search

Alex313031 / thorium

Chromium fork named after radioactive element No. 90. Windows and MacOS/Raspi/Android/Special builds are in different repositories, links are towards the top of the README.md.
https://thorium.rocks/
BSD 3-Clause "New" or "Revised" License
4.7k stars 146 forks source link

using ubuntu PPA instead of custom site #36

Closed lilinquin closed 2 years ago

lilinquin commented 2 years ago

Firstly apologies this suggestion was not meant to be impolite.

Would you mind hosting the .deb files at a Ubuntu PPA (1) instead of .rocks site? This is thought in the long term possibility and security in mind.

  1. Using a PPA means very challenging for spammers to steal the domain to host fake debs.
  2. Or a bounced payment to domain or some errors in payment
  3. Or example: https://puri.sm/posts/the-great-purism-dns-outage-of-2018/

This is because browser is a very valuable part. And possibly using PPA would help gain more traction to make the project broader with more devs/maintainers - good for long run.

  1. https://help.launchpad.net/Packaging/PPA
Alex313031 commented 2 years ago

@nmarathi I already have a launchpad and set up a PPA for thorium. Unfortunately, I decided not to go that route because I would have to upload the source there and maintain it there too as well as here, and the main thing is that they don't allow uploading binary packages, they have to build it from your source. And unless I wanna pay a lot of money to get a higher resource quota, building Thorium on their free tier would take a ridiculous amount of time. It already takes multiple hours on a 4790K for example. And I would have to make seperate releases for say debian and ubuntu, and maybe even for each release, i.e. one for 16.04, 18.04, 20.04, and 22.04. PPAs are nice, and that was what I wanted to do, but.... This new site is hosted as a netifly app, it uses https, and it is being kept very minimal. I'm not so worried that someone is going to hack into the site and have a malicious deb, especially since we will soon be using a GPG key as well as posting hashes for the .deb files here on github. It just makes it an easy way for people to auto update thorium, instead of manually downloading a .deb from here every update. Now for windows.....IDK what to do about that, as setting up zucchini (the auto updater in chrome) only has a stub of the code in chromium, i.e. it is one of the internal proprietary things in google chrome. It can be done, as can be seen with Brave, since they successfully used the zucchini module to implement auto updating for brave on windows and macos. That is out of my paygrade though and I would have no idea about how to go about that.

joshcangit commented 1 year ago

@Alex313031 Good to know you'll be using a GPG key soon. Hope that GPG key will also be set up for your repository. As of now, it's just using the "trusted" option.