also looking at this
fix(chrome): ship NSS's runtime providers and gate on a real render
#246
3 files
+114
-2
| @@ -1,5 +1,15 @@ | ||
| 1 | 1 | import type { Recipe } from '../../../scripts/recipe-types' |
| 2 | 2 | |
| 3 | /** NSS modules loaded with dlopen at runtime, so no dependency walk finds them. */ | |
| 4 | export const NSS_RUNTIME_PROVIDERS: readonly string[] = [ | |
| 5 | 'libsoftokn3.so', | |
| 6 | 'libsoftokn3.chk', | |
| 7 | 'libfreebl3.so', | |
| 8 | 'libfreeblpriv3.so', | |
| 9 | 'libfreeblpriv3.chk', | |
| 10 | 'libnssckbi.so', | |
| 11 | ] | |
| 12 | ||
| 3 | 13 | export const recipe: Recipe = { |
| 4 | 14 | domain: 'google.com/chrome', |
| 5 | 15 | name: 'chrome-for-testing', |
| @@ -49,8 +59,13 @@ export const recipe: Recipe = { | ||
| 49 | 59 | 'mkdir -p /lib /bin', |
| 50 | 60 | 'cp -a chrome-linux64 /lib/chrome-for-testing', |
| 51 | 61 | 'ln -s ../lib/chrome-for-testing/chrome /bin/google-chrome-stable', |
| 52 | // NSS opens these providers dynamically, outside the ELF DT_NEEDED graph. | |
| 53 | 'cp /lib/libsoftokn3.so /lib/libfreebl3.so /lib/', | |
| 62 | // NSS opens these providers dynamically, outside the ELF DT_NEEDED graph, | |
| 63 | // from the directory of the libnss3 Chrome loads ($ORIGIN/.. here): | |
| 64 | // softokn loads libfreeblpriv3 (freebl3 is only its stub), and the | |
| 65 | // built-in root module is libnssckbi. Without libfreeblpriv3 the browser | |
| 66 | // aborts at startup with nss_error=-8023, which --version never reaches. | |
| 67 | // The .chk files are their FIPS integrity signatures. | |
| 68 | `cp ${NSS_RUNTIME_PROVIDERS.map(file => `{{deps.mozilla.org/nss.prefix}}/lib/${file}`).join(' ')} /lib/`, | |
| 54 | 69 | ], |
| 55 | 70 | }, |
| 56 | 71 | test: { |