Do not automatically update DEPOT_TOOLS

fix "sudo must be owned by uid 0 and have the setuid bit set"

.github/workflows/build_bromite_dev.yaml

@@ -250,9 +250,9 @@ jobs:
 
              echo "::group::-------- gn gen"
              [[ "$USEGOMA" = "true" ]] && \
-                gn gen --args="import(\"/home/lg/working_dir/bromite/build/GN_ARGS\") use_goma=true goma_dir=\"$WORKSPACE/goma\" $(cat ../../build_args.gni) " out/bromite \
+                gn gen --args="import(\"/home/lg/working_dir/bromite/build/bromite.gn_args\") use_goma=true goma_dir=\"$WORKSPACE/goma\" $(cat ../../build_args.gni) " out/bromite \
                 || \
-                gn gen --args="import(\"/home/lg/working_dir/bromite/build/GN_ARGS\") $(cat ../../build_args.gni) " out/bromite              
+                gn gen --args="import(\"/home/lg/working_dir/bromite/build/bromite.gn_args\") $(cat ../../build_args.gni) " out/bromite              
              echo "::endgroup::"
 
              echo "::group::-------- gn args"
@@ -368,7 +368,10 @@ jobs:
             -t compdb cc cxx objc objcxx >$WORKSPACE/chromium/src/out/bromite/compile_commands.json
 
           test -f out/bromite/bromite.idx || \
-            /home/lg/working_dir/clangd_snapshot_20211205/bin/clangd-indexer --executor=all-TUs out/bromite/compile_commands.json >out/bromite/bromite.idx
+            cp -r out/bromite/ out/clangd && \
+            gn gen --args="import(\"/home/lg/working_dir/bromite/build/bromite.gn_args\") $(cat ../../build_args.gni) skip_clangd_unsupported_options = true" out/clangd && \
+            /home/lg/working_dir/clangd_snapshot_20211205/bin/clangd-indexer --executor=all-TUs out/clangd/compile_commands.json >out/bromite/bromite.idx && \
+            rm -rf out/clangd
 
       - name: Generate Supersize data
         if: ${{ github.event.inputs.debug == 'false' }}

.github/workflows/release.yaml

@@ -45,7 +45,7 @@ jobs:
         run: |
           wget https://github.com/ericchiang/pup/releases/download/v0.4.0/pup_v0.4.0_linux_amd64.zip
           unzip pup_v0.4.0_linux_amd64.zip && rm pup_v0.4.0_linux_amd64.zip
-          BRANCH=$(curl https://github.com/uazo/bromite/branch_commits/$BROMITE_SHA | ./pup -p li.branch a text{})
+          BRANCH=$(curl https://github.com/uazo/bromite/branch_commits/$BROMITE_SHA | ./pup -p li.branch:last-child a text{} | xargs)
           echo "BRANCH=$BRANCH" >> $GITHUB_ENV
 
           wget https://github.com/cli/cli/releases/download/v2.4.0/gh_2.4.0_linux_amd64.tar.gz
@@ -74,7 +74,7 @@ jobs:
           cd bromite
           VERSION=v$(cat ${{ env.OUTPUTFILE }}/RELEASE)-${{ github.event.inputs.build }}
           ../gh_2.4.0_linux_amd64/bin/gh release create $VERSION-$BROMITE_SHA \
-            ../$APK --notes ""
+            ../$APK --notes "" -p
 
 #      - name: Enable proxy on container
 #        shell: bash

create-from-patch.sh

@@ -10,7 +10,7 @@ fi
 
 if [ -z "$2" ]
 then
-        PATCH_NEW_PATH="~/bromite/build/patches-new"
+        PATCH_NEW_PATH=~/bromite/build/patches-new
 else
         PATCH_NEW_PATH=$2
 fi

export-all-patch.sh

@@ -32,3 +32,16 @@ for patch in $ALLPATCHS_E; do
 	bash ~/bromite-buildtools/export-single-patch.sh $patch $PATCH_FILE
 
 done
+
+PATCH_LIST=~/bromite/build/bromite_patches_list.txt
+mkdir ~/bromite/build/patches-new/changed
+mkdir ~/bromite/build/patches-new/contrib
+for current_file in $(cat $PATCH_LIST); do
+	if [[ "$current_file" == *".patch" ]]; then
+		if [[ $current_file =~ ^changed/.* ]]; then
+			mv ~/bromite/build/patches-new/$(basename $current_file) ~/bromite/build/patches-new/changed
+		elif [[ $current_file =~ ^contrib/.* ]]; then
+			mv ~/bromite/build/patches-new/$(basename $current_file) ~/bromite/build/patches-new/contrib || true
+		fi
+	fi
+done

export-patch-list.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+
+VERSION=$(cat ~/bromite/build/RELEASE)
+CURRENT_RELEASE=$(git -C ~/chromium/src/ rev-parse --verify refs/tags/$VERSION)
+
+ALLPATCHS_E=$(git -C ~/chromium/src/ rev-list HEAD...$CURRENT_RELEASE)
+
+mkdir ~/bromite/build/patches-new
+rm ~/bromite/build/patches-new/patch-list
+
+NO_NAME=1
+
+for patch in $ALLPATCHS_E; do
+
+	PATCH_FILE=$(git -C ~/chromium/src/ show -s $patch | grep FILE: | sed 's/FILE://g' | sed 's/^[ \t]*//;s/[ \t]*$//')
+	if [[ "$PATCH_FILE" == *"Automated-domain-substitution"* ]]; then
+		continue
+	fi
+
+	echo $PATCH_FILE >>~/bromite/build/patches-new/patch-list
+
+done
+
+tac ~/bromite/build/patches-new/patch-list >~/bromite/build/patches-new/zz-patch-list.txt
+rm ~/bromite/build/patches-new/patch-list

export-single-patch.sh

@@ -32,9 +32,9 @@ sed -i '/^ mode change/d' ~/bromite/build/patches-new/$PATCH_FILE
 sed -i '/^old mode /d' ~/bromite/build/patches-new/$PATCH_FILE
 sed -i '/^new mode /d' ~/bromite/build/patches-new/$PATCH_FILE
 
-echo "-- " >> ~/bromite/build/patches-new/$PATCH_FILE
+echo "--" >> ~/bromite/build/patches-new/$PATCH_FILE
 echo "2.25.1" >> ~/bromite/build/patches-new/$PATCH_FILE
-echo "" >> ~/bromite/build/patches-new/$PATCH_FILE
+#echo "" >> ~/bromite/build/patches-new/$PATCH_FILE
 
 echo "   done."
 echo ""

images/bromite-build/build_args.gni

@@ -14,7 +14,8 @@ if(getenv("TARGET_CPU") != "") {
 # print("Target " + target_cpu)
 
 enable_kythe_annotations = true
-clang_use_chrome_plugins = false
+# clang_use_chrome_plugins = false
+chrome_public_manifest_package = "org.bromite.bromite.dev"
 
 if(_is_debug_build == "true") {
 # print("Debug build on")
@@ -24,6 +25,11 @@ if(_is_debug_build == "true") {
   symbol_level = 1
   strip_debug_info = false
   generate_linker_map = false
+
+  # since is_cfi require use_thin_lto
+  # but not work in debug mode
+  is_cfi = false # disable it
+  use_cfi_cast = false # disable it
 } else {
   generate_linker_map = true
 }

images/bromite-source/apply-bromite-patches.sh

@@ -10,6 +10,7 @@ cd chromium/src
 echo -e ${RED} ------- apply patchs ${NC}
 for file in $(cat ../../bromite/build/bromite_patches_list.txt) ; do
 
+   if [[ "$file" == *".patch" ]]; then
 	#if [[ "$file" == *"Automated-domain-substitution"* ]]; then
 	#	echo -e ${RED} " -> Excluding $file" ${NC}
 	#	continue
@@ -17,7 +18,7 @@ for file in $(cat ../../bromite/build/bromite_patches_list.txt) ; do
 	
 	echo -e ${RED} " -> Apply $file" ${NC}
 
-	REPL="0,/^---/s//FILE:"$file"\n---/"
+	REPL="0,/^---/s//FILE:"$(basename $file)"\n---/"
 	cat ../../bromite/build/patches/$file | sed $REPL | git am
 
 	if [ $? -ne 0 ]
@@ -27,4 +28,6 @@ for file in $(cat ../../bromite/build/bromite_patches_list.txt) ; do
 	fi
 
 	echo " "
+    fi
+    
 done

images/build-deps/Dockerfile

@@ -16,13 +16,14 @@ RUN dpkg --add-architecture i386
 
 RUN apt-get update &&\
     DEBIAN_FRONTEND=noninteractive \
-    apt-get -f -y install sudo lsb-release cl-base64 bash wget apt-utils python sed tzdata build-essential lib32gcc-9-dev
+    apt-get -f -y install sudo lsb-release cl-base64 bash wget apt-utils python sed tzdata build-essential lib32gcc-9-dev g++-multilib
 
 ENV user lg
 
 RUN useradd -m -d /home/${user} ${user} && \
     chown -R ${user} /home/${user} && \
     adduser ${user} sudo && \
+    chmod 4755 /usr/bin/sudo && \
     echo '%sudo ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers
 USER ${user}
 

images/chr-source/depot_tools.diff

@@ -1,57 +1,60 @@
 diff --git a/gclient_scm.py b/gclient_scm.py
+index f58c07a8..c8409726 100644
 --- a/gclient_scm.py
 +++ b/gclient_scm.py
-@@ -1012,28 +1012,35 @@ class GitWrapper(SCMWrapper):
-     gclient_utils.safe_makedirs(parent_dir)
-
-     template_dir = None
-+    use_fetch = False
+@@ -1137,31 +1137,29 @@ class GitWrapper(SCMWrapper):
+       clone_cmd.append(url)
+ 
+       template_dir = None
++      use_fetch = False
 +
-+    tmp_dir = tempfile.mkdtemp(
-+        prefix='_gclient_%s_' % os.path.basename(self.checkout_path),
-+        dir=parent_dir)
++      tmp_dir = tempfile.mkdtemp(
++          prefix='_gclient_%s_' % os.path.basename(self.checkout_path),
++          dir=parent_dir)
 +
-     if hasattr(options, 'no_history') and options.no_history:
-       if gclient_utils.IsGitSha(revision):
-         # In the case of a subproject, the pinned sha is not necessarily the
-         # head of the remote branch (so we can't just use --depth=N). Instead,
-         # we tell git to fetch all the remote objects from SHA..HEAD by means of
-         # a template git dir which has a 'shallow' file pointing to the sha.
--        template_dir = tempfile.mkdtemp(
--            prefix='_gclient_gittmp_%s' % os.path.basename(self.checkout_path),
--            dir=parent_dir)
--        self._Run(['init', '--bare', template_dir], options, cwd=self._root_dir)
--        with open(os.path.join(template_dir, 'shallow'), 'w') as template_file:
--          template_file.write(revision)
--        clone_cmd.append('--template=' + template_dir)
-+        self._Run(['init', tmp_dir], options, cwd=self._root_dir)
+       if hasattr(options, 'no_history') and options.no_history:
+         if gclient_utils.IsGitSha(revision):
+-          # In the case of a subproject, the pinned sha is not necessarily the
+-          # head of the remote branch (so we can't just use --depth=N). Instead,
+-          # we tell git to fetch all the remote objects from SHA..HEAD by means
+-          # of a template git dir which has a 'shallow' file pointing to the
+-          # sha.
+-          template_dir = tempfile.mkdtemp(prefix='_gclient_gittmp_%s' %
+-                                          os.path.basename(self.checkout_path),
+-                                          dir=parent_dir)
+-          self._Run(['init', '--bare', template_dir],
+-                    options,
+-                    cwd=self._root_dir)
+-          with open(os.path.join(template_dir, 'shallow'),
+-                    'w') as template_file:
+-            template_file.write(revision)
+-            clone_cmd.append('--template=' + template_dir)
++          self._Run(['init', tmp_dir], options, cwd=self._root_dir)
 +
-+        self._Run(['-C', tmp_dir, 'remote', 'add', 'origin', url], options, cwd=self._root_dir)
++          self._Run(['-C', tmp_dir, 'remote', 'add', 'origin', url], options, cwd=self._root_dir)
 +
-+        clone_cmd = cfg + ['-C', tmp_dir, 'fetch', '--progress']
-+        clone_cmd.append('--depth=1')
-+        clone_cmd.append(url)
-+        clone_cmd.append(revision)
-+        use_fetch = True
-       else:
-         # Otherwise, we're just interested in the HEAD. Just use --depth.
-         clone_cmd.append('--depth=1')
-
--    tmp_dir = tempfile.mkdtemp(
--        prefix='_gclient_%s_' % os.path.basename(self.checkout_path),
--        dir=parent_dir)
-     try:
++          clone_cmd = cfg + ['-C', tmp_dir, 'fetch', '--progress']
++          clone_cmd.append('--depth=1')
++          clone_cmd.append(url)
++          clone_cmd.append(revision)
++          use_fetch = True
+         else:
+           # Otherwise, we're just interested in the HEAD. Just use --depth.
+           clone_cmd.append('--depth=1')
+ 
+-      tmp_dir = tempfile.mkdtemp(prefix='_gclient_%s_' %
+-                                 os.path.basename(self.checkout_path),
+-                                 dir=parent_dir)
 -      clone_cmd.append(tmp_dir)
 +      if use_fetch == False:
 +        clone_cmd.append(tmp_dir)
-+
-       if self.print_outbuf:
-         print_stdout = True
-         filter_fn = None
-@@ -1328,6 +1335,9 @@ class GitWrapper(SCMWrapper):
+ 
+       try:
+         self._Run(clone_cmd,
+@@ -1452,6 +1450,9 @@ class GitWrapper(SCMWrapper):
      if refspec:
        fetch_cmd.append(refspec)
-
+ 
 +    if hasattr(options, 'no_history') and options.no_history:
 +      fetch_cmd.append('--depth=1')
 +

images/chr-source/prepare-build.sh

@@ -22,6 +22,8 @@ echo -e ${RED} -------- download chromium repo ${NC}
 mkdir ./chromium
 cd ./chromium
 
+export DEPOT_TOOLS_UPDATE=0
+
 gclient root
 
 mkdir ./src

images/github-runner/Dockerfile

@@ -77,7 +77,7 @@ RUN useradd -m runner \
 
 # Build args
 ARG TARGETPLATFORM=amd64
-ARG RUNNER_VERSION=2.302.4
+ARG RUNNER_VERSION=2.302.5
 WORKDIR /runner
 
 # Runner download supports amd64 as x64

images/github-runner/startup.sh

@@ -48,7 +48,9 @@ echo "Registering runner ${runner_id}"
   --url "${registration_url}" \
   --allowedauthorslist "${ALLOWEDAUTHORSLIST}" \
   --unattended \
-  --replace
+  --replace \
+  --disableupdate \
+  --ephemeral
 
 trap 'remove_runner; exit 130' SIGINT
 trap 'remove_runner; exit 143' SIGTERM

images/squid/whitelist

@@ -4,6 +4,13 @@
 .githubusercontent.com
 .ubuntu.com
 
+# for .net
+.dot.net
+dotnet.microsoft.com
+dotnetcli.azureedge.net
+aka.ms
+packages.microsoft.com
+
 # for buildeps
 #chromium.googlesource.com