Unverified Commit a701c5e8 authored by emilylange's avatar emilylange
Browse files

chromium: prevent automatic Widevine DRM download 

Previously, chromium automatically downloaded Widevine via its
component updater when encountering DRM protected content for the first
time or when manually opening chrome://components.

This commit disables that and also prevents previously downloaded
Widevine blobs (usually in ~/.config/chromium/WidevineCdm/) from being
loaded and executed.

Widevine now only works using
~~~
chromium.override { enableWideVine = true; }
~~~
making Widevine truly opt-in, as it's supposed to be.
Using that override also sets meta.license to unfree, making the
end user aware that Widevine is in fact unfree.

See issue 115275 for further details.
parent 6a77fda9

pkgs/applications/networking/browsers/chromium/common.nix

+24 −5
Original line number Diff line number Diff line
@@ -241,8 +241,26 @@ let 
      ./patches/cross-compile.patch

      # Optional patch to use SOURCE_DATE_EPOCH in compute_build_timestamp.py (should be upstreamed):

      ./patches/no-build-timestamps.patch

      # For bundling Widevine (DRM), might be replaceable via bundle_widevine_cdm=true in gnFlags:

      ./patches/widevine-79.patch

    ] ++ lib.optionals (packageName == "chromium") [

      # This patch is limited to chromium and ungoogled-chromium because electron-source sets

      # enable_widevine to false.

      #

      # The patch disables the automatic Widevine download (component) that happens at runtime

      # completely (~/.config/chromium/WidevineCdm/). This would happen if chromium encounters DRM

      # protected content or when manually opening chrome://components.

      #

      # It also prevents previously downloaded Widevine blobs in that location from being loaded and

      # used at all, while still allowing the use of our -wv wrapper. This is because those old

      # versions are out of out our control and may be vulnerable, given we literally disable their

      # auto updater.

      #

      # bundle_widevine_cdm is available as gn flag, but we cannot use it, as it expects a bunch of

      # files Widevine files at configure/compile phase that we don't have. Changing the value of the

      # BUNDLE_WIDEVINE_CDM build flag does work in the way we want though.

      # We also need enable_widevine_cdm_component to be false. Unfortunately it isn't exposed as gn

      # flag (declare_args) so we simply hardcode it to false.

      ./patches/widevine-disable-auto-download-allow-bundle.patch

    ] ++ [

      # Required to fix the build with a more recent wayland-protocols version

      # (we currently package 1.26 in Nixpkgs while Chromium bundles 1.21):

      # Source: https://bugs.chromium.org/p/angleproject/issues/detail?id=7582#c1
@@ -418,10 +436,11 @@ let 
      # Feature overrides:

      # Native Client support was deprecated in 2020 and support will end in June 2021:

      enable_nacl = false;

      # Enabling the Widevine component here doesn't affect whether we can

      # redistribute the chromium package; the Widevine component is either

      # added later in the wrapped -wv build or downloaded from Google:

    } // lib.optionalAttrs (packageName == "chromium") {

      # Enabling the Widevine here doesn't affect whether we can redistribute the chromium package.

      # Widevine in this drv is a bit more complex than just that. See Widevine patch somewhere above.

      enable_widevine = true;

    } // {

      # Provides the enable-webrtc-pipewire-capturer flag to support Wayland screen capture:

      rtc_use_pipewire = true;

      # Disable PGO because the profile data requires a newer compiler version (LLVM 14 isn't sufficient):

pkgs/applications/networking/browsers/chromium/patches/widevine-79.patch→pkgs/applications/networking/browsers/chromium/patches/widevine-disable-auto-download-allow-bundle.patch

+27 −0
Original line number Diff line number Diff line 
diff --git a/third_party/widevine/cdm/BUILD.gn b/third_party/widevine/cdm/BUILD.gn

index ed0e2f5208b..5b431a030d5 100644

index 525693b6c10ab..245491e137d39 100644

--- a/third_party/widevine/cdm/BUILD.gn

+++ b/third_party/widevine/cdm/BUILD.gn

@@ -14,7 +14,7 @@ buildflag_header("buildflags") {

@@ -22,7 +22,7 @@ buildflag_header("buildflags") {

 

   flags = [

     "ENABLE_WIDEVINE=$enable_widevine",

-    "BUNDLE_WIDEVINE_CDM=$bundle_widevine_cdm",

+    "BUNDLE_WIDEVINE_CDM=true",

     "ENABLE_WIDEVINE_CDM_COMPONENT=$enable_widevine_cdm_component",

     "ENABLE_MEDIA_FOUNDATION_WIDEVINE_CDM=$enable_media_foundation_widevine_cdm",

   ]

 }
 
diff --git a/third_party/widevine/cdm/widevine.gni b/third_party/widevine/cdm/widevine.gni

index 58f073ca562ca..4b242c2618dfb 100644

--- a/third_party/widevine/cdm/widevine.gni

+++ b/third_party/widevine/cdm/widevine.gni

@@ -41,8 +41,7 @@ enable_library_widevine_cdm =

 # Widevine CDM can be deployed as a component. Currently only supported on

 # desktop platforms. The CDM can be bundled regardless whether

 # it's a component. See below.

-enable_widevine_cdm_component =

-    enable_library_widevine_cdm && (is_win || is_mac || is_linux || is_chromeos)

+enable_widevine_cdm_component = false

 

 # Enable (Windows) Media Foundation Widevine CDM component.

 declare_args() {