Subject: [bug#78052] [PATCH] gnu: ungoogled-chromium: Fix WebRTC.

From: Maxim Cournoyer <[email-masked]>
Date: Tue, 29 Apr 2025 17:14:58 +0900

Hi Nicolas,

Nicolas Goaziou <[email-masked]> writes:

> Hello,
>
> Maxim Cournoyer <[email-masked]> writes:
>
>> Danny Milosavljevic <[email-masked]> writes:
>>
>>> * gnu/packages/patches/ungoogled-chromium-fcntl-fix.patch: New file.
>>> * gnu/packages/chromium.scm (%guix-patches): Add reference to it.
>>> * gnu/local.mk (dist_patch_DATA): Add reference to it.
>>
>> Ouch, the last time ungoogled-chromium was updated was in 2023.  That's
>> terrible for something is sensitive as a web browser that runs arbitrary
>> javascript by default.
>>
>> If nobody champions an update, I'd suggest we remove the package.
>>
>> What do people think? (+CC guix-devel).
>
> It still builds, so I disagree that it should be removed. It can still
> be useful locally, assuming casting is fixed (see
> <https://issues.guix.gnu.org/58581>).
>
> Of course, it would be nice to update it.

I agree that it has value; wouldn't it only be for testing website
problems (it's still a thing in 2025 to find a website feature that only
works with Chromium, in a nudge to the good old Internet Explorer days).

But I'm not sure that this value is worth the exposure of unsuspecting
user to tens of CVEs:

--8<---------------cut here---------------start------------->8---
$ guix lint -c cve ungoogled-chromium
fetching CVE database for 2025...
--8<---------------cut here---------------end--------------->8---

I'd think that most users expect that security matters for web browsers
and that they are kept up to date/secure.

-- 
Thanks,
Maxim