[ISSUE] Chromium package contains non-free components (Widevine)

[ISSUE] Chromium package contains non-free components (Widevine)

[selfisekai]

[-- Attachment #1: Type: text/plain, Size: 1308 bytes --]

New issue by selfisekai on void-packages repository

https://github.com/void-linux/void-packages/issues/29273

Description:
<!-- Don't request update of package. We have a script for that. https://alpha.de.repo.voidlinux.org/void-updates/void-updates.txt . However, a quality pull request may help. -->
### System

* xuname: `Void 5.10.19_1 x86_64 AuthenticAMD uptodate rrmFF`
  *output of ``xuname`` (part of xtools)*
* package: `chromium-88.0.4324.182_1` 
  *affected package(s) including the version*: ``xbps-query -p pkgver <pkgname>``

### Expected behavior
A package downloaded from outside of the nonfree repository should not contain/download non-free components

### Actual behavior
Chromium downloads the Widevine component and uses it, which is not really transparent to the user.
![image](https://user-images.githubusercontent.com/11798442/110215944-a903b800-7eac-11eb-82b4-90ead6423f65.png)
![image](https://user-images.githubusercontent.com/11798442/110216334-dd787380-7eae-11eb-8fba-9830627671f2.png)

### Steps to reproduce the behavior
- `xbps-install chromium`
- `chromium`
- open `chrome://components` and force an update of Widevide CDM, or just wait until it gets triggered itself
- try playing a Widevine-protected video, like here: https://bitmovin.com/demos/drm

Re: Chromium package contains non-free components (Widevine)

[ericonr]

[-- Attachment #1: Type: text/plain, Size: 257 bytes --]

New comment by ericonr on void-packages repository

https://github.com/void-linux/void-packages/issues/29273#issuecomment-792016685

Comment:
Afaik this is a *feature* for anyone who wants to play netflix or similar. I'm not sure we'd like to disable it...

Re: Chromium package contains non-free components (Widevine)

[selfisekai]

[-- Attachment #1: Type: text/plain, Size: 633 bytes --]

New comment by selfisekai on void-packages repository

https://github.com/void-linux/void-packages/issues/29273#issuecomment-792071892

Comment:
I don't really have a problem with an _option_ to use Widevine, if it is either a package from the nonfree repository, or it's transparent to the user (like in Firefox, which explicitly asks the user if they want to install and enable the Widevine add-on) 
![image](https://user-images.githubusercontent.com/11798442/110222152-82f00f00-7ed0-11eb-9aca-c47a7830506f.png)

Placing Chromium, which does this automatically, in a free repository, creates an illusion of using free software.

Re: Chromium package contains non-free components (Widevine)

[q66]

[-- Attachment #1: Type: text/plain, Size: 343 bytes --]

New comment by q66 on void-packages repository

https://github.com/void-linux/void-packages/issues/29273#issuecomment-792073131

Comment:
this is an upstream decision, we generally don't override upstream decisions

we also don't adhere to strict free software guidelines, so requirements from the likes of FSF are entirely irrelevant to us

Re: Chromium package contains non-free components (Widevine)

[q66]

[-- Attachment #1: Type: text/plain, Size: 424 bytes --]

New comment by q66 on void-packages repository

https://github.com/void-linux/void-packages/issues/29273#issuecomment-792073131

Comment:
this is an upstream decision, we generally don't override upstream decisions (as for widevine, you can already install it from packages: `chromium-widevine`)

we also don't adhere to strict free software guidelines, so requirements from the likes of FSF are entirely irrelevant to us

Re: Chromium package contains non-free components (Widevine)

[ptrcnull]

[-- Attachment #1: Type: text/plain, Size: 460 bytes --]

New comment by ptrcnull on void-packages repository

https://github.com/void-linux/void-packages/issues/29273#issuecomment-792119673

Comment:
I don't think the issue is about FSF or any other guidelines; it's just not cool that a supposedly open-source package downloads a backdoor from Google, considering that it's possible to disable it, as [https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=%23960454](Debian package maintainers) have been able to do it.

Re: Chromium package contains non-free components (Widevine)

[ptrcnull]

[-- Attachment #1: Type: text/plain, Size: 460 bytes --]

New comment by ptrcnull on void-packages repository

https://github.com/void-linux/void-packages/issues/29273#issuecomment-792119673

Comment:
I don't think the issue is about FSF or any other guidelines; it's just not cool that a supposedly open-source package downloads a backdoor from Google, considering that it's possible to disable it, as [Debian package maintainers](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=%23960454) have been able to do it.

Re: Chromium package contains non-free components (Widevine)

[ptrcnull]

[-- Attachment #1: Type: text/plain, Size: 624 bytes --]

New comment by ptrcnull on void-packages repository

https://github.com/void-linux/void-packages/issues/29273#issuecomment-792119673

Comment:
I don't think the issue is about FSF or any other guidelines; it's just not cool that a supposedly open-source package downloads a backdoor from Google, considering that it's possible to disable it, as [Debian package maintainers](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=%23960454) have been able to do it.

As far as I know, Michel's patch would allow users to still download Widevine via the `chromium-widevine` package, but makes it actually opt-in and transparent.

Re: Chromium package contains non-free components (Widevine)

[q66]

[-- Attachment #1: Type: text/plain, Size: 257 bytes --]

New comment by q66 on void-packages repository

https://github.com/void-linux/void-packages/issues/29273#issuecomment-792146760

Comment:
hm, i guess this is simple enough

probably worth adding into https://github.com/void-linux/void-packages/pull/29205

Re: Chromium package contains non-free components (Widevine)

[ericonr]

[-- Attachment #1: Type: text/plain, Size: 260 bytes --]

New comment by ericonr on void-packages repository

https://github.com/void-linux/void-packages/issues/29273#issuecomment-792150148

Comment:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=%23960454#54 <-- can we be sure it won't be introducing new bugs?

Re: Chromium package contains non-free components (Widevine)

[ericonr]

[-- Attachment #1: Type: text/plain, Size: 285 bytes --]

New comment by ericonr on void-packages repository

https://github.com/void-linux/void-packages/issues/29273#issuecomment-792150148

Comment:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=%23960454#54 <-- can we be sure it won't be introducing new bugs? (besides being chromium)

Re: Chromium package contains non-free components (Widevine)

[q66]

[-- Attachment #1: Type: text/plain, Size: 315 bytes --]

New comment by q66 on void-packages repository

https://github.com/void-linux/void-packages/issues/29273#issuecomment-792165657

Comment:
well, installing `chromium-widevine` is probably already the preferrable way to get the plugin and then you won't get autoupdates at all (but it updates together with chromium)

Re: Chromium package contains non-free components (Widevine)

[ericonr]

[-- Attachment #1: Type: text/plain, Size: 387 bytes --]

New comment by ericonr on void-packages repository

https://github.com/void-linux/void-packages/issues/29273#issuecomment-792174564

Comment:
AFAIK we have kept `chromium-widevine` mostly for qutebrowser uers :p

From a supply chain perspective, the package is indeed better, but I think most chromium users will be relying on the convenience of the automatic download (I know I was).

Re: Chromium package contains non-free components (Widevine)

[q66]

[-- Attachment #1: Type: text/plain, Size: 272 bytes --]

New comment by q66 on void-packages repository

https://github.com/void-linux/void-packages/issues/29273#issuecomment-792175897

Comment:
shrug, my platform doesn't have widevine or proprietary plugins in the first place, so i'll let the more qualified people decide here

Re: Chromium package contains non-free components (Widevine)

[github-actions]

[-- Attachment #1: Type: text/plain, Size: 293 bytes --]

New comment by github-actions[bot] on void-packages repository

https://github.com/void-linux/void-packages/issues/29273#issuecomment-1120110079

Comment:
Issues become stale 90 days after last activity and are closed 14 days after that.  If this issue is still relevant bump it or assign it.

Re: [ISSUE] [CLOSED] Chromium package contains non-free components (Widevine)

[github-actions]

[-- Attachment #1: Type: text/plain, Size: 1311 bytes --]

Closed issue by selfisekai on void-packages repository

https://github.com/void-linux/void-packages/issues/29273

Description:
<!-- Don't request update of package. We have a script for that. https://alpha.de.repo.voidlinux.org/void-updates/void-updates.txt . However, a quality pull request may help. -->
### System

* xuname: `Void 5.10.19_1 x86_64 AuthenticAMD uptodate rrmFF`
  *output of ``xuname`` (part of xtools)*
* package: `chromium-88.0.4324.182_1` 
  *affected package(s) including the version*: ``xbps-query -p pkgver <pkgname>``

### Expected behavior
A package downloaded from outside of the nonfree repository should not contain/download non-free components

### Actual behavior
Chromium downloads the Widevine component and uses it, which is not really transparent to the user.
![image](https://user-images.githubusercontent.com/11798442/110215944-a903b800-7eac-11eb-82b4-90ead6423f65.png)
![image](https://user-images.githubusercontent.com/11798442/110216334-dd787380-7eae-11eb-8fba-9830627671f2.png)

### Steps to reproduce the behavior
- `xbps-install chromium`
- `chromium`
- open `chrome://components` and force an update of Widevide CDM, or just wait until it gets triggered itself
- try playing a Widevine-protected video, like here: https://bitmovin.com/demos/drm