gnu: ungoogled-chromium: Update to 86.0.4240.183-0.b68e17f [security fixes].
[jackhill/guix/guix.git] / gnu / packages / chromium.scm
index ecded29..6db791a 100644 (file)
@@ -37,7 +37,6 @@
   #:use-module (gnu packages curl)
   #:use-module (gnu packages fontutils)
   #:use-module (gnu packages freedesktop)
-  #:use-module (gnu packages gcc)
   #:use-module (gnu packages ghostscript)
   #:use-module (gnu packages gl)
   #:use-module (gnu packages glib)
   #:use-module (gnu packages libevent)
   #:use-module (gnu packages libffi)
   #:use-module (gnu packages linux)
+  #:use-module (gnu packages llvm)
   #:use-module (gnu packages kerberos)
   #:use-module (gnu packages ninja)
   #:use-module (gnu packages node)
   #:use-module (gnu packages nss)
   #:use-module (gnu packages pciutils)
   #:use-module (gnu packages pkg-config)
+  #:use-module (gnu packages protobuf)
   #:use-module (gnu packages pulseaudio)
   #:use-module (gnu packages python)
   #:use-module (gnu packages python-web)
@@ -69,7 +70,9 @@
   #:use-module (gnu packages xiph)
   #:use-module (gnu packages xml)
   #:use-module (gnu packages xdisorg)
-  #:use-module (gnu packages xorg))
+  #:use-module (gnu packages xorg)
+  #:use-module (ice-9 match)
+  #:use-module (srfi srfi-1))
 
 (define %preserved-third-party-files
   '("base/third_party/cityhash" ;Expat
@@ -80,6 +83,9 @@
     "base/third_party/symbolize" ;BSD-3
     "base/third_party/xdg_mime" ;LGPL2.0+ or Academic 2.0
     "base/third_party/xdg_user_dirs" ;Expat
+    ;; XXX: Chromium requires a newer C++ standard library.  Remove this when
+    ;; the default GCC is 9 or later.
+    "buildtools/third_party/libc++" ;ASL2.0, with LLVM exceptions
     "chrome/third_party/mozilla_security_manager" ;MPL-1.1/GPL2+/LGPL2.1+
     "courgette/third_party/bsdiff" ;BSD-2, BSD protection license
     "courgette/third_party/divsufsort" ;Expat
     "third_party/angle/src/third_party/compiler" ;BSD-2
     "third_party/angle/src/third_party/libXNVCtrl" ;Expat
     "third_party/angle/src/third_party/trace_event" ;BSD-3
+    "third_party/angle/src/third_party/volk" ;Expat
     "third_party/angle/third_party/vulkan-headers" ;ASL2.0
     "third_party/angle/third_party/vulkan-loader" ;ASL2.0
     "third_party/angle/third_party/vulkan-tools" ;ASL2.0
     "third_party/blink" ;BSD-3, LGPL2+
     "third_party/boringssl" ;OpenSSL/ISC (Google additions are ISC)
     "third_party/boringssl/src/third_party/fiat" ;Expat
-    "third_party/boringssl/src/third_party/sike" ;Expat
-    ;; XXX: these files are generated by fp-$arch.pl in the above directory.
-    "third_party/boringssl/linux-aarch64/crypto/third_party/sike/asm/fp-armv8.S"
-    "third_party/boringssl/linux-x86_64/crypto/third_party/sike/asm/fp-x86_64.S"
     "third_party/breakpad" ;BSD-3
     "third_party/brotli" ;Expat
-    "third_party/cacheinvalidation" ;ASL2.0
     "third_party/catapult" ;BSD-3
     "third_party/catapult/common/py_vulcanize/third_party/rcssmin" ;ASL2.0
     "third_party/catapult/common/py_vulcanize/third_party/rjsmin" ;ASL2.0
     "third_party/catapult/third_party/polymer" ;BSD-3
+    ;; XXX: This is a minified version of <https://d3js.org/>.
     "third_party/catapult/tracing/third_party/d3" ;BSD-3
     "third_party/catapult/tracing/third_party/gl-matrix" ;Expat
+    "third_party/catapult/tracing/third_party/jpeg-js" ;ASL2.0
+    ;; XXX: Minified version of <https://github.com/Stuk/jszip>.
     "third_party/catapult/tracing/third_party/jszip" ;Expat or GPL3
     "third_party/catapult/tracing/third_party/mannwhitneyu" ;Expat
     "third_party/catapult/tracing/third_party/oboe" ;BSD-2
+    ;; XXX: Minified version of <https://github.com/nodeca/pako>.
     "third_party/catapult/tracing/third_party/pako" ;Expat
     "third_party/ced" ;BSD-3
     "third_party/cld_3" ;ASL2.0
     "third_party/dav1d" ;BSD-2
     "third_party/dawn" ;ASL2.0
     "third_party/depot_tools/owners.py" ;BSD-3
+    "third_party/devtools-frontend" ;BSD-3
+    "third_party/devtools-frontend/src/front_end/third_party/acorn" ;Expat
+    "third_party/devtools-frontend/src/front_end/third_party/chromium" ;BSD-3
+    "third_party/devtools-frontend/src/front_end/third_party/codemirror" ;Expat
+    "third_party/devtools-frontend/src/front_end/third_party/fabricjs" ;Expat
+    "third_party/devtools-frontend/src/front_end/third_party/i18n" ;ASL2.0
+    "third_party/devtools-frontend/src/front_end/third_party/intl-messageformat" ;BSD-3
+    "third_party/devtools-frontend/src/front_end/third_party/lighthouse" ;ASL2.0
+    "third_party/devtools-frontend/src/front_end/third_party/lit-html" ;BSD-3
+    "third_party/devtools-frontend/src/front_end/third_party/lodash-isequal" ;Expat
+    "third_party/devtools-frontend/src/front_end/third_party/marked" ;Expat, BSD-3
+    "third_party/devtools-frontend/src/front_end/third_party/wasmparser" ;ASL2.0
+    "third_party/devtools-frontend/src/third_party/axe-core" ;MPL2.0
+    "third_party/devtools-frontend/src/third_party/pyjson5" ;ASL2.0
+    "third_party/devtools-frontend/src/third_party/typescript" ;ASL2.0
     "third_party/dom_distiller_js" ;BSD-3
     "third_party/emoji-segmenter" ;ASL2.0
     "third_party/flatbuffers" ;ASL2.0
     "third_party/google_input_tools/third_party/closure_library" ;ASL2.0
     "third_party/google_input_tools/third_party/closure_library/third_party/closure" ;Expat
     "third_party/googletest" ;BSD-3
+    "third_party/harfbuzz-ng" ;Expat
     "third_party/hunspell" ;MPL1.1/GPL2+/LGPL2.1+
     "third_party/iccjpeg" ;IJG
     "third_party/inspector_protocol" ;BSD-3
     "third_party/jinja2" ;BSD-3
+    ;; XXX: Unbundle this when switching back to libstdc++.
+    "third_party/jsoncpp" ;Public Domain or Expat
     "third_party/jstemplate" ;ASL2.0
     "third_party/khronos" ;Expat, SGI
     "third_party/leveldatabase" ;BSD-3
+    "third_party/libavif" ;BSD-2
     "third_party/libXNVCtrl" ;Expat
     "third_party/libaddressinput" ;ASL2.0
     "third_party/libaom" ;BSD-2 or "Alliance for Open Media Patent License 1.0"
     "third_party/libaom/source/libaom/third_party/vector" ;Expat
     "third_party/libaom/source/libaom/third_party/x86inc" ;ISC
+    "third_party/libgifcodec" ;MPL1.1/GPL2+/LGPL2.1+, BSD-3, BSD-2
     "third_party/libjingle_xmpp" ;BSD-3
     "third_party/libphonenumber" ;ASL2.0
     "third_party/libsecret" ;LGPL2.1+
     "third_party/libsrtp" ;BSD-3
     "third_party/libsync" ;ASL2.0
     "third_party/libudev" ;LGPL2.1+
+
+    ;; FIXME: build/linux/unbundle/libvpx.gn does not work for all users.
+    "third_party/libvpx" ;BSD-3
+    "third_party/libvpx/source/libvpx/third_party/x86inc" ;Expat
+
     "third_party/libwebm" ;BSD-3
     "third_party/libxml/chromium" ;BSD-3
     "third_party/libyuv" ;BSD-3
+    "third_party/lottie" ;Expat
     "third_party/lss" ;BSD-3
+    "third_party/mako" ;Expat
     "third_party/markupsafe" ;BSD-3
     "third_party/mesa_headers" ;Expat, SGI
     "third_party/metrics_proto" ;BSD-3
     "third_party/modp_b64" ;BSD-3
     "third_party/nasm" ;BSD-2
+    "third_party/nearby" ;ASL2.0
     "third_party/node" ;Expat
     "third_party/node/node_modules/polymer-bundler/lib/third_party/UglifyJS2" ;BSD-2
     "third_party/one_euro_filter" ;BSD-3
     "third_party/openscreen" ;BSD-3
     "third_party/openscreen/src/third_party/tinycbor" ;Expat
+    "third_party/openscreen/src/third_party/mozilla" ;MPL1.1/GPL2+/LGPL2.1+, BSD-3
     "third_party/ots" ;BSD-3
     "third_party/pdfium" ;BSD-3
     "third_party/pdfium/third_party/agg23" ;Expat
     "third_party/pdfium/third_party/bigint" ;Public domain, BSD-3
     "third_party/pdfium/third_party/skia_shared" ;BSD-3
     "third_party/pdfium/third_party/freetype/include/pstables.h" ;FreeType
+    "third_party/perfetto" ;ASL2.0
     "third_party/pffft" ;the "FFTPACK" license, similar to BSD-3
     "third_party/ply" ;BSD-3
     "third_party/polymer" ;BSD-3
     "third_party/protobuf/third_party/six" ;Expat
     "third_party/pyjson5" ;ASL2.0
     "third_party/qcms" ;Expat
+    ;; XXX: System re2 cannot be used when Chromium uses libc++ because the re2
+    ;; ABI relies on libstdc++ internals.  See build/linux/unbundle/re2.gn.
+    "third_party/re2" ;BSD-3
     "third_party/rnnoise" ;BSD-3
     "third_party/s2cellid" ;ASL2.0
-    "third_party/sfntly" ;ASL2.0
+    "third_party/schema_org" ;CC-BY-SA3.0
+    "third_party/securemessage" ;ASL2.0
     "third_party/skia" ;BSD-3
     "third_party/skia/include/third_party/skcms" ;BSD-3
-    "third_party/skia/third_party/gif" ;MPL1.1/GPL2+/LGPL2.1+
     "third_party/skia/third_party/skcms" ;BSD-3
     "third_party/skia/third_party/vulkanmemoryallocator" ;BSD-3, Expat
     "third_party/smhasher" ;Expat, public domain
     "third_party/spirv-headers" ;ASL2.0
     "third_party/SPIRV-Tools" ;ASL2.0
     "third_party/sqlite" ;Public domain
-    "third_party/ungoogled" ;BSD-3
+    "third_party/swiftshader" ;ASL2.0
+    "third_party/swiftshader/third_party/astc-encoder" ;ASL2.0
+    "third_party/swiftshader/third_party/llvm-10.0" ;ASL2.0, with LLVM exception
+    "third_party/swiftshader/third_party/llvm-subzero" ;NCSA
+    "third_party/swiftshader/third_party/marl" ;ASL2.0
+    "third_party/swiftshader/third_party/subzero" ;NCSA
+    "third_party/swiftshader/third_party/SPIRV-Headers" ;X11-style
+    "third_party/tcmalloc/chromium" ;BSD-3
+    "third_party/ukey2" ;ASL2.0
     "third_party/usb_ids" ;BSD-3
     "third_party/usrsctp" ;BSD-2
+    "third_party/vulkan_memory_allocator" ;Expat
     "third_party/wayland/wayland_scanner_wrapper.py" ;BSD-3
     "third_party/wayland-protocols" ;Expat
     "third_party/web-animations-js" ;ASL2.0
     "third_party/webdriver" ;ASL2.0
     "third_party/webrtc" ;BSD-3
-    "third_party/webrtc/common_audio/third_party/fft4g" ;Non-copyleft
+    "third_party/webrtc/common_audio/third_party/ooura" ;Non-copyleft
     "third_party/webrtc/common_audio/third_party/spl_sqrt_floor" ;Public domain
     "third_party/webrtc/modules/third_party/fft" ;Non-copyleft
     "third_party/webrtc/modules/third_party/g711" ;Public domain
     "third_party/widevine/cdm/widevine_cdm_version.h" ;BSD-3
     "third_party/widevine/cdm/widevine_cdm_common.h" ;BSD-3
     "third_party/woff2" ;ASL2.0
+    "third_party/xcbproto" ;X11
     "third_party/xdg-utils" ;Expat
-    "third_party/yasm/run_yasm.py" ;BSD-2 or BSD-3
     "third_party/zlib/google" ;BSD-3
+    "third_party/zxcvbn-cpp" ;Expat
     "url/third_party/mozilla" ;BSD-3, MPL1.1/GPL2+/LGPL2.1+
     "v8/src/third_party/siphash" ;Public domain
     "v8/src/third_party/utf8-decoder" ;Expat
     "v8/third_party/inspector_protocol" ;BSD-3
     "v8/third_party/v8/builtins")) ;PSFL
 
-(define* (computed-origin-method gexp-promise hash-algo hash
-                                 #:optional (name "source")
-                                 #:key (system (%current-system))
-                                 (guile (default-guile)))
-  "Return a derivation that executes the G-expression that results
-from forcing GEXP-PROMISE."
-  (mlet %store-monad ((guile (package->derivation guile system)))
-    (gexp->derivation (or name "computed-origin")
-                      (force gexp-promise)
-                      #:graft? #f       ;nothing to graft
-                      #:system system
-                      #:guile-for-build guile)))
-
-(define %chromium-version "79.0.3945.130")
-(define %ungoogled-revision "e2fae994d786b6716fb473a47b0c880bcfdc2497")
-(define %debian-revision "debian/79.0.3945.130-2")
-(define package-revision "0")
-(define %package-version (string-append %chromium-version "-"
-                                        package-revision "."
-                                        (string-take %ungoogled-revision 7)))
-
-(define %chromium-origin
+(define %blacklisted-files
+  ;; 'third_party/blink/perf_tests/resources/svg/HarveyRayner.svg' carries a
+  ;; nonfree license according to LICENSES in the same directory.  As we don't
+  ;; run the Blink performance tests, just remove everything to save ~70MiB.
+  '("third_party/blink/perf_tests"))
+
+(define (debian-patch name revision hash)
   (origin
     (method url-fetch)
-    (uri (string-append "https://commondatastorage.googleapis.com"
-                        "/chromium-browser-official/chromium-"
-                        %chromium-version ".tar.xz"))
-    (sha256
-     (base32
-      "183vz3lf1588cr9s5vlnj65qvbmz36s8cg8k7dvr64cxmcqk86an"))))
+    (uri (string-append "https://salsa.debian.org/chromium-team/chromium/-/raw/"
+                        revision "/debian/patches/" name))
+    (file-name (match (string-split name #\/)
+                 ((category name)
+                  (string-append "ungoogled-chromium-" category "-" name))))
+    (sha256 (base32 hash))))
+
+(define (arch-patch name revision hash)
+  (origin
+    (method url-fetch)
+    (uri (string-append "https://raw.githubusercontent.com/archlinux"
+                        "/svntogit-packages/" revision "/trunk/" name))
+    (sha256 (base32 hash))))
+
+(define %chromium-version "86.0.4240.183")
+(define %ungoogled-revision "b68e17f32e9eff56615a07b44e457835bb9460c6")
+(define %debian-revision "debian/84.0.4147.105-1")
+(define %arch-revision "2cbe439471932d30ff2c8ded6b3dfd51b312bbc9")
+
+(define %debian-patches
+  (list (debian-patch "system/zlib.patch" %debian-revision
+                      "09vqgs37w9ycc7par14wa7rnvmg9bm0z9pqg6fyl3iqvpghyjyr4")
+        (debian-patch "system/openjpeg.patch" %debian-revision
+                      "0zd6v5njx1pc7i0y6mslxvpx5j4cq01mmyx55qcqx8qzkm0gm48j")))
+
+(define %arch-patches
+  (list (arch-patch "check-for-enable-accelerated-video-decode-on-Linux.patch"
+                    %arch-revision
+                    "12qj23dcp2g2ivyfyj13m4fzf68nllb9djwcxf1h195gn8wkml03")
+        (arch-patch "only-fall-back-to-the-i965-driver-if-we-re-on-iHD.patch"
+                    %arch-revision
+                    "0073qjp0dp9kj2ix2j6cxrima01rpdpkcjj9crxlb9b43b4cc53m")
+        (arch-patch "fix-invalid-end-iterator-usage-in-CookieMonster.patch"
+                    %arch-revision
+                    "1p1wy3dfncw0hhz77a1km0xjhix69ksgbpa569qz86nv76jbgn39")))
 
 (define %ungoogled-origin
   (origin
@@ -269,146 +332,74 @@ from forcing GEXP-PROMISE."
                               (string-take %ungoogled-revision 7)))
     (sha256
      (base32
-      "15vmc07iba1zmzn4j7c5n2hyvyxzwwf9hc3kyym0m4jajlsyxr5f"))))
+      "0visyhz321ykrmbjndvx31yd8xlmha9gas0xbkavc2i45rpfahjq"))))
 
-(define %debian-origin
-  (origin
-    (method git-fetch)
-    (uri (git-reference
-          (url "https://salsa.debian.org/chromium-team/chromium.git")
-          (commit %debian-revision)))
-    (file-name (git-file-name "debian-chromium-packaging"
-                              (if (string-prefix? "debian/" %debian-revision)
-                                  (cadr (string-split %debian-revision #\/))
-                                  (string-take %debian-revision 7))))
-    (sha256
-     (base32
-      "1rbzxcwfp7v0c6rkvn9jl9by7p363cnbdyqazwiak1z03kmw3nkz"))))
+(define %guix-patches
+  (list (local-file (search-patch "ungoogled-chromium-system-nspr.patch"))
+        (local-file (search-patch "ungoogled-chromium-extension-search-path.patch"))))
 
-;; This is a "computed" origin that does the following:
-;; *) Runs the Ungoogled scripts on a pristine Chromium tarball.
-;; *) Applies Debians Chromium patches, for their unbundling and GCC work.
+;; This is a source 'snippet' that does the following:
+;; *) Applies various patches for unbundling purposes and libstdc++ compatibility.
+;; *) Runs the ungoogled patch-, domain substitution-, and scrubbing scripts.
 ;; *) Prunes all third_party directories that are not explicitly preserved.
 ;; *) Adjusts "GN" build files such that system libraries are preferred.
-(define ungoogled-chromium-source
-  (let ((chromium-source %chromium-origin)
-        (ungoogled-source %ungoogled-origin)
-        (debian-source %debian-origin))
-    (origin
-      (method computed-origin-method)
-      (file-name (string-append "ungoogled-chromium-" %package-version ".tar.xz"))
-      (sha256 #f)
-      (uri
-       (delay
-         (with-imported-modules '((guix build utils))
-           #~(begin
-               (use-modules (guix build utils)
-                            (ice-9 rdelim)
-                            (srfi srfi-1)
-                            (srfi srfi-26))
-               (let ((chromium-dir    (string-append "chromium-" #$%chromium-version))
-                     (preserved-files (list #$@%preserved-third-party-files)))
-
-                 (set-path-environment-variable
-                  "PATH" '("bin")
-                  (list #+(canonical-package patch)
-                        #+(canonical-package xz)
-                        #+(canonical-package tar)
-                        #+python-2
-                        #+python))
-
-                 (copy-recursively #+ungoogled-source "/tmp/ungoogled")
-
-                 (with-directory-excursion "/tmp/ungoogled"
-
-                   (format #t "Unpacking chromium tarball...~%")
-                   (force-output)
-                   (invoke "tar" "xf" #+chromium-source)
-
-                   ;; Ungoogled-Chromium contains a forked subset of the Debian
-                   ;; patches.  Disable those, as we apply newer versions later.
-                   (substitute* "patches/series"
-                     ((".*/debian/.*")
-                      ""))
-
-                   (format #t "Ungooglifying...~%")
-                   (force-output)
-                   (invoke "python3" "utils/prune_binaries.py" chromium-dir
-                           "pruning.list")
-                   (invoke "python3" "utils/patches.py" "apply"
-                           chromium-dir "patches")
-                   (invoke "python3" "utils/domain_substitution.py" "apply" "-r"
-                           "domain_regex.list" "-f" "domain_substitution.list"
-                           "-c" "/tmp/domainscache.tar.gz" chromium-dir)
-
-                   (with-directory-excursion chromium-dir
-
-                     (format #t "applying Debian patches...~%")
-                     (force-output)
-                     (let* ((debian  #+debian-source)
-                            (patches (string-append debian "/debian/patches"))
-                            (series  (string-append patches "/series")))
-                       (with-input-from-file series
-                         (lambda ()
-                           (let loop ((line (read-line)))
-                             (unless (eof-object? line)
-                               (when (and (> (string-length line) 1)
-                                          (not (string-prefix? "#" line))
-                                          ;; Skip the Debian-specific ones.
-                                          (not (string-prefix? "debianization/" line))
-                                          (not (string-prefix? "buster/" line))
-                                          (not (any (cute string-suffix? <> line)
-                                                    ;; These conflict with Ungoogled.
-                                                    '("widevine-buildflag.patch"
-                                                      "signin.patch"
-                                                      "third-party-cookies.patch"
-
-                                                      ;; Disable workarounds for the
-                                                      ;; Chromium "-lite" tarball.  We
-                                                      ;; use the "full" version and don't
-                                                      ;; need these patches.
-                                                      "closure.patch"
-                                                      "owners.patch"
-
-                                                      ;; XXX: 'fixes/inspector.patch'
-                                                      ;; makes v8 reuse the top-level
-                                                      ;; third_party/inspector_protocol
-                                                      ;; instead of its own bundled copy,
-                                                      ;; but that does not work here for
-                                                      ;; some reason.  Ignore that patch
-                                                      ;; and those that depend on it.
-                                                      "inspector.patch"))))
-                                 (invoke "patch" "--force" "-p1" "--input"
-                                         (string-append patches "/" line)
-                                         "--no-backup-if-mismatch"))
-                               (loop (read-line)))))))
-
-                     (format #t "Pruning third party files...~%")
-                     (force-output)
-                     (apply invoke "python"
-                            "build/linux/unbundle/remove_bundled_libraries.py"
-                            "--do-remove" preserved-files)
-
-                     (format #t "Replacing GN files...~%")
-                     (force-output)
-                     (invoke "python3" "build/linux/unbundle/replace_gn_files.py"
-                             "--system-libraries" "ffmpeg" "flac" "fontconfig"
-                             "freetype" "harfbuzz-ng" "icu" "libdrm" "libevent"
-                             "libjpeg" "libpng" "libvpx" "libwebp" "libxml"
-                             "libxslt" "openh264" "opus" "re2" "snappy" "yasm"
-                             "zlib"))
-
-                   (format #t (string-append "Packing new ungoogled tarball ...~%"))
-                   (force-output)
-                   (invoke "tar" "cvfa" #$output
-                           ;; Avoid non-determinism in the archive.
-                           "--mtime=@0"
-                           "--owner=root:0"
-                           "--group=root:0"
-                           "--sort=name"
-                           chromium-dir)
-
-                   #t)))))))))
+(define ungoogled-chromium-snippet
+  ;; Note: delay to cope with cyclic module imports at the top level.
+  (delay
+    #~(begin
+        (let ((chromium-dir (getcwd)))
+          (set-path-environment-variable
+           "PATH" '("bin")
+           (list #+patch #+python-wrapper #+xz))
+
+          ;; Apply patches before running the ungoogled scripts because
+          ;; domain substitution may break some of the patches.
+          (format #t "Applying assorted build fixes...~%")
+          (force-output)
+          (for-each (lambda (patch)
+                      (invoke "patch" "-p1" "--force" "--input"
+                              patch "--no-backup-if-mismatch"))
+                    (append '#+%debian-patches '#+%arch-patches
+                            '#+%guix-patches))
+
+          (with-directory-excursion #+%ungoogled-origin
+            (format #t "Ungooglifying...~%")
+            (force-output)
+            (invoke "python" "utils/prune_binaries.py" chromium-dir
+                    "pruning.list")
+            (invoke "python" "utils/patches.py" "apply" chromium-dir
+                    "patches")
+            (invoke "python" "utils/domain_substitution.py" "apply" "-r"
+                    "domain_regex.list" "-f" "domain_substitution.list"
+                    "-c" "/tmp/domainscache.tar.gz" chromium-dir))
+
+          ;; Run after the ungoogled scripts to avoid interfering with
+          ;; patches or file lists.
+          (format #t "Removing blacklisted files...~%")
+          (force-output)
+          (for-each delete-file-recursively '#$%blacklisted-files)
+
+          (format #t "Pruning third party files...~%")
+          (force-output)
+          (apply invoke (string-append #+python-2 "/bin/python")
+                 "build/linux/unbundle/remove_bundled_libraries.py"
+                 "--do-remove" '#$%preserved-third-party-files)
+
+          (format #t "Replacing GN files...~%")
+          (force-output)
+          (substitute* "tools/generate_shim_headers/generate_shim_headers.py"
+            ;; The "is_official_build" configure option enables certain
+            ;; release optimizations like those used in the commercial
+            ;; Chrome browser.  Unfortunately it also requires using the
+            ;; bundled libraries: lose that restriction.
+            (("#if defined\\(OFFICIAL_BUILD\\)")
+             "#if 0"))
+          (invoke "python" "build/linux/unbundle/replace_gn_files.py"
+                  "--system-libraries" "ffmpeg" "flac" "fontconfig"
+                  "freetype" "harfbuzz-ng" "icu" "libdrm" "libevent"
+                  "libjpeg" "libpng" "libwebp" "libxml" "libxslt"
+                  "openh264" "opus" "snappy" "zlib")
+          #t))))
 
 (define opus+custom
   (package/inherit opus
@@ -422,12 +413,47 @@ from forcing GEXP-PROMISE."
         `(cons "--enable-custom-modes"
                ,flags))))))
 
+;; 'make-ld-wrapper' can only work with an 'ld' executable, so we need
+;; this trick to make it wrap 'lld'.
+(define (make-lld-wrapper lld)
+  (define lld-as-ld
+    (computed-file "lld-ld"
+                   #~(begin
+                       (mkdir #$output)
+                       (mkdir (string-append #$output "/bin"))
+                       (symlink #$(file-append lld "/bin/lld")
+                                (string-append #$output "/bin/ld")))))
+
+  ;; Create a wrapper for LLD that inserts appropriate -rpath entries.
+  (define lld-wrapper
+    (make-ld-wrapper "lld-wrapper"
+                     #:binutils lld-as-ld))
+
+  ;; Clang looks for an 'ld.lld' executable, so we need to symlink it back.
+  (computed-file "lld-wrapped"
+                 #~(begin
+                     (mkdir #$output)
+                     (mkdir (string-append #$output "/bin"))
+                     (symlink #$(file-append lld-wrapper "/bin/ld")
+                              (string-append #$output "/bin/lld"))
+                     (symlink "lld" (string-append #$output "/bin/ld.lld")))))
+
 (define-public ungoogled-chromium
   (package
     (name "ungoogled-chromium")
-    (version %package-version)
+    (version (string-append %chromium-version "-0."
+                            (string-take %ungoogled-revision 7)))
     (synopsis "Graphical web browser")
-    (source ungoogled-chromium-source)
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "https://commondatastorage.googleapis.com"
+                                  "/chromium-browser-official/chromium-"
+                                  %chromium-version ".tar.xz"))
+              (sha256
+               (base32
+                "1g39i82js7fm4fqb8i66d6xs0kzqjxzi4vzvvwz5y9rkbikcc4ma"))
+              (modules '((guix build utils)))
+              (snippet (force ungoogled-chromium-snippet))))
     (build-system gnu-build-system)
     (arguments
      `(#:tests? #f
@@ -435,8 +461,6 @@ from forcing GEXP-PROMISE."
        #:validate-runpath? #f
        #:modules ((guix build gnu-build-system)
                   (guix build utils)
-                  (ice-9 ftw)
-                  (ice-9 regex)
                   (srfi srfi-26))
        #:configure-flags
        ;; See tools/gn/docs/cookbook.md and
@@ -445,16 +469,16 @@ from forcing GEXP-PROMISE."
        ;; directory for an exhaustive list of supported flags.
        ;; (Note: The 'configure' phase will do that for you.)
        (list "is_debug=false"
-             "use_gold=false"
-             "use_lld=false"
-             "linux_use_bundled_binutils=false"
-             "use_custom_libcxx=false"
+             ;; Use the "official" release optimizations, as opposed to
+             ;; a developer build.
+             "is_official_build=true"
+             (string-append "max_jobs_per_link="
+                            (number->string (parallel-job-count)))
+             "clang_use_chrome_plugins=false"
              "use_sysroot=false"
-             "enable_precompiled_headers=false"
              "goma_dir=\"\""
              "enable_nacl=false"
              "enable_nacl_nonsfi=false"
-             "use_allocator=\"none\""
              "use_unofficial_version_number=false"
              "treat_warnings_as_errors=false"
              "use_official_google_api_keys=false"
@@ -466,28 +490,15 @@ from forcing GEXP-PROMISE."
              "enable_remoting=false"
              "enable_reporting=false"
              "enable_service_discovery=false"
-             "enable_swiftshader=false"
              "enable_vr=false"
              "enable_widevine=false"
              ;; Disable type-checking for the Web UI to avoid a Java dependency.
-             "closure_compile=false"
+             "enable_js_type_check=false"
 
              ;; Define a custom toolchain that simply looks up CC, AR and
              ;; friends from the environment.
              "custom_toolchain=\"//build/toolchain/linux/unbundle:default\""
              "host_toolchain=\"//build/toolchain/linux/unbundle:default\""
-             ;; Don't assume it's clang.
-             "is_clang=false"
-             ;; Disable debugging features to save space.  These are normally
-             ;; pulled in by "is_official_build", but that requires "is_clang".
-             "enable_iterator_debugging=false"
-             "exclude_unwind_tables=true"
-             ;; Optimize for building everything at once, as opposed to
-             ;; incrementally for development.  See "docs/jumbo.md".
-             "use_jumbo_build=true"
-             ;; The default file merge limit of 50 requires huge amounts of RAM.
-             ;; Cap it to make sure the build succeeds on commodity hardware.
-             "jumbo_file_merge_limit=8"
 
              ;; Prefer system libraries.
              "use_system_freetype=true"
@@ -502,6 +513,11 @@ from forcing GEXP-PROMISE."
              "use_openh264=true"
              "use_pulseaudio=true"
              "link_pulseaudio=true"
+             "icu_use_data_file=false"
+
+             ;; FIXME: Using system protobuf with "is_official_build" causes an
+             ;; invalid opcode and "protoc-gen-plugin: Plugin killed by signal 4".
+             ;;"perfetto_use_system_protobuf=true"
 
              ;; VA-API acceleration is currently only supported on x86_64-linux.
              ,@(if (string-prefix? "x86_64" (or (%current-target-system)
@@ -516,16 +532,13 @@ from forcing GEXP-PROMISE."
              ;; WebRTC stuff.
              "rtc_use_h264=true"
              ;; Don't use bundled sources.
-             "rtc_build_json=false"
+             "rtc_build_json=true"      ;FIXME: libc++ std::string ABI difference
              "rtc_build_libevent=false"
              "rtc_build_libvpx=false"
              "rtc_build_opus=false"
              "rtc_build_ssl=false"
              "rtc_build_libsrtp=true"   ;FIXME: fails to find headers
              "rtc_build_usrsctp=true"   ;TODO: package this
-             (string-append "rtc_jsoncpp_root=\""
-                            (assoc-ref %build-inputs "jsoncpp")
-                            "/include/jsoncpp/json\"")
              (string-append "rtc_ssl_root=\""
                             (assoc-ref %build-inputs "openssl")
                             "/include/openssl\""))
@@ -560,11 +573,6 @@ from forcing GEXP-PROMISE."
                        (find-files (string-append "third_party/webrtc/modules"
                                                   "/audio_coding/codecs/opus")))
 
-             (substitute* "chrome/common/chrome_paths.cc"
-               (("/usr/share/chromium/extensions")
-                ;; TODO: Add ~/.guix-profile.
-                "/run/current-system/profile/share/chromium/extensions"))
-
              ;; Many files try to include ICU headers from "third_party/icu/...".
              ;; Remove the "third_party/" prefix to use system headers instead.
              (substitute* (find-files "chrome" "\\.cc$")
@@ -578,29 +586,17 @@ from forcing GEXP-PROMISE."
 
              (substitute*
                  "third_party/breakpad/breakpad/src/common/linux/libcurl_wrapper.h"
-               (("include \"third_party/curl") "include \"curl"))
-
-             (substitute* "third_party/webrtc/rtc_base/strings/json.h"
-               (("#include \"third_party/jsoncpp/") "#include \"json/"))
+               (("include \"third_party/curl")
+                "include \"curl"))
 
              (substitute* '("components/viz/common/gpu/vulkan_context_provider.h"
-                            "components/viz/common/resources/resource_format_utils.h")
-               (("third_party/vulkan/include/") ""))
+                            "components/viz/common/resources/resource_format_utils.h"
+                            "gpu/config/gpu_util.cc")
+               (("third_party/vulkan_headers/include/") ""))
 
              (substitute* "third_party/skia/include/gpu/vk/GrVkVulkan.h"
                (("include/third_party/vulkan/") ""))
 
-             ;; Building chromedriver embeds some files using the ZIP
-             ;; format which doesn't support timestamps before
-             ;; 1980. Therefore, advance the timestamps of the files
-             ;; which are included so that building chromedriver
-             ;; works.
-             (let ((circa-1980 (* 10 366 24 60 60)))
-               (for-each (lambda (file)
-                           (utime file circa-1980 circa-1980))
-                         '("chrome/test/chromedriver/extension/background.js"
-                           "chrome/test/chromedriver/extension/manifest.json")))
-
              #t))
          (add-after 'patch-stuff 'add-absolute-references
            (lambda* (#:key inputs #:allow-other-keys)
@@ -618,11 +614,10 @@ from forcing GEXP-PROMISE."
                (substitute* "device/udev_linux/udev1_loader.cc"
                  (("libudev\\.so\\.1")
                   (string-append udev "/lib/libudev.so.1")))
-               (substitute*
-                   '("ui/ozone/platform/x11/gl_ozone_glx.cc"
-                     "ui/ozone/common/egl_util.cc"
-                     "ui/gl/init/gl_initializer_x11.cc"
-                     "third_party/angle/src/libANGLE/renderer/gl/glx/FunctionsGLX.cpp")
+
+               (substitute* '("ui/ozone/platform/x11/gl_ozone_glx.cc"
+                              "ui/ozone/common/egl_util.cc"
+                              "ui/gl/init/gl_initializer_linux_x11.cc")
                  (("libGL\\.so\\.1")
                   (string-append mesa "/lib/libGL.so.1"))
                  (("libEGL\\.so\\.1")
@@ -633,12 +628,32 @@ from forcing GEXP-PROMISE."
          (add-before 'configure 'prepare-build-environment
            (lambda* (#:key inputs #:allow-other-keys)
 
-             ;; Make sure the right build tools are used.
-             (setenv "AR" "ar") (setenv "NM" "nm")
-             (setenv "CC" "gcc") (setenv "CXX" "g++")
-
-             ;; Prevent GCC from optimizing away null pointer safety checks.
-             (setenv "CXXFLAGS" "-fno-delete-null-pointer-checks")
+             ;; Define the GN toolchain.
+             (setenv "AR" "llvm-ar") (setenv "NM" "llvm-nm")
+             (setenv "CC" "clang") (setenv "CXX" "clang++")
+
+             (let ((gcc (assoc-ref inputs  "gcc")))
+               ;; Remove the default compiler from CPLUS_INCLUDE_PATH to
+               ;; prevent header conflict with the bundled libcxx.
+               (setenv "CPLUS_INCLUDE_PATH"
+                       (string-join
+                        (delete (string-append gcc "/include/c++")
+                                (string-split (getenv "CPLUS_INCLUDE_PATH")
+                                              #\:))
+                        ":"))
+               (format #t
+                       "environment variable `CPLUS_INCLUDE_PATH' changed to ~a~%"
+                       (getenv "CPLUS_INCLUDE_PATH")))
+
+             (setenv "CXXFLAGS"
+                     (string-join
+                      '(;; Do not optimize away null pointer safety checks.
+                        "-fno-delete-null-pointer-checks"
+                        ;; Disable warnings about unknown warnings that require
+                        ;; Clang plugins or newer versions.
+                        "-Wno-unknown-warning-option")))
+
+             (setenv "CFLAGS" "-Wno-unknown-warning-option")
 
              ;; TODO: pre-compile instead. Avoids a race condition.
              (setenv "PYTHONDONTWRITEBYTECODE" "1")
@@ -694,7 +709,10 @@ from forcing GEXP-PROMISE."
                     (lib            (string-append out "/lib"))
                     (man            (string-append out "/share/man/man1"))
                     (applications   (string-append out "/share/applications"))
-                    (install-regexp (make-regexp "\\.(bin|pak)$"))
+                    (libs           '("chrome_100_percent.pak"
+                                      "chrome_200_percent.pak"
+                                      "resources.pak"
+                                      "v8_context_snapshot.bin"))
                     (locales        (string-append lib "/locales"))
                     (resources      (string-append lib "/resources"))
                     (preferences    (assoc-ref inputs "master-preferences"))
@@ -719,9 +737,7 @@ from forcing GEXP-PROMISE."
                (copy-file preferences (string-append lib "/master_preferences"))
 
                (with-directory-excursion "out/Release"
-                 (for-each (lambda (file)
-                             (install-file file lib))
-                           (scandir "." (cut regexp-exec install-regexp <>)))
+                 (for-each (cut install-file <> lib) libs)
                  (copy-file "chrome" (string-append lib "/chromium"))
 
                  (copy-recursively "locales" locales)
@@ -731,6 +747,10 @@ from forcing GEXP-PROMISE."
                  (symlink "../lib/chromium" exe)
                  (install-file "chromedriver" bin)
 
+                 (for-each (lambda (so)
+                             (install-file so (string-append lib "/swiftshader")))
+                           (find-files "swiftshader" "\\.so$"))
+
                  (wrap-program exe
                    ;; Avoid file manager crash.  See <https://bugs.gnu.org/26593>.
                    `("XDG_DATA_DIRS" ":" prefix (,(string-append gtk+ "/share")))))
@@ -747,14 +767,14 @@ from forcing GEXP-PROMISE."
                #t))))))
     (native-inputs
      `(("bison" ,bison)
-       ("gcc" ,gcc-8)
+       ("clang" ,clang-11)
        ("gn" ,gn)
        ("gperf" ,gperf)
+       ("ld-wrapper" ,(make-lld-wrapper lld))
        ("ninja" ,ninja)
        ("node" ,node)
        ("pkg-config" ,pkg-config)
        ("which" ,which)
-       ("yasm" ,yasm)
 
        ;; This file contains defaults for new user profiles.
        ("master-preferences" ,(local-file "aux-files/chromium/master-preferences.json"))
@@ -778,8 +798,7 @@ from forcing GEXP-PROMISE."
        ("glib" ,glib)
        ("gtk+" ,gtk+)
        ("harfbuzz" ,harfbuzz)
-       ("icu4c" ,icu4c)
-       ("jsoncpp" ,jsoncpp)
+       ("icu4c" ,icu4c-67)
        ("lcms" ,lcms)
        ("libevent" ,libevent)
        ("libffi" ,libffi)
@@ -813,16 +832,23 @@ from forcing GEXP-PROMISE."
        ("pango" ,pango)
        ("pciutils" ,pciutils)
        ("pulseaudio" ,pulseaudio)
-       ("re2" ,re2)
        ("snappy" ,snappy)
        ("speech-dispatcher" ,speech-dispatcher)
        ("udev" ,eudev)
        ("valgrind" ,valgrind)
        ("vulkan-headers" ,vulkan-headers)))
+    (native-search-paths
+     (list (search-path-specification
+            (variable "CHROMIUM_EXTENSION_DIRECTORY")
+            (separator #f)              ;single entry
+            (files '("share/chromium/extensions")))))
 
     ;; Building Chromium takes ... a very long time.  On a single core, a busy
     ;; mid-end x86 system may need more than 24 hours to complete the build.
-    (properties '((timeout . 144000)))  ;40 hours
+    (properties '((timeout . 144000)    ;40 hours
+                  ;; The linking step may take more than an hour on some hardware.
+                  (max-silent-time . 7200)
+                  (cpe-name . "chrome")))
 
     (home-page "https://github.com/Eloston/ungoogled-chromium")
     (description
@@ -854,6 +880,7 @@ disabled in order to protect the users privacy.")
        ((#:configure-flags flags)
         `(append (list "use_ozone=true"
                        "ozone_platform_wayland=true"
+                       "ozone_platform_x11=true"
                        "ozone_auto_platforms=false"
                        "ozone_platform=\"wayland\""
                        "use_xkbcommon=true"