bryan-minimal · Oct 22, 2026 · Oct 20, 2026 · Oct 20, 2026 · Oct 20, 2026 · Oct 21, 2026
@@ -0,0 +1,153 @@
+#!/usr/bin/env python3
+"""Keep Chromium's distrust policy aligned with the canonical denylist.
+
+packages/ca-certificates/distrust.txt is the tree's one list of distrusted
+certificates and keys (`<cert|spki> <64 lowercase hex>  <note>`). Chromium's
+`CADistrustedCertificates` policy (packages/chromium-policies/
+ca-distrusted-certificates.json) needs whole base64 DER certificates, so it
+cannot be generated from those hashes. This check makes sure the two never
+drift: every certificate in the policy must have its SubjectPublicKeyInfo
+SHA-256 listed as an `spki` line in distrust.txt.
+
+The reverse is not required. distrust.txt also lists roots and issuers that
+the Chrome Root Store never trusted (e.g. Sectigo AAA, emSign Root TLS CA - G3),
+which the policy has no reason to repeat.
+
+Exit codes: 0 aligned (or distrust.txt not on this branch yet, which is
+reported as a warning), 1 drift or a malformed input, 2 the built-in negative
+control failed (the check itself is broken).
+
+Pure standard library: the SPKI is cut out of the DER by a minimal parser,
+so the result does not depend on the runner's openssl.
+"""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import json
+import os
+import re
+import sys
+
+POLICY = "packages/chromium-policies/ca-distrusted-certificates.json"
+DENYLIST = "packages/ca-certificates/distrust.txt"
+_LINE_RE = re.compile(r"^(cert|spki) ([0-9a-f]{64})(?:\s+(.*))?$")
+
+
+def _tlv(buf: bytes, pos: int) -> tuple[int, int, int]:
+    """Return (tag, content_start, content_end) of the DER TLV at `pos`."""
+    if pos + 2 > len(buf):
+        raise ValueError("truncated DER")
+    tag = buf[pos]
+    length = buf[pos + 1]
+    pos += 2
+    if length & 0x80:
+        n = length & 0x7F
+        if n == 0 or n > 4 or pos + n > len(buf):
+            raise ValueError("bad DER length")
+        length = int.from_bytes(buf[pos : pos + n], "big")
+        pos += n
+    if pos + length > len(buf):
+        raise ValueError("DER length past end of buffer")
+    return tag, pos, pos + length
+
+
+def spki_sha256(der: bytes) -> str:
+    """SHA-256 of the DER SubjectPublicKeyInfo of an X.509 certificate."""
+    tag, start, end = _tlv(der, 0)
+    if tag != 0x30 or end != len(der):
+        raise ValueError("not a DER certificate")
+    tag, pos, tbs_end = _tlv(der, start)  # tbsCertificate
+    if tag != 0x30:
+        raise ValueError("no tbsCertificate")
+    tag, _, nxt = _tlv(der, pos)
+    if tag == 0xA0:  # [0] EXPLICIT version
+        pos = nxt
+    # serialNumber, signature, issuer, validity, subject
+    for want in (0x02, 0x30, 0x30, 0x30, 0x30):
+        tag, _, nxt = _tlv(der, pos)
+        if tag != want:
+            raise ValueError("unexpected tbsCertificate layout")
+        pos = nxt
+    tag, _, spki_end = _tlv(der, pos)
+    if tag != 0x30 or spki_end > tbs_end:
+        raise ValueError("no subjectPublicKeyInfo")
+    return hashlib.sha256(der[pos:spki_end]).hexdigest()
+
+
+def load_denylist_spkis(path: str) -> set[str]:
+    spkis: set[str] = set()
+    with open(path, encoding="utf-8") as f:
+        for n, raw in enumerate(f, 1):
+            line = raw.strip()
+            if not line or line.startswith("#"):
+                continue
+            m = _LINE_RE.match(line)
+            if not m:
+                raise ValueError(f"{path}:{n}: malformed line: {line!r}")
+            if m.group(1) == "spki":
+                spkis.add(m.group(2))
+    return spkis
+
+
+def load_policy_spkis(path: str) -> list[str]:
+    with open(path, encoding="utf-8") as f:
+        doc = json.load(f)
+    certs = doc.get("CADistrustedCertificates") if isinstance(doc, dict) else None
+    if not isinstance(certs, list) or not certs:
+        raise ValueError(f"{path}: no CADistrustedCertificates list")
+    return [spki_sha256(base64.b64decode(c, validate=True)) for c in certs]
+
+
+def missing(policy_spkis: list[str], deny: set[str]) -> list[str]:
+    return [s for s in policy_spkis if s not in deny]
+
+
+def main() -> int:
+    root = sys.argv[1] if len(sys.argv) > 1 else "."
+    policy_path = os.path.join(root, POLICY)
+    deny_path = os.path.join(root, DENYLIST)
+
+    try:
+        policy_spkis = load_policy_spkis(policy_path)
+    except (OSError, ValueError) as e:
+        print(f"::error::{e}")
+        return 1
+    print(f"{POLICY}: {len(policy_spkis)} certificates")
+
+    if not os.path.exists(deny_path):
+        print(
+            f"::warning::{DENYLIST} is not on this branch yet (it arrives with "
+            "gominimal/pkgs#948); the policy/denylist alignment check activates "
+            "once it lands."
+        )
+        return 0
+
+    try:
+        deny = load_denylist_spkis(deny_path)
+    except (OSError, ValueError) as e:
+        print(f"::error::{e}")
+        return 1
+    print(f"{DENYLIST}: {len(deny)} spki entries")
+
+    # Negative control: drop the denylist entry for the first policy key and
+    # require the check to notice. A check that cannot fail proves nothing.
+    if not missing(policy_spkis, deny - {policy_spkis[0]}):
+        print("::error::negative control passed; the alignment check is broken")
+        return 2
+
+    gaps = missing(policy_spkis, deny)
+    if gaps:
+        for s in gaps:
+            print(
+                f"::error file={POLICY}::policy certificate with SPKI {s} has no "
+                f"`spki {s}` line in {DENYLIST}"
+            )
+        return 1
+    print(f"OK: all {len(policy_spkis)} policy keys are `spki` entries in {DENYLIST}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
@@ -0,0 +1,38 @@
+name: chromium-policy-distrust
+
+# BLOCKING. Chromium's CADistrustedCertificates policy
+# (packages/chromium-policies/ca-distrusted-certificates.json) must stay inside
+# the canonical denylist (packages/ca-certificates/distrust.txt): every
+# certificate in the policy needs its SPKI SHA-256 as an `spki` line there.
+# The policy has to carry whole certificates, so it cannot be generated from
+# the hashes; this check stops the two drifting apart. Rationale in
+# .github/scripts/chromium_policy_distrust_check.py.
+#
+# Until distrust.txt exists on main (gominimal/pkgs#948) the job warns and
+# passes; it enforces from the first PR that has both files.
+
+on:
+  workflow_dispatch: {}
+  pull_request:
+    branches: ["main"]
+    paths:
+      - "packages/chromium-policies/**"
+      - "packages/ca-certificates/distrust.txt"
+      - ".github/scripts/chromium_policy_distrust_check.py"
+      - ".github/workflows/chromium-policy-distrust.yml"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: chromium-policy-distrust-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: policy keys are listed in distrust.txt
+        run: python3 .github/scripts/chromium_policy_distrust_check.py .
@@ -1,26 +1,56 @@
 # chromium-bin
 
-Prebuilt full Chromium browser binary, used in headed mode. amd64 comes
-from Chromium's official snapshot bucket (true Chromium — Chrome for
-Testing is a branded-Chrome build whose ToS forbids redistribution);
-arm64 comes from Playwright's
-own arm64 build hosted on Microsoft's CDN (Google does not publish
-arm64 builds at all).
+Prebuilt full Chromium browser, used in headed mode (or headless via
+`--headless`). Both arches come from
+[ungoogled-chromium-portablelinux](https://github.com/ungoogled-software/ungoogled-chromium-portablelinux)
+release tarballs: a Stable-branch Chromium build with the ungoogled-chromium
+patch set, published for x86_64 and arm64 for every Stable point release.
+
+This is an **interim** source (2026-10-20). It gets the package back onto
+Chromium Stable on both arches; it is not meant to be the long-term answer
+(see gominimal/pkgmgr-rs#681 for the source-build path).
 
 Sibling package: [`chromium-headless-shell-bin`](../chromium-headless-shell-bin/)
 ships the stripped headless-shell variant used by Playwright/Puppeteer
 in default headless mode. Each pkg fetches and installs only its own
-zip, so consumers that need only one variant don't pay for both.
+artifact, so consumers that need only one variant don't pay for both.
 
 Provides:
 
 - `/bin/chromium` — full browser
-- `/usr/share/playwright-browsers/chromium-<rev>/...` — Playwright's
-  registry layout, shared with `chromium-headless-shell-bin`
+- `/usr/share/playwright-browsers/chromium-<rev>/chrome-linux64/` (amd64) or
+  `.../chrome-linux-arm64/` (arm64, plus a `chrome-linux` compat symlink) —
+  Playwright's registry layout, shared with `chromium-headless-shell-bin`.
+  The browser directory also carries the matching `chromedriver` (same
+  version as the browser; not on `PATH`).
+
+## What differs from stock Chromium
+
+ungoogled-chromium removes Google service integration. For users of this
+package that means:
+
+- **No Chrome Web Store installs.** Installing an extension from the Web
+  Store does not work. Unpacked extensions loaded with
+  `--load-extension=<dir>` do.
+- **No Safe Browsing**, **no Google sign-in / sync**, no Google API keys.
+- **No Widevine**, so no DRM (EME) media playback.
+
+Everything a test runner or automation tool uses (DevTools protocol,
+headless mode, `--dump-dom`, screenshots, chromedriver) works as in
+Chromium.
+
+## Licensing
+
+BSD-3-Clause (ungoogled-chromium) over Chromium's own BSD-3-Clause and the
 third-party licenses listed at `chrome://credits`. Redistributable, so it
+is served from the binary cache like any other package. It is built with
+proprietary codecs enabled (H.264/AAC decoders in the bundled ffmpeg), as
+other redistributed Chromium binaries are; patent licensing for those
+codecs is a separate question from copyright.
 
 ## Using with Playwright
 
-There are two routes — pick whichever matches how the project consumes
+There are two routes. Pick whichever matches how the project consumes
 Playwright.
 
 ### Route A: `PLAYWRIGHT_BROWSERS_PATH` (drop-in, revision must match)
@@ -33,13 +63,13 @@ export PLAYWRIGHT_BROWSERS_PATH=/usr/share/playwright-browsers
 npx playwright test
 ```
 
-This works for both `playwright-core` and `@playwright/test`. The two
-pkgs share the `playwright-browsers` directory and Playwright's
-registry walks it for `chromium{,_headless_shell}-<rev>/`. The
-revision shipped here (currently **1217 ↔ Chrome 147.0.7727.15 ↔
-playwright-core ^1.58.0**) must match the installed `playwright-core`
-version — there is no `*_EXECUTABLE_PATH` env override for browsers,
-so revision drift can't be papered over with env vars alone.
+The two pkgs share the `playwright-browsers` directory and Playwright's
+registry walks it for `chromium{,_headless_shell}-<rev>/`. The directory
+key shipped here is **revision 1243 (playwright-core 1.63.x)**. The browser
+inside is the current Chromium Stable, not the Chrome 153 that
+playwright-core 1.63 was rolled against. A different playwright-core
+version looks for a different `chromium-<rev>` directory, and there is no
+`*_EXECUTABLE_PATH` env override for browsers, so use Route B.
 
 ### Route B: `executablePath` (works regardless of revision)
 
@@ -58,11 +88,18 @@ const browser = await chromium.launch({
 // playwright.config.{ts,mjs} — for @playwright/test
 export default {
   use: {
-    launchOptions: { executablePath: '/bin/chromium-headless-shell' },
+    launchOptions: { executablePath: '/bin/chromium' },
   },
 };
 ```
 
+## Sandbox
+
+The tarball has no setuid `chrome-sandbox` helper (and a package could not
+install one setuid anyway). Chromium uses the user-namespace sandbox where
+the kernel allows unprivileged user namespaces; inside containers that
+don't, pass `--no-sandbox`, as before.
+
 ## Why prebuilt?
 
 Building Chromium from source requires depot_tools, a hermetic clang