guix_mirror_bot pushed a commit to branch master
in repository guix.
commit 704ad8ced8ac2a6f94ddaf6edbfa1ae7d154dd44
Author: André Batista <[email protected]>
AuthorDate: Fri Oct 23 12:09:36 2026 -0300
gnu: ungoogled-chromium: Update to 156.0.8078.47 [security-fixes].
Fixes several CVEs, too many to list.
* gnu/packages/chromium.scm: Import web.scm.
(%preserved-third-party-files): Remove third_party/bidimapper.
Add third_party/chromium-bidi and third_party/openxr.
(%denied-files): Add third_party/devtools-frontend/src/node_modules/esbuild,
third_party/oak/src/mcp,
third_party/tflite/src/tensorflow/lite/experimental/acceleration/compatibility
and
third_party/tflite/src/tensorflow/lite/experimental/acceleration/mini_benchmark/models
which have bundled binaries.
(%chromium-version): Update to 156.0.8078.47.
(%ungoogled-origin, %debian-origin): Update hashes.
(%debian-patches): Add fixes/crubit.patch, fixes/tsc-split-comp.patch and
fixes/verification-tokens.patch.
Remove bookworm/foreach.patch, system/rust-cbor.patch and
trixie/nodejs-main.patch, which are not needed any longer.
(%guix-patches): Remove ungoogled-chromium-crubit.patch and use debian's
above. Add ungoogled-chromium-emudhra.patch and
ungoogled-chromium-esbuild.patch.
(ungoogled-chromium) [arguments] <#:configure-flags>: Set
v8_use_metagen_instance_types to false.
<#:phases> {patch-stuff}: Set esbuild and substitute it where needed. Add
third_party/devtools-frontend/src/scripts/build/typescript/typescript_vars.gni
to typescript substitution path list. Symlink our own node-esbuild
modules.
{install}: Adjust substitutions to target the current @@desktop_icon and
@@desktop_exec variables.
[native-inputs]: Use go at version 1.27, build fails at our current default.
Add node-esbuild.
* gnu/packages/patches/ungoogled-chromium-custom-compiler.patch: ...
* gnu/packages/patches/ungoogled-chromium-rust-toolchain-var.patch: ...
* gnu/packages/patches/ungoogled-chromium-override-libdrm-assertion.patch:
...
* gnu/packages/patches/ungoogled-chromium-typescript.patch: Refresh them.
* gnu/packages/patches/ungoogled-chromium-crubit.patch: Delete it.
* gnu/packages/patches/ungoogled-chromium-esbuild.patch: ...
* gnu/packages/patches/ungoogled-chromium-emudhra.patch: Add them.
* gnu/local.mk (dist_patch_DATA): Unregister
ungoogled-chromium-crubit.patch. Register ungoogled-chromium-emudhra.patch
and ungoogled-chromium-esbuild.patch.
Signed-off-by: Andreas Enge <[email protected]>
---
gnu/local.mk | 3 +-
gnu/packages/chromium.scm | 62 +-
.../patches/ungoogled-chromium-crubit.patch | 248 -------
.../ungoogled-chromium-custom-compiler.patch | 92 ++-
.../patches/ungoogled-chromium-emudhra.patch | 741 +++++++++++++++++++++
.../patches/ungoogled-chromium-esbuild.patch | 29 +
...oogled-chromium-override-libdrm-assertion.patch | 3 +-
.../ungoogled-chromium-rust-toolchain-var.patch | 40 +-
.../patches/ungoogled-chromium-typescript.patch | 226 +++++++
9 files changed, 1131 insertions(+), 313 deletions(-)
diff --git a/gnu/local.mk b/gnu/local.mk
index 32ca2338c21..bf9b80a355c 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -2653,8 +2653,9 @@ dist_patch_DATA =
\
%D%/packages/patches/unity-test-set-subdir-correctly.patch \
%D%/packages/patches/unity-test-support-int64.patch \
%D%/packages/patches/ungoogled-chromium-custom-compiler.patch \
- %D%/packages/patches/ungoogled-chromium-crubit.patch \
%D%/packages/patches/ungoogled-chromium-empty-parsed-rustc-args.patch
\
+ %D%/packages/patches/ungoogled-chromium-emudhra.patch \
+ %D%/packages/patches/ungoogled-chromium-esbuild.patch \
%D%/packages/patches/ungoogled-chromium-extension-search-path.patch \
%D%/packages/patches/ungoogled-chromium-golang.patch \
%D%/packages/patches/ungoogled-chromium-increase-fortify-level.patch \
diff --git a/gnu/packages/chromium.scm b/gnu/packages/chromium.scm
index 634e183df1e..9f3197fe902 100644
--- a/gnu/packages/chromium.scm
+++ b/gnu/packages/chromium.scm
@@ -76,6 +76,7 @@
#:use-module (gnu packages xiph)
#:use-module (gnu packages xml)
#:use-module (gnu packages xorg)
+ #:use-module (gnu packages web)
#:use-module (ice-9 match))
(define %preserved-third-party-files
@@ -97,7 +98,6 @@
"third_party/anonymous_tokens" ;ASL2.0
"third_party/apple_apsl" ;APSL2.0
"third_party/axe-core" ;MPL2.0
- "third_party/bidimapper" ;ASL2.0
"third_party/blink" ;BSD-3, LGPL2+
"third_party/boringssl" ;OpenSSL/ISC (Google additions are ISC)
"third_party/boringssl/src/third_party/fiat" ;Expat
@@ -121,6 +121,7 @@
;; XXX: Minified version of <https://github.com/nodeca/pako>.
"third_party/catapult/tracing/third_party/pako" ;Expat
"third_party/ced" ;BSD-3
+ "third_party/chromium-bidi" ;ASL2.0
"third_party/cld_3" ;ASL2.0
"third_party/closure_compiler" ;ASL2.0
"third_party/compiler-rt" ;ASL2.0
@@ -279,6 +280,7 @@
"third_party/one_euro_filter" ;BSD-3
"third_party/openscreen" ;BSD-3
"third_party/openscreen/src/third_party/tinycbor" ;Expat
+ "third_party/openxr" ;ASL2.0 among others.
"third_party/opus" ;BSD-3
"third_party/ots" ;BSD-3
"third_party/pdfium" ;BSD-3
@@ -405,9 +407,14 @@
;; 'third_party/blink/perf_tests/resources/svg/HarveyRayner.svg' carries a
;; nonfree license according to LICENSES in the same directory. As we don't
;; run the Blink performance tests, just remove everything to save ~70MiB.
- '("third_party/blink/perf_tests"))
-
-(define %chromium-version "153.0.8010.52")
+ '("third_party/blink/perf_tests"
+ ;; Bundled binaries.
+ "third_party/devtools-frontend/src/node_modules/esbuild"
+ "third_party/oak/src/mcp"
+
"third_party/tflite/src/tensorflow/lite/experimental/acceleration/compatibility"
+
"third_party/tflite/src/tensorflow/lite/experimental/acceleration/mini_benchmark/models"))
+
+(define %chromium-version "156.0.8078.47")
(define %ungoogled-revision (string-append %chromium-version "-1"))
(define %debian-revision (string-append "debian/" %ungoogled-revision))
@@ -419,7 +426,7 @@
(file-name (git-file-name "ungoogled-chromium" %ungoogled-revision))
(sha256
(base32
- "1sd34gzhc9aimqhq4bnj1zijx3z2f5i8ql7svzis5kc5j8gkcxv6"))))
+ "1iirvhpfc88g7w2yp6kkam5lci02793k4mm3l3jfy3kif19s3bs3"))))
(define %debian-origin
(origin
@@ -432,7 +439,7 @@
((_ version) version))))
(sha256
(base32
- "1q43rdy7hjjfcdshlb6aw70yjmcp2ncqa32zalzf89nlkzgr869l"))))
+ "0jfrim8pdhjlr923b0pxqb6gvf52afvqvzmdyjcs2z7ah6dglxh9"))))
(define (origin-file origin file)
(computed-file
@@ -445,16 +452,18 @@
(define %debian-patches
(map debian-patch
- '("bookworm/foreach.patch"
- "debianization/safe-libcxx.patch"
+ '("debianization/safe-libcxx.patch"
"disable/enterprise-tests.patch"
"disable/node-version-ck.patch"
"disable/rustc-allow-features.patch"
"fixes/bytemuck.patch"
+ "fixes/crubit.patch"
"fixes/gentoo-stylesheet.patch"
"fixes/libcpp-headers.patch"
"fixes/libpng-testonly.patch"
"fixes/rust-clanglib.patch"
+ "fixes/tsc-split-comp.patch"
+ "fixes/verification-tokens.patch"
"llvm-22/clang22.patch"
"llvm-22/clone-traits.patch"
"llvm-22/const-profile.patch"
@@ -462,11 +471,9 @@
"llvm-22/keyfactory.patch"
"llvm-22/raw-ref-map-find.patch"
"system/openjpeg.patch"
- "system/rust-cbor.patch"
"system/llvm.patch"
"trixie/bindgen-boringssl.patch"
"trixie/cookie-string-view.patch"
- "trixie/nodejs-main.patch"
"trixie/revert-v8-sanitize.patch")))
(define %guix-patches
@@ -476,8 +483,9 @@
(search-patch patch))))
(list
"ungoogled-chromium-custom-compiler.patch"
- "ungoogled-chromium-crubit.patch"
"ungoogled-chromium-empty-parsed-rustc-args.patch"
+ "ungoogled-chromium-emudhra.patch"
+ "ungoogled-chromium-esbuild.patch"
"ungoogled-chromium-extension-search-path.patch"
"ungoogled-chromium-golang.patch"
"ungoogled-chromium-increase-fortify-level.patch"
@@ -623,7 +631,7 @@
%chromium-version "-lite.tar.xz"))
(sha256
(base32
- "0jl476d87vz7n35h1gxxacffdxjnigx3asv13739fbzi2gwwnvzd"))
+ "01d7xbrbk57kldavdrjs9yqd2ylh032q1f4x5qghxxqfi4l20hr8"))
(modules '((guix build utils)))
(snippet (force ungoogled-chromium-snippet))))
(build-system gnu-build-system)
@@ -696,6 +704,8 @@
"v8_symbol_level=0"
"v8_enable_backtrace=false"
"v8_drumbrake_bounds_checks=true"
+ ;; Does not work with unbundled llvm toolchain.
+ "v8_use_metagen_instance_types=false"
;; Define a custom toolchain that simply looks up CC, AR and
;; friends from the environment.
@@ -771,6 +781,9 @@
(lambda* (#:key inputs native-inputs #:allow-other-keys)
(let* ((brotli (search-input-file inputs
"/bin/brotli"))
+ (esbuild (search-input-file
+ (or native-inputs inputs)
+ "/lib/node_modules/esbuild/bin/esbuild"))
(libopenjp2 (search-input-file inputs
"lib/libopenjp2.so"))
(openjpeg (dirname (dirname libopenjp2)))
(gperf (search-input-file (or native-inputs inputs)
@@ -787,12 +800,21 @@
(("/usr/bin/brotli")
brotli))
+ ;; Works on top of the esbuild patch.
+ (substitute*
+
'("third_party/devtools-frontend/src/scripts/build/esbuild.js"
+
"third_party/devtools-frontend/src/scripts/build/ninja/bundle.gni")
+ (("/usr/bin/esbuild")
+ esbuild))
+
(substitute* ".gn"
(("//third_party/cpython3/host/bin/python3")
python3))
- ;; works on top of typescript patch.
- (substitute*
"third_party/devtools-frontend/src/third_party/typescript/typescript.py"
+ ;; Works on top of typescript patch.
+ (substitute*
+
'("third_party/devtools-frontend/src/third_party/typescript/typescript.py"
+
"third_party/devtools-frontend/src/scripts/build/typescript/typescript_vars.gni")
(("/usr/bin/tsc")
tsc))
@@ -847,6 +869,11 @@
(mkdir-p "third_party/gperf/cipd")
(symlink (dirname gperf) "third_party/gperf/cipd/bin")
+ ;; Since M154, esbuild is required, bundled and expected to
+ ;; be available here.
+ (symlink (dirname (dirname esbuild))
+
"third_party/devtools-frontend/src/node_modules/esbuild")
+
(substitute*
"third_party/breakpad/breakpad/src/common/linux/libcurl_wrapper.h"
(("include \"third_party/curl")
@@ -1007,8 +1034,8 @@
(substitute* '("chrome/app/resources/manpage.1.in"
"chrome/installer/linux/common/desktop.template")
(("@@MENUNAME") "Chromium")
- (("@@PACKAGE") "chromium")
- (("/usr/bin/@@usr_bin_symlink_name") exe)
+ (("@@desktop_icon") "chromium")
+ (("@@desktop_exec") exe)
(("@@uri_scheme") "x-scheme-handler/chromium;")
(("@@extra_desktop_entries") "")
(("@@startup_wm_class") "Chromium-browser"))
@@ -1061,10 +1088,11 @@
clang-toolchain-23
gn
gperf
- go
+ go-1.27
lld-as-ld-wrapper-23
llvm-23
ninja
+ node-esbuild
node-lts
node-typescript
pkg-config
diff --git a/gnu/packages/patches/ungoogled-chromium-crubit.patch
b/gnu/packages/patches/ungoogled-chromium-crubit.patch
deleted file mode 100644
index 5bcba5f2448..00000000000
--- a/gnu/packages/patches/ungoogled-chromium-crubit.patch
+++ /dev/null
@@ -1,248 +0,0 @@
---- b/third_party/blink/renderer/platform/BUILD.gn
-+++ a/third_party/blink/renderer/platform/BUILD.gn
-@@ -186,6 +186,18 @@
- ]
- }
-
-+rust_static_library("font_format_check") {
-+ allow_unsafe = true # Needed for FFI that underpins the `cxx` crate.
-+ crate_root = "fonts/opentype/format_check.rs"
-+ sources = [ crate_root ]
-+ cxx_bindings = [ crate_root ]
-+ deps = [
-+ "//third_party/rust/font_types/v0_12:lib",
-+ "//third_party/rust/read_fonts/v0_41:lib",
-+ "//third_party/rust/skrifa/v0_44:lib",
-+ ]
-+}
-+
- rust_static_library("rustfft_ffi") {
- allow_unsafe = true # Needed for FFI that underpins the `cxx` crate.
- crate_root = "audio/rustfft_ffi.rs"
-@@ -1794,7 +1806,6 @@
- ":allow_discouraged_type",
- ":blink_platform_public_deps",
- ":platform_export",
-- "//build/rust/crubit",
- "//gpu/command_buffer/client:raster_interface",
- "//media/capture:capture_lib",
- "//mojo/public/cpp/base",
-@@ -1821,8 +1832,8 @@
- "//ui/native_theme/features",
- ]
- deps = [
-+ ":font_format_check",
- ":rustfft_ffi",
-- "fonts:font_format_bindings",
- "//base:base_static",
- "//base/allocator:buildflags",
- "//build:chromecast_buildflags",
---- b/third_party/blink/renderer/platform/fonts/BUILD.gn
-+++ /dev/null
-@@ -1,19 +0,0 @@
--# Copyright 2026 The Chromium Authors
--# Use of this source code is governed by a BSD-style license that can be
--# found in the LICENSE file.
--
--import("//build/rust/rust_static_library.gni")
--
--rust_static_library("font_format") {
-- crate_root = "opentype/format_check.rs"
-- sources = [ crate_root ]
-- cpp_api_from_rust = {
-- target_name = "font_format_bindings"
-- cpp_namespace = "font_format"
-- }
-- deps = [
-- "//third_party/rust/font_types/v0_12:lib",
-- "//third_party/rust/read_fonts/v0_41:lib",
-- "//third_party/rust/skrifa/v0_44:lib",
-- ]
--}
---- b/third_party/blink/renderer/platform/fonts/opentype/font_format_check.cc
-+++ a/third_party/blink/renderer/platform/fonts/opentype/font_format_check.cc
-@@ -7,6 +7,7 @@
- #include "base/containers/span.h"
- #include "base/containers/span_rust.h"
- #include "base/numerics/byte_conversions.h"
-+#include
"third_party/blink/renderer/platform/fonts/opentype/format_check.rs.h"
- #include "third_party/blink/renderer/platform/runtime_enabled_features.h"
- #include "third_party/blink/renderer/platform/wtf/vector.h"
- #include "third_party/skia/include/core/SkTypeface.h"
-@@ -14,37 +15,35 @@
- namespace blink {
-
- FontFormatCheck::FontFormatCheck(sk_sp<SkData> sk_data)
-+ : format_info_(font_format_check::get_font_format_info(
-- : format_info_(font_format::get_font_format_info(
- base::SpanToRustSlice(sk_data->byteSpan()))) {}
-
--FontFormatCheck::~FontFormatCheck() = default;
--
- bool FontFormatCheck::IsVariableFont() const {
-+ return font_format_check::is_variable(*format_info_);
-- return font_format::is_variable(format_info_);
- }
-
- bool FontFormatCheck::IsCbdtCblcColorFont() const {
-+ return font_format_check::is_cbdt_cblc(*format_info_);
-- return font_format::is_cbdt_cblc(format_info_);
- }
-
- bool FontFormatCheck::IsEbdtEblcMonochromeFont() const {
-+ return font_format_check::is_ebdt_eblc(*format_info_);
-- return font_format::is_ebdt_eblc(format_info_);
- }
-
- bool FontFormatCheck::IsColrCpalColorFontV0() const {
-+ return font_format_check::is_colrv0(*format_info_);
-- return font_format::is_colrv0(format_info_);
- }
-
- bool FontFormatCheck::IsColrCpalColorFontV1() const {
-+ return font_format_check::is_colrv1(*format_info_);
-- return font_format::is_colrv1(format_info_);
- }
-
- bool FontFormatCheck::IsSbixColorFont() const {
-+ return font_format_check::is_sbix(*format_info_);
-- return font_format::is_sbix(format_info_);
- }
-
- bool FontFormatCheck::IsCff2OutlineFont() const {
-+ return font_format_check::is_cff2(*format_info_);
-- return font_format::is_cff2(format_info_);
- }
-
- bool FontFormatCheck::IsVariableColrV0Font() const {
-@@ -58,7 +57,7 @@
-
- bool FontFormatCheck::IsAvar2Font() const {
- return RuntimeEnabledFeatures::FontFormatAvar2Enabled() &&
-+ font_format_check::is_avar2(*format_info_);
-- font_format::is_avar2(format_info_);
- }
-
- FontFormatCheck::VariableFontSubType FontFormatCheck::ProbeVariableFont(
---- b/third_party/blink/renderer/platform/fonts/opentype/font_format_check.h
-+++ a/third_party/blink/renderer/platform/fonts/opentype/font_format_check.h
-@@ -5,7 +5,7 @@
- #ifndef
THIRD_PARTY_BLINK_RENDERER_PLATFORM_FONTS_OPENTYPE_FONT_FORMAT_CHECK_H_
- #define
THIRD_PARTY_BLINK_RENDERER_PLATFORM_FONTS_OPENTYPE_FONT_FORMAT_CHECK_H_
-
-+#include
"third_party/blink/renderer/platform/fonts/opentype/format_check.rs.h"
--#include "third_party/blink/renderer/platform/fonts/font_format.h"
- #include "third_party/blink/renderer/platform/platform_export.h"
- #include "third_party/blink/renderer/platform/wtf/allocator/allocator.h"
- #include "third_party/skia/include/core/SkData.h"
-@@ -19,7 +19,7 @@
-
- public:
- explicit FontFormatCheck(sk_sp<SkData>);
-+ virtual ~FontFormatCheck() = default;
-- virtual ~FontFormatCheck();
- virtual bool IsVariableFont() const;
- virtual bool IsCbdtCblcColorFont() const;
- virtual bool IsEbdtEblcMonochromeFont() const;
-@@ -46,7 +46,7 @@
- enum class COLRVersion { kCOLRV0, kCOLRV1, kNoCOLR };
-
- private:
-+ rust::Box<font_format_check::FontFormatInfo> format_info_;
-- font_format::FontFormatInfo format_info_;
- };
-
- } // namespace blink
---- b/third_party/blink/renderer/platform/fonts/opentype/format_check.rs
-+++ a/third_party/blink/renderer/platform/fonts/opentype/format_check.rs
-@@ -23,7 +23,7 @@
- format_flags: Option<FontFormatFlags>,
- }
-
-+pub fn get_font_format_info(font_bytes: &[u8]) -> Box<FontFormatInfo> {
--pub fn get_font_format_info(font_bytes: &[u8]) -> FontFormatInfo {
- let file_ref = make_font_ref_internal(font_bytes, 0);
-
- match file_ref {
-@@ -32,11 +32,11 @@
- font.table_directory().table_records().iter().map(|e|
e.tag()).collect();
- let color_version = get_colr_version(&font);
- let avar_version = get_avar_version(&font);
-+ Box::new(FontFormatInfo {
-- FontFormatInfo {
- format_flags: Some(FontFormatFlags { table_tags,
color_version, avar_version }),
-+ })
-- }
- }
-+ _ => Box::new(FontFormatInfo::default()),
-- _ => FontFormatInfo::default(),
- }
- }
-
-@@ -44,10 +44,10 @@
- Some(font_ref.colr().ok()?.version())
- }
-
-+fn is_colrv1(format_info: &FontFormatInfo) -> bool {
--pub fn is_colrv1(format_info: &FontFormatInfo) -> bool {
- matches!(&format_info.format_flags, Some(FontFormatFlags { color_version:
Some(1), .. }),)
- }
-+fn is_colrv0(format_info: &FontFormatInfo) -> bool {
--pub fn is_colrv0(format_info: &FontFormatInfo) -> bool {
- matches!(&format_info.format_flags, Some(FontFormatFlags { color_version:
Some(0), .. }),)
- }
-
-@@ -56,7 +56,7 @@
- Some((version.major, version.minor))
- }
-
-+fn is_avar2(format_info: &FontFormatInfo) -> bool {
--pub fn is_avar2(format_info: &FontFormatInfo) -> bool {
- matches!(&format_info.format_flags, Some(FontFormatFlags { avar_version:
Some((2, _)), .. }),)
- }
-
-@@ -69,22 +69,39 @@
- }
- }
-
-+fn is_variable(format_info: &FontFormatInfo) -> bool {
--pub fn is_variable(format_info: &FontFormatInfo) -> bool {
- has_tags(format_info, &[Tag::new(b"fvar")])
- }
-
-+fn is_sbix(format_info: &FontFormatInfo) -> bool {
--pub fn is_sbix(format_info: &FontFormatInfo) -> bool {
- has_tags(format_info, &[Tag::new(b"sbix")])
- }
-
-+fn is_cbdt_cblc(format_info: &FontFormatInfo) -> bool {
--pub fn is_cbdt_cblc(format_info: &FontFormatInfo) -> bool {
- has_tags(format_info, &[Tag::new(b"CBDT"), Tag::new(b"CBLC")])
- }
-
-+fn is_ebdt_eblc(format_info: &FontFormatInfo) -> bool {
--pub fn is_ebdt_eblc(format_info: &FontFormatInfo) -> bool {
- has_tags(format_info, &[Tag::new(b"EBDT"), Tag::new(b"EBLC")])
- }
-
-+fn is_cff2(format_info: &FontFormatInfo) -> bool {
--pub fn is_cff2(format_info: &FontFormatInfo) -> bool {
- has_tags(format_info, &[Tag::new(b"CFF2")])
- }
-+
-+#[cxx::bridge(namespace = "font_format_check")]
-+pub mod ffi {
-+ extern "Rust" {
-+ type FontFormatInfo;
-+
-+ fn get_font_format_info(font_bytes: &[u8]) -> Box<FontFormatInfo>;
-+ fn is_colrv1(format_info: &FontFormatInfo) -> bool;
-+ fn is_colrv0(format_info: &FontFormatInfo) -> bool;
-+ fn is_cbdt_cblc(format_info: &FontFormatInfo) -> bool;
-+ fn is_ebdt_eblc(format_info: &FontFormatInfo) -> bool;
-+ fn is_variable(format_info: &FontFormatInfo) -> bool;
-+ fn is_sbix(format_info: &FontFormatInfo) -> bool;
-+ fn is_cff2(format_info: &FontFormatInfo) -> bool;
-+ fn is_avar2(format_info: &FontFormatInfo) -> bool;
-+ }
-+}
diff --git a/gnu/packages/patches/ungoogled-chromium-custom-compiler.patch
b/gnu/packages/patches/ungoogled-chromium-custom-compiler.patch
index d8d978b24b2..e3d6289e40b 100644
--- a/gnu/packages/patches/ungoogled-chromium-custom-compiler.patch
+++ b/gnu/packages/patches/ungoogled-chromium-custom-compiler.patch
@@ -6,7 +6,7 @@ Subject: [PATCH] Update compiler patch for M147 beta
Signed-off-by: Matt Jolly <[email protected]>
--- a/build/config/compiler/BUILD.gn
+++ b/build/config/compiler/BUILD.gn
-@@ -368,9 +368,6 @@ config("compiler") {
+@@ -365,9 +365,6 @@ config("compiler") {
configs += [
# See the definitions below.
@@ -16,7 +16,7 @@ Signed-off-by: Matt Jolly <[email protected]>
":compiler_codegen",
":compiler_deterministic",
":clang_warning_suppression",
-@@ -1396,43 +1393,6 @@ config("compiler_deterministic") {
+@@ -1408,43 +1405,6 @@ config("compiler_deterministic") {
}
}
@@ -60,7 +60,7 @@ Signed-off-by: Matt Jolly <[email protected]>
# Tells the compiler not to use absolute paths when passing the default
# paths to the tools it invokes. We don't want this because we don't
# really need it and it can mess up the RBE cache entries.
-@@ -1465,88 +1425,6 @@ config("compiler_deterministic") {
+@@ -1477,121 +1437,6 @@ config("compiler_deterministic") {
}
}
@@ -120,22 +120,55 @@ Signed-off-by: Matt Jolly <[email protected]>
-
- if (toolchain_has_rust && _perform_consistency_checks &&
- !rust_force_head_revision) {
-- # Ensure that the synced rust version matches what's in git.
-- _rust_revision_lines =
-- filter_include(read_file("//tools/rust/update_rust.py", "list
lines"),
-- [ "RUST_*REVISION = *" ])
-- _py_revision =
-- string_replace(_rust_revision_lines[0], "RUST_REVISION = '", "")
-- _py_revision = string_replace(_py_revision, "'", "")
-- _py_subrevision =
-- string_replace(_rust_revision_lines[1], "RUST_SUB_REVISION = ", "")
-- _expected_rust_revision = "$_py_revision-$_py_subrevision"
+- # Ensure that synced rust, crubit, and bindgen versions match what's in
+- # git.
+- _rust_update_lines =
+- read_file("//tools/rust/update_rust.py", "list lines")
+- _version_lines =
+- read_file("//third_party/rust-toolchain/VERSION", "list lines")
-
-- # Ensure the rust version matches the clang version.
-- assert(
-- filter_include([ rustc_revision ],
-- [ "*-$_expected_rust_revision-*" ]) != [],
-- "rustc_revision=\"$rustc_revision\" but update_rust.py expected
\"$_expected_rust_revision\". Run \"gclient sync\"?")
+- # The rust revision combines two lines of the file, so we need to do
+- # some preprocessing to combine them.
+- _lines = filter_include(_rust_update_lines, [ "RUST_*REVISION = *" ])
+- _rust_rev =
+- string_replace(string_replace(_lines[0], "RUST_REVISION = '", ""),
+- "'",
+- "")
+- _rust_subrev = string_replace(_lines[1], "RUST_SUB_REVISION = ", "")
+-
+- _tools = [
+- {
+- name = "rustc"
+- expected_pattern = "rustc *$_rust_rev-$_rust_subrev-*"
+- },
+- {
+- name = "crubit"
+- update_variable = "CRUBIT_REVISION"
+- },
+- {
+- name = "bindgen"
+- update_variable = "BINDGEN_REVISION"
+- },
+- ]
+-
+- foreach(_tool, _tools) {
+- if (defined(_tool.expected_pattern)) {
+- _expected = _tool.expected_pattern
+- } else {
+- _lines = []
+- _lines = filter_include(_rust_update_lines,
+- [ "${_tool.update_variable} = *" ])
+- _expected =
+- string_replace(string_replace(_lines[0],
+- "${_tool.update_variable} = '",
+- "${_tool.name}: "),
+- "'",
+- "")
+- }
+- assert(
+- filter_include(_version_lines, [ _expected ]) != [],
+- "${_tool.name} revision in //third_party/rust-toolchain/VERSION
does not match update_rust.py. Run \"gclient sync\"?")
+- }
- }
-
- # This is here so that all files get recompiled after a clang roll and
@@ -149,19 +182,28 @@ Signed-off-by: Matt Jolly <[email protected]>
# Controls the usage of a warning suppression mapping (WSM) file to suppress
# warnings based on the path of the file they come from. It's controlled by
the
# `clang_warning_suppression_file` gn argument , which points to a text file
-@@ -1590,7 +1590,7 @@ config("clang_warning_suppression") {
+@@ -1625,7 +1470,7 @@ config("clang_warning_suppression") {
# See also: https://crbug.com/40891132#comment10
ubsan_hardening("c_array_bounds") {
sanitizer = "array-bounds"
- condition = !(is_asan && target_cpu == "x86")
+ condition = false
-
+
# Because we've enabled array-bounds sanitizing we also want to suppress
# the related warning about "unsafe-buffer-usage-in-static-sized-array",
-@@ -1604,18 +1604,7 @@ ubsan_hardening("c_array_bounds") {
+@@ -1639,6 +1484,7 @@ ubsan_hardening("c_array_bounds") {
# `NOTREACHED()` at the end of such functions.
ubsan_hardening("return") {
sanitizer = "return"
++ condition = false
+ }
+
+ # Enable `-fsanitize=unreachable` to crash deterministically if control
+@@ -1650,19 +1496,7 @@ ubsan_hardening("unreachable") {
+ # 1. `fuchsia-binary-size` tells us that web_engine and
+ # chrome_fuchsia both grow 32768 bytes (10x that, uncompressed).
+ # 2. `headless_shell_wpt_tests` fail on `mac-rel`.
+- condition = is_debug || !(is_mac || is_fuchsia)
-}
-
-config("rustc_revision") {
@@ -176,9 +218,9 @@ Signed-off-by: Matt Jolly <[email protected]>
- }
+ condition = false
}
-
+
config("compiler_arm_fpu") {
-@@ -2104,11 +1970,7 @@ config("chromium_code") {
+@@ -2174,11 +2008,7 @@ config("chromium_code") {
defines = [ "_HAS_NODISCARD" ]
}
} else {
@@ -191,7 +233,3 @@ Signed-off-by: Matt Jolly <[email protected]>
# In Chromium code, we define __STDC_foo_MACROS in order to get the
# C99 macros on Mac and Linux.
-
---
-2.52.0
-
diff --git a/gnu/packages/patches/ungoogled-chromium-emudhra.patch
b/gnu/packages/patches/ungoogled-chromium-emudhra.patch
new file mode 100644
index 00000000000..000411e12ba
--- /dev/null
+++ b/gnu/packages/patches/ungoogled-chromium-emudhra.patch
@@ -0,0 +1,741 @@
+From da63b94c4ee231a3f89ecec37c58db6486afaf14 Mon Sep 17 00:00:00 2001
+From: Hubert Chao <[email protected]>
+Date: Tue, 20 Oct 2026 11:28:38 -0700
+Subject: [PATCH] Add compromised eMudhra intermediates to blocklist.
+
+https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/0XofdebrAAAJ
+
+Change-Id: I8036be8b65ee3c7ff2ea645e670428db31f3e8f6
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8618876
+Reviewed-by: David Benjamin <[email protected]>
+Commit-Queue: Hubert Chao <[email protected]>
+Cr-Commit-Position: refs/heads/main@{#1723080}
+---
+
+diff --git a/net/cert/cert_verify_proc_blocklist.inc
b/net/cert/cert_verify_proc_blocklist.inc
+index b00fc51..c196d03ef 100644
+--- a/net/cert/cert_verify_proc_blocklist.inc
++++ b/net/cert/cert_verify_proc_blocklist.inc
+@@ -418,7 +418,39 @@
+ //
289ed1676f42b679f2b665bb5a3f25610d9d19ac017beafa46787f1d6022986a.pem
+ {0x36, 0xce, 0x75, 0xed, 0xea, 0x80, 0x6f, 0x09, 0x85, 0x14, 0x56,
+ 0x83, 0x29, 0x4e, 0x54, 0xdb, 0xdf, 0xf0, 0x2f, 0xc8, 0x21, 0x87,
+- 0x0c, 0xf5, 0x06, 0x7a, 0x30, 0x8d, 0x15, 0x04, 0xbe, 0x3a}
++ 0x0c, 0xf5, 0x06, 0x7a, 0x30, 0x8d, 0x15, 0x04, 0xbe, 0x3a},
++ //
0164d7ceae5bb909c272af151ff44b1177ae9b47d9424b94f1d9558c30934d19.pem
++ {0x49, 0xdd, 0x35, 0x3d, 0xc2, 0xb9, 0x19, 0xa3, 0x77, 0x06, 0x45,
++ 0x11, 0x7d, 0x0e, 0x60, 0xc1, 0x61, 0x15, 0xe7, 0xd1, 0xbc, 0x25,
++ 0x9e, 0xef, 0xe7, 0x34, 0xb0, 0x0e, 0xa4, 0x34, 0xfe, 0x5f},
++ //
42c4accd12c4f59597925e1a08a7a90102608543809308d50ec427e118ba1493.pem
++ {0xeb, 0xed, 0x64, 0x75, 0xc2, 0xc2, 0xd8, 0x0f, 0xcb, 0x19, 0x9f,
++ 0x3f, 0xe8, 0xdd, 0x6e, 0x6b, 0x3c, 0xe6, 0x0b, 0x77, 0xeb, 0x15,
++ 0xd4, 0xe4, 0x2c, 0x3d, 0xec, 0x0c, 0x6f, 0x5b, 0x51, 0x05},
++ //
432ec25f0d28de9006d97bf752f17bbb2cd41f669933fcb072d9a1148d0261f3.pem
++ {0x5c, 0x06, 0x60, 0xa2, 0xb1, 0x64, 0x91, 0x0d, 0x8f, 0xf5, 0x89,
++ 0xc1, 0x8e, 0x14, 0x55, 0x2e, 0x9e, 0x0e, 0xc2, 0x37, 0xdc, 0xef,
++ 0xe2, 0xcb, 0x73, 0x6d, 0x41, 0xa4, 0x81, 0x1f, 0x81, 0xa0},
++ //
98b896625c0c230adeec3eb2cf6aad5001ecf9156a68644e82374ce5833bc25b.pem
++ {0x43, 0xbf, 0xfa, 0x19, 0xd6, 0xef, 0x65, 0x14, 0x51, 0xf6, 0x84,
++ 0x1e, 0x01, 0x99, 0x31, 0xe9, 0x6f, 0x6f, 0x2e, 0xae, 0xff, 0x28,
++ 0xab, 0x4b, 0x6f, 0x1c, 0xe4, 0x57, 0x6d, 0xe2, 0x71, 0x7b},
++ //
cb6e15165ac802e9b3f993f16c25d41f4e81c21ebde71ae1b012ac00bf9c7c3f.pem
++ {0x63, 0xec, 0xef, 0xee, 0x43, 0x1d, 0x49, 0x52, 0x3b, 0xc1, 0x13,
++ 0x6c, 0x4e, 0x72, 0xd0, 0x20, 0x6a, 0x47, 0x70, 0x86, 0xca, 0xf6,
++ 0x06, 0xcd, 0x5c, 0xf0, 0x25, 0x68, 0x6c, 0x10, 0x9c, 0xf8},
++ //
e7568fe6e12331f4fd7de61da4c7559d0f8eb192a218d4741a3ba75184333838.pem
++ {0xe0, 0x25, 0x4c, 0x7f, 0xcd, 0xc2, 0x65, 0xe2, 0xf0, 0xf8, 0xa4,
++ 0x28, 0xda, 0xbb, 0x75, 0xab, 0x4a, 0xe0, 0x39, 0xb4, 0x87, 0x2d,
++ 0x62, 0xf5, 0xee, 0x57, 0xf0, 0x87, 0x7d, 0x5a, 0x8a, 0x41},
++ //
4b2460a466f95fd40113bcdcca2ceb29b3b093921de45474da7df48874c630b1.pem
++ {0x92, 0xc0, 0x63, 0xd6, 0x7e, 0x8f, 0x14, 0xdb, 0x71, 0xd2, 0x88,
0xe1,
++ 0x12, 0x66, 0xff, 0xda, 0xf6, 0x9c, 0xbf, 0x11, 0x5f, 0x7b, 0xab,
0x14,
++ 0xf3, 0xbc, 0x2f, 0x68, 0xd2, 0x5e, 0x0e, 0x30},
++ //
9e39de2881273acc225a149c72ba3e0f51424963669ab633ee1dc7df5db067b4.pem
++ {0xec, 0x4f, 0xfa, 0x1a, 0xd0, 0xac, 0x88, 0x08, 0x13, 0x14, 0xb7,
0xaa,
++ 0xff, 0xef, 0x6a, 0x91, 0xf9, 0x7c, 0xd5, 0x72, 0x91, 0xbb, 0x5b,
0xa6,
++ 0x86, 0xc5, 0x41, 0x5f, 0x5e, 0xb4, 0xf6, 0xb6}
+ };
+
+ // Hashes of SubjectPublicKeyInfos known to be used for interception by a
+diff --git
a/net/data/ssl/blocklist/0164d7ceae5bb909c272af151ff44b1177ae9b47d9424b94f1d9558c30934d19.pem
b/net/data/ssl/blocklist/0164d7ceae5bb909c272af151ff44b1177ae9b47d9424b94f1d9558c30934d19.pem
+new file mode 100644
+index 0000000..0bd03a9
+--- /dev/null
++++
b/net/data/ssl/blocklist/0164d7ceae5bb909c272af151ff44b1177ae9b47d9424b94f1d9558c30934d19.pem
+@@ -0,0 +1,76 @@
++Certificate:
++ Data:
++ Version: 3 (0x2)
++ Serial Number:
++ 58:8b:2e:3c:2b:b8:cd:a1:3e:1a:12:09:25:43:21
++ Signature Algorithm: ecdsa-with-SHA384
++ Issuer: C=IN, O=eMudhra Technologies Limited, CN=emSign Root TLS CA -
G3
++ Validity
++ Not Before: Apr 30 15:35:09 2025 GMT
++ Not After : Apr 28 18:30:00 2040 GMT
++ Subject: C=US, O=eMudhra Inc, CN=EM DV TLS CA - G3C
++ Subject Public Key Info:
++ Public Key Algorithm: id-ecPublicKey
++ Public-Key: (384 bit)
++ pub:
++ 04:3a:7a:78:62:c8:c4:4d:32:4d:dd:69:03:3a:67:
++ 82:c0:ef:ee:fe:40:55:e6:8a:12:3f:a0:37:1b:a3:
++ bd:91:94:51:4e:e1:72:a4:33:e3:63:0f:02:bd:18:
++ 80:37:d9:e5:14:9f:9b:77:db:94:a2:81:df:98:7b:
++ 2f:ea:88:8b:74:bd:fe:8f:da:4c:10:99:ee:6c:a1:
++ 95:66:fe:3e:f0:e5:f6:b0:9a:55:6c:cc:8b:a5:05:
++ 61:df:1b:2a:44:1d:01
++ ASN1 OID: secp384r1
++ NIST CURVE: P-384
++ X509v3 extensions:
++ X509v3 Authority Key Identifier:
++ E1:3A:AB:21:7C:F1:E3:4D:54:AE:D4:72:B7:FD:8B:59:42:20:90:54
++ X509v3 Subject Key Identifier:
++ AE:7E:10:5C:3C:29:96:C1:A8:47:27:05:59:F1:E0:3D:D4:E5:0A:F3
++ X509v3 Extended Key Usage:
++ TLS Web Server Authentication, TLS Web Client Authentication
++ X509v3 Certificate Policies:
++ Policy: 1.3.6.1.4.1.50977.1.0.1
++ CPS: http://repository.emsign.com
++ Policy: 1.3.6.1.4.1.50977.1.2.100
++ Policy: 2.23.140.1.2.1
++ Authority Information Access:
++ OCSP - URI:http://ocsp-c.emsign.com
++ CA Issuers -
URI:http://repository.emsign.com/certs/EMDVTLSCAG3C.p7c
++ X509v3 CRL Distribution Points:
++ Full Name:
++ URI:http://crl.emsign.com/?roottlscag3.crl
++
++ X509v3 Key Usage: critical
++ Certificate Sign, CRL Sign
++ X509v3 Basic Constraints: critical
++ CA:TRUE, pathlen:0
++ Signature Algorithm: ecdsa-with-SHA384
++ Signature Value:
++ 30:65:02:31:00:c1:0d:d8:75:8c:a1:c6:ee:59:dc:b5:77:7d:
++ e9:1f:a2:69:32:f3:ff:57:f0:c8:4b:93:ed:65:bb:f5:43:b4:
++ d7:11:bc:6b:73:2c:60:ca:e7:5d:38:9b:1c:60:32:49:94:02:
++ 30:07:8b:07:d4:1a:5b:49:c0:f3:91:d0:f8:b4:90:52:c2:b1:
++ bf:d4:cc:7c:da:f6:fc:61:ac:92:7a:13:6e:bb:5f:b5:a1:73:
++ 5d:00:42:b0:68:9d:26:57:34:9c:cb:6f:ba
++-----BEGIN CERTIFICATE-----
++MIIDaDCCAu6gAwIBAgIPWIsuPCu4zaE+GhIJJUMhMAoGCCqGSM49BAMDMFYxCzAJ
++BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk
++MSAwHgYDVQQDDBdlbVNpZ24gUm9vdCBUTFMgQ0EgLSBHMzAeFw0yNTA0MzAxNTM1
++MDlaFw00MDA0MjgxODMwMDBaMEAxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtlTXVk
++aHJhIEluYzEbMBkGA1UEAwwSRU0gRFYgVExTIENBIC0gRzNDMHYwEAYHKoZIzj0C
++AQYFK4EEACIDYgAEOnp4YsjETTJN3WkDOmeCwO/u/kBV5ooSP6A3G6O9kZRRTuFy
++pDPjYw8CvRiAN9nlFJ+bd9uUooHfmHsv6oiLdL3+j9pMEJnubKGVZv4+8OX2sJpV
++bMyLpQVh3xsqRB0Bo4IBljCCAZIwHwYDVR0jBBgwFoAU4TqrIXzx401UrtRyt/2L
++WUIgkFQwHQYDVR0OBBYEFK5+EFw8KZbBqEcnBVnx4D3U5QrzMB0GA1UdJQQWMBQG
++CCsGAQUFBwMBBggrBgEFBQcDAjBdBgNVHSAEVjBUMDkGCysGAQQBg44hAQABMCow
++KAYIKwYBBQUHAgEWHGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wDQYLKwYB
++BAGDjiEBAmQwCAYGZ4EMAQIBMHUGCCsGAQUFBwEBBGkwZzAkBggrBgEFBQcwAYYY
++aHR0cDovL29jc3AtYy5lbXNpZ24uY29tMD8GCCsGAQUFBzAChjNodHRwOi8vcmVw
++b3NpdG9yeS5lbXNpZ24uY29tL2NlcnRzL0VNRFZUTFNDQUczQy5wN2MwNwYDVR0f
++BDAwLjAsoCqgKIYmaHR0cDovL2NybC5lbXNpZ24uY29tLz9yb290dGxzY2FnMy5j
++cmwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwCgYIKoZIzj0E
++AwMDaAAwZQIxAMEN2HWMocbuWdy1d33pH6JpMvP/V/DIS5PtZbv1Q7TXEbxrcyxg
++yuddOJscYDJJlAIwB4sH1BpbScDzkdD4tJBSwrG/1Mx82vb8YaySehNuu1+1oXNd
++AEKwaJ0mVzScy2+6
++-----END CERTIFICATE-----
+diff --git
a/net/data/ssl/blocklist/42c4accd12c4f59597925e1a08a7a90102608543809308d50ec427e118ba1493.pem
b/net/data/ssl/blocklist/42c4accd12c4f59597925e1a08a7a90102608543809308d50ec427e118ba1493.pem
+new file mode 100644
+index 0000000..9a268c0b
+--- /dev/null
++++
b/net/data/ssl/blocklist/42c4accd12c4f59597925e1a08a7a90102608543809308d50ec427e118ba1493.pem
+@@ -0,0 +1,78 @@
++Certificate:
++ Data:
++ Version: 3 (0x2)
++ Serial Number:
++ a4:ae:e6:78:f2:33:62:b4:c0:e4:60:b7:72:f2:14
++ Signature Algorithm: ecdsa-with-SHA384
++ Issuer: C=IN, O=eMudhra Technologies Limited, CN=emSign Root TLS CA -
G3
++ Validity
++ Not Before: Apr 30 15:54:08 2025 GMT
++ Not After : Apr 28 18:30:00 2040 GMT
++ Subject: C=NL, O=eMudhra BV, CN=EM DV TLS CA - G3B
++ Subject Public Key Info:
++ Public Key Algorithm: id-ecPublicKey
++ Public-Key: (384 bit)
++ pub:
++ 04:e7:9e:d9:c0:4a:97:73:c4:73:5e:51:11:1d:a8:
++ 5a:c2:bd:5e:64:ab:37:4b:80:e1:2c:bc:20:38:ec:
++ 1e:4f:0e:3b:81:2f:c9:85:9e:1e:67:af:b0:4e:2f:
++ 8b:c9:7f:74:85:ba:65:aa:91:1e:e8:a4:e4:5b:62:
++ d5:cc:03:d5:6b:e6:78:b3:c3:8c:b4:dc:93:7c:a2:
++ 46:0e:23:84:53:c8:92:93:5d:29:d4:4f:91:e1:56:
++ 06:b6:3c:ce:da:b4:68
++ ASN1 OID: secp384r1
++ NIST CURVE: P-384
++ X509v3 extensions:
++ X509v3 Authority Key Identifier:
++ E1:3A:AB:21:7C:F1:E3:4D:54:AE:D4:72:B7:FD:8B:59:42:20:90:54
++ X509v3 Subject Key Identifier:
++ E2:1E:2F:E7:1C:19:39:0E:55:4B:62:C1:20:24:57:35:24:8A:25:14
++ X509v3 Extended Key Usage:
++ TLS Web Server Authentication, TLS Web Client Authentication
++ X509v3 Certificate Policies:
++ Policy: 1.3.6.1.4.1.50977.1.0.1
++ CPS: http://repository.emsign.com
++ Policy: 1.3.6.1.4.1.50977.1.2.100
++ Policy: 2.23.140.1.2.1
++ Authority Information Access:
++ OCSP - URI:http://ocsp-b.emsign.com
++ CA Issuers -
URI:http://repository.emsign.com/certs/EMDVTLSCAG3B.p7c
++ X509v3 CRL Distribution Points:
++ Full Name:
++ URI:http://crl.emsign.com/?roottlscag3.crl
++
++ X509v3 Key Usage: critical
++ Certificate Sign, CRL Sign
++ X509v3 Basic Constraints: critical
++ CA:TRUE, pathlen:0
++ Signature Algorithm: ecdsa-with-SHA384
++ Signature Value:
++ 30:65:02:30:2e:6b:06:5e:2e:a8:14:c2:76:92:59:1c:10:c5:
++ cc:ba:0e:a0:bf:14:16:65:69:1e:c2:20:d6:57:34:32:97:62:
++ fa:cf:a0:ee:41:f3:ce:21:b8:75:82:bb:dd:50:b0:c2:02:31:
++ 00:c5:9b:cb:97:15:1a:bc:6e:bd:27:ac:27:4a:30:bc:5c:16:
++ ea:34:84:2c:27:a0:84:d9:07:4d:39:ef:38:3e:dc:5b:e9:51:
++ bc:82:dd:93:95:f2:5b:1e:28:be:28:db:ca
++
++-----BEGIN CERTIFICATE-----
++MIIDaDCCAu6gAwIBAgIQAKSu5njyM2K0wORgt3LyFDAKBggqhkjOPQQDAzBWMQsw
++CQYDVQQGEwJJTjElMCMGA1UECgwcZU11ZGhyYSBUZWNobm9sb2dpZXMgTGltaXRl
++ZDEgMB4GA1UEAwwXZW1TaWduIFJvb3QgVExTIENBIC0gRzMwHhcNMjUwNDMwMTU1
++NDA4WhcNNDAwNDI4MTgzMDAwWjA/MQswCQYDVQQGEwJOTDETMBEGA1UECgwKZU11
++ZGhyYSBCVjEbMBkGA1UEAwwSRU0gRFYgVExTIENBIC0gRzNCMHYwEAYHKoZIzj0C
++AQYFK4EEACIDYgAE557ZwEqXc8RzXlERHahawr1eZKs3S4DhLLwgOOweTw47gS/J
++hZ4eZ6+wTi+LyX90hbplqpEe6KTkW2LVzAPVa+Z4s8OMtNyTfKJGDiOEU8iSk10p
++1E+R4VYGtjzO2rRoo4IBljCCAZIwHwYDVR0jBBgwFoAU4TqrIXzx401UrtRyt/2L
++WUIgkFQwHQYDVR0OBBYEFOIeL+ccGTkOVUtiwSAkVzUkiiUUMB0GA1UdJQQWMBQG
++CCsGAQUFBwMBBggrBgEFBQcDAjBdBgNVHSAEVjBUMDkGCysGAQQBg44hAQABMCow
++KAYIKwYBBQUHAgEWHGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wDQYLKwYB
++BAGDjiEBAmQwCAYGZ4EMAQIBMHUGCCsGAQUFBwEBBGkwZzAkBggrBgEFBQcwAYYY
++aHR0cDovL29jc3AtYi5lbXNpZ24uY29tMD8GCCsGAQUFBzAChjNodHRwOi8vcmVw
++b3NpdG9yeS5lbXNpZ24uY29tL2NlcnRzL0VNRFZUTFNDQUczQi5wN2MwNwYDVR0f
++BDAwLjAsoCqgKIYmaHR0cDovL2NybC5lbXNpZ24uY29tLz9yb290dGxzY2FnMy5j
++cmwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwCgYIKoZIzj0E
++AwMDaAAwZQIwLmsGXi6oFMJ2klkcEMXMug6gvxQWZWkewiDWVzQyl2L6z6DuQfPO
++Ibh1grvdULDCAjEAxZvLlxUavG69J6wnSjC8XBbqNIQsJ6CE2QdNOe84Ptxb6VG8
++gt2TlfJbHii+KNvK
++-----END CERTIFICATE-----
++
+diff --git
a/net/data/ssl/blocklist/432ec25f0d28de9006d97bf752f17bbb2cd41f669933fcb072d9a1148d0261f3.pem
b/net/data/ssl/blocklist/432ec25f0d28de9006d97bf752f17bbb2cd41f669933fcb072d9a1148d0261f3.pem
+new file mode 100644
+index 0000000..fd2a5855
+--- /dev/null
++++
b/net/data/ssl/blocklist/432ec25f0d28de9006d97bf752f17bbb2cd41f669933fcb072d9a1148d0261f3.pem
+@@ -0,0 +1,77 @@
++Certificate:
++ Data:
++ Version: 3 (0x2)
++ Serial Number:
++ 80:09:92:8a:64:10:76:01:af:05:fa:2f:19:f1:09
++ Signature Algorithm: ecdsa-with-SHA384
++ Issuer: C=IN, O=eMudhra Technologies Limited, CN=emSign Root TLS CA -
G3
++ Validity
++ Not Before: Apr 30 15:39:31 2025 GMT
++ Not After : Apr 28 18:30:00 2040 GMT
++ Subject: C=US, O=eMudhra Inc, CN=EM EV TLS CA - G3C
++ Subject Public Key Info:
++ Public Key Algorithm: id-ecPublicKey
++ Public-Key: (384 bit)
++ pub:
++ 04:2d:56:e8:29:a6:fb:82:c6:4a:46:97:d9:60:af:
++ 95:1e:90:67:ae:91:f9:26:d3:43:06:da:48:a8:aa:
++ eb:78:69:b6:a6:7e:6d:27:42:6e:04:42:aa:03:b3:
++ 6e:19:88:df:f6:36:51:4e:e1:cf:07:f5:ba:4b:3f:
++ f2:a0:66:45:ae:7d:31:d5:86:6a:d3:1a:a3:d2:46:
++ eb:0b:31:77:ee:99:cb:75:66:c5:16:ce:74:80:8a:
++ 66:8f:91:f0:c4:7f:ca
++ ASN1 OID: secp384r1
++ NIST CURVE: P-384
++ X509v3 extensions:
++ X509v3 Authority Key Identifier:
++ E1:3A:AB:21:7C:F1:E3:4D:54:AE:D4:72:B7:FD:8B:59:42:20:90:54
++ X509v3 Subject Key Identifier:
++ A6:25:5E:80:A9:4D:B7:F3:96:7C:1B:C7:91:DF:92:BC:EE:4B:EB:5F
++ X509v3 Extended Key Usage:
++ TLS Web Server Authentication, TLS Web Client Authentication
++ X509v3 Certificate Policies:
++ Policy: 1.3.6.1.4.1.50977.1.0.1
++ CPS: http://repository.emsign.com
++ Policy: 1.3.6.1.4.1.50977.1.2.120
++ Policy: 2.23.140.1.1
++ Authority Information Access:
++ OCSP - URI:http://ocsp-c.emsign.com
++ CA Issuers -
URI:http://repository.emsign.com/certs/EMEVTLSCAG3C.p7c
++ X509v3 CRL Distribution Points:
++ Full Name:
++ URI:http://crl.emsign.com/?roottlscag3.crl
++
++ X509v3 Key Usage: critical
++ Certificate Sign, CRL Sign
++ X509v3 Basic Constraints: critical
++ CA:TRUE, pathlen:0
++ Signature Algorithm: ecdsa-with-SHA384
++ Signature Value:
++ 30:65:02:30:07:2d:70:4e:7c:c7:e2:55:c3:4f:2d:8f:0f:dd:
++ 72:b0:b8:ef:9e:55:4d:dc:96:c9:99:cd:41:20:c1:14:f1:33:
++ 8b:91:85:47:89:b3:1c:f4:77:b2:a2:78:a4:15:27:e6:02:31:
++ 00:ea:e1:37:41:1c:65:ad:94:f3:ff:5f:e5:5c:f4:c4:31:48:
++ 68:6a:e0:2d:c9:c6:a0:b6:53:45:a7:bf:64:8e:1b:cd:6b:6f:
++ df:01:a9:75:18:dc:6c:3a:eb:4b:9e:bd:18
++-----BEGIN CERTIFICATE-----
++MIIDaDCCAu6gAwIBAgIQAIAJkopkEHYBrwX6LxnxCTAKBggqhkjOPQQDAzBWMQsw
++CQYDVQQGEwJJTjElMCMGA1UECgwcZU11ZGhyYSBUZWNobm9sb2dpZXMgTGltaXRl
++ZDEgMB4GA1UEAwwXZW1TaWduIFJvb3QgVExTIENBIC0gRzMwHhcNMjUwNDMwMTUz
++OTMxWhcNNDAwNDI4MTgzMDAwWjBAMQswCQYDVQQGEwJVUzEUMBIGA1UECgwLZU11
++ZGhyYSBJbmMxGzAZBgNVBAMMEkVNIEVWIFRMUyBDQSAtIEczQzB2MBAGByqGSM49
++AgEGBSuBBAAiA2IABC1W6Cmm+4LGSkaX2WCvlR6QZ66R+SbTQwbaSKiq63hptqZ+
++bSdCbgRCqgOzbhmI3/Y2UU7hzwf1uks/8qBmRa59MdWGatMao9JG6wsxd+6Zy3Vm
++xRbOdICKZo+R8MR/yqOCAZUwggGRMB8GA1UdIwQYMBaAFOE6qyF88eNNVK7Ucrf9
++i1lCIJBUMB0GA1UdDgQWBBSmJV6AqU2385Z8G8eR35K87kvrXzAdBgNVHSUEFjAU
++BggrBgEFBQcDAQYIKwYBBQUHAwIwXAYDVR0gBFUwUzA5BgsrBgEEAYOOIQEAATAq
++MCgGCCsGAQUFBwIBFhxodHRwOi8vcmVwb3NpdG9yeS5lbXNpZ24uY29tMA0GCysG
++AQQBg44hAQJ4MAcGBWeBDAEBMHUGCCsGAQUFBwEBBGkwZzAkBggrBgEFBQcwAYYY
++aHR0cDovL29jc3AtYy5lbXNpZ24uY29tMD8GCCsGAQUFBzAChjNodHRwOi8vcmVw
++b3NpdG9yeS5lbXNpZ24uY29tL2NlcnRzL0VNRVZUTFNDQUczQy5wN2MwNwYDVR0f
++BDAwLjAsoCqgKIYmaHR0cDovL2NybC5lbXNpZ24uY29tLz9yb290dGxzY2FnMy5j
++cmwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwCgYIKoZIzj0E
++AwMDaAAwZQIwBy1wTnzH4lXDTy2PD91ysLjvnlVN3JbJmc1BIMEU8TOLkYVHibMc
++9HeyonikFSfmAjEA6uE3QRxlrZTz/1/lXPTEMUhoauAtycagtlNFp79kjhvNa2/f
++Aal1GNxsOutLnr0Y
++-----END CERTIFICATE-----
++
+diff --git
a/net/data/ssl/blocklist/4b2460a466f95fd40113bcdcca2ceb29b3b093921de45474da7df48874c630b1.pem
b/net/data/ssl/blocklist/4b2460a466f95fd40113bcdcca2ceb29b3b093921de45474da7df48874c630b1.pem
+new file mode 100644
+index 0000000..66ae276
+--- /dev/null
++++
b/net/data/ssl/blocklist/4b2460a466f95fd40113bcdcca2ceb29b3b093921de45474da7df48874c630b1.pem
+@@ -0,0 +1,75 @@
++Certificate:
++ Data:
++ Version: 3 (0x2)
++ Serial Number:
++ 54:4b:7f:92:2c:31:ae:22:0a:4a:92:29:16:f6:e6
++ Signature Algorithm: ecdsa-with-SHA384
++ Issuer: C=IN, O=eMudhra Technologies Limited, CN=emSign Root CS CA -
G3
++ Validity
++ Not Before: Apr 30 16:38:40 2025 GMT
++ Not After : Apr 28 18:30:00 2040 GMT
++ Subject: C=US, O=eMudhra Inc, CN=EM OV CS CA - G3C
++ Subject Public Key Info:
++ Public Key Algorithm: id-ecPublicKey
++ Public-Key: (384 bit)
++ pub:
++ 04:b9:f0:e0:63:47:02:a6:9c:a6:aa:dd:44:3c:fd:
++ 62:c4:1b:9b:a4:b2:09:24:69:7d:79:74:e7:69:1a:
++ 12:6f:b9:6a:fb:3e:34:c2:fd:3b:c5:f4:83:06:1f:
++ 26:5d:c2:a5:84:36:34:73:23:51:04:36:b2:8f:04:
++ f3:86:23:63:06:79:80:e2:50:3e:02:53:2d:65:46:
++ 23:5a:71:65:a2:59:a1:ef:49:6f:74:1b:5f:de:e7:
++ 78:72:08:e4:b8:fa:ef
++ ASN1 OID: secp384r1
++ NIST CURVE: P-384
++ X509v3 extensions:
++ X509v3 Authority Key Identifier:
++ 68:74:03:F8:85:CA:8D:54:50:57:1D:16:E0:C8:DE:45:0D:AB:CD:2D
++ X509v3 Subject Key Identifier:
++ EE:6F:73:29:8D:6F:BF:A7:B3:1B:C3:95:34:F6:15:56:44:78:66:B7
++ X509v3 Extended Key Usage:
++ Code Signing
++ X509v3 Certificate Policies:
++ Policy: 1.3.6.1.4.1.50977.1.0.1
++ CPS: http://repository.emsign.com
++ Policy: 1.3.6.1.4.1.50977.1.2.200
++ Policy: 2.23.140.1.4.1
++ Authority Information Access:
++ OCSP - URI:http://ocsp-c.emsign.com
++ CA Issuers -
URI:http://repository.emsign.com/certs/EMOVCSCAG3C.p7c
++ X509v3 CRL Distribution Points:
++ Full Name:
++ URI:http://crl.emsign.com/?rootcscag3.crl
++
++ X509v3 Key Usage: critical
++ Certificate Sign, CRL Sign
++ X509v3 Basic Constraints: critical
++ CA:TRUE, pathlen:0
++ Signature Algorithm: ecdsa-with-SHA384
++ Signature Value:
++ 30:65:02:31:00:f3:23:e0:f2:c9:ed:3a:12:f0:57:64:17:27:
++ 92:c4:68:a4:a9:a3:f7:e7:13:7b:8e:81:36:9d:2b:bd:df:0e:
++ 1c:a3:8a:aa:f4:22:8f:46:56:e4:13:62:a0:4f:6d:0d:93:02:
++ 30:60:7a:e0:29:98:14:b8:f3:af:a2:7a:2d:37:95:1a:e9:d7:
++ 7f:5d:3f:0e:a4:db:c8:e3:18:db:d6:b0:05:3b:03:53:7c:e8:
++ 9d:73:3c:95:43:13:25:47:fa:73:00:58:2d
++-----BEGIN CERTIFICATE-----
++MIIDWzCCAuGgAwIBAgIPVEt/kiwxriIKSpIpFvbmMAoGCCqGSM49BAMDMFUxCzAJ
++BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk
++MR8wHQYDVQQDDBZlbVNpZ24gUm9vdCBDUyBDQSAtIEczMB4XDTI1MDQzMDE2Mzg0
++MFoXDTQwMDQyODE4MzAwMFowPzELMAkGA1UEBhMCVVMxFDASBgNVBAoMC2VNdWRo
++cmEgSW5jMRowGAYDVQQDDBFFTSBPViBDUyBDQSAtIEczQzB2MBAGByqGSM49AgEG
++BSuBBAAiA2IABLnw4GNHAqacpqrdRDz9YsQbm6SyCSRpfXl052kaEm+5avs+NML9
++O8X0gwYfJl3CpYQ2NHMjUQQ2so8E84YjYwZ5gOJQPgJTLWVGI1pxZaJZoe9Jb3Qb
++X97neHII5Lj676OCAYswggGHMB8GA1UdIwQYMBaAFGh0A/iFyo1UUFcdFuDI3kUN
++q80tMB0GA1UdDgQWBBTub3MpjW+/p7Mbw5U09hVWRHhmtzATBgNVHSUEDDAKBggr
++BgEFBQcDAzBeBgNVHSAEVzBVMDkGCysGAQQBg44hAQABMCowKAYIKwYBBQUHAgEW
++HGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wDgYMKwYBBAGDjiEBAoFIMAgG
++BmeBDAEEATB0BggrBgEFBQcBAQRoMGYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3Nw
++LWMuZW1zaWduLmNvbTA+BggrBgEFBQcwAoYyaHR0cDovL3JlcG9zaXRvcnkuZW1z
++aWduLmNvbS9jZXJ0cy9FTU9WQ1NDQUczQy5wN2MwNgYDVR0fBC8wLTAroCmgJ4Yl
++aHR0cDovL2NybC5lbXNpZ24uY29tLz9yb290Y3NjYWczLmNybDAOBgNVHQ8BAf8E
++BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAKBggqhkjOPQQDAwNoADBlAjEA8yPg
++8sntOhLwV2QXJ5LEaKSpo/fnE3uOgTadK73fDhyjiqr0Io9GVuQTYqBPbQ2TAjBg
++euApmBS486+iei03lRrp139dPw6k28jjGNvWsAU7A1N86J1zPJVDEyVH+nMAWC0=
++-----END CERTIFICATE-----
+diff --git
a/net/data/ssl/blocklist/98b896625c0c230adeec3eb2cf6aad5001ecf9156a68644e82374ce5833bc25b.pem
b/net/data/ssl/blocklist/98b896625c0c230adeec3eb2cf6aad5001ecf9156a68644e82374ce5833bc25b.pem
+new file mode 100644
+index 0000000..72de3b9
+--- /dev/null
++++
b/net/data/ssl/blocklist/98b896625c0c230adeec3eb2cf6aad5001ecf9156a68644e82374ce5833bc25b.pem
+@@ -0,0 +1,77 @@
++Certificate:
++ Data:
++ Version: 3 (0x2)
++ Serial Number:
++ 6c:ad:a3:67:fb:1c:10:00:88:12:0e:a2:02:d5:68
++ Signature Algorithm: ecdsa-with-SHA384
++ Issuer: C=IN, O=eMudhra Technologies Limited, CN=emSign Root TLS CA -
G3
++ Validity
++ Not Before: Apr 30 16:00:12 2025 GMT
++ Not After : Apr 28 18:30:00 2040 GMT
++ Subject: C=NL, O=eMudhra BV, CN=EM OV TLS CA - G3B
++ Subject Public Key Info:
++ Public Key Algorithm: id-ecPublicKey
++ Public-Key: (384 bit)
++ pub:
++ 04:73:89:7a:a0:eb:3c:fd:ca:8b:12:40:2f:fa:f0:
++ ab:c4:e1:21:2b:af:8d:ee:77:8a:c9:ee:2d:6d:b8:
++ 3f:ac:28:0c:5e:05:63:8a:e7:a2:ac:d7:1c:32:2a:
++ 8e:36:1c:de:b9:f6:9c:43:02:b9:dd:8d:73:d1:cc:
++ 6c:aa:b2:cc:0a:ee:4e:21:6c:e9:79:dd:51:8a:4a:
++ f4:b6:26:e5:68:4c:dd:65:80:37:ed:0c:85:4e:4c:
++ c1:2f:4c:f8:64:6d:0d
++ ASN1 OID: secp384r1
++ NIST CURVE: P-384
++ X509v3 extensions:
++ X509v3 Authority Key Identifier:
++ E1:3A:AB:21:7C:F1:E3:4D:54:AE:D4:72:B7:FD:8B:59:42:20:90:54
++ X509v3 Subject Key Identifier:
++ 9B:D8:65:51:AF:E7:E7:2C:37:AD:08:EE:69:19:D9:BF:37:84:AE:0A
++ X509v3 Extended Key Usage:
++ TLS Web Server Authentication, TLS Web Client Authentication
++ X509v3 Certificate Policies:
++ Policy: 1.3.6.1.4.1.50977.1.0.1
++ CPS: http://repository.emsign.com
++ Policy: 1.3.6.1.4.1.50977.1.2.110
++ Policy: 2.23.140.1.2.2
++ Authority Information Access:
++ OCSP - URI:http://ocsp-b.emsign.com
++ CA Issuers -
URI:http://repository.emsign.com/certs/EMOVTLSCAG3B.p7c
++ X509v3 CRL Distribution Points:
++ Full Name:
++ URI:http://crl.emsign.com/?roottlscag3.crl
++
++ X509v3 Key Usage: critical
++ Certificate Sign, CRL Sign
++ X509v3 Basic Constraints: critical
++ CA:TRUE, pathlen:0
++ Signature Algorithm: ecdsa-with-SHA384
++ Signature Value:
++ 30:64:02:30:40:93:ee:41:8b:37:49:86:b1:03:df:06:fb:17:
++ 61:a6:ed:b5:88:eb:47:65:35:dd:3b:e6:78:21:4f:64:eb:47:
++ 83:56:29:9b:49:65:c6:dc:db:cc:71:21:8f:cd:38:d2:02:30:
++ 5e:a6:3d:db:23:a2:c6:aa:9a:f1:0c:5a:a2:9c:06:1e:2f:b0:
++ 8b:d7:48:a9:d0:8f:9a:3c:ce:b1:41:e2:82:92:f9:a7:1c:8d:
++ 84:de:f0:3c:f7:6d:08:da:ba:fc:bd:bb
++-----BEGIN CERTIFICATE-----
++MIIDZjCCAu2gAwIBAgIPbK2jZ/scEACIEg6iAtVoMAoGCCqGSM49BAMDMFYxCzAJ
++BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk
++MSAwHgYDVQQDDBdlbVNpZ24gUm9vdCBUTFMgQ0EgLSBHMzAeFw0yNTA0MzAxNjAw
++MTJaFw00MDA0MjgxODMwMDBaMD8xCzAJBgNVBAYTAk5MMRMwEQYDVQQKDAplTXVk
++aHJhIEJWMRswGQYDVQQDDBJFTSBPViBUTFMgQ0EgLSBHM0IwdjAQBgcqhkjOPQIB
++BgUrgQQAIgNiAARziXqg6zz9yosSQC/68KvE4SErr43ud4rJ7i1tuD+sKAxeBWOK
++56Ks1xwyKo42HN659pxDArndjXPRzGyqsswK7k4hbOl53VGKSvS2JuVoTN1lgDft
++DIVOTMEvTPhkbQ2jggGWMIIBkjAfBgNVHSMEGDAWgBThOqshfPHjTVSu1HK3/YtZ
++QiCQVDAdBgNVHQ4EFgQUm9hlUa/n5yw3rQjuaRnZvzeErgowHQYDVR0lBBYwFAYI
++KwYBBQUHAwEGCCsGAQUFBwMCMF0GA1UdIARWMFQwOQYLKwYBBAGDjiEBAAEwKjAo
++BggrBgEFBQcCARYcaHR0cDovL3JlcG9zaXRvcnkuZW1zaWduLmNvbTANBgsrBgEE
++AYOOIQECbjAIBgZngQwBAgIwdQYIKwYBBQUHAQEEaTBnMCQGCCsGAQUFBzABhhho
++dHRwOi8vb2NzcC1iLmVtc2lnbi5jb20wPwYIKwYBBQUHMAKGM2h0dHA6Ly9yZXBv
++c2l0b3J5LmVtc2lnbi5jb20vY2VydHMvRU1PVlRMU0NBRzNCLnA3YzA3BgNVHR8E
++MDAuMCygKqAohiZodHRwOi8vY3JsLmVtc2lnbi5jb20vP3Jvb3R0bHNjYWczLmNy
++bDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAKBggqhkjOPQQD
++AwNnADBkAjBAk+5BizdJhrED3wb7F2Gm7bWI60dlNd075nghT2TrR4NWKZtJZcbc
++28xxIY/NONICMF6mPdsjosaqmvEMWqKcBh4vsIvXSKnQj5o8zrFB4oKS+accjYTe
++8Dz3bQjauvy9uw==
++-----END CERTIFICATE-----
++
+diff --git
a/net/data/ssl/blocklist/9e39de2881273acc225a149c72ba3e0f51424963669ab633ee1dc7df5db067b4.pem
b/net/data/ssl/blocklist/9e39de2881273acc225a149c72ba3e0f51424963669ab633ee1dc7df5db067b4.pem
+new file mode 100644
+index 0000000..7d8aa4d
+--- /dev/null
++++
b/net/data/ssl/blocklist/9e39de2881273acc225a149c72ba3e0f51424963669ab633ee1dc7df5db067b4.pem
+@@ -0,0 +1,76 @@
++Certificate:
++ Data:
++ Version: 3 (0x2)
++ Serial Number:
++ 78:18:93:3f:8f:85:b4:61:9a:2b:35:fb:a8:3d:0a
++ Signature Algorithm: ecdsa-with-SHA384
++ Issuer: C=IN, O=eMudhra Technologies Limited, CN=emSign Root CS CA -
G3
++ Validity
++ Not Before: Apr 30 16:08:27 2025 GMT
++ Not After : Apr 28 18:30:00 2040 GMT
++ Subject: C=NL, O=eMudhra BV, CN=EM OV CS CA - G3B
++ Subject Public Key Info:
++ Public Key Algorithm: id-ecPublicKey
++ Public-Key: (384 bit)
++ pub:
++ 04:aa:bb:0f:b0:66:6a:cf:cf:01:fa:d5:2b:fc:fd:
++ 4c:2b:f2:cb:3c:34:97:de:73:95:0e:58:19:b6:1f:
++ e6:95:09:87:41:c8:c4:91:43:9b:34:a0:43:1c:af:
++ fe:5b:f9:b4:c1:c8:e8:ae:00:01:f9:f4:dc:8a:d8:
++ 2c:59:f3:63:9e:96:cd:6c:3d:4d:b0:ce:fe:c2:6c:
++ 3d:62:51:7b:37:76:13:72:74:3f:8e:8a:dd:77:b1:
++ 00:64:f2:ab:e5:e0:50
++ ASN1 OID: secp384r1
++ NIST CURVE: P-384
++ X509v3 extensions:
++ X509v3 Authority Key Identifier:
++ 68:74:03:F8:85:CA:8D:54:50:57:1D:16:E0:C8:DE:45:0D:AB:CD:2D
++ X509v3 Subject Key Identifier:
++ 79:FA:E8:EC:CF:DB:0D:75:8D:A4:58:D6:9F:B6:ED:DC:7C:49:DE:E6
++ X509v3 Extended Key Usage:
++ Code Signing
++ X509v3 Certificate Policies:
++ Policy: 1.3.6.1.4.1.50977.1.0.1
++ CPS: http://repository.emsign.com
++ Policy: 1.3.6.1.4.1.50977.1.2.200
++ Policy: 2.23.140.1.4.1
++ Authority Information Access:
++ OCSP - URI:http://ocsp-b.emsign.com
++ CA Issuers -
URI:http://repository.emsign.com/certs/EMOVCSCAG3B.p7c
++ X509v3 CRL Distribution Points:
++ Full Name:
++ URI:http://crl.emsign.com/?rootcscag3.crl
++
++ X509v3 Key Usage: critical
++ Certificate Sign, CRL Sign
++ X509v3 Basic Constraints: critical
++ CA:TRUE, pathlen:0
++ Signature Algorithm: ecdsa-with-SHA384
++ Signature Value:
++ 30:66:02:31:00:bf:ce:bd:37:60:41:0b:b0:d2:aa:cd:4b:47:
++ d9:d5:45:8b:80:5a:28:57:72:ae:bf:fa:1b:57:48:5a:9f:0a:
++ 01:58:2c:c3:6f:ee:e2:5c:b2:6e:85:03:68:2f:63:0e:f2:02:
++ 31:00:bd:1d:3c:64:bb:ce:2d:35:7f:5d:98:73:ad:1f:b6:82:
++ d8:db:bf:24:cd:23:4d:fe:8a:8d:90:2f:a2:f0:89:cf:3b:f5:
++ 20:55:92:66:95:4b:66:26:f2:9c:c2:d7:3a:b3
++-----BEGIN CERTIFICATE-----
++MIIDWzCCAuCgAwIBAgIPeBiTP4+FtGGaKzX7qD0KMAoGCCqGSM49BAMDMFUxCzAJ
++BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk
++MR8wHQYDVQQDDBZlbVNpZ24gUm9vdCBDUyBDQSAtIEczMB4XDTI1MDQzMDE2MDgy
++N1oXDTQwMDQyODE4MzAwMFowPjELMAkGA1UEBhMCTkwxEzARBgNVBAoMCmVNdWRo
++cmEgQlYxGjAYBgNVBAMMEUVNIE9WIENTIENBIC0gRzNCMHYwEAYHKoZIzj0CAQYF
++K4EEACIDYgAEqrsPsGZqz88B+tUr/P1MK/LLPDSX3nOVDlgZth/mlQmHQcjEkUOb
++NKBDHK/+W/m0wcjorgAB+fTcitgsWfNjnpbNbD1NsM7+wmw9YlF7N3YTcnQ/jord
++d7EAZPKr5eBQo4IBizCCAYcwHwYDVR0jBBgwFoAUaHQD+IXKjVRQVx0W4MjeRQ2r
++zS0wHQYDVR0OBBYEFHn66OzP2w11jaRY1p+27dx8Sd7mMBMGA1UdJQQMMAoGCCsG
++AQUFBwMDMF4GA1UdIARXMFUwOQYLKwYBBAGDjiEBAAEwKjAoBggrBgEFBQcCARYc
++aHR0cDovL3JlcG9zaXRvcnkuZW1zaWduLmNvbTAOBgwrBgEEAYOOIQECgUgwCAYG
++Z4EMAQQBMHQGCCsGAQUFBwEBBGgwZjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3At
++Yi5lbXNpZ24uY29tMD4GCCsGAQUFBzAChjJodHRwOi8vcmVwb3NpdG9yeS5lbXNp
++Z24uY29tL2NlcnRzL0VNT1ZDU0NBRzNCLnA3YzA2BgNVHR8ELzAtMCugKaAnhiVo
++dHRwOi8vY3JsLmVtc2lnbi5jb20vP3Jvb3Rjc2NhZzMuY3JsMA4GA1UdDwEB/wQE
++AwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMAoGCCqGSM49BAMDA2kAMGYCMQC/zr03
++YEELsNKqzUtH2dVFi4BaKFdyrr/6G1dIWp8KAVgsw2/u4lyyboUDaC9jDvICMQC9
++HTxku84tNX9dmHOtH7aC2Nu/JM0jTf6KjZAvovCJzzv1IFWSZpVLZibynMLXOrM=
++-----END CERTIFICATE-----
++
+diff --git a/net/data/ssl/blocklist/README.md
b/net/data/ssl/blocklist/README.md
+index fe2d29db..48025326 100644
+--- a/net/data/ssl/blocklist/README.md
++++ b/net/data/ssl/blocklist/README.md
+@@ -399,3 +399,18 @@
+ ### www.cloudflarechallenge.com
+
+ *
[e757fd60d8dd4c26f77aca6a87f63ea4d38d0b736c7f79b56cad932d4c400fb5.pem](e757fd60d8dd4c26f77aca6a87f63ea4d38d0b736c7f79b56cad932d4c400fb5.pem)
++
++
++### eMudhra
++
++For details, see
<https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE/m/0XofdebrAAAJ>
++
++ *
[0164d7ceae5bb909c272af151ff44b1177ae9b47d9424b94f1d9558c30934d19.pem](0164d7ceae5bb909c272af151ff44b1177ae9b47d9424b94f1d9558c30934d19.pem)
++ *
[42c4accd12c4f59597925e1a08a7a90102608543809308d50ec427e118ba1493.pem](42c4accd12c4f59597925e1a08a7a90102608543809308d50ec427e118ba1493.pem)
++ *
[432ec25f0d28de9006d97bf752f17bbb2cd41f669933fcb072d9a1148d0261f3.pem](432ec25f0d28de9006d97bf752f17bbb2cd41f669933fcb072d9a1148d0261f3.pem)
++ *
[4b2460a466f95fd40113bcdcca2ceb29b3b093921de45474da7df48874c630b1.pem](4b2460a466f95fd40113bcdcca2ceb29b3b093921de45474da7df48874c630b1.pem)
++ *
[98b896625c0c230adeec3eb2cf6aad5001ecf9156a68644e82374ce5833bc25b.pem](98b896625c0c230adeec3eb2cf6aad5001ecf9156a68644e82374ce5833bc25b.pem)
++ *
[9e39de2881273acc225a149c72ba3e0f51424963669ab633ee1dc7df5db067b4.pem](9e39de2881273acc225a149c72ba3e0f51424963669ab633ee1dc7df5db067b4.pem)
++ *
[cb6e15165ac802e9b3f993f16c25d41f4e81c21ebde71ae1b012ac00bf9c7c3f.pem](cb6e15165ac802e9b3f993f16c25d41f4e81c21ebde71ae1b012ac00bf9c7c3f.pem)
++ *
[e7568fe6e12331f4fd7de61da4c7559d0f8eb192a218d4741a3ba75184333838.pem](e7568fe6e12331f4fd7de61da4c7559d0f8eb192a218d4741a3ba75184333838.pem)
++
+diff --git
a/net/data/ssl/blocklist/cb6e15165ac802e9b3f993f16c25d41f4e81c21ebde71ae1b012ac00bf9c7c3f.pem
b/net/data/ssl/blocklist/cb6e15165ac802e9b3f993f16c25d41f4e81c21ebde71ae1b012ac00bf9c7c3f.pem
+new file mode 100644
+index 0000000..dc1c471c
+--- /dev/null
++++
b/net/data/ssl/blocklist/cb6e15165ac802e9b3f993f16c25d41f4e81c21ebde71ae1b012ac00bf9c7c3f.pem
+@@ -0,0 +1,76 @@
++Certificate:
++ Data:
++ Version: 3 (0x2)
++ Serial Number:
++ 29:69:26:c2:27:a3:a1:52:63:92:b1:94:82:a5:04
++ Signature Algorithm: ecdsa-with-SHA384
++ Issuer: C=IN, O=eMudhra Technologies Limited, CN=emSign Root TLS CA -
G3
++ Validity
++ Not Before: Apr 30 15:37:41 2025 GMT
++ Not After : Apr 28 18:30:00 2040 GMT
++ Subject: C=US, O=eMudhra Inc, CN=EM OV TLS CA - G3C
++ Subject Public Key Info:
++ Public Key Algorithm: id-ecPublicKey
++ Public-Key: (384 bit)
++ pub:
++ 04:13:82:51:cd:52:ac:92:98:c1:c8:aa:d9:77:32:
++ 1d:eb:97:e7:09:bd:0b:4c:a0:ac:a5:5d:c8:ad:51:
++ dc:fc:9d:15:89:a1:59:7e:3a:51:20:e1:ef:d6:31:
++ c6:3e:18:35:ca:ca:e2:98:69:a6:2e:16:31:e8:a2:
++ 81:81:ab:56:61:6d:c4:5d:91:8a:bc:09:f3:ab:0e:
++ 63:cf:79:2a:a4:dc:ed:73:87:be:37:bb:a5:69:54:
++ 9f:1c:02:b2:70:ed:67
++ ASN1 OID: secp384r1
++ NIST CURVE: P-384
++ X509v3 extensions:
++ X509v3 Authority Key Identifier:
++ E1:3A:AB:21:7C:F1:E3:4D:54:AE:D4:72:B7:FD:8B:59:42:20:90:54
++ X509v3 Subject Key Identifier:
++ 34:EA:EA:0C:EB:C9:0A:DA:F9:D0:C5:E2:ED:9B:78:C9:87:9E:1B:6C
++ X509v3 Extended Key Usage:
++ TLS Web Server Authentication, TLS Web Client Authentication
++ X509v3 Certificate Policies:
++ Policy: 1.3.6.1.4.1.50977.1.0.1
++ CPS: http://repository.emsign.com
++ Policy: 1.3.6.1.4.1.50977.1.2.110
++ Policy: 2.23.140.1.2.2
++ Authority Information Access:
++ OCSP - URI:http://ocsp-c.emsign.com
++ CA Issuers -
URI:http://repository.emsign.com/certs/EMOVTLSCAG3C.p7c
++ X509v3 CRL Distribution Points:
++ Full Name:
++ URI:http://crl.emsign.com/?roottlscag3.crl
++
++ X509v3 Key Usage: critical
++ Certificate Sign, CRL Sign
++ X509v3 Basic Constraints: critical
++ CA:TRUE, pathlen:0
++ Signature Algorithm: ecdsa-with-SHA384
++ Signature Value:
++ 30:65:02:31:00:c4:99:b7:6c:6c:3d:eb:a6:45:d7:92:31:24:
++ 37:09:bc:c8:65:e4:3f:ab:b1:83:09:67:de:13:53:ea:fa:68:
++ 60:03:a8:11:33:8e:1c:35:51:77:c4:9f:b0:b3:12:64:fb:02:
++ 30:14:96:da:0c:ca:24:0f:c1:22:e9:e3:4e:88:0f:32:50:c6:
++ 2f:7f:34:32:9e:09:ab:85:94:0c:74:f0:8a:d5:27:b0:ad:1e:
++ fd:e2:b4:9b:f6:f1:aa:c5:9c:de:95:0b:61
++-----BEGIN CERTIFICATE-----
++MIIDaDCCAu6gAwIBAgIPKWkmwiejoVJjkrGUgqUEMAoGCCqGSM49BAMDMFYxCzAJ
++BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk
++MSAwHgYDVQQDDBdlbVNpZ24gUm9vdCBUTFMgQ0EgLSBHMzAeFw0yNTA0MzAxNTM3
++NDFaFw00MDA0MjgxODMwMDBaMEAxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtlTXVk
++aHJhIEluYzEbMBkGA1UEAwwSRU0gT1YgVExTIENBIC0gRzNDMHYwEAYHKoZIzj0C
++AQYFK4EEACIDYgAEE4JRzVKskpjByKrZdzId65fnCb0LTKCspV3IrVHc/J0ViaFZ
++fjpRIOHv1jHGPhg1ysrimGmmLhYx6KKBgatWYW3EXZGKvAnzqw5jz3kqpNztc4e+
++N7ulaVSfHAKycO1no4IBljCCAZIwHwYDVR0jBBgwFoAU4TqrIXzx401UrtRyt/2L
++WUIgkFQwHQYDVR0OBBYEFDTq6gzryQra+dDF4u2beMmHnhtsMB0GA1UdJQQWMBQG
++CCsGAQUFBwMBBggrBgEFBQcDAjBdBgNVHSAEVjBUMDkGCysGAQQBg44hAQABMCow
++KAYIKwYBBQUHAgEWHGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wDQYLKwYB
++BAGDjiEBAm4wCAYGZ4EMAQICMHUGCCsGAQUFBwEBBGkwZzAkBggrBgEFBQcwAYYY
++aHR0cDovL29jc3AtYy5lbXNpZ24uY29tMD8GCCsGAQUFBzAChjNodHRwOi8vcmVw
++b3NpdG9yeS5lbXNpZ24uY29tL2NlcnRzL0VNT1ZUTFNDQUczQy5wN2MwNwYDVR0f
++BDAwLjAsoCqgKIYmaHR0cDovL2NybC5lbXNpZ24uY29tLz9yb290dGxzY2FnMy5j
++cmwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwCgYIKoZIzj0E
++AwMDaAAwZQIxAMSZt2xsPeumRdeSMSQ3CbzIZeQ/q7GDCWfeE1Pq+mhgA6gRM44c
++NVF3xJ+wsxJk+wIwFJbaDMokD8Ei6eNOiA8yUMYvfzQyngmrhZQMdPCK1SewrR79
++4rSb9vGqxZzelQth
++-----END CERTIFICATE-----
+diff --git
a/net/data/ssl/blocklist/e7568fe6e12331f4fd7de61da4c7559d0f8eb192a218d4741a3ba75184333838.pem
b/net/data/ssl/blocklist/e7568fe6e12331f4fd7de61da4c7559d0f8eb192a218d4741a3ba75184333838.pem
+new file mode 100644
+index 0000000..8fa9650f
+--- /dev/null
++++
b/net/data/ssl/blocklist/e7568fe6e12331f4fd7de61da4c7559d0f8eb192a218d4741a3ba75184333838.pem
+@@ -0,0 +1,76 @@
++Certificate:
++ Data:
++ Version: 3 (0x2)
++ Serial Number:
++ c7:c4:1e:fe:92:d8:25:f0:5e:ae:84:1a:4a:82:c1
++ Signature Algorithm: ecdsa-with-SHA384
++ Issuer: C=IN, O=eMudhra Technologies Limited, CN=emSign Root TLS CA -
G3
++ Validity
++ Not Before: Apr 30 16:03:31 2025 GMT
++ Not After : Apr 28 18:30:00 2040 GMT
++ Subject: C=NL, O=eMudhra BV, CN=EM EV TLS CA - G3B
++ Subject Public Key Info:
++ Public Key Algorithm: id-ecPublicKey
++ Public-Key: (384 bit)
++ pub:
++ 04:25:db:a8:5a:64:d3:97:da:0b:10:52:e9:ea:54:
++ 6e:48:7b:ef:ea:9c:9d:9d:68:a0:c5:ea:dc:fe:ef:
++ 75:a6:9b:b5:d6:fc:01:f4:2b:fb:ca:6e:b4:0b:cd:
++ 64:c0:76:7e:36:ff:d0:5d:97:a8:13:c5:aa:0c:6c:
++ 95:30:e7:9c:f5:f0:86:64:68:f1:38:06:42:0a:a5:
++ c8:51:84:0b:1e:25:25:40:e7:90:e4:b6:54:c3:85:
++ 2e:d6:4a:f1:e8:65:7d
++ ASN1 OID: secp384r1
++ NIST CURVE: P-384
++ X509v3 extensions:
++ X509v3 Authority Key Identifier:
++ E1:3A:AB:21:7C:F1:E3:4D:54:AE:D4:72:B7:FD:8B:59:42:20:90:54
++ X509v3 Subject Key Identifier:
++ 3E:DC:20:D9:89:46:98:87:7B:87:3F:D8:81:47:B2:5C:15:D8:47:06
++ X509v3 Extended Key Usage:
++ TLS Web Server Authentication, TLS Web Client Authentication
++ X509v3 Certificate Policies:
++ Policy: 1.3.6.1.4.1.50977.1.0.1
++ CPS: http://repository.emsign.com
++ Policy: 1.3.6.1.4.1.50977.1.2.120
++ Policy: 2.23.140.1.1
++ Authority Information Access:
++ OCSP - URI:http://ocsp-b.emsign.com
++ CA Issuers -
URI:http://repository.emsign.com/certs/EMEVTLSCAG3B.p7c
++ X509v3 CRL Distribution Points:
++ Full Name:
++ URI:http://crl.emsign.com/?roottlscag3.crl
++
++ X509v3 Key Usage: critical
++ Certificate Sign, CRL Sign
++ X509v3 Basic Constraints: critical
++ CA:TRUE, pathlen:0
++ Signature Algorithm: ecdsa-with-SHA384
++ Signature Value:
++ 30:66:02:31:00:f4:9a:bd:f7:da:1a:39:42:a1:17:0a:29:c3:
++ 7d:e2:0a:6b:74:38:72:27:de:08:d3:e3:71:9f:b8:e1:d1:fd:
++ 87:24:5d:dc:28:35:d0:c0:94:81:21:cf:43:60:44:ed:ff:02:
++ 31:00:bd:8f:da:dc:e3:2f:92:d2:19:2d:88:e7:f9:62:ca:9a:
++ 9d:10:86:b2:0c:57:e7:ba:12:94:bb:8f:81:95:78:e2:a8:b8:
++ da:7a:30:df:cf:f8:1c:86:7a:24:4c:82:1c:c1
++-----BEGIN CERTIFICATE-----
++MIIDaDCCAu2gAwIBAgIQAMfEHv6S2CXwXq6EGkqCwTAKBggqhkjOPQQDAzBWMQsw
++CQYDVQQGEwJJTjElMCMGA1UECgwcZU11ZGhyYSBUZWNobm9sb2dpZXMgTGltaXRl
++ZDEgMB4GA1UEAwwXZW1TaWduIFJvb3QgVExTIENBIC0gRzMwHhcNMjUwNDMwMTYw
++MzMxWhcNNDAwNDI4MTgzMDAwWjA/MQswCQYDVQQGEwJOTDETMBEGA1UECgwKZU11
++ZGhyYSBCVjEbMBkGA1UEAwwSRU0gRVYgVExTIENBIC0gRzNCMHYwEAYHKoZIzj0C
++AQYFK4EEACIDYgAEJduoWmTTl9oLEFLp6lRuSHvv6pydnWigxerc/u91ppu11vwB
++9Cv7ym60C81kwHZ+Nv/QXZeoE8WqDGyVMOec9fCGZGjxOAZCCqXIUYQLHiUlQOeQ
++5LZUw4Uu1krx6GV9o4IBlTCCAZEwHwYDVR0jBBgwFoAU4TqrIXzx401UrtRyt/2L
++WUIgkFQwHQYDVR0OBBYEFD7cINmJRpiHe4c/2IFHslwV2EcGMB0GA1UdJQQWMBQG
++CCsGAQUFBwMBBggrBgEFBQcDAjBcBgNVHSAEVTBTMDkGCysGAQQBg44hAQABMCow
++KAYIKwYBBQUHAgEWHGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wDQYLKwYB
++BAGDjiEBAngwBwYFZ4EMAQEwdQYIKwYBBQUHAQEEaTBnMCQGCCsGAQUFBzABhhho
++dHRwOi8vb2NzcC1iLmVtc2lnbi5jb20wPwYIKwYBBQUHMAKGM2h0dHA6Ly9yZXBv
++c2l0b3J5LmVtc2lnbi5jb20vY2VydHMvRU1FVlRMU0NBRzNCLnA3YzA3BgNVHR8E
++MDAuMCygKqAohiZodHRwOi8vY3JsLmVtc2lnbi5jb20vP3Jvb3R0bHNjYWczLmNy
++bDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAKBggqhkjOPQQD
++AwNpADBmAjEA9Jq999oaOUKhFwopw33iCmt0OHIn3gjT43GfuOHR/YckXdwoNdDA
++lIEhz0NgRO3/AjEAvY/a3OMvktIZLYjn+WLKmp0QhrIMV+e6EpS7j4GVeOKouNp6
++MN/P+ByGeiRMghzB
++-----END CERTIFICATE-----
diff --git a/gnu/packages/patches/ungoogled-chromium-esbuild.patch
b/gnu/packages/patches/ungoogled-chromium-esbuild.patch
new file mode 100644
index 00000000000..09b85d0402e
--- /dev/null
+++ b/gnu/packages/patches/ungoogled-chromium-esbuild.patch
@@ -0,0 +1,29 @@
+From ungoogled-chromium.
+--- a/third_party/devtools-frontend/src/scripts/build/esbuild.js
++++ b/third_party/devtools-frontend/src/scripts/build/esbuild.js
+@@ -17,13 +17,7 @@ import {esbuildPlugin} from './devtools_
+ process.env.GODEBUG = 'asyncpreemptoff=1';
+
+ // esbuild module uses binary in this path.
+-const binaryName = os.type() === 'Windows_NT' ? 'esbuild.exe' : 'esbuild';
+-process.env.ESBUILD_BINARY_PATH = path.join(
+- devtoolsRootPath(),
+- 'third_party',
+- 'esbuild',
+- binaryName,
+-);
++process.env.ESBUILD_BINARY_PATH = '/usr/bin/esbuild';
+ // This needs to be after the ESBUILD_BINARY_PATH is set
+
+ const esbuild = await import('esbuild');
+--- a/third_party/devtools-frontend/src/scripts/build/ninja/bundle.gni
++++ b/third_party/devtools-frontend/src/scripts/build/ninja/bundle.gni
+@@ -35,7 +35,7 @@ template("bundle") {
+ devtools_location_prepend + "scripts/devtools_paths.js",
+ ]
+
+- _esbuild = devtools_location_prepend + "third_party/esbuild/esbuild"
++ _esbuild = "/usr/bin/esbuild"
+ if (host_os == "win") {
+ inputs += [ _esbuild + ".exe" ]
+ } else {
diff --git
a/gnu/packages/patches/ungoogled-chromium-override-libdrm-assertion.patch
b/gnu/packages/patches/ungoogled-chromium-override-libdrm-assertion.patch
index 9b780bf5758..47ae16ecee2 100644
--- a/gnu/packages/patches/ungoogled-chromium-override-libdrm-assertion.patch
+++ b/gnu/packages/patches/ungoogled-chromium-override-libdrm-assertion.patch
@@ -1,10 +1,11 @@
--- a/build/config/linux/libdrm/BUILD.gn
+++ b/build/config/linux/libdrm/BUILD.gn
-@@ -15,7 +15,6 @@
+@@ -15,8 +15,6 @@ declare_args() {
}
if (use_system_libdrm) {
- assert(!is_linux, "System libdrm is not supported in linux")
+-
pkg_config("libdrm_config") {
packages = [ "libdrm" ]
}
diff --git a/gnu/packages/patches/ungoogled-chromium-rust-toolchain-var.patch
b/gnu/packages/patches/ungoogled-chromium-rust-toolchain-var.patch
index 3215152fd10..2ebaaed91fd 100644
--- a/gnu/packages/patches/ungoogled-chromium-rust-toolchain-var.patch
+++ b/gnu/packages/patches/ungoogled-chromium-rust-toolchain-var.patch
@@ -81,9 +81,9 @@ index 105a1d52a1682..88ed50182a604 100644
# For the rustc sysroot we must include even the rlibs we don't pass to
--- a/build/rust/gni_impl/run_rs_bindings_from_cc.py
+++ b/build/rust/gni_impl/run_rs_bindings_from_cc.py
-@@ -15,15 +15,6 @@ CHROMIUM_SRC_DIR = os.path.relpath(os.pa
+@@ -15,14 +15,6 @@ CHROMIUM_SRC_DIR = os.path.relpath(os.pa
sys.path.append(THIS_DIR)
- from run_bindgen import filter_clang_args
+ from filter_clang_args import filter_clang_args
-RUST_TOOLCHAIN_DIR = os.path.join(
- CHROMIUM_SRC_DIR, "third_party", "rust-toolchain"
@@ -93,11 +93,10 @@ index 105a1d52a1682..88ed50182a604 100644
-RS_BINDINGS_FROM_CC_EXE_PATH = os.path.join(
- RUST_TOOLCHAIN_DIR, "bin", "rs_bindings_from_cc"
-)
--
-
- def format_cmdline(args):
-
-@@ -40,6 +31,18 @@ def main():
+ CRUBIT_SUPPORT_PATH = os.path.join(
+ "third_party", "crubit", "src", "rs_bindings_from_cc", "support"
+ )
+@@ -43,6 +35,18 @@ def main():
parser = argparse.ArgumentParser()
(
parser.add_argument(
@@ -116,7 +115,7 @@ index 105a1d52a1682..88ed50182a604 100644
"--targets_and_args_from_gn",
metavar="FILE",
help="File parsed into --targets_and_args Crubit arg",
-@@ -111,8 +114,9 @@ def main():
+@@ -114,8 +118,9 @@ def main():
)
# All Crubit invocations in Chromium share the following cmdline args.
@@ -125,11 +124,11 @@ index 105a1d52a1682..88ed50182a604 100644
+ generator_args.append(f"--rustfmt_exe_path={args.rustfmt_path}")
+ rustfmt_config_path = os.path.join(CHROMIUM_SRC_DIR, ".rustfmt.toml")
+ generator_args.append(f"--rustfmt_config_path={rustfmt_config_path}")
- generator_args.append(
-
"--crubit_support_path=third_party/crubit/src/rs_bindings_from_cc/support"
- )
-@@ -143,7 +147,7 @@ def main():
- clang_args += ["-Wno-unused-command-line-argument"]
+ generator_args.append(f"--crubit_support_path={CRUBIT_SUPPORT_PATH}")
+
+ # Long cmdlines may not work - work around that by using Abseil's
+@@ -135,7 +140,7 @@ def main():
+ clang_args.extend(filter_clang_args(args.clang_args))
# Print a copy&pastable final cmdline when asked for debugging help.
- cmdline = [RS_BINDINGS_FROM_CC_EXE_PATH, f"--flagfile={params_file_path}"]
@@ -162,12 +161,10 @@ index 105a1d52a1682..88ed50182a604 100644
rebase_path(_rustc_env_and_flags, root_build_dir),
--- a/build/rust/rs_bindings_from_cc.gni
+++ b/build/rust/rs_bindings_from_cc.gni
-@@ -248,7 +248,15 @@ template("rs_bindings_from_cc") {
+@@ -248,10 +248,16 @@ template("rs_bindings_from_cc") {
}
-
+
script = "//build/rust/gni_impl/run_rs_bindings_from_cc.py"
-- inputs = [ "//third_party/rust-toolchain/bin/rs_bindings_from_cc" ]
-+
+ if (host_os == "win") {
+ _rs_bindings_from_cc_exe = "${rust_sysroot}/bin/rs_bindings_from_cc.exe"
+ _rustfmt_exe = "${rust_sysroot}/bin/rustfmt.exe"
@@ -175,8 +172,13 @@ index 105a1d52a1682..88ed50182a604 100644
+ _rs_bindings_from_cc_exe = "${rust_sysroot}/bin/rs_bindings_from_cc"
+ _rustfmt_exe = "${rust_sysroot}/bin/rustfmt"
+ }
-+ inputs = [ _rs_bindings_from_cc_exe ]
- sources = invoker.public_headers
++
+ inputs = [
+- # Public headers are inputs to this action rather than sources,
+- # so GN does not consider this target an owner of the headers.
+- "//third_party/rust-toolchain/bin/rs_bindings_from_cc",
++ _rs_bindings_from_cc_exe,
+ ] + invoker.public_headers
outputs = [
_rs_out_path,
@@ -268,6 +276,10 @@ template("rs_bindings_from_cc") {
diff --git a/gnu/packages/patches/ungoogled-chromium-typescript.patch
b/gnu/packages/patches/ungoogled-chromium-typescript.patch
index ac3e0b488e5..855de80813d 100644
--- a/gnu/packages/patches/ungoogled-chromium-typescript.patch
+++ b/gnu/packages/patches/ungoogled-chromium-typescript.patch
@@ -19,3 +19,229 @@
}
if (enable_cast_receiver || is_cast_android || is_castos) {
+---
a/third_party/devtools-frontend/src/scripts/build/typescript/typescript_vars.gni
++++
b/third_party/devtools-frontend/src/scripts/build/typescript/typescript_vars.gni
+@@ -6,7 +6,7 @@ import("//build/toolchain/rbe.gni")
+ import("../ninja/vars.gni")
+
+ if (host_os == "linux") {
+- tsc_binary = "//third_party/typescript/linux-amd64/src/lib/tsc"
++ tsc_binary = "/usr/bin/tsc"
+ } else if (host_os == "win") {
+ tsc_binary = "//third_party/typescript/windows-amd64/src/lib/tsc.exe"
+ } else if (host_os == "mac") {
+--- a/tools/typescript/ts_definitions.gni
++++ b/tools/typescript/ts_definitions.gni
+@@ -3,7 +3,11 @@
+ # found in the LICENSE file.
+
+ import("//third_party/node/node.gni")
+-import("//third_party/typescript/tsgo.gni")
++import("//ui/webui/webui_features.gni")
++
++if (use_typescript_go) {
++ import("//third_party/typescript/tsgo.gni")
++}
+
+ assert(is_chromeos)
+
+@@ -20,9 +24,12 @@ template("ts_definitions") {
+ ])
+
+ inputs = [
+- "//package.json",
+- "//tools/typescript/tsconfig_definitions_base.json",
+- ] + tsgo_inputs
++ "//package.json",
++ "//tools/typescript/tsconfig_definitions_base.json",
++ ]
++ if (use_typescript_go) {
++ inputs += tsgo_inputs
++ }
+ outputs = [ "$target_gen_dir/tsconfig_definitions.json" ]
+
+ root_dir = "."
+@@ -52,6 +59,10 @@ template("ts_definitions") {
+ "--js_files",
+ ] + js_files
+
++ if (use_typescript_go) {
++ args += [ "--use_typescript_go" ]
++ }
++
+ if (defined(deps)) {
+ args += [ "--deps" ]
+
+--- a/tools/typescript/ts_definitions.py
++++ b/tools/typescript/ts_definitions.py
+@@ -13,8 +13,9 @@ _CWD = os.getcwd()
+ _HERE_DIR = os.path.dirname(__file__)
+ _SRC_DIR = os.path.normpath(os.path.join(_HERE_DIR, '..', '..'))
+
+-sys.path.append(os.path.join(_SRC_DIR, 'third_party', 'typescript'))
+-import typescript
++sys.path.append(os.path.join(_SRC_DIR, 'third_party', 'node'))
++import node
++import node_modules
+
+
+ _TSCONFIG_BASE = 'tsconfig_definitions_base.json'
+@@ -40,6 +41,7 @@ def main(argv):
+ parser.add_argument('--root_dir', required=True)
+ parser.add_argument('--js_files', nargs='*', required=True)
+ parser.add_argument('--path_mappings', nargs='*')
++ parser.add_argument('--use_typescript_go', action='store_true')
+ args = parser.parse_args(argv)
+
+ with open(
+@@ -81,9 +83,22 @@ def main(argv):
+ if os.path.exists(to_delete):
+ os.remove(to_delete)
+
+- stdout = typescript.RunTypeScript(
+- ['--project', os.path.join(args.gen_dir, _TSCONFIG_GEN)]
+- )
++ stdout = None
++ if args.use_typescript_go:
++ sys.path.append(os.path.join(_SRC_DIR, 'third_party', 'typescript'))
++ import typescript
++
++ stdout = typescript.RunTypeScript(
++ ['--project', os.path.join(args.gen_dir, _TSCONFIG_GEN)]
++ )
++ else:
++ stdout = node.RunNode(
++ [
++ node_modules.PathToTypescript(),
++ '--project',
++ os.path.join(args.gen_dir, _TSCONFIG_GEN),
++ ]
++ )
+
+ # Verify that that no unexpected .d.ts files were generated.
+ lines = stdout.splitlines()
+--- a/tools/typescript/ts_library.gni
++++ b/tools/typescript/ts_library.gni
+@@ -3,7 +3,11 @@
+ # found in the LICENSE file.
+
+ import("//third_party/node/node.gni")
+-import("//third_party/typescript/tsgo.gni")
++import("//ui/webui/webui_features.gni")
++
++if (use_typescript_go) {
++ import("//third_party/typescript/tsgo.gni")
++}
+
+ template("ts_library") {
+ node(target_name) {
+@@ -21,11 +25,14 @@ template("ts_library") {
+ ])
+
+ inputs = [
+- "//package.json",
+- "//tools/typescript/path_utils.py",
+- "//tools/typescript/tsconfig_base.json",
+- "//tools/typescript/validate_tsconfig.py",
+- ] + tsgo_inputs
++ "//package.json",
++ "//tools/typescript/path_utils.py",
++ "//tools/typescript/tsconfig_base.json",
++ "//tools/typescript/validate_tsconfig.py",
++ ]
++ if (use_typescript_go) {
++ inputs += tsgo_inputs
++ }
+
+ outputs = [ "$target_gen_dir/tsconfig_$target_name.json" ]
+
+@@ -77,6 +84,10 @@ template("ts_library") {
+ target_name,
+ ]
+
++ if (use_typescript_go) {
++ args += [ "--use_typescript_go" ]
++ }
++
+ if (defined(in_files)) {
+ args += [ "--in_files" ] + in_files
+ }
+--- a/tools/typescript/ts_library.py
++++ b/tools/typescript/ts_library.py
+@@ -15,8 +15,9 @@ _CWD = os.getcwd()
+ _HERE_DIR = os.path.dirname(__file__)
+ _SRC_DIR = os.path.normpath(os.path.join(_HERE_DIR, '..', '..'))
+
+-sys.path.append(os.path.join(_SRC_DIR, 'third_party', 'typescript'))
+-import typescript
++sys.path.append(os.path.join(_SRC_DIR, 'third_party', 'node'))
++import node
++import node_modules
+
+ from path_utils import isInAshFolder, getTargetPath
+ from validate_tsconfig import (
+@@ -70,6 +71,7 @@ def main(argv):
+ )
+ parser.add_argument('--enable_source_maps', action='store_true')
+ parser.add_argument('--output_suffix', required=True)
++ parser.add_argument('--use_typescript_go', action='store_true')
+ args = parser.parse_args(argv)
+
+ root_dir = os.path.relpath(args.root_dir, args.gen_dir)
+@@ -305,9 +307,21 @@ def main(argv):
+ os.remove(to_check)
+
+ try:
+- typescript.RunTypeScript(
+- ['--project', os.path.join(args.gen_dir, tsconfig_file)]
+- )
++ if args.use_typescript_go:
++ sys.path.append(os.path.join(_SRC_DIR, 'third_party', 'typescript'))
++ import typescript
++
++ typescript.RunTypeScript(
++ ['--project', os.path.join(args.gen_dir, tsconfig_file)]
++ )
++ else:
++ node.RunNode(
++ [
++ node_modules.PathToTypescript(),
++ '--project',
++ os.path.join(args.gen_dir, tsconfig_file),
++ ]
++ )
+ finally:
+ if args.composite:
+ # `.tsbuildinfo` is generated by TypeScript for incremenetal compilation
+@@ -327,13 +341,24 @@ def main(argv):
+
+ # Invoke the TS compiler again, with the --listFilesOnly flag, to detect any
+ # files that are used by the build, but not properly declared as
dependencies.
+- out = typescript.RunTypeScript(
+- [
+- '--project',
+- os.path.join(args.gen_dir, tsconfig_file),
+- '--listFilesOnly',
+- ]
+- )
++ out = None
++ if args.use_typescript_go:
++ out = typescript.RunTypeScript(
++ [
++ '--project',
++ os.path.join(args.gen_dir, tsconfig_file),
++ '--listFilesOnly',
++ ]
++ )
++ else:
++ out = node.RunNode(
++ [
++ node_modules.PathToTypescript(),
++ '--project',
++ os.path.join(args.gen_dir, tsconfig_file),
++ '--listFilesOnly',
++ ]
++ )
+
+ files_list = out.split('\n')
+ definitions_files = list(filter(lambda f: f.endswith('.d.ts'), files_list))
