Chromium, as built in many open-source distributions, uses a per-distribution Go...

rhencke · on Dec 8, 2020

To elaborate, the following distributions of Chromium are violating the Google API terms of service [1] [2] by publishing the API secret key publicly in the build source code responsible for building Chromium:

* Alpine Linux (community port) - https://git.alpinelinux.org/aports/tree/community/chromium/A...

* Arch Linux (svntogit, AUR) - https://github.com/archlinux/svntogit-packages/blob/1e8f3fe7... - https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=chrom...

* Fedora Linux - https://src.fedoraproject.org/rpms/chromium/blob/e78656ce58d...

* Gentoo - https://github.com/gentoo/gentoo/blob/9acf51b665b6f4b5b97edb...

* OpenSuSE - https://build.opensuse.org/package/view_file/openSUSE:Factor...

* Slackware - http://www.slackware.com/~alien/slackbuilds/chromium/build/c...

* Ubuntu, Linux Mint (Canonincal Chromium Snap) - https://git.launchpad.net/~chromium-team/chromium-browser/+g...

[1] https://developers.google.com/terms (specifically: "You will only access (or attempt to access) an API by the means described in the documentation of that API. If Google assigns you developer credentials (e.g. client IDs), you must use them with the applicable APIs. You will not misrepresent or mask either your identity or your API Client's identity when using the APIs or developer accounts." and "Developer credentials (such as passwords, keys, and client IDs) are intended to be used by you and identify your API Client. You will keep your credentials confidential and make reasonable efforts to prevent and discourage other API Clients from using your credentials. Developer credentials may not be embedded in open source projects.")

[2] https://www.chromium.org/developers/how-tos/api-keys (specifically: "Note that the keys you have now acquired are not for distribution purposes and must not be shared with other users.")

rthomas6 · on Dec 9, 2020

The Arch Linux one sort of doesn't count. The AUR is a user-created package repository. Anyone can make a build and add it to the AUR.

rhencke · on Dec 9, 2020

Can you elaborate on what you mean by "doesn't count"?

selfhoster11 · on Dec 9, 2020

It's not an official package. The Arch Linux project cannot be held responsible for what non-official packages do.

rhencke · on Dec 9, 2020

I agree with you. I don't think any Chromium distributions are at risk of their keys being revoked - I don't believe Google will take any action here.

But, I also don't see anyone ever talk about this, and I think it's worth people being aware.

pabs3 · on Dec 9, 2020

Some of them could have agreements with Google that let them do that.

rhencke · on Dec 9, 2020

Let's say this is true.

If I fork one of the aforementioned Chromium packages, is my fork covered under that agreement? Is my right to build and produce my own binaries from the original unmodified source still intact?

pabs3 · on Dec 9, 2020

Presumably not.