From 5533e05ca151a1763b57b86e212968b7f6bddf17 Mon Sep 17 00:00:00 2001
From: "ambrop7@gmail.com" <Ambroz Bizjak>
Date: Sun, 16 Mar 2014 13:32:39 +0100
Subject: [PATCH 01/37] Chromium: Add desktop entry.

---
 .../networking/browsers/chromium/default.nix     | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index baf67371769d..6b57acc2d356 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, makeWrapper, ninja, which
+{ stdenv, fetchurl, makeWrapper, ninja, which, makeDesktopItem
 
 # default dependencies
 , bzip2, flac, speex
@@ -155,6 +155,17 @@ let
   libExecPath = "$out/libexec/${packageName}";
   sandboxPath = "${sandbox}/bin/${packageName}_sandbox";
 
+  desktopItem = makeDesktopItem {
+    name = "Chromium";
+    exec = "chromium";
+    icon = "chromium";
+    comment = "An open source web browser from Google";
+    desktopName = "Chromium";
+    genericName = "Web browser";
+    mimeType = "text/html;text/xml;application/xhtml+xml;x-scheme-handler/http;x-scheme-handler/https;x-scheme-handler/ftp;x-scheme-handler/mailto;x-scheme-handler/webcal";
+    categories = "Network;WebBrowser";
+  };
+
 in stdenv.mkDerivation rec {
   name = "${packageName}-${src.version}";
   inherit packageName src;
@@ -266,6 +277,9 @@ in stdenv.mkDerivation rec {
       mkdir -vp "$logo_output_path"
       cp -v "$icon_file" "$logo_output_path/${packageName}.png"
     done
+
+    mkdir -vp "$out/share/applications"
+    cp -v "${desktopItem}/share/applications/"* "$out/share/applications"
   '';
 
   passthru = {

From e2dba7c6cffd5c48a2f2e17d33b0560bad172d32 Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Mon, 17 Mar 2014 12:29:59 +0100
Subject: [PATCH 02/37] chromium: Use version 3 of libgnome_keyring.

Starting with version 35, version 2 of libgnome_keyring is no longer
supported and it's probably pretty useless to do backports to version 2,
given the assumption that most users on Nix probably don't use it.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 pkgs/applications/networking/browsers/chromium/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index 213e75ee6efa..7ae83186567a 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -24,7 +24,7 @@
 , enableNaCl ? false
 , useOpenSSL ? false, nss ? null, openssl ? null
 , gnomeSupport ? false, gconf ? null
-, gnomeKeyringSupport ? false, libgnome_keyring ? null
+, gnomeKeyringSupport ? false, libgnome_keyring3 ? null
 , proprietaryCodecs ? true
 , cupsSupport ? false
 , pulseSupport ? false, pulseaudio ? null
@@ -171,7 +171,7 @@ in stdenv.mkDerivation rec {
     libXScrnSaver libXcursor libXtst mesa
     pciutils protobuf speechd libXdamage
     pythonPackages.gyp
-  ] ++ optional gnomeKeyringSupport libgnome_keyring
+  ] ++ optional gnomeKeyringSupport libgnome_keyring3
     ++ optionals gnomeSupport [ gconf libgcrypt ]
     ++ optional enableSELinux libselinux
     ++ optional cupsSupport libgcrypt

From 9f45c2cbbab6ac763860c1b5d58c36a2208685a5 Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Mon, 17 Mar 2014 21:53:29 +0100
Subject: [PATCH 03/37] chromium: Prepare for building the -lite package.

We currently can't build the -lite package because beta and dev versions
aren't yet compatible with ICU version 52. But apart from that blocker,
this should get us ready for the switch.

Also, we're now correctly unbundling all dependencies which are used
from <nixpkgs>.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 .../networking/browsers/chromium/default.nix      | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index 7ae83186567a..5c0d44f05a33 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -1,8 +1,8 @@
 { stdenv, fetchurl, makeWrapper, ninja, which
 
 # default dependencies
-, bzip2, flac, speex
-, libevent, expat, libjpeg
+, bzip2, flac, speex, icu, libopus
+, libevent, expat, libjpeg, snappy
 , libpng, libxml2, libxslt
 , xdg_utils, yasm, zlib
 , libusb1, libexif, pciutils
@@ -117,8 +117,9 @@ let
     use_system_libexif = true;
     use_system_libjpeg = true;
     use_system_libpng = false; # PNG dlopen() version conflict
-    use_system_libusb = true;
     use_system_libxml = true;
+    use_system_opus = true;
+    use_system_snappy = true;
     use_system_speex = true;
     use_system_ssl = useOpenSSL;
     use_system_stlport = true;
@@ -128,7 +129,8 @@ let
     use_system_protobuf = true;
 
     use_system_harfbuzz = false;
-    use_system_icu = false;
+    use_system_icu = false; # Doesn't support ICU 52 yet.
+    use_system_libusb = false; # http://crbug.com/266149
     use_system_libwebp = false; # http://crbug.com/133161
     use_system_skia = false;
     use_system_sqlite = false; # http://crbug.com/22208
@@ -136,8 +138,8 @@ let
   };
 
   defaultDependencies = [
-    bzip2 flac speex
-    libevent expat libjpeg
+    bzip2 flac speex icu libopus
+    libevent expat libjpeg snappy
     libpng libxml2 libxslt
     xdg_utils yasm zlib
     libusb1 libexif
@@ -230,6 +232,7 @@ in stdenv.mkDerivation rec {
   });
 
   configurePhase = ''
+    python build/linux/unbundle/replace_gyp_files.py ${gypFlags}
     python build/gyp_chromium -f ninja --depth "$(pwd)" ${gypFlags}
   '';
 

From 8ddc86d6e486e577afb746c55cbec181f372f6b5 Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Mon, 17 Mar 2014 22:03:06 +0100
Subject: [PATCH 04/37] v8: Refactor package and update to version 3.25.9.

This now uses fetchurl instead of fetchsvn and now invokes gyp directly
instead of copying over the gyp command to the source tree.

Also, we're now using stdenv.is64bit to properly determine the host
architecture.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 pkgs/development/libraries/v8/default.nix | 101 +++++++++++-----------
 1 file changed, 51 insertions(+), 50 deletions(-)

diff --git a/pkgs/development/libraries/v8/default.nix b/pkgs/development/libraries/v8/default.nix
index 0564e6887957..db8e491caae3 100644
--- a/pkgs/development/libraries/v8/default.nix
+++ b/pkgs/development/libraries/v8/default.nix
@@ -1,65 +1,66 @@
-{ stdenv, fetchsvn, gyp, readline, python, which }:
+{ stdenv, fetchurl, gyp, readline, python, which, icu }:
 
 assert readline != null;
 
 let
-  system = stdenv.system;
-  arch = if system == "i686-linux" then "ia32" else if system == "x86_64-linux" || system == "x86_64-darwin" then "x64" else "";
-  version = "3.14.5.9";
+  arch = if stdenv.is64bit then "x64" else "ia32";
 in
 
-assert arch != "";
+stdenv.mkDerivation rec {
+  name = "v8-${version}";
+  version = "3.25.9";
 
-stdenv.mkDerivation {
-    name = "v8-${version}";
+  src = fetchurl {
+    url = "https://commondatastorage.googleapis.com/chromium-browser-official/"
+        + "${name}.tar.bz2";
+    sha256 = "0x6czv99dr701vljyb4ghyhhc5rmv7vfkpvigcnrqz2an9q1pc28";
+  };
 
-    src = fetchsvn {
-      url = "http://v8.googlecode.com/svn/tags/${version}";
-      sha256 = "18qp5qp5xrb6f00w01cklz358yrl54pks963f5rwvwz82d8sfyqr";
-      name = "v8-${version}-src";
-    };
+  configurePhase = ''
+    PYTHONPATH="tools/generate_shim_headers:$PYTHONPATH" \
+      ${gyp}/bin/gyp \
+        -f make \
+        --generator-output="out" \
+        -Dflock_index=0 \
+        -Dv8_enable_i18n_support=1 \
+        -Duse_system_icu=1 \
+        -Dconsole=readline \
+        -Dcomponent=shared_library \
+        -Dv8_target_arch=${arch} \
+        --depth=. -Ibuild/standalone.gypi \
+        build/all.gyp
+  '';
 
-    patches = [ ./fix-GetLocalizedMessage-usage.patch ];
+  nativeBuildInputs = [ which ];
+  buildInputs = [ readline python icu ];
 
-    configurePhase = ''
-      mkdir build/gyp
-      ln -sv ${gyp}/bin/gyp build/gyp/gyp
-    '';
+  buildFlags = [
+    "LINK=g++"
+    "-C out"
+    "builddir=$(CURDIR)/Release"
+    "BUILDTYPE=Release"
+  ];
 
-    nativeBuildInputs = [ which ];
-    buildInputs = [ readline python ];
+  enableParallelBuilding = true;
 
-    buildFlags = [
-      "library=shared"
-      "console=readline"
-      "${arch}.release"
-    ];
+  installPhase = ''
+    install -vD out/Release/d8 "$out/bin/d8"
+    ${if stdenv.system == "x86_64-darwin" then ''
+    install -vD out/Release/lib.target/libv8.dylib "$out/lib/libv8.dylib"
+    '' else ''
+    install -vD out/Release/lib.target/libv8.so "$out/lib/libv8.so"
+    ''}
+    cp -vr include "$out/"
+  '';
 
-    # http://code.google.com/p/v8/issues/detail?id=2149
-    NIX_CFLAGS_COMPILE = "-Wno-unused-local-typedefs -Wno-aggressive-loop-optimizations";
+  postFixup = if stdenv.isDarwin then ''
+    install_name_tool -change /usr/local/lib/libv8.dylib $out/lib/libv8.dylib -change /usr/lib/libgcc_s.1.dylib ${stdenv.gcc.gcc}/lib/libgcc_s.1.dylib $out/bin/d8
+    install_name_tool -id $out/lib/libv8.dylib -change /usr/lib/libgcc_s.1.dylib ${stdenv.gcc.gcc}/lib/libgcc_s.1.dylib $out/lib/libv8.dylib
+  '' else null;
 
-    enableParallelBuilding = true;
-
-    installPhase = ''
-      mkdir -p $out/bin
-      mkdir -p $out/lib
-      mv -v out/${arch}.release/d8 $out/bin
-
-      ${if stdenv.system == "x86_64-darwin" then
-        "mv -v out/${arch}.release/libv8.dylib $out/lib"
-      else
-        "mv -v out/${arch}.release/lib.target/libv8.so $out/lib"}
-      mv -v include $out/
-    '';
-
-    postFixup = if stdenv.isDarwin then ''
-      install_name_tool -change /usr/local/lib/libv8.dylib $out/lib/libv8.dylib -change /usr/lib/libgcc_s.1.dylib ${stdenv.gcc.gcc}/lib/libgcc_s.1.dylib $out/bin/d8
-      install_name_tool -id $out/lib/libv8.dylib -change /usr/lib/libgcc_s.1.dylib ${stdenv.gcc.gcc}/lib/libgcc_s.1.dylib $out/lib/libv8.dylib
-    '' else null;
-
-    meta = with stdenv.lib; {
-      description = "V8 is Google's open source JavaScript engine";
-      platforms = platforms.linux ++ platforms.darwin;
-      license = licenses.bsd3;
-    };
+  meta = with stdenv.lib; {
+    description = "V8 is Google's open source JavaScript engine";
+    platforms = platforms.linux ++ platforms.darwin;
+    license = licenses.bsd3;
+  };
 }

From 2f23f57b28fc7cb41bec51250e4566e969e3aa2c Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Mon, 17 Mar 2014 22:15:46 +0100
Subject: [PATCH 05/37] chromium: Build beta/dev with v8 from nixpkgs.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 pkgs/applications/networking/browsers/chromium/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index 5c0d44f05a33..292b99f92eb3 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -3,7 +3,7 @@
 # default dependencies
 , bzip2, flac, speex, icu, libopus
 , libevent, expat, libjpeg, snappy
-, libpng, libxml2, libxslt
+, libpng, libxml2, libxslt, v8
 , xdg_utils, yasm, zlib
 , libusb1, libexif, pciutils
 
@@ -134,13 +134,13 @@ let
     use_system_libwebp = false; # http://crbug.com/133161
     use_system_skia = false;
     use_system_sqlite = false; # http://crbug.com/22208
-    use_system_v8 = false;
+    use_system_v8 = !versionOlder src.version "34.0.0.0";
   };
 
   defaultDependencies = [
     bzip2 flac speex icu libopus
     libevent expat libjpeg snappy
-    libpng libxml2 libxslt
+    libpng libxml2 libxslt v8
     xdg_utils yasm zlib
     libusb1 libexif
   ];

From a01f279d2e1b7cffd1cee29ae555d5ddedfa9b73 Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Mon, 17 Mar 2014 22:17:16 +0100
Subject: [PATCH 06/37] libwebp: Update to new upstream version 0.4.0.

Now the version should be recent enough to be built against Chromium,
see: https://code.google.com/p/webp/issues/detail?id=122#c6

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 pkgs/development/libraries/libwebp/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/libwebp/default.nix b/pkgs/development/libraries/libwebp/default.nix
index 854af5942f90..95b9e6bc95c0 100644
--- a/pkgs/development/libraries/libwebp/default.nix
+++ b/pkgs/development/libraries/libwebp/default.nix
@@ -1,11 +1,11 @@
 {stdenv, fetchurl, libpng, libjpeg}:
 
 stdenv.mkDerivation rec {
-  name = "libwebp-0.1.3";
-  
+  name = "libwebp-0.4.0";
+
   src = fetchurl {
     url = "http://webp.googlecode.com/files/${name}.tar.gz";
-    sha256 = "1fkssvg99s9ypswh4ywkirgcy1wmy3b6388f3cqj4a4vwdb89ca0";
+    sha256 = "0sadjkx8m6sf064r5gngjvz4b5246q3j27dlaml5b1k3x5vkb49i";
   };
 
   buildInputs = [ libpng libjpeg ];

From 7f47785d67b028a02b76aa3aec79b13366bd003d Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Mon, 17 Mar 2014 22:25:39 +0100
Subject: [PATCH 07/37] libwebp: Build with support for GIF and TIFF.

Not sure whether those are really needed for Chromium, but I suppose it
doesn't hurt to have support for conversion.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 pkgs/development/libraries/libwebp/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libwebp/default.nix b/pkgs/development/libraries/libwebp/default.nix
index 95b9e6bc95c0..aeac9239c8bf 100644
--- a/pkgs/development/libraries/libwebp/default.nix
+++ b/pkgs/development/libraries/libwebp/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, libpng, libjpeg}:
+{ stdenv, fetchurl, libpng, libjpeg, giflib, libtiff }:
 
 stdenv.mkDerivation rec {
   name = "libwebp-0.4.0";
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "0sadjkx8m6sf064r5gngjvz4b5246q3j27dlaml5b1k3x5vkb49i";
   };
 
-  buildInputs = [ libpng libjpeg ];
+  buildInputs = [ libpng libjpeg giflib libtiff ];
 
   meta = {
     homepage = http://code.google.com/p/webp/;

From 823b72d0ad26d1bad0c6d5107a2dd8fc0c131995 Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Mon, 17 Mar 2014 22:27:46 +0100
Subject: [PATCH 08/37] chromium: Build with libwebp from nixpkgs.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 pkgs/applications/networking/browsers/chromium/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index 292b99f92eb3..8ef102c34cc7 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -4,7 +4,7 @@
 , bzip2, flac, speex, icu, libopus
 , libevent, expat, libjpeg, snappy
 , libpng, libxml2, libxslt, v8
-, xdg_utils, yasm, zlib
+, xdg_utils, yasm, zlib, libwebp
 , libusb1, libexif, pciutils
 
 , python, pythonPackages, perl, pkgconfig
@@ -117,6 +117,7 @@ let
     use_system_libexif = true;
     use_system_libjpeg = true;
     use_system_libpng = false; # PNG dlopen() version conflict
+    use_system_libwebp = true;
     use_system_libxml = true;
     use_system_opus = true;
     use_system_snappy = true;
@@ -131,7 +132,6 @@ let
     use_system_harfbuzz = false;
     use_system_icu = false; # Doesn't support ICU 52 yet.
     use_system_libusb = false; # http://crbug.com/266149
-    use_system_libwebp = false; # http://crbug.com/133161
     use_system_skia = false;
     use_system_sqlite = false; # http://crbug.com/22208
     use_system_v8 = !versionOlder src.version "34.0.0.0";
@@ -141,7 +141,7 @@ let
     bzip2 flac speex icu libopus
     libevent expat libjpeg snappy
     libpng libxml2 libxslt v8
-    xdg_utils yasm zlib
+    xdg_utils yasm zlib libwebp
     libusb1 libexif
   ];
 

From 5b67290740fbb0d8b9a5bcc0d9a9108b844add5d Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Mon, 17 Mar 2014 22:30:51 +0100
Subject: [PATCH 09/37] chromium: Build using libpng from nixpkgs.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 pkgs/applications/networking/browsers/chromium/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index 8ef102c34cc7..66fbe9779b9f 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -116,7 +116,7 @@ let
     use_system_libexpat = true;
     use_system_libexif = true;
     use_system_libjpeg = true;
-    use_system_libpng = false; # PNG dlopen() version conflict
+    use_system_libpng = true;
     use_system_libwebp = true;
     use_system_libxml = true;
     use_system_opus = true;

From 33acfbe9176cd0b88d3cb821a749de757e19ce58 Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Tue, 18 Mar 2014 02:21:10 +0100
Subject: [PATCH 10/37] minizip: New package based on zlib derivation.

This is needed by Chromium and is part of the zlib source tree in
contrib/, so let's propagate the version of zlib and use the same source
tree.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 pkgs/development/libraries/minizip/default.nix | 14 ++++++++++++++
 pkgs/development/libraries/zlib/default.nix    |  2 ++
 pkgs/top-level/all-packages.nix                |  2 ++
 3 files changed, 18 insertions(+)
 create mode 100644 pkgs/development/libraries/minizip/default.nix

diff --git a/pkgs/development/libraries/minizip/default.nix b/pkgs/development/libraries/minizip/default.nix
new file mode 100644
index 000000000000..b71920446e4c
--- /dev/null
+++ b/pkgs/development/libraries/minizip/default.nix
@@ -0,0 +1,14 @@
+{ stdenv, zlib, autoconf, automake, libtool }:
+
+stdenv.mkDerivation {
+  name = "minizip-${zlib.version}";
+  inherit (zlib) src;
+
+  nativeBuildInputs = [ autoconf automake libtool ];
+  buildInputs = [ zlib ];
+
+  preConfigure = ''
+    cd contrib/minizip
+    autoreconf -vfi
+  '';
+}
diff --git a/pkgs/development/libraries/zlib/default.nix b/pkgs/development/libraries/zlib/default.nix
index 0d4abaf25e0a..f1eea80ab7a3 100644
--- a/pkgs/development/libraries/zlib/default.nix
+++ b/pkgs/development/libraries/zlib/default.nix
@@ -40,4 +40,6 @@ stdenv.mkDerivation rec {
 
   # zlib doesn't like the automatic --disable-shared from the Cygwin stdenv.
   cygwinConfigureEnableShared = true;
+
+  passthru.version = version;
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ae947c552b73..fda6cdaa2610 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5398,6 +5398,8 @@ let
 
   ming = callPackage ../development/libraries/ming { };
 
+  minizip = callPackage ../development/libraries/minizip { };
+
   minmay = callPackage ../development/libraries/minmay { };
 
   miro = callPackage ../applications/video/miro {

From c9c9ca38b94389851bc86b381038d919ffee1d2f Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Mon, 17 Mar 2014 22:31:15 +0100
Subject: [PATCH 11/37] chromium: Build using minizip from nixpkgs.

Well, the gyp flag mentions "zlib" but in reality, minizip is used.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 pkgs/applications/networking/browsers/chromium/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index 66fbe9779b9f..dcd2f78a4f5e 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -4,7 +4,7 @@
 , bzip2, flac, speex, icu, libopus
 , libevent, expat, libjpeg, snappy
 , libpng, libxml2, libxslt, v8
-, xdg_utils, yasm, zlib, libwebp
+, xdg_utils, yasm, minizip, libwebp
 , libusb1, libexif, pciutils
 
 , python, pythonPackages, perl, pkgconfig
@@ -126,7 +126,7 @@ let
     use_system_stlport = true;
     use_system_xdg_utils = true;
     use_system_yasm = true;
-    use_system_zlib = false; # http://crbug.com/143623
+    use_system_zlib = true;
     use_system_protobuf = true;
 
     use_system_harfbuzz = false;
@@ -141,7 +141,7 @@ let
     bzip2 flac speex icu libopus
     libevent expat libjpeg snappy
     libpng libxml2 libxslt v8
-    xdg_utils yasm zlib libwebp
+    xdg_utils yasm minizip libwebp
     libusb1 libexif
   ];
 

From 5e95ae5e88fd0faddf9ceb85e856f8a220150fe1 Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Tue, 18 Mar 2014 03:38:06 +0100
Subject: [PATCH 12/37] libwebp: Enable (de)mux and decoder.

This is required to build Chromium. Making it a non-optional dependency
as it shouldn't really hurt other packages using it.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 pkgs/development/libraries/libwebp/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/libraries/libwebp/default.nix b/pkgs/development/libraries/libwebp/default.nix
index aeac9239c8bf..6800541d923f 100644
--- a/pkgs/development/libraries/libwebp/default.nix
+++ b/pkgs/development/libraries/libwebp/default.nix
@@ -10,6 +10,12 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libpng libjpeg giflib libtiff ];
 
+  configureFlags = [
+    "--enable-libwebpmux"
+    "--enable-libwebpdemux"
+    "--enable-libwebpdecoder"
+  ];
+
   meta = {
     homepage = http://code.google.com/p/webp/;
     description = "Tools and library for the WebP image format";

From c2abe4da6c0e19358d46e6fdd4d5ff5bfddfff82 Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Wed, 19 Mar 2014 11:32:39 +0100
Subject: [PATCH 13/37] chromium: Add support for ppapi flash and PDF.

This is hardcoded for the dev channel at the moment and we're going to
fetch it along with the main Chromium sources.

Also I'm putting this in default.nix at the moment, because we're going
to tear apart the whole Chromium package into several subparts soon.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 .../networking/browsers/chromium/default.nix  | 74 ++++++++++++++++++-
 1 file changed, 72 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index dcd2f78a4f5e..b70825670156 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -26,6 +26,8 @@
 , gnomeSupport ? false, gconf ? null
 , gnomeKeyringSupport ? false, libgnome_keyring3 ? null
 , proprietaryCodecs ? true
+, enablePepperFlash ? false
+, enablePepperPDF ? false
 , cupsSupport ? false
 , pulseSupport ? false, pulseaudio ? null
 }:
@@ -151,6 +153,68 @@ let
     binary = "${packageName}_sandbox";
   };
 
+  binaryPlugins = stdenv.mkDerivation {
+    name = "chromium-binary-plugins";
+
+    # XXX: Only temporary and has to be version-specific
+    src = fetchurl {
+      url = "https://dl.google.com/linux/chrome/deb/pool/main/g/"
+          + "google-chrome-unstable/google-chrome-unstable_"
+          + "35.0.1897.2-1_amd64.deb";
+      sha1 = "b68683fc5321d10536e4135c266b14894b7668ed";
+    };
+
+    phases = [ "unpackPhase" "patchPhase" "checkPhase" "installPhase" ];
+    outputs = [ "pdf" "flash" ];
+
+    unpackCmd = ''
+      ensureDir plugins
+      ar p "$src" data.tar.lzma | tar xJ -C plugins --strip-components=4 \
+        ./opt/google/chrome-unstable/PepperFlash \
+        ./opt/google/chrome-unstable/libpdf.so
+    '';
+
+    doCheck = true;
+    checkPhase = ''
+      ! find -iname '*.so' -exec ldd {} + | grep 'not found'
+    '';
+
+    patchPhase = let
+      rpaths = [ stdenv.gcc.gcc ];
+      mkrpath = p: "${makeSearchPath "lib64" p}:${makeSearchPath "lib" p}";
+    in ''
+      for sofile in PepperFlash/libpepflashplayer.so libpdf.so; do
+        chmod +x "$sofile"
+        patchelf --set-rpath "${mkrpath rpaths}" "$sofile"
+      done
+    '';
+
+    installPhase = let
+      pdfName = "Chrome PDF Viewer";
+      pdfDescription = "Portable Document Format";
+      pdfMimeTypes = concatStringsSep ";" [
+        "application/pdf"
+        "application/x-google-chrome-print-preview-pdf"
+      ];
+      pdfInfo = "#${pdfName}#${pdfDescription};${pdfMimeTypes}";
+    in ''
+      install -vD libpdf.so "$pdf/lib/libpdf.so"
+      ensureDir "$pdf/nix-support"
+      echo "--register-pepper-plugins='$pdf/lib/libpdf.so${pdfInfo}'" \
+        > "$pdf/nix-support/chromium-flags"
+
+      flashVersion="$(
+        sed -n -r 's/.*"version": "([^"]+)",.*/\1/p' PepperFlash/manifest.json
+      )"
+
+      install -vD libpepflashplayer.so "$flash/lib/libpepflashplayer.so"
+      ensureDir "$flash/nix-support"
+      echo "--ppapi-flash-path='$flash/lib/libpepflashplayer.so'" \
+           "--ppapi-flash-version=$flashVersion" \
+           > "$flash/nix-support/chromium-flags"
+    '';
+  };
+
   # build paths and release info
   packageName = "chromium";
   buildType = "Release";
@@ -248,7 +312,12 @@ in stdenv.mkDerivation rec {
         chrome ${optionalString (!enableSELinux) "chrome_sandbox"}
   '';
 
-  installPhase = ''
+  installPhase = let
+    enabledPlugins = optional enablePepperFlash binaryPlugins.flash
+                  ++ optional enablePepperPDF   binaryPlugins.pdf;
+    getFlags = plugin: "$(< ${plugin}/nix-support/chromium-flags)";
+    pluginArgs = concatStringsSep " " (map getFlags enabledPlugins);
+  in ''
     ensureDir "${libExecPath}"
     cp -v "${buildPath}/"*.pak "${libExecPath}/"
     ${optionalString (!versionOlder src.version "34.0.0.0") ''
@@ -260,7 +329,8 @@ in stdenv.mkDerivation rec {
     cp -v "${buildPath}/chrome" "${libExecPath}/${packageName}"
 
     mkdir -vp "$out/bin"
-    makeWrapper "${libExecPath}/${packageName}" "$out/bin/${packageName}"
+    makeWrapper "${libExecPath}/${packageName}" "$out/bin/${packageName}" \
+      --add-flags "${pluginArgs}"
 
     mkdir -vp "$out/share/man/man1"
     cp -v "${buildPath}/chrome.1" "$out/share/man/man1/${packageName}.1"

From 88a939c2d116236fbfb48d9a27741584b6a6e055 Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Wed, 19 Mar 2014 12:21:10 +0100
Subject: [PATCH 14/37] chromium: Decouple browser from default.nix.

This currently only passes through the arguments and is nothing more
than the foundation of the new structure. In essence, I want to have a
really small default.nix which is then going down into the respective
subparts that are isolated from each other.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 .../networking/browsers/chromium/browser.nix  | 361 ++++++++++++++++++
 .../networking/browsers/chromium/default.nix  | 358 +----------------
 pkgs/top-level/all-packages.nix               |   1 -
 3 files changed, 374 insertions(+), 346 deletions(-)
 create mode 100644 pkgs/applications/networking/browsers/chromium/browser.nix

diff --git a/pkgs/applications/networking/browsers/chromium/browser.nix b/pkgs/applications/networking/browsers/chromium/browser.nix
new file mode 100644
index 000000000000..e98c47d8cdd8
--- /dev/null
+++ b/pkgs/applications/networking/browsers/chromium/browser.nix
@@ -0,0 +1,361 @@
+{ stdenv, fetchurl, makeWrapper, ninja, which
+
+# default dependencies
+, bzip2, flac, speex, icu, libopus
+, libevent, expat, libjpeg, snappy
+, libpng, libxml2, libxslt, v8
+, xdg_utils, yasm, minizip, libwebp
+, libusb1, libexif, pciutils
+
+, python, pythonPackages, perl, pkgconfig
+, nspr, udev, krb5
+, utillinux, alsaLib
+, gcc, bison, gperf
+, glib, gtk, dbus_glib
+, libXScrnSaver, libXcursor, libXtst, mesa
+, protobuf, speechd, libXdamage
+
+# optional dependencies
+, libgcrypt ? null # gnomeSupport || cupsSupport
+
+# package customization
+, channel ? "stable"
+, enableSELinux ? false, libselinux ? null
+, enableNaCl ? false
+, useOpenSSL ? false, nss ? null, openssl ? null
+, gnomeSupport ? false, gnome ? null
+, gnomeKeyringSupport ? false, libgnome_keyring3 ? null
+, proprietaryCodecs ? true
+, enablePepperFlash ? false
+, enablePepperPDF ? false
+, cupsSupport ? false
+, pulseSupport ? false, pulseaudio ? null
+}:
+
+with stdenv.lib;
+
+let
+  src = with getAttr channel (import ./sources.nix); stdenv.mkDerivation {
+    name = "chromium-source-${version}";
+
+    src = fetchurl {
+      inherit url sha256;
+    };
+
+    buildInputs = [ python ]; # cannot patch shebangs otherwise
+
+    phases = [ "unpackPhase" "patchPhase" "installPhase" ];
+
+    opensslPatches = optional useOpenSSL openssl.patches;
+
+    prePatch = "patchShebangs .";
+
+    patches = singleton ./sandbox_userns_31.patch;
+
+    postPatch = ''
+      sed -i -r \
+        -e 's/-f(stack-protector)(-all)?/-fno-\1/' \
+        -e 's|/bin/echo|echo|' \
+        -e "/python_arch/s/: *'[^']*'/: '""'/" \
+        build/common.gypi chrome/chrome_tests.gypi
+      sed -i '/not RunGN/,+1d' build/gyp_chromium
+      sed -i -e 's|/usr/bin/gcc|gcc|' \
+        third_party/WebKit/Source/build/scripts/scripts.gypi \
+        third_party/WebKit/Source/build/scripts/preprocessor.pm
+    '' + optionalString useOpenSSL ''
+      cat $opensslPatches | patch -p1 -d third_party/openssl/openssl
+    '' + optionalString (!versionOlder version "34.0.0.0") ''
+      sed -i '/import.*depot/d' build/gyp_chromium
+    '';
+
+    outputs = [ "out" "sandbox" "bundled" "main" ];
+    installPhase = ''
+      ensureDir "$out" "$sandbox" "$bundled" "$main"
+
+      header "copying browser main sources to $main"
+      find . -mindepth 1 -maxdepth 1 \
+        \! -path ./sandbox \
+        \! -path ./third_party \
+        \! -path ./build \
+        \! -path ./tools \
+        \! -name '.*' \
+        -print | xargs cp -rt "$main"
+      stopNest
+
+      header "copying sandbox components to $sandbox"
+      cp -rt "$sandbox" sandbox/*
+      stopNest
+
+      header "copying third party sources to $bundled"
+      cp -rt "$bundled" third_party/*
+      stopNest
+
+      header "copying build requisites to $out"
+      cp -rt "$out" build tools
+      stopNest
+
+      rm -rf "$out/tools/gyp" # XXX: Don't even copy it in the first place.
+    '';
+
+    passthru = {
+      inherit version;
+    };
+  };
+
+  mkGypFlags =
+    let
+      sanitize = value:
+        if value == true then "1"
+        else if value == false then "0"
+        else "${value}";
+      toFlag = key: value: "-D${key}=${sanitize value}";
+    in attrs: concatStringsSep " " (attrValues (mapAttrs toFlag attrs));
+
+  gypFlagsUseSystemLibs = {
+    use_system_bzip2 = true;
+    use_system_flac = true;
+    use_system_libevent = true;
+    use_system_libexpat = true;
+    use_system_libexif = true;
+    use_system_libjpeg = true;
+    use_system_libpng = true;
+    use_system_libwebp = true;
+    use_system_libxml = true;
+    use_system_opus = true;
+    use_system_snappy = true;
+    use_system_speex = true;
+    use_system_ssl = useOpenSSL;
+    use_system_stlport = true;
+    use_system_xdg_utils = true;
+    use_system_yasm = true;
+    use_system_zlib = true;
+    use_system_protobuf = true;
+
+    use_system_harfbuzz = false;
+    use_system_icu = false; # Doesn't support ICU 52 yet.
+    use_system_libusb = false; # http://crbug.com/266149
+    use_system_skia = false;
+    use_system_sqlite = false; # http://crbug.com/22208
+    use_system_v8 = !versionOlder src.version "34.0.0.0";
+  };
+
+  defaultDependencies = [
+    bzip2 flac speex icu libopus
+    libevent expat libjpeg snappy
+    libpng libxml2 libxslt v8
+    xdg_utils yasm minizip libwebp
+    libusb1 libexif
+  ];
+
+  sandbox = import ./sandbox.nix {
+    inherit stdenv;
+    src = src.sandbox;
+    binary = "${packageName}_sandbox";
+  };
+
+  binaryPlugins = stdenv.mkDerivation {
+    name = "chromium-binary-plugins";
+
+    # XXX: Only temporary and has to be version-specific
+    src = fetchurl {
+      url = "https://dl.google.com/linux/chrome/deb/pool/main/g/"
+          + "google-chrome-unstable/google-chrome-unstable_"
+          + "35.0.1897.2-1_amd64.deb";
+      sha1 = "b68683fc5321d10536e4135c266b14894b7668ed";
+    };
+
+    phases = [ "unpackPhase" "patchPhase" "checkPhase" "installPhase" ];
+    outputs = [ "pdf" "flash" ];
+
+    unpackCmd = ''
+      ensureDir plugins
+      ar p "$src" data.tar.lzma | tar xJ -C plugins --strip-components=4 \
+        ./opt/google/chrome-unstable/PepperFlash \
+        ./opt/google/chrome-unstable/libpdf.so
+    '';
+
+    doCheck = true;
+    checkPhase = ''
+      ! find -iname '*.so' -exec ldd {} + | grep 'not found'
+    '';
+
+    patchPhase = let
+      rpaths = [ stdenv.gcc.gcc ];
+      mkrpath = p: "${makeSearchPath "lib64" p}:${makeSearchPath "lib" p}";
+    in ''
+      for sofile in PepperFlash/libpepflashplayer.so libpdf.so; do
+        chmod +x "$sofile"
+        patchelf --set-rpath "${mkrpath rpaths}" "$sofile"
+      done
+    '';
+
+    installPhase = let
+      pdfName = "Chrome PDF Viewer";
+      pdfDescription = "Portable Document Format";
+      pdfMimeTypes = concatStringsSep ";" [
+        "application/pdf"
+        "application/x-google-chrome-print-preview-pdf"
+      ];
+      pdfInfo = "#${pdfName}#${pdfDescription};${pdfMimeTypes}";
+    in ''
+      install -vD libpdf.so "$pdf/lib/libpdf.so"
+      ensureDir "$pdf/nix-support"
+      echo "--register-pepper-plugins='$pdf/lib/libpdf.so${pdfInfo}'" \
+        > "$pdf/nix-support/chromium-flags"
+
+      flashVersion="$(
+        sed -n -r 's/.*"version": "([^"]+)",.*/\1/p' PepperFlash/manifest.json
+      )"
+
+      install -vD libpepflashplayer.so "$flash/lib/libpepflashplayer.so"
+      ensureDir "$flash/nix-support"
+      echo "--ppapi-flash-path='$flash/lib/libpepflashplayer.so'" \
+           "--ppapi-flash-version=$flashVersion" \
+           > "$flash/nix-support/chromium-flags"
+    '';
+  };
+
+  # build paths and release info
+  packageName = "chromium";
+  buildType = "Release";
+  buildPath = "out/${buildType}";
+  libExecPath = "$out/libexec/${packageName}";
+  sandboxPath = "${sandbox}/bin/${packageName}_sandbox";
+
+in stdenv.mkDerivation rec {
+  name = "${packageName}-${src.version}";
+  inherit packageName src;
+
+  buildInputs = defaultDependencies ++ [
+    which makeWrapper
+    python perl pkgconfig
+    nspr udev
+    (if useOpenSSL then openssl else nss)
+    utillinux alsaLib
+    gcc bison gperf
+    gcc bison gperf krb5
+    glib gtk dbus_glib
+    libXScrnSaver libXcursor libXtst mesa
+    pciutils protobuf speechd libXdamage
+    pythonPackages.gyp
+  ] ++ optional gnomeKeyringSupport libgnome_keyring3
+    ++ optionals gnomeSupport [ gnome.GConf libgcrypt ]
+    ++ optional enableSELinux libselinux
+    ++ optional cupsSupport libgcrypt
+    ++ optional pulseSupport pulseaudio;
+
+  prePatch = ''
+    # XXX: Figure out a way how to split these properly.
+    #cpflags="-dsr --no-preserve=mode"
+    cpflags="-dr"
+    cp $cpflags "${src.main}"/* .
+    cp $cpflags "${src.bundled}" third_party
+    cp $cpflags "${src.sandbox}" sandbox
+    chmod -R u+w . # XXX!
+  '';
+
+  postPatch = ''
+    sed -i -e '/base::FilePath exe_dir/,/^ *} *$/c \
+      sandbox_binary = \
+        base::FilePath("'"${sandboxPath}"'");
+    ' content/browser/browser_main_loop.cc
+  '';
+
+  gypFlags = mkGypFlags (gypFlagsUseSystemLibs // {
+    linux_use_gold_binary = false;
+    linux_use_gold_flags = false;
+    proprietary_codecs = false;
+    use_gnome_keyring = gnomeKeyringSupport;
+    use_gconf = gnomeSupport;
+    use_gio = gnomeSupport;
+    use_pulseaudio = pulseSupport;
+    disable_nacl = !enableNaCl;
+    use_openssl = useOpenSSL;
+    selinux = enableSELinux;
+    use_cups = cupsSupport;
+    linux_sandbox_path="${sandboxPath}";
+    linux_sandbox_chrome_path="${libExecPath}/${packageName}";
+    werror = "";
+
+    # Google API keys, see http://www.chromium.org/developers/how-tos/api-keys.
+    # Note: These are for NixOS/nixpkgs use ONLY. For your own distribution,
+    # please get your own set of keys.
+    google_api_key = "AIzaSyDGi15Zwl11UNe6Y-5XW_upsfyw31qwZPI";
+    google_default_client_id = "404761575300.apps.googleusercontent.com";
+    google_default_client_secret = "9rIFQjfnkykEmqb6FfjJQD1D";
+
+  } // optionalAttrs proprietaryCodecs {
+    # enable support for the H.264 codec
+    proprietary_codecs = true;
+    ffmpeg_branding = "Chrome";
+  } // optionalAttrs (stdenv.system == "x86_64-linux") {
+    target_arch = "x64";
+    python_arch = "x86-64";
+  } // optionalAttrs (stdenv.system == "i686-linux") {
+    target_arch = "ia32";
+    python_arch = "ia32";
+  });
+
+  configurePhase = ''
+    python build/linux/unbundle/replace_gyp_files.py ${gypFlags}
+    python build/gyp_chromium -f ninja --depth "$(pwd)" ${gypFlags}
+  '';
+
+  buildPhase = let
+    CC = "${gcc}/bin/gcc";
+    CXX = "${gcc}/bin/g++";
+  in ''
+    CC="${CC}" CC_host="${CC}"     \
+    CXX="${CXX}" CXX_host="${CXX}" \
+    LINK_host="${CXX}"             \
+      "${ninja}/bin/ninja" -C "${buildPath}"  \
+        -j$NIX_BUILD_CORES -l$NIX_BUILD_CORES \
+        chrome ${optionalString (!enableSELinux) "chrome_sandbox"}
+  '';
+
+  installPhase = let
+    enabledPlugins = optional enablePepperFlash binaryPlugins.flash
+                  ++ optional enablePepperPDF   binaryPlugins.pdf;
+    getFlags = plugin: "$(< ${plugin}/nix-support/chromium-flags)";
+    pluginArgs = concatStringsSep " " (map getFlags enabledPlugins);
+  in ''
+    ensureDir "${libExecPath}"
+    cp -v "${buildPath}/"*.pak "${libExecPath}/"
+    ${optionalString (!versionOlder src.version "34.0.0.0") ''
+    cp -v "${buildPath}/icudtl.dat" "${libExecPath}/"
+    ''}
+    cp -vR "${buildPath}/locales" "${buildPath}/resources" "${libExecPath}/"
+    cp -v ${buildPath}/libffmpegsumo.so "${libExecPath}/"
+
+    cp -v "${buildPath}/chrome" "${libExecPath}/${packageName}"
+
+    mkdir -vp "$out/bin"
+    makeWrapper "${libExecPath}/${packageName}" "$out/bin/${packageName}" \
+      --add-flags "${pluginArgs}"
+
+    mkdir -vp "$out/share/man/man1"
+    cp -v "${buildPath}/chrome.1" "$out/share/man/man1/${packageName}.1"
+
+    for icon_file in chrome/app/theme/chromium/product_logo_*[0-9].png; do
+      num_and_suffix="''${icon_file##*logo_}"
+      icon_size="''${num_and_suffix%.*}"
+      expr "$icon_size" : "^[0-9][0-9]*$" || continue
+      logo_output_prefix="$out/share/icons/hicolor"
+      logo_output_path="$logo_output_prefix/''${icon_size}x''${icon_size}/apps"
+      mkdir -vp "$logo_output_path"
+      cp -v "$icon_file" "$logo_output_path/${packageName}.png"
+    done
+  '';
+
+  passthru = {
+    inherit sandbox;
+  };
+
+  meta = {
+    description = "An open source web browser from Google";
+    homepage = http://www.chromium.org/;
+    maintainers = with maintainers; [ goibhniu chaoflow aszlig wizeman ];
+    license = licenses.bsd3;
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index b70825670156..bb6f530309ff 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -1,360 +1,28 @@
-{ stdenv, fetchurl, makeWrapper, ninja, which
-
-# default dependencies
-, bzip2, flac, speex, icu, libopus
-, libevent, expat, libjpeg, snappy
-, libpng, libxml2, libxslt, v8
-, xdg_utils, yasm, minizip, libwebp
-, libusb1, libexif, pciutils
-
-, python, pythonPackages, perl, pkgconfig
-, nspr, udev, krb5
-, utillinux, alsaLib
-, gcc, bison, gperf
-, glib, gtk, dbus_glib
-, libXScrnSaver, libXcursor, libXtst, mesa
-, protobuf, speechd, libXdamage
-
-# optional dependencies
-, libgcrypt ? null # gnomeSupport || cupsSupport
+{ newScope
 
 # package customization
 , channel ? "stable"
-, enableSELinux ? false, libselinux ? null
+, enableSELinux ? false
 , enableNaCl ? false
-, useOpenSSL ? false, nss ? null, openssl ? null
-, gnomeSupport ? false, gconf ? null
-, gnomeKeyringSupport ? false, libgnome_keyring3 ? null
+, useOpenSSL ? false
+, gnomeSupport ? false
+, gnomeKeyringSupport ? false
 , proprietaryCodecs ? true
 , enablePepperFlash ? false
 , enablePepperPDF ? false
 , cupsSupport ? false
-, pulseSupport ? false, pulseaudio ? null
+, pulseSupport ? false
 }:
 
-with stdenv.lib;
-
 let
-  src = with getAttr channel (import ./sources.nix); stdenv.mkDerivation {
-    name = "chromium-source-${version}";
+  callPackage = newScope chromium;
 
-    src = fetchurl {
-      inherit url sha256;
-    };
-
-    buildInputs = [ python ]; # cannot patch shebangs otherwise
-
-    phases = [ "unpackPhase" "patchPhase" "installPhase" ];
-
-    opensslPatches = optional useOpenSSL openssl.patches;
-
-    prePatch = "patchShebangs .";
-
-    patches = singleton ./sandbox_userns_31.patch;
-
-    postPatch = ''
-      sed -i -r \
-        -e 's/-f(stack-protector)(-all)?/-fno-\1/' \
-        -e 's|/bin/echo|echo|' \
-        -e "/python_arch/s/: *'[^']*'/: '""'/" \
-        build/common.gypi chrome/chrome_tests.gypi
-      sed -i '/not RunGN/,+1d' build/gyp_chromium
-      sed -i -e 's|/usr/bin/gcc|gcc|' \
-        third_party/WebKit/Source/build/scripts/scripts.gypi \
-        third_party/WebKit/Source/build/scripts/preprocessor.pm
-    '' + optionalString useOpenSSL ''
-      cat $opensslPatches | patch -p1 -d third_party/openssl/openssl
-    '' + optionalString (!versionOlder version "34.0.0.0") ''
-      sed -i '/import.*depot/d' build/gyp_chromium
-    '';
-
-    outputs = [ "out" "sandbox" "bundled" "main" ];
-    installPhase = ''
-      ensureDir "$out" "$sandbox" "$bundled" "$main"
-
-      header "copying browser main sources to $main"
-      find . -mindepth 1 -maxdepth 1 \
-        \! -path ./sandbox \
-        \! -path ./third_party \
-        \! -path ./build \
-        \! -path ./tools \
-        \! -name '.*' \
-        -print | xargs cp -rt "$main"
-      stopNest
-
-      header "copying sandbox components to $sandbox"
-      cp -rt "$sandbox" sandbox/*
-      stopNest
-
-      header "copying third party sources to $bundled"
-      cp -rt "$bundled" third_party/*
-      stopNest
-
-      header "copying build requisites to $out"
-      cp -rt "$out" build tools
-      stopNest
-
-      rm -rf "$out/tools/gyp" # XXX: Don't even copy it in the first place.
-    '';
-
-    passthru = {
-      inherit version;
+  chromium = {
+    browser = callPackage ./browser.nix {
+      inherit channel enableSELinux enableNaCl useOpenSSL gnomeSupport
+              gnomeKeyringSupport proprietaryCodecs enablePepperFlash
+              enablePepperPDF cupsSupport pulseSupport;
     };
   };
 
-  mkGypFlags =
-    let
-      sanitize = value:
-        if value == true then "1"
-        else if value == false then "0"
-        else "${value}";
-      toFlag = key: value: "-D${key}=${sanitize value}";
-    in attrs: concatStringsSep " " (attrValues (mapAttrs toFlag attrs));
-
-  gypFlagsUseSystemLibs = {
-    use_system_bzip2 = true;
-    use_system_flac = true;
-    use_system_libevent = true;
-    use_system_libexpat = true;
-    use_system_libexif = true;
-    use_system_libjpeg = true;
-    use_system_libpng = true;
-    use_system_libwebp = true;
-    use_system_libxml = true;
-    use_system_opus = true;
-    use_system_snappy = true;
-    use_system_speex = true;
-    use_system_ssl = useOpenSSL;
-    use_system_stlport = true;
-    use_system_xdg_utils = true;
-    use_system_yasm = true;
-    use_system_zlib = true;
-    use_system_protobuf = true;
-
-    use_system_harfbuzz = false;
-    use_system_icu = false; # Doesn't support ICU 52 yet.
-    use_system_libusb = false; # http://crbug.com/266149
-    use_system_skia = false;
-    use_system_sqlite = false; # http://crbug.com/22208
-    use_system_v8 = !versionOlder src.version "34.0.0.0";
-  };
-
-  defaultDependencies = [
-    bzip2 flac speex icu libopus
-    libevent expat libjpeg snappy
-    libpng libxml2 libxslt v8
-    xdg_utils yasm minizip libwebp
-    libusb1 libexif
-  ];
-
-  sandbox = import ./sandbox.nix {
-    inherit stdenv;
-    src = src.sandbox;
-    binary = "${packageName}_sandbox";
-  };
-
-  binaryPlugins = stdenv.mkDerivation {
-    name = "chromium-binary-plugins";
-
-    # XXX: Only temporary and has to be version-specific
-    src = fetchurl {
-      url = "https://dl.google.com/linux/chrome/deb/pool/main/g/"
-          + "google-chrome-unstable/google-chrome-unstable_"
-          + "35.0.1897.2-1_amd64.deb";
-      sha1 = "b68683fc5321d10536e4135c266b14894b7668ed";
-    };
-
-    phases = [ "unpackPhase" "patchPhase" "checkPhase" "installPhase" ];
-    outputs = [ "pdf" "flash" ];
-
-    unpackCmd = ''
-      ensureDir plugins
-      ar p "$src" data.tar.lzma | tar xJ -C plugins --strip-components=4 \
-        ./opt/google/chrome-unstable/PepperFlash \
-        ./opt/google/chrome-unstable/libpdf.so
-    '';
-
-    doCheck = true;
-    checkPhase = ''
-      ! find -iname '*.so' -exec ldd {} + | grep 'not found'
-    '';
-
-    patchPhase = let
-      rpaths = [ stdenv.gcc.gcc ];
-      mkrpath = p: "${makeSearchPath "lib64" p}:${makeSearchPath "lib" p}";
-    in ''
-      for sofile in PepperFlash/libpepflashplayer.so libpdf.so; do
-        chmod +x "$sofile"
-        patchelf --set-rpath "${mkrpath rpaths}" "$sofile"
-      done
-    '';
-
-    installPhase = let
-      pdfName = "Chrome PDF Viewer";
-      pdfDescription = "Portable Document Format";
-      pdfMimeTypes = concatStringsSep ";" [
-        "application/pdf"
-        "application/x-google-chrome-print-preview-pdf"
-      ];
-      pdfInfo = "#${pdfName}#${pdfDescription};${pdfMimeTypes}";
-    in ''
-      install -vD libpdf.so "$pdf/lib/libpdf.so"
-      ensureDir "$pdf/nix-support"
-      echo "--register-pepper-plugins='$pdf/lib/libpdf.so${pdfInfo}'" \
-        > "$pdf/nix-support/chromium-flags"
-
-      flashVersion="$(
-        sed -n -r 's/.*"version": "([^"]+)",.*/\1/p' PepperFlash/manifest.json
-      )"
-
-      install -vD libpepflashplayer.so "$flash/lib/libpepflashplayer.so"
-      ensureDir "$flash/nix-support"
-      echo "--ppapi-flash-path='$flash/lib/libpepflashplayer.so'" \
-           "--ppapi-flash-version=$flashVersion" \
-           > "$flash/nix-support/chromium-flags"
-    '';
-  };
-
-  # build paths and release info
-  packageName = "chromium";
-  buildType = "Release";
-  buildPath = "out/${buildType}";
-  libExecPath = "$out/libexec/${packageName}";
-  sandboxPath = "${sandbox}/bin/${packageName}_sandbox";
-
-in stdenv.mkDerivation rec {
-  name = "${packageName}-${src.version}";
-  inherit packageName src;
-
-  buildInputs = defaultDependencies ++ [
-    which makeWrapper
-    python perl pkgconfig
-    nspr udev
-    (if useOpenSSL then openssl else nss)
-    utillinux alsaLib
-    gcc bison gperf krb5
-    glib gtk dbus_glib
-    libXScrnSaver libXcursor libXtst mesa
-    pciutils protobuf speechd libXdamage
-    pythonPackages.gyp
-  ] ++ optional gnomeKeyringSupport libgnome_keyring3
-    ++ optionals gnomeSupport [ gconf libgcrypt ]
-    ++ optional enableSELinux libselinux
-    ++ optional cupsSupport libgcrypt
-    ++ optional pulseSupport pulseaudio;
-
-  prePatch = ''
-    # XXX: Figure out a way how to split these properly.
-    #cpflags="-dsr --no-preserve=mode"
-    cpflags="-dr"
-    cp $cpflags "${src.main}"/* .
-    cp $cpflags "${src.bundled}" third_party
-    cp $cpflags "${src.sandbox}" sandbox
-    chmod -R u+w . # XXX!
-  '';
-
-  postPatch = ''
-    sed -i -e '/base::FilePath exe_dir/,/^ *} *$/c \
-      sandbox_binary = \
-        base::FilePath("'"${sandboxPath}"'");
-    ' content/browser/browser_main_loop.cc
-  '';
-
-  gypFlags = mkGypFlags (gypFlagsUseSystemLibs // {
-    linux_use_gold_binary = false;
-    linux_use_gold_flags = false;
-    proprietary_codecs = false;
-    use_gnome_keyring = gnomeKeyringSupport;
-    use_gconf = gnomeSupport;
-    use_gio = gnomeSupport;
-    use_pulseaudio = pulseSupport;
-    disable_nacl = !enableNaCl;
-    use_openssl = useOpenSSL;
-    selinux = enableSELinux;
-    use_cups = cupsSupport;
-    linux_sandbox_path="${sandboxPath}";
-    linux_sandbox_chrome_path="${libExecPath}/${packageName}";
-    werror = "";
-
-    # Google API keys, see http://www.chromium.org/developers/how-tos/api-keys.
-    # Note: These are for NixOS/nixpkgs use ONLY. For your own distribution,
-    # please get your own set of keys.
-    google_api_key = "AIzaSyDGi15Zwl11UNe6Y-5XW_upsfyw31qwZPI";
-    google_default_client_id = "404761575300.apps.googleusercontent.com";
-    google_default_client_secret = "9rIFQjfnkykEmqb6FfjJQD1D";
-
-  } // optionalAttrs proprietaryCodecs {
-    # enable support for the H.264 codec
-    proprietary_codecs = true;
-    ffmpeg_branding = "Chrome";
-  } // optionalAttrs (stdenv.system == "x86_64-linux") {
-    target_arch = "x64";
-    python_arch = "x86-64";
-  } // optionalAttrs (stdenv.system == "i686-linux") {
-    target_arch = "ia32";
-    python_arch = "ia32";
-  });
-
-  configurePhase = ''
-    python build/linux/unbundle/replace_gyp_files.py ${gypFlags}
-    python build/gyp_chromium -f ninja --depth "$(pwd)" ${gypFlags}
-  '';
-
-  buildPhase = let
-    CC = "${gcc}/bin/gcc";
-    CXX = "${gcc}/bin/g++";
-  in ''
-    CC="${CC}" CC_host="${CC}"     \
-    CXX="${CXX}" CXX_host="${CXX}" \
-    LINK_host="${CXX}"             \
-      "${ninja}/bin/ninja" -C "${buildPath}"  \
-        -j$NIX_BUILD_CORES -l$NIX_BUILD_CORES \
-        chrome ${optionalString (!enableSELinux) "chrome_sandbox"}
-  '';
-
-  installPhase = let
-    enabledPlugins = optional enablePepperFlash binaryPlugins.flash
-                  ++ optional enablePepperPDF   binaryPlugins.pdf;
-    getFlags = plugin: "$(< ${plugin}/nix-support/chromium-flags)";
-    pluginArgs = concatStringsSep " " (map getFlags enabledPlugins);
-  in ''
-    ensureDir "${libExecPath}"
-    cp -v "${buildPath}/"*.pak "${libExecPath}/"
-    ${optionalString (!versionOlder src.version "34.0.0.0") ''
-    cp -v "${buildPath}/icudtl.dat" "${libExecPath}/"
-    ''}
-    cp -vR "${buildPath}/locales" "${buildPath}/resources" "${libExecPath}/"
-    cp -v ${buildPath}/libffmpegsumo.so "${libExecPath}/"
-
-    cp -v "${buildPath}/chrome" "${libExecPath}/${packageName}"
-
-    mkdir -vp "$out/bin"
-    makeWrapper "${libExecPath}/${packageName}" "$out/bin/${packageName}" \
-      --add-flags "${pluginArgs}"
-
-    mkdir -vp "$out/share/man/man1"
-    cp -v "${buildPath}/chrome.1" "$out/share/man/man1/${packageName}.1"
-
-    for icon_file in chrome/app/theme/chromium/product_logo_*[0-9].png; do
-      num_and_suffix="''${icon_file##*logo_}"
-      icon_size="''${num_and_suffix%.*}"
-      expr "$icon_size" : "^[0-9][0-9]*$" || continue
-      logo_output_prefix="$out/share/icons/hicolor"
-      logo_output_path="$logo_output_prefix/''${icon_size}x''${icon_size}/apps"
-      mkdir -vp "$logo_output_path"
-      cp -v "$icon_file" "$logo_output_path/${packageName}.png"
-    done
-  '';
-
-  passthru = {
-    inherit sandbox;
-  };
-
-  meta = {
-    description = "An open source web browser from Google";
-    homepage = http://www.chromium.org/;
-    maintainers = with maintainers; [ goibhniu chaoflow aszlig wizeman ];
-    license = licenses.bsd3;
-    platforms = platforms.linux;
-  };
-}
+in chromium.browser
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index fda6cdaa2610..79c1ce219dab 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7739,7 +7739,6 @@ let
 
   chromium = lowPrio (callPackage ../applications/networking/browsers/chromium {
     channel = "stable";
-    gconf = gnome.GConf;
     pulseSupport = config.pulseaudio or true;
   });
 

From 1ae328ba86aeb046ea9220550ef994e6df9a0fd8 Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Wed, 19 Mar 2014 12:51:39 +0100
Subject: [PATCH 15/37] chromium: Factor out source into its own Nix file.

The name is a bit unfortunate, so it would make sense to rename
"sources.nix" into something else.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 .../networking/browsers/chromium/browser.nix  | 86 +++----------------
 .../networking/browsers/chromium/default.nix  |  8 +-
 .../networking/browsers/chromium/source.nix   | 74 ++++++++++++++++
 3 files changed, 92 insertions(+), 76 deletions(-)
 create mode 100644 pkgs/applications/networking/browsers/chromium/source.nix

diff --git a/pkgs/applications/networking/browsers/chromium/browser.nix b/pkgs/applications/networking/browsers/chromium/browser.nix
index e98c47d8cdd8..ee2d29065e6a 100644
--- a/pkgs/applications/networking/browsers/chromium/browser.nix
+++ b/pkgs/applications/networking/browsers/chromium/browser.nix
@@ -19,7 +19,6 @@
 , libgcrypt ? null # gnomeSupport || cupsSupport
 
 # package customization
-, channel ? "stable"
 , enableSELinux ? false, libselinux ? null
 , enableNaCl ? false
 , useOpenSSL ? false, nss ? null, openssl ? null
@@ -30,77 +29,13 @@
 , enablePepperPDF ? false
 , cupsSupport ? false
 , pulseSupport ? false, pulseaudio ? null
+
+, source
 }:
 
 with stdenv.lib;
 
 let
-  src = with getAttr channel (import ./sources.nix); stdenv.mkDerivation {
-    name = "chromium-source-${version}";
-
-    src = fetchurl {
-      inherit url sha256;
-    };
-
-    buildInputs = [ python ]; # cannot patch shebangs otherwise
-
-    phases = [ "unpackPhase" "patchPhase" "installPhase" ];
-
-    opensslPatches = optional useOpenSSL openssl.patches;
-
-    prePatch = "patchShebangs .";
-
-    patches = singleton ./sandbox_userns_31.patch;
-
-    postPatch = ''
-      sed -i -r \
-        -e 's/-f(stack-protector)(-all)?/-fno-\1/' \
-        -e 's|/bin/echo|echo|' \
-        -e "/python_arch/s/: *'[^']*'/: '""'/" \
-        build/common.gypi chrome/chrome_tests.gypi
-      sed -i '/not RunGN/,+1d' build/gyp_chromium
-      sed -i -e 's|/usr/bin/gcc|gcc|' \
-        third_party/WebKit/Source/build/scripts/scripts.gypi \
-        third_party/WebKit/Source/build/scripts/preprocessor.pm
-    '' + optionalString useOpenSSL ''
-      cat $opensslPatches | patch -p1 -d third_party/openssl/openssl
-    '' + optionalString (!versionOlder version "34.0.0.0") ''
-      sed -i '/import.*depot/d' build/gyp_chromium
-    '';
-
-    outputs = [ "out" "sandbox" "bundled" "main" ];
-    installPhase = ''
-      ensureDir "$out" "$sandbox" "$bundled" "$main"
-
-      header "copying browser main sources to $main"
-      find . -mindepth 1 -maxdepth 1 \
-        \! -path ./sandbox \
-        \! -path ./third_party \
-        \! -path ./build \
-        \! -path ./tools \
-        \! -name '.*' \
-        -print | xargs cp -rt "$main"
-      stopNest
-
-      header "copying sandbox components to $sandbox"
-      cp -rt "$sandbox" sandbox/*
-      stopNest
-
-      header "copying third party sources to $bundled"
-      cp -rt "$bundled" third_party/*
-      stopNest
-
-      header "copying build requisites to $out"
-      cp -rt "$out" build tools
-      stopNest
-
-      rm -rf "$out/tools/gyp" # XXX: Don't even copy it in the first place.
-    '';
-
-    passthru = {
-      inherit version;
-    };
-  };
 
   mkGypFlags =
     let
@@ -136,7 +71,7 @@ let
     use_system_libusb = false; # http://crbug.com/266149
     use_system_skia = false;
     use_system_sqlite = false; # http://crbug.com/22208
-    use_system_v8 = !versionOlder src.version "34.0.0.0";
+    use_system_v8 = !versionOlder source.version "34.0.0.0";
   };
 
   defaultDependencies = [
@@ -149,7 +84,7 @@ let
 
   sandbox = import ./sandbox.nix {
     inherit stdenv;
-    src = src.sandbox;
+    src = source.sandbox;
     binary = "${packageName}_sandbox";
   };
 
@@ -223,8 +158,9 @@ let
   sandboxPath = "${sandbox}/bin/${packageName}_sandbox";
 
 in stdenv.mkDerivation rec {
-  name = "${packageName}-${src.version}";
-  inherit packageName src;
+  name = "${packageName}-${source.version}";
+  inherit packageName;
+  src = source;
 
   buildInputs = defaultDependencies ++ [
     which makeWrapper
@@ -248,9 +184,9 @@ in stdenv.mkDerivation rec {
     # XXX: Figure out a way how to split these properly.
     #cpflags="-dsr --no-preserve=mode"
     cpflags="-dr"
-    cp $cpflags "${src.main}"/* .
-    cp $cpflags "${src.bundled}" third_party
-    cp $cpflags "${src.sandbox}" sandbox
+    cp $cpflags "${source.main}"/* .
+    cp $cpflags "${source.bundled}" third_party
+    cp $cpflags "${source.sandbox}" sandbox
     chmod -R u+w . # XXX!
   '';
 
@@ -321,7 +257,7 @@ in stdenv.mkDerivation rec {
   in ''
     ensureDir "${libExecPath}"
     cp -v "${buildPath}/"*.pak "${libExecPath}/"
-    ${optionalString (!versionOlder src.version "34.0.0.0") ''
+    ${optionalString (!versionOlder source.version "34.0.0.0") ''
     cp -v "${buildPath}/icudtl.dat" "${libExecPath}/"
     ''}
     cp -vR "${buildPath}/locales" "${buildPath}/resources" "${libExecPath}/"
diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index bb6f530309ff..c62de9859c31 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -18,8 +18,14 @@ let
   callPackage = newScope chromium;
 
   chromium = {
+    source = callPackage ./source.nix {
+      inherit channel;
+      # XXX: common config
+      inherit useOpenSSL;
+    };
+
     browser = callPackage ./browser.nix {
-      inherit channel enableSELinux enableNaCl useOpenSSL gnomeSupport
+      inherit enableSELinux enableNaCl useOpenSSL gnomeSupport
               gnomeKeyringSupport proprietaryCodecs enablePepperFlash
               enablePepperPDF cupsSupport pulseSupport;
     };
diff --git a/pkgs/applications/networking/browsers/chromium/source.nix b/pkgs/applications/networking/browsers/chromium/source.nix
new file mode 100644
index 000000000000..12a691db633b
--- /dev/null
+++ b/pkgs/applications/networking/browsers/chromium/source.nix
@@ -0,0 +1,74 @@
+{ stdenv, fetchurl, python
+, channel ? "stable"
+, useOpenSSL # XXX
+}:
+
+with stdenv.lib;
+with getAttr channel (import ./sources.nix);
+
+stdenv.mkDerivation {
+  name = "chromium-source-${version}";
+
+  src = fetchurl {
+    inherit url sha256;
+  };
+
+  buildInputs = [ python ]; # cannot patch shebangs otherwise
+
+  phases = [ "unpackPhase" "patchPhase" "installPhase" ];
+
+  opensslPatches = optional useOpenSSL openssl.patches;
+
+  prePatch = "patchShebangs .";
+
+  patches = singleton ./sandbox_userns_31.patch;
+
+  postPatch = ''
+    sed -i -r \
+      -e 's/-f(stack-protector)(-all)?/-fno-\1/' \
+      -e 's|/bin/echo|echo|' \
+      -e "/python_arch/s/: *'[^']*'/: '""'/" \
+      build/common.gypi chrome/chrome_tests.gypi
+    sed -i '/not RunGN/,+1d' build/gyp_chromium
+    sed -i -e 's|/usr/bin/gcc|gcc|' \
+      third_party/WebKit/Source/build/scripts/scripts.gypi \
+      third_party/WebKit/Source/build/scripts/preprocessor.pm
+  '' + optionalString useOpenSSL ''
+    cat $opensslPatches | patch -p1 -d third_party/openssl/openssl
+  '' + optionalString (!versionOlder version "34.0.0.0") ''
+    sed -i '/import.*depot/d' build/gyp_chromium
+  '';
+
+  outputs = [ "out" "sandbox" "bundled" "main" ];
+  installPhase = ''
+    ensureDir "$out" "$sandbox" "$bundled" "$main"
+
+    header "copying browser main sources to $main"
+    find . -mindepth 1 -maxdepth 1 \
+      \! -path ./sandbox \
+      \! -path ./third_party \
+      \! -path ./build \
+      \! -path ./tools \
+      \! -name '.*' \
+      -print | xargs cp -rt "$main"
+    stopNest
+
+    header "copying sandbox components to $sandbox"
+    cp -rt "$sandbox" sandbox/*
+    stopNest
+
+    header "copying third party sources to $bundled"
+    cp -rt "$bundled" third_party/*
+    stopNest
+
+    header "copying build requisites to $out"
+    cp -rt "$out" build tools
+    stopNest
+
+    rm -rf "$out/tools/gyp" # XXX: Don't even copy it in the first place.
+  '';
+
+  passthru = {
+    inherit version;
+  };
+}

From 16af058ff9d41416eab5937c1c4b534ba464f842 Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Wed, 19 Mar 2014 12:57:49 +0100
Subject: [PATCH 16/37] chromium: Move plugins into its own Nix file.

We now no longer pass enablePepperFlash and enablePepperPDF to the
browser package itself and only use plugins.flagsEnabled from there.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 .../networking/browsers/chromium/browser.nix  | 74 +-----------------
 .../networking/browsers/chromium/default.nix  |  8 +-
 .../networking/browsers/chromium/plugins.nix  | 78 +++++++++++++++++++
 3 files changed, 87 insertions(+), 73 deletions(-)
 create mode 100644 pkgs/applications/networking/browsers/chromium/plugins.nix

diff --git a/pkgs/applications/networking/browsers/chromium/browser.nix b/pkgs/applications/networking/browsers/chromium/browser.nix
index ee2d29065e6a..94fa002ab20d 100644
--- a/pkgs/applications/networking/browsers/chromium/browser.nix
+++ b/pkgs/applications/networking/browsers/chromium/browser.nix
@@ -25,12 +25,11 @@
 , gnomeSupport ? false, gnome ? null
 , gnomeKeyringSupport ? false, libgnome_keyring3 ? null
 , proprietaryCodecs ? true
-, enablePepperFlash ? false
-, enablePepperPDF ? false
 , cupsSupport ? false
 , pulseSupport ? false, pulseaudio ? null
 
 , source
+, plugins
 }:
 
 with stdenv.lib;
@@ -88,68 +87,6 @@ let
     binary = "${packageName}_sandbox";
   };
 
-  binaryPlugins = stdenv.mkDerivation {
-    name = "chromium-binary-plugins";
-
-    # XXX: Only temporary and has to be version-specific
-    src = fetchurl {
-      url = "https://dl.google.com/linux/chrome/deb/pool/main/g/"
-          + "google-chrome-unstable/google-chrome-unstable_"
-          + "35.0.1897.2-1_amd64.deb";
-      sha1 = "b68683fc5321d10536e4135c266b14894b7668ed";
-    };
-
-    phases = [ "unpackPhase" "patchPhase" "checkPhase" "installPhase" ];
-    outputs = [ "pdf" "flash" ];
-
-    unpackCmd = ''
-      ensureDir plugins
-      ar p "$src" data.tar.lzma | tar xJ -C plugins --strip-components=4 \
-        ./opt/google/chrome-unstable/PepperFlash \
-        ./opt/google/chrome-unstable/libpdf.so
-    '';
-
-    doCheck = true;
-    checkPhase = ''
-      ! find -iname '*.so' -exec ldd {} + | grep 'not found'
-    '';
-
-    patchPhase = let
-      rpaths = [ stdenv.gcc.gcc ];
-      mkrpath = p: "${makeSearchPath "lib64" p}:${makeSearchPath "lib" p}";
-    in ''
-      for sofile in PepperFlash/libpepflashplayer.so libpdf.so; do
-        chmod +x "$sofile"
-        patchelf --set-rpath "${mkrpath rpaths}" "$sofile"
-      done
-    '';
-
-    installPhase = let
-      pdfName = "Chrome PDF Viewer";
-      pdfDescription = "Portable Document Format";
-      pdfMimeTypes = concatStringsSep ";" [
-        "application/pdf"
-        "application/x-google-chrome-print-preview-pdf"
-      ];
-      pdfInfo = "#${pdfName}#${pdfDescription};${pdfMimeTypes}";
-    in ''
-      install -vD libpdf.so "$pdf/lib/libpdf.so"
-      ensureDir "$pdf/nix-support"
-      echo "--register-pepper-plugins='$pdf/lib/libpdf.so${pdfInfo}'" \
-        > "$pdf/nix-support/chromium-flags"
-
-      flashVersion="$(
-        sed -n -r 's/.*"version": "([^"]+)",.*/\1/p' PepperFlash/manifest.json
-      )"
-
-      install -vD libpepflashplayer.so "$flash/lib/libpepflashplayer.so"
-      ensureDir "$flash/nix-support"
-      echo "--ppapi-flash-path='$flash/lib/libpepflashplayer.so'" \
-           "--ppapi-flash-version=$flashVersion" \
-           > "$flash/nix-support/chromium-flags"
-    '';
-  };
-
   # build paths and release info
   packageName = "chromium";
   buildType = "Release";
@@ -249,12 +186,7 @@ in stdenv.mkDerivation rec {
         chrome ${optionalString (!enableSELinux) "chrome_sandbox"}
   '';
 
-  installPhase = let
-    enabledPlugins = optional enablePepperFlash binaryPlugins.flash
-                  ++ optional enablePepperPDF   binaryPlugins.pdf;
-    getFlags = plugin: "$(< ${plugin}/nix-support/chromium-flags)";
-    pluginArgs = concatStringsSep " " (map getFlags enabledPlugins);
-  in ''
+  installPhase = ''
     ensureDir "${libExecPath}"
     cp -v "${buildPath}/"*.pak "${libExecPath}/"
     ${optionalString (!versionOlder source.version "34.0.0.0") ''
@@ -267,7 +199,7 @@ in stdenv.mkDerivation rec {
 
     mkdir -vp "$out/bin"
     makeWrapper "${libExecPath}/${packageName}" "$out/bin/${packageName}" \
-      --add-flags "${pluginArgs}"
+      --add-flags "${plugins.flagsEnabled}"
 
     mkdir -vp "$out/share/man/man1"
     cp -v "${buildPath}/chrome.1" "$out/share/man/man1/${packageName}.1"
diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index c62de9859c31..be525aa3c8eb 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -26,8 +26,12 @@ let
 
     browser = callPackage ./browser.nix {
       inherit enableSELinux enableNaCl useOpenSSL gnomeSupport
-              gnomeKeyringSupport proprietaryCodecs enablePepperFlash
-              enablePepperPDF cupsSupport pulseSupport;
+              gnomeKeyringSupport proprietaryCodecs cupsSupport
+              pulseSupport;
+    };
+
+    plugins = callPackage ./plugins.nix {
+      inherit enablePepperFlash enablePepperPDF;
     };
   };
 
diff --git a/pkgs/applications/networking/browsers/chromium/plugins.nix b/pkgs/applications/networking/browsers/chromium/plugins.nix
new file mode 100644
index 000000000000..04af90be1283
--- /dev/null
+++ b/pkgs/applications/networking/browsers/chromium/plugins.nix
@@ -0,0 +1,78 @@
+{ stdenv
+, enablePepperFlash ? false
+, enablePepperPDF ? false
+, fetchurl # XXX
+}:
+
+with stdenv.lib;
+
+let
+  plugins = stdenv.mkDerivation {
+    name = "chromium-binary-plugins";
+
+    # XXX: Only temporary and has to be version-specific
+    src = fetchurl {
+      url = "https://dl.google.com/linux/chrome/deb/pool/main/g/"
+          + "google-chrome-unstable/google-chrome-unstable_"
+          + "35.0.1897.2-1_amd64.deb";
+      sha1 = "b68683fc5321d10536e4135c266b14894b7668ed";
+    };
+
+    phases = [ "unpackPhase" "patchPhase" "checkPhase" "installPhase" ];
+    outputs = [ "pdf" "flash" ];
+
+    unpackCmd = ''
+      ensureDir plugins
+      ar p "$src" data.tar.lzma | tar xJ -C plugins --strip-components=4 \
+        ./opt/google/chrome-unstable/PepperFlash \
+        ./opt/google/chrome-unstable/libpdf.so
+    '';
+
+    doCheck = true;
+    checkPhase = ''
+      ! find -iname '*.so' -exec ldd {} + | grep 'not found'
+    '';
+
+    patchPhase = let
+      rpaths = [ stdenv.gcc.gcc ];
+      mkrpath = p: "${makeSearchPath "lib64" p}:${makeSearchPath "lib" p}";
+    in ''
+      for sofile in PepperFlash/libpepflashplayer.so libpdf.so; do
+        chmod +x "$sofile"
+        patchelf --set-rpath "${mkrpath rpaths}" "$sofile"
+      done
+    '';
+
+    installPhase = let
+      pdfName = "Chrome PDF Viewer";
+      pdfDescription = "Portable Document Format";
+      pdfMimeTypes = concatStringsSep ";" [
+        "application/pdf"
+        "application/x-google-chrome-print-preview-pdf"
+      ];
+      pdfInfo = "#${pdfName}#${pdfDescription};${pdfMimeTypes}";
+    in ''
+      install -vD libpdf.so "$pdf/lib/libpdf.so"
+      ensureDir "$pdf/nix-support"
+      echo "--register-pepper-plugins='$pdf/lib/libpdf.so${pdfInfo}'" \
+        > "$pdf/nix-support/chromium-flags"
+
+      flashVersion="$(
+        sed -n -r 's/.*"version": "([^"]+)",.*/\1/p' PepperFlash/manifest.json
+      )"
+
+      install -vD PepperFlash/libpepflashplayer.so \
+        "$flash/lib/libpepflashplayer.so"
+      ensureDir "$flash/nix-support"
+      echo "--ppapi-flash-path='$flash/lib/libpepflashplayer.so'" \
+           "--ppapi-flash-version=$flashVersion" \
+           > "$flash/nix-support/chromium-flags"
+    '';
+
+    passthru.flagsEnabled = let
+      enabledPlugins = optional enablePepperFlash plugins.flash
+                    ++ optional enablePepperPDF   plugins.pdf;
+      getFlags = plugin: "$(< ${plugin}/nix-support/chromium-flags)";
+    in concatStringsSep " " (map getFlags enabledPlugins);
+  };
+in plugins

From c86d376c82c33a8184bb74ea437732ee0b6e4492 Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Sat, 22 Mar 2014 15:39:26 +0100
Subject: [PATCH 17/37] chromium: Selectively link bundled libraries.

So far we just copied everything from source.* into the build directory
during the prePatch. This somewhat defeated the purpose of the source
splitup because it involved more I/O than just unpacking the entire
source tree.

Now, we're selectively *symlinking* the bundled sources into the build
directory. Even that isn't perfect because in the end we'd just
reference foreign derivations and we're done. But for now, this gets us
at least prepared for a massive reduction of compile time.

Unfortunately, gyp's behaviour when it comes to symlinks is quite
painful to come by, so we need to fix a few references to use absolute
paths.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 .../networking/browsers/chromium/browser.nix  | 116 ++++++++++++++++--
 1 file changed, 107 insertions(+), 9 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/browser.nix b/pkgs/applications/networking/browsers/chromium/browser.nix
index 94fa002ab20d..1954b392d17a 100644
--- a/pkgs/applications/networking/browsers/chromium/browser.nix
+++ b/pkgs/applications/networking/browsers/chromium/browser.nix
@@ -117,14 +117,113 @@ in stdenv.mkDerivation rec {
     ++ optional cupsSupport libgcrypt
     ++ optional pulseSupport pulseaudio;
 
-  prePatch = ''
-    # XXX: Figure out a way how to split these properly.
-    #cpflags="-dsr --no-preserve=mode"
-    cpflags="-dr"
-    cp $cpflags "${source.main}"/* .
-    cp $cpflags "${source.bundled}" third_party
-    cp $cpflags "${source.sandbox}" sandbox
-    chmod -R u+w . # XXX!
+  prePatch = let
+    lntree = [ "cp" "-dsr" "--no-preserve=mode" ];
+    lntreeList = concatStringsSep ", " (map (arg: "'${arg}'") lntree);
+    lntreeSh = concatStringsSep " " lntree;
+  in ''
+    ${lntreeSh} "${source.main}"/* .
+    ${lntreeSh} "${source.sandbox}" sandbox
+
+    ensureDir third_party
+
+    # ONLY the dependencies we can't use from nixpkgs!
+    for bundled in ${concatStringsSep " " [
+      # This is in preparation of splitting up the bundled sources into separate
+      # derivations so we some day can tremendously reduce build time.
+      "adobe"
+      "angle"
+      "cacheinvalidation"
+      "cld_2"
+      "codesighs"
+      "cros_dbus_cplusplus"
+      "cros_system_api"
+      "flot"
+      "freetype2"
+      "hunspell"
+      "iccjpeg"
+      "jinja2"
+      "JSON"
+      "jstemplate"
+      "khronos"
+      "leveldatabase"
+      "libaddressinput"
+      "libjingle"
+      "libmtp"
+      "libphonenumber"
+      "libsrtp"
+      "libXNVCtrl"
+      "libyuv"
+      "lss"
+      "lzma_sdk"
+      "markupsafe"
+      "mesa"
+      "modp_b64"
+      "mt19937ar"
+      "mtpd"
+      "npapi"
+      "ots"
+      "ply"
+      "protobuf"
+      "qcms"
+      "readability"
+      "safe_browsing"
+      "sfntly"
+      "skia"
+      "smhasher"
+      "speech-dispatcher"
+      "tcmalloc"
+      "trace-viewer"
+      "undoview"
+      "usb_ids"
+      "usrsctp"
+      "WebKit"
+      "webrtc"
+      "widevine"
+      "x86inc"
+      "yasm"
+    ]}; do
+      echo -n "Linking ${source.bundled}/$bundled to third_party/..." >&2
+      ${lntreeSh} "${source.bundled}/$bundled" third_party/
+      echo " done." >&2
+    done
+
+    # Everything else is decided based on gypFlags.
+    PYTHONPATH="build/linux/unbundle:$PYTHONPATH" python <<PYTHON
+    import os, sys, subprocess
+    from replace_gyp_files import REPLACEMENTS
+    for flag, path in REPLACEMENTS.items():
+      if path.startswith("v8/"):
+        continue
+      if "-D{0}=1".format(flag) in os.environ.get('gypFlags'):
+        target = os.path.join("build/linux/unbundle", os.path.basename(path))
+        dest = path
+      else:
+        target_base = os.path.basename(os.path.dirname(path))
+        target = os.path.join("${source.bundled}", target_base)
+        dest = os.path.join("third_party", target_base)
+      try:
+        os.makedirs(os.path.dirname(dest))
+      except:
+        pass
+      sys.stderr.write("Linking {0} to {1}...".format(target, dest))
+      subprocess.check_call([${lntreeList}, os.path.abspath(target), dest])
+      sys.stderr.write(" done.\n")
+    PYTHON
+
+    # Auxilliary files needed in unbundled trees
+    ${lntreeSh} "${source.bundled}/libxml/chromium" third_party/libxml/chromium
+    ${lntreeSh} "${source.bundled}/zlib/google" third_party/zlib/google
+
+    find -iname '*.gyp*' \( -type f -o -type l \) \
+      -exec sed -i -e 's|<(DEPTH)|'"$(pwd)"'|g' {} +
+
+    # XXX: Really ugly workaround to fix improper symlink dereference.
+    sed -i -e '/args\['"'"'name'"'"'\] *= *parts\[0\]$/ {
+      s|$|.split("-bundled/WebKit/Source/", 1)[1] |;
+      s|$|if parts[0].startswith("../") else parts[0]|;
+    }' third_party/WebKit/Source/build/scripts/in_file.py \
+       third_party/WebKit/Source/build/scripts/make_event_factory.py
   '';
 
   postPatch = ''
@@ -170,7 +269,6 @@ in stdenv.mkDerivation rec {
   });
 
   configurePhase = ''
-    python build/linux/unbundle/replace_gyp_files.py ${gypFlags}
     python build/gyp_chromium -f ninja --depth "$(pwd)" ${gypFlags}
   '';
 

From 5021717099d7482ba4e68bb497b0a0868d0a185b Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Sat, 22 Mar 2014 17:05:14 +0100
Subject: [PATCH 18/37] chromium: Split off sandbox from the browser.

Now, we no longer tie the sandbox directly to the browser derivation but
wrap everything together into one derivation at the entry point at
default.nix.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 .../networking/browsers/chromium/browser.nix  | 27 ++++---------------
 .../networking/browsers/chromium/default.nix  | 21 +++++++++++++--
 .../networking/browsers/chromium/sandbox.nix  |  8 +++---
 3 files changed, 28 insertions(+), 28 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/browser.nix b/pkgs/applications/networking/browsers/chromium/browser.nix
index 1954b392d17a..558054bba412 100644
--- a/pkgs/applications/networking/browsers/chromium/browser.nix
+++ b/pkgs/applications/networking/browsers/chromium/browser.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, makeWrapper, ninja, which
+{ stdenv, fetchurl, ninja, which
 
 # default dependencies
 , bzip2, flac, speex, icu, libopus
@@ -81,26 +81,19 @@ let
     libusb1 libexif
   ];
 
-  sandbox = import ./sandbox.nix {
-    inherit stdenv;
-    src = source.sandbox;
-    binary = "${packageName}_sandbox";
-  };
-
   # build paths and release info
   packageName = "chromium";
   buildType = "Release";
   buildPath = "out/${buildType}";
   libExecPath = "$out/libexec/${packageName}";
-  sandboxPath = "${sandbox}/bin/${packageName}_sandbox";
 
 in stdenv.mkDerivation rec {
-  name = "${packageName}-${source.version}";
+  name = "${packageName}-browser-${source.version}";
   inherit packageName;
   src = source;
 
   buildInputs = defaultDependencies ++ [
-    which makeWrapper
+    which
     python perl pkgconfig
     nspr udev
     (if useOpenSSL then openssl else nss)
@@ -228,8 +221,7 @@ in stdenv.mkDerivation rec {
 
   postPatch = ''
     sed -i -e '/base::FilePath exe_dir/,/^ *} *$/c \
-      sandbox_binary = \
-        base::FilePath("'"${sandboxPath}"'");
+      sandbox_binary = base::FilePath(getenv("CHROMIUM_SANDBOX_BINARY_PATH"));
     ' content/browser/browser_main_loop.cc
   '';
 
@@ -245,7 +237,6 @@ in stdenv.mkDerivation rec {
     use_openssl = useOpenSSL;
     selinux = enableSELinux;
     use_cups = cupsSupport;
-    linux_sandbox_path="${sandboxPath}";
     linux_sandbox_chrome_path="${libExecPath}/${packageName}";
     werror = "";
 
@@ -281,7 +272,7 @@ in stdenv.mkDerivation rec {
     LINK_host="${CXX}"             \
       "${ninja}/bin/ninja" -C "${buildPath}"  \
         -j$NIX_BUILD_CORES -l$NIX_BUILD_CORES \
-        chrome ${optionalString (!enableSELinux) "chrome_sandbox"}
+        chrome
   '';
 
   installPhase = ''
@@ -295,10 +286,6 @@ in stdenv.mkDerivation rec {
 
     cp -v "${buildPath}/chrome" "${libExecPath}/${packageName}"
 
-    mkdir -vp "$out/bin"
-    makeWrapper "${libExecPath}/${packageName}" "$out/bin/${packageName}" \
-      --add-flags "${plugins.flagsEnabled}"
-
     mkdir -vp "$out/share/man/man1"
     cp -v "${buildPath}/chrome.1" "$out/share/man/man1/${packageName}.1"
 
@@ -313,10 +300,6 @@ in stdenv.mkDerivation rec {
     done
   '';
 
-  passthru = {
-    inherit sandbox;
-  };
-
   meta = {
     description = "An open source web browser from Google";
     homepage = http://www.chromium.org/;
diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index be525aa3c8eb..ca802770b6b9 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -1,4 +1,4 @@
-{ newScope
+{ newScope, stdenv, makeWrapper
 
 # package customization
 , channel ? "stable"
@@ -30,9 +30,26 @@ let
               pulseSupport;
     };
 
+    sandbox = callPackage ./sandbox.nix { };
+
     plugins = callPackage ./plugins.nix {
       inherit enablePepperFlash enablePepperPDF;
     };
   };
 
-in chromium.browser
+in stdenv.mkDerivation {
+  name = "chromium-${channel}-${chromium.source.version}";
+
+  buildInputs = [ makeWrapper ];
+
+  buildCommand = let
+    browserBinary = "${chromium.browser}/libexec/chromium/chromium";
+    sandboxBinary = "${chromium.sandbox}/bin/chromium-sandbox";
+  in ''
+    ensureDir "$out/bin"
+    ln -s "${chromium.browser}/share" "$out/share"
+    makeWrapper "${browserBinary}" "$out/bin/chromium" \
+      --set CHROMIUM_SANDBOX_BINARY_PATH "${sandboxBinary}" \
+      --add-flags "${chromium.plugins.flagsEnabled}"
+  '';
+}
diff --git a/pkgs/applications/networking/browsers/chromium/sandbox.nix b/pkgs/applications/networking/browsers/chromium/sandbox.nix
index b43385e86338..81ae49ebbb82 100644
--- a/pkgs/applications/networking/browsers/chromium/sandbox.nix
+++ b/pkgs/applications/networking/browsers/chromium/sandbox.nix
@@ -1,8 +1,8 @@
-{ stdenv, src, binary }:
+{ stdenv, source }:
 
 stdenv.mkDerivation {
-  name = "chromium-sandbox-${src.version}";
-  inherit src;
+  name = "chromium-sandbox-${source.version}";
+  src = source.sandbox;
 
   patchPhase = ''
     sed -i -e '/#include.*base_export/c \
@@ -15,6 +15,6 @@ stdenv.mkDerivation {
   '';
 
   installPhase = ''
-    install -svD sandbox "$out/bin/${binary}"
+    install -svD sandbox "$out/bin/chromium-sandbox"
   '';
 }

From d8ba5b3eff0075cf971315873696ab263ad5df48 Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Sat, 22 Mar 2014 18:22:46 +0100
Subject: [PATCH 19/37] chromium: Add bundled dependencies for dev/beta.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 .../networking/browsers/chromium/browser.nix             | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/browser.nix b/pkgs/applications/networking/browsers/chromium/browser.nix
index 558054bba412..66e2522bf135 100644
--- a/pkgs/applications/networking/browsers/chromium/browser.nix
+++ b/pkgs/applications/networking/browsers/chromium/browser.nix
@@ -121,7 +121,7 @@ in stdenv.mkDerivation rec {
     ensureDir third_party
 
     # ONLY the dependencies we can't use from nixpkgs!
-    for bundled in ${concatStringsSep " " [
+    for bundled in ${concatStringsSep " " ([
       # This is in preparation of splitting up the bundled sources into separate
       # derivations so we some day can tremendously reduce build time.
       "adobe"
@@ -175,7 +175,12 @@ in stdenv.mkDerivation rec {
       "widevine"
       "x86inc"
       "yasm"
-    ]}; do
+    ] ++ optionals (!versionOlder source.version "34.0.0.0") [
+      "brotli"
+      "libwebm"
+      "nss.isolate"
+      "polymer"
+    ])}; do
       echo -n "Linking ${source.bundled}/$bundled to third_party/..." >&2
       ${lntreeSh} "${source.bundled}/$bundled" third_party/
       echo " done." >&2

From cce984b32464d3a579ac690c6bddb8541f0623c9 Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Sun, 23 Mar 2014 16:29:07 +0100
Subject: [PATCH 20/37] chromium: Correct tools path in blink_idl_parser.

This is because of our symlink mess, as Chromium's build support scripts
are trying to resolve everything based on absolute paths and we split
off the bundled sources from the main derivation.

Yes, I'm refering to this as a mess, because in the end, we're going to
patch up the gyp files and use references someday.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 .../applications/networking/browsers/chromium/browser.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/applications/networking/browsers/chromium/browser.nix b/pkgs/applications/networking/browsers/chromium/browser.nix
index 66e2522bf135..321c03a3edea 100644
--- a/pkgs/applications/networking/browsers/chromium/browser.nix
+++ b/pkgs/applications/networking/browsers/chromium/browser.nix
@@ -222,6 +222,14 @@ in stdenv.mkDerivation rec {
       s|$|if parts[0].startswith("../") else parts[0]|;
     }' third_party/WebKit/Source/build/scripts/in_file.py \
        third_party/WebKit/Source/build/scripts/make_event_factory.py
+  '' + optionalString (!versionOlder source.version "35.0.0.0") ''
+    # Transform symlinks into plain files
+    sed -i -e "" third_party/jinja2/__init__.py \
+                 third_party/jinja2/environment.py \
+                 third_party/WebKit/Source/bindings/scripts/idl_compiler.py
+
+    sed -i -e '/tools_dir *=/s|=.*|= "'"$(pwd)"'/tools"|' \
+      third_party/WebKit/Source/bindings/scripts/blink_idl_parser.py
   '';
 
   postPatch = ''

From c6fa73b26c995c72aef0971f7b411ddb75f64308 Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Sun, 23 Mar 2014 19:48:53 +0100
Subject: [PATCH 21/37] chromium: Propagate browser's meta to the wrapper.

We obviously don't want the Hydra job of nixpkgs to fail, so we need to
make sure that we have a proper meta attribute on the outermost
derivation.

For builds based on the Chromium source tree (like for example libcef),
we can still move the wrapper elsewhere when we need it.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 pkgs/applications/networking/browsers/chromium/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index ca802770b6b9..2a2490555e51 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -52,4 +52,6 @@ in stdenv.mkDerivation {
       --set CHROMIUM_SANDBOX_BINARY_PATH "${sandboxBinary}" \
       --add-flags "${chromium.plugins.flagsEnabled}"
   '';
+
+  inherit (chromium.browser) meta;
 }

From eadbf855b0498ea8d75fd3a69e36f48271032a59 Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Mon, 24 Mar 2014 03:20:12 +0100
Subject: [PATCH 22/37] chromium: Revert back to copying bundled sources.

I'm giving up on this after several attempts to correctly unbundle the
largest part, namely Google's WebKit fork Blink. Right now it's so much
tied into the Chromium source it's going to be fairly hard to do if
you're not working full time on it.

Also, the intermediate steps needed to do this properly would introduce
uneccesary complexity on our side, so we really need to finish this
without leaving it in the "messy" state in order to not make Chromium
even more difficult to maintain than it is already.

However, anyone who wants to proceed on this messy step is free to
revert this commit and continue doing so. In my case I'm going to try
again once https://crbug.com/239107 and https://crbug.com/239181 are
fixed in _stable_ (I don't want to introduce *lots* of conditionals on
the version either).

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 .../networking/browsers/chromium/browser.nix  | 130 ++----------------
 1 file changed, 12 insertions(+), 118 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/browser.nix b/pkgs/applications/networking/browsers/chromium/browser.nix
index 321c03a3edea..34e8347b2d66 100644
--- a/pkgs/applications/networking/browsers/chromium/browser.nix
+++ b/pkgs/applications/networking/browsers/chromium/browser.nix
@@ -110,126 +110,19 @@ in stdenv.mkDerivation rec {
     ++ optional cupsSupport libgcrypt
     ++ optional pulseSupport pulseaudio;
 
-  prePatch = let
-    lntree = [ "cp" "-dsr" "--no-preserve=mode" ];
-    lntreeList = concatStringsSep ", " (map (arg: "'${arg}'") lntree);
-    lntreeSh = concatStringsSep " " lntree;
-  in ''
-    ${lntreeSh} "${source.main}"/* .
-    ${lntreeSh} "${source.sandbox}" sandbox
-
-    ensureDir third_party
-
-    # ONLY the dependencies we can't use from nixpkgs!
-    for bundled in ${concatStringsSep " " ([
-      # This is in preparation of splitting up the bundled sources into separate
-      # derivations so we some day can tremendously reduce build time.
-      "adobe"
-      "angle"
-      "cacheinvalidation"
-      "cld_2"
-      "codesighs"
-      "cros_dbus_cplusplus"
-      "cros_system_api"
-      "flot"
-      "freetype2"
-      "hunspell"
-      "iccjpeg"
-      "jinja2"
-      "JSON"
-      "jstemplate"
-      "khronos"
-      "leveldatabase"
-      "libaddressinput"
-      "libjingle"
-      "libmtp"
-      "libphonenumber"
-      "libsrtp"
-      "libXNVCtrl"
-      "libyuv"
-      "lss"
-      "lzma_sdk"
-      "markupsafe"
-      "mesa"
-      "modp_b64"
-      "mt19937ar"
-      "mtpd"
-      "npapi"
-      "ots"
-      "ply"
-      "protobuf"
-      "qcms"
-      "readability"
-      "safe_browsing"
-      "sfntly"
-      "skia"
-      "smhasher"
-      "speech-dispatcher"
-      "tcmalloc"
-      "trace-viewer"
-      "undoview"
-      "usb_ids"
-      "usrsctp"
-      "WebKit"
-      "webrtc"
-      "widevine"
-      "x86inc"
-      "yasm"
-    ] ++ optionals (!versionOlder source.version "34.0.0.0") [
-      "brotli"
-      "libwebm"
-      "nss.isolate"
-      "polymer"
-    ])}; do
-      echo -n "Linking ${source.bundled}/$bundled to third_party/..." >&2
-      ${lntreeSh} "${source.bundled}/$bundled" third_party/
-      echo " done." >&2
-    done
-
-    # Everything else is decided based on gypFlags.
-    PYTHONPATH="build/linux/unbundle:$PYTHONPATH" python <<PYTHON
-    import os, sys, subprocess
-    from replace_gyp_files import REPLACEMENTS
-    for flag, path in REPLACEMENTS.items():
-      if path.startswith("v8/"):
-        continue
-      if "-D{0}=1".format(flag) in os.environ.get('gypFlags'):
-        target = os.path.join("build/linux/unbundle", os.path.basename(path))
-        dest = path
-      else:
-        target_base = os.path.basename(os.path.dirname(path))
-        target = os.path.join("${source.bundled}", target_base)
-        dest = os.path.join("third_party", target_base)
-      try:
-        os.makedirs(os.path.dirname(dest))
-      except:
-        pass
-      sys.stderr.write("Linking {0} to {1}...".format(target, dest))
-      subprocess.check_call([${lntreeList}, os.path.abspath(target), dest])
-      sys.stderr.write(" done.\n")
-    PYTHON
-
-    # Auxilliary files needed in unbundled trees
-    ${lntreeSh} "${source.bundled}/libxml/chromium" third_party/libxml/chromium
-    ${lntreeSh} "${source.bundled}/zlib/google" third_party/zlib/google
+  # XXX: Wait for https://crbug.com/239107 and https://crbug.com/239181 to
+  #      be fixed, then try again to unbundle everything into separate
+  #      derivations.
+  prePatch = ''
+    cp -dsr --no-preserve=mode "${source.main}"/* .
+    cp -dsr --no-preserve=mode "${source.sandbox}" sandbox
+    cp -dr "${source.bundled}" third_party
+    chmod -R u+w third_party
 
+    # Hardcode source tree root in all gyp files
     find -iname '*.gyp*' \( -type f -o -type l \) \
-      -exec sed -i -e 's|<(DEPTH)|'"$(pwd)"'|g' {} +
-
-    # XXX: Really ugly workaround to fix improper symlink dereference.
-    sed -i -e '/args\['"'"'name'"'"'\] *= *parts\[0\]$/ {
-      s|$|.split("-bundled/WebKit/Source/", 1)[1] |;
-      s|$|if parts[0].startswith("../") else parts[0]|;
-    }' third_party/WebKit/Source/build/scripts/in_file.py \
-       third_party/WebKit/Source/build/scripts/make_event_factory.py
-  '' + optionalString (!versionOlder source.version "35.0.0.0") ''
-    # Transform symlinks into plain files
-    sed -i -e "" third_party/jinja2/__init__.py \
-                 third_party/jinja2/environment.py \
-                 third_party/WebKit/Source/bindings/scripts/idl_compiler.py
-
-    sed -i -e '/tools_dir *=/s|=.*|= "'"$(pwd)"'/tools"|' \
-      third_party/WebKit/Source/bindings/scripts/blink_idl_parser.py
+      -exec sed -i -e 's|<(DEPTH)|'"$(pwd)"'|g' {} + \
+      -exec chmod u+w {} +
   '';
 
   postPatch = ''
@@ -273,6 +166,7 @@ in stdenv.mkDerivation rec {
   });
 
   configurePhase = ''
+    python build/linux/unbundle/replace_gyp_files.py ${gypFlags}
     python build/gyp_chromium -f ninja --depth "$(pwd)" ${gypFlags}
   '';
 

From 202755ca2f23889af8456286aea0b7f52b9f5175 Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Mon, 24 Mar 2014 12:02:49 +0100
Subject: [PATCH 23/37] chromium: Properly pass packageName and version.

We don't want ta have the source derivation in the runtime dependencies
of the browser itself. Also, we've broken the Firefox wrapper, because
we've no longer exposed the packageName attribute.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 pkgs/applications/networking/browsers/chromium/browser.nix | 5 +++--
 pkgs/applications/networking/browsers/chromium/default.nix | 4 ++--
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/browser.nix b/pkgs/applications/networking/browsers/chromium/browser.nix
index 34e8347b2d66..3b45ff78206c 100644
--- a/pkgs/applications/networking/browsers/chromium/browser.nix
+++ b/pkgs/applications/networking/browsers/chromium/browser.nix
@@ -88,7 +88,8 @@ let
   libExecPath = "$out/libexec/${packageName}";
 
 in stdenv.mkDerivation rec {
-  name = "${packageName}-browser-${source.version}";
+  name = "${packageName}-browser-${version}";
+  inherit (source) version;
   inherit packageName;
   src = source;
 
@@ -185,7 +186,7 @@ in stdenv.mkDerivation rec {
   installPhase = ''
     ensureDir "${libExecPath}"
     cp -v "${buildPath}/"*.pak "${libExecPath}/"
-    ${optionalString (!versionOlder source.version "34.0.0.0") ''
+    ${optionalString (!versionOlder version "34.0.0.0") ''
     cp -v "${buildPath}/icudtl.dat" "${libExecPath}/"
     ''}
     cp -vR "${buildPath}/locales" "${buildPath}/resources" "${libExecPath}/"
diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index 2a2490555e51..d47c9c89eb07 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -38,7 +38,7 @@ let
   };
 
 in stdenv.mkDerivation {
-  name = "chromium-${channel}-${chromium.source.version}";
+  name = "chromium-${channel}-${chromium.browser.version}";
 
   buildInputs = [ makeWrapper ];
 
@@ -53,5 +53,5 @@ in stdenv.mkDerivation {
       --add-flags "${chromium.plugins.flagsEnabled}"
   '';
 
-  inherit (chromium.browser) meta;
+  inherit (chromium.browser) meta packageName;
 }

From 4c8ec5e12e187347fd97b1a1a9a43eb19e009ed0 Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Mon, 24 Mar 2014 13:45:21 +0100
Subject: [PATCH 24/37] v8: Bring back old version 3.14.

The current version of v8 breaks builds of nodejs, mongodb and
rethinkdb. So let's bring back the old package with annoying _3_14
version suffix so hopefully the corresponding maintainers will get rid
of that dependency :-)

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 pkgs/development/libraries/v8/3.14.nix   | 65 ++++++++++++++++++++++++
 pkgs/development/web/nodejs/default.nix  |  4 +-
 pkgs/servers/nosql/mongodb/default.nix   |  4 +-
 pkgs/servers/nosql/rethinkdb/default.nix |  4 +-
 pkgs/top-level/all-packages.nix          |  8 ++-
 5 files changed, 78 insertions(+), 7 deletions(-)
 create mode 100644 pkgs/development/libraries/v8/3.14.nix

diff --git a/pkgs/development/libraries/v8/3.14.nix b/pkgs/development/libraries/v8/3.14.nix
new file mode 100644
index 000000000000..0564e6887957
--- /dev/null
+++ b/pkgs/development/libraries/v8/3.14.nix
@@ -0,0 +1,65 @@
+{ stdenv, fetchsvn, gyp, readline, python, which }:
+
+assert readline != null;
+
+let
+  system = stdenv.system;
+  arch = if system == "i686-linux" then "ia32" else if system == "x86_64-linux" || system == "x86_64-darwin" then "x64" else "";
+  version = "3.14.5.9";
+in
+
+assert arch != "";
+
+stdenv.mkDerivation {
+    name = "v8-${version}";
+
+    src = fetchsvn {
+      url = "http://v8.googlecode.com/svn/tags/${version}";
+      sha256 = "18qp5qp5xrb6f00w01cklz358yrl54pks963f5rwvwz82d8sfyqr";
+      name = "v8-${version}-src";
+    };
+
+    patches = [ ./fix-GetLocalizedMessage-usage.patch ];
+
+    configurePhase = ''
+      mkdir build/gyp
+      ln -sv ${gyp}/bin/gyp build/gyp/gyp
+    '';
+
+    nativeBuildInputs = [ which ];
+    buildInputs = [ readline python ];
+
+    buildFlags = [
+      "library=shared"
+      "console=readline"
+      "${arch}.release"
+    ];
+
+    # http://code.google.com/p/v8/issues/detail?id=2149
+    NIX_CFLAGS_COMPILE = "-Wno-unused-local-typedefs -Wno-aggressive-loop-optimizations";
+
+    enableParallelBuilding = true;
+
+    installPhase = ''
+      mkdir -p $out/bin
+      mkdir -p $out/lib
+      mv -v out/${arch}.release/d8 $out/bin
+
+      ${if stdenv.system == "x86_64-darwin" then
+        "mv -v out/${arch}.release/libv8.dylib $out/lib"
+      else
+        "mv -v out/${arch}.release/lib.target/libv8.so $out/lib"}
+      mv -v include $out/
+    '';
+
+    postFixup = if stdenv.isDarwin then ''
+      install_name_tool -change /usr/local/lib/libv8.dylib $out/lib/libv8.dylib -change /usr/lib/libgcc_s.1.dylib ${stdenv.gcc.gcc}/lib/libgcc_s.1.dylib $out/bin/d8
+      install_name_tool -id $out/lib/libv8.dylib -change /usr/lib/libgcc_s.1.dylib ${stdenv.gcc.gcc}/lib/libgcc_s.1.dylib $out/lib/libv8.dylib
+    '' else null;
+
+    meta = with stdenv.lib; {
+      description = "V8 is Google's open source JavaScript engine";
+      platforms = platforms.linux ++ platforms.darwin;
+      license = licenses.bsd3;
+    };
+}
diff --git a/pkgs/development/web/nodejs/default.nix b/pkgs/development/web/nodejs/default.nix
index 062d7f4ec066..3b1b64679722 100644
--- a/pkgs/development/web/nodejs/default.nix
+++ b/pkgs/development/web/nodejs/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, openssl, python, zlib, v8, utillinux, http-parser, c-ares, pkgconfig, runCommand }:
+{ stdenv, fetchurl, openssl, python, zlib, v8_3_14, utillinux, http-parser, c-ares, pkgconfig, runCommand }:
 
 let
   dtrace = runCommand "dtrace-native" {} ''
@@ -10,7 +10,7 @@ let
 
   # !!! Should we also do shared libuv?
   deps = {
-    inherit v8 openssl zlib http-parser;
+    inherit v8_3_14 openssl zlib http-parser;
     cares = c-ares;
   };
 
diff --git a/pkgs/servers/nosql/mongodb/default.nix b/pkgs/servers/nosql/mongodb/default.nix
index 6956271e992c..a5a021b93545 100644
--- a/pkgs/servers/nosql/mongodb/default.nix
+++ b/pkgs/servers/nosql/mongodb/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, scons, boost, v8, gperftools, pcre, snappy }:
+{ stdenv, fetchurl, scons, boost, v8_3_14, gperftools, pcre, snappy }:
 
 let version = "2.4.8"; in stdenv.mkDerivation rec {
   name = "mongodb-${version}";
@@ -8,7 +8,7 @@ let version = "2.4.8"; in stdenv.mkDerivation rec {
     sha256 = "1p6gnharypglfp39halp72fig96fqjhakyy7m76a1prxwpjkqw7x";
   };
 
-  nativeBuildInputs = [ scons boost v8 gperftools pcre snappy ];
+  nativeBuildInputs = [ scons boost v8_3_14 gperftools pcre snappy ];
 
   postPatch = ''
     substituteInPlace SConstruct \
diff --git a/pkgs/servers/nosql/rethinkdb/default.nix b/pkgs/servers/nosql/rethinkdb/default.nix
index e81ccb396322..ec1dbd763646 100644
--- a/pkgs/servers/nosql/rethinkdb/default.nix
+++ b/pkgs/servers/nosql/rethinkdb/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, which, protobuf, v8, ncurses, gperftools, boost, m4 }:
+{ stdenv, fetchurl, which, protobuf, v8_3_14, ncurses, gperftools, boost, m4 }:
 
 stdenv.mkDerivation rec {
   name = "rethinkdb-1.11.2";
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = "--lib-path ${gperftools}/lib";
 
-  buildInputs = [ protobuf v8 ncurses boost ];
+  buildInputs = [ protobuf v8_3_14 ncurses boost ];
 
   nativeBuildInputs = [ which m4 ];
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 79c1ce219dab..8a498067d586 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6147,7 +6147,13 @@ let
     inherit (gnome) libsoup;
   };
 
-  v8 = callPackage ../development/libraries/v8 { inherit (pythonPackages) gyp; };
+  v8 = callPackage ../development/libraries/v8 {
+    inherit (pythonPackages) gyp;
+  };
+
+  v8_3_14 = callPackage ../development/libraries/v8/3.14.nix {
+    inherit (pythonPackages) gyp;
+  };
 
   xmlsec = callPackage ../development/libraries/xmlsec { };
 

From 8bc8b51375669737f33b236d22821d7ed43e3f41 Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Mon, 24 Mar 2014 15:04:41 +0100
Subject: [PATCH 25/37] chromium: Move source package into own subdir.

Next, we're going to refactor update.sh and the first step is to ensure
that we keep everything related to sources into its own subdirectory to
not clutter up the main directory too much.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 pkgs/applications/networking/browsers/chromium/default.nix      | 2 +-
 .../browsers/chromium/{source.nix => source/default.nix}        | 0
 .../browsers/chromium/{ => source}/sandbox_userns_31.patch      | 0
 .../networking/browsers/chromium/{ => source}/sources.nix       | 0
 .../networking/browsers/chromium/{ => source}/update.sh         | 0
 5 files changed, 1 insertion(+), 1 deletion(-)
 rename pkgs/applications/networking/browsers/chromium/{source.nix => source/default.nix} (100%)
 rename pkgs/applications/networking/browsers/chromium/{ => source}/sandbox_userns_31.patch (100%)
 rename pkgs/applications/networking/browsers/chromium/{ => source}/sources.nix (100%)
 rename pkgs/applications/networking/browsers/chromium/{ => source}/update.sh (100%)

diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index d47c9c89eb07..950be9c1892b 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -18,7 +18,7 @@ let
   callPackage = newScope chromium;
 
   chromium = {
-    source = callPackage ./source.nix {
+    source = callPackage ./source {
       inherit channel;
       # XXX: common config
       inherit useOpenSSL;
diff --git a/pkgs/applications/networking/browsers/chromium/source.nix b/pkgs/applications/networking/browsers/chromium/source/default.nix
similarity index 100%
rename from pkgs/applications/networking/browsers/chromium/source.nix
rename to pkgs/applications/networking/browsers/chromium/source/default.nix
diff --git a/pkgs/applications/networking/browsers/chromium/sandbox_userns_31.patch b/pkgs/applications/networking/browsers/chromium/source/sandbox_userns_31.patch
similarity index 100%
rename from pkgs/applications/networking/browsers/chromium/sandbox_userns_31.patch
rename to pkgs/applications/networking/browsers/chromium/source/sandbox_userns_31.patch
diff --git a/pkgs/applications/networking/browsers/chromium/sources.nix b/pkgs/applications/networking/browsers/chromium/source/sources.nix
similarity index 100%
rename from pkgs/applications/networking/browsers/chromium/sources.nix
rename to pkgs/applications/networking/browsers/chromium/source/sources.nix
diff --git a/pkgs/applications/networking/browsers/chromium/update.sh b/pkgs/applications/networking/browsers/chromium/source/update.sh
similarity index 100%
rename from pkgs/applications/networking/browsers/chromium/update.sh
rename to pkgs/applications/networking/browsers/chromium/source/update.sh

From 27415239269acc0560bdb22ad32ace33293e0bd9 Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Thu, 27 Mar 2014 07:20:20 +0100
Subject: [PATCH 26/37] chromium: Remove URL in sources.nix and updater.

The updater is now splitted between a shellscript and a Nix expression
file which contains helpers and lookup functions to reconstruct all
information needed in order to fetch the source tarballs.

This means, that the sources.nix now doesn't contain URLs and only
versions and the corresponding SHA256 hashes. Of course, right now this
sounds like it's unnecessary, but we're going to fetch binaries soon so
it's a good idea to not unnecessarily clutter up sources.nix.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 .../browsers/chromium/source/default.nix      |  5 +-
 .../browsers/chromium/source/sources.nix      |  3 -
 .../browsers/chromium/source/update.nix       | 58 +++++++++++++++++
 .../browsers/chromium/source/update.sh        | 64 +++----------------
 4 files changed, 71 insertions(+), 59 deletions(-)
 create mode 100644 pkgs/applications/networking/browsers/chromium/source/update.nix

diff --git a/pkgs/applications/networking/browsers/chromium/source/default.nix b/pkgs/applications/networking/browsers/chromium/source/default.nix
index 12a691db633b..74cc692919e3 100644
--- a/pkgs/applications/networking/browsers/chromium/source/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/source/default.nix
@@ -4,7 +4,10 @@
 }:
 
 with stdenv.lib;
-with getAttr channel (import ./sources.nix);
+
+with (import ./update.nix {
+  inherit (stdenv) system;
+}).getChannel channel;
 
 stdenv.mkDerivation {
   name = "chromium-source-${version}";
diff --git a/pkgs/applications/networking/browsers/chromium/source/sources.nix b/pkgs/applications/networking/browsers/chromium/source/sources.nix
index 49b5e2b42215..dceab16d38cb 100644
--- a/pkgs/applications/networking/browsers/chromium/source/sources.nix
+++ b/pkgs/applications/networking/browsers/chromium/source/sources.nix
@@ -2,17 +2,14 @@
 {
   dev = {
     version = "35.0.1883.0";
-    url = "http://commondatastorage.googleapis.com/chromium-browser-official/chromium-35.0.1883.0.tar.xz";
     sha256 = "0qbv6prxl18y5824pfd13ng9798g561gzb6nypwp502hqr45jvb6";
   };
   beta = {
     version = "34.0.1847.60";
-    url = "http://commondatastorage.googleapis.com/chromium-browser-official/chromium-34.0.1847.60.tar.xz";
     sha256 = "1na5d6z4a0wkabn7cj62vyiv3mmvcb6qdvrkyy6fj79h7gk2hb7k";
   };
   stable = {
     version = "34.0.1847.116";
-    url = "http://commondatastorage.googleapis.com/chromium-browser-official/chromium-34.0.1847.116.tar.xz";
     sha256 = "04cpfav5rqa117igvzmrw0045r2ljxg5fqb46qgqvkgff30pjrfx";
   };
 }
diff --git a/pkgs/applications/networking/browsers/chromium/source/update.nix b/pkgs/applications/networking/browsers/chromium/source/update.nix
new file mode 100644
index 000000000000..841dfcccb542
--- /dev/null
+++ b/pkgs/applications/networking/browsers/chromium/source/update.nix
@@ -0,0 +1,58 @@
+{ system ? builtins.currentSystem }:
+
+let
+  inherit (import <nixpkgs> {}) lib writeText;
+
+  sources = if builtins.pathExists ./sources.nix
+            then import ./sources.nix
+            else null;
+
+  bucketURL = "http://commondatastorage.googleapis.com/"
+            + "chromium-browser-official";
+
+  tryChannel = channel: let
+    chanAttrs = builtins.getAttr channel sources;
+  in if sources != null then ''
+    oldver="${chanAttrs.version}";
+    echo -n "Checking if $oldver ($channel) is up to date..." >&2;
+    if [ "x$(get_newest_ver "$version" "$oldver")" != "x$oldver" ];
+    then
+      echo " no, getting sha256 for new version $version:" >&2;
+      sha256="$(nix-prefetch-url "$url")" || return 1;
+    else
+      echo " yes, keeping old sha256." >&2;
+      sha256="${chanAttrs.sha256}";
+    fi;
+  '' else ''
+    sha256="$(nix-prefetch-url "$url")" || return 1;
+  '';
+
+  caseChannel = channel: ''
+    ${channel}) ${tryChannel channel};;
+  '';
+
+in rec {
+  getChannel = channel: let
+    chanAttrs = builtins.getAttr channel sources;
+  in {
+    url = "${bucketURL}/chromium-${chanAttrs.version}.tar.xz";
+    inherit (chanAttrs) version sha256;
+  };
+
+  updateHelpers = writeText "update-helpers.sh" ''
+    get_sha256()
+    {
+      channel="$1";
+      version="$2";
+      url="${bucketURL}/chromium-$version.tar.xz";
+
+      case "$channel" in
+        ${lib.concatMapStrings caseChannel [ "stable" "dev" "beta" ]}
+      esac;
+
+      sha_insert "$version" "$sha256";
+      echo "$sha256";
+      return 0;
+    }
+  '';
+}
diff --git a/pkgs/applications/networking/browsers/chromium/source/update.sh b/pkgs/applications/networking/browsers/chromium/source/update.sh
index 0c4881bb3962..a2e1e268f4fe 100755
--- a/pkgs/applications/networking/browsers/chromium/source/update.sh
+++ b/pkgs/applications/networking/browsers/chromium/source/update.sh
@@ -3,16 +3,9 @@
 channels_url="http://omahaproxy.appspot.com/all?csv=1";
 history_url="http://omahaproxy.appspot.com/history";
 bucket_url="http://commondatastorage.googleapis.com/chromium-browser-official/";
-output_file="$(cd "$(dirname "$0")" && pwd)/sources.nix";
+base_path="$(cd "$(dirname "$0")" && pwd)";
 
-nix_getattr()
-{
-    input_file="$1";
-    attr="$2";
-
-    var="$(nix-instantiate --eval-only -A "$attr" "$output_file")";
-    echo "$var" | tr -d '\\"';
-}
+source "$(nix-build --no-out-link "$base_path/update.nix" -A updateHelpers)";
 
 ### poor mans key/value-store :-) ###
 
@@ -53,39 +46,6 @@ get_newest_ver()
     fi;
 }
 
-if [ -e "$output_file" ];
-then
-    get_sha256()
-    {
-        channel="$1";
-        version="$2";
-        url="$3";
-
-        oldver="$(nix_getattr "$output_file" "$channel.version")";
-
-        echo -n "Checking if $oldver ($channel) is up to date..." >&2;
-
-        if [ "x$(get_newest_ver "$version" "$oldver")" != "x$oldver" ];
-        then
-            echo " no, getting sha256 for new version $version:" >&2;
-            sha256="$(nix-prefetch-url "$url")" || return 1;
-        else
-            echo " yes, keeping old sha256." >&2;
-            sha256="$(nix_getattr "$output_file" "$channel.sha256")" \
-                || return 1;
-        fi;
-
-        sha_insert "$version" "$sha256";
-        echo "$sha256";
-        return 0;
-    }
-else
-    get_sha256()
-    {
-        nix-prefetch-url "$3";
-    }
-fi;
-
 fetch_filtered_history()
 {
     curl -s "$history_url" | sed -nr 's/^'"linux,$1"',([^,]+).*$/\1/p';
@@ -99,9 +59,8 @@ get_prev_sha256()
     for version in $(fetch_filtered_history "$channel");
     do
         [ "x$version" = "x$current_version" ] && continue;
-        url="${bucket_url%/}/chromium-$version.tar.xz";
-        sha256="$(get_sha256 "$channel" "$version" "$url")" || continue;
-        echo "$sha256:$version:$url";
+        sha256="$(get_sha256 "$channel" "$version")" || continue;
+        echo "$sha256:$version";
         return 0;
     done;
 }
@@ -113,25 +72,21 @@ get_channel_exprs()
         channel="${chline%%,*}";
         version="${chline##*,}";
 
-        url="${bucket_url%/}/chromium-$version.tar.xz";
-
         echo -n "Checking if sha256 of version $version is cached..." >&2;
         if sha256="$(sha_lookup "$version")";
         then
             echo " yes: $sha256" >&2;
         else
             echo " no." >&2;
-            sha256="$(get_sha256 "$channel" "$version" "$url")";
+            sha256="$(get_sha256 "$channel" "$version")";
             if [ $? -ne 0 ];
             then
                 echo "Whoops, failed to fetch $version, trying previous" \
                      "versions:" >&2;
 
-                sha_ver_url="$(get_prev_sha256 "$channel" "$version")";
-                sha256="${sha_ver_url%%:*}";
-                ver_url="${sha_ver_url#*:}";
-                version="${ver_url%%:*}";
-                url="${ver_url#*:}";
+                sha_ver="$(get_prev_sha256 "$channel" "$version")";
+                sha256="${sha_ver%:*}";
+                version="${sha_ver#*:}";
             fi;
         fi;
 
@@ -139,7 +94,6 @@ get_channel_exprs()
 
         echo "  $channel = {";
         echo "    version = \"$version\";";
-        echo "    url = \"$url\";";
         echo "    sha256 = \"$sha256\";";
         echo "  };";
     done;
@@ -151,7 +105,7 @@ omaha="$(curl -s "$channels_url")";
 versions="$(echo "$omaha" | sed -nr -e 's/^linux,([^,]+,[^,]+).*$/\1/p')";
 channel_exprs="$(get_channel_exprs "$versions")";
 
-cat > "$output_file" <<-EOF
+cat > "$base_path/sources.nix" <<-EOF
 # This file is autogenerated from update.sh in the same directory.
 {
 $channel_exprs

From 6184ee89fe4107a1e15f1473f50e4593f449f40c Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Thu, 27 Mar 2014 09:40:21 +0100
Subject: [PATCH 27/37] chromium/update: Update Debian binaries as well.

This cases the Debian binaries to be fetched from Google's official APT
repository. If we aren't able to find a package from the APT repository,
it's very likely that it already got deleted upstream and we need to
fallback to mirrors instead.

Unfortunately, we can't use mirrors for updating, because Google doesn't
sign the Debian packages themselves and only the release files.

We're going to hook it into a Chromium updater soon, making the sha256
hashes publicly available, so if it is missing, we can still put the
sha256 manually into sources.nix, without risking anything by blindly
fetching from one of the provided mirrors.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 .../browsers/chromium/source/update.nix       | 77 ++++++++++++++++---
 .../browsers/chromium/source/update.sh        | 12 ++-
 2 files changed, 79 insertions(+), 10 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/source/update.nix b/pkgs/applications/networking/browsers/chromium/source/update.nix
index 841dfcccb542..7a8144314d5a 100644
--- a/pkgs/applications/networking/browsers/chromium/source/update.nix
+++ b/pkgs/applications/networking/browsers/chromium/source/update.nix
@@ -1,7 +1,7 @@
 { system ? builtins.currentSystem }:
 
 let
-  inherit (import <nixpkgs> {}) lib writeText;
+  inherit (import <nixpkgs> {}) lib writeText stdenv;
 
   sources = if builtins.pathExists ./sources.nix
             then import ./sources.nix
@@ -10,21 +10,34 @@ let
   bucketURL = "http://commondatastorage.googleapis.com/"
             + "chromium-browser-official";
 
+  debURL = "https://dl.google.com/linux/chrome/deb/pool/main/g";
+
+  # Untrusted mirrors, don't try to update from them!
+  debMirrors = [
+    "http://95.31.35.30/chrome/pool/main/g"
+    "http://mirror.pcbeta.com/google/chrome/deb/pool/main/g"
+  ];
+
   tryChannel = channel: let
-    chanAttrs = builtins.getAttr channel sources;
+    chan = builtins.getAttr channel sources;
   in if sources != null then ''
-    oldver="${chanAttrs.version}";
+    oldver="${chan.version}";
     echo -n "Checking if $oldver ($channel) is up to date..." >&2;
     if [ "x$(get_newest_ver "$version" "$oldver")" != "x$oldver" ];
     then
       echo " no, getting sha256 for new version $version:" >&2;
-      sha256="$(nix-prefetch-url "$url")" || return 1;
+      sha256="$(prefetch_sha "$channel" "$version")" || return 1;
     else
       echo " yes, keeping old sha256." >&2;
-      sha256="${chanAttrs.sha256}";
+      sha256="${chan.sha256}";
+      ${if (chan ? sha256bin32 && chan ? sha256bin64) then ''
+        sha256="$sha256.${chan.sha256bin32}.${chan.sha256bin64}";
+      '' else ''
+        sha256="$sha256.$(prefetch_deb_sha "$channel" "$version")";
+      ''}
     fi;
   '' else ''
-    sha256="$(nix-prefetch-url "$url")" || return 1;
+    sha256="$(prefetch_sha "$channel" "$version")" || return 1;
   '';
 
   caseChannel = channel: ''
@@ -35,16 +48,62 @@ in rec {
   getChannel = channel: let
     chanAttrs = builtins.getAttr channel sources;
   in {
-    url = "${bucketURL}/chromium-${chanAttrs.version}.tar.xz";
-    inherit (chanAttrs) version sha256;
+    main = {
+      url = "${bucketURL}/chromium-${chanAttrs.version}.tar.xz";
+      inherit (chanAttrs) version sha256;
+    };
+
+    binary = let
+      pname = if channel == "dev"
+              then "google-chrome-unstable"
+              else "google-chrome-${channel}";
+      arch = if stdenv.is64bit then "amd64" else "i386";
+      relpath = "${pname}/${pname}_${chanAttrs.version}-1_${arch}.deb";
+    in lib.optionalAttrs (chanAttrs ? sha256bin64) {
+      urls = map (url: "${url}/${relpath}") ([ debURL ] ++ debMirrors);
+      sha256 = if stdenv.is64bit
+               then chanAttrs.sha256bin64
+               else chanAttrs.sha256bin32;
+      inherit (chanAttrs) version;
+    };
   };
 
   updateHelpers = writeText "update-helpers.sh" ''
+
+    prefetch_main_sha()
+    {
+      nix-prefetch-url "${bucketURL}/chromium-$2.tar.xz";
+    }
+
+    prefetch_deb_sha()
+    {
+      channel="$1";
+      version="$2";
+
+      case "$1" in
+        dev) pname="google-chrome-unstable";;
+        *)   pname="google-chrome-$channel";;
+      esac;
+
+      deb_pre="${debURL}/$pname/$pname";
+
+      deb32=$(nix-prefetch-url "''${deb_pre}_$version-1_i386.deb");
+      deb64=$(nix-prefetch-url "''${deb_pre}_$version-1_amd64.deb");
+
+      echo "$deb32.$deb64";
+      return 0;
+    }
+
+    prefetch_sha()
+    {
+      echo "$(prefetch_main_sha "$@").$(prefetch_deb_sha "$@")";
+      return 0;
+    }
+
     get_sha256()
     {
       channel="$1";
       version="$2";
-      url="${bucketURL}/chromium-$version.tar.xz";
 
       case "$channel" in
         ${lib.concatMapStrings caseChannel [ "stable" "dev" "beta" ]}
diff --git a/pkgs/applications/networking/browsers/chromium/source/update.sh b/pkgs/applications/networking/browsers/chromium/source/update.sh
index a2e1e268f4fe..806169f524c3 100755
--- a/pkgs/applications/networking/browsers/chromium/source/update.sh
+++ b/pkgs/applications/networking/browsers/chromium/source/update.sh
@@ -92,9 +92,19 @@ get_channel_exprs()
 
         sha_insert "$version" "$sha256";
 
+        main="${sha256%%.*}";
+        deb="${sha256#*.}";
+        deb32="${deb%.*}";
+        deb64="${deb#*.}";
+
         echo "  $channel = {";
         echo "    version = \"$version\";";
-        echo "    sha256 = \"$sha256\";";
+        echo "    sha256 = \"$main\";";
+        if [ "x${deb#*[a-z0-9].[a-z0-9]}" != "x$deb" ];
+        then
+            echo "    sha256bin32 = \"$deb32\";";
+            echo "    sha256bin64 = \"$deb64\";";
+        fi;
         echo "  };";
     done;
 }

From cad411f61d6b5179776b2c359d19464a21c19ea4 Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Thu, 27 Mar 2014 09:49:46 +0100
Subject: [PATCH 28/37] chromium/plugins: Use Debian package from sources.

This now uses the Debian package from the sources derivation instead of
hardcoding it, so we finally should have proper PepperAPI plugin support
without crashing plugins and whatnot.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 .../networking/browsers/chromium/plugins.nix  | 20 +++++++++----------
 .../browsers/chromium/source/default.nix      |  7 +++----
 .../browsers/chromium/source/update.nix       |  5 +++--
 3 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/plugins.nix b/pkgs/applications/networking/browsers/chromium/plugins.nix
index 04af90be1283..f760b06fe24b 100644
--- a/pkgs/applications/networking/browsers/chromium/plugins.nix
+++ b/pkgs/applications/networking/browsers/chromium/plugins.nix
@@ -1,7 +1,8 @@
 { stdenv
 , enablePepperFlash ? false
 , enablePepperPDF ? false
-, fetchurl # XXX
+
+, source
 }:
 
 with stdenv.lib;
@@ -11,21 +12,20 @@ let
     name = "chromium-binary-plugins";
 
     # XXX: Only temporary and has to be version-specific
-    src = fetchurl {
-      url = "https://dl.google.com/linux/chrome/deb/pool/main/g/"
-          + "google-chrome-unstable/google-chrome-unstable_"
-          + "35.0.1897.2-1_amd64.deb";
-      sha1 = "b68683fc5321d10536e4135c266b14894b7668ed";
-    };
+    src = source.plugins;
 
     phases = [ "unpackPhase" "patchPhase" "checkPhase" "installPhase" ];
     outputs = [ "pdf" "flash" ];
 
-    unpackCmd = ''
+    unpackCmd = let
+      chan = if source.channel == "dev"    then "chrome-unstable"
+        else if source.channel == "stable" then "chrome"
+        else "chrome-${source.channel}";
+    in ''
       ensureDir plugins
       ar p "$src" data.tar.lzma | tar xJ -C plugins --strip-components=4 \
-        ./opt/google/chrome-unstable/PepperFlash \
-        ./opt/google/chrome-unstable/libpdf.so
+        ./opt/google/${chan}/PepperFlash \
+        ./opt/google/${chan}/libpdf.so
     '';
 
     doCheck = true;
diff --git a/pkgs/applications/networking/browsers/chromium/source/default.nix b/pkgs/applications/networking/browsers/chromium/source/default.nix
index 74cc692919e3..eca5767e8c01 100644
--- a/pkgs/applications/networking/browsers/chromium/source/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/source/default.nix
@@ -12,9 +12,7 @@ with (import ./update.nix {
 stdenv.mkDerivation {
   name = "chromium-source-${version}";
 
-  src = fetchurl {
-    inherit url sha256;
-  };
+  src = fetchurl main;
 
   buildInputs = [ python ]; # cannot patch shebangs otherwise
 
@@ -72,6 +70,7 @@ stdenv.mkDerivation {
   '';
 
   passthru = {
-    inherit version;
+    inherit version channel;
+    plugins = fetchurl binary;
   };
 }
diff --git a/pkgs/applications/networking/browsers/chromium/source/update.nix b/pkgs/applications/networking/browsers/chromium/source/update.nix
index 7a8144314d5a..09f834a90c6f 100644
--- a/pkgs/applications/networking/browsers/chromium/source/update.nix
+++ b/pkgs/applications/networking/browsers/chromium/source/update.nix
@@ -48,9 +48,11 @@ in rec {
   getChannel = channel: let
     chanAttrs = builtins.getAttr channel sources;
   in {
+    inherit (chanAttrs) version;
+
     main = {
       url = "${bucketURL}/chromium-${chanAttrs.version}.tar.xz";
-      inherit (chanAttrs) version sha256;
+      inherit (chanAttrs) sha256;
     };
 
     binary = let
@@ -64,7 +66,6 @@ in rec {
       sha256 = if stdenv.is64bit
                then chanAttrs.sha256bin64
                else chanAttrs.sha256bin32;
-      inherit (chanAttrs) version;
     };
   };
 

From a87208de5896e01e51933f2eede44bfc3b02a3c3 Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Thu, 27 Mar 2014 15:41:56 +0100
Subject: [PATCH 29/37] libopus: Allow to enable custom modes.

The reason I'm not making this the default is because it seems to add
complexity and degrades performance of the library. For details have a
look at this lengthy discussion at:

https://bugs.debian.org/686777

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 pkgs/development/libraries/libopus/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libopus/default.nix b/pkgs/development/libraries/libopus/default.nix
index b1bf65d0fe67..78b264506f01 100644
--- a/pkgs/development/libraries/libopus/default.nix
+++ b/pkgs/development/libraries/libopus/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fixedPoint ? false }:
+{ stdenv, fetchurl, fixedPoint ? false, withCustomModes ? false }:
 
 let
   version = "1.1";
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "158xprn2086arvdib3vbbygz7z6jqkw2nci7nlywzzwallap0wmr";
   };
 
-  configureFlags = stdenv.lib.optionalString fixedPoint "--enable-fixed-point";
+  configureFlags = stdenv.lib.optional fixedPoint "--enable-fixed-point"
+                ++ stdenv.lib.optional withCustomModes "--enable-custom-modes";
 
   doCheck = true;
 

From 111caaad539b738c54ecd60378de0f2a53249ad3 Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Tue, 1 Apr 2014 07:36:26 +0200
Subject: [PATCH 30/37] chromium: Factor out common build attributes.

This results in a new function called mkChromiumDerivation, which can be
used to easily build packages that are based on the Chromium source
tree.

We pass through this function as mkDerivation in the chromium wrappre,
so in the end if you want to create such a package, something like:

chromium.mkDerivation (base: {
  name = "your-shiny-package-based-on-chromium";
  ...
})

will suffice.

Of course, this is only the first step towards this functionality,
because right now I'm not even sure the Chromium browser itself will
build.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 .../networking/browsers/chromium/browser.nix  | 205 ++----------------
 .../networking/browsers/chromium/common.nix   | 200 +++++++++++++++++
 .../networking/browsers/chromium/default.nix  |   7 +-
 3 files changed, 220 insertions(+), 192 deletions(-)
 create mode 100644 pkgs/applications/networking/browsers/chromium/common.nix

diff --git a/pkgs/applications/networking/browsers/chromium/browser.nix b/pkgs/applications/networking/browsers/chromium/browser.nix
index 3b45ff78206c..8c83dbb853a6 100644
--- a/pkgs/applications/networking/browsers/chromium/browser.nix
+++ b/pkgs/applications/networking/browsers/chromium/browser.nix
@@ -1,201 +1,24 @@
-{ stdenv, fetchurl, ninja, which
-
-# default dependencies
-, bzip2, flac, speex, icu, libopus
-, libevent, expat, libjpeg, snappy
-, libpng, libxml2, libxslt, v8
-, xdg_utils, yasm, minizip, libwebp
-, libusb1, libexif, pciutils
-
-, python, pythonPackages, perl, pkgconfig
-, nspr, udev, krb5
-, utillinux, alsaLib
-, gcc, bison, gperf
-, glib, gtk, dbus_glib
-, libXScrnSaver, libXcursor, libXtst, mesa
-, protobuf, speechd, libXdamage
-
-# optional dependencies
-, libgcrypt ? null # gnomeSupport || cupsSupport
-
-# package customization
-, enableSELinux ? false, libselinux ? null
-, enableNaCl ? false
-, useOpenSSL ? false, nss ? null, openssl ? null
-, gnomeSupport ? false, gnome ? null
-, gnomeKeyringSupport ? false, libgnome_keyring3 ? null
-, proprietaryCodecs ? true
-, cupsSupport ? false
-, pulseSupport ? false, pulseaudio ? null
-
-, source
-, plugins
-}:
+{ stdenv, mkChromiumDerivation }:
 
 with stdenv.lib;
 
-let
-
-  mkGypFlags =
-    let
-      sanitize = value:
-        if value == true then "1"
-        else if value == false then "0"
-        else "${value}";
-      toFlag = key: value: "-D${key}=${sanitize value}";
-    in attrs: concatStringsSep " " (attrValues (mapAttrs toFlag attrs));
-
-  gypFlagsUseSystemLibs = {
-    use_system_bzip2 = true;
-    use_system_flac = true;
-    use_system_libevent = true;
-    use_system_libexpat = true;
-    use_system_libexif = true;
-    use_system_libjpeg = true;
-    use_system_libpng = true;
-    use_system_libwebp = true;
-    use_system_libxml = true;
-    use_system_opus = true;
-    use_system_snappy = true;
-    use_system_speex = true;
-    use_system_ssl = useOpenSSL;
-    use_system_stlport = true;
-    use_system_xdg_utils = true;
-    use_system_yasm = true;
-    use_system_zlib = true;
-    use_system_protobuf = true;
-
-    use_system_harfbuzz = false;
-    use_system_icu = false; # Doesn't support ICU 52 yet.
-    use_system_libusb = false; # http://crbug.com/266149
-    use_system_skia = false;
-    use_system_sqlite = false; # http://crbug.com/22208
-    use_system_v8 = !versionOlder source.version "34.0.0.0";
-  };
-
-  defaultDependencies = [
-    bzip2 flac speex icu libopus
-    libevent expat libjpeg snappy
-    libpng libxml2 libxslt v8
-    xdg_utils yasm minizip libwebp
-    libusb1 libexif
-  ];
-
-  # build paths and release info
-  packageName = "chromium";
-  buildType = "Release";
-  buildPath = "out/${buildType}";
-  libExecPath = "$out/libexec/${packageName}";
-
-in stdenv.mkDerivation rec {
-  name = "${packageName}-browser-${version}";
-  inherit (source) version;
-  inherit packageName;
-  src = source;
-
-  buildInputs = defaultDependencies ++ [
-    which
-    python perl pkgconfig
-    nspr udev
-    (if useOpenSSL then openssl else nss)
-    utillinux alsaLib
-    gcc bison gperf
-    gcc bison gperf krb5
-    glib gtk dbus_glib
-    libXScrnSaver libXcursor libXtst mesa
-    pciutils protobuf speechd libXdamage
-    pythonPackages.gyp
-  ] ++ optional gnomeKeyringSupport libgnome_keyring3
-    ++ optionals gnomeSupport [ gnome.GConf libgcrypt ]
-    ++ optional enableSELinux libselinux
-    ++ optional cupsSupport libgcrypt
-    ++ optional pulseSupport pulseaudio;
-
-  # XXX: Wait for https://crbug.com/239107 and https://crbug.com/239181 to
-  #      be fixed, then try again to unbundle everything into separate
-  #      derivations.
-  prePatch = ''
-    cp -dsr --no-preserve=mode "${source.main}"/* .
-    cp -dsr --no-preserve=mode "${source.sandbox}" sandbox
-    cp -dr "${source.bundled}" third_party
-    chmod -R u+w third_party
-
-    # Hardcode source tree root in all gyp files
-    find -iname '*.gyp*' \( -type f -o -type l \) \
-      -exec sed -i -e 's|<(DEPTH)|'"$(pwd)"'|g' {} + \
-      -exec chmod u+w {} +
-  '';
-
-  postPatch = ''
-    sed -i -e '/base::FilePath exe_dir/,/^ *} *$/c \
-      sandbox_binary = base::FilePath(getenv("CHROMIUM_SANDBOX_BINARY_PATH"));
-    ' content/browser/browser_main_loop.cc
-  '';
-
-  gypFlags = mkGypFlags (gypFlagsUseSystemLibs // {
-    linux_use_gold_binary = false;
-    linux_use_gold_flags = false;
-    proprietary_codecs = false;
-    use_gnome_keyring = gnomeKeyringSupport;
-    use_gconf = gnomeSupport;
-    use_gio = gnomeSupport;
-    use_pulseaudio = pulseSupport;
-    disable_nacl = !enableNaCl;
-    use_openssl = useOpenSSL;
-    selinux = enableSELinux;
-    use_cups = cupsSupport;
-    linux_sandbox_chrome_path="${libExecPath}/${packageName}";
-    werror = "";
-
-    # Google API keys, see http://www.chromium.org/developers/how-tos/api-keys.
-    # Note: These are for NixOS/nixpkgs use ONLY. For your own distribution,
-    # please get your own set of keys.
-    google_api_key = "AIzaSyDGi15Zwl11UNe6Y-5XW_upsfyw31qwZPI";
-    google_default_client_id = "404761575300.apps.googleusercontent.com";
-    google_default_client_secret = "9rIFQjfnkykEmqb6FfjJQD1D";
-
-  } // optionalAttrs proprietaryCodecs {
-    # enable support for the H.264 codec
-    proprietary_codecs = true;
-    ffmpeg_branding = "Chrome";
-  } // optionalAttrs (stdenv.system == "x86_64-linux") {
-    target_arch = "x64";
-    python_arch = "x86-64";
-  } // optionalAttrs (stdenv.system == "i686-linux") {
-    target_arch = "ia32";
-    python_arch = "ia32";
-  });
-
-  configurePhase = ''
-    python build/linux/unbundle/replace_gyp_files.py ${gypFlags}
-    python build/gyp_chromium -f ninja --depth "$(pwd)" ${gypFlags}
-  '';
-
-  buildPhase = let
-    CC = "${gcc}/bin/gcc";
-    CXX = "${gcc}/bin/g++";
-  in ''
-    CC="${CC}" CC_host="${CC}"     \
-    CXX="${CXX}" CXX_host="${CXX}" \
-    LINK_host="${CXX}"             \
-      "${ninja}/bin/ninja" -C "${buildPath}"  \
-        -j$NIX_BUILD_CORES -l$NIX_BUILD_CORES \
-        chrome
-  '';
+mkChromiumDerivation (base: rec {
+  name = "chromium-browser";
+  buildTargets = [ "chrome" ];
 
   installPhase = ''
-    ensureDir "${libExecPath}"
-    cp -v "${buildPath}/"*.pak "${libExecPath}/"
-    ${optionalString (!versionOlder version "34.0.0.0") ''
-    cp -v "${buildPath}/icudtl.dat" "${libExecPath}/"
+    ensureDir "$libExecPath"
+    cp -v "$buildPath/"*.pak "$libExecPath/"
+    ${optionalString (!versionOlder base.version "34.0.0.0") ''
+    cp -v "$buildPath/icudtl.dat" "$libExecPath/"
     ''}
-    cp -vR "${buildPath}/locales" "${buildPath}/resources" "${libExecPath}/"
-    cp -v ${buildPath}/libffmpegsumo.so "${libExecPath}/"
+    cp -vR "$buildPath/locales" "$buildPath/resources" "$libExecPath/"
+    cp -v $buildPath/libffmpegsumo.so "$libExecPath/"
 
-    cp -v "${buildPath}/chrome" "${libExecPath}/${packageName}"
+    cp -v "$buildPath/chrome" "$libExecPath/$packageName"
 
     mkdir -vp "$out/share/man/man1"
-    cp -v "${buildPath}/chrome.1" "$out/share/man/man1/${packageName}.1"
+    cp -v "$buildPath/chrome.1" "$out/share/man/man1/$packageName.1"
 
     for icon_file in chrome/app/theme/chromium/product_logo_*[0-9].png; do
       num_and_suffix="''${icon_file##*logo_}"
@@ -204,7 +27,7 @@ in stdenv.mkDerivation rec {
       logo_output_prefix="$out/share/icons/hicolor"
       logo_output_path="$logo_output_prefix/''${icon_size}x''${icon_size}/apps"
       mkdir -vp "$logo_output_path"
-      cp -v "$icon_file" "$logo_output_path/${packageName}.png"
+      cp -v "$icon_file" "$logo_output_path/$packageName.png"
     done
   '';
 
@@ -215,4 +38,4 @@ in stdenv.mkDerivation rec {
     license = licenses.bsd3;
     platforms = platforms.linux;
   };
-}
+})
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
new file mode 100644
index 000000000000..be1725345e79
--- /dev/null
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -0,0 +1,200 @@
+{ stdenv, fetchurl, ninja, which
+
+# default dependencies
+, bzip2, flac, speex, icu, libopus
+, libevent, expat, libjpeg, snappy
+, libpng, libxml2, libxslt, v8
+, xdg_utils, yasm, minizip, libwebp
+, libusb1, libexif, pciutils
+
+, python, pythonPackages, perl, pkgconfig
+, nspr, udev, krb5
+, utillinux, alsaLib
+, gcc, bison, gperf
+, glib, gtk, dbus_glib
+, libXScrnSaver, libXcursor, libXtst, mesa
+, protobuf, speechd, libXdamage
+
+# optional dependencies
+, libgcrypt ? null # gnomeSupport || cupsSupport
+
+# package customization
+, enableSELinux ? false, libselinux ? null
+, enableNaCl ? false
+, useOpenSSL ? false, nss ? null, openssl ? null
+, gnomeSupport ? false, gnome ? null
+, gnomeKeyringSupport ? false, libgnome_keyring3 ? null
+, proprietaryCodecs ? true
+, cupsSupport ? false
+, pulseSupport ? false, pulseaudio ? null
+
+, source
+, plugins
+}:
+
+buildFun:
+
+with stdenv.lib;
+
+let
+  # The additional attributes for creating derivations based on the chromium
+  # source tree.
+  extraAttrs = buildFun base;
+
+  mkGypFlags =
+    let
+      sanitize = value:
+        if value == true then "1"
+        else if value == false then "0"
+        else "${value}";
+      toFlag = key: value: "-D${key}=${sanitize value}";
+    in attrs: concatStringsSep " " (attrValues (mapAttrs toFlag attrs));
+
+  gypFlagsUseSystemLibs = {
+    use_system_bzip2 = true;
+    use_system_flac = true;
+    use_system_libevent = true;
+    use_system_libexpat = true;
+    use_system_libexif = true;
+    use_system_libjpeg = true;
+    use_system_libpng = true;
+    use_system_libwebp = true;
+    use_system_libxml = true;
+    use_system_opus = true;
+    use_system_snappy = true;
+    use_system_speex = true;
+    use_system_ssl = useOpenSSL;
+    use_system_stlport = true;
+    use_system_xdg_utils = true;
+    use_system_yasm = true;
+    use_system_zlib = true;
+    use_system_protobuf = true;
+
+    use_system_harfbuzz = false;
+    use_system_icu = false; # Doesn't support ICU 52 yet.
+    use_system_libusb = false; # http://crbug.com/266149
+    use_system_skia = false;
+    use_system_sqlite = false; # http://crbug.com/22208
+    use_system_v8 = !versionOlder source.version "34.0.0.0";
+  };
+
+  opusWithCustomModes = libopus.override {
+    withCustomModes = !versionOlder source.version "35.0.0.0";
+  };
+
+  defaultDependencies = [
+    bzip2 flac speex icu opusWithCustomModes
+    libevent expat libjpeg snappy
+    libpng libxml2 libxslt v8
+    xdg_utils yasm minizip libwebp
+    libusb1 libexif
+  ];
+
+  # build paths and release info
+  packageName = extraAttrs.name;
+  buildType = "Release";
+  buildPath = "out/${buildType}";
+  libExecPath = "$out/libexec/${packageName}";
+
+  base = rec {
+    name = "${packageName}-${version}";
+    inherit (source) version;
+    inherit packageName buildType buildPath;
+    src = source;
+
+    buildInputs = defaultDependencies ++ [
+      which
+      python perl pkgconfig
+      nspr udev
+      (if useOpenSSL then openssl else nss)
+      utillinux alsaLib
+      gcc bison gperf krb5
+      glib gtk dbus_glib
+      libXScrnSaver libXcursor libXtst mesa
+      pciutils protobuf speechd libXdamage
+      pythonPackages.gyp
+    ] ++ optional gnomeKeyringSupport libgnome_keyring3
+      ++ optionals gnomeSupport [ gnome.GConf libgcrypt ]
+      ++ optional enableSELinux libselinux
+      ++ optional cupsSupport libgcrypt
+      ++ optional pulseSupport pulseaudio;
+
+    # XXX: Wait for https://crbug.com/239107 and https://crbug.com/239181 to
+    #      be fixed, then try again to unbundle everything into separate
+    #      derivations.
+    prePatch = ''
+      cp -dsr --no-preserve=mode "${source.main}"/* .
+      cp -dsr --no-preserve=mode "${source.sandbox}" sandbox
+      cp -dr "${source.bundled}" third_party
+      chmod -R u+w third_party
+
+      # Hardcode source tree root in all gyp files
+      find -iname '*.gyp*' \( -type f -o -type l \) \
+        -exec sed -i -e 's|<(DEPTH)|'"$(pwd)"'|g' {} + \
+        -exec chmod u+w {} +
+    '';
+
+    postPatch = ''
+      sed -i -e '/base::FilePath exe_dir/,/^ *} *$/c \
+        sandbox_binary = base::FilePath(getenv("CHROMIUM_SANDBOX_BINARY_PATH"));
+      ' content/browser/browser_main_loop.cc
+    '';
+
+    gypFlags = mkGypFlags (gypFlagsUseSystemLibs // {
+      linux_use_gold_binary = false;
+      linux_use_gold_flags = false;
+      proprietary_codecs = false;
+      use_gnome_keyring = gnomeKeyringSupport;
+      use_gconf = gnomeSupport;
+      use_gio = gnomeSupport;
+      use_pulseaudio = pulseSupport;
+      disable_nacl = !enableNaCl;
+      use_openssl = useOpenSSL;
+      selinux = enableSELinux;
+      use_cups = cupsSupport;
+      linux_sandbox_chrome_path="${libExecPath}/${packageName}";
+      werror = "";
+
+      # Google API keys, see http://www.chromium.org/developers/how-tos/api-keys.
+      # Note: These are for NixOS/nixpkgs use ONLY. For your own distribution,
+      # please get your own set of keys.
+      google_api_key = "AIzaSyDGi15Zwl11UNe6Y-5XW_upsfyw31qwZPI";
+      google_default_client_id = "404761575300.apps.googleusercontent.com";
+      google_default_client_secret = "9rIFQjfnkykEmqb6FfjJQD1D";
+
+    } // optionalAttrs proprietaryCodecs {
+      # enable support for the H.264 codec
+      proprietary_codecs = true;
+      ffmpeg_branding = "Chrome";
+    } // optionalAttrs (stdenv.system == "x86_64-linux") {
+      target_arch = "x64";
+      python_arch = "x86-64";
+    } // optionalAttrs (stdenv.system == "i686-linux") {
+      target_arch = "ia32";
+      python_arch = "ia32";
+    } // (extraAttrs.gypFlags or {}));
+
+    configurePhase = ''
+      # This is to ensure expansion of $out.
+      libExecPath="${libExecPath}"
+      python build/linux/unbundle/replace_gyp_files.py ${gypFlags}
+      python build/gyp_chromium -f ninja --depth "$(pwd)" ${gypFlags}
+    '';
+
+    buildPhase = let
+      CC = "${gcc}/bin/gcc";
+      CXX = "${gcc}/bin/g++";
+    in ''
+      CC="${CC}" CC_host="${CC}"     \
+      CXX="${CXX}" CXX_host="${CXX}" \
+      LINK_host="${CXX}"             \
+        "${ninja}/bin/ninja" -C "${buildPath}"  \
+          -j$NIX_BUILD_CORES -l$NIX_BUILD_CORES \
+          ${concatStringsSep " " (extraAttrs.buildTargets or [])}
+    '';
+  };
+
+# Remove some extraAttrs we supplied to the base attributes already.
+in stdenv.mkDerivation (base // removeAttrs extraAttrs [
+  "name" "gypFlags" "buildTargets"
+])
diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index 950be9c1892b..0fd9e09accfd 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -24,12 +24,13 @@ let
       inherit useOpenSSL;
     };
 
-    browser = callPackage ./browser.nix {
+    mkChromiumDerivation = callPackage ./common.nix {
       inherit enableSELinux enableNaCl useOpenSSL gnomeSupport
               gnomeKeyringSupport proprietaryCodecs cupsSupport
               pulseSupport;
     };
 
+    browser = callPackage ./browser.nix { };
     sandbox = callPackage ./sandbox.nix { };
 
     plugins = callPackage ./plugins.nix {
@@ -54,4 +55,8 @@ in stdenv.mkDerivation {
   '';
 
   inherit (chromium.browser) meta packageName;
+
+  passthru = {
+    mkDerivation = chromium.mkChromiumDerivation;
+  };
 }

From d0722342821d519ee2f07a4c377c80bf03421ea7 Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Sat, 19 Apr 2014 08:05:16 +0200
Subject: [PATCH 31/37] chromium: Prefer local build on source derivation.

It doesn't make sense to do the splitting of the source code on a remote
machine, so don't try to do it.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 .../networking/browsers/chromium/source/default.nix             | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/applications/networking/browsers/chromium/source/default.nix b/pkgs/applications/networking/browsers/chromium/source/default.nix
index eca5767e8c01..e80e05ca9e24 100644
--- a/pkgs/applications/networking/browsers/chromium/source/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/source/default.nix
@@ -69,6 +69,8 @@ stdenv.mkDerivation {
     rm -rf "$out/tools/gyp" # XXX: Don't even copy it in the first place.
   '';
 
+  preferLocalBuild = true;
+
   passthru = {
     inherit version channel;
     plugins = fetchurl binary;

From 3378679ff9b14adc920372646d3a2a22b8144ef6 Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Sat, 19 Apr 2014 09:56:48 +0200
Subject: [PATCH 32/37] chromium: Don't use v8 from <nixpkgs> anymore.

The version of v8 to use for Chromium is heavily tied to the specific
version of Chromium and thus it doesn't really make sense to use v8 from
<nixpkgs>, as we would need to have 3 different versions of v8, one for
each Chromium channel.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 pkgs/applications/networking/browsers/chromium/common.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index be1725345e79..85964ee76877 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -3,7 +3,7 @@
 # default dependencies
 , bzip2, flac, speex, icu, libopus
 , libevent, expat, libjpeg, snappy
-, libpng, libxml2, libxslt, v8
+, libpng, libxml2, libxslt
 , xdg_utils, yasm, minizip, libwebp
 , libusb1, libexif, pciutils
 
@@ -75,7 +75,7 @@ let
     use_system_libusb = false; # http://crbug.com/266149
     use_system_skia = false;
     use_system_sqlite = false; # http://crbug.com/22208
-    use_system_v8 = !versionOlder source.version "34.0.0.0";
+    use_system_v8 = false;
   };
 
   opusWithCustomModes = libopus.override {
@@ -85,7 +85,7 @@ let
   defaultDependencies = [
     bzip2 flac speex icu opusWithCustomModes
     libevent expat libjpeg snappy
-    libpng libxml2 libxslt v8
+    libpng libxml2 libxslt
     xdg_utils yasm minizip libwebp
     libusb1 libexif
   ];

From c537fa6da03a484081d51998013fef9b9a037283 Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Thu, 27 Mar 2014 09:53:01 +0100
Subject: [PATCH 33/37] chromium: Update beta and dev to latest versions.

beta: 34.0.1847.60 -> 35.0.1916.47 (builds fine, tested)
dev:  35.0.1883.0  -> 36.0.1941.0  (builds fine, tested)

For the new version 36, we needed to rebase our user namespaces sandbox
patch, because http://crbug.com/312380 is preparing for an upstream
implementation of the same functionality.

Also, we need to add ply and jinja2 to the depends on version 36. This
is done unconditionally, because I want to avoid cluttering up the
expressions with various versionOlder checks.

The sandbox binary had to be fixed as well and we no longer use system
zlib, as - who might have guessed it - it's a fast moving target at
Chromium as well.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 .../networking/browsers/chromium/common.nix   |   4 +-
 .../networking/browsers/chromium/sandbox.nix  |   1 +
 .../browsers/chromium/source/default.nix      |   4 +-
 .../chromium/source/sandbox_userns_36.patch   | 293 ++++++++++++++++++
 .../browsers/chromium/source/sources.nix      |  14 +-
 5 files changed, 309 insertions(+), 7 deletions(-)
 create mode 100644 pkgs/applications/networking/browsers/chromium/source/sandbox_userns_36.patch

diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 85964ee76877..29b60967d559 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -67,7 +67,7 @@ let
     use_system_stlport = true;
     use_system_xdg_utils = true;
     use_system_yasm = true;
-    use_system_zlib = true;
+    use_system_zlib = false;
     use_system_protobuf = true;
 
     use_system_harfbuzz = false;
@@ -112,7 +112,7 @@ let
       glib gtk dbus_glib
       libXScrnSaver libXcursor libXtst mesa
       pciutils protobuf speechd libXdamage
-      pythonPackages.gyp
+      pythonPackages.gyp pythonPackages.ply pythonPackages.jinja2
     ] ++ optional gnomeKeyringSupport libgnome_keyring3
       ++ optionals gnomeSupport [ gnome.GConf libgcrypt ]
       ++ optional enableSELinux libselinux
diff --git a/pkgs/applications/networking/browsers/chromium/sandbox.nix b/pkgs/applications/networking/browsers/chromium/sandbox.nix
index 81ae49ebbb82..b470ed633253 100644
--- a/pkgs/applications/networking/browsers/chromium/sandbox.nix
+++ b/pkgs/applications/networking/browsers/chromium/sandbox.nix
@@ -7,6 +7,7 @@ stdenv.mkDerivation {
   patchPhase = ''
     sed -i -e '/#include.*base_export/c \
       #define BASE_EXPORT __attribute__((visibility("default")))
+    /#include/s|sandbox/linux|'"$(pwd)"'/linux|
     ' linux/suid/*.[hc]
   '';
 
diff --git a/pkgs/applications/networking/browsers/chromium/source/default.nix b/pkgs/applications/networking/browsers/chromium/source/default.nix
index e80e05ca9e24..4ec853bddf8d 100644
--- a/pkgs/applications/networking/browsers/chromium/source/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/source/default.nix
@@ -22,7 +22,9 @@ stdenv.mkDerivation {
 
   prePatch = "patchShebangs .";
 
-  patches = singleton ./sandbox_userns_31.patch;
+  patches = if (versionOlder version "36.0.0.0")
+            then singleton ./sandbox_userns_31.patch
+            else singleton ./sandbox_userns_36.patch;
 
   postPatch = ''
     sed -i -r \
diff --git a/pkgs/applications/networking/browsers/chromium/source/sandbox_userns_36.patch b/pkgs/applications/networking/browsers/chromium/source/sandbox_userns_36.patch
new file mode 100644
index 000000000000..a8f3ed0befd4
--- /dev/null
+++ b/pkgs/applications/networking/browsers/chromium/source/sandbox_userns_36.patch
@@ -0,0 +1,293 @@
+commit 3c80951744293441c2e66345ef7d82c199f4600e
+Author: aszlig <aszlig@redmoonstudios.org>
+Date:   Thu May 16 14:17:56 2013 +0200
+
+    zygote: Add support for user namespaces on Linux.
+    
+    The implementation is done by patching the Zygote host to execute the sandbox
+    binary with CLONE_NEWUSER and setting the uid and gid mapping so that the child
+    process is using uid 0 and gid 0 which map to the current user of the parent.
+    Afterwards, the sandbox will continue as if it was called as a setuid binary.
+    
+    In addition, this adds new_user_namespace as an option in process_util in order
+    to set the UID and GID mapping correctly. The reason for this is that just
+    passing CLONE_NEWUSER to clone_flags doesn't help in LaunchProcess(), because
+    without setting the mappings exec*() will clear the process's capability sets.
+    
+    If the kernel doesn't support unprivileged user namespaces and the sandbox
+    binary doesn't have the setuid flag, the Zygote main process will run without a
+    sandbox. This is to mimic the behaviour if no SUID sandbox binary path is set.
+    
+    Signed-off-by: aszlig <aszlig@redmoonstudios.org>
+
+diff --git a/base/process/launch.cc b/base/process/launch.cc
+index 81748f5..930f20f 100644
+--- a/base/process/launch.cc
++++ b/base/process/launch.cc
+@@ -26,6 +26,7 @@ LaunchOptions::LaunchOptions()
+ #if defined(OS_LINUX)
+       , clone_flags(0)
+       , allow_new_privs(false)
++      , new_user_namespace(false)
+ #endif  // OS_LINUX
+ #if defined(OS_CHROMEOS)
+       , ctrl_terminal_fd(-1)
+diff --git a/base/process/launch.h b/base/process/launch.h
+index 9e39fba..00e4c79 100644
+--- a/base/process/launch.h
++++ b/base/process/launch.h
+@@ -115,6 +115,9 @@ struct BASE_EXPORT LaunchOptions {
+   // By default, child processes will have the PR_SET_NO_NEW_PRIVS bit set. If
+   // true, then this bit will not be set in the new child process.
+   bool allow_new_privs;
++
++  // If true, start the process in a new user namespace.
++  bool new_user_namespace;
+ #endif  // defined(OS_LINUX)
+ 
+ #if defined(OS_CHROMEOS)
+diff --git a/base/process/launch_posix.cc b/base/process/launch_posix.cc
+index fe4da1a..7f118b8 100644
+--- a/base/process/launch_posix.cc
++++ b/base/process/launch_posix.cc
+@@ -40,6 +40,10 @@
+ 
+ #if defined(OS_LINUX)
+ #include <sys/prctl.h>
++#include <sched.h>
++#if !defined(CLONE_NEWUSER)
++#define CLONE_NEWUSER 0x10000000
++#endif
+ #endif
+ 
+ #if defined(OS_CHROMEOS)
+@@ -301,13 +305,23 @@ bool LaunchProcess(const std::vector<std::string>& argv,
+ 
+   pid_t pid;
+ #if defined(OS_LINUX)
+-  if (options.clone_flags) {
++  int map_pipe_fd[2];
++  int flags = options.clone_flags;
++
++  if (options.new_user_namespace) {
++    flags |= CLONE_NEWUSER;
++    if (pipe(map_pipe_fd) < 0) {
++      DPLOG(ERROR) << "user namespace pipe";
++      return false;
++    }
++  }
++
++  if (options.clone_flags || options.new_user_namespace) {
+     // Signal handling in this function assumes the creation of a new
+     // process, so we check that a thread is not being created by mistake
+     // and that signal handling follows the process-creation rules.
+-    RAW_CHECK(
+-        !(options.clone_flags & (CLONE_SIGHAND | CLONE_THREAD | CLONE_VM)));
+-    pid = syscall(__NR_clone, options.clone_flags, 0, 0, 0);
++    RAW_CHECK(!(flags & (CLONE_SIGHAND | CLONE_THREAD | CLONE_VM)));
++    pid = syscall(__NR_clone, flags, 0, 0, 0);
+   } else
+ #endif
+   {
+@@ -328,6 +342,21 @@ bool LaunchProcess(const std::vector<std::string>& argv,
+     // DANGER: no calls to malloc or locks are allowed from now on:
+     // http://crbug.com/36678
+ 
++#if defined(OS_LINUX)
++    if (options.new_user_namespace) {
++      // Close the write end of the pipe so we get an EOF when the parent closes
++      // the FD. This is to avoid race conditions when the UID/GID mappings are
++      // written _after_ execvp().
++      close(map_pipe_fd[1]);
++
++      char dummy;
++      if (HANDLE_EINTR(read(map_pipe_fd[0], &dummy, 1)) != 0) {
++        RAW_LOG(ERROR, "Unexpected input in uid/gid mapping pipe.");
++        _exit(127);
++      }
++    }
++#endif
++
+     // DANGER: fork() rule: in the child, if you don't end up doing exec*(),
+     // you call _exit() instead of exit(). This is because _exit() does not
+     // call any previously-registered (in the parent) exit handlers, which
+@@ -451,6 +480,40 @@ bool LaunchProcess(const std::vector<std::string>& argv,
+     _exit(127);
+   } else {
+     // Parent process
++#if defined(OS_LINUX)
++    if (options.new_user_namespace) {
++      // We need to write UID/GID mapping here to map the current user outside
++      // the namespace to the root user inside the namespace in order to
++      // correctly "fool" the child process.
++      char buf[256];
++      int map_fd, map_len;
++
++      snprintf(buf, sizeof(buf), "/proc/%d/uid_map", pid);
++      map_fd = open(buf, O_RDWR);
++      DPCHECK(map_fd >= 0);
++      snprintf(buf, sizeof(buf), "0 %d 1", geteuid());
++      map_len = strlen(buf);
++      if (write(map_fd, buf, map_len) != map_len) {
++        RAW_LOG(WARNING, "Can't write to uid_map.");
++      }
++      close(map_fd);
++
++      snprintf(buf, sizeof(buf), "/proc/%d/gid_map", pid);
++      map_fd = open(buf, O_RDWR);
++      DPCHECK(map_fd >= 0);
++      snprintf(buf, sizeof(buf), "0 %d 1", getegid());
++      map_len = strlen(buf);
++      if (write(map_fd, buf, map_len) != map_len) {
++        RAW_LOG(WARNING, "Can't write to gid_map.");
++      }
++      close(map_fd);
++
++      // Close the pipe on the parent, so the child can continue doing the
++      // execvp() call.
++      close(map_pipe_fd[1]);
++    }
++#endif
++
+     if (options.wait) {
+       // While this isn't strictly disk IO, waiting for another process to
+       // finish is the sort of thing ThreadRestrictions is trying to prevent.
+diff --git a/content/browser/zygote_host/zygote_host_impl_linux.cc b/content/browser/zygote_host/zygote_host_impl_linux.cc
+index 0106a7a..a0465af 100644
+--- a/content/browser/zygote_host/zygote_host_impl_linux.cc
++++ b/content/browser/zygote_host/zygote_host_impl_linux.cc
+@@ -124,25 +124,31 @@ void ZygoteHostImpl::Init(const std::string& sandbox_cmd) {
+ 
+   sandbox_binary_ = sandbox_cmd.c_str();
+ 
+-  // A non empty sandbox_cmd means we want a SUID sandbox.
+-  using_suid_sandbox_ = !sandbox_cmd.empty();
++  bool userns_sandbox = false;
++  const std::vector<std::string> cmd_line_unwrapped(cmd_line.argv());
+ 
+-  if (using_suid_sandbox_) {
++  if (!sandbox_cmd.empty()) {
+     struct stat st;
+     if (stat(sandbox_binary_.c_str(), &st) != 0) {
+       LOG(FATAL) << "The SUID sandbox helper binary is missing: "
+                  << sandbox_binary_ << " Aborting now.";
+     }
+ 
+-    if (access(sandbox_binary_.c_str(), X_OK) == 0 &&
+-        (st.st_uid == 0) &&
+-        (st.st_mode & S_ISUID) &&
+-        (st.st_mode & S_IXOTH)) {
++    if (access(sandbox_binary_.c_str(), X_OK) == 0) {
++      using_suid_sandbox_ = true;
++
+       cmd_line.PrependWrapper(sandbox_binary_);
+ 
+       scoped_ptr<sandbox::SetuidSandboxClient>
+           sandbox_client(sandbox::SetuidSandboxClient::Create());
+       sandbox_client->SetupLaunchEnvironment();
++
++      if (!((st.st_uid == 0) &&
++            (st.st_mode & S_ISUID) &&
++            (st.st_mode & S_IXOTH))) {
++        userns_sandbox = true;
++        sandbox_client->SetNoSuid();
++      }
+     } else {
+       LOG(FATAL) << "The SUID sandbox helper binary was found, but is not "
+                     "configured correctly. Rather than run without sandboxing "
+@@ -167,7 +173,19 @@ void ZygoteHostImpl::Init(const std::string& sandbox_cmd) {
+   base::LaunchOptions options;
+   options.fds_to_remap = &fds_to_map;
+   options.allow_new_privs = using_suid_sandbox_;  // Don't PR_SET_NO_NEW_PRIVS.
++  if (userns_sandbox)
++    options.new_user_namespace = true;
+   base::LaunchProcess(cmd_line.argv(), options, &process);
++
++  if (process == -1 && userns_sandbox) {
++    LOG(ERROR) << "User namespace sandbox failed to start, running without "
++               << "sandbox! You need at least kernel 3.8.0 with CONFIG_USER_NS "
++               << "enabled in order to use the sandbox without setuid bit.";
++    using_suid_sandbox_ = false;
++    options.new_user_namespace = false;
++    base::LaunchProcess(cmd_line_unwrapped, options, &process);
++  }
++
+   CHECK(process != -1) << "Failed to launch zygote process";
+ 
+   if (using_suid_sandbox_) {
+diff --git a/content/zygote/zygote_main_linux.cc b/content/zygote/zygote_main_linux.cc
+index 5dc09fa..4e09bc4 100644
+--- a/content/zygote/zygote_main_linux.cc
++++ b/content/zygote/zygote_main_linux.cc
+@@ -397,6 +397,13 @@ static bool EnterSuidSandbox(sandbox::SetuidSandboxClient* setuid_sandbox) {
+     CHECK(CreateInitProcessReaper());
+   }
+ 
++  // Don't set non-dumpable, as it causes trouble when the host tries to find
++  // the zygote process (XXX: Not quite sure why this happens with user
++  // namespaces). Fortunately, we also have the seccomp filter sandbox which
++  // should disallow the use of ptrace.
++  if (setuid_sandbox->IsNoSuid())
++    return true;
++
+ #if !defined(OS_OPENBSD)
+   // Previously, we required that the binary be non-readable. This causes the
+   // kernel to mark the process as non-dumpable at startup. The thinking was
+diff --git a/sandbox/linux/suid/client/setuid_sandbox_client.cc b/sandbox/linux/suid/client/setuid_sandbox_client.cc
+index 8ed1a97..cbdfadc 100644
+--- a/sandbox/linux/suid/client/setuid_sandbox_client.cc
++++ b/sandbox/linux/suid/client/setuid_sandbox_client.cc
+@@ -173,6 +173,10 @@ bool SetuidSandboxClient::IsInNewNETNamespace() const {
+   return env_->HasVar(kSandboxNETNSEnvironmentVarName);
+ }
+ 
++bool SetuidSandboxClient::IsNoSuid() const {
++  return env_->HasVar(kSandboxNoSuidVarName);
++}
++
+ bool SetuidSandboxClient::IsSandboxed() const {
+   return sandboxed_;
+ }
+@@ -182,4 +186,8 @@ void SetuidSandboxClient::SetupLaunchEnvironment() {
+   SetSandboxAPIEnvironmentVariable(env_);
+ }
+ 
++void SetuidSandboxClient::SetNoSuid() {
++  env_->SetVar(kSandboxNoSuidVarName, "1");
++}
++
+ }  // namespace sandbox
+diff --git a/sandbox/linux/suid/client/setuid_sandbox_client.h b/sandbox/linux/suid/client/setuid_sandbox_client.h
+index 0f6db7a..c629391 100644
+--- a/sandbox/linux/suid/client/setuid_sandbox_client.h
++++ b/sandbox/linux/suid/client/setuid_sandbox_client.h
+@@ -46,6 +46,8 @@ class SANDBOX_EXPORT SetuidSandboxClient {
+   bool IsInNewPIDNamespace() const;
+   // Did the setuid helper create a new network namespace ?
+   bool IsInNewNETNamespace() const;
++  // Is sandboxed without SUID binary ?
++  bool IsNoSuid() const;
+   // Are we done and fully sandboxed ?
+   bool IsSandboxed() const;
+ 
+@@ -53,6 +55,8 @@ class SANDBOX_EXPORT SetuidSandboxClient {
+   // helper.
+   void SetupLaunchEnvironment();
+ 
++  void SetNoSuid();
++
+  private:
+   // Holds the environment. Will never be NULL.
+   base::Environment* env_;
+diff --git a/sandbox/linux/suid/common/sandbox.h b/sandbox/linux/suid/common/sandbox.h
+index 9345287..2db659e 100644
+--- a/sandbox/linux/suid/common/sandbox.h
++++ b/sandbox/linux/suid/common/sandbox.h
+@@ -15,6 +15,7 @@ static const char kAdjustOOMScoreSwitch[] = "--adjust-oom-score";
+ 
+ static const char kSandboxDescriptorEnvironmentVarName[] = "SBX_D";
+ static const char kSandboxHelperPidEnvironmentVarName[] = "SBX_HELPER_PID";
++static const char kSandboxNoSuidVarName[] = "SBX_NO_SUID";
+ 
+ static const long kSUIDSandboxApiNumber = 1;
+ static const char kSandboxEnvironmentApiRequest[] = "SBX_CHROME_API_RQ";
diff --git a/pkgs/applications/networking/browsers/chromium/source/sources.nix b/pkgs/applications/networking/browsers/chromium/source/sources.nix
index dceab16d38cb..9204c7f08e5b 100644
--- a/pkgs/applications/networking/browsers/chromium/source/sources.nix
+++ b/pkgs/applications/networking/browsers/chromium/source/sources.nix
@@ -1,15 +1,21 @@
 # This file is autogenerated from update.sh in the same directory.
 {
   dev = {
-    version = "35.0.1883.0";
-    sha256 = "0qbv6prxl18y5824pfd13ng9798g561gzb6nypwp502hqr45jvb6";
+    version = "36.0.1941.0";
+    sha256 = "12rhyq8hliwc8b3371h2axzlzabg99c06d02kl9ldag2kxfpsfps";
+    sha256bin32 = "1rbl5x0pjid5lypdplbqvcx4lgvr2rlbiv83ivvqb5dbg6p7886g";
+    sha256bin64 = "18440spj541w4bqjblb2wpf94slg4if176gprccbxw9sy6b7z38w";
   };
   beta = {
-    version = "34.0.1847.60";
-    sha256 = "1na5d6z4a0wkabn7cj62vyiv3mmvcb6qdvrkyy6fj79h7gk2hb7k";
+    version = "35.0.1916.47";
+    sha256 = "0pq87aybfna4pgsf02v97lprj5kbsrzim7c44nqarmcvlj4l65ch";
+    sha256bin32 = "057l59any3hiqdg1gh4nxry542083lxdaychhljbrfkipq1gy4yv";
+    sha256bin64 = "07n8sqv234dg959id023w3mz5n9ascwrcmxq3px96bqgqim2vf8s";
   };
   stable = {
     version = "34.0.1847.116";
     sha256 = "04cpfav5rqa117igvzmrw0045r2ljxg5fqb46qgqvkgff30pjrfx";
+    sha256bin32 = "1k24j80xgc91p8ssynql9ifjdhpz6w7vl3pk9lvkr0sdhg16hlrf";
+    sha256bin64 = "16gidav4ilc95fr1d6832xzpyynfwnglbz7b33gq62vp8bj77da4";
   };
 }

From ad770bea6789a14dbad6178d3c5e39775d1e5d55 Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Sat, 19 Apr 2014 15:16:22 +0200
Subject: [PATCH 34/37] chromium: Move update.sh back into the main path.

This is to ensure that nothing unexpected will be after the merge of the
refactoring branch, and also my own autoupdate machinery is expecting
this location, so there really is no reason to change it now.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 .../networking/browsers/chromium/source/sources.nix           | 2 +-
 .../networking/browsers/chromium/{source => }/update.sh       | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)
 rename pkgs/applications/networking/browsers/chromium/{source => }/update.sh (95%)

diff --git a/pkgs/applications/networking/browsers/chromium/source/sources.nix b/pkgs/applications/networking/browsers/chromium/source/sources.nix
index 9204c7f08e5b..6881b8d44e84 100644
--- a/pkgs/applications/networking/browsers/chromium/source/sources.nix
+++ b/pkgs/applications/networking/browsers/chromium/source/sources.nix
@@ -1,4 +1,4 @@
-# This file is autogenerated from update.sh in the same directory.
+# This file is autogenerated from update.sh in the parent directory.
 {
   dev = {
     version = "36.0.1941.0";
diff --git a/pkgs/applications/networking/browsers/chromium/source/update.sh b/pkgs/applications/networking/browsers/chromium/update.sh
similarity index 95%
rename from pkgs/applications/networking/browsers/chromium/source/update.sh
rename to pkgs/applications/networking/browsers/chromium/update.sh
index 806169f524c3..e82d22f34fd0 100755
--- a/pkgs/applications/networking/browsers/chromium/source/update.sh
+++ b/pkgs/applications/networking/browsers/chromium/update.sh
@@ -3,7 +3,7 @@
 channels_url="http://omahaproxy.appspot.com/all?csv=1";
 history_url="http://omahaproxy.appspot.com/history";
 bucket_url="http://commondatastorage.googleapis.com/chromium-browser-official/";
-base_path="$(cd "$(dirname "$0")" && pwd)";
+base_path="$(cd "$(dirname "$0")" && pwd)/source";
 
 source "$(nix-build --no-out-link "$base_path/update.nix" -A updateHelpers)";
 
@@ -116,7 +116,7 @@ versions="$(echo "$omaha" | sed -nr -e 's/^linux,([^,]+,[^,]+).*$/\1/p')";
 channel_exprs="$(get_channel_exprs "$versions")";
 
 cat > "$base_path/sources.nix" <<-EOF
-# This file is autogenerated from update.sh in the same directory.
+# This file is autogenerated from update.sh in the parent directory.
 {
 $channel_exprs
 }

From 11b84078c5e1cc3d3ac38122212e263760d7019d Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Sat, 19 Apr 2014 15:25:21 +0200
Subject: [PATCH 35/37] chromium/common: Wrap lines to 80 characters.

Yes, it's just a comment and yes, it's so insignificant that everyone
would make a "O_o" face. But I'm getting annoyed by things like this.

Obviously that means no feature changes :-)

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 pkgs/applications/networking/browsers/chromium/common.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 29b60967d559..9727de1a5157 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -155,7 +155,8 @@ let
       linux_sandbox_chrome_path="${libExecPath}/${packageName}";
       werror = "";
 
-      # Google API keys, see http://www.chromium.org/developers/how-tos/api-keys.
+      # Google API keys, see:
+      #   http://www.chromium.org/developers/how-tos/api-keys
       # Note: These are for NixOS/nixpkgs use ONLY. For your own distribution,
       # please get your own set of keys.
       google_api_key = "AIzaSyDGi15Zwl11UNe6Y-5XW_upsfyw31qwZPI";

From 0517041a2fc421f3efa75933e8258ae001ce21ab Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Sat, 19 Apr 2014 15:31:38 +0200
Subject: [PATCH 36/37] chromium: Drop conditionals for version 33.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 pkgs/applications/networking/browsers/chromium/browser.nix     | 2 --
 .../networking/browsers/chromium/source/default.nix            | 3 +--
 2 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/browser.nix b/pkgs/applications/networking/browsers/chromium/browser.nix
index 8c83dbb853a6..e230af175300 100644
--- a/pkgs/applications/networking/browsers/chromium/browser.nix
+++ b/pkgs/applications/networking/browsers/chromium/browser.nix
@@ -9,9 +9,7 @@ mkChromiumDerivation (base: rec {
   installPhase = ''
     ensureDir "$libExecPath"
     cp -v "$buildPath/"*.pak "$libExecPath/"
-    ${optionalString (!versionOlder base.version "34.0.0.0") ''
     cp -v "$buildPath/icudtl.dat" "$libExecPath/"
-    ''}
     cp -vR "$buildPath/locales" "$buildPath/resources" "$libExecPath/"
     cp -v $buildPath/libffmpegsumo.so "$libExecPath/"
 
diff --git a/pkgs/applications/networking/browsers/chromium/source/default.nix b/pkgs/applications/networking/browsers/chromium/source/default.nix
index 4ec853bddf8d..2c7e7277b814 100644
--- a/pkgs/applications/networking/browsers/chromium/source/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/source/default.nix
@@ -32,14 +32,13 @@ stdenv.mkDerivation {
       -e 's|/bin/echo|echo|' \
       -e "/python_arch/s/: *'[^']*'/: '""'/" \
       build/common.gypi chrome/chrome_tests.gypi
-    sed -i '/not RunGN/,+1d' build/gyp_chromium
+    sed -i -e '/not RunGN/,+1d' -e '/import.*depot/d' build/gyp_chromium
     sed -i -e 's|/usr/bin/gcc|gcc|' \
       third_party/WebKit/Source/build/scripts/scripts.gypi \
       third_party/WebKit/Source/build/scripts/preprocessor.pm
   '' + optionalString useOpenSSL ''
     cat $opensslPatches | patch -p1 -d third_party/openssl/openssl
   '' + optionalString (!versionOlder version "34.0.0.0") ''
-    sed -i '/import.*depot/d' build/gyp_chromium
   '';
 
   outputs = [ "out" "sandbox" "bundled" "main" ];

From 18234b676821db85f6d94777c90303e513f2f110 Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Sun, 20 Apr 2014 08:39:40 +0200
Subject: [PATCH 37/37] chromium: Fix package name for browser derivation.

The packageName attribute defines the output path and binary name of the
product that's going to be created, so we really want to have "chromium"
instead of "chromium-browser" here, especially for the resulting binary.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
---
 pkgs/applications/networking/browsers/chromium/browser.nix | 1 +
 pkgs/applications/networking/browsers/chromium/common.nix  | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/networking/browsers/chromium/browser.nix b/pkgs/applications/networking/browsers/chromium/browser.nix
index e230af175300..a4b99bc58023 100644
--- a/pkgs/applications/networking/browsers/chromium/browser.nix
+++ b/pkgs/applications/networking/browsers/chromium/browser.nix
@@ -4,6 +4,7 @@ with stdenv.lib;
 
 mkChromiumDerivation (base: rec {
   name = "chromium-browser";
+  packageName = "chromium";
   buildTargets = [ "chrome" ];
 
   installPhase = ''
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 9727de1a5157..7bed83ac4c6d 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -91,7 +91,7 @@ let
   ];
 
   # build paths and release info
-  packageName = extraAttrs.name;
+  packageName = extraAttrs.packageName or extraAttrs.name;
   buildType = "Release";
   buildPath = "out/${buildType}";
   libExecPath = "$out/libexec/${packageName}";