Subject: [bug#28004] Chromium 66 + status update

From: Marius Bakke <[email-masked]>
Date: Tue, 24 Apr 2018 20:08:51 +0200

Christopher Lemmer Webber <[email-masked]> writes:

> Hello!  I'd like to speak up in favor of getting Chromium merged into
> Guix master.  As a web developer, sometimes I have to test things
> against multiple browsers.  Having Chromium in GuixSD would help me out
> a lot.
>
> It looks like a mountain of hard work has been put into this.  Could we
> get it merged rather than have that work languish?

Hello!

I use this browser a lot, so it's hardly languishing.

There was a recent discussion[0] about the Pale Moon browser, where it
was pointed out that the FSDG[1] requires that any third-party
repositories must be committed to only free software.

[0] https://lists.gnu.org/archive/html/guix-devel/2018-03/msg00319.html
[1] https://www.gnu.org/distros/free-system-distribution-guidelines.html#license-rules

Unfortunately there are UI links to the Chrome "Web Store" still.  It's
not possible to install from it without setting the
CHROMIUM_ENABLE_WEB_STORE variable, but I'm not sure if that is
sufficient.  It's unfortunate if an unsuspecting user stumbles into the
Web Store and tries to install something (free or not) and only then
finds out that it does not work.

The other remaining issue is that some data is sent to Google whenever
you start the browser for the first time.  I don't think that's a
blocker, but it's certainly something we should aim to fix.

Attached are updates for 66.  The first is an interdiff from the
previous 65 patch; the other is the full "squashed" patch for
convenience.

New in this version:

* The snippet will now error if a preserved directory is not present.
* Chromium again requires a git revision of libvpx.
* The "safe browsing" feature requires the nonfree "unrar" program(!!),
  as such it has been compiled out.  Luckily "Inox" already had a patch
  to make the thing actually build with that flag disabled.
* Cosmetic rearrangement of patches to follow Debian and Inox patch order.

From a6ce5ebc121f129c3097f1f105b6a4de925b43e9 Mon Sep 17 00:00:00 2001
From: Marius Bakke <[email-masked]>
Date: Tue, 17 Apr 2018 03:54:56 +0200
Subject: [PATCH] Chromium 66 update.

---
 gnu/local.mk                                  |   1 -
 gnu/packages/chromium.scm                     | 173 ++++++++++++------
 .../patches/chromium-glibc-compat.patch       |  38 ----
 3 files changed, 115 insertions(+), 97 deletions(-)
 delete mode 100644 gnu/packages/patches/chromium-glibc-compat.patch

diff --git a/gnu/local.mk b/gnu/local.mk
index fdb15a074..0bc3220f8 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -592,7 +592,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/ceph-skip-collect-sys-info-test.patch	\
   %D%/packages/patches/ceph-skip-unittest_blockdev.patch	\
   %D%/packages/patches/chmlib-inttypes.patch			\
-  %D%/packages/patches/chromium-glibc-compat.patch		\
   %D%/packages/patches/chromium-remove-default-history.patch	\
   %D%/packages/patches/clang-3.5-libc-search-path.patch		\
   %D%/packages/patches/clang-3.8-libc-search-path.patch		\
diff --git a/gnu/packages/chromium.scm b/gnu/packages/chromium.scm
index cecbab7a1..a6f9fec0f 100644
--- a/gnu/packages/chromium.scm
+++ b/gnu/packages/chromium.scm
@@ -122,63 +122,89 @@
     (sha256 (base32 hash))
     (file-name (chromium-patch-file-name pathspec))))
 
-;; Fix an assignment bug when using Clang and libstdc++.
-(define %chromium-clang-assignment.patch
-  (gentoo-patch "chromium-clang-r3.patch"
-                "804a0d7244a06736d01c353b45c20daf324f0722"
-                "1d10il3mjzyzwgqi8iifw3aw9jnbqfrzz8v1x7cmvqpwjkykwk2a"))
-
-;; Add missing stdint include.
-(define %chromium-add-missing-stdint.patch
-  (gentoo-patch "chromium-stdint.patch"
-                "804a0d7244a06736d01c353b45c20daf324f0722"
-                "03r16zqi0hm3i00b9bwq2bdn2sp731rllizcxfl3i2q7y432a3f0"))
+(define %debian-revision "debian/66.0.3359.26-1")
+(define %gentoo-revision "599be358f257098e7ba29196f6fce498b0a8d208")
+(define %inox-revision "365a106e298e04b4a7063559b7a0ee16888b928f")
 
+;; Use system NSPR.
 (define %chromium-system-nspr.patch
   (debian-patch "system/nspr.patch"
-                "debian/65.0.3325.146-4"
-                "1ggdrlz94d75ni21rx6ivvajjwhx7zwnl3s5aapysqn9kls4qsr2"))
+                %debian-revision
+                "0x54c8zhwjldlnx4754aaq0xyb24spqia3fgn94kcf686wp61srz"))
 
+;; And system libevent.
 (define %chromium-system-libevent.patch
   (debian-patch "system/event.patch"
-                "debian/65.0.3325.146-4"
-                "1k3zc59vpwc8rzbknxryjzzy99jk666whdablzcvxnyzaqk38kfx"))
+                %debian-revision
+                "18ka0zmfd6g5yxhknh6x94bfm643v1kgczzag5sfndizsaaxrlpc"))
 
-(define %chromium-system-icu.patch
-  (debian-patch "system/icu.patch"
-                "debian/65.0.3325.146-4"
-                "19wclidx1kyjbi3b3hnmkjs0h34d67p4dp6a48vbjbx9rxmfdk3b"))
+;; Avoid dependency on Chromiums embedded libc++ library for GN.
+(define %chromium-gn-libcxx.patch
+  (debian-patch "gn/libcxx.patch"
+                %debian-revision
+                "14rx16abxv0pz4qyp194cy999z3390hxi80rdbjs3v2lwscx36cl"))
 
 ;; Don't show a warning about missing API keys.
 (define %chromium-disable-api-keys-warning.patch
   (debian-patch "disable/google-api-warning.patch"
-                "debian/65.0.3325.146-4"
-                "1g5yk51bl7svrqx8wjxsgpz545mnymnpi3bsa62kwdm4qd8bx10x"))
+                %debian-revision
+                "1qf2y7jmaya43k9rbsxjjpkp5manzmbkhjj5hvfyqcdylhy30swj"))
 
-;; Add DuckDuckGo and set it as the default search engine.
-(define %chromium-duckduckgo.patch
-  (inox-patch "0011-add-duckduckgo-search-engine.patch"
-              "0c55cc9a81634244ad13fbbd6b5c5098b9132162"
-              "0mvw1ax0gw3d252c9b1pwbk0j7ny8z9nsfywcmhj56wm6yksgpkg"))
+;; Some files were missing in the Chromium 66 release tarball.
+;; See <https://crbug.com/832283>.
+(define %chromium-add-blink-tools.patch
+  (origin
+    (method url-fetch)
+    (uri (string-append "https://bazaar.launchpad.net/~chromium-team"
+                        "/chromium-browser/bionic-stable/download/head:"
+                        "/addmissingblinktools-20180416203514-02f50sz15c2mn6ei-1"
+                        "/add-missing-blink-tools.patch"))
+    (sha256
+     (base32
+      "1im2l1g6g9mangpfphbkg6zxyglbfwbkm5jxv122yxqgm6vxzz6s"))))
 
-;; Don't start a "Login Wizard" at first launch.
-(define %chromium-first-run.patch
-  (inox-patch "0018-disable-first-run-behaviour.patch"
-              "0c55cc9a81634244ad13fbbd6b5c5098b9132162"
-              "1y4zsqqf2125jkb1phwy9g5hcbd9xhyv5lr4xcaly66rpdzx2ayb"))
+;; Fix an assignment bug when using Clang and libstdc++.
+(define %chromium-clang-assignment.patch
+  (gentoo-patch "chromium-clang-r4.patch"
+                %gentoo-revision
+                "0ip3pzk9is6n7icpml33ryysiq4cfrx8jlr0jkjgdg6mvl8pli3i"))
+
+;; Fix error detecting system ffmpeg.
+(define %chromium-ffmpeg.patch
+  (gentoo-patch "chromium-ffmpeg-r1.patch"
+                %gentoo-revision
+                "1pivcdmana4qx8sngcdpr858l0qh6bygv7azj66vg021phq5725a"))
+
+;; Fix build failure when built with "safe_browsing_mode=0".
+(define %chromium-build-without-safebrowsing.patch
+  (inox-patch "0001-fix-building-without-safebrowsing.patch"
+              %inox-revision
+              "0r1as6vmc6bbc7i54cxbmbm6rrwj33a12hfz6rzj0yxyqnnps00f"))
 
 ;; Use privacy-preserving defaults.
 (define %chromium-default-preferences.patch
   (inox-patch "0006-modify-default-prefs.patch"
-              "0c55cc9a81634244ad13fbbd6b5c5098b9132162"
-              "0zyshpl1hjssqrfhdfbgxdib4smdszjgf0ac98l978hrn9gwwk03"))
+              %inox-revision
+              "1ncjij9sib7fliafpv37j1zf8zz5hvyxqad669vvadg7vvwr9rza"))
 
 ;; Recent versions of Chromium may load a remote search engine on the
 ;; New Tab Page, causing unnecessary and involuntary network traffic.
 (define %chromium-restore-classic-ntp.patch
   (inox-patch "0008-restore-classic-ntp.patch"
-              "0c55cc9a81634244ad13fbbd6b5c5098b9132162"
-              "1h698cbp97g8lgmndfy6kswgwfvss7c3k609xgvyxbfldkzy7pd5"))
+              %inox-revision
+              "1jl978qas2ry9lnq6x42xl4qa6arxxj9a37k9j2wclz2pin8cmzn"))
+
+;; Add DuckDuckGo and set it as the default search engine.
+(define %chromium-duckduckgo.patch
+  (inox-patch "0011-add-duckduckgo-search-engine.patch"
+              %inox-revision
+              "0mvw1ax0gw3d252c9b1pwbk0j7ny8z9nsfywcmhj56wm6yksgpkg"))
+
+;; Don't start a "Login Wizard" at first launch.
+(define %chromium-first-run.patch
+  (inox-patch "0018-disable-first-run-behaviour.patch"
+              %inox-revision
+              "1y4zsqqf2125jkb1phwy9g5hcbd9xhyv5lr4xcaly66rpdzx2ayb"))
 
 (define opus+custom
   (package (inherit opus)
@@ -194,6 +220,17 @@
 
 (define libvpx+experimental
   (package (inherit libvpx)
+           ;; XXX: Chromium 66 relies on unreleased libvpx features.
+           ;; The commit below is the tip of the "m66-3359" branch
+           ;; as of 2018-04-19.
+           (source (origin
+                     (method git-fetch)
+                     (uri (git-reference
+                           (url "https://chromium.googlesource.com/webm/libvpx")
+                           (commit "e9fff8a9dbcd03fbf3e5b7caaa9dc2631a79882a")))
+                     (sha256
+                      (base32
+                       "1b1d89dlbr8ydakvp82cg6xnlnkz5hj7679f4pgxwlgd6x46f4g2"))))
            (name "libvpx+experimental")
            (arguments
             (substitute-keyword-arguments (package-arguments libvpx)
@@ -305,7 +342,7 @@ includes Clang, the Guix ld wrapper, glibc, a C++ library, and Binutils.")
 (define-public chromium
   (package
     (name "chromium")
-    (version "65.0.3325.181")
+    (version "66.0.3359.117")
     (synopsis "Graphical web browser")
     (source (origin
               (method url-fetch)
@@ -314,19 +351,22 @@ includes Clang, the Guix ld wrapper, glibc, a C++ library, and Binutils.")
                                   version ".tar.xz"))
               (sha256
                (base32
-                "11w6wg862ixbgm7dpqag2lmbjknv83zlr9imd8zchvmrqr468rlk"))
-              (patches (list %chromium-duckduckgo.patch
-                             %chromium-default-preferences.patch
-                             %chromium-first-run.patch
-                             %chromium-restore-classic-ntp.patch
-
-                             %chromium-clang-assignment.patch
-                             %chromium-add-missing-stdint.patch
-                             %chromium-system-icu.patch
+                "1mlfavs0m0lf60s42krqxqiyx73hdfd4r1mkjwv31p2gchsa7ibp"))
+              (patches (list %chromium-gn-libcxx.patch
+                             %chromium-disable-api-keys-warning.patch
                              %chromium-system-nspr.patch
                              %chromium-system-libevent.patch
-                             %chromium-disable-api-keys-warning.patch
-                             (search-patch "chromium-glibc-compat.patch")
+
+                             %chromium-add-blink-tools.patch
+
+                             %chromium-clang-assignment.patch
+                             %chromium-ffmpeg.patch
+
+                             %chromium-build-without-safebrowsing.patch
+                             %chromium-default-preferences.patch
+                             %chromium-restore-classic-ntp.patch
+                             %chromium-duckduckgo.patch
+                             %chromium-first-run.patch
                              (search-patch "chromium-remove-default-history.patch")))
               (modules '((srfi srfi-1)
                          (srfi srfi-26)
@@ -351,7 +391,6 @@ includes Clang, the Guix ld wrapper, glibc, a C++ library, and Binutils.")
                            "base/third_party/symbolize" ;glog
                            "base/third_party/xdg_mime"
                            "base/third_party/xdg_user_dirs"
-                           "buildtools/third_party/libc++"
                            "chrome/third_party/mozilla_security_manager"
                            "courgette/third_party"
                            "net/third_party/mozilla_security_manager"
@@ -367,6 +406,10 @@ includes Clang, the Guix ld wrapper, glibc, a C++ library, and Binutils.")
                            "third_party/angle/src/third_party/compiler"
                            "third_party/angle/src/third_party/libXNVCtrl"
                            "third_party/angle/src/third_party/trace_event"
+                           "third_party/angle/third_party/glslang"
+                           "third_party/angle/third_party/spirv-headers"
+                           "third_party/angle/third_party/spirv-tools"
+                           "third_party/angle/third_party/vulkan-validation-layers"
                            "third_party/blink"
                            "third_party/boringssl"
                            "third_party/boringssl/src/third_party/fiat"
@@ -406,6 +449,8 @@ includes Clang, the Guix ld wrapper, glibc, a C++ library, and Binutils.")
                            "third_party/leveldatabase"
                            "third_party/libXNVCtrl"
                            "third_party/libaddressinput"
+                           "third_party/libaom"
+                           "third_party/libaom/source/libaom/third_party/x86inc/x86inc.asm"
                            "third_party/libjingle_xmpp"
                            "third_party/libphonenumber"
                            "third_party/libsecret" ;FIXME: needs pkg-config support.
@@ -420,7 +465,6 @@ includes Clang, the Guix ld wrapper, glibc, a C++ library, and Binutils.")
                            "third_party/mesa"
                            "third_party/metrics_proto"
                            "third_party/modp_b64"
-                           "third_party/mt19937ar"
                            "third_party/node"
                            (string-append "third_party/node/node_modules/"
                                           "polymer-bundler/lib/third_party/UglifyJS2")
@@ -430,7 +474,7 @@ includes Clang, the Guix ld wrapper, glibc, a C++ library, and Binutils.")
                            "third_party/pdfium"
                            "third_party/pdfium/third_party"
                            (string-append "third_party/pdfium/third_party/freetype"
-                                          "/include/psnames/pstables.h")
+                                          "/include/pstables.h")
                            "third_party/ply"
                            "third_party/polymer"
                            "third_party/protobuf"
@@ -442,16 +486,12 @@ includes Clang, the Guix ld wrapper, glibc, a C++ library, and Binutils.")
                            "third_party/skia/third_party/gif"
                            "third_party/smhasher"
                            "third_party/speech-dispatcher"
-                           "third_party/spirv-headers"
-                           "third_party/spirv-tools-angle"
                            "third_party/sqlite"
                            "third_party/swiftshader"
                            "third_party/swiftshader/third_party"
                            "third_party/s2cellid"
                            "third_party/usb_ids"
                            "third_party/usrsctp"
-                           "third_party/vulkan"
-                           "third_party/vulkan-validation-layers"
                            "third_party/WebKit"
                            "third_party/web-animations-js"
                            "third_party/webrtc"
@@ -475,6 +515,10 @@ includes Clang, the Guix ld wrapper, glibc, a C++ library, and Binutils.")
                           #t
                           #f))
 
+                    (define (useless? file)
+                      (any (cute string-suffix? <> file)
+                           '(".tar.gz" ".zip" ".exe" ".jar")))
+
                     (define (parents child)
                       "Return a list of paths up to and including the closest third_party"
                       (let ((lst (reverse (string-split child #\/))))
@@ -492,11 +536,12 @@ includes Clang, the Guix ld wrapper, glibc, a C++ library, and Binutils.")
                       (let ((protected (make-regexp "\\.(gn|gyp)i?$")))
                         (match flag
                           ((or 'regular 'symlink 'stale-symlink)
-                           (when (third_party? child)
+                           (when (or (third_party? child) (useless? child))
                              (unless (or (member child preserved-club)
                                          (any (cute member <> preserved-club)
                                               (parents child))
                                          (regexp-exec protected child))
+                               (format (current-error-port) "deleting ~s~%" child)
                                (delete-file child)))
                            #t)
                           ('directory-processed
@@ -507,9 +552,11 @@ includes Clang, the Guix ld wrapper, glibc, a C++ library, and Binutils.")
 
                     (nftw "." delete-unwanted 'depth 'physical)
 
-                    ;; Do a second pass to get rid of various binary archives.
-                    (for-each delete-file
-                              (find-files "." "\\.(zip|jar|tar.gz|exe)$"))
+                    ;; Assert that each listed item is present to catch removals.
+                    (for-each (lambda (third-party)
+                                (unless (file-exists? third-party)
+                                  (error (format #f "~s does not exist!" third-party))))
+                              preserved-club)
 
                     ;; Replace "GN" files from third_party with shims for
                     ;; building against system libraries.  Keep this list in
@@ -635,7 +682,12 @@ includes Clang, the Guix ld wrapper, glibc, a C++ library, and Binutils.")
                       "override_build_date=\"01 01 2000 05:00:00\""
                       "use_unofficial_version_number=false"
 
+                      ;; Disable "safe browsing", which pulls in a dependency
+                      ;; on the nonfree "unrar" program.
+                      "safe_browsing_mode=0"
+
                       ;; GCC is poorly supported, so we use Clang for now.
+                      ;;"is_clang=false"
                       (string-append "clang_base_path=\"" clang-toolchain "\"")
                       "clang_use_chrome_plugins=false"
 
@@ -716,6 +768,11 @@ includes Clang, the Guix ld wrapper, glibc, a C++ library, and Binutils.")
                        (string-append (getenv "CPLUS_INCLUDE_PATH")
                                       ":" clang-toolchain
                                       "/include/x86_64-unknown-linux-gnu"))
+               ;; XXX: For some reason this is needed also for C code (libaom).
+               (setenv "C_INCLUDE_PATH"
+                       (string-append (getenv "C_INCLUDE_PATH")
+                                      ":" clang-toolchain
+                                      "/include/x86_64-unknown-linux-gnu"))
 
                ;; TODO: pre-compile instead. Avoids a race condition.
                (setenv "PYTHONDONTWRITEBYTECODE" "1")
diff --git a/gnu/packages/patches/chromium-glibc-compat.patch b/gnu/packages/patches/chromium-glibc-compat.patch
deleted file mode 100644
index 720adbeef..000000000
--- a/gnu/packages/patches/chromium-glibc-compat.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-Upstream-Status: Backport
-
-Signed-off-by: Raphael Kubo da Costa <[email-masked]>
----
-From 9f63f94a11abc34d40ede8b8712fa15b5844a8c0 Mon Sep 17 00:00:00 2001
-From: Tom Anderson <[email-masked]>
-Date: Sat, 27 Jan 2018 20:03:37 +0000
-Subject: [PATCH] Fix build with glibc 2.27
-
-BUG=806340
-TBR=[email-masked]
-
-Change-Id: Ib4e5091212d874d9ad88f3e9a1fdfee3ed7e0d5e
-Reviewed-on: https://chromium-review.googlesource.com/890059
-Reviewed-by: Thomas Anderson <[email-masked]>
-Reviewed-by: Philippe Hamel <[email-masked]>
-Commit-Queue: Thomas Anderson <[email-masked]>
-Cr-Commit-Position: refs/heads/master@{#532249}
----
- components/assist_ranker/ranker_example_util.cc | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/components/assist_ranker/ranker_example_util.cc b/components/assist_ranker/ranker_example_util.cc
-index 54d4dbd58f7d..ceedd8f9b18d 100644
---- a/components/assist_ranker/ranker_example_util.cc
-+++ b/components/assist_ranker/ranker_example_util.cc
-@@ -2,6 +2,8 @@
- // Use of this source code is governed by a BSD-style license that can be
- // found in the LICENSE file.
- 
-+#include <math.h>
-+
- #include "components/assist_ranker/ranker_example_util.h"
- #include "base/bit_cast.h"
- #include "base/format_macros.h"
--- 
-2.14.3
-
-- 
2.17.0

...and the full thing:

From 0b08dd695ee9f3d8e64173dea5f9d0470ed92718 Mon Sep 17 00:00:00 2001
From: Marius Bakke <[email-masked]>
Date: Wed, 12 Oct 2016 17:25:05 +0100
Subject: [PATCH] gnu: Add chromium.

* gnu/packages/chromium.scm: New file.
* gnu/packages/patches/chromium-glibc-compat.patch,
gnu/packages/patches/chromium-remove-default-history.patch: New files.
* gnu/local.mk: Record it.
---
 gnu/local.mk                                  |   2 +
 gnu/packages/chromium.scm                     | 951 ++++++++++++++++++
 .../chromium-remove-default-history.patch     |  13 +
 3 files changed, 966 insertions(+)
 create mode 100644 gnu/packages/chromium.scm
 create mode 100644 gnu/packages/patches/chromium-remove-default-history.patch

diff --git a/gnu/local.mk b/gnu/local.mk
index 056a46cb7..0bc3220f8 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -94,6 +94,7 @@ GNU_SYSTEM_MODULES =				\
   %D%/packages/check.scm			\
   %D%/packages/chemistry.scm			\
   %D%/packages/chez.scm				\
+  %D%/packages/chromium.scm			\
   %D%/packages/ci.scm				\
   %D%/packages/cinnamon.scm			\
   %D%/packages/cmake.scm			\
@@ -591,6 +592,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/ceph-skip-collect-sys-info-test.patch	\
   %D%/packages/patches/ceph-skip-unittest_blockdev.patch	\
   %D%/packages/patches/chmlib-inttypes.patch			\
+  %D%/packages/patches/chromium-remove-default-history.patch	\
   %D%/packages/patches/clang-3.5-libc-search-path.patch		\
   %D%/packages/patches/clang-3.8-libc-search-path.patch		\
   %D%/packages/patches/clang-6.0-libc-search-path.patch		\
diff --git a/gnu/packages/chromium.scm b/gnu/packages/chromium.scm
new file mode 100644
index 000000000..a6f9fec0f
--- /dev/null
+++ b/gnu/packages/chromium.scm
@@ -0,0 +1,951 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2016, 2017, 2018 Marius Bakke <[email-masked]>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu packages chromium)
+  #:use-module ((guix licenses) #:prefix license:)
+  #:use-module (guix packages)
+  #:use-module (guix download)
+  #:use-module (guix git-download)
+  #:use-module (guix utils)
+  #:use-module (guix build-system gnu)
+  #:use-module (guix build-system trivial)
+  #:use-module (gnu packages)
+  #:use-module (gnu packages assembly)
+  #:use-module (gnu packages base)
+  #:use-module (gnu packages bison)
+  #:use-module (gnu packages compression)
+  #:use-module (gnu packages cups)
+  #:use-module (gnu packages curl)
+  #:use-module (gnu packages databases)
+  #:use-module (gnu packages fontutils)
+  #:use-module (gnu packages gcc)
+  #:use-module (gnu packages ghostscript)
+  #:use-module (gnu packages gl)
+  #:use-module (gnu packages glib)
+  #:use-module (gnu packages gnome)
+  #:use-module (gnu packages gnuzilla)
+  #:use-module (gnu packages gperf)
+  #:use-module (gnu packages gtk)
+  #:use-module (gnu packages icu4c)
+  #:use-module (gnu packages image)
+  #:use-module (gnu packages libevent)
+  #:use-module (gnu packages libffi)
+  #:use-module (gnu packages libusb)
+  #:use-module (gnu packages linux)
+  #:use-module (gnu packages llvm)
+  #:use-module (gnu packages kerberos)
+  #:use-module (gnu packages ninja)
+  #:use-module (gnu packages node)
+  #:use-module (gnu packages pciutils)
+  #:use-module (gnu packages photo)
+  #:use-module (gnu packages pkg-config)
+  #:use-module (gnu packages protobuf)
+  #:use-module (gnu packages pulseaudio)
+  #:use-module (gnu packages python)
+  #:use-module (gnu packages python-web)
+  #:use-module (gnu packages regex)
+  #:use-module (gnu packages serialization)
+  #:use-module (gnu packages speech)
+  #:use-module (gnu packages tls)
+  #:use-module (gnu packages valgrind)
+  #:use-module (gnu packages version-control)
+  #:use-module (gnu packages video)
+  #:use-module (gnu packages xiph)
+  #:use-module (gnu packages xml)
+  #:use-module (gnu packages xdisorg)
+  #:use-module (gnu packages xorg))
+
+(define (strip-directory-prefix pathspec)
+  "Return everything after the last '/' in PATHSPEC."
+  (let ((index (string-rindex pathspec #\/)))
+    (if index
+        (string-drop pathspec (+ 1 index))
+        pathspec)))
+
+(define (chromium-patch-file-name pathspec)
+  (let ((patch-name (strip-directory-prefix pathspec)))
+    (if (string-prefix? "chromium-" patch-name)
+        patch-name
+        (string-append "chromium-" patch-name))))
+
+;; https://anonscm.debian.org/cgit/pkg-chromium/pkg-chromium.git/tree/debian/patches
+(define (debian-patch pathspec revision hash)
+  (origin
+    (method url-fetch)
+    (uri (string-append
+          "https://anonscm.debian.org/cgit/pkg-chromium/pkg-chromium.git"
+          "/plain/debian/patches/" pathspec "?id=" revision))
+    (sha256 (base32 hash))
+    (file-name (chromium-patch-file-name pathspec))))
+
+;; https://gitweb.gentoo.org/repo/gentoo.git/tree/www-client/chromium/files
+(define (gentoo-patch pathspec revision hash)
+  (origin
+    (method url-fetch)
+    (uri (string-append
+          "https://gitweb.gentoo.org/repo/gentoo.git/plain/www-client"
+          "/chromium/files/" pathspec "?id=" revision))
+    (sha256 (base32 hash))
+    (file-name (chromium-patch-file-name pathspec))))
+
+;; https://github.com/gcarq/inox-patchset
+(define (inox-patch pathspec revision hash)
+  (origin
+    (method url-fetch)
+    (uri (string-append "https://raw.githubusercontent.com/gcarq/inox-patchset/"
+                        revision "/" pathspec))
+    (sha256 (base32 hash))
+    (file-name (chromium-patch-file-name pathspec))))
+
+;; https://github.com/NixOS/nixpkgs/tree/master/pkgs/applications/networking/browsers/chromium
+(define (nixos-patch pathspec revision hash)
+  (origin
+    (method url-fetch)
+    (uri (string-append "https://raw.githubusercontent.com/NixOS/nixpkgs/"
+                        revision "/pkgs/applications/networking/browsers"
+                        "/chromium/patches/" pathspec))
+    (sha256 (base32 hash))
+    (file-name (chromium-patch-file-name pathspec))))
+
+(define %debian-revision "debian/66.0.3359.26-1")
+(define %gentoo-revision "599be358f257098e7ba29196f6fce498b0a8d208")
+(define %inox-revision "365a106e298e04b4a7063559b7a0ee16888b928f")
+
+;; Use system NSPR.
+(define %chromium-system-nspr.patch
+  (debian-patch "system/nspr.patch"
+                %debian-revision
+                "0x54c8zhwjldlnx4754aaq0xyb24spqia3fgn94kcf686wp61srz"))
+
+;; And system libevent.
+(define %chromium-system-libevent.patch
+  (debian-patch "system/event.patch"
+                %debian-revision
+                "18ka0zmfd6g5yxhknh6x94bfm643v1kgczzag5sfndizsaaxrlpc"))
+
+;; Avoid dependency on Chromiums embedded libc++ library for GN.
+(define %chromium-gn-libcxx.patch
+  (debian-patch "gn/libcxx.patch"
+                %debian-revision
+                "14rx16abxv0pz4qyp194cy999z3390hxi80rdbjs3v2lwscx36cl"))
+
+;; Don't show a warning about missing API keys.
+(define %chromium-disable-api-keys-warning.patch
+  (debian-patch "disable/google-api-warning.patch"
+                %debian-revision
+                "1qf2y7jmaya43k9rbsxjjpkp5manzmbkhjj5hvfyqcdylhy30swj"))
+
+;; Some files were missing in the Chromium 66 release tarball.
+;; See <https://crbug.com/832283>.
+(define %chromium-add-blink-tools.patch
+  (origin
+    (method url-fetch)
+    (uri (string-append "https://bazaar.launchpad.net/~chromium-team"
+                        "/chromium-browser/bionic-stable/download/head:"
+                        "/addmissingblinktools-20180416203514-02f50sz15c2mn6ei-1"
+                        "/add-missing-blink-tools.patch"))
+    (sha256
+     (base32
+      "1im2l1g6g9mangpfphbkg6zxyglbfwbkm5jxv122yxqgm6vxzz6s"))))
+
+;; Fix an assignment bug when using Clang and libstdc++.
+(define %chromium-clang-assignment.patch
+  (gentoo-patch "chromium-clang-r4.patch"
+                %gentoo-revision
+                "0ip3pzk9is6n7icpml33ryysiq4cfrx8jlr0jkjgdg6mvl8pli3i"))
+
+;; Fix error detecting system ffmpeg.
+(define %chromium-ffmpeg.patch
+  (gentoo-patch "chromium-ffmpeg-r1.patch"
+                %gentoo-revision
+                "1pivcdmana4qx8sngcdpr858l0qh6bygv7azj66vg021phq5725a"))
+
+;; Fix build failure when built with "safe_browsing_mode=0".
+(define %chromium-build-without-safebrowsing.patch
+  (inox-patch "0001-fix-building-without-safebrowsing.patch"
+              %inox-revision
+              "0r1as6vmc6bbc7i54cxbmbm6rrwj33a12hfz6rzj0yxyqnnps00f"))
+
+;; Use privacy-preserving defaults.
+(define %chromium-default-preferences.patch
+  (inox-patch "0006-modify-default-prefs.patch"
+              %inox-revision
+              "1ncjij9sib7fliafpv37j1zf8zz5hvyxqad669vvadg7vvwr9rza"))
+
+;; Recent versions of Chromium may load a remote search engine on the
+;; New Tab Page, causing unnecessary and involuntary network traffic.
+(define %chromium-restore-classic-ntp.patch
+  (inox-patch "0008-restore-classic-ntp.patch"
+              %inox-revision
+              "1jl978qas2ry9lnq6x42xl4qa6arxxj9a37k9j2wclz2pin8cmzn"))
+
+;; Add DuckDuckGo and set it as the default search engine.
+(define %chromium-duckduckgo.patch
+  (inox-patch "0011-add-duckduckgo-search-engine.patch"
+              %inox-revision
+              "0mvw1ax0gw3d252c9b1pwbk0j7ny8z9nsfywcmhj56wm6yksgpkg"))
+
+;; Don't start a "Login Wizard" at first launch.
+(define %chromium-first-run.patch
+  (inox-patch "0018-disable-first-run-behaviour.patch"
+              %inox-revision
+              "1y4zsqqf2125jkb1phwy9g5hcbd9xhyv5lr4xcaly66rpdzx2ayb"))
+
+(define opus+custom
+  (package (inherit opus)
+           (name "opus+custom")
+           (arguments
+            (substitute-keyword-arguments (package-arguments opus)
+              ((#:configure-flags flags ''())
+               ;; Opus Custom is an optional extension of the Opus
+               ;; specification that allows for unsupported frame
+               ;; sizes.  Chromium requires that this is enabled.
+               `(cons "--enable-custom-modes"
+                      ,flags))))))
+
+(define libvpx+experimental
+  (package (inherit libvpx)
+           ;; XXX: Chromium 66 relies on unreleased libvpx features.
+           ;; The commit below is the tip of the "m66-3359" branch
+           ;; as of 2018-04-19.
+           (source (origin
+                     (method git-fetch)
+                     (uri (git-reference
+                           (url "https://chromium.googlesource.com/webm/libvpx")
+                           (commit "e9fff8a9dbcd03fbf3e5b7caaa9dc2631a79882a")))
+                     (sha256
+                      (base32
+                       "1b1d89dlbr8ydakvp82cg6xnlnkz5hj7679f4pgxwlgd6x46f4g2"))))
+           (name "libvpx+experimental")
+           (arguments
+            (substitute-keyword-arguments (package-arguments libvpx)
+              ((#:configure-flags flags)
+               ;; Spatial SVC is an experimental VP9 encoder required
+               ;; by Chromium.
+               `(cons* "--enable-experimental" "--enable-spatial-svc"
+                       ,flags))))))
+
+;; XXX: This ugly libstdc++ variant stems from the fact that building
+;; libstdc++ standalone is not officially supported by GCC upstream, and
+;; the "make-libstdc++" procedure consequently builds a library without
+;; threading support, since the configure script fails to detect gthreads.
+;;
+;; Fixing it properly would require building libgcc (which creates
+;; gthr-default.h) before building libstdc++.  This authors attempts
+;; at doing so were unsuccessful, hence this hack.
+;;
+;; This behaviour changed upstream in this commit:
+;; https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=630d52ca0a88d173f89634a5d7dd8aee07d04d80
+;; ...or around GCC 4.6.  The libstdc++ docs are very explicit about it
+;; not being designed to used standalone (even though it worked just fine
+;; before 4.6, according to multiple mailing list threads around that time),
+;; so upstream is not interested in improving the situation.
+;;
+;; In fact, there used to be an "INSTALL" document with libstdc++, which
+;; is conspicuously missing in later releases.
+;;
+;; An alternative would be to change the GCC package to install C++ headers
+;; in "include" rather than "include/c++".  I tried that too; but it caused
+;; a bootstrapping failure.  The situation is further complicated by the
+;; fact that GCC installs C++ headers in the default output, but libstdc++.so
+;; ends up in "lib".
+;;
+;; To be continued...
+
+(define (libstdc++-from-gcc gcc)
+  "Return a libstdc++ library extracted from gcc.  The primary use case
+is when using compilers other than GCC."
+  (package
+    (inherit gcc)
+    (source #f)
+    (name "libstdc++")
+    (build-system trivial-build-system)
+    (arguments
+     `(#:modules ((guix build utils))
+       #:builder (begin
+                  (use-modules (guix build utils))
+                  (let* ((out (assoc-ref %outputs "out"))
+                         (lib (string-append out "/lib"))
+                         (include (string-append out "/include"))
+                         (gcc (assoc-ref %build-inputs "gcc"))
+                         (gcc-lib (assoc-ref %build-inputs "gcc:lib")))
+                    (mkdir-p out)
+                    (copy-recursively (string-append gcc "/include/c++")
+                                      include)
+                    (for-each (lambda (file)
+                                (install-file file lib))
+                              (find-files (string-append gcc-lib "/lib")
+                                          "^libstdc\\+\\+\\.so.*"))
+                    #t))))
+    (outputs '("out"))
+    (inputs `(("gcc" ,gcc)
+              ("gcc:lib" ,gcc "lib")))
+    (native-inputs '())
+    (propagated-inputs '())
+    (synopsis "GNU C++ standard library")))
+
+(define (make-clang-toolchain clang libcxx)
+  "Return a complete toolchain for Clang."
+  (package
+    (name "clang-toolchain")
+    (version (package-version clang))
+    (source #f)
+    (build-system trivial-build-system)
+    (arguments
+     '(#:modules ((guix build union))
+       #:builder (begin
+                   (use-modules (ice-9 match)
+                                (srfi srfi-26)
+                                (guix build union))
+
+                   (let ((out (assoc-ref %outputs "out")))
+
+                     (match %build-inputs
+                       (((names . directories) ...)
+                        (union-build out directories)))
+                     #t))))
+    (native-search-paths (package-native-search-paths clang))
+    (search-paths (package-search-paths clang))
+    (license (package-license clang))
+    (synopsis "Complete Clang tool chain for C/C++ development")
+    (description
+     "This package provides a complete Clang tool chain for C/C++.  This
+includes Clang, the Guix ld wrapper, glibc, a C++ library, and Binutils.")
+    (home-page "https://clang.llvm.org")
+    (outputs '("out"))
+    (inputs `(("clang" ,clang)
+              ("libcxx" ,libcxx)
+              ("ld-wrapper" ,(car (assoc-ref (%final-inputs) "ld-wrapper")))
+              ("binutils" ,binutils)
+              ("libc" ,glibc)))))
+
+;; When using Clang, Chromium expects to find "ar" and friends next
+;; to the clang executable.  For simplicity just create this union.
+(define chromium-clang-toolchain
+  (make-clang-toolchain clang (libstdc++-from-gcc gcc-6)))
+
+(define-public chromium
+  (package
+    (name "chromium")
+    (version "66.0.3359.117")
+    (synopsis "Graphical web browser")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "https://commondatastorage.googleapis.com/"
+                                  "chromium-browser-official/chromium-"
+                                  version ".tar.xz"))
+              (sha256
+               (base32
+                "1mlfavs0m0lf60s42krqxqiyx73hdfd4r1mkjwv31p2gchsa7ibp"))
+              (patches (list %chromium-gn-libcxx.patch
+                             %chromium-disable-api-keys-warning.patch
+                             %chromium-system-nspr.patch
+                             %chromium-system-libevent.patch
+
+                             %chromium-add-blink-tools.patch
+
+                             %chromium-clang-assignment.patch
+                             %chromium-ffmpeg.patch
+
+                             %chromium-build-without-safebrowsing.patch
+                             %chromium-default-preferences.patch
+                             %chromium-restore-classic-ntp.patch
+                             %chromium-duckduckgo.patch
+                             %chromium-first-run.patch
+                             (search-patch "chromium-remove-default-history.patch")))
+              (modules '((srfi srfi-1)
+                         (srfi srfi-26)
+                         (ice-9 ftw)
+                         (ice-9 match)
+                         (ice-9 regex)
+                         (guix build utils)))
+              (snippet
+               '(begin
+                  (let ((preserved-club
+                         (map
+                          (lambda (path)
+                            ;; Prepend paths with "./" for comparison with ftw.
+                            (string-append "./" path))
+                          (list
+                           "base/third_party/dmg_fp"
+                           "base/third_party/dynamic_annotations"
+                           "base/third_party/icu"
+                           "base/third_party/libevent"
+                           "base/third_party/nspr"
+                           "base/third_party/superfasthash"
+                           "base/third_party/symbolize" ;glog
+                           "base/third_party/xdg_mime"
+                           "base/third_party/xdg_user_dirs"
+                           "chrome/third_party/mozilla_security_manager"
+                           "courgette/third_party"
+                           "net/third_party/mozilla_security_manager"
+                           "net/third_party/nss"
+                           "third_party/adobe/flash/flapper_version.h"
+                           ;; FIXME: This is used in:
+                           ;; * ui/webui/resources/js/analytics.js
+                           ;; * ui/file_manager/
+                           "third_party/analytics"
+                           "third_party/angle"
+                           "third_party/angle/src/common/third_party/base"
+                           "third_party/angle/src/common/third_party/smhasher"
+                           "third_party/angle/src/third_party/compiler"
+                           "third_party/angle/src/third_party/libXNVCtrl"
+                           "third_party/angle/src/third_party/trace_event"
+                           "third_party/angle/third_party/glslang"
+                           "third_party/angle/third_party/spirv-headers"
+                           "third_party/angle/third_party/spirv-tools"
+                           "third_party/angle/third_party/vulkan-validation-layers"
+                           "third_party/blink"
+                           "third_party/boringssl"
+                           "third_party/boringssl/src/third_party/fiat"
+                           "third_party/breakpad"
+                           "third_party/brotli"
+                           "third_party/cacheinvalidation"
+                           "third_party/catapult"
+                           "third_party/catapult/common/py_vulcanize/third_party/rcssmin"
+                           "third_party/catapult/common/py_vulcanize/third_party/rjsmin"
+                           "third_party/catapult/third_party/polymer"
+                           "third_party/catapult/tracing/third_party/d3"
+                           "third_party/catapult/tracing/third_party/gl-matrix"
+                           "third_party/catapult/tracing/third_party/jszip"
+                           "third_party/catapult/tracing/third_party/mannwhitneyu"
+                           "third_party/catapult/tracing/third_party/oboe"
+                           "third_party/catapult/tracing/third_party/pako"
+                           "third_party/ced"
+                           "third_party/cld_3"
+                           "third_party/crc32c"
+                           "third_party/cros_system_api"
+                           "third_party/dom_distiller_js"
+                           "third_party/fips181"
+                           "third_party/flatbuffers"
+                           "third_party/glslang-angle"
+                           "third_party/google_input_tools"
+                           "third_party/google_input_tools/third_party/closure_library"
+                           (string-append "third_party/google_input_tools/third_party"
+                                          "/closure_library/third_party/closure")
+                           "third_party/googletest"
+                           "third_party/harfbuzz-ng"
+                           "third_party/hunspell"
+                           "third_party/iccjpeg"
+                           "third_party/inspector_protocol"
+                           "third_party/jinja2"
+                           "third_party/jstemplate"
+                           "third_party/khronos"
+                           "third_party/leveldatabase"
+                           "third_party/libXNVCtrl"
+                           "third_party/libaddressinput"
+                           "third_party/libaom"
+                           "third_party/libaom/source/libaom/third_party/x86inc/x86inc.asm"
+                           "third_party/libjingle_xmpp"
+                           "third_party/libphonenumber"
+                           "third_party/libsecret" ;FIXME: needs pkg-config support.
+                           "third_party/libsrtp"   ;TODO: Requires libsrtp@2.
+                           "third_party/libudev"
+                           "third_party/libwebm"
+                           "third_party/libxml"
+                           "third_party/libyuv"
+                           "third_party/lss"
+                           "third_party/lzma_sdk"
+                           "third_party/markupsafe"
+                           "third_party/mesa"
+                           "third_party/metrics_proto"
+                           "third_party/modp_b64"
+                           "third_party/node"
+                           (string-append "third_party/node/node_modules/"
+                                          "polymer-bundler/lib/third_party/UglifyJS2")
+                           "third_party/openmax_dl"
+                           "third_party/ots"
+                           ;; TODO: Build as extension.
+                           "third_party/pdfium"
+                           "third_party/pdfium/third_party"
+                           (string-append "third_party/pdfium/third_party/freetype"
+                                          "/include/pstables.h")
+                           "third_party/ply"
+                           "third_party/polymer"
+                           "third_party/protobuf"
+                           "third_party/protobuf/third_party/six"
+                           "third_party/qcms"
+                           "third_party/sfntly"
+                           "third_party/skia"
+                           "third_party/skia/third_party/vulkan"
+                           "third_party/skia/third_party/gif"
+                           "third_party/smhasher"
+                           "third_party/speech-dispatcher"
+                           "third_party/sqlite"
+                           "third_party/swiftshader"
+                           "third_party/swiftshader/third_party"
+                           "third_party/s2cellid"
+                           "third_party/usb_ids"
+                           "third_party/usrsctp"
+                           "third_party/WebKit"
+                           "third_party/web-animations-js"
+                           "third_party/webrtc"
+                           "third_party/webrtc_overrides"
+                           "third_party/widevine/cdm/widevine_cdm_version.h"
+                           "third_party/widevine/cdm/widevine_cdm_common.h"
+                           "third_party/woff2"
+                           "third_party/xdg-utils"
+                           "third_party/yasm/run_yasm.py"
+                           "third_party/zlib/google"
+                           "url/third_party/mozilla"
+                           "v8/src/third_party/utf8-decoder"
+                           "v8/src/third_party/valgrind"
+                           "v8/third_party/inspector_protocol"))))
+
+                    (define (empty? dir)
+                      (equal? (scandir dir) '("." "..")))
+
+                    (define (third_party? file)
+                      (if (string-contains file "third_party/")
+                          #t
+                          #f))
+
+                    (define (useless? file)
+                      (any (cute string-suffix? <> file)
+                           '(".tar.gz" ".zip" ".exe" ".jar")))
+
+                    (define (parents child)
+                      "Return a list of paths up to and including the closest third_party"
+                      (let ((lst (reverse (string-split child #\/))))
+                        (let loop ((hierarchy lst)
+                                   (result '()))
+                          (if (or (null? hierarchy)
+                                  (and (not (null? result))
+                                       (string-suffix? "third_party" (car result))))
+                              result
+                              (loop (cdr hierarchy)
+                                    (cons (string-join (reverse hierarchy) "/")
+                                          result))))))
+
+                    (define (delete-unwanted child stat flag base level)
+                      (let ((protected (make-regexp "\\.(gn|gyp)i?$")))
+                        (match flag
+                          ((or 'regular 'symlink 'stale-symlink)
+                           (when (or (third_party? child) (useless? child))
+                             (unless (or (member child preserved-club)
+                                         (any (cute member <> preserved-club)
+                                              (parents child))
+                                         (regexp-exec protected child))
+                               (format (current-error-port) "deleting ~s~%" child)
+                               (delete-file child)))
+                           #t)
+                          ('directory-processed
+                           (when (empty? child)
+                             (rmdir child))
+                           #t)
+                          (_ #t))))
+
+                    (nftw "." delete-unwanted 'depth 'physical)
+
+                    ;; Assert that each listed item is present to catch removals.
+                    (for-each (lambda (third-party)
+                                (unless (file-exists? third-party)
+                                  (error (format #f "~s does not exist!" third-party))))
+                              preserved-club)
+
+                    ;; Replace "GN" files from third_party with shims for
+                    ;; building against system libraries.  Keep this list in
+                    ;; sync with "build/linux/unbundle/replace_gn_files.py".
+                    (for-each (lambda (pair)
+                                (let ((source (string-append
+                                               "build/linux/unbundle/" (car pair)))
+                                      (dest (cdr pair)))
+                                  (copy-file source dest)))
+                              (list
+                               '("ffmpeg.gn" . "third_party/ffmpeg/BUILD.gn")
+                               '("flac.gn" . "third_party/flac/BUILD.gn")
+                               '("fontconfig.gn" . "third_party/fontconfig/BUILD.gn")
+                               '("freetype.gn" . "build/config/freetype/freetype.gni")
+                               '("harfbuzz-ng.gn" .
+                                 "third_party/harfbuzz-ng/harfbuzz.gni")
+                               '("icu.gn" . "third_party/icu/BUILD.gn")
+                               '("libdrm.gn" . "third_party/libdrm/BUILD.gn")
+                               '("libevent.gn" . "base/third_party/libevent/BUILD.gn")
+                               '("libjpeg.gn" .
+                                 "build/secondary/third_party/libjpeg_turbo/BUILD.gn")
+                               '("libpng.gn" . "third_party/libpng/BUILD.gn")
+                               '("libvpx.gn" . "third_party/libvpx/BUILD.gn")
+                               '("libwebp.gn" . "third_party/libwebp/BUILD.gn")
+                               '("libxml.gn" . "third_party/libxml/BUILD.gn")
+                               '("libxslt.gn" . "third_party/libxslt/BUILD.gn")
+                               '("openh264.gn" . "third_party/openh264/BUILD.gn")
+                               '("opus.gn" . "third_party/opus/BUILD.gn")
+                               '("re2.gn" . "third_party/re2/BUILD.gn")
+                               '("snappy.gn" . "third_party/snappy/BUILD.gn")
+                               '("yasm.gn" . "third_party/yasm/yasm_assemble.gni")
+                               '("zlib.gn" . "third_party/zlib/BUILD.gn")))
+                    #t)))))
+    (build-system gnu-build-system)
+    (arguments
+     `(#:tests? #f
+       ;; FIXME: There is a "gn" option specifically for setting -rpath, but
+       ;; it overrides the RUNPATH set by the linker.
+       #:validate-runpath? #f
+       #:modules ((srfi srfi-26)
+                  (ice-9 ftw)
+                  (ice-9 regex)
+                  (guix build gnu-build-system)
+                  (guix build utils))
+       #:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'patch-stuff
+           (lambda* (#:key inputs #:allow-other-keys)
+             (substitute* "printing/cups_config_helper.py"
+               (("cups_config =.*")
+                (string-append "cups_config = '" (assoc-ref inputs "cups")
+                               "/bin/cups-config'\n")))
+
+             (substitute*
+                 '("base/process/launch_posix.cc"
+                   "base/third_party/dynamic_annotations/dynamic_annotations.c"
+                   "sandbox/linux/seccomp-bpf/sandbox_bpf.cc"
+                   "sandbox/linux/services/credentials.cc"
+                   "sandbox/linux/services/namespace_utils.cc"
+                   "sandbox/linux/services/syscall_wrappers.cc"
+                   "sandbox/linux/syscall_broker/broker_host.cc")
+               (("include \"base/third_party/valgrind/") "include \"valgrind/"))
+
+             (for-each (lambda (file)
+                         (substitute* file
+                           ;; Fix opus include path.
+                           ;; Do not substitute opus_private.h.
+                           (("#include \"opus\\.h\"")
+                            "#include \"opus/opus.h\"")
+                           (("#include \"opus_custom\\.h\"")
+                            "#include \"opus/opus_custom.h\"")
+                           (("#include \"opus_defines\\.h\"")
+                            "#include \"opus/opus_defines.h\"")
+                           (("#include \"opus_multistream\\.h\"")
+                            "#include \"opus/opus_multistream.h\"")
+                           (("#include \"opus_types\\.h\"")
+                            "#include \"opus/opus_types.h\"")))
+                       (find-files (string-append "third_party/webrtc/modules"
+                                                  "/audio_coding/codecs/opus")))
+
+             (substitute* "chrome/common/chrome_paths.cc"
+               (("/usr/share/chromium/extensions")
+                ;; TODO: Add ~/.guix-profile.
+                "/run/current-system/profile/share/chromium/extensions"))
+
+             (substitute*
+                 "third_party/breakpad/breakpad/src/common/linux/libcurl_wrapper.h"
+               (("include \"third_party/curl") "include \"curl"))
+             (substitute* "media/base/decode_capabilities.cc"
+               (("third_party/libvpx/source/libvpx/") ""))
+
+             ;; We don't cross compile most packages, so get rid of the
+             ;; unnecessary ARCH-linux-gnu* prefix.
+             (substitute* "build/toolchain/linux/BUILD.gn"
+               (("aarch64-linux-gnu-") "")
+               (("arm-linux-gnueabihf-") ""))
+             #t))
+         (replace 'configure
+           (lambda* (#:key inputs outputs #:allow-other-keys)
+             (let* ((out (assoc-ref outputs "out"))
+                    (clang-toolchain (assoc-ref inputs "clang-toolchain"))
+                    (gtk+ (assoc-ref inputs "gtk+"))
+                    (mesa (assoc-ref inputs "mesa"))
+                    (nss (assoc-ref inputs "nss"))
+                    (udev (assoc-ref inputs "udev"))
+                    (gn-flags
+                     (list
+                      ;; See tools/gn/docs/cookbook.md and
+                      ;; https://www.chromium.org/developers/gn-build-configuration
+                      ;; for usage.  Run "./gn args . --list" in the Release
+                      ;; directory for an exhaustive list of supported flags.
+                      "is_debug=false"
+                      "use_gold=false"
+                      "use_lld=false"
+                      "linux_use_bundled_binutils=false"
+                      "use_custom_libcxx=false"
+                      "use_sysroot=false"
+                      "enable_precompiled_headers=false"
+                      "goma_dir=\"\""
+                      "enable_nacl=false"
+                      "enable_nacl_nonsfi=false"
+                      "use_allocator=\"none\"" ;don't use tcmalloc
+                      "override_build_date=\"01 01 2000 05:00:00\""
+                      "use_unofficial_version_number=false"
+
+                      ;; Disable "safe browsing", which pulls in a dependency
+                      ;; on the nonfree "unrar" program.
+                      "safe_browsing_mode=0"
+
+                      ;; GCC is poorly supported, so we use Clang for now.
+                      ;;"is_clang=false"
+                      (string-append "clang_base_path=\"" clang-toolchain "\"")
+                      "clang_use_chrome_plugins=false"
+
+                      ;; Optimize for building everything at once, as opposed
+                      ;; to incrementally for development.  See "docs/jumbo.md".
+                      "use_jumbo_build=true"
+                      ;; Disable debugging features to save space.
+                      "symbol_level=1"
+                      "remove_webcore_debug_symbols=true"
+                      "enable_iterator_debugging=false"
+                      ;; Some of the unbundled libraries throws deprecation
+                      ;; warnings, etc.  Ignore it.
+                      "treat_warnings_as_errors=false"
+                      ;; Don't add any API keys.  End users can set them in the
+                      ;; environment if desired.  See
+                      ;; <https://www.chromium.org/developers/how-tos/api-keys>.
+                      "use_official_google_api_keys=false"
+                      ;; Disable "field trials".
+                      "fieldtrial_testing_like_official_build=true"
+                      ;; Disable Chrome Remote Desktop (aka Chromoting).
+                      "enable_remoting=false"
+
+                      "use_system_freetype=true"
+                      "use_system_lcms2=true"
+                      "use_system_libjpeg=true"
+                      "use_system_libpng=true"
+                      "use_system_zlib=true"
+                      ;; This is currently not supported on GNU/Linux:
+                      ;; https://bugs.chromium.org/p/chromium/issues/detail?id=22208
+                      ;;"use_system_sqlite=true"
+
+                      "use_gnome_keyring=false" ;deprecated by libsecret
+                      "use_gtk3=true"
+                      "use_openh264=true"
+                      "use_xkbcommon=true"
+                      "use_pulseaudio=true"
+                      "link_pulseaudio=true"
+
+                      ;; Don't arbitrarily restrict formats supported by system ffmpeg.
+                      "proprietary_codecs=true"
+                      "ffmpeg_branding=\"Chrome\""
+
+                      ;; WebRTC stuff.
+                      "rtc_use_h264=true"
+                      ;; Don't use bundled sources.
+                      "rtc_build_json=false"
+                      "rtc_build_libevent=false"
+                      "rtc_build_libvpx=false"
+                      "rtc_build_opus=false"
+                      "rtc_build_ssl=false"
+                      ;; TODO: Package these.
+                      "rtc_build_libsrtp=true" ;2.0
+                      "rtc_build_openmax_dl=true"
+                      "rtc_build_usrsctp=true"
+                      (string-append "rtc_jsoncpp_root=\""
+                                     (assoc-ref inputs "jsoncpp")
+                                     "/include/jsoncpp/json\"")
+                      (string-append "rtc_ssl_root=\""
+                                     (assoc-ref inputs "openssl")
+                                     "/include/openssl\""))))
+
+               ;; XXX: How portable is this.
+               (mkdir-p "third_party/node/linux/node-linux-x64")
+               (symlink (string-append (assoc-ref inputs "node") "/bin")
+                        "third_party/node/linux/node-linux-x64/bin")
+
+               (setenv "CC" "clang")
+               (setenv "CXX" "clang++")
+
+               ;; FIXME: This nasty hack works around a problem where
+               ;; Clang does not add the arch triplet to the libtsdc++
+               ;; search path.  Fixing it seems tricky, since it only
+               ;; searches "include/<triplet>" when it detects libstdc++
+               ;; in GCC which is not the case in Guix; the only reason
+               ;; libstdc++ works here is because it's already on the
+               ;; include path...
+               (setenv "CPLUS_INCLUDE_PATH"
+                       (string-append (getenv "CPLUS_INCLUDE_PATH")
+                                      ":" clang-toolchain
+                                      "/include/x86_64-unknown-linux-gnu"))
+               ;; XXX: For some reason this is needed also for C code (libaom).
+               (setenv "C_INCLUDE_PATH"
+                       (string-append (getenv "C_INCLUDE_PATH")
+                                      ":" clang-toolchain
+                                      "/include/x86_64-unknown-linux-gnu"))
+
+               ;; TODO: pre-compile instead. Avoids a race condition.
+               (setenv "PYTHONDONTWRITEBYTECODE" "1")
+               (and
+                ;; Build the "gn" tool.
+                (invoke "python"
+                        "tools/gn/bootstrap/bootstrap.py" "-s" "-v")
+                ;; Generate ninja build files.
+                (invoke "./out/Release/gn" "gen" "out/Release"
+                        (string-append "--args="
+                                       (string-join gn-flags " ")))))))
+         (replace 'build
+           (lambda* (#:key outputs #:allow-other-keys)
+             (invoke "ninja" "-C" "out/Release"
+                     "-j" (number->string (parallel-job-count))
+                     "chrome")))
+         (replace 'install
+           (lambda* (#:key inputs outputs #:allow-other-keys)
+             (let* ((out            (assoc-ref outputs "out"))
+                    (bin            (string-append out "/bin"))
+                    (exe            (string-append bin "/chromium"))
+                    (lib            (string-append out "/lib"))
+                    (man            (string-append out "/share/man/man1"))
+                    (applications   (string-append out "/share/applications"))
+                    (install-regexp (make-regexp "\\.(bin|pak)$"))
+                    (locales        (string-append lib "/locales"))
+                    (resources      (string-append lib "/resources"))
+                    (gtk+           (assoc-ref inputs "gtk+"))
+                    (mesa           (assoc-ref inputs "mesa"))
+                    (nss            (assoc-ref inputs "nss"))
+                    (udev           (assoc-ref inputs "udev"))
+                    (sh             (which "sh")))
+
+               (substitute* '("chrome/app/resources/manpage.1.in"
+                              "chrome/installer/linux/common/desktop.template")
+                 (("@@MENUNAME@@") "Chromium")
+                 (("@@PACKAGE@@") "chromium")
+                 (("/usr/bin/@@USR_BIN_SYMLINK_NAME@@") exe))
+               (mkdir-p man)
+               (copy-file "chrome/app/resources/manpage.1.in"
+                          (string-append man "/chromium.1"))
+               (mkdir-p applications)
+               (copy-file "chrome/installer/linux/common/desktop.template"
+                          (string-append applications "/chromium.desktop"))
+
+               (with-directory-excursion "out/Release"
+                 (for-each (lambda (file)
+                             (install-file file lib))
+                           (scandir "." (cut regexp-exec install-regexp <>)))
+                 (copy-file "chrome" (string-append lib "/chromium"))
+
+                 ;; TODO: Install icons from "../../chrome/app/themes" into
+                 ;; "out/share/icons/hicolor/$size".
+                 (install-file
+                  "product_logo_48.png"
+                  (string-append out "/share/icons/48x48/chromium.png"))
+
+                 (copy-recursively "locales" locales)
+                 (copy-recursively "resources" resources)
+
+                 (mkdir-p bin)
+                 ;; Add a thin wrapper to prevent the user from inadvertently
+                 ;; installing non-free software through the Web Store.
+                 ;; TODO: Discover extensions from the profile and pass
+                 ;; something like "--disable-extensions-except=...".
+                 (call-with-output-file exe
+                   (lambda (port)
+                     (format port
+                             "#!~a~@
+                             if [ -z \"$CHROMIUM_ENABLE_WEB_STORE\" ]~@
+                             then~@
+                               CHROMIUM_FLAGS=\" \\~@
+                                 --disable-background-networking \\~@
+                                 --disable-extensions \\~@
+                               \"~@
+                             fi~@
+                             exec ~a $CHROMIUM_FLAGS \"$@\"~%"
+                             sh (string-append lib "/chromium"))))
+                 (chmod exe #o755)
+
+                 (wrap-program exe
+                   ;; TODO: Get these in RUNPATH.
+                   `("LD_LIBRARY_PATH" ":" prefix
+                     (,(string-append lib ":" nss "/lib/nss:" gtk+ "/lib:"
+                                      mesa "/lib:" udev "/lib")))
+                   ;; Avoid file manager crash.  See <https://bugs.gnu.org/26593>.
+                   `("XDG_DATA_DIRS" ":" prefix (,(string-append gtk+ "/share"))))
+                 #t)))))))
+    (native-inputs
+     `(("bison" ,bison)
+       ("clang-toolchain" ,chromium-clang-toolchain)
+       ("git" ,git)                     ;last_commit_position.py
+       ("gperf" ,gperf)
+       ("ninja" ,ninja)
+       ("node" ,node)
+       ("pkg-config" ,pkg-config)
+       ("which" ,which)
+       ("yasm" ,yasm)
+
+       ("python-beautifulsoup4" ,python2-beautifulsoup4)
+       ("python-html5lib" ,python2-html5lib)
+       ("python" ,python-2)))
+    (inputs
+     `(("alsa-lib" ,alsa-lib)
+       ("atk" ,atk)
+       ("cups" ,cups)
+       ("curl" ,curl)
+       ("dbus" ,dbus)
+       ("dbus-glib" ,dbus-glib)
+       ("expat" ,expat)
+       ("flac" ,flac)
+       ("ffmpeg" ,ffmpeg)
+       ("fontconfig" ,fontconfig)
+       ("freetype" ,freetype)
+       ("gdk-pixbuf" ,gdk-pixbuf)
+       ("glib" ,glib)
+       ("gtk+-2" ,gtk+-2)
+       ("gtk+" ,gtk+)
+       ("harfbuzz" ,harfbuzz)
+       ("icu4c" ,icu4c)
+       ("jsoncpp" ,jsoncpp)
+       ("lcms" ,lcms)
+       ("libevent" ,libevent)
+       ("libffi" ,libffi)
+       ("libjpeg-turbo" ,libjpeg-turbo)
+       ("libpng" ,libpng)
+       ("libusb" ,libusb)
+       ("libvpx" ,libvpx+experimental)
+       ("libwebp" ,libwebp)
+       ("libx11" ,libx11)
+       ("libxcb" ,libxcb)
+       ("libxcomposite" ,libxcomposite)
+       ("libxcursor" ,libxcursor)
+       ("libxdamage" ,libxdamage)
+       ("libxext" ,libxext)
+       ("libxfixes" ,libxfixes)
+       ("libxi" ,libxi)
+       ("libxkbcommon" ,libxkbcommon)
+       ("libxml2" ,libxml2)
+       ("libxrandr" ,libxrandr)
+       ("libxrender" ,libxrender)
+       ("libxscrnsaver" ,libxscrnsaver)
+       ("libxslt" ,libxslt)
+       ("libxtst" ,libxtst)
+       ("mesa" ,mesa)
+       ("minizip" ,minizip)
+       ("mit-krb5" ,mit-krb5)
+       ("nss" ,nss)
+       ("openh264" ,openh264)
+       ("openssl" ,openssl)
+       ("opus" ,opus+custom)
+       ("pango" ,pango)
+       ("pciutils" ,pciutils)
+       ("protobuf" ,protobuf)
+       ("pulseaudio" ,pulseaudio)
+       ("re2" ,re2)
+       ("snappy" ,snappy)
+       ("speech-dispatcher" ,speech-dispatcher)
+       ("sqlite" ,sqlite)
+       ("udev" ,eudev)
+       ("valgrind" ,valgrind)))
+    (home-page "https://www.chromium.org/")
+    (description
+     "Chromium is a web browser designed for speed and security.  This
+version incorporates patches from
+@url{https://github.com/gcarq/inox-patchset,Inox} and
+@url{https://www.debian.org/,Debian} in order to protect the users privacy.")
+    ;; Chromium is developed as BSD-3, but bundles a large number of third-party
+    ;; components with other licenses.  For full information, see chrome://credits.
+    (license (list license:bsd-3
+                   license:bsd-2
+                   license:expat
+                   license:asl2.0
+                   license:mpl2.0
+                   license:public-domain
+                   license:lgpl2.1+))))
diff --git a/gnu/packages/patches/chromium-remove-default-history.patch b/gnu/packages/patches/chromium-remove-default-history.patch
new file mode 100644
index 000000000..38be10820
--- /dev/null
+++ b/gnu/packages/patches/chromium-remove-default-history.patch
@@ -0,0 +1,13 @@
+Don't pre-populate the New Tab Page for new profiles.
+
+--- a/chrome/browser/history/top_sites_factory.cc
++++ b/chrome/browser/history/top_sites_factory.cc
+@@ -74,7 +74,7 @@
+ 
+ void InitializePrepopulatedPageList(
+     history::PrepopulatedPageList* prepopulated_pages) {
+-#if !defined(OS_ANDROID)
++#if false
+   DCHECK(prepopulated_pages);
+   prepopulated_pages->reserve(arraysize(kRawPrepopulatedPages));
+   for (size_t i = 0; i < arraysize(kRawPrepopulatedPages); ++i) {
-- 
2.17.0