Currently, www-client/chromium does not enforce built-in (static) public key HTTPS pins. This is caused by a code in net/http/transport_security_state.cc that disables these pins (and a similar, static Expect-CT list) for non-Google builds. Note that these hashes are getting built-in into a Chromium binary anyway, just never getting used. Gentoo ships the same pin list in Firefox and Thunderbird, where it is normally enforced, so there is no reason why Chromium should be different in this regard. Besides that, Chromium will automatically disable enforcing of static pins once 10 weeks passes since the time the browser was compiled (see TransportSecurityState::IsBuildTimely() in net/http/transport_security_state.cc). The attached patch enables these pins also for our builds. A test site for HTTPS public key pinning can be reached at https://pinning-test.badssl.com/
Created attachment 568580 [details, diff] patch to reenable static pinning
Please submit a patch upstream to make this configurable via gn.
> Please submit a patch upstream to make this configurable via gn. Would Gentoo make use of such option in its www-client/chromium ebuilds if upstream makes it available? If not, it will be hard to convince Chromiumm developers to add an option which will isn't going to be used.
