cromite: drop

[ghost]

the absence of any committers among its maintainers

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• Nixpkgs 25.11 Release Notes (or backporting 24.11 and 25.05 Nixpkgs Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
• NixOS 25.11 Release Notes (or backporting 24.11 and 25.05 NixOS Release notes)
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[Daholli]

I don't think you need to actively start dropping things that you are maintaining, while it would be better to have a committer as part of the maintainer, I think just building a network and having a committer that you can ask for a quick review is the better solution.

[JohnRTitor]

I don't intend to merge this PR nor blocking it. To improve the current situation, I started a discussion in #415695.

(If any other commiter intend to merge, they should feel free)

[JohnRTitor]

That's upto you, without any maintainer picking it up again, it will be dropped anyhow.

[Daholli]

I wish we could have a notice for users that packages might be dropped so they can sign up to be maintainers. Something that is merged in advance

[LeSuisse]

Ok so this PR is open for 10 days and the only maintainer wants out. I do not see a way forward, at least short term and despite the discussions going on in #415695, for a proper maintenance. Given that the nixpkgs requirements for security-critical fast-moving package are currently not met, I'm going to make what will likely be an unpopular decision and merge this by the end of the week.

---

Side note: I took a look at upstream repo because I was curious of the privacy related changes. Over the past 2 years it seems to have been maintained by a single maintainer. I'm also a bit surprised by some of the changes, typically this one: https://github.com/uazo/cromite/blob/v137.0.7151.72-4ea840397d139bcaf3298a54a80a93d135f7dac7/build/patches/Use-BoringSSL-for-RandBytes.patch which appears to have been to "to overcome the lack of entropy for the internal generator in some android devices" but seems to be applied for all contexts nonetheless.

[dtomvan]

I wish we could have a notice for users that packages might be dropped so they can sign up to be maintainers. Something that is merged in advance

We can already do that with some meta abuse, something like:

meta.knownVulnerabilities = [
  ''
  Cromite is unmaintained in nixpkgs and will not receive any security-critical updates.
  
  Feel free to start maintaining this package if you want to keep using this browser
  vulnerability-free and if you are willing to donate some of your free time to nixpkgs.
  ''
];

I'm going to make what will likely be an unpopular decision

I think it'll be fine... (no hate to uazo I think it's very admirable to maintain a chromium fork with such consistency)

[JohnRTitor]

added the package out of temporary interest

I wish we had a policy that prevents new maintainers from adding packages only to throw them away later.

[emilylange]

added the package out of temporary interest

I wish we had a policy that prevents new maintainers from adding packages only to throw them away later.

We have such policy in our contributing guidelines, but it's not like it matters in this case here.

Not being aware of this as a committer is unfortunate, but whatever.
But given you, @JohnRTitor, can't even be bothered to tick the little "Fits CONTRIBUTING.md" checkbox, let alone anything else of our pull request template, in what feels like the majority of your PRs, I should not be surprised.

Please consider reading those for once and stop interfering with this PR.

[JohnRTitor]

let alone anything else of our pull request template, in what feels like the majority of your PRs

In the recent days I have shifted towards a more nixpkgs-review approach and I believe that is better as it shows whether all dependant packages are building fine and with error logs for those that have failed to build.

[nixpkgs-ci]

Successfully created backport PR for release-25.05:

• [Backport release-25.05] cromite: drop #416353