4 ms·
To elaborate, the following distributions of Chromium are violating the Google API terms of service [1] [2] by publishing the API secret key publicly in the bui
by rhencke 6y ago
To elaborate, the following distributions of Chromium are violating the Google API terms of service [1] [2] by publishing the API secret key publicly in the build source code responsible for building Chromium:
* Alpine Linux (community port) - https://git.alpinelinux.org/aports/tree/community/chromium/APKBUILD?id=7f866234e512a34d9758a6cee5b8edfba2147c4f#n192 https://git.alpinelinux.org/aports/tree/community/chromium/A...
* Arch Linux (svntogit, AUR) - https://github.com/archlinux/svntogit-packages/blob/1e8f3fe75e060ea70553b32926185bec84561e32/trunk/PKGBUILD#L67 https://github.com/archlinux/svntogit-packages/blob/1e8f3fe7... - https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=chromium-dev&id=0ea1e1fad209a7ca2552fbe6efaf9e49c732b8d8#n111 https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=chrom...
* Fedora Linux - https://src.fedoraproject.org/rpms/chromium/blob/e78656ce58dd9e7417433461df24e191eaf41b29/f/chromium.spec#_171 https://src.fedoraproject.org/rpms/chromium/blob/e78656ce58d...
* Gentoo - https://github.com/gentoo/gentoo/blob/9acf51b665b6f4b5b97edb871da588c4e870e9b3/www-client/chromium/chromium-89.0.4343.0.ebuild#L624 https://github.com/gentoo/gentoo/blob/9acf51b665b6f4b5b97edb...
* OpenSuSE - https://build.opensuse.org/package/view_file/openSUSE:Factory/chromium/chromium.spec https://build.opensuse.org/package/view_file/openSUSE:Factor...
* Slackware - http://www.slackware.com/~alien/slackbuilds/chromium/build/chromium_apikeys http://www.slackware.com/~alien/slackbuilds/chromium/build/c...
* Ubuntu, Linux Mint (Canonincal Chromium Snap) - https://git.launchpad.net/~chromium-team/chromium-browser/+git/snap-from-source/tree/build/args.gn?h=stable&id=af9ed0cec8cdfcc2972b8a3e13a750516b358211#n3 https://git.launchpad.net/~chromium-team/chromium-browser/+g...
[1] https://developers.google.com/terms https://developers.google.com/terms (specifically: "You will only access (or attempt to access) an API by the means described in the documentation of that API. If Google assigns you developer credentials (e.g. client IDs), you must use them with the applicable APIs. You will not misrepresent or mask either your identity or your API Client's identity when using the APIs or developer accounts." and "Developer credentials (such as passwords, keys, and client IDs) are intended to be used by you and identify your API Client. You will keep your credentials confidential and make reasonable efforts to prevent and discourage other API Clients from using your credentials. Developer credentials may not be embedded in open source projects.")
[2] https://www.chromium.org/developers/how-tos/api-keys https://www.chromium.org/developers/how-tos/api-keys (specifically: "Note that the keys you have now acquired are not for distribution purposes and must not be shared with other users.")
- pabs3 6y agoSome of them could have agreements with Google that let them do that.
- rthomas6 6y agoThe Arch Linux one sort of doesn't count. The AUR is a user-created package repository. Anyone can make a build and add it to the AUR.
- rhencke 6y agoCan you elaborate on what you mean by "doesn't count"?
- selfhoster11 6y agoIt's not an official package. The Arch Linux project cannot be held responsible for what non-official packages do.
- rhencke 6y agoI agree with you. I don't think any Chromium distributions are at risk of their keys being revoked - I don't believe Google will take any action here. But, I also don't see anyone ever talk about this, and I think it's worth people being aware.