); ++ ++ char dummy; ++ if (HANDLE_EINTR(read(map_pipe_fd[0], &dummy, 1)) != 0) { ++ RAW_LOG(ERROR, "Unexpected input in uid/gid mapping pipe."); ++ _exit(127); ++ } ++ } ++#endif ++ + // DANGER: fork() rule: in the child, if you don't end up doing exec*(), + // you call _exit() instead of exit(). This is because _exit() does not + // call any previously-registered (in the parent) exit handlers, which +@@ -451,6 +480,40 @@ bool LaunchProcess(const std::vector<std::string>& argv, + _exit(127); + } else { + // Parent process ++#if defined(OS_LINUX) ++ if (options.new_user_namespace) { ++ // We need to write UID/GID mapping here to map the current user outside ++ // the namespace to the root user inside the namespace in order to ++ // correctly "fool" the child process. ++ char buf[256]; ++ int map_fd, map_len; ++ ++ snprintf(buf, sizeof(buf), "/proc/%d/uid_map", pid); ++ map_fd = open(buf, O_RDWR); ++ DPCHECK(map_fd >= 0); ++ snprintf(buf, sizeof(buf), "0 %d 1", geteuid()); ++ map_len = strlen(buf); ++ if (write(map_fd, buf, map_len) != map_len) { ++ RAW_LOG(WARNING, "Can't write to uid_map."); ++ } ++ close(map_fd); ++ ++ snprintf(buf, sizeof(buf), "/proc/%d/gid_map", pid); ++ map_fd = open(buf, O_RDWR); ++ DPCHECK(map_fd >= 0); ++ snprintf(buf, sizeof(buf), "0 %d 1", getegid()); ++ map_len = strlen(buf); ++ if (write(map_fd, buf, map_len) != map_len) { ++ RAW_LOG(WARNING, "Can't write to gid_map."); ++ } ++ close(map_fd); ++ ++ // Close the pipe on the parent, so the child can continue doing the ++ // execvp() call. ++ close(map_pipe_fd[1]); ++ } ++#endif ++ + if (options.wait) { + // While this isn't strictly disk IO, waiting for another process to + // finish is the sort of thing ThreadRestrictions is trying to prevent. +diff --git a/content/browser/zygote_host/zygote_host_impl_linux.cc b/content/browser/zygote_host/zygote_host_impl_linux.cc +index 0106a7a..a0465af 100644 +--- a/content/browser/zygote_host/zygote_host_impl_linux.cc ++++ b/content/browser/zygote_host/zygote_host_impl_linux.cc +@@ -124,25 +124,31 @@ void ZygoteHostImpl::Init(const std::string& sandbox_cmd) { + + sandbox_binary_ = sandbox_cmd.c_str(); + +- // A non empty sandbox_cmd means we want a SUID sandbox. +- using_suid_sandbox_ = !sandbox_cmd.empty(); ++ bool userns_sandbox = false; ++ const std::vector<std::string> cmd_line_unwrapped(cmd_line.argv()); + +- if (using_suid_sandbox_) { ++ if (!sandbox_cmd.empty()) { + struct stat st; + if (stat(sandbox_binary_.c_str(), &st) != 0) { + LOG(FATAL) << "The SUID sandbox helper binary is missing: " + << sandbox_binary_ << " Aborting now."; + } + +- if (access(sandbox_binary_.c_str(), X_OK) == 0 && +- (st.st_uid == 0) && +- (st.st_mode & S_ISUID) && +- (st.st_mode & S_IXOTH)) { ++ if (access(sandbox_binary_.c_str(), X_OK) == 0) { ++ using_suid_sandbox_ = true; ++ + cmd_line.PrependWrapper(sandbox_binary_); + + scoped_ptr<sandbox::SetuidSandboxClient> + sandbox_client(sandbox::SetuidSandboxClient::Create()); + sandbox_client->SetupLaunchEnvironment(); ++ ++ if (!((st.st_uid == 0) && ++ (st.st_mode & S_ISUID) && ++ (st.st_mode & S_IXOTH))) { ++ userns_sandbox = true; ++ sandbox_client->SetNoSuid(); ++ } + } else { + LOG(FATAL) << "The SUID sandbox helper binary was found, but is not " + "configured correctly. Rather than run without sandboxing " +@@ -167,7 +173,19 @@ void ZygoteHostImpl::Init(const std::string& sandbox_cmd) { + base::LaunchOptions options; + options.fds_to_remap = &fds_to_map; + options.allow_new_privs = using_suid_sandbox_; // Don't PR_SET_NO_NEW_PRIVS. ++ if (userns_sandbox) ++ options.new_user_namespace = true; + base::LaunchProcess(cmd_line.argv(), options, &process); ++ ++ if (process == -1 && userns_sandbox) { ++ LOG(ERROR) << "User namespace sandbox failed to start, running without " ++ << "sandbox! You need at least kernel 3.8.0 with CONFIG_USER_NS " ++ << "enabled in order to use the sandbox without setuid bit."; ++ using_suid_sandbox_ = false; ++ options.new_user_namespace = false; ++ base::LaunchProcess(cmd_line_unwrapped, options, &process); ++ } ++ + CHECK(process != -1) << "Failed to launch zygote process"; + + if (using_suid_sandbox_) { +diff --git a/content/zygote/zygote_main_linux.cc b/content/zygote/zygote_main_linux.cc +index 5dc09fa..4e09bc4 100644 +--- a/content/zygote/zygote_main_linux.cc ++++ b/content/zygote/zygote_main_linux.cc +@@ -397,6 +397,13 @@ static bool EnterSuidSandbox(sandbox::SetuidSandboxClient* setuid_sandbox) { + CHECK(CreateInitProcessReaper()); + } + ++ // Don't set non-dumpable, as it causes trouble when the host tries to find ++ // the zygote process (XXX: Not quite sure why this happens with user ++ // namespaces). Fortunately, we also have the seccomp filter sandbox which ++ // should disallow the use of ptrace. ++ if (setuid_sandbox->IsNoSuid()) ++ return true; ++ + #if !defined(OS_OPENBSD) + // Previously, we required that the binary be non-readable. This causes the + // kernel to mark the process as non-dumpable at startup. The thinking was +diff --git a/sandbox/linux/suid/client/setuid_sandbox_client.cc b/sandbox/linux/suid/client/setuid_sandbox_client.cc +index 8ed1a97..cbdfadc 100644 +--- a/sandbox/linux/suid/client/setuid_sandbox_client.cc ++++ b/sandbox/linux/suid/client/setuid_sandbox_client.cc +@@ -173,6 +173,10 @@ bool SetuidSandboxClient::IsInNewNETNamespace() const { + return env_->HasVar(kSandboxNETNSEnvironmentVarName); + } + ++bool SetuidSandboxClient::IsNoSuid() const { ++ return env_->HasVar(kSandboxNoSuidVarName); ++} ++ + bool SetuidSandboxClient::IsSandboxed() const { + return sandboxed_; + } +@@ -182,4 +186,8 @@ void SetuidSandboxClient::SetupLaunchEnvironment() { + SetSandboxAPIEnvironmentVariable(env_); + } + ++void SetuidSandboxClient::SetNoSuid() { ++ env_->SetVar(kSandboxNoSuidVarName, "1"); ++} ++ + } // namespace sandbox +diff --git a/sandbox/linux/suid/client/setuid_sandbox_client.h b/sandbox/linux/suid/client/setuid_sandbox_client.h +index 0f6db7a..c629391 100644 +--- a/sandbox/linux/suid/client/setuid_sandbox_client.h ++++ b/sandbox/linux/suid/client/setuid_sandbox_client.h +@@ -46,6 +46,8 @@ class SANDBOX_EXPORT SetuidSandboxClient { + bool IsInNewPIDNamespace() const; + // Did the setuid helper create a new network namespace ? + bool IsInNewNETNamespace() const; ++ // Is sandboxed without SUID binary ? ++ bool IsNoSuid() const; + // Are we done and fully sandboxed ? + bool IsSandboxed() const; + +@@ -53,6 +55,8 @@ class SANDBOX_EXPORT SetuidSandboxClient { + // helper. + void SetupLaunchEnvironment(); + ++ void SetNoSuid(); ++ + private: + // Holds the environment. Will never be NULL. + base::Environment* env_; +diff --git a/sandbox/linux/suid/common/sandbox.h b/sandbox/linux/suid/common/sandbox.h +index 9345287..2db659e 100644 +--- a/sandbox/linux/suid/common/sandbox.h ++++ b/sandbox/linux/suid/common/sandbox.h +@@ -15,6 +15,7 @@ static const char kAdjustOOMScoreSwitch[] = "--adjust-oom-score"; + + static const char kSandboxDescriptorEnvironmentVarName[] = "SBX_D"; + static const char kSandboxHelperPidEnvironmentVarName[] = "SBX_HELPER_PID"; ++static const char kSandboxNoSuidVarName[] = "SBX_NO_SUID"; + + static const long kSUIDSandboxApiNumber = 1; + static const char kSandboxEnvironmentApiRequest[] = "SBX_CHROME_API_RQ"; diff --git a/pkgs/applications/networking/browsers/chromium/source/sources.nix b/pkgs/applications/networking/browsers/chromium/source/sources.nix new file mode 100644 index 000000000000..6881b8d44e84 --- /dev/null +++ b/pkgs/applications/networking/browsers/chromium/source/sources.nix @@ -0,0 +1,21 @@ +# This file is autogenerated from update.sh in the parent directory. +{ + dev = { + version = "36.0.1941.0"; + sha256 = "12rhyq8hliwc8b3371h2axzlzabg99c06d02kl9ldag2kxfpsfps"; + sha256bin32 = "1rbl5x0pjid5lypdplbqvcx4lgvr2rlbiv83ivvqb5dbg6p7886g"; + sha256bin64 = "18440spj541w4bqjblb2wpf94slg4if176gprccbxw9sy6b7z38w"; + }; + beta = { + version = "35.0.1916.47"; + sha256 = "0pq87aybfna4pgsf02v97lprj5kbsrzim7c44nqarmcvlj4l65ch"; + sha256bin32 = "057l59any3hiqdg1gh4nxry542083lxdaychhljbrfkipq1gy4yv"; + sha256bin64 = "07n8sqv234dg959id023w3mz5n9ascwrcmxq3px96bqgqim2vf8s"; + }; + stable = { + version = "34.0.1847.116"; + sha256 = "04cpfav5rqa117igvzmrw0045r2ljxg5fqb46qgqvkgff30pjrfx"; + sha256bin32 = "1k24j80xgc91p8ssynql9ifjdhpz6w7vl3pk9lvkr0sdhg16hlrf"; + sha256bin64 = "16gidav4ilc95fr1d6832xzpyynfwnglbz7b33gq62vp8bj77da4"; + }; +} diff --git a/pkgs/applications/networking/browsers/chromium/source/update.nix b/pkgs/applications/networking/browsers/chromium/source/update.nix new file mode 100644 index 000000000000..09f834a90c6f --- /dev/null +++ b/pkgs/applications/networking/browsers/chromium/source/update.nix @@ -0,0 +1,118 @@ +{ system ? builtins.currentSystem }: + +let + inherit (import <nixpkgs> {}) lib writeText stdenv; + + sources = if builtins.pathExists ./sources.nix + then import ./sources.nix + else null; + + bucketURL = "http://commondatastorage.googleapis.com/" + + "chromium-browser-official"; + + debURL = "https://dl.google.com/linux/chrome/deb/pool/main/g"; + + # Untrusted mirrors, don't try to update from them! + debMirrors = [ + "http://95.31.35.30/chrome/pool/main/g" + "http://mirror.pcbeta.com/google/chrome/deb/pool/main/g" + ]; + + tryChannel = channel: let + chan = builtins.getAttr channel sources; + in if sources != null then '' + oldver="${chan.version}"; + echo -n "Checking if $oldver ($channel) is up to date..." >&2; + if [ "x$(get_newest_ver "$version" "$oldver")" != "x$oldver" ]; + then + echo " no, getting sha256 for new version $version:" >&2; + sha256="$(prefetch_sha "$channel" "$version")" || return 1; + else + echo " yes, keeping old sha256." >&2; + sha256="${chan.sha256}"; + ${if (chan ? sha256bin32 && chan ? sha256bin64) then '' + sha256="$sha256.${chan.sha256bin32}.${chan.sha256bin64}"; + '' else '' + sha256="$sha256.$(prefetch_deb_sha "$channel" "$version")"; + ''} + fi; + '' else '' + sha256="$(prefetch_sha "$channel" "$version")" || return 1; + ''; + + caseChannel = channel: '' + ${channel}) ${tryChannel channel};; + ''; + +in rec { + getChannel = channel: let + chanAttrs = builtins.getAttr channel sources; + in { + inherit (chanAttrs) version; + + main = { + url = "${bucketURL}/chromium-${chanAttrs.version}.tar.xz"; + inherit (chanAttrs) sha256; + }; + + binary = let + pname = if channel == "dev" + then "google-chrome-unstable" + else "google-chrome-${channel}"; + arch = if stdenv.is64bit then "amd64" else "i386"; + relpath = "${pname}/${pname}_${chanAttrs.version}-1_${arch}.deb"; + in lib.optionalAttrs (chanAttrs ? sha256bin64) { + urls = map (url: "${url}/${relpath}") ([ debURL ] ++ debMirrors); + sha256 = if stdenv.is64bit + then chanAttrs.sha256bin64 + else chanAttrs.sha256bin32; + }; + }; + + updateHelpers = writeText "update-helpers.sh" '' + + prefetch_main_sha() + { + nix-prefetch-url "${bucketURL}/chromium-$2.tar.xz"; + } + + prefetch_deb_sha() + { + channel="$1"; + version="$2"; + + case "$1" in + dev) pname="google-chrome-unstable";; + *) pname="google-chrome-$channel";; + esac; + + deb_pre="${debURL}/$pname/$pname"; + + deb32=$(nix-prefetch-url "''${deb_pre}_$version-1_i386.deb"); + deb64=$(nix-prefetch-url "''${deb_pre}_$version-1_amd64.deb"); + + echo "$deb32.$deb64"; + return 0; + } + + prefetch_sha() + { + echo "$(prefetch_main_sha "$@").$(prefetch_deb_sha "$@")"; + return 0; + } + + get_sha256() + { + channel="$1"; + version="$2"; + + case "$channel" in + ${lib.concatMapStrings caseChannel [ "stable" "dev" "beta" ]} + esac; + + sha_insert "$version" "$sha256"; + echo "$sha256"; + return 0; + } + ''; +} diff --git a/pkgs/applications/networking/browsers/chromium/sources.nix b/pkgs/applications/networking/browsers/chromium/sources.nix deleted file mode 100644 index 49b5e2b42215..000000000000 --- a/pkgs/applications/networking/browsers/chromium/sources.nix +++ /dev/null @@ -1,18 +0,0 @@ -# This file is autogenerated from update.sh in the same directory. -{ - dev = { - version = "35.0.1883.0"; - url = "http://commondatastorage.googleapis.com/chromium-browser-official/chromium-35.0.1883.0.tar.xz"; - sha256 = "0qbv6prxl18y5824pfd13ng9798g561gzb6nypwp502hqr45jvb6"; - }; - beta = { - version = "34.0.1847.60"; - url = "http://commondatastorage.googleapis.com/chromium-browser-official/chromium-34.0.1847.60.tar.xz"; - sha256 = "1na5d6z4a0wkabn7cj62vyiv3mmvcb6qdvrkyy6fj79h7gk2hb7k"; - }; - stable = { - version = "34.0.1847.116"; - url = "http://commondatastorage.googleapis.com/chromium-browser-official/chromium-34.0.1847.116.tar.xz"; - sha256 = "04cpfav5rqa117igvzmrw0045r2ljxg5fqb46qgqvkgff30pjrfx"; - }; -} diff --git a/pkgs/applications/networking/browsers/chromium/update.sh b/pkgs/applications/networking/browsers/chromium/update.sh index 0c4881bb3962..e82d22f34fd0 100755 --- a/pkgs/applications/networking/browsers/chromium/update.sh +++ b/pkgs/applications/networking/browsers/chromium/update.sh @@ -3,16 +3,9 @@ channels_url="http://omahaproxy.appspot.com/all?csv=1"; history_url="http://omahaproxy.appspot.com/history"; bucket_url="http://commondatastorage.googleapis.com/chromium-browser-official/"; -output_file="$(cd "$(dirname "$0")" && pwd)/sources.nix"; +base_path="$(cd "$(dirname "$0")" && pwd)/source"; -nix_getattr() -{ - input_file="$1"; - attr="$2"; - - var="$(nix-instantiate --eval-only -A "$attr" "$output_file")"; - echo "$var" | tr -d '\\"'; -} +source "$(nix-build --no-out-link "$base_path/update.nix" -A updateHelpers)"; ### poor mans key/value-store :-) ### @@ -53,39 +46,6 @@ get_newest_ver() fi; } -if [ -e "$output_file" ]; -then - get_sha256() - { - channel="$1"; - version="$2"; - url="$3"; - - oldver="$(nix_getattr "$output_file" "$channel.version")"; - - echo -n "Checking if $oldver ($channel) is up to date..." >&2; - - if [ "x$(get_newest_ver "$version" "$oldver")" != "x$oldver" ]; - then - echo " no, getting sha256 for new version $version:" >&2; - sha256="$(nix-prefetch-url "$url")" || return 1; - else - echo " yes, keeping old sha256." >&2; - sha256="$(nix_getattr "$output_file" "$channel.sha256")" \ - || return 1; - fi; - - sha_insert "$version" "$sha256"; - echo "$sha256"; - return 0; - } -else - get_sha256() - { - nix-prefetch-url "$3"; - } -fi; - fetch_filtered_history() { curl -s "$history_url" | sed -nr 's/^'"linux,$1"',([^,]+).*$/\1/p'; @@ -99,9 +59,8 @@ get_prev_sha256() for version in $(fetch_filtered_history "$channel"); do [ "x$version" = "x$current_version" ] && continue; - url="${bucket_url%/}/chromium-$version.tar.xz"; - sha256="$(get_sha256 "$channel" "$version" "$url")" || continue; - echo "$sha256:$version:$url"; + sha256="$(get_sha256 "$channel" "$version")" || continue; + echo "$sha256:$version"; return 0; done; } @@ -113,34 +72,39 @@ get_channel_exprs() channel="${chline%%,*}"; version="${chline##*,}"; - url="${bucket_url%/}/chromium-$version.tar.xz"; - echo -n "Checking if sha256 of version $version is cached..." >&2; if sha256="$(sha_lookup "$version")"; then echo " yes: $sha256" >&2; else echo " no." >&2; - sha256="$(get_sha256 "$channel" "$version" "$url")"; + sha256="$(get_sha256 "$channel" "$version")"; if [ $? -ne 0 ]; then echo "Whoops, failed to fetch $version, trying previous" \ "versions:" >&2; - sha_ver_url="$(get_prev_sha256 "$channel" "$version")"; - sha256="${sha_ver_url%%:*}"; - ver_url="${sha_ver_url#*:}"; - version="${ver_url%%:*}"; - url="${ver_url#*:}"; + sha_ver="$(get_prev_sha256 "$channel" "$version")"; + sha256="${sha_ver%:*}"; + version="${sha_ver#*:}"; fi; fi; sha_insert "$version" "$sha256"; + main="${sha256%%.*}"; + deb="${sha256#*.}"; + deb32="${deb%.*}"; + deb64="${deb#*.}"; + echo " $channel = {"; echo " version = \"$version\";"; - echo " url = \"$url\";"; - echo " sha256 = \"$sha256\";"; + echo " sha256 = \"$main\";"; + if [ "x${deb#*[a-z0-9].[a-z0-9]}" != "x$deb" ]; + then + echo " sha256bin32 = \"$deb32\";"; + echo " sha256bin64 = \"$deb64\";"; + fi; echo " };"; done; } @@ -151,8 +115,8 @@ omaha="$(curl -s "$channels_url")"; versions="$(echo "$omaha" | sed -nr -e 's/^linux,([^,]+,[^,]+).*$/\1/p')"; channel_exprs="$(get_channel_exprs "$versions")"; -cat > "$output_file" <<-EOF -# This file is autogenerated from update.sh in the same directory. +cat > "$base_path/sources.nix" <<-EOF +# This file is autogenerated from update.sh in the parent directory. { $channel_exprs } diff --git a/pkgs/development/libraries/libopus/default.nix b/pkgs/development/libraries/libopus/default.nix index b1bf65d0fe67..78b264506f01 100644 --- a/pkgs/development/libraries/libopus/default.nix +++ b/pkgs/development/libraries/libopus/default.nix @@ -1,4 +1,4 @@ -{ stdenv, fetchurl, fixedPoint ? false }: +{ stdenv, fetchurl, fixedPoint ? false, withCustomModes ? false }: let version = "1.1"; @@ -11,7 +11,8 @@ stdenv.mkDerivation rec { sha256 = "158xprn2086arvdib3vbbygz7z6jqkw2nci7nlywzzwallap0wmr"; }; - configureFlags = stdenv.lib.optionalString fixedPoint "--enable-fixed-point"; + configureFlags = stdenv.lib.optional fixedPoint "--enable-fixed-point" + ++ stdenv.lib.optional withCustomModes "--enable-custom-modes"; doCheck = true; diff --git a/pkgs/development/libraries/libwebp/default.nix b/pkgs/development/libraries/libwebp/default.nix index 854af5942f90..6800541d923f 100644 --- a/pkgs/development/libraries/libwebp/default.nix +++ b/pkgs/development/libraries/libwebp/default.nix @@ -1,14 +1,20 @@ -{stdenv, fetchurl, libpng, libjpeg}: +{ stdenv, fetchurl, libpng, libjpeg, giflib, libtiff }: stdenv.mkDerivation rec { - name = "libwebp-0.1.3"; - + name = "libwebp-0.4.0"; + src = fetchurl { url = "http://webp.googlecode.com/files/${name}.tar.gz"; - sha256 = "1fkssvg99s9ypswh4ywkirgcy1wmy3b6388f3cqj4a4vwdb89ca0"; + sha256 = "0sadjkx8m6sf064r5gngjvz4b5246q3j27dlaml5b1k3x5vkb49i"; }; - buildInputs = [ libpng libjpeg ]; + buildInputs = [ libpng libjpeg giflib libtiff ]; + + configureFlags = [ + "--enable-libwebpmux" + "--enable-libwebpdemux" + "--enable-libwebpdecoder" + ]; meta = { homepage = http://code.google.com/p/webp/; diff --git a/pkgs/development/libraries/minizip/default.nix b/pkgs/development/libraries/minizip/default.nix new file mode 100644 index 000000000000..b71920446e4c --- /dev/null +++ b/pkgs/development/libraries/minizip/default.nix @@ -0,0 +1,14 @@ +{ stdenv, zlib, autoconf, automake, libtool }: + +stdenv.mkDerivation { + name = "minizip-${zlib.version}"; + inherit (zlib) src; + + nativeBuildInputs = [ autoconf automake libtool ]; + buildInputs = [ zlib ]; + + preConfigure = '' + cd contrib/minizip + autoreconf -vfi + ''; +} diff --git a/pkgs/development/libraries/v8/3.14.nix b/pkgs/development/libraries/v8/3.14.nix new file mode 100644 index 000000000000..0564e6887957 --- /dev/null +++ b/pkgs/development/libraries/v8/3.14.nix @@ -0,0 +1,65 @@ +{ stdenv, fetchsvn, gyp, readline, python, which }: + +assert readline != null; + +let + system = stdenv.system; + arch = if system == "i686-linux" then "ia32" else if system == "x86_64-linux" || system == "x86_64-darwin" then "x64" else ""; + version = "3.14.5.9"; +in + +assert arch != ""; + +stdenv.mkDerivation { + name = "v8-${version}"; + + src = fetchsvn { + url = "http://v8.googlecode.com/svn/tags/${version}"; + sha256 = "18qp5qp5xrb6f00w01cklz358yrl54pks963f5rwvwz82d8sfyqr"; + name = "v8-${version}-src"; + }; + + patches = [ ./fix-GetLocalizedMessage-usage.patch ]; + + configurePhase = '' + mkdir build/gyp + ln -sv ${gyp}/bin/gyp build/gyp/gyp + ''; + + nativeBuildInputs = [ which ]; + buildInputs = [ readline python ]; + + buildFlags = [ + "library=shared" + "console=readline" + "${arch}.release" + ]; + + # http://code.google.com/p/v8/issues/detail?id=2149 + NIX_CFLAGS_COMPILE = "-Wno-unused-local-typedefs -Wno-aggressive-loop-optimizations"; + + enableParallelBuilding = true; + + installPhase = '' + mkdir -p $out/bin + mkdir -p $out/lib + mv -v out/${arch}.release/d8 $out/bin + + ${if stdenv.system == "x86_64-darwin" then + "mv -v out/${arch}.release/libv8.dylib $out/lib" + else + "mv -v out/${arch}.release/lib.target/libv8.so $out/lib"} + mv -v include $out/ + ''; + + postFixup = if stdenv.isDarwin then '' + install_name_tool -change /usr/local/lib/libv8.dylib $out/lib/libv8.dylib -change /usr/lib/libgcc_s.1.dylib ${stdenv.gcc.gcc}/lib/libgcc_s.1.dylib $out/bin/d8 + install_name_tool -id $out/lib/libv8.dylib -change /usr/lib/libgcc_s.1.dylib ${stdenv.gcc.gcc}/lib/libgcc_s.1.dylib $out/lib/libv8.dylib + '' else null; + + meta = with stdenv.lib; { + description = "V8 is Google's open source JavaScript engine"; + platforms = platforms.linux ++ platforms.darwin; + license = licenses.bsd3; + }; +} diff --git a/pkgs/development/libraries/v8/default.nix b/pkgs/development/libraries/v8/default.nix index 0564e6887957..db8e491caae3 100644 --- a/pkgs/development/libraries/v8/default.nix +++ b/pkgs/development/libraries/v8/default.nix @@ -1,65 +1,66 @@ -{ stdenv, fetchsvn, gyp, readline, python, which }: +{ stdenv, fetchurl, gyp, readline, python, which, icu }: assert readline != null; let - system = stdenv.system; - arch = if system == "i686-linux" then "ia32" else if system == "x86_64-linux" || system == "x86_64-darwin" then "x64" else ""; - version = "3.14.5.9"; + arch = if stdenv.is64bit then "x64" else "ia32"; in -assert arch != ""; +stdenv.mkDerivation rec { + name = "v8-${version}"; + version = "3.25.9"; -stdenv.mkDerivation { - name = "v8-${version}"; + src = fetchurl { + url = "https://commondatastorage.googleapis.com/chromium-browser-official/" + + "${name}.tar.bz2"; + sha256 = "0x6czv99dr701vljyb4ghyhhc5rmv7vfkpvigcnrqz2an9q1pc28"; + }; - src = fetchsvn { - url = "http://v8.googlecode.com/svn/tags/${version}"; - sha256 = "18qp5qp5xrb6f00w01cklz358yrl54pks963f5rwvwz82d8sfyqr"; - name = "v8-${version}-src"; - }; + configurePhase = '' + PYTHONPATH="tools/generate_shim_headers:$PYTHONPATH" \ + ${gyp}/bin/gyp \ + -f make \ + --generator-output="out" \ + -Dflock_index=0 \ + -Dv8_enable_i18n_support=1 \ + -Duse_system_icu=1 \ + -Dconsole=readline \ + -Dcomponent=shared_library \ + -Dv8_target_arch=${arch} \ + --depth=. -Ibuild/standalone.gypi \ + build/all.gyp + ''; - patches = [ ./fix-GetLocalizedMessage-usage.patch ]; + nativeBuildInputs = [ which ]; + buildInputs = [ readline python icu ]; - configurePhase = '' - mkdir build/gyp - ln -sv ${gyp}/bin/gyp build/gyp/gyp - ''; + buildFlags = [ + "LINK=g++" + "-C out" + "builddir=$(CURDIR)/Release" + "BUILDTYPE=Release" + ]; - nativeBuildInputs = [ which ]; - buildInputs = [ readline python ]; + enableParallelBuilding = true; - buildFlags = [ - "library=shared" - "console=readline" - "${arch}.release" - ]; + installPhase = '' + install -vD out/Release/d8 "$out/bin/d8" + ${if stdenv.system == "x86_64-darwin" then '' + install -vD out/Release/lib.target/libv8.dylib "$out/lib/libv8.dylib" + '' else '' + install -vD out/Release/lib.target/libv8.so "$out/lib/libv8.so" + ''} + cp -vr include "$out/" + ''; - # http://code.google.com/p/v8/issues/detail?id=2149 - NIX_CFLAGS_COMPILE = "-Wno-unused-local-typedefs -Wno-aggressive-loop-optimizations"; + postFixup = if stdenv.isDarwin then '' + install_name_tool -change /usr/local/lib/libv8.dylib $out/lib/libv8.dylib -change /usr/lib/libgcc_s.1.dylib ${stdenv.gcc.gcc}/lib/libgcc_s.1.dylib $out/bin/d8 + install_name_tool -id $out/lib/libv8.dylib -change /usr/lib/libgcc_s.1.dylib ${stdenv.gcc.gcc}/lib/libgcc_s.1.dylib $out/lib/libv8.dylib + '' else null; - enableParallelBuilding = true; - - installPhase = '' - mkdir -p $out/bin - mkdir -p $out/lib - mv -v out/${arch}.release/d8 $out/bin - - ${if stdenv.system == "x86_64-darwin" then - "mv -v out/${arch}.release/libv8.dylib $out/lib" - else - "mv -v out/${arch}.release/lib.target/libv8.so $out/lib"} - mv -v include $out/ - ''; - - postFixup = if stdenv.isDarwin then '' - install_name_tool -change /usr/local/lib/libv8.dylib $out/lib/libv8.dylib -change /usr/lib/libgcc_s.1.dylib ${stdenv.gcc.gcc}/lib/libgcc_s.1.dylib $out/bin/d8 - install_name_tool -id $out/lib/libv8.dylib -change /usr/lib/libgcc_s.1.dylib ${stdenv.gcc.gcc}/lib/libgcc_s.1.dylib $out/lib/libv8.dylib - '' else null; - - meta = with stdenv.lib; { - description = "V8 is Google's open source JavaScript engine"; - platforms = platforms.linux ++ platforms.darwin; - license = licenses.bsd3; - }; + meta = with stdenv.lib; { + description = "V8 is Google's open source JavaScript engine"; + platforms = platforms.linux ++ platforms.darwin; + license = licenses.bsd3; + }; } diff --git a/pkgs/development/libraries/zlib/default.nix b/pkgs/development/libraries/zlib/default.nix index 0d4abaf25e0a..f1eea80ab7a3 100644 --- a/pkgs/development/libraries/zlib/default.nix +++ b/pkgs/development/libraries/zlib/default.nix @@ -40,4 +40,6 @@ stdenv.mkDerivation rec { # zlib doesn't like the automatic --disable-shared from the Cygwin stdenv. cygwinConfigureEnableShared = true; + + passthru.version = version; } diff --git a/pkgs/development/web/nodejs/default.nix b/pkgs/development/web/nodejs/default.nix index 062d7f4ec066..3b1b64679722 100644 --- a/pkgs/development/web/nodejs/default.nix +++ b/pkgs/development/web/nodejs/default.nix @@ -1,4 +1,4 @@ -{ stdenv, fetchurl, openssl, python, zlib, v8, utillinux, http-parser, c-ares, pkgconfig, runCommand }: +{ stdenv, fetchurl, openssl, python, zlib, v8_3_14, utillinux, http-parser, c-ares, pkgconfig, runCommand }: let dtrace = runCommand "dtrace-native" {} '' @@ -10,7 +10,7 @@ let # !!! Should we also do shared libuv? deps = { - inherit v8 openssl zlib http-parser; + inherit v8_3_14 openssl zlib http-parser; cares = c-ares; }; diff --git a/pkgs/servers/nosql/mongodb/default.nix b/pkgs/servers/nosql/mongodb/default.nix index 6956271e992c..a5a021b93545 100644 --- a/pkgs/servers/nosql/mongodb/default.nix +++ b/pkgs/servers/nosql/mongodb/default.nix @@ -1,4 +1,4 @@ -{ stdenv, fetchurl, scons, boost, v8, gperftools, pcre, snappy }: +{ stdenv, fetchurl, scons, boost, v8_3_14, gperftools, pcre, snappy }: let version = "2.4.8"; in stdenv.mkDerivation rec { name = "mongodb-${version}"; @@ -8,7 +8,7 @@ let version = "2.4.8"; in stdenv.mkDerivation rec { sha256 = "1p6gnharypglfp39halp72fig96fqjhakyy7m76a1prxwpjkqw7x"; }; - nativeBuildInputs = [ scons boost v8 gperftools pcre snappy ]; + nativeBuildInputs = [ scons boost v8_3_14 gperftools pcre snappy ]; postPatch = '' substituteInPlace SConstruct \ diff --git a/pkgs/servers/nosql/rethinkdb/default.nix b/pkgs/servers/nosql/rethinkdb/default.nix index e81ccb396322..ec1dbd763646 100644 --- a/pkgs/servers/nosql/rethinkdb/default.nix +++ b/pkgs/servers/nosql/rethinkdb/default.nix @@ -1,4 +1,4 @@ -{ stdenv, fetchurl, which, protobuf, v8, ncurses, gperftools, boost, m4 }: +{ stdenv, fetchurl, which, protobuf, v8_3_14, ncurses, gperftools, boost, m4 }: stdenv.mkDerivation rec { name = "rethinkdb-1.11.2"; @@ -15,7 +15,7 @@ stdenv.mkDerivation rec { configureFlags = "--lib-path ${gperftools}/lib"; - buildInputs = [ protobuf v8 ncurses boost ]; + buildInputs = [ protobuf v8_3_14 ncurses boost ]; nativeBuildInputs = [ which m4 ]; diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 1475b3f4ed71..9f9b15920b67 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -5409,6 +5409,8 @@ let ming = callPackage ../development/libraries/ming { }; + minizip = callPackage ../development/libraries/minizip { }; + minmay = callPackage ../development/libraries/minmay { }; miro = callPackage ../applications/video/miro { @@ -6156,7 +6158,13 @@ let inherit (gnome) libsoup; }; - v8 = callPackage ../development/libraries/v8 { inherit (pythonPackages) gyp; }; + v8 = callPackage ../development/libraries/v8 { + inherit (pythonPackages) gyp; + }; + + v8_3_14 = callPackage ../development/libraries/v8/3.14.nix { + inherit (pythonPackages) gyp; + }; xmlsec = callPackage ../development/libraries/xmlsec { }; @@ -7750,7 +7758,6 @@ let chromium = lowPrio (callPackage ../applications/networking/browsers/chromium { channel = "stable"; - gconf = gnome.GConf; pulseSupport = config.pulseaudio or true; }); |