GNU bug report logs - #34565
ungoogled-chromium may contain Widevine DRM

Previous Next

Full log

Message #20 received at 34565 <at> debbugs.gnu.org (full text, mbox):

From: Julien Lepiller <julien <at> lepiller.eu>
To: 34565 <at> debbugs.gnu.org
Subject: Re: bug#34565: ungoogled-chromium contains Widevine DRM
Date: Tue, 19 Feb 2019 15:44:17 +0100

Le 2019-02-19 14:42, Julien Lepiller a écrit :
> Le 2019-02-19 14:28, Jason Self a écrit :
>> On Tue, 2019-02-19 at 02:06 -0500, Leo Famulari wrote:
>> Why do you think this is the case?
>> 
>> We know Chromium comes with it. Have you looked through ungoogled-
>> chromium to see where it's being deleted?
> 
> Our package definition has two widevine-related headers listed as
> preserved third-party stuff... I'm not sure how widevine normally
> gets into chromium, but if we don't have it, I guess we should
> not need these headers? There might actually be an issue, but
> I'm not sure how to check. Where is widevine in upstream (non
> ungoogled) chromium? Is it downloaded at runtime?
> 
> IIUC, the rest of this widevine directory is removed before
> building anything, so maybe there's nothing to worry about
> after all?

So I've downloaded the source tarball with `guix build -S chromium`
and here's what I found in it:

$ find -name cdm
./media/cdm
./third_party/widevine/cdm
./chrome/android/java/src/org/chromium/chrome/browser/media/cdm
./chrome/browser/media/android/cdm
./content/renderer/media/cdm
./chromecast/media/cdm
./components/cdm

$ find -name widevine
./third_party/widevine

$ find -name '*widevine*'
./third_party/widevine
./third_party/widevine/cdm/android/widevine_cdm_version.h
./third_party/widevine/cdm/widevinecdmadapter.ver
./third_party/widevine/cdm/stub/widevine_cdm_version.h
./third_party/widevine/cdm/widevine.gni
./third_party/widevine/cdm/widevine_cdm_version.h
./third_party/widevine/cdm/widevine_cdm_common.h
./chrome/common/widevine_cdm_constants.h
./chrome/common/widevine_cdm_constants.cc
./chrome/browser/component_updater/widevine_cdm_component_installer.cc
./chrome/browser/component_updater/widevine_cdm_component_installer.h
./components/cdm/common/widevine_drm_delegate_android.cc
./components/cdm/common/widevine_drm_delegate_android.h
./components/cdm/renderer/widevine_key_system_properties.cc
./components/cdm/renderer/widevine_key_system_properties.h


This 
./chrome/browser/component_updater/widevine_cdm_component_installer.cc
looks particularly suspicious to me...

Now, it seems that widevine stuff only gets built when the 
ENABLE_WIDEVINE
option is set, and it doesn't seem to be the case in guix' package. 
Since
I don't understand how the browser gets built, so I'm not sure about the
default. In any case, it would be good to get rid of these files even
if they aren't built.

HTH!

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.