[Pkg-chromium-maint] Bug#786909: chromium: unconditionally downloads binary blob

[Steven Chamberlain]

Michael Gilbert wrote:
> Yes, nacl is intentionally disabled in the Debian packages, [...]
> [...]
> No, it does not work.  Obviously nacl applications cannot execute
> without a nacl interpreter.

Thanks!  That's quite reassuring for Debian users at least.

Christoph Anton Mitterer wrote:
> I don't think it really matters what upstream claims here,

Right, we shouldn't just take their word for it.

From what I can tell, the file download was configured by way of a
module ID listed as an "import" here:
https://sources.debian.net/src/chromium-browser/43.0.2357.124-1/chrome/browser/resources/hotword/manifest.json/#L82
(and didn't exist before Chromium 43, JFTR).

(I don't yet understand how the upstream commit stopped the module being
downloaded, but rather appears to stop it from being invoked?)
https://codereview.chromium.org/1160243004/diff/120001/chrome/browser/search/hotword_service.cc

I scanned through the other manifest.json and found one other
occurrence which is:
https://sources.debian.net/src/chromium-browser/43.0.2357.124-1/ui/file_manager/video_player/manifest.json/?hl=60#L60

Could someone please check if that plugin is enabled?  (Seems
Mike just committed to packaging Git a way to make hidden extensions
visible now).

There is some scary code in
https://sources.debian.net/src/chromium-browser/43.0.2357.124-1/chrome/browser/chromeos/extensions/file_manager/private_api_misc.cc
relating to "https://www.googleapis.com/auth/chromewebstore" and
talking about "silent installation".  It relates to Cast API and
hopefully is unused in Debian builds (I don't see this file in the
Debian package build logs).

Regards,
-- 
Steven Chamberlain
steven at pyro.eu.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 493 bytes
Desc: Digital signature
URL: <http://lists.alioth.debian.org/pipermail/pkg-chromium-maint/attachments/20150619/0837ed7c/attachment-0001.sig>