Subject: [bug#28004] Chromium 65

From: Marius Bakke <[email-masked]>
Date: Fri, 13 Apr 2018 21:10:48 +0200

Hello!

Attached is a patch for Chromium 65.

New in this version:

* Deleting third party files is now done with a single traversal of the
  file system, instead of the "shotgun" approach used previously.  I
  also added a second pass to scrub bundled JARs and tarballs, that will
  be incorporated in the "nftw" snippet eventually.

* It's using Clang instead of GCC since the latter is no longer
  supported upstream (as in part of their continuous integration).  GCC5
  in particular is completely broken with this release.  Debian and
  NixOS are apparently able to build it with GCC 6 and 7 respectively,
  but Arch and Gentoo changed to Clang with 65.  Unfortunately GCC6 and
  later has other problems in Guix: <https://bugs.gnu.org/30756>.

* Various tweaks to build options after reading the "GN" flags more
  closely.  In particular, more debugging symbols have been removed.

I haven't done anything on the privacy side since this update was
difficult enough as-is.  You'll notice a few hacks around Clang and
libstdc++, and also that currently only x86_64 is supported due to
unconditionally adding the x86_64 triplet to CPLUS_INCLUDE_PATH.

Hopefully future updates will be easier.  Any feedback on the
Clang/libstdc++ issues mentioned in the patch are very welcome.

From 759253a8966e2e6afbeaeb67255e4e067ce33b76 Mon Sep 17 00:00:00 2001
From: Marius Bakke <[email-masked]>
Date: Wed, 12 Oct 2016 17:25:05 +0100
Subject: [PATCH] gnu: Add chromium.

* gnu/packages/chromium.scm: New file.
* gnu/packages/patches/chromium-glibc-compat.patch,
gnu/packages/patches/chromium-remove-default-history.patch: New files.
* gnu/local.mk: Record it.
---
 gnu/local.mk                                  |   3 +
 gnu/packages/chromium.scm                     | 894 ++++++++++++++++++
 .../patches/chromium-glibc-compat.patch       |  38 +
 .../chromium-remove-default-history.patch     |  13 +
 4 files changed, 948 insertions(+)
 create mode 100644 gnu/packages/chromium.scm
 create mode 100644 gnu/packages/patches/chromium-glibc-compat.patch
 create mode 100644 gnu/packages/patches/chromium-remove-default-history.patch

diff --git a/gnu/local.mk b/gnu/local.mk
index 3d4b05c77..03f972130 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -94,6 +94,7 @@ GNU_SYSTEM_MODULES =				\
   %D%/packages/check.scm			\
   %D%/packages/chemistry.scm			\
   %D%/packages/chez.scm				\
+  %D%/packages/chromium.scm			\
   %D%/packages/ci.scm				\
   %D%/packages/cinnamon.scm			\
   %D%/packages/cmake.scm			\
@@ -591,6 +592,8 @@ dist_patch_DATA =						\
   %D%/packages/patches/ceph-skip-collect-sys-info-test.patch	\
   %D%/packages/patches/ceph-skip-unittest_blockdev.patch	\
   %D%/packages/patches/chmlib-inttypes.patch			\
+  %D%/packages/patches/chromium-glibc-compat.patch		\
+  %D%/packages/patches/chromium-remove-default-history.patch	\
   %D%/packages/patches/clang-3.5-libc-search-path.patch		\
   %D%/packages/patches/clang-3.8-libc-search-path.patch		\
   %D%/packages/patches/clang-6.0-libc-search-path.patch		\
diff --git a/gnu/packages/chromium.scm b/gnu/packages/chromium.scm
new file mode 100644
index 000000000..cecbab7a1
--- /dev/null
+++ b/gnu/packages/chromium.scm
@@ -0,0 +1,894 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2016, 2017, 2018 Marius Bakke <[email-masked]>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu packages chromium)
+  #:use-module ((guix licenses) #:prefix license:)
+  #:use-module (guix packages)
+  #:use-module (guix download)
+  #:use-module (guix git-download)
+  #:use-module (guix utils)
+  #:use-module (guix build-system gnu)
+  #:use-module (guix build-system trivial)
+  #:use-module (gnu packages)
+  #:use-module (gnu packages assembly)
+  #:use-module (gnu packages base)
+  #:use-module (gnu packages bison)
+  #:use-module (gnu packages compression)
+  #:use-module (gnu packages cups)
+  #:use-module (gnu packages curl)
+  #:use-module (gnu packages databases)
+  #:use-module (gnu packages fontutils)
+  #:use-module (gnu packages gcc)
+  #:use-module (gnu packages ghostscript)
+  #:use-module (gnu packages gl)
+  #:use-module (gnu packages glib)
+  #:use-module (gnu packages gnome)
+  #:use-module (gnu packages gnuzilla)
+  #:use-module (gnu packages gperf)
+  #:use-module (gnu packages gtk)
+  #:use-module (gnu packages icu4c)
+  #:use-module (gnu packages image)
+  #:use-module (gnu packages libevent)
+  #:use-module (gnu packages libffi)
+  #:use-module (gnu packages libusb)
+  #:use-module (gnu packages linux)
+  #:use-module (gnu packages llvm)
+  #:use-module (gnu packages kerberos)
+  #:use-module (gnu packages ninja)
+  #:use-module (gnu packages node)
+  #:use-module (gnu packages pciutils)
+  #:use-module (gnu packages photo)
+  #:use-module (gnu packages pkg-config)
+  #:use-module (gnu packages protobuf)
+  #:use-module (gnu packages pulseaudio)
+  #:use-module (gnu packages python)
+  #:use-module (gnu packages python-web)
+  #:use-module (gnu packages regex)
+  #:use-module (gnu packages serialization)
+  #:use-module (gnu packages speech)
+  #:use-module (gnu packages tls)
+  #:use-module (gnu packages valgrind)
+  #:use-module (gnu packages version-control)
+  #:use-module (gnu packages video)
+  #:use-module (gnu packages xiph)
+  #:use-module (gnu packages xml)
+  #:use-module (gnu packages xdisorg)
+  #:use-module (gnu packages xorg))
+
+(define (strip-directory-prefix pathspec)
+  "Return everything after the last '/' in PATHSPEC."
+  (let ((index (string-rindex pathspec #\/)))
+    (if index
+        (string-drop pathspec (+ 1 index))
+        pathspec)))
+
+(define (chromium-patch-file-name pathspec)
+  (let ((patch-name (strip-directory-prefix pathspec)))
+    (if (string-prefix? "chromium-" patch-name)
+        patch-name
+        (string-append "chromium-" patch-name))))
+
+;; https://anonscm.debian.org/cgit/pkg-chromium/pkg-chromium.git/tree/debian/patches
+(define (debian-patch pathspec revision hash)
+  (origin
+    (method url-fetch)
+    (uri (string-append
+          "https://anonscm.debian.org/cgit/pkg-chromium/pkg-chromium.git"
+          "/plain/debian/patches/" pathspec "?id=" revision))
+    (sha256 (base32 hash))
+    (file-name (chromium-patch-file-name pathspec))))
+
+;; https://gitweb.gentoo.org/repo/gentoo.git/tree/www-client/chromium/files
+(define (gentoo-patch pathspec revision hash)
+  (origin
+    (method url-fetch)
+    (uri (string-append
+          "https://gitweb.gentoo.org/repo/gentoo.git/plain/www-client"
+          "/chromium/files/" pathspec "?id=" revision))
+    (sha256 (base32 hash))
+    (file-name (chromium-patch-file-name pathspec))))
+
+;; https://github.com/gcarq/inox-patchset
+(define (inox-patch pathspec revision hash)
+  (origin
+    (method url-fetch)
+    (uri (string-append "https://raw.githubusercontent.com/gcarq/inox-patchset/"
+                        revision "/" pathspec))
+    (sha256 (base32 hash))
+    (file-name (chromium-patch-file-name pathspec))))
+
+;; https://github.com/NixOS/nixpkgs/tree/master/pkgs/applications/networking/browsers/chromium
+(define (nixos-patch pathspec revision hash)
+  (origin
+    (method url-fetch)
+    (uri (string-append "https://raw.githubusercontent.com/NixOS/nixpkgs/"
+                        revision "/pkgs/applications/networking/browsers"
+                        "/chromium/patches/" pathspec))
+    (sha256 (base32 hash))
+    (file-name (chromium-patch-file-name pathspec))))
+
+;; Fix an assignment bug when using Clang and libstdc++.
+(define %chromium-clang-assignment.patch
+  (gentoo-patch "chromium-clang-r3.patch"
+                "804a0d7244a06736d01c353b45c20daf324f0722"
+                "1d10il3mjzyzwgqi8iifw3aw9jnbqfrzz8v1x7cmvqpwjkykwk2a"))
+
+;; Add missing stdint include.
+(define %chromium-add-missing-stdint.patch
+  (gentoo-patch "chromium-stdint.patch"
+                "804a0d7244a06736d01c353b45c20daf324f0722"
+                "03r16zqi0hm3i00b9bwq2bdn2sp731rllizcxfl3i2q7y432a3f0"))
+
+(define %chromium-system-nspr.patch
+  (debian-patch "system/nspr.patch"
+                "debian/65.0.3325.146-4"
+                "1ggdrlz94d75ni21rx6ivvajjwhx7zwnl3s5aapysqn9kls4qsr2"))
+
+(define %chromium-system-libevent.patch
+  (debian-patch "system/event.patch"
+                "debian/65.0.3325.146-4"
+                "1k3zc59vpwc8rzbknxryjzzy99jk666whdablzcvxnyzaqk38kfx"))
+
+(define %chromium-system-icu.patch
+  (debian-patch "system/icu.patch"
+                "debian/65.0.3325.146-4"
+                "19wclidx1kyjbi3b3hnmkjs0h34d67p4dp6a48vbjbx9rxmfdk3b"))
+
+;; Don't show a warning about missing API keys.
+(define %chromium-disable-api-keys-warning.patch
+  (debian-patch "disable/google-api-warning.patch"
+                "debian/65.0.3325.146-4"
+                "1g5yk51bl7svrqx8wjxsgpz545mnymnpi3bsa62kwdm4qd8bx10x"))
+
+;; Add DuckDuckGo and set it as the default search engine.
+(define %chromium-duckduckgo.patch
+  (inox-patch "0011-add-duckduckgo-search-engine.patch"
+              "0c55cc9a81634244ad13fbbd6b5c5098b9132162"
+              "0mvw1ax0gw3d252c9b1pwbk0j7ny8z9nsfywcmhj56wm6yksgpkg"))
+
+;; Don't start a "Login Wizard" at first launch.
+(define %chromium-first-run.patch
+  (inox-patch "0018-disable-first-run-behaviour.patch"
+              "0c55cc9a81634244ad13fbbd6b5c5098b9132162"
+              "1y4zsqqf2125jkb1phwy9g5hcbd9xhyv5lr4xcaly66rpdzx2ayb"))
+
+;; Use privacy-preserving defaults.
+(define %chromium-default-preferences.patch
+  (inox-patch "0006-modify-default-prefs.patch"
+              "0c55cc9a81634244ad13fbbd6b5c5098b9132162"
+              "0zyshpl1hjssqrfhdfbgxdib4smdszjgf0ac98l978hrn9gwwk03"))
+
+;; Recent versions of Chromium may load a remote search engine on the
+;; New Tab Page, causing unnecessary and involuntary network traffic.
+(define %chromium-restore-classic-ntp.patch
+  (inox-patch "0008-restore-classic-ntp.patch"
+              "0c55cc9a81634244ad13fbbd6b5c5098b9132162"
+              "1h698cbp97g8lgmndfy6kswgwfvss7c3k609xgvyxbfldkzy7pd5"))
+
+(define opus+custom
+  (package (inherit opus)
+           (name "opus+custom")
+           (arguments
+            (substitute-keyword-arguments (package-arguments opus)
+              ((#:configure-flags flags ''())
+               ;; Opus Custom is an optional extension of the Opus
+               ;; specification that allows for unsupported frame
+               ;; sizes.  Chromium requires that this is enabled.
+               `(cons "--enable-custom-modes"
+                      ,flags))))))
+
+(define libvpx+experimental
+  (package (inherit libvpx)
+           (name "libvpx+experimental")
+           (arguments
+            (substitute-keyword-arguments (package-arguments libvpx)
+              ((#:configure-flags flags)
+               ;; Spatial SVC is an experimental VP9 encoder required
+               ;; by Chromium.
+               `(cons* "--enable-experimental" "--enable-spatial-svc"
+                       ,flags))))))
+
+;; XXX: This ugly libstdc++ variant stems from the fact that building
+;; libstdc++ standalone is not officially supported by GCC upstream, and
+;; the "make-libstdc++" procedure consequently builds a library without
+;; threading support, since the configure script fails to detect gthreads.
+;;
+;; Fixing it properly would require building libgcc (which creates
+;; gthr-default.h) before building libstdc++.  This authors attempts
+;; at doing so were unsuccessful, hence this hack.
+;;
+;; This behaviour changed upstream in this commit:
+;; https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=630d52ca0a88d173f89634a5d7dd8aee07d04d80
+;; ...or around GCC 4.6.  The libstdc++ docs are very explicit about it
+;; not being designed to used standalone (even though it worked just fine
+;; before 4.6, according to multiple mailing list threads around that time),
+;; so upstream is not interested in improving the situation.
+;;
+;; In fact, there used to be an "INSTALL" document with libstdc++, which
+;; is conspicuously missing in later releases.
+;;
+;; An alternative would be to change the GCC package to install C++ headers
+;; in "include" rather than "include/c++".  I tried that too; but it caused
+;; a bootstrapping failure.  The situation is further complicated by the
+;; fact that GCC installs C++ headers in the default output, but libstdc++.so
+;; ends up in "lib".
+;;
+;; To be continued...
+
+(define (libstdc++-from-gcc gcc)
+  "Return a libstdc++ library extracted from gcc.  The primary use case
+is when using compilers other than GCC."
+  (package
+    (inherit gcc)
+    (source #f)
+    (name "libstdc++")
+    (build-system trivial-build-system)
+    (arguments
+     `(#:modules ((guix build utils))
+       #:builder (begin
+                  (use-modules (guix build utils))
+                  (let* ((out (assoc-ref %outputs "out"))
+                         (lib (string-append out "/lib"))
+                         (include (string-append out "/include"))
+                         (gcc (assoc-ref %build-inputs "gcc"))
+                         (gcc-lib (assoc-ref %build-inputs "gcc:lib")))
+                    (mkdir-p out)
+                    (copy-recursively (string-append gcc "/include/c++")
+                                      include)
+                    (for-each (lambda (file)
+                                (install-file file lib))
+                              (find-files (string-append gcc-lib "/lib")
+                                          "^libstdc\\+\\+\\.so.*"))
+                    #t))))
+    (outputs '("out"))
+    (inputs `(("gcc" ,gcc)
+              ("gcc:lib" ,gcc "lib")))
+    (native-inputs '())
+    (propagated-inputs '())
+    (synopsis "GNU C++ standard library")))
+
+(define (make-clang-toolchain clang libcxx)
+  "Return a complete toolchain for Clang."
+  (package
+    (name "clang-toolchain")
+    (version (package-version clang))
+    (source #f)
+    (build-system trivial-build-system)
+    (arguments
+     '(#:modules ((guix build union))
+       #:builder (begin
+                   (use-modules (ice-9 match)
+                                (srfi srfi-26)
+                                (guix build union))
+
+                   (let ((out (assoc-ref %outputs "out")))
+
+                     (match %build-inputs
+                       (((names . directories) ...)
+                        (union-build out directories)))
+                     #t))))
+    (native-search-paths (package-native-search-paths clang))
+    (search-paths (package-search-paths clang))
+    (license (package-license clang))
+    (synopsis "Complete Clang tool chain for C/C++ development")
+    (description
+     "This package provides a complete Clang tool chain for C/C++.  This
+includes Clang, the Guix ld wrapper, glibc, a C++ library, and Binutils.")
+    (home-page "https://clang.llvm.org")
+    (outputs '("out"))
+    (inputs `(("clang" ,clang)
+              ("libcxx" ,libcxx)
+              ("ld-wrapper" ,(car (assoc-ref (%final-inputs) "ld-wrapper")))
+              ("binutils" ,binutils)
+              ("libc" ,glibc)))))
+
+;; When using Clang, Chromium expects to find "ar" and friends next
+;; to the clang executable.  For simplicity just create this union.
+(define chromium-clang-toolchain
+  (make-clang-toolchain clang (libstdc++-from-gcc gcc-6)))
+
+(define-public chromium
+  (package
+    (name "chromium")
+    (version "65.0.3325.181")
+    (synopsis "Graphical web browser")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "https://commondatastorage.googleapis.com/"
+                                  "chromium-browser-official/chromium-"
+                                  version ".tar.xz"))
+              (sha256
+               (base32
+                "11w6wg862ixbgm7dpqag2lmbjknv83zlr9imd8zchvmrqr468rlk"))
+              (patches (list %chromium-duckduckgo.patch
+                             %chromium-default-preferences.patch
+                             %chromium-first-run.patch
+                             %chromium-restore-classic-ntp.patch
+
+                             %chromium-clang-assignment.patch
+                             %chromium-add-missing-stdint.patch
+                             %chromium-system-icu.patch
+                             %chromium-system-nspr.patch
+                             %chromium-system-libevent.patch
+                             %chromium-disable-api-keys-warning.patch
+                             (search-patch "chromium-glibc-compat.patch")
+                             (search-patch "chromium-remove-default-history.patch")))
+              (modules '((srfi srfi-1)
+                         (srfi srfi-26)
+                         (ice-9 ftw)
+                         (ice-9 match)
+                         (ice-9 regex)
+                         (guix build utils)))
+              (snippet
+               '(begin
+                  (let ((preserved-club
+                         (map
+                          (lambda (path)
+                            ;; Prepend paths with "./" for comparison with ftw.
+                            (string-append "./" path))
+                          (list
+                           "base/third_party/dmg_fp"
+                           "base/third_party/dynamic_annotations"
+                           "base/third_party/icu"
+                           "base/third_party/libevent"
+                           "base/third_party/nspr"
+                           "base/third_party/superfasthash"
+                           "base/third_party/symbolize" ;glog
+                           "base/third_party/xdg_mime"
+                           "base/third_party/xdg_user_dirs"
+                           "buildtools/third_party/libc++"
+                           "chrome/third_party/mozilla_security_manager"
+                           "courgette/third_party"
+                           "net/third_party/mozilla_security_manager"
+                           "net/third_party/nss"
+                           "third_party/adobe/flash/flapper_version.h"
+                           ;; FIXME: This is used in:
+                           ;; * ui/webui/resources/js/analytics.js
+                           ;; * ui/file_manager/
+                           "third_party/analytics"
+                           "third_party/angle"
+                           "third_party/angle/src/common/third_party/base"
+                           "third_party/angle/src/common/third_party/smhasher"
+                           "third_party/angle/src/third_party/compiler"
+                           "third_party/angle/src/third_party/libXNVCtrl"
+                           "third_party/angle/src/third_party/trace_event"
+                           "third_party/blink"
+                           "third_party/boringssl"
+                           "third_party/boringssl/src/third_party/fiat"
+                           "third_party/breakpad"
+                           "third_party/brotli"
+                           "third_party/cacheinvalidation"
+                           "third_party/catapult"
+                           "third_party/catapult/common/py_vulcanize/third_party/rcssmin"
+                           "third_party/catapult/common/py_vulcanize/third_party/rjsmin"
+                           "third_party/catapult/third_party/polymer"
+                           "third_party/catapult/tracing/third_party/d3"
+                           "third_party/catapult/tracing/third_party/gl-matrix"
+                           "third_party/catapult/tracing/third_party/jszip"
+                           "third_party/catapult/tracing/third_party/mannwhitneyu"
+                           "third_party/catapult/tracing/third_party/oboe"
+                           "third_party/catapult/tracing/third_party/pako"
+                           "third_party/ced"
+                           "third_party/cld_3"
+                           "third_party/crc32c"
+                           "third_party/cros_system_api"
+                           "third_party/dom_distiller_js"
+                           "third_party/fips181"
+                           "third_party/flatbuffers"
+                           "third_party/glslang-angle"
+                           "third_party/google_input_tools"
+                           "third_party/google_input_tools/third_party/closure_library"
+                           (string-append "third_party/google_input_tools/third_party"
+                                          "/closure_library/third_party/closure")
+                           "third_party/googletest"
+                           "third_party/harfbuzz-ng"
+                           "third_party/hunspell"
+                           "third_party/iccjpeg"
+                           "third_party/inspector_protocol"
+                           "third_party/jinja2"
+                           "third_party/jstemplate"
+                           "third_party/khronos"
+                           "third_party/leveldatabase"
+                           "third_party/libXNVCtrl"
+                           "third_party/libaddressinput"
+                           "third_party/libjingle_xmpp"
+                           "third_party/libphonenumber"
+                           "third_party/libsecret" ;FIXME: needs pkg-config support.
+                           "third_party/libsrtp"   ;TODO: Requires libsrtp@2.
+                           "third_party/libudev"
+                           "third_party/libwebm"
+                           "third_party/libxml"
+                           "third_party/libyuv"
+                           "third_party/lss"
+                           "third_party/lzma_sdk"
+                           "third_party/markupsafe"
+                           "third_party/mesa"
+                           "third_party/metrics_proto"
+                           "third_party/modp_b64"
+                           "third_party/mt19937ar"
+                           "third_party/node"
+                           (string-append "third_party/node/node_modules/"
+                                          "polymer-bundler/lib/third_party/UglifyJS2")
+                           "third_party/openmax_dl"
+                           "third_party/ots"
+                           ;; TODO: Build as extension.
+                           "third_party/pdfium"
+                           "third_party/pdfium/third_party"
+                           (string-append "third_party/pdfium/third_party/freetype"
+                                          "/include/psnames/pstables.h")
+                           "third_party/ply"
+                           "third_party/polymer"
+                           "third_party/protobuf"
+                           "third_party/protobuf/third_party/six"
+                           "third_party/qcms"
+                           "third_party/sfntly"
+                           "third_party/skia"
+                           "third_party/skia/third_party/vulkan"
+                           "third_party/skia/third_party/gif"
+                           "third_party/smhasher"
+                           "third_party/speech-dispatcher"
+                           "third_party/spirv-headers"
+                           "third_party/spirv-tools-angle"
+                           "third_party/sqlite"
+                           "third_party/swiftshader"
+                           "third_party/swiftshader/third_party"
+                           "third_party/s2cellid"
+                           "third_party/usb_ids"
+                           "third_party/usrsctp"
+                           "third_party/vulkan"
+                           "third_party/vulkan-validation-layers"
+                           "third_party/WebKit"
+                           "third_party/web-animations-js"
+                           "third_party/webrtc"
+                           "third_party/webrtc_overrides"
+                           "third_party/widevine/cdm/widevine_cdm_version.h"
+                           "third_party/widevine/cdm/widevine_cdm_common.h"
+                           "third_party/woff2"
+                           "third_party/xdg-utils"
+                           "third_party/yasm/run_yasm.py"
+                           "third_party/zlib/google"
+                           "url/third_party/mozilla"
+                           "v8/src/third_party/utf8-decoder"
+                           "v8/src/third_party/valgrind"
+                           "v8/third_party/inspector_protocol"))))
+
+                    (define (empty? dir)
+                      (equal? (scandir dir) '("." "..")))
+
+                    (define (third_party? file)
+                      (if (string-contains file "third_party/")
+                          #t
+                          #f))
+
+                    (define (parents child)
+                      "Return a list of paths up to and including the closest third_party"
+                      (let ((lst (reverse (string-split child #\/))))
+                        (let loop ((hierarchy lst)
+                                   (result '()))
+                          (if (or (null? hierarchy)
+                                  (and (not (null? result))
+                                       (string-suffix? "third_party" (car result))))
+                              result
+                              (loop (cdr hierarchy)
+                                    (cons (string-join (reverse hierarchy) "/")
+                                          result))))))
+
+                    (define (delete-unwanted child stat flag base level)
+                      (let ((protected (make-regexp "\\.(gn|gyp)i?$")))
+                        (match flag
+                          ((or 'regular 'symlink 'stale-symlink)
+                           (when (third_party? child)
+                             (unless (or (member child preserved-club)
+                                         (any (cute member <> preserved-club)
+                                              (parents child))
+                                         (regexp-exec protected child))
+                               (delete-file child)))
+                           #t)
+                          ('directory-processed
+                           (when (empty? child)
+                             (rmdir child))
+                           #t)
+                          (_ #t))))
+
+                    (nftw "." delete-unwanted 'depth 'physical)
+
+                    ;; Do a second pass to get rid of various binary archives.
+                    (for-each delete-file
+                              (find-files "." "\\.(zip|jar|tar.gz|exe)$"))
+
+                    ;; Replace "GN" files from third_party with shims for
+                    ;; building against system libraries.  Keep this list in
+                    ;; sync with "build/linux/unbundle/replace_gn_files.py".
+                    (for-each (lambda (pair)
+                                (let ((source (string-append
+                                               "build/linux/unbundle/" (car pair)))
+                                      (dest (cdr pair)))
+                                  (copy-file source dest)))
+                              (list
+                               '("ffmpeg.gn" . "third_party/ffmpeg/BUILD.gn")
+                               '("flac.gn" . "third_party/flac/BUILD.gn")
+                               '("fontconfig.gn" . "third_party/fontconfig/BUILD.gn")
+                               '("freetype.gn" . "build/config/freetype/freetype.gni")
+                               '("harfbuzz-ng.gn" .
+                                 "third_party/harfbuzz-ng/harfbuzz.gni")
+                               '("icu.gn" . "third_party/icu/BUILD.gn")
+                               '("libdrm.gn" . "third_party/libdrm/BUILD.gn")
+                               '("libevent.gn" . "base/third_party/libevent/BUILD.gn")
+                               '("libjpeg.gn" .
+                                 "build/secondary/third_party/libjpeg_turbo/BUILD.gn")
+                               '("libpng.gn" . "third_party/libpng/BUILD.gn")
+                               '("libvpx.gn" . "third_party/libvpx/BUILD.gn")
+                               '("libwebp.gn" . "third_party/libwebp/BUILD.gn")
+                               '("libxml.gn" . "third_party/libxml/BUILD.gn")
+                               '("libxslt.gn" . "third_party/libxslt/BUILD.gn")
+                               '("openh264.gn" . "third_party/openh264/BUILD.gn")
+                               '("opus.gn" . "third_party/opus/BUILD.gn")
+                               '("re2.gn" . "third_party/re2/BUILD.gn")
+                               '("snappy.gn" . "third_party/snappy/BUILD.gn")
+                               '("yasm.gn" . "third_party/yasm/yasm_assemble.gni")
+                               '("zlib.gn" . "third_party/zlib/BUILD.gn")))
+                    #t)))))
+    (build-system gnu-build-system)
+    (arguments
+     `(#:tests? #f
+       ;; FIXME: There is a "gn" option specifically for setting -rpath, but
+       ;; it overrides the RUNPATH set by the linker.
+       #:validate-runpath? #f
+       #:modules ((srfi srfi-26)
+                  (ice-9 ftw)
+                  (ice-9 regex)
+                  (guix build gnu-build-system)
+                  (guix build utils))
+       #:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'patch-stuff
+           (lambda* (#:key inputs #:allow-other-keys)
+             (substitute* "printing/cups_config_helper.py"
+               (("cups_config =.*")
+                (string-append "cups_config = '" (assoc-ref inputs "cups")
+                               "/bin/cups-config'\n")))
+
+             (substitute*
+                 '("base/process/launch_posix.cc"
+                   "base/third_party/dynamic_annotations/dynamic_annotations.c"
+                   "sandbox/linux/seccomp-bpf/sandbox_bpf.cc"
+                   "sandbox/linux/services/credentials.cc"
+                   "sandbox/linux/services/namespace_utils.cc"
+                   "sandbox/linux/services/syscall_wrappers.cc"
+                   "sandbox/linux/syscall_broker/broker_host.cc")
+               (("include \"base/third_party/valgrind/") "include \"valgrind/"))
+
+             (for-each (lambda (file)
+                         (substitute* file
+                           ;; Fix opus include path.
+                           ;; Do not substitute opus_private.h.
+                           (("#include \"opus\\.h\"")
+                            "#include \"opus/opus.h\"")
+                           (("#include \"opus_custom\\.h\"")
+                            "#include \"opus/opus_custom.h\"")
+                           (("#include \"opus_defines\\.h\"")
+                            "#include \"opus/opus_defines.h\"")
+                           (("#include \"opus_multistream\\.h\"")
+                            "#include \"opus/opus_multistream.h\"")
+                           (("#include \"opus_types\\.h\"")
+                            "#include \"opus/opus_types.h\"")))
+                       (find-files (string-append "third_party/webrtc/modules"
+                                                  "/audio_coding/codecs/opus")))
+
+             (substitute* "chrome/common/chrome_paths.cc"
+               (("/usr/share/chromium/extensions")
+                ;; TODO: Add ~/.guix-profile.
+                "/run/current-system/profile/share/chromium/extensions"))
+
+             (substitute*
+                 "third_party/breakpad/breakpad/src/common/linux/libcurl_wrapper.h"
+               (("include \"third_party/curl") "include \"curl"))
+             (substitute* "media/base/decode_capabilities.cc"
+               (("third_party/libvpx/source/libvpx/") ""))
+
+             ;; We don't cross compile most packages, so get rid of the
+             ;; unnecessary ARCH-linux-gnu* prefix.
+             (substitute* "build/toolchain/linux/BUILD.gn"
+               (("aarch64-linux-gnu-") "")
+               (("arm-linux-gnueabihf-") ""))
+             #t))
+         (replace 'configure
+           (lambda* (#:key inputs outputs #:allow-other-keys)
+             (let* ((out (assoc-ref outputs "out"))
+                    (clang-toolchain (assoc-ref inputs "clang-toolchain"))
+                    (gtk+ (assoc-ref inputs "gtk+"))
+                    (mesa (assoc-ref inputs "mesa"))
+                    (nss (assoc-ref inputs "nss"))
+                    (udev (assoc-ref inputs "udev"))
+                    (gn-flags
+                     (list
+                      ;; See tools/gn/docs/cookbook.md and
+                      ;; https://www.chromium.org/developers/gn-build-configuration
+                      ;; for usage.  Run "./gn args . --list" in the Release
+                      ;; directory for an exhaustive list of supported flags.
+                      "is_debug=false"
+                      "use_gold=false"
+                      "use_lld=false"
+                      "linux_use_bundled_binutils=false"
+                      "use_custom_libcxx=false"
+                      "use_sysroot=false"
+                      "enable_precompiled_headers=false"
+                      "goma_dir=\"\""
+                      "enable_nacl=false"
+                      "enable_nacl_nonsfi=false"
+                      "use_allocator=\"none\"" ;don't use tcmalloc
+                      "override_build_date=\"01 01 2000 05:00:00\""
+                      "use_unofficial_version_number=false"
+
+                      ;; GCC is poorly supported, so we use Clang for now.
+                      (string-append "clang_base_path=\"" clang-toolchain "\"")
+                      "clang_use_chrome_plugins=false"
+
+                      ;; Optimize for building everything at once, as opposed
+                      ;; to incrementally for development.  See "docs/jumbo.md".
+                      "use_jumbo_build=true"
+                      ;; Disable debugging features to save space.
+                      "symbol_level=1"
+                      "remove_webcore_debug_symbols=true"
+                      "enable_iterator_debugging=false"
+                      ;; Some of the unbundled libraries throws deprecation
+                      ;; warnings, etc.  Ignore it.
+                      "treat_warnings_as_errors=false"
+                      ;; Don't add any API keys.  End users can set them in the
+                      ;; environment if desired.  See
+                      ;; <https://www.chromium.org/developers/how-tos/api-keys>.
+                      "use_official_google_api_keys=false"
+                      ;; Disable "field trials".
+                      "fieldtrial_testing_like_official_build=true"
+                      ;; Disable Chrome Remote Desktop (aka Chromoting).
+                      "enable_remoting=false"
+
+                      "use_system_freetype=true"
+                      "use_system_lcms2=true"
+                      "use_system_libjpeg=true"
+                      "use_system_libpng=true"
+                      "use_system_zlib=true"
+                      ;; This is currently not supported on GNU/Linux:
+                      ;; https://bugs.chromium.org/p/chromium/issues/detail?id=22208
+                      ;;"use_system_sqlite=true"
+
+                      "use_gnome_keyring=false" ;deprecated by libsecret
+                      "use_gtk3=true"
+                      "use_openh264=true"
+                      "use_xkbcommon=true"
+                      "use_pulseaudio=true"
+                      "link_pulseaudio=true"
+
+                      ;; Don't arbitrarily restrict formats supported by system ffmpeg.
+                      "proprietary_codecs=true"
+                      "ffmpeg_branding=\"Chrome\""
+
+                      ;; WebRTC stuff.
+                      "rtc_use_h264=true"
+                      ;; Don't use bundled sources.
+                      "rtc_build_json=false"
+                      "rtc_build_libevent=false"
+                      "rtc_build_libvpx=false"
+                      "rtc_build_opus=false"
+                      "rtc_build_ssl=false"
+                      ;; TODO: Package these.
+                      "rtc_build_libsrtp=true" ;2.0
+                      "rtc_build_openmax_dl=true"
+                      "rtc_build_usrsctp=true"
+                      (string-append "rtc_jsoncpp_root=\""
+                                     (assoc-ref inputs "jsoncpp")
+                                     "/include/jsoncpp/json\"")
+                      (string-append "rtc_ssl_root=\""
+                                     (assoc-ref inputs "openssl")
+                                     "/include/openssl\""))))
+
+               ;; XXX: How portable is this.
+               (mkdir-p "third_party/node/linux/node-linux-x64")
+               (symlink (string-append (assoc-ref inputs "node") "/bin")
+                        "third_party/node/linux/node-linux-x64/bin")
+
+               (setenv "CC" "clang")
+               (setenv "CXX" "clang++")
+
+               ;; FIXME: This nasty hack works around a problem where
+               ;; Clang does not add the arch triplet to the libtsdc++
+               ;; search path.  Fixing it seems tricky, since it only
+               ;; searches "include/<triplet>" when it detects libstdc++
+               ;; in GCC which is not the case in Guix; the only reason
+               ;; libstdc++ works here is because it's already on the
+               ;; include path...
+               (setenv "CPLUS_INCLUDE_PATH"
+                       (string-append (getenv "CPLUS_INCLUDE_PATH")
+                                      ":" clang-toolchain
+                                      "/include/x86_64-unknown-linux-gnu"))
+
+               ;; TODO: pre-compile instead. Avoids a race condition.
+               (setenv "PYTHONDONTWRITEBYTECODE" "1")
+               (and
+                ;; Build the "gn" tool.
+                (invoke "python"
+                        "tools/gn/bootstrap/bootstrap.py" "-s" "-v")
+                ;; Generate ninja build files.
+                (invoke "./out/Release/gn" "gen" "out/Release"
+                        (string-append "--args="
+                                       (string-join gn-flags " ")))))))
+         (replace 'build
+           (lambda* (#:key outputs #:allow-other-keys)
+             (invoke "ninja" "-C" "out/Release"
+                     "-j" (number->string (parallel-job-count))
+                     "chrome")))
+         (replace 'install
+           (lambda* (#:key inputs outputs #:allow-other-keys)
+             (let* ((out            (assoc-ref outputs "out"))
+                    (bin            (string-append out "/bin"))
+                    (exe            (string-append bin "/chromium"))
+                    (lib            (string-append out "/lib"))
+                    (man            (string-append out "/share/man/man1"))
+                    (applications   (string-append out "/share/applications"))
+                    (install-regexp (make-regexp "\\.(bin|pak)$"))
+                    (locales        (string-append lib "/locales"))
+                    (resources      (string-append lib "/resources"))
+                    (gtk+           (assoc-ref inputs "gtk+"))
+                    (mesa           (assoc-ref inputs "mesa"))
+                    (nss            (assoc-ref inputs "nss"))
+                    (udev           (assoc-ref inputs "udev"))
+                    (sh             (which "sh")))
+
+               (substitute* '("chrome/app/resources/manpage.1.in"
+                              "chrome/installer/linux/common/desktop.template")
+                 (("@@MENUNAME@@") "Chromium")
+                 (("@@PACKAGE@@") "chromium")
+                 (("/usr/bin/@@USR_BIN_SYMLINK_NAME@@") exe))
+               (mkdir-p man)
+               (copy-file "chrome/app/resources/manpage.1.in"
+                          (string-append man "/chromium.1"))
+               (mkdir-p applications)
+               (copy-file "chrome/installer/linux/common/desktop.template"
+                          (string-append applications "/chromium.desktop"))
+
+               (with-directory-excursion "out/Release"
+                 (for-each (lambda (file)
+                             (install-file file lib))
+                           (scandir "." (cut regexp-exec install-regexp <>)))
+                 (copy-file "chrome" (string-append lib "/chromium"))
+
+                 ;; TODO: Install icons from "../../chrome/app/themes" into
+                 ;; "out/share/icons/hicolor/$size".
+                 (install-file
+                  "product_logo_48.png"
+                  (string-append out "/share/icons/48x48/chromium.png"))
+
+                 (copy-recursively "locales" locales)
+                 (copy-recursively "resources" resources)
+
+                 (mkdir-p bin)
+                 ;; Add a thin wrapper to prevent the user from inadvertently
+                 ;; installing non-free software through the Web Store.
+                 ;; TODO: Discover extensions from the profile and pass
+                 ;; something like "--disable-extensions-except=...".
+                 (call-with-output-file exe
+                   (lambda (port)
+                     (format port
+                             "#!~a~@
+                             if [ -z \"$CHROMIUM_ENABLE_WEB_STORE\" ]~@
+                             then~@
+                               CHROMIUM_FLAGS=\" \\~@
+                                 --disable-background-networking \\~@
+                                 --disable-extensions \\~@
+                               \"~@
+                             fi~@
+                             exec ~a $CHROMIUM_FLAGS \"$@\"~%"
+                             sh (string-append lib "/chromium"))))
+                 (chmod exe #o755)
+
+                 (wrap-program exe
+                   ;; TODO: Get these in RUNPATH.
+                   `("LD_LIBRARY_PATH" ":" prefix
+                     (,(string-append lib ":" nss "/lib/nss:" gtk+ "/lib:"
+                                      mesa "/lib:" udev "/lib")))
+                   ;; Avoid file manager crash.  See <https://bugs.gnu.org/26593>.
+                   `("XDG_DATA_DIRS" ":" prefix (,(string-append gtk+ "/share"))))
+                 #t)))))))
+    (native-inputs
+     `(("bison" ,bison)
+       ("clang-toolchain" ,chromium-clang-toolchain)
+       ("git" ,git)                     ;last_commit_position.py
+       ("gperf" ,gperf)
+       ("ninja" ,ninja)
+       ("node" ,node)
+       ("pkg-config" ,pkg-config)
+       ("which" ,which)
+       ("yasm" ,yasm)
+
+       ("python-beautifulsoup4" ,python2-beautifulsoup4)
+       ("python-html5lib" ,python2-html5lib)
+       ("python" ,python-2)))
+    (inputs
+     `(("alsa-lib" ,alsa-lib)
+       ("atk" ,atk)
+       ("cups" ,cups)
+       ("curl" ,curl)
+       ("dbus" ,dbus)
+       ("dbus-glib" ,dbus-glib)
+       ("expat" ,expat)
+       ("flac" ,flac)
+       ("ffmpeg" ,ffmpeg)
+       ("fontconfig" ,fontconfig)
+       ("freetype" ,freetype)
+       ("gdk-pixbuf" ,gdk-pixbuf)
+       ("glib" ,glib)
+       ("gtk+-2" ,gtk+-2)
+       ("gtk+" ,gtk+)
+       ("harfbuzz" ,harfbuzz)
+       ("icu4c" ,icu4c)
+       ("jsoncpp" ,jsoncpp)
+       ("lcms" ,lcms)
+       ("libevent" ,libevent)
+       ("libffi" ,libffi)
+       ("libjpeg-turbo" ,libjpeg-turbo)
+       ("libpng" ,libpng)
+       ("libusb" ,libusb)
+       ("libvpx" ,libvpx+experimental)
+       ("libwebp" ,libwebp)
+       ("libx11" ,libx11)
+       ("libxcb" ,libxcb)
+       ("libxcomposite" ,libxcomposite)
+       ("libxcursor" ,libxcursor)
+       ("libxdamage" ,libxdamage)
+       ("libxext" ,libxext)
+       ("libxfixes" ,libxfixes)
+       ("libxi" ,libxi)
+       ("libxkbcommon" ,libxkbcommon)
+       ("libxml2" ,libxml2)
+       ("libxrandr" ,libxrandr)
+       ("libxrender" ,libxrender)
+       ("libxscrnsaver" ,libxscrnsaver)
+       ("libxslt" ,libxslt)
+       ("libxtst" ,libxtst)
+       ("mesa" ,mesa)
+       ("minizip" ,minizip)
+       ("mit-krb5" ,mit-krb5)
+       ("nss" ,nss)
+       ("openh264" ,openh264)
+       ("openssl" ,openssl)
+       ("opus" ,opus+custom)
+       ("pango" ,pango)
+       ("pciutils" ,pciutils)
+       ("protobuf" ,protobuf)
+       ("pulseaudio" ,pulseaudio)
+       ("re2" ,re2)
+       ("snappy" ,snappy)
+       ("speech-dispatcher" ,speech-dispatcher)
+       ("sqlite" ,sqlite)
+       ("udev" ,eudev)
+       ("valgrind" ,valgrind)))
+    (home-page "https://www.chromium.org/")
+    (description
+     "Chromium is a web browser designed for speed and security.  This
+version incorporates patches from
+@url{https://github.com/gcarq/inox-patchset,Inox} and
+@url{https://www.debian.org/,Debian} in order to protect the users privacy.")
+    ;; Chromium is developed as BSD-3, but bundles a large number of third-party
+    ;; components with other licenses.  For full information, see chrome://credits.
+    (license (list license:bsd-3
+                   license:bsd-2
+                   license:expat
+                   license:asl2.0
+                   license:mpl2.0
+                   license:public-domain
+                   license:lgpl2.1+))))
diff --git a/gnu/packages/patches/chromium-glibc-compat.patch b/gnu/packages/patches/chromium-glibc-compat.patch
new file mode 100644
index 000000000..720adbeef
--- /dev/null
+++ b/gnu/packages/patches/chromium-glibc-compat.patch
@@ -0,0 +1,38 @@
+Upstream-Status: Backport
+
+Signed-off-by: Raphael Kubo da Costa <[email-masked]>
+---
+From 9f63f94a11abc34d40ede8b8712fa15b5844a8c0 Mon Sep 17 00:00:00 2001
+From: Tom Anderson <[email-masked]>
+Date: Sat, 27 Jan 2018 20:03:37 +0000
+Subject: [PATCH] Fix build with glibc 2.27
+
+BUG=806340
+TBR=[email-masked]
+
+Change-Id: Ib4e5091212d874d9ad88f3e9a1fdfee3ed7e0d5e
+Reviewed-on: https://chromium-review.googlesource.com/890059
+Reviewed-by: Thomas Anderson <[email-masked]>
+Reviewed-by: Philippe Hamel <[email-masked]>
+Commit-Queue: Thomas Anderson <[email-masked]>
+Cr-Commit-Position: refs/heads/master@{#532249}
+---
+ components/assist_ranker/ranker_example_util.cc | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/components/assist_ranker/ranker_example_util.cc b/components/assist_ranker/ranker_example_util.cc
+index 54d4dbd58f7d..ceedd8f9b18d 100644
+--- a/components/assist_ranker/ranker_example_util.cc
++++ b/components/assist_ranker/ranker_example_util.cc
+@@ -2,6 +2,8 @@
+ // Use of this source code is governed by a BSD-style license that can be
+ // found in the LICENSE file.
+ 
++#include <math.h>
++
+ #include "components/assist_ranker/ranker_example_util.h"
+ #include "base/bit_cast.h"
+ #include "base/format_macros.h"
+-- 
+2.14.3
+
diff --git a/gnu/packages/patches/chromium-remove-default-history.patch b/gnu/packages/patches/chromium-remove-default-history.patch
new file mode 100644
index 000000000..38be10820
--- /dev/null
+++ b/gnu/packages/patches/chromium-remove-default-history.patch
@@ -0,0 +1,13 @@
+Don't pre-populate the New Tab Page for new profiles.
+
+--- a/chrome/browser/history/top_sites_factory.cc
++++ b/chrome/browser/history/top_sites_factory.cc
+@@ -74,7 +74,7 @@
+ 
+ void InitializePrepopulatedPageList(
+     history::PrepopulatedPageList* prepopulated_pages) {
+-#if !defined(OS_ANDROID)
++#if false
+   DCHECK(prepopulated_pages);
+   prepopulated_pages->reserve(arraysize(kRawPrepopulatedPages));
+   for (size_t i = 0; i < arraysize(kRawPrepopulatedPages); ++i) {
-- 
2.17.0