Re: Chromium security bugs remain unfixed for > 1 month

2022-03-02 Thread Kevin Kofler via devel
Demi Marie Obenour wrote: > On 3/2/22 10:09, Tom Callaway wrote: >> Additionally, Fedora uses GCC (intentionally) which requires patch work >> for each release, but improves the quality of the resulting package. > > Would it be possible to make a one-off exception for Chromium? There is actually

Re: Chromium security bugs remain unfixed for > 1 month

2022-03-02 Thread Kevin Kofler via devel
Demi Marie Obenour wrote: > Arch uses the upstream *source* code, but not the binaries, if I > understand correctly. They just don’t have anywhere near as many > patches as Fedora does. I suspect this is a combination of factors. > First, Arch builds use clang and more bundled libraries, so they

Re: Chromium security bugs remain unfixed for > 1 month

2022-03-02 Thread Richard W.M. Jones
On Wed, Mar 02, 2022 at 04:07:43PM -, Leigh Scott wrote: > > Fedora cannot use the default tarball due to legal restrictions. > > Additionally, Fedora uses > > GCC (intentionally) which requires patch work for each release, but > > improves the quality > > of the resulting package. > > So GC

Re: Chromium security bugs remain unfixed for > 1 month

2022-03-02 Thread Gary Buhrmaster
On Wed, Mar 2, 2022 at 5:06 AM Demi Marie Obenour wrote: > What would it take to get tall of the users of QtWebEngine onto 6.2? I > don’t think Fedora should ship any version of QtWebEngine except the > latest, since only the latest version appears to get regular patches. Well, it is slightly m

Re: Chromium security bugs remain unfixed for > 1 month

2022-03-02 Thread Demi Marie Obenour
On 3/2/22 10:09, Tom Callaway wrote: > Apologies for the delays. My wife has been rather ill for a while, so my open > source time has been greatly minimized lately. I am so sorry. > Fedora cannot use the default tarball due to legal restrictions. Unfortunate but understandable. How much recur

Re: Chromium security bugs remain unfixed for > 1 month

2022-03-02 Thread Tom Seewald
Thanks, and thank you for maintaining chromium-freeworld in rpmfusion. ___ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-U

Re: Chromium security bugs remain unfixed for > 1 month

2022-03-02 Thread Leigh Scott
> Fedora cannot use the default tarball due to legal restrictions. > Additionally, Fedora uses > GCC (intentionally) which requires patch work for each release, but improves > the quality > of the resulting package. So GCC needs 125Gb of Ram to build chromium? https://koji.fedoraproject.org/koji

Re: Chromium security bugs remain unfixed for > 1 month

2022-03-02 Thread Leigh Scott
> VAAPI hasn't worked for a long time on chromium. In "chrome://gpu" it shows > "Video Decode: Software only. Hardware acceleration disabled" and it cannot be > changed in "chrome://flags" either. This is the case for Fedora's packaged > chromium and rpmfusion's chromium-freeworld. I encourage you

Re: Chromium security bugs remain unfixed for > 1 month

2022-03-02 Thread Tom Seewald
> We ship VA-API integration, which Google doesn't offer. VAAPI hasn't worked for a long time on chromium. In "chrome://gpu" it shows "Video Decode: Software only. Hardware acceleration disabled" and it cannot be changed in "chrome://flags" either. This is the case for Fedora's packaged chromiu

Re: Chromium security bugs remain unfixed for > 1 month

2022-03-02 Thread Neal Gompa
On Wed, Mar 2, 2022 at 9:19 AM Zbigniew Jędrzejewski-Szmek wrote: > > On Wed, Mar 02, 2022 at 07:08:07AM -0500, Neal Gompa wrote: > > Those features provide tangible benefits to the community at large > > that we would lose by "sloppy packaging". Instead of kvetching, why > > not try helping? Mayb

Re: Chromium security bugs remain unfixed for > 1 month

2022-03-02 Thread Tom Callaway
Apologies for the delays. My wife has been rather ill for a while, so my open source time has been greatly minimized lately. Fedora cannot use the default tarball due to legal restrictions. Additionally, Fedora uses GCC (intentionally) which requires patch work for each release, but improves th

Re: Chromium security bugs remain unfixed for > 1 month

2022-03-02 Thread Zbigniew Jędrzejewski-Szmek
On Wed, Mar 02, 2022 at 07:08:07AM -0500, Neal Gompa wrote: > Those features provide tangible benefits to the community at large > that we would lose by "sloppy packaging". Instead of kvetching, why > not try helping? Maybe *ask* Tom what you could do to help him ship > newer versions? Neal, plea

Re: Chromium security bugs remain unfixed for > 1 month

2022-03-02 Thread Vitaly Zaitsev via devel
On 02/03/2022 12:44, Demi Marie Obenour wrote: That doesn’t explain why RPM Fusion gets updates so much more quickly. RPM Fusion don't need to manually strip ffmpeg, apply some specific patches, etc. In the case of something like Chromium, a sloppy package that gets timely updates is better

Re: Chromium security bugs remain unfixed for > 1 month

2022-03-02 Thread Neal Gompa
On Wed, Mar 2, 2022 at 6:44 AM Demi Marie Obenour wrote: > > On 3/2/22 04:05, Vitaly Zaitsev via devel wrote: > > On 02/03/2022 01:21, Demi Marie Obenour wrote: > >> What are the differences between the RPMFusion SRPM and the > >> Fedora SRPM? > > > > RPM Fusion version includes all available mult

Re: Chromium security bugs remain unfixed for > 1 month

2022-03-02 Thread Demi Marie Obenour
On 3/2/22 04:05, Vitaly Zaitsev via devel wrote: > On 02/03/2022 01:21, Demi Marie Obenour wrote: >> What are the differences between the RPMFusion SRPM and the >> Fedora SRPM? > > RPM Fusion version includes all available multimedia codecs. That doesn’t explain why RPM Fusion gets updates so muc

Re: Chromium security bugs remain unfixed for > 1 month

2022-03-02 Thread Vitaly Zaitsev via devel
On 02/03/2022 02:45, Demi Marie Obenour wrote: I am surprised that the answer is not to automatically download and install Canonical’s Snap package Absolutely no way. Everything must be built from sources on trusted infra. No exceptions. -- Sincerely, Vitaly Zaitsev (vit...@easycoding.org)

Re: Chromium security bugs remain unfixed for > 1 month

2022-03-02 Thread Vitaly Zaitsev via devel
On 02/03/2022 01:21, Demi Marie Obenour wrote: What are the differences between the RPMFusion SRPM and the Fedora SRPM? RPM Fusion version includes all available multimedia codecs. Tom Callaway, what is the hardest part for you? Packaging of Google's software is a nightmare. They do their b

Re: Chromium security bugs remain unfixed for > 1 month

2022-03-01 Thread Demi Marie Obenour
On 3/1/22 22:44, Kevin Kofler via devel wrote: > Demi Marie Obenour wrote: >> Me too. I am surprised that the answer is not to automatically >> download and install Canonical’s Snap package; they seem to have >> figured out everything already. Arch manages to do it by having very >> few patches a

Re: Chromium security bugs remain unfixed for > 1 month

2022-03-01 Thread Demi Marie Obenour
On 3/1/22 23:14, Adam Williamson wrote: > On Tue, 2022-03-01 at 19:21 -0500, Demi Marie Obenour wrote: >> On 3/1/22 16:02, Jonathan Schleifer wrote: >>> Hi! >>> >>> It looks like Chromium on Fedora is not receiving timely updates. It >>> hasn't been updated in over a month and there were many bugs

Re: Chromium security bugs remain unfixed for > 1 month

2022-03-01 Thread Adam Williamson
On Tue, 2022-03-01 at 19:21 -0500, Demi Marie Obenour wrote: > On 3/1/22 16:02, Jonathan Schleifer wrote: > > Hi! > > > > It looks like Chromium on Fedora is not receiving timely updates. It > > hasn't been updated in over a month and there were many bugs fixed > > upstream. At the very least, C

Re: Chromium security bugs remain unfixed for > 1 month

2022-03-01 Thread Kevin Kofler via devel
Kevin Kofler via devel wrote: > (Well, technically, I suppose I could attempt to backport them from 90- > based, i.e., from QtWebengine 6.2: > https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=90-based > or even directly from Chromium upstream, but that is extremely time- > consuming and n

Re: Chromium security bugs remain unfixed for > 1 month

2022-03-01 Thread Kevin Kofler via devel
Demi Marie Obenour wrote: > Me too. I am surprised that the answer is not to automatically > download and install Canonical’s Snap package; they seem to have > figured out everything already. Arch manages to do it by having very > few patches and using the upstream source tarball. If you think t

Re: Chromium security bugs remain unfixed for > 1 month

2022-03-01 Thread Demi Marie Obenour
On 3/1/22 19:42, Michael Catanzaro wrote: > On Tue, Mar 1 2022 at 07:21:14 PM -0500, Demi Marie Obenour > wrote: >> Tom Callaway, what is the hardest part for you? > > Keep in mind Tom is a volunteer and Chromium packaging is not fun. I'm > impressed that anybody is willing to attempt it tbh.

Re: Chromium security bugs remain unfixed for > 1 month

2022-03-01 Thread Michael Catanzaro
On Tue, Mar 1 2022 at 07:21:14 PM -0500, Demi Marie Obenour wrote: Tom Callaway, what is the hardest part for you? Keep in mind Tom is a volunteer and Chromium packaging is not fun. I'm impressed that anybody is willing to attempt it tbh. Michael ___

Re: Chromium security bugs remain unfixed for > 1 month

2022-03-01 Thread Demi Marie Obenour
On 3/1/22 16:02, Jonathan Schleifer wrote: > Hi! > > It looks like Chromium on Fedora is not receiving timely updates. It > hasn't been updated in over a month and there were many bugs fixed > upstream. At the very least, Chromium on Fedora is vulnerable to the > following: > > CVE-2022-0452: