Repository navigation
chromium-headless-shell-bin: source from Chrome for Testing Stable 153.0.8010.52 - #718
Merged
Merged
Conversation
…3.0.8010.52
The arm64 leg pointed at Playwright's own build, and Playwright stopped
producing those. r1243 was the last one ever — re-verified following
redirects: r1243 -> HTTP 200, r1245/1250/1260/1270 -> HTTP 400. We shipped
the final artifact by luck of timing. There was no newer revision to walk
to, so the package could not be updated on arm64 at all.
We had moved OFF Chrome for Testing on 2026-07-15 (inbox#284) because CfT
is branded Google Chrome whose ToS forbids redistribution and our cache
redistributes. That reasoning is about the `chrome` bundle and does not
hold for `chrome-headless-shell`. Verified against both CfT zips at
153.0.8010.52:
* ZERO WidevineCdm/** entries on either arch
* each ships LICENSE.headless_shell (2,352,658 B) opening with the
Chromium Project BSD-3-Clause grant, containing zero occurrences of
"not open source" / "separate license agreement with Google" /
"may not use, modify, sell"
* 287 entries per arch, arm64 binary is ELF 64-bit LSB pie ARM aarch64
So license_spdx stays BSD-3-Clause and the package stays cache-served; it
does NOT need the redistributable=false posture pkgs#684 assumed every
CfT-sourced leg would need.
Stable, not Beta. CfT Beta is 154.0.8037.0, which matches ~0 CVEs today
and a few hundred the day M154 goes stable. The security win is the
channel, not the hostname (pkgmgr-rs#646). This is also a patch bump
within the same branch: .12 -> .52.
Deletes the amd64 graft. The snapshot bucket's headless-shell.zip carries
only the binary + .paks, so build.sh grafted icudtl.dat / the v8 snapshot
/ the GL+SwiftShader libs out of chrome-linux.zip and borrowed
headless_command_resources.pak from the arm64 Playwright zip. CfT carries
all of it inline — the pak is present at an identical 3,109 B on both
arches, confirming the old comment's guess that it is arch-independent
grit data. Three Sources become one per arch and snapshot_position is
gone, which also retires the re-derivation trap of pkgmgr-rs#540.
Side effect: the updater is unstuck. pkg_action_state has read
state=failed for this package since 2026-07-15 with "multi-arch build.ncl
has 4 sha256 literals but the updater can map only 3". Those 4 literals
were only 3 distinct artifacts — the arm64 zip appeared twice, and
count_sha256_literals counts occurrences. Two literals now, confirmed
against the real regex that has_unmappable_source_sha goes False.
build.sh keeps a compat symlink for the pre-CfT arm64 layout
(chrome-linux/headless_shell) so PLAYWRIGHT_BROWSERS_PATH consumers on
playwright-core ^1.59 still resolve, and gains fail-closed guards on
icudtl.dat and headless_command_resources.pak — a silently incomplete
bundle would otherwise surface as a launch FATAL or as --dump-dom quietly
returning nothing.
Refs #684, #717
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Essentials Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour. 📝 WalkthroughWalkthroughThe package now uses Stable Chrome for Testing headless-shell archives for amd64 and arm64. The build extracts each complete archive, validates its binary and runtime resources, and adds compatibility symlinks for legacy names. ChangesChrome for Testing headless shell
Priority: ⬇️ Low Estimated code review effort: 3 (Moderate) | ~20 minutes Change: Bug fix Suggested reviewers: Merge Risk: ⚪ Minimal · up to The package migration preserves the expected browser paths and validates required runtime files, with no concrete merge-blocking issue identified. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
mitodrummer
approved these changes
Sep 18, 2026
CI failed `chromium-headless-shell-bin :: fmt` on both arches while the builds themselves succeeded. I had called this failure pre-existing and deliberately left it — verified it fails on pristine origin/main — on the theory that the repo used an older nickel than my local 1.17 CLI and that reformatting would bury the change in unrelated churn. That reasoning was backwards. `min check`'s fmt uses `nickel_lang_core::format` linked into the min binary, and the canonical output is `build_deps = [` on one line — exactly what nickel 1.17 emits and what I reverted. The file on main was simply mis-formatted; nothing was protecting the old shape. Applied via `min check --packages chromium-headless-shell-bin --fix`, which formats with the same library version the check compares against, so this cannot drift from whatever CI runs. Note for anyone doing this: `--fix` writes into the session's snapshot, not your worktree, so the file has to be read back out of the session afterwards — `git diff` looks empty otherwise and it appears to have done nothing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the headless-shell half of #684. Details in #717.
Why
The arm64 leg pointed at Playwright's own build, and Playwright stopped producing those. r1243 was the last one ever — re-verified following redirects (a bare HEAD returns 307 for every revision, real or not, which is what made this look ambiguous in #684):
We ship r1243. We landed on the final artifact by luck of timing when #678 merged on 09-14. There is no newer revisio 8000 n to walk to, so on arm64 this package could not be updated at all.
The licensing premise that turned out not to apply
We moved off CfT on 2026-07-15 (inbox#284) because CfT is branded Google Chrome, whose ToS forbids redistribution, and our cache redistributes.
That is about the
chromebundle. It does not hold forchrome-headless-shell. Verified against both CfT zips at 153.0.8010.52:WidevineCdm/**entriesLICENSE.headless_shellnot open source/separate license agreement with Google/may not use, modify, sellELF 64-bit LSB pie, ARM aarch64So
license_spdxstays BSD-3-Clause, the package stays cache-served, and it does not need theredistributable = falseposture #684 assumed every CfT-sourced leg would need.chromium-binis untouched and still faces that decision.Stable, not Beta
CfT Beta is 154.0.8037.0. It matches ~0 CVEs today and will match a few hundred the day M154 goes stable in early October — pkgmgr-rs#646's "ahead of the published feed, not audited clean" trap. The security win is the channel, not the hostname. Targeting Stable also makes this a patch bump within the same branch: 153.0.8010.12 → 153.0.8010.52.
What this deletes
The snapshot bucket's
headless-shell.zipships only the binary + its.paks, so build.sh graftedicudtl.dat, the v8 snapshot and the GL/SwiftShader libs out ofchrome-linux.zip, then borrowedheadless_command_resources.pakfrom the arm64 Playwright zip because no snapshot artifact ships it.CfT carries all of it inline. The pak is present at an identical 3,109 bytes on both arches, confirming the old comment's guess that it is arch-independent grit data. So three Sources become one per arch, and
snapshot_positionis gone — which also retires the re-derivation trap of pkgmgr-rs#540.Side effect: the updater is unstuck
pkg_action_statehas readstate=failedfor this package since 2026-07-15:Those 4 literals were only 3 distinct artifacts — the arm64 zip appeared twice (same sha at the old
build.ncl:84and:110) andcount_sha256_literalscounts occurrences. There are 2 now, and I checked against the real regex ("[0-9a-f]{64}") thathas_unmappable_source_shareturns False. Two months of manual-only updates end as a side effect.Compatibility
CfT's arm64 layout is
chrome-headless-shell-linux-arm64/chrome-headless-shell; the old Playwright arm64 build extracted tochrome-linux/headless_shell. amd64 is unaffected (same dir and binary names as before). For arm64, build.sh adds the old names as symlinks so aPLAYWRIGHT_BROWSERS_PATHconsumer pinned to playwright-core ^1.59 still resolves, while newer playwright-core — which already expects the CfT layout — uses the real directory.revisionis retained purely as the registry directory key. Importers are agent-browser and mermaid-cli.build.sh also gains fail-closed guards on
icudtl.datandheadless_command_resources.pak: an incomplete bundle would otherwise surface as a launch FATAL, or worse, as--dump-domquietly returning nothing.Verification
Built in the Linux sandbox (
min package build --rebuild --verbose), and I confirmed the sandbox was running this build.sh rather than a snapshot/cache — the documentedexit 97negative control failed withexited with code 97, and removing it built clean.min check --packages chromium-headless-shell-binpasses every check:⚠ The
fmtfailure is pre-existing and not from this PR. I verified it by checking out this package pristine atorigin/mainand running the same check — it fails there too. I deliberately did not "fix" it: the localnickelis 1.17.0 and reformats to a newer style than the repo uses, which would have buried this change under an unrelated whole-file reformat. Worth a separate look at why this one package is out of step with whatever nickel CI pins.Not covered
The CVE count may not drop as much as the dashboard implies — NVD's Chrome CPE ranges are unbounded below, so a 153.x pin matches CVEs that 153 itself fixed (the glibc false-positive shape). Worth measuring against the new pin rather than assuming.
🤖 Generated with Claude Code
Summary by CodeRabbit