Fedora's missing Chromium updates [LWN.net]

By Jonathan Corbet
March 4, 2022

Google's Chrome browser seemingly dominates the Internet at this point, but that does not mean that everybody wants to run it. Chrome, of course, is built on an open-source project called Chromium but is not an open-source product itself; it includes a number of proprietary add-ons. But the Chromium source is out there and can, with some effort, be used to build a working, open-source browser; a number of distributors do so. But Chromium is famously hard to package, and distributors have, at times, struggled to keep up with it; a recent discussion in the Fedora community has brought new attention to this problem.

Comparisons between Chrome and Chromium often focus on what the latter browser lacks. It doesn't have Google's automatic updates, for example, and it is missing a number of codecs for problematic media formats. Chromium's ability to use the Google bookmark-synchronization feature was taken away in 2021. But Chromium users can also point to what is gained, starting with the fact that it is free software. Chromium lacks many of the data-reporting mechanisms found in Chrome and is rather less insistent about using one's Google ID with random web sites. Distributors can also add their own features as well.

The problem with Chromium is that it is a huge and messy program to build. The source tarball (compressed) weighs in at well over 1GB. The list of dependencies is long; some of those are bundled with the browser source, while others must be provided by the operating system. The result is that even an out-of-the-box build can be challenging; if the distributor has to make changes to meet its own requirements, the problem gets harder yet.

Fedora does have its own requirements. As a general rule, bundled libraries are not acceptable; packages are expected to use the shared libraries provided by the distribution. Chromium, like other applications, is expected to integrate with the rest of the Fedora environment — working well with the Wayland display system, for example. Red Hat's legal team places its own requirements on software that can be shipped, meaning that some of the code (codecs, primarily) that is part of Chromium must be excluded from the build. And, just because that all isn't challenging enough, Fedora builds the browser with GCC, despite the fact that the Chromium developers use LLVM.

It all comes down to a difficult impedance-matching task for anybody who works to build Chromium for Fedora. This is not a new situation; it first cropped up on LWN back in 2009, when including Chromium in Fedora seemed like an impossible task. Chromium was finally able to enter the Fedora repository in 2013 and has been there ever since. The task of packaging Chromium has gotten easier for distributors since, but "easier" is not the same as "easy".

One of the other advantages claimed for Chromium over Chrome is its faster update cycle. But source updates and updated packages in distribution repositories are two different things. The current Chromium release is 99.0.4844.48 but, as of this writing, Fedora is shipping version 96.0.4664.110, which was released in December. Jonathan Schleifer took to the Fedora development list to complain about this lag. He included a long list of CVE numbers that have been addressed since Fedora last shipped a Chromium release, noting that a number of them are said to be actively exploited on the net. Fedora Chromium users, he said, should "stop using it NOW", and Fedora should consider using the RPM Fusion version, which is currently at 98.0.4758.102.

Demi Marie Obenour went further, saying that Fedora should perhaps loosen its standards for the Chromium package: "In the case of something like Chromium, a sloppy package that gets timely updates is better than a fully conforming package that does not". That led to a strong response from Neal Gompa, who expressed his disappointment with anybody "who thinks it's okay to do less than a good job on shipping software". Beyond addressing the integration issues (both for users and lawyers) with Fedora, he said, the Fedora build brings a number of advantages:

For example, Fedora's Chromium will attempt to use Wayland by default on a Wayland desktop. Upstream Chrom(e|ium) is not ready for that yet. We ship VA-API integration, which Google doesn't offer. We have working screencasting on Wayland, which upstream doesn't have right now by default. We can enable security features that upstream refuses to (CaBLE, for example). And so on.

Falling back to "sloppy packaging", he said, would lose those benefits. Tom Seewald responded by saying that, if keeping Chromium current is too much work, the browser should simply be removed from the repository.

Tom Callaway, who has done the bulk of the work to maintain Chromium in Fedora for all these years, jumped in to say that, due to family issues, he has been short of time to work on open-source projects. He defended the work that Fedora does with Chromium, though, and said that he had finally managed to get past some build failures that had been holding things up. The results of that work can be seen in the Rawhide distribution, which currently ships version 98.0.4758.102. Not that the problem is solved: "Of course, Google released a new major version this morning, so the terrifying carousel spins anew".

Fedora will likely get an updated Chromium in the near future. Meanwhile, the criticisms of its maintenance of the Fedora Chromium package may have encountered strong pushback on the mailing list, but they are not entirely without merit. Shipping an Internet-exposed application with known security holes is the sort of thing that distributors like Fedora normally go far out of their way to avoid, and any users who are compromised by one of those vulnerabilities will take little comfort from the otherwise high quality of the Chromium package. An outdated and vulnerable Chromium package falls short of the standards that the Fedora community sets for itself.

While there are developers who are paid to work on Fedora, the distribution also depends on volunteers working on their own time. The Chromium package may have suffered from this; it looks a lot like a heroic, one-person effort that could benefit from some extra help. Perhaps it is time for both Red Hat and the Fedora community to try to provide that help. Even users of other browsers benefit from a solid Chromium package for all of those "Chrome-only" web sites; failing to provide that could prove harmful for Fedora in the long run.

to post comments

Fedora's missing Chromium updates

Posted Mar 4, 2022 16:10 UTC (Fri) by smoogen (subscriber, #97) [Link] (17 responses)

Internet Browsers are a NIMBY (Not In My BackYard) problem for distributions. Everyone wants one that works perfectly, but very few people want to put in the work themselves to make it work. When it comes to staffing it, it is always a 'Can we get someone else to do that for us?' over and over again.

Part of it is that most browsers are an operating system in themselves. You have to fake/second-guess the main operating system in some many places because every slowdown causes an avalanche of soul-numbing 'Why is my page so slloooooow your browser sucks!'. If you are lucky you get someone coming up with a fix they worked out in a thesis which is much faster but only under ideal situation.. and then once you factor in those you find it is at best the algorithm you already had.

In the end, you end up finding out you need to staff just as much as you do for the 'core' operating system. There will be people who have to know compilers, people who have to know network latency, file latency, and video latency. You have to have people who have to deal with at least 3 different embedded scripting languages: CSS, HTML and Javascript. Finally you have to deal with standards which are basically 'you should do this, but no one else does so if you do, it will look like crap'. And finally once you get all that dealt together you have an unending bikeshed problem because every user "knows art when they see it." but can't understand why no one else can.

And finally when you come up with the staffing needed to deal with this, you get from the community and if a business from management.. 'wow that's too much, you have to be wrong'. This seems to cause a reset of all the complaints for a while but no additional staffing. Which then rolls down to someone having to try and make it work until they break. And the distribution usually ends up having to just focus on one browser like Firefox because it is more 'community focused' versus 'throw over the wall LOL'.

Fedora's missing Chromium updates

Posted Mar 4, 2022 21:57 UTC (Fri) by mattdm (subscriber, #18) [Link] (16 responses)

This is off-topic to Chromium, but I want to push back on your "NIMBY" claim. Martin Stransky, who works on Firefox as part of Fedora, is personally responsible for a large portion of "Firefox continues to work on Linux at all".

But, fundamentally... I think almost all software should actually be "not our problem" to distributions. Our role is getting open source software to users in a polished, secure way. If we need significant investment in application development at the distro level around things which aren't distro-specific, something is off track.

Fedora's missing Chromium updates

Posted Mar 4, 2022 23:34 UTC (Fri) by pbonzini (subscriber, #60935) [Link] (1 responses)

I think you're in violent agreement, he said "very few people" want to do the work, not no one.

Fedora's missing Chromium updates

Posted Mar 5, 2022 20:42 UTC (Sat) by ballombe (subscriber, #9523) [Link]

> ... "very few people" want to do the work
This is true for almost every packages in a distribution...

Fedora's missing Chromium updates

Posted Mar 5, 2022 8:31 UTC (Sat) by NYKevin (subscriber, #129325) [Link]

> If we need significant investment in application development at the distro level around things which aren't distro-specific, something is off track.

From upstream's perspective, there are several options for providing up-to-date binaries, and they all suck in one way or another:

1. Build and maintain packages yourself, and tell users to add your server as an extra repo. Main downside: Have to do this for every distro you care about (probably Debian and/or Fedora at a minimum, but if you only do one, then users of the other will ask/demand that you support it, or else they will try to install it themselves with third-party deb2rpm/rpm2deb tools, and now you're in the business of de facto supporting that use case). Some users will complain that it's not in their distro's standard repo (which might even be a valid complaint, if the product happens to be FOSS). Main upside: You have a real package manager handling installation, but at the same time, you retain maximal control over what that package manager will actually do.
2. Build and maintain packages yourself, and get them added to the official repo. All the downsides of (1), with the additional downside that you have less control over the package and have to "play nice" with the distro's rules. Arguably, that's a good thing, since many of these packages are poorly made, but from the perspective of upstream, this is extra work and "office" politics. Also, if one of your developers gets into a stupid argument with somebody on a mailing list, some journalist might decide that it's newsworthy, so now your PR people have to be aware that that's a thing. Main upside: If you do it right, distro devs will like you for making their lives easier. Also, installation is relatively easy for the end user.
3. Provide a flatpak or one of the equivalents. Main downside: Everyone will say that you are bad and wrong for vendoring everything, and also it will use up more disk space than the other options once installed. Main upside: It Just Works™ on the vast majority of reasonable systems, at least assuming you built it right.
4. Provide a tarball. Then you lose everyone who doesn't either have a compiler installed or know how to install one, and on top of that, you probably also lose a good 5-10% of the remainder to weird configure/make errors. But at least it's less work (you just run autoconf and tar/gzip everything up).
5. Be popular enough that some/most distros are willing to do (2) for you. Main downside: If they screw up the packaging, you'll probably get blamed for the resulting misbehavior of your application. Main upside: No work at all (but practically speaking, it's "polite" to at least offer tarballs so that distros have a reasonable starting point).

TL;DR: There is real work that has to be done, somebody has to do it, and upstream is only going to do it if they think it is in their interest to do it.

Fedora's missing Chromium updates

Posted Mar 5, 2022 14:55 UTC (Sat) by smoogen (subscriber, #97) [Link] (2 responses)

1. I must apologize for not being clearer in my original comment. I only wanted to focus on complaints about Chromium maintenance and make it a slight against Martin Stransky's work on Firefox. However, if Firefox is only on Fedora due the heroic work of one person and the vast number of people expecting it to work are not putting any effort in it, then it is a Not In My Back Yard problem. They want it, they know they need it, they know it is required, but putting in the work to make it work would mean having to give up something they prefer so meh let someone else take the work.

2. I don't know what to do with your second paragraph. If it isn't part of the distributions work (and the people who consume said distribution) to help the upstream browsers make it work, then whose is it? The browser companies have already a full hand working on 98% of the desktops they could deploy to by keeping things working Windows and MacOS. Add to that their largest share is on phones which dwarf the amount of work needed for desktops. If it is the consumers of Firefox/Chromium to do so themselves, then why do they even need a distribution?

Fedora's missing Chromium updates

Posted Mar 5, 2022 16:58 UTC (Sat) by amacater (subscriber, #790) [Link] (1 responses)

There's a bunch of additional work in Debian and Fedora, for example, in porting Firefox and Chromium to machines and architectures that upstream doesn't really care about - so more than amd64 / x86_64 or arm64 / aarch64. That's good and useful work in that it also sometimes throws up alignment issues or whatever. I'm not sure how much of that work is actually taken in by upstream.

Outwith the distributions doing this - and Debian is broadly the upstream for Ubuntu and all Debian derivatives, Fedora the upstream for most Red Hat-alikes - you wouldn't have the availability to run either of these in places where they run today.
Credit where credit's due, please. One bugbear for Debian, at least, appears to be Rust and Firefox dependencies on Rust which change rapidly and where the necessary toolchains are hard to build. That turns out to be a significant blocker.

The browser as 9/10 of a distro's complexity, - and avoiding things like vendor bundling with NPM and pip dependencies in packages being the other 9/10 - it's also tough to find capable porter boxes and time. The rapidity of change of versions upstream is also the enemy of the good here, I think.

Fedora's missing Chromium updates

Posted Mar 6, 2022 8:01 UTC (Sun) by Tov (subscriber, #61080) [Link]

It seems the underlying issue is perhaps not only lack of man-power, but a too large difference to upstream. The article does not really address whether Google is a receptive upstream or cares too little about desktop Linux.

If all the distros have to invest a lot of work in getting important Linux features integrated (Wayland, VA-API, gcc build etc.) they could perhaps band together to make a common "mid-stream" project, which acts as impedance matching to the un-receptive upstream?

Fedora's missing Chromium updates

Posted Mar 5, 2022 15:03 UTC (Sat) by smoogen (subscriber, #97) [Link]

One other thing I failed to do was to say that I am as guilty as many others on this. Tom and Martin have been doing lots of work and I have done zip to help them. I just expect my browser to work when I come in the morning and I move on.. just like I expect my water in my pipes to be clean and my garbage to be picked up.

Now what I can do to get out of this position is going to be hard, but well I have to do so.

Fedora's missing Chromium updates

Posted Mar 5, 2022 17:34 UTC (Sat) by wtarreau (subscriber, #51152) [Link] (3 responses)

This situation really makes me sad. Indeed, browsers have become full-blown operating systems. They're so complex that they can barely be qualified as opensource in that me, you or most users cannot even figure how to enter this to adjust their unpleasant behaviors, let alone build them. So we just have to undergo, just as if they were proprietary. And I suspect that there's a strong disconnection between browser developers and those doing the packaging. To me it looks like "take it as is, period" (i.e. download the binary). The level of effort that the packagers have to provide just to get such essential components packaged seems tremendous and unrewarding. Maybe if such too painful packages were dropped at some point, their developers would make an effort to improve modularity, build dependencies and everything that results in so much pain for packagers.

In my opinion, packagers should probably only be bothered by porting to architectures that are not in the upstream developers' focus but only on their distro's focus. But at least on default architectures, opensource software should definitely build out of the box and not require thousands of dollars of hardware investment to see a build complete in less than 24 hours :-/

Those having to do that painful job have my sympathy, as I gave up trying to build my browser more than a decade ago, and without their efforts I would probably just be using outdated and vulnerable binaries.

Fedora's missing Chromium updates

Posted Mar 5, 2022 21:54 UTC (Sat) by Paf (subscriber, #91811) [Link] (2 responses)

But the packagers aren’t packaging for upstreams target platforms, so upstream might well just … do nothing. Android is quite different from desktop Linux and for desktop usage, Linux is an almost immeasurably small fraction. That’s why these things stink to package for Linux. If it weren’t for Mac OS being a Unix family OS and the presence of Android, I think there’s a solid chance they wouldn’t work *at all* on Linux. I guess Firefox maybe would… but that’s it.

Fedora's missing Chromium updates

Posted Mar 6, 2022 2:24 UTC (Sun) by khim (subscriber, #9252) [Link] (1 responses)

The main reason Chrome and Firefox work on Linux is the fact that cloud offerings are cheaper for Linux.

Which means that lots of CI/CD testing happens on Linux which means they have to build that beast on Linux somehow.

They have zero incentive to do anything beyond that and if distros don't provide an easy way to give the binaries used for CI/CD purposes to the end users… well… it's their loss then.

Fedora's missing Chromium updates

Posted Mar 6, 2022 3:35 UTC (Sun) by mjg59 (subscriber, #23239) [Link]

Developer workstations in Google are largely Linux, so there's an internal incentive to support the platform. There's also, uh, ChromeOS, at which point you're most of the way to a desktop Linux version anyway. The cost to Google of running core Chrome CI infrastructure on Windows rather than Linux would be pretty negligible, owning a cloud platform means a lot of your internal costing is just made up anyway.

Fedora's missing Chromium updates

Posted Mar 7, 2022 9:50 UTC (Mon) by nim-nim (subscriber, #34454) [Link] (4 responses)

Hi,

Browsers are not an operating system, and browsers makers are not able to deliver an operating system (otherwise FirefoxOS would have been a direct success).

Browsers are complex apps that reach deeply inside the operating system. Therefore browser devs *have* to work with their upstreams to feed changes and fixes there.

However they tried the usual dev shortcut of bundling because it is “someone else's problem”® and it is cheap and fast (at first). And now the whole card pile is about to crash (happened so many times before, see Java log4j etc).

There is no good solution short of browser makers becoming OS makers themselves or learning to work better with OS makers. Either way would force them to un-bundle things since os-level monorepos are unmanageable.

But, humans being humans, people will stress the system to the breakpoint to avoid doing things they do not want to do.

Fedora's missing Chromium updates

Posted Mar 7, 2022 16:46 UTC (Mon) by mjg59 (subscriber, #23239) [Link] (2 responses)

> browsers makers are not able to deliver an operating system

(stares in ChromeOS)

Fedora's missing Chromium updates

Posted Mar 7, 2022 22:59 UTC (Mon) by foom (subscriber, #14868) [Link]

Indeed, Firefox is the only browser engine which _doesn't_ have an affiliated OS!

Fedora's missing Chromium updates

Posted Mar 8, 2022 16:59 UTC (Tue) by nim-nim (subscriber, #34454) [Link]

ChromeOS is a separate OS team (despite the deliberately confusing naming).

Fedora's missing Chromium updates

Posted Mar 12, 2022 23:17 UTC (Sat) by immibis (subscriber, #105511) [Link]

Browsers are operating systems. They are just *different* operating systems. They have different strengths and weaknesses from traditional operating systems, which is why it's conventional to install both on the same machine - one inside the other, like a virtual machine.

Fedora's missing Chromium updates

Posted Mar 4, 2022 17:01 UTC (Fri) by NightMonkey (subscriber, #23051) [Link] (5 responses)

Just FYI, I've been happy with Gentoo's meta-packaging of Chromium for quite a long time. Do I use the 'proprietary-codec' and 'widevine' USE flags? Yes. But I like being able to choose my cross. :) The "effort" for me is compiling it, but that's one command. And does it take a while? Yes, even though I have distcc set up, it takes 5-8 hours. But that's not *my* time - that's the computer's time. And, with a few exceptions over the years, It Just Works(TM).

Perhaps the Fedora devs should make a build-farm with a Gentoo base to build their binaries reliably? If it was good enough for Google themselves to use Gentoo build facilities to build ChromeOS and ChromiumOS and their packages, then they can perhaps benefit, too. :)

Oh, and they can disable 'proprietary-codec' USE flag and make their legal teams happier.

Cheers!

Fedora's missing Chromium updates

Posted Mar 4, 2022 17:36 UTC (Fri) by iabervon (subscriber, #722) [Link]

Either that, or have a common project among different distros to produce the source that gives you the options that distros want. That said, I think part of Gentoo's ability to build Chromium well is due to it being able to update system library packages to versions without matching ABIs by rebuilding other packages when necessary. (Also, possibly, the use of slots to let Chromium use a version of a system library that Chromium has been tested with and requires, but no other software in the distro has been tested with yet.)

Fedora's missing Chromium updates

Posted Mar 4, 2022 17:41 UTC (Fri) by flussence (guest, #85566) [Link]

I swore off Chromium around the time the tarball suddenly jumped to over half a gigabyte, several years ago. Not that I couldn't build it, but that was one of a hundred signals that the project was becoming more of an affliction than an application. I prefer it when the tools I use to communicate with the outside world aren't making headlines.

Fedora's missing Chromium updates

Posted Mar 5, 2022 1:09 UTC (Sat) by vimja (subscriber, #91577) [Link] (2 responses)

I must admin, I stopped building Chromium on all my Gentoo machines with the exception of one particularly powerful desktop I use. It takes just sooo long to build. Other large programs like Firefox, Libreoffice or even LLVM and Rust are built very quickly in comparison. And it needs to be updated so often. In the end I felt it simply wasn't worth it any longer for me.

Even on that powerful desktop I use, I had to resort to reducing the number of parallel build jobs (-j) through package.env because the system would OOM otherwise. Such a pain :/

Fedora's missing Chromium updates

Posted Mar 7, 2022 8:47 UTC (Mon) by taladar (subscriber, #68407) [Link] (1 responses)

I have the same experience. I do not build Chromium any more on my Gentoo systems and in fact considering it does not have significantly more features than Firefox I consider the Chrome/Chromium codebase incredibly bloated because it takes so much longer to build.

Fedora's missing Chromium updates

Posted Mar 7, 2022 9:39 UTC (Mon) by adobriyan (guest, #30858) [Link]

> I do not build Chromium any more on my Gentoo systems

Chromium debuginfo build is a must test workload for anyone touching kernel swap code.

Fedora's missing Chromium updates

Posted Mar 4, 2022 17:44 UTC (Fri) by smcv (subscriber, #53363) [Link] (9 responses)

Debian has had a very similar conversation in the last couple of months, with essentially the same problems with packaging Chromium. Fedora has a shorter release cycle than Debian, and a different packaging format, but its policies around Free Software and avoiding vendored/bundled libraries where possible are quite similar.

Fedora's missing Chromium updates

Posted Mar 4, 2022 18:17 UTC (Fri) by logang (subscriber, #127618) [Link] (6 responses)

The story with chromium is mildly interesting. I'm more interested to know why Debian's firefox release is so behind. With an entirely up to date bullseye system, it installs 78 which some websites are complaining now is unsupported. This has been the case for months, even when buster and stretch have version 91 through the security maintainers. A bug report from December says the bullseye release is waiting on compiler fixes but 3 months later it hasn't arrived.

To make it a bigger head scratcher, I managed to find a deb for 91.6.0esr-1~deb11u1 sitting on the security servers which I've installed manually. But how many systems exist with the out dated version that could be fixed simply by telling systems to download this install this build?

Fedora's missing Chromium updates

Posted Mar 4, 2022 18:50 UTC (Fri) by amacater (subscriber, #790) [Link] (5 responses)

In which case, check your /etc/apt/sources.list is current and contains the correct lines:

deb http://deb.debian.org/debian bullseye main non-free contrib
deb-src http://deb.debian.org/debian bullseye main non-free contrib

deb http://security.debian.org/debian-security bullseye-security main contrib non-free
deb-src http://security.debian.org/debian-security bullseye-security main contrib non-free

# bullseye-updates, to get updates before a point release is made;
# see https://www.debian.org/doc/manuals/debian-reference/ch02....
deb http://deb.debian.org/debian bullseye-updates main contrib non-free
deb-src http://deb.debian.org/debian bullseye-updates main contrib non-free

or thereabouts.

Fedora's missing Chromium updates

Posted Mar 4, 2022 19:41 UTC (Fri) by logang (subscriber, #127618) [Link] (4 responses)

Yes, I have the correct security and bullseye-updates repos in my sources.list

You can see here that bullseye still has version 78.15.0esr-1~deb11u1 and no other options.

https://packages.debian.org/search?searchon=names&key...

Fedora's missing Chromium updates

Posted Mar 4, 2022 22:04 UTC (Fri) by jbicha (subscriber, #75043) [Link] (2 responses)

Bullseye has 91 in its security updates repo

Fedora's missing Chromium updates

Posted Mar 4, 2022 22:29 UTC (Fri) by logang (subscriber, #127618) [Link]

Oh, harumph. Seems on my desktops I had sometime in the past set APT::Default-Release "stable", and that apparently disables security updates with bullseye:

https://www.debian.org/releases/bullseye/amd64/release-no...

To add to the confusion, Debian's package list pages don't list security packages for bullseye anymore (likely due to the same change) so it looked like they hadn't been added yet (as seen in the link I posted in the grandparent). So for all I could tell, I was receiving the security updates but in fact I was not. At least I got to the bottom of that.

Fedora's missing Chromium updates

Posted Mar 5, 2022 1:28 UTC (Sat) by dilinger (subscriber, #2867) [Link]

Debian's probably about due for a point release; I've had similar issues with people thinking Debian stable is still on chromium 90.

Fedora's missing Chromium updates

Posted Mar 5, 2022 8:36 UTC (Sat) by andrewsh (subscriber, #71043) [Link]

$ apt policy firefox-esr
firefox-esr:
  Installed: (none)
  Candidate: 91.6.0esr-1~deb11u1
  Version table:
     91.6.0esr-1~deb11u1 500
        500 http://security.debian.org bullseye-security/main amd64 Packages
     78.15.0esr-1~deb11u1 500
        500 http://ftp.debian.org/debian bullseye/main amd64 Packages

Fedora's missing Chromium updates

Posted Mar 5, 2022 14:40 UTC (Sat) by lobachevsky (subscriber, #121871) [Link] (1 responses)

And Debian's package is in even worse shape than Fedora's situation. Debian stable currently ships Chromium 90.0.4430.212-1 and there are dozens of critical, open CVEs for that.

Fedora's missing Chromium updates

Posted Mar 5, 2022 17:12 UTC (Sat) by smcv (subscriber, #53363) [Link]

Debian stable systems are expected to have apt sources for both bullseye and bullseye-security (or whatever version they are on, bullseye being the current stable release) to get timely security updates. It's a bit like the way Windows has (or used to have?) individual security updates for individual security issues (those are like a bullseye-security update), and also "service packs" that collect lots of security and non-security fixes into one big release (those are like a bullseye update).

The bullseye-security suite is where the security team put new security updates that correspond to a security advisory. It has chromium 99 and firefox-esr 91 already. Other packages with recent-ish CVEs have updated versions in bullseye-security, for example Flatpak 1.10.7 and expat 2.2.10-2+deb11u2.

The bullseye suite is slow-moving, and is only updated during point releases every couple of months. 11.2 is the latest, and 11.3 should ideally have happened during February (but presumably the stable release managers have been too busy). At the moment it's still on chromium 90 and firefox-esr 78 (and Flatpak 1.10.5 and expat 2.2.10-2), but chromium 99 and firefox-esr 91 (and Flatpak 1.10.7 and expat 2.2.10-2+deb11u2) will be copied from bullseye-security into bullseye during the 11.3 point release. Point releases also include fixes for non-security-related bugs (there's a non-security GTK update queued up for 11.3, for example).

I believe the reasoning behind this is that it means the critical path for issuing new security updates involves a much smaller package-set than the entire Debian archive (because it doesn't have to include any packages that haven't needed a security update during this release cycle), which makes it lower-overhead for the security team to manage, so they can ship security updates sooner. It also makes it more feasible to use time-limited signatures on the metadata, so that people can detect a malicious or broken proxy, mirror or ISP holding back updates that they should have received.

Ubuntu security updates are also like this, but more so: in Ubuntu, a released suite like focal *never* gets updated, and all package updates (including security fixes) happen via focal-security or focal-updates.

Fedora's missing Chromium updates

Posted Mar 4, 2022 20:18 UTC (Fri) by jhoblitt (guest, #77733) [Link] (4 responses)

Can gnome trigger the opening of URLs in a flatpak packaged browser?

Fedora's missing Chromium updates

Posted Mar 4, 2022 21:29 UTC (Fri) by basmevissen (guest, #54935) [Link] (3 responses)

Yes, you can. You can even set it as default browser in your ~/.config/mimeapps.list file (using the gui if you want).

Fedora's missing Chromium updates

Posted Mar 4, 2022 22:01 UTC (Fri) by jhoblitt (guest, #77733) [Link] (2 responses)

I use flatpaked browsers for testing occasionally and have no complaints. As long as I can take screenshots, download into ~/Downloads, and open URLs from other apps I'm happy. Seems like flatpak would be a reasonable option for fedora's chromium build and that would let them relax trying to replace bundled deps.

Fedora's missing Chromium updates

Posted Mar 7, 2022 11:20 UTC (Mon) by cortana (subscriber, #24596) [Link] (1 responses)

I wonder how well they work for accelerated video decoding and/or 3D? These things barely work with the official upstream builds or distro's own builds...

Fedora's missing Chromium updates

Posted Mar 10, 2022 14:45 UTC (Thu) by kpfleming (subscriber, #23250) [Link]

I use Flatpaked Firefox on Debian Bullseye and graphics acceleration (via VAAPI) works just fine.

Fedora's missing Chromium updates

Posted Mar 4, 2022 22:02 UTC (Fri) by basmevissen (guest, #54935) [Link] (9 responses)

When it comes to the missing updates, I think that such sensitive packages should have more than one knowledgeable packager. There can always be a reason why someone is not in the position to do their work. Sometimes it is even necessary to have an update in a day, for example in case of a 0-day. That something that cannot always be expected that from a single individual.

When it comes to packaging such complex software with a lot of very specific requirements and dependencies, I think a flatpack is a viable option. There is an official flatpack from the Chromium project (https://flathub.org/apps/details/org.chromium.Chromium) that is up to date and runs fine on Fedora 35.

For Red Hat/ Fedora, the advantages of their builds are really offset by the legal limitations they face. It would be nice if there was a way to get around that (e.g. with a non-free repo that adds those).

Fedora's missing Chromium updates

Posted Mar 4, 2022 22:56 UTC (Fri) by re:fi.64 (subscriber, #132628) [Link] (8 responses)

I'm the maintainer of the Chromium Flatpak, and although I appreciate the shout-out, please do note that it's *not* actually official!

Fedora's missing Chromium updates

Posted Mar 4, 2022 23:00 UTC (Fri) by basmevissen (guest, #54935) [Link] (6 responses)

You are welcome. Keep up the good work on the Flatpak!
There is nothing on the page on flathub that hints on it being *not* official. Maybe it is a good idea to make that clear.

Fedora's missing Chromium updates

Posted Mar 5, 2022 3:47 UTC (Sat) by re:fi.64 (subscriber, #132628) [Link] (4 responses)

Thanks for the kind words!

I'll look into making it more explicit, but do note that there are *no* official Chromium binaries. Any official builds by Google will always be under the Chrome branding instead.

Fedora's missing Chromium updates

Posted Mar 6, 2022 20:45 UTC (Sun) by basmevissen (guest, #54935) [Link] (3 responses)

I currently (Sun 6 Mar 21:45 CET) do not see any Chromium flatpak on flathub. Are you changing stuff?
I also noticed we went back from 99.xxxx to 98.xxxx yesterday. That was apparently deliberate: https://github.com/flathub/org.chromium.Chromium/commit/a...
Can you please elaborate on what is going on? Thanks!

Fedora's missing Chromium updates

Posted Mar 6, 2022 21:17 UTC (Sun) by mbunkus (subscriber, #87248) [Link] (1 responses)

I actually did a search for "browser" and "chromium" a couple of hours ago, and at least two Chromium flatpaks were listed — one of them ungoogled.

It seems to me that flathub.org is currently somewhat broken: not only does any type of search yield 0 results, even clicking on any of the categories in the sidebar lists the same number.

The only links that work a little bit are "Popular" and the two "Editor's choice" ones, and "Popular" even lists Chromium. But clicking on any of the packages yields a "not found" page.

So yeah… currently broken.

Fedora's missing Chromium updates

Posted Mar 6, 2022 22:33 UTC (Sun) by mbunkus (subscriber, #87248) [Link]

And they're back:

https://flathub.org/apps/details/org.chromium.Chromium
https://flathub.org/apps/details/com.github.Eloston.Ungoo...

Fedora's missing Chromium updates

Posted Mar 7, 2022 2:45 UTC (Mon) by re:fi.64 (subscriber, #132628) [Link]

I... honestly don't know what's up with version 99. The new tarballs and Chrome release were removed by upstream, presumably due to regressions (probably https://github.com/flathub/org.chromium.Chromium/issues/207), but I can't find any public info as to why. The tarball was re-added now, but with no changes, and the corresponding Chrome release still hasn't been re-released...so I'm just waiting to see what happens now.

Fedora's missing Chromium updates

Posted Mar 5, 2022 10:32 UTC (Sat) by nedrichards (guest, #23295) [Link]

This is work that is in fact currently occuring right now in partnership between the GNOME foundation and Flathub. https://foundation.gnome.org/2022/01/21/further-investmen... (and in the context of the whole conversation above has been on the backlog of all the volunteers who work on flathub for many, many years but some money helped to catalyse making it happen quicker!)

Chromium as a flatpak: Thanks!

Posted Mar 5, 2022 4:02 UTC (Sat) by CChittleborough (subscriber, #60775) [Link]

I use this flatpak (as a secondary browser, for websites that don’t support Firefox) and it Just Works for me. Thanks for all your work!

Fedora's missing Chromium updates

Posted Mar 4, 2022 22:44 UTC (Fri) by pebolle (guest, #35204) [Link] (14 responses)

The article and the comments mention Fedora, Redhat, Debian and Gentoo. There's also Ubuntu, Suse and some other, sometimes quite obscure distributions. The article further mentions Chromium and Firefox. There's also Konqueror and Epiphany, but I'm not sure what their current status is. Are there any other Free browsers?

Multiple distributions, multiple browsers, negligible market share but a vast overlap of effort. I think this is, at the very least, a suboptimal outcome. But yay diversity right?

Fedora's missing Chromium updates

Posted Mar 4, 2022 23:02 UTC (Fri) by KJ7RRV (subscriber, #153595) [Link] (1 responses)

GNU IceCat is another free browser. It is based on Firefox. Afaik it's very similar, so it might not count as a separate browser.

Fedora's missing Chromium updates

Posted Mar 5, 2022 14:40 UTC (Sat) by brunowolff (guest, #71160) [Link]

The Firefox devs have some privacy blind spots and Icecat has fixes for a number of them. I appreciate the work that gets done to make the Icecat fork of Firefox.

Fedora's missing Chromium updates

Posted Mar 5, 2022 0:53 UTC (Sat) by pabs (subscriber, #43278) [Link] (8 responses)

> There's also Konqueror and Epiphany, but I'm not sure what their current status is.

Konqueror uses a web engine that is security unsupported at least in Debian.

Epiphany is also known as GNOME Web and uses the security supported WebKitGTK web engine.

> Are there any other Free browsers?

There are lots of free browsers that are forks of Firefox or Chromium or use their web engines or forks of them.

netsurf is another free browser, it uses its own web engine that is not as featureful as more mainstream engines though. It works fine for HTML documents, but not really for web apps.

There is this weird LISP browser, ISTR it uses one of the WebKit/Chromium lineage of web engines.

https://nyxt.atlas.engineer/

Fedora's missing Chromium updates

Posted Mar 5, 2022 2:52 UTC (Sat) by kenmoffat (guest, #4807) [Link] (7 responses)

When I looked a month or so back, konqueror actually uses qtwebengine these days, as Arch implied, although the only official konqueror documentation I could find suggested otherwise. And it was only by using it on an updating page (a news feed) that I could see in 'top' that it was using qtwebengine. It's really hard to work out what it uses, probably does a dynamic link.

The other kde browser, falkon, also uses qtwebengine, and unlike the rest of qt5 you can get current versions of that from git. Of course, although the qt devs are good at backporting CVE fixes, qtwebengine5 is stuck on chrome 87 and therefore python2.7. But falkon does work on some websites that only work with chrome or its derivatives .

Fedora's missing Chromium updates

Posted Mar 5, 2022 3:58 UTC (Sat) by pabs (subscriber, #43278) [Link] (6 responses)

Neither of the Qt web engines (QtWebKit/QtWebEngine) are security supported on Debian unfortunately.

Fedora's missing Chromium updates

Posted Mar 5, 2022 19:44 UTC (Sat) by kenmoffat (guest, #4807) [Link] (5 responses)

debian sid has qtwebengine-5.15.8 [https://packages.debian.org/source/sid/qtwebengine-openso...] and is using debian versions of 5.15.2 for the remaining qt dependencies - I think you will find those include both the qtsvg CVEs, so I suggest that you use sid for qt5.

Fedora's missing Chromium updates

Posted Mar 7, 2022 8:52 UTC (Mon) by taladar (subscriber, #68407) [Link] (4 responses)

Debian sid is not a distro version meant for use, it is more like a staging area for packages that go into stable and testing.

Fedora's missing Chromium updates

Posted Mar 7, 2022 18:03 UTC (Mon) by nybble41 (subscriber, #55106) [Link] (3 responses)

Debian sid / unstable is the rolling development version, and can be a perfectly usable distro (though not really a "release") depending on your requirements. You can install a complete, working system using only packages from Debian sid—there is an installer available (the Unstable "mini.iso"), though no full CD/DVD images due to the rate of change. It's "experimental" which is exclusively for staging and doesn't include all the packages needed for a working system.

One could say that sid / unstable is the staging area for the testing release, in much the same way that testing is the staging area for stable. That doesn't imply that it "is not a distro version meant for use"; it's meant for developers and beta-testers to use. Those who are less tolerant of typical bleeding-edge development instability will still want to use the testing or stable releases, of course, and these are both kept more up-to-date than they once were.

Fedora's missing Chromium updates

Posted Mar 7, 2022 20:26 UTC (Mon) by kronat (subscriber, #117266) [Link] (2 responses)

> ... typical bleeding-edge development instability...

Such as? I'm using a rolling-release distro, and my experience is (and was) awesome.

Fedora's missing Chromium updates

Posted Mar 8, 2022 4:58 UTC (Tue) by Wol (subscriber, #4433) [Link] (1 responses)

And?

Rolling Release != Bleeding Edge

For example, Tumbleweed, Gentoo, Debian Testing, I'm sure there's plenty more ...

Cheers,
Wol

Fedora's missing Chromium updates

Posted Mar 8, 2022 9:13 UTC (Tue) by kronat (subscriber, #117266) [Link]

You're right. So, let me change it: I'm using a bleeding edge, and rolling-release, distro [...]

Fedora's missing Chromium updates

Posted Mar 6, 2022 9:13 UTC (Sun) by flussence (guest, #85566) [Link] (1 responses)

Dillo is a useful one to have around, at least for reading HTML files in /usr/share/doc/. It uses TeX's word-wrapping algorithm IIRC, something the mainstream browsers had no equivalent to until relatively recently.

Fedora's missing Chromium updates

Posted Mar 10, 2022 19:18 UTC (Thu) by rwmj (subscriber, #5474) [Link]

Haven't used dillo in a long time, but I'm quite impressed with how snappy it is compared to Firefox (on lwn.net).

Fedora's missing Chromium updates

Posted Mar 6, 2022 19:26 UTC (Sun) by opsec (subscriber, #119360) [Link]

palemoon, falkon, iridium are other browsers. I'm using FreeBSD, sometimes, upstreams are not really interested in build patches for those. The maintainers for those packages are heroes, it's wild ride.

Fedora's missing Chromium updates

Posted Mar 5, 2022 1:10 UTC (Sat) by dilinger (subscriber, #2867) [Link]

Minor correction - the latest version of chromium for desktop (which includes Windows, Mac, and Linux) is 99.0.4844.51; I uploaded it to Debian a few days ago. Chromium 99.0.4844.48 is specifically the Android release.

Fedora's missing Chromium updates

Posted Mar 5, 2022 4:16 UTC (Sat) by passthejoe (guest, #156034) [Link]

It's worth noting that the Chromium packaged for Fedora also becomes, through EPEL the Chromium for CentOS and other RHEL-compatible distros.

Tom "Spot" Callaway is a key player in packaging for Fedora and EPEL, and I value his contributions.

Ungoogled Chromium

Posted Mar 5, 2022 5:26 UTC (Sat) by zaitseff (subscriber, #851) [Link]

It's probably worth mentioning the excellent Ungoogled Chromium project, as well as the related Ungoogled Chromium for Debian repository. Unfortunately, the "unified" Debian package for Ungoogled Chromium is stuck at version 95.0.4638.54-1 -- if others can help solve the underlying issue, that would no doubt be appreciated!

Fedora's missing Chromium updates

Posted Mar 6, 2022 15:11 UTC (Sun) by jezuch (subscriber, #52988) [Link] (5 responses)

> For example, Fedora's Chromium will attempt to use Wayland by default on a Wayland desktop. Upstream Chrom(e|ium) is not ready for that yet. We ship VA-API integration, which Google doesn't offer. We have working screencasting on Wayland, which upstream doesn't have right now by default. We can enable security features that upstream refuses to (CaBLE, for example). And so on.

How much of that could or should be pushed upstream? Chromium is (supposedly) open-source. But if this can't be fixed upstream, then in fact it is not.

Fedora's missing Chromium updates

Posted Mar 6, 2022 15:43 UTC (Sun) by mathstuf (subscriber, #69389) [Link] (4 responses)

It's still FOSS. However, just as with any contribution, there is the "is it worth the cost for us to accept this patch and commit to maintaining it ourselves?" angle that needs to be taken into account. Given that Google (presumably) doesn't care all that much right now, to cost of having to merge it all the time to keep up-to-date with "real" upstream is likely non-zero. Sure, distro maintainers could work together to maintain it as part of Chromium itself, but maybe that is too much for them to split their efforts. Things will likely get done, just maybe not in a timeline that anyone is impressed by.

Fedora's missing Chromium updates

Posted Mar 8, 2022 22:00 UTC (Tue) by jezuch (subscriber, #52988) [Link] (3 responses)

> Given that Google (presumably) doesn't care all that much right now ...

If patch acceptance depends so much on whims of a single entity then IMO it's "open" and "free" only on paper.

Fedora's missing Chromium updates

Posted Mar 8, 2022 23:01 UTC (Tue) by pebolle (guest, #35204) [Link]

> If patch acceptance depends so much on whims of a single entity then IMO it's "open" and "free" only on paper.

One can reject all patches and still be considered providing free software or open source. Not just on paper but in actual practice. Patch acceptance is not a requirement for either movements and that's for perfectly good reasons.

Fedora's missing Chromium updates

Posted Mar 9, 2022 0:06 UTC (Wed) by rahulsundaram (subscriber, #21946) [Link] (1 responses)

> If patch acceptance depends so much on whims of a single entity then IMO it's "open" and "free" only on paper.

That is entirely incorrect. If I release my software under say the MIT license and I refuse to accept any patches because I have zero interest in reviewing your patches, my software is still entirely open and free, you are free to use it, you are free to fork it etc, it meets all the definitions of open source and free software. You can make a more nebulous claim that it doesn't meet some sort of "spirit" of open source software but it is a much more weaker one to make.

Fedora's missing Chromium updates

Posted Mar 20, 2022 8:16 UTC (Sun) by oldtomas (guest, #72579) [Link]

"That is entirely incorrect."

Letter and spirit and things. You are right that this is "open source" according to the letter.

First it was "free software". Then "open source" was coined. Now I'm proposing "closed open source":

My criteria? Of course not /only/ an upstream not accepting patches. But:

- an upstream controlled by one entity with commercial interests
- making patch acceptance depend on alignment with the above
- an entity so big that it can easily outprogram any fork which might be made.

Chromium: closed open source.

Yes, Rahul, I know we disagree on such things :-)

All distros should encourage users to move to the Chromium flatpak

Posted Mar 6, 2022 16:58 UTC (Sun) by shalem (subscriber, #4062) [Link] (1 responses)

Reading through all the comments here, a picture emerges where we (Linux distro users) have chromium packages thanks to the heroic efforts of about 1 person per distro.

IMHO it would be better for all the chromium packagers to band together, encourage the users of all distros to switch to the chromium flatpak and to work together with the existing chromium flatpak maintainer to share the load there (so as to e.g. always ensure timely updates) and to make it so that we have a single well maintained chromium package for all distros.

All distros should encourage users to move to the Chromium flatpak

Posted Mar 7, 2022 9:09 UTC (Mon) by taladar (subscriber, #68407) [Link]

A lot of the work for distro packaging is unbundling dependencies so large packages like Chromium do not need to be rebuilt every time some dependency has a security hole. Flatpak basically does exactly the opposite so I doubt that idea would gain much traction.

Fedora's missing Chromium updates

Posted Mar 7, 2022 7:23 UTC (Mon) by geuder (subscriber, #62854) [Link]

Reading this discussion I cannot resist the feeling that Linux users start to be in the same situation again as there were 10-20 years ago. Back then it was drivers and document formats that made everyday Linux usage a pain. Luckily those have mostly disappeared to be a daily problem during the last 10 years or so.

Now it starts to be the browser. Personally I survive very well with Firefox alone still. Haven't had any chromium installed for years. And of course not knowing the competition makes sure I don't miss anything. But the lower Firefox market share falls the more likely it becomes that its maintenance and development will suffer and more and more "Chrome-only" sites will develop.

Fedora's missing Chromium updates

Posted Mar 10, 2022 20:38 UTC (Thu) by bartoc (guest, #124262) [Link] (1 responses)

What's this CaBLE security feature mentioned? It's ungoogleable.

Fedora's missing Chromium updates

Posted Mar 10, 2022 21:11 UTC (Thu) by excors (subscriber, #95769) [Link]

Apparently caBLE is "cloud-assisted Bluetooth Low Energy" pairing, intended for pairing your PC (running Chrome) and your phone (running Android). Normal BLE pairing is either user-unfriendly (requiring you to type in a 6-digit passkey etc) or vulnerable to MITM; I assume caBLE solves that by having both devices already authenticated to your Google account, and then Google can provide an OOB channel for BLE key exchange, allowing the pairing to happen automatically and securely.

Once paired, you can then use your phone as a 2FA device for your PC (instead of e.g. a YubiKey). Since it's using BLE, it will only work when in physical proximity, which makes it more resistant to phishing than a purely cloud-based 2FA solution. Web sites can use the WebAuthn API to let the user register/authenticate with their phone as the 2FA device, and it will automatically pop up a fingerprint prompt on their phone. Apparently the user's private keys are actually stored in the Google cloud, not on the phone, so the browser will then interact with the cloud to do whatever signing the web site wants - the BLE is just for proximity detection, not for communication.

(Sources: https://blog.millerti.me/2021/06/18/previewing-chromes-ca... , https://venturebeat.com/2019/04/10/you-can-now-use-your-a...)