Repository navigation
chromium-bin, chromium-headless-shell-bin: provenance names the real origin (pm#1029) - #1300
Conversation
…origin Both declared GithubRepo microsoft/playwright, a stand-in kept only because supply-chain mapped google:chrome to that purl. chromium-bin now names ungoogled-software/ungoogled-chromium-portablelinux (the tarballs it ships, pkgs#960) and chromium-headless-shell-bin names GoogleChromeLabs/chrome-for-testing (the zips it ships, the same home as chromedriver-bin). Chrome's CVEs now come from a package-keyed google:chrome identity in supply-chain (gominimal/minimal-supply-chain#587), which takes precedence over GithubRepo provenance, so this rename must land AFTER that is deployed. Version checks and updates go through pkgmgr's chromium resolver by package name and don't read provenance. Refs gominimal/pkgmgr-rs#1029. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Warning Review limit reached
This review includes 2 billable files and costs up to $0.50.
Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing. Or wait 52 minutes for your next included review. View limit details
|
There was a problem hiding this comment.
Scope matches the title. The diff changes source_provenance and its comment in two packages, and nothing else. Clobber none: git log on both files shows only version bumps and the #960 source move, and this diff reverts none of them. Correctness both new repos match the bytes. release_url in chromium-bin fetches from ungoogled-software/ungoogled-chromium-portablelinux. chromium-headless-shell-bin fetches Chrome for Testing zips and now names the same repo as chromedriver-bin. No Nickel file reads .source_provenance. .github/scripts/version_age_report.py is the only script that reads it. That script is report-only, and the bare version is not expected to match a tag in the old or the new repo, so it falls through to the source URL date as before. The tag lookup was not run. Two low findings concern comments and a README. Not checked: the state of minimal-supply-chain#587 and pkgmgr-rs#1202, because the gh call was denied. Confirm that both are merged and the runner is redeployed before this PR merges. If this PR merges first, both packages lose the Chrome CVEs without an error. The claims about package_cpe_identity.toml and the chromium resolver are also unverified, because that code is not in this repository. No build or scan ran.
| # that identity takes precedence over this provenance. It is keyed by | ||
| # name because chromedriver-bin shares this repo and is not the | ||
| # browser. Renaming the package without moving that entry makes it scan | ||
| # 0/0/0. pkgmgr's chromium resolver checks and updates it by name. |
There was a problem hiding this comment.
low · The new comment says this package comes from Chrome for Testing, but packages/chromium-headless-shell-bin/README.md lines 5-8 say the opposite. The README says amd64 comes from the snapshot bucket, arm64 comes from Playwright on Microsoft's CDN, and Chrome for Testing is forbidden by its ToS. Line 35 also names revision 1217 and Chrome 147. This PR removes the Playwright label because the package no longer ships a Playwright build, so the README is the last place that still claims it. Update the README in this PR. The issue is local: packages/chromium-bin/README.md already names the correct source.
| # as-is. Renaming the package without moving that identity entry makes | ||
| # it scan 0/0/0, a silent false negative. Version checks and updates | ||
| # don't read this field either: pkgmgr's chromium resolver handles this | ||
| # package by name. |
There was a problem hiding this comment.
low · The comment replaces a warning about a silent failure, but it records only one of the two name-keyed dependencies. The PR body says that this new provenance needs pkgmgr-rs#1202, which routes chromium names to shipped history. Without that routing, the lifecycle window moves to ungoogled <v>-N releases, and these compare as pre-releases of <v>. A person who renames the package is told about the 0/0/0 scan only. Add one sentence that names the lifecycle window routing. This hazard is specific to chromium-bin, because chromium-headless-shell-bin has no -N tags. The pkgmgr-rs code was not read, so this rests on the PR body.
DRAFT: do not merge until gominimal/minimal-supply-chain#587 AND gominimal/pkgmgr-rs#1202 are merged and the runner is redeployed. Merging this first makes both packages lose Chrome's CPE-path CVEs (a silent 0/0/0). It also switches chromium-bin's lifecycle window to ungoogled's
<v>-Nreleases.Refs gominimal/pkgmgr-rs#1029.
Change
Both packages declared
source_provenance = microsoft/playwright. That was a stand-in kept only because supply-chain'scpe_remapmappedgoogle:chrometo the playwright purl. Neither package ships a Playwright build any more, and the playwright label shows up in Slack and on the site.The "LOAD-BEARING" comment on chromium-bin is rewritten, and headless-shell gets the matching comment. Chrome's CVEs now come from a package-keyed
google:chromeidentity in supply-chain'spackage_cpe_identity.toml(sc#587). That identity takes precedence over GithubRepo provenance in the scan's CPE path and in the lifecycle producer, so this rename no longer changes which CVEs the packages see. It is keyed by name and not by purl because chromedriver-bin also uses the chrome-for-testing purl, and it is not the browser.Expected before/after
These are expectations from reading the code, not a measured scan diff. No
pkgmgr vulnsdry-run was run. Please check the nightly after this merges.google:chrome, before this PR lands. After this PR, only the OSV-GIT/GHSA supplement re-keys, from microsoft/playwright to the new repos. That supplement contributed Playwright's own advisories, such as CVE-2025-9611, which is already overridden as not-chromium. The new repos are expected to hold none, so the change can only remove misattributed Playwright advisories, never Chrome ones.pkg_name, so the rename updatesowner/repoon the existing row and doesn't create a new one. Counts are rewritten from the scan as usual. They stay non-zero because the identity path doesn't depend on provenance, so theopen_findings_total = 0deletion gates (sc lifecycle retract step 1b, pmorphaned_backfill_keys) are not triggered. If counts did drop to 0 for either package after this merges, that would be the deletion-gate hazard. Revert first, then investigate.<v>-Nreleases, which compare as pre-releases of<v>.pkgmgr check/update/auto-fix route chromium by package name to the chromium resolver, which reads each build.ncl's own source URLs and never reads provenance.Follow-ups after merge
trackfixtures verbatim (testdata/chromium/chromium-bin-ungoogled.build.ncl,testdata/redistributable/chromium-headless-shell-bin.build.ncl).google:chrome -> github.com/microsoft/playwrightremap and its pinning test once nothing names playwright.🤖 Generated with Claude Code