Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 621998 - www-client/firefox add flag for disabling google api key during build
Summary: www-client/firefox add flag for disabling google api key during build
Status: UNCONFIRMED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal enhancement with 4 votes (vote)
Assignee: Mozilla Gentoo Team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-06-17 09:54 UTC by Th
Modified: 2019-06-20 05:00 UTC (History)
7 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Th 2017-06-17 09:54:27 UTC
I noticed in about:support that the row 'Google Key' says 'found'. After taking a look into the ebuild-files every ebuild sets an api-key in src_configure.

It would be nice to be able to disable the api key during the build-process with a use-flag.

Reproducible: Always
Comment 1 Jory A. Pratt gentoo-dev 2017-06-19 00:28:36 UTC
(In reply to Th from comment #0)
> I noticed in about:support that the row 'Google Key' says 'found'. After
> taking a look into the ebuild-files every ebuild sets an api-key in
> src_configure.
> 
> It would be nice to be able to disable the api key during the build-process
> with a use-flag.
> 
> Reproducible: Always

There is no advantage to disabling it. This would just introduce more breakage from users disabling a feature they expect to work.
Comment 2 haarp 2017-07-03 11:38:21 UTC
> # Note: These are for Gentoo Linux use ONLY.

You're inadvertently making it possible for Google to trivially identify and fingerprint Gentoo users. Can't say I approve.
Comment 3 Ian Stakenvicius gentoo-dev 2018-10-05 18:14:51 UTC
I'm still not willing to put this on a use flag.

Builds should however still support EXTRA_ECONF, and so with that you could append --without-google-api-keyfile or --with-google-api-keyfile=/path/to/your/own to configuration in order to override it, without patching the ebuild yourself.

However as Jory said, YMMV and you get to pick up the pieces.
Comment 4 Thomas Deutschmann gentoo-dev Security 2018-10-05 19:46:31 UTC
How about adding a check for an environment variable? If not set, ebuild will set it. We just need to check for a special value to set --without.. or will an empty just disable that feature?
Comment 5 Ian Stakenvicius gentoo-dev 2018-10-05 19:53:08 UTC
(In reply to Thomas Deutschmann from comment #4)
> How about adding a check for an environment variable? If not set, ebuild
> will set it. We just need to check for a special value to set --without.. or
> will an empty just disable that feature?

I was thinking that, but, ECONF_EXTRA is a variable too (would be set in the same manner in package.env) and it'll already take care of this.  And we are -really- strongly discouraged from allowing random variables in ebuilds from being manipulated by end users..
Comment 6 Libor Polčák 2018-12-16 10:49:43 UTC
I found some info about the issue from Seamonkey devs mailing list http://mozilla.6506.n7.nabble.com/Google-API-Key-td281258.html. I am not sure I understand the issue but I think that I am with the Th and I would rather have a build that does not communicate with Google than setting up some magical string somewhere behind my back.

I especially agree with http://mozilla.6506.n7.nabble.com/Google-API-Key-td281258.html#message281338:

> > People that build their own versions of Firefox can either provide their
> > own keys and these services will work... or they can do nothing, and
> > these services will not work.
> 
> This is IMHO a big argument to, one by one, try to get rid of using
> those services and build on free-to-use alternatives instead.
> 
> Robert Kaiser

I would like to have break_google_products_reuiring_api_key USE flag for firefox and seamonkey. That way, no one can complain that they disabled a feature they expect to work.