Repository navigation
chromedriver-bin: ChromeDriver at chromium-headless-shell-bin's version - #990
Merged
Merged
Conversation
Split out of #848. Chrome for Testing's chromedriver, version imported from chromium-headless-shell-bin so the pair cannot drift (a browser bump fails this build on its sha256s until both move together). runtime_deps are the binaries' DT_NEEDED: gcc narrowed to libgcc, dbus on amd64 only. Notes why it is prebuilt. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
|
Warning Review limit reached
This review includes 2 billable files and costs up to $0.50.
Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing. Or wait 47 minutes for your next included review. View limit details
Comment |
norrietaylor
approved these changes
Oct 22, 2026
Member
There was a problem hiding this comment.
LGTM.
- It now takes
subsetOf gcc ["libgcc"]. dbusis amd64-only, with the DT_NEEDED rationale in a comment.- The prebuilt justification is at
:22-25.
Keeping source_provenance on the CfT repo until pkgmgr-rs#1029 is fine with me. I'm accepting the session min check evidence for the never-built-in-CI case.
Generated by Claude Code
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Split out of #848, as suggested in review. This PR is only
chromedriver-bin. It is independent of the other three parts.What. This is ChromeDriver from Chrome for Testing, so Selenium-driven browser tests (Rails system tests, Capybara + selenium-webdriver) can run against packaged binaries. Without it, Selenium Manager downloads an unpinned Chrome and driver at test time.
Version. The version is not written in this file. It is
chromium-headless-shell-bin.attrs.upstream_version, so the pair can't drift. ChromeDriver refuses a browser of a different major version. A browser bump changes the URLs here, and this build then fails on the two sha256s until they are updated in the same change, which is intended.matches_browserchecks the driver binary, the browser binary and the declared version against each other.Review points from #848
llvm-readelf -dfrom both 155.0.8059.84 zips (their sha256s match the pins).libgcc_s, glib, nspr, nss/nssutil and libxcb.libdbus-1.gccis nowsubsetOf gcc ["libgcc"], anddbusis added on amd64 only, via@ match { … } targetas boost does.mip dumpshowsdbusin amd64's runtime_deps and not in arm64's. No libstdc++ is needed.chromium-headless-shell-bin, andbinary_fromnames both zips.LICENSE.chromedriveris the plain Chromium BSD-3-Clause grant. That's the same footing as headless-shell, not the brandedchromebundle.source_provenance: kept for now, and here is why. You're right thatGoogleChromeLabs/chrome-for-testingisn't the code's upstream. But dropping provenance leaves the package with no advisory query, and the morningcoverage-healthgate flags any newly dark package. That happened with ca-certificates this week.google:chrome), which chromium-bin and chromium-headless-shell-bin already share through supply-chain's CPE remap.Verification. A fresh remote session (
pkgbuildloadout) ranmin package build --rebuild chromedriver-binthenmin check --packages chromedriver-bin. Every check is Pass, with no Skip, including missing runtime_deps (with gcc narrowed and dbus amd64-only) and both standalone tests (smoketest,matches_browser).nickel format --check,bash -nandmip dump(amd64 and arm64) are clean.🤖 Generated with Claude Code