Ungoogled-chromium: automatic updates (or just checking for updates) for the browser and extensions

[magicgoose]

This would a good thing, because outdated browsers and extensions are a security risk.
And checking manually every time is meh, I'm sure most users will just forget about it.

[Eloston]

We could probably create some sort of extension that users can install to have this functionality. Or we could have some external utility to check for updates.

I am open to suggestions.

[9Morello]

An extension that checks for new Chromium versions would be cool. Not sure whats the best way for extensions, though.

[sp-1234]

https://blog.chromium.org/2009/07/smaller-is-faster-and-safer-too.html
https://dev.chromium.org/developers/design-documents/software-updates-courgette
tl;dr original chromium uses updates in form of binary diffs and they are very size-efficient

Probably if these diffs are generated and uploaded to "Github releases" too, they might work too.

[woolyss]

Henry updated its tool (chrlauncher) to install, update and launch ungoogled-chromium ;)
https://github.com/henrypp/chrlauncher/issues/33#issuecomment-279736691

...but nothing about extensions. Sorry.

[magicgoose]

@woolyss it's only for windows™.

[woolyss]

@magicgoose, Yes. It is only for Windows.

I know it is possible to write a shell script to update ungoogled-chromium on Mac and Linux.
An example about Chromium: https://github.com/mloporchio/chromium-downloader-script
More on my site: https://chromium.woolyss.com/#updater (this is about Chromium but can be improved for ungoogled-chromium)

[Eloston]

It's a bit unnecessary to provide an external updater system for Linux, as most Linux systems come with a package system. For Mac, I think there are several packaging systems out there already.

[woolyss]

Yes @Eloston, I completely agree with you.

[koichirose]

Any news on this? Is there a way to at least have notifications about new updates?

[pjv]

i wrote a super-kludgy shell script with a node package dependency, a dependency on jq, and a dependency on curl that looks at the extensions you have installed and then downloads the latest version from the play store into a directory of your choosing. You then have to drag them into the extensions page to install the updates.

It only works with play store extensions and it's a long way from a proper updater, but it beats doing it all manually, and I think if anyone wanted to it could be improved/extended.

Here's a gist.

EDIT: this is only tested on OS X.

[Unkn0wn-MDCLXIV]

I've written a small script to update and install extensions easily.
It's windows only tho, but if there is demand I can upload and release it on github.
See my other reply at #226

[ajkblue]

I've found the easiest way to keep ungoogled-chromium updated is with brew cask, which will automatically install the latest version for me as long as I run "brew update".

[Eloston]

For users of feeds, an Atom feed is available for the contributor binaries download page

[XXLCXX]

Eloston - Give please the link to download your browser. DEBIAN

[antonin-lebrard]

@sem5959 https://ungoogled-software.github.io/ungoogled-chromium-binaries/

[XXLCXX]

Спасибо.

[unicorntaco]

I favor the idea of an extension to perform these various checks. It would be great if that extension would accept SOCKS5 proxy (with auth) for googley chittering.

[ownchoice]

This is the only downside of using Ungoogled Chromium for me.
I don't want to have the browser and extensions outdated, and updating manually is a little bit painful.

[Eloston]

FYI my proposed solution for automatic extension updates is in #285.

[intika]

Update checker for UC :
Here are some extensions solution that can be used to check for update for UC other than a distro repo

• Website Monitoring For Change Extensions like visualping or page-monitor
  (you just need add uc-site to the monitored sites...)

• Github notification like notifier-for-github (does not require to be logged in... of course you will need to subscribe to UC repo)

• Rss-Feed Reader like feedbro

[Eloston]

In addition to the Atom feed for contributor binaries (link above), there's also the Atom feed for new tags from GitHub.

[intika]

a function chat check that link could be added easily mainstream but in one hand

• update are important for security
  and the other
• users may dislike a connection to github

I think as it would just check one link for updates i think it would be fair to enable it by default (this eventual feature) and add a flag to make it disableable

@Eloston what do you think ?

[Eloston]

@intika This is something an extension can do perfectly well. I see no need for anything to be added to ungoogld-chromium for this. Once a solution comes around, we could suggest it in the Wiki.

[IANatCAMBIO]

I agree in leaving this functionality as an extension. The modular framework is there for a reason, and should be used whenever possible.

It sounds like this is really 2 issues:
Checking/Notifying that a new version is available
and
Performing the update.

BSD/Linux and MacOS can use their package managers for #2, but a notification of a new version would be nice.

Windows users would need both types of functionality.

As Intika said above, extensions to check for page changes (i.e. new published binaries) already exist, but they must be setup and configured. If we're trying to stay true to the published purpose for this project, then we try to maintain functional parity with Chrome/Chromium. That would include at least notifying of updates.

Would it be possible to have a bundle of default extensions (including and update checker) to provide the functionality? This does not have to be included with UC, so that we still maintain the 'you must opt-in for new features' requirement.
Although, it should not be enabled by default, branding and hosting that bundle along with the binary downloads would allow for standard Open-Source protections (code review).

[NeverDecaf]

I threw together a barebones extension that adds this functionality to Ungoogled Chromium:
https://github.com/NeverDecaf/chromium-web-store

Unfortunately I could not find a way with my limited javascript knowledge to dynamically detect the buttons on the chrome web store, therefore if the site layout changes at all this part of the extension will surely break. The code for update checking, however, uses the chrome api and should work fine until google deprecates it.

Please note I have barely tested this, and on Windows only. If something is broken I'll be happy to fix it if I can, just open an issue. A PR to add a robust button detection or to make the popup actually look nice is more than welcome.

[woolyss]

Thank you very much NeverDecaf. It works like a charm. Bravo!

I made a video to show it. Free to use and share it anywhere!

• Stored on my server: https://chromium.woolyss.com/f/video-extension-chromium-web-store.mp4
• Stored at Streamable (without any user account): https://streamable.com/655nn

My config:

• ungoogled-chromium 76.0.3809.100 (64-bit)
• chrlaucher (https://github.com/henrypp/chrlauncher) to test ungoogled-chromium in its portable version.
• Windows 10 1903 with the enabled dark theme.

[NeverDecaf]

@woolyss Thanks for the video! I've added it to the readme as it makes the install process very clear.

[woolyss]

It is ok @NeverDecaf. Thank you. I put a link of your github project on my site. Contact me if you want a better video! ;)

[TNTBOMBOM]

Appimage support update, any issue with it? This resolves almost all GNU/Linux upgrades issue (using appimage version).

https://docs.appimage.org/packaging-guide/optional/updates.html

https://github.com/AppImage/AppImageUpdate

[PF4Public]

outdated […] extensions are a security risk.

In the light of a recent news about an extension being sold to people, whose intentions were not very decent, auto-updating mechanism of Chrome backfired badly on users. So that auto-updated extension also poses a security risk!

[TNTBOMBOM]

can you share with us the sources? "extension being sold to people" ,
"chrome backfired badly on users"

ThX

PF4Public:

outdated […] extensions are a security risk.

In the light of a recent news about an extension being sold to people, whose intentions were not very decent, auto-updating mechanism of Chrome backfired badly on users. So that auto-updated extension also poses a security risk!

[PF4Public]

Given the tremendous hatred that the author of the extension received, I hesitate providing direct links, as this might spawn another wave of anger, which is unconstrictive and absolutely not helpful in this situation.

I think, I'll just describe the security issue itself instead.
Imagine an extension, that is installed on a lot of Chrome profiles. One day, author of the extension gives access to posting updates to someone else. That person modifies the extension to send headers of a select requests of victims to himself. Due to autoupdate, this malicious extension got installed on a computers of unsuspecting users without their approval or consent.

Aftermath is still unfolding unfortunately :(

[dm17]

@woolyss @NeverDecaf You guys think it would be easier to just have a Dockerfile with a config file sources repos for each extension we want - and we just rebuild this every time we want to latest plugins & ungoogled-chromium? Thoughts?
I also have different extensions per chromium profile, which could be a pain for this.