scottk/secureblue
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/secureblue.git synced 2025-11-02 19:38:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: switch to hardened-chromium (#332)

Browse Source
This commit is contained in:
qoijjj
2024-07-24 23:35:23 -07:00
committed by GitHub
parent 0ccc7cd11b
commit 721ad757b5
7 changed files with 3 additions and 465 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
files/scripts/setchromiumflags.sh
View File

@@ -1,17 +0,0 @@
#!/usr/bin/env bash
# Tell build process to exit if there are any errors.
set -oue pipefail
sed -i '/--enable-chrome-browser-cloud-management/d' /etc/chromium/chromium.conf
# https://bugzilla.redhat.com/show_bug.cgi?id=2293202
sed -i '/--enable-native-gpu-memory-buffers/d' /etc/chromium/chromium.conf
sed -i 's/FEATURES=""/FEATURES="SplitCacheByNetworkIsolationKey,SplitCodeCacheByNetworkIsolationKey,SplitHostCacheByNetworkIsolationKey,PrefetchPrivacyChanges,IsolateSandboxedIframes,StrictOriginIsolation,PartitionConnectionsByNetworkIsolationKey,PartitionHttpServerPropertiesByNetworkIsolationKey,PartitionSSLSessionsByNetworkIsolationKey,PartitionNelAndReportingByNetworkIsolationKey,EnableCrossSiteFlagNetworkIsolationKey,ContentSettingsPartitioning,"/g' /etc/chromium/chromium.conf
echo '
CHROMIUM_FLAGS+=" --ozone-platform=wayland --js-flags=--jitless --no-pings --disk-cache-dir=/dev/null --extension-content-verification=enforce_strict --extensions-install-verification=enforce_strict --disable-features=PrivacySandboxSettings4,InterestFeedV2,NTPPopularSitesBakedInContent,UsePopularSitesSuggestions,MediaDrmPreprovisioning,AutofillServerCommunication,DisableThirdPartyStoragePartitioningDeprecationTrial,OptimizationHints,OptimizationHintsFetching,OptimizationHintsFetchingAnonymousDataConsent"
' >> /etc/chromium/chromium.conf

39
files/system/usr/etc/chromium/chromium.conf.md
View File

@@ -1,39 +0,0 @@
**Disables hyperlink auditing pings**
`--no-pings`
**Disables the disk cache**
`--disk-cache-dir=/dev/null`
**Use strict extension verification**
`--extension-content-verification=enforce_strict --extensions-install-verification=enforce_strict`
**Enable partitioning features**
`SplitCacheByNetworkIsolationKey,SplitCodeCacheByNetworkIsolationKey,SplitHostCacheByNetworkIsolationKey,IsolateSandboxedIframes,StrictOriginIsolation,PartitionConnectionsByNetworkIsolationKey,PartitionHttpServerPropertiesByNetworkIsolationKey,PartitionSSLSessionsByNetworkIsolationKey,PartitionNelAndReportingByNetworkIsolationKey,EnableCrossSiteFlagNetworkIsolationKey`
**Harden prefetching**
`PrefetchPrivacyChanges`
**Disable Google's "privacy sandbox"**
`PrivacySandboxSettings4`
**Disable various content suggestions**
`InterestFeedV2,NTPPopularSitesBakedInContent,UsePopularSitesSuggestions`
**Disable DRM**
`MediaDrmPreprovisioning`
**Disable autofill requests**
`AutofillServerCommunication`
**Enable content settings partitioning**
`ContentSettingsPartitioning`

44
files/system/usr/etc/chromium/policies/managed/hardening.json
View File

@@ -1,44 +0,0 @@
{
"DefaultSensorsSetting": 2,
"EnableMediaRouter": false,
"AccessibilityImageLabelsEnabled": false,
"BackgroundModeEnabled": false,
"BlockThirdPartyCookies": true,
"ChromeVariations": 1,
"ClickToCallEnabled": false,
"DnsOverHttpsMode": "automatic",
"HttpsOnlyMode": "force_enabled",
"MediaRecommendationsEnabled": false,
"MetricsReportingEnabled": false,
"NetworkPredictionOptions": 2,
"PaymentMethodQueryEnabled": false,
"PromotionalTabsEnabled": false,
"RemoteDebuggingAllowed": false,
"SafeSitesFilterBehavior": 0,
"SearchSuggestEnabled": false,
"SharedClipboardEnabled": false,
"ShowFullUrlsInAddressBar": true,
"SpellCheckServiceEnabled": false,
"SyncDisabled": true,
"TranslateEnabled": false,
"UrlKeyedAnonymizedDataCollectionEnabled": false,
"WebRtcEventLogCollectionAllowed": false,
"WebRtcIPHandling": "disable_non_proxied_udp",
"SafeBrowsingExtendedReportingEnabled": false,
"BrowserSignin": 0,
"AlternateErrorPagesEnabled": false,
"RemoteAccessHostAllowRemoteAccessConnections": false,
"RemoteAccessHostFirewallTraversal": false,
"DefaultInsecureContentSetting": 2,
"BlockExternalExtensions": true,
"AuthSchemes": "ntlm,negotiate",
"CloudPrintProxyEnabled": false,
"DefaultGeolocationSetting": 2,
"CloudPrintSubmitEnabled": false,
"AutofillAddressEnabled": false,
"AutofillCreditCardEnabled": false,
"ImportSavedPasswords": false,
"AlwaysOpenPdfExternally": true,
"AudioSandboxEnabled": true,
"NetworkServiceSandboxEnabled": true
}

170
files/system/usr/etc/chromium/policies/managed/hardening.json.readme.md
View File

@@ -1,170 +0,0 @@
*The policies set here include a subset of those found in the [brace policy file](https://github.com/divestedcg/Brace/blob/master/brace/etc/chromium/policies/managed/brace.json). All policies that are deprecated, identical to the default, or only for ChromeOS have been removed.*
**Do not allow any site to access sensors**
`"DefaultSensorsSetting": 2`
**Disable Google Cast**
`"EnableMediaRouter": false`
**Disable fetching labels for unlabelled images**
`"AccessibilityImageLabelsEnabled": false`
**Disable background mode**
`"BackgroundModeEnabled": false`
**Disable third party cookies**
`"BlockThirdPartyCookies": true`
**Permit Chrome Variations only for critical fixes**
`"ChromeVariations": 1`
**Disable click to call**
`"ClickToCallEnabled": false`
**Automatically use DNS-over-HTTPS if it's available**
`"DnsOverHttpsMode": "automatic"`
**Force enable HTTPS-Only Mode**
`"HttpsOnlyMode": "force_enabled"`
**Hide media recommendations**
`"MediaRecommendationsEnabled": false`
**Disable usage and crash reporting**
`"MetricsReportingEnabled": false`
**Disable network prediction**
`"NetworkPredictionOptions": 2`
**Disable payment method API**
`"PaymentMethodQueryEnabled": false`
**Disable full-tab promotions**
`"PromotionalTabsEnabled": false`
**Disable remote debugging**
`"RemoteDebuggingAllowed": false`
**Disable sending URLs for content filtering**
`"SafeSitesFilterBehavior": 0`
**Disable search suggestions**
`"SearchSuggestEnabled": false`
**Disable cross-device clipboard sharing**
`"SharedClipboardEnabled": false`
**Show full urls in the address bar**
`"ShowFullUrlsInAddressBar": true`
**Disable online spellchecking service**
`"SpellCheckServiceEnabled": false`
**Disable sync services**
`"SyncDisabled": true`
**Disable translate services**
`"TranslateEnabled": false`
**Disable URL-keyed anonymized data collection**
`"UrlKeyedAnonymizedDataCollectionEnabled": false`
**Disable WebRTC event log collection and uploading**
`"WebRtcEventLogCollectionAllowed": false`
**For WebRTC, use TCP on the public-facing interface, and will only use UDP if supported by a configured proxy.**
`"WebRtcIPHandling": "disable_non_proxied_udp"`
**Disable extended reporting for Safe Browsing**
`"SafeBrowsingExtendedReportingEnabled": false`
**Disable browser sign-in**
`"BrowserSignin": 0`
**Disable navigation error correction**
`"AlternateErrorPagesEnabled": false`
**Prevent remote access service from starting**
`"RemoteAccessHostAllowRemoteAccessConnections": false`
**Prevent remote client discovery**
`"RemoteAccessHostFirewallTraversal": false`
**Do not allow sites to load mixed content**
`"DefaultInsecureContentSetting": 2`
**Block external extensions**
`"BlockExternalExtensions": true`
**Disable insecure HTTP authentication schemes**
`"AuthSchemes": "ntlm,negotiate"`
**Disable Google Cloud Print proxy**
`"CloudPrintProxyEnabled": false`
**By default, do not allow any site to track the users' physical location**
`"DefaultGeolocationSetting": 2`
**Disable Google Cloud Print site submission**
`"CloudPrintSubmitEnabled": false`
**Prevent saving address information for autofill**
`"AutofillAddressEnabled": false`
**Prevent saving credit card information for autofill**
`"AutofillCreditCardEnabled": false`
**Do not import saved passwords on first run**
`"ImportSavedPasswords": false`
**Disable the internal PDF viewer**
`"AlwaysOpenPdfExternally": true`
**Enable Audio Service Sandbox**
`"AudioSandboxEnabled": true`
**Enable Network Service Sandbox**
`"NetworkServiceSandboxEnabled": true`

193
files/system/usr/etc/chromium/vanadium_comparison.readme.md
View File

@@ -1,193 +0,0 @@
A list of [Vanadium patches](https://github.com/GrapheneOS/Vanadium/blob/main/patches/) and their secureblue counterpart (if any).
| Vanadium patch | Patch description | Relevance | Counterpart |
| ------------- | ------------- | ------------- | ------------- |
| [0001-Vanadium-string-rebranding](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0001-Vanadium-string-rebranding.patch) | Adjust strings to reflect Vanadium branding | No, branding related | N/A |
| [0002-Vanadium-branding](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0002-Vanadium-branding.patch) | Apply branding changes specific to Vanadium | No, branding related | N/A |
| [0003-Vanadium-branding-for-WebView](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0003-Vanadium-branding-for-WebView.patch) | Apply branding changes specific to Vanadium for the WebView | No, branding related | N/A |
| [0004-Support-for-extended-version-name-and-increments](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0004-Support-for-extended-version-name-and-increments.patch) | Add support for extended version names and increments | No, not desired | N/A |
| [0005-temporary-Workaround-for-crashes-at-StackTrace-calls](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0005-temporary-Workaround-for-crashes-at-StackTrace-calls.patch) | Temporary workaround for crashes at StackTrace calls | No, not desired | N/A |
| [0006-use-64-bit-WebView-processes](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0005-use-64-bit-WebView-processes.patch) | Forbid use of 32-bit ABI in WebView | No, Android only | N/A |
| [0007-switch-to-fstack-protector-strong](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0006-switch-to-fstack-protector-strong.patch) | Use -fstack-protector-strong cflag | Yes | [Set in upstream Fedora](https://src.fedoraproject.org/rpms/chromium/blob/f39/f/chromium-123-fstack-protector-strong.patch) |
| [0008-enable-fwrapv-in-Clang-for-non-UBSan-builds](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0007-enable-fwrapv-in-Clang-for-non-UBSan-builds.patch) | Set -fwrapv to make signed integer overflow defined behavior to improve memory safety | Yes | [Set in upstream Fedora](https://src.fedoraproject.org/rpms/chromium/c/55c38ba66d02c7b2746e0f70d38f15ff81ef74f4?branch=f39) |
| [0009-enable-ftrivial-auto-var-init-zero](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0008-enable-ftrivial-auto-var-init-zero.patch) | Set -ftrivial-auto-var-init=zero to force clang to initialize automatic variables with zeroes | Yes | [Set in upstream Fedora](https://src.fedoraproject.org/rpms/chromium/c/55c38ba66d02c7b2746e0f70d38f15ff81ef74f4?branch=f39) |
| [0010-disable-broken-warning-for-auto-var-init](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0009-disable-broken-warning-for-auto-var-init.patch) | Minor fix related to the prior patch | No, not desired | N/A |
| [0011-Checkout-PGO-profiles](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0010-Checkout-PGO-profiles.patch) | Checkout PGO profiles | No, not desired | N/A |
| [0012-disable-checkout_nacl](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0012-disable-checkout_nacl.patch) | Disables checking out nacl | Yes | [nacl is disabled in upstream Fedora](https://src.fedoraproject.org/rpms/chromium/blob/f39/f/chromium.spec#_1478) |
| [0013-disable-first-run-welcome-page](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0013-disable-first-run-welcome-page.patch) | Disable first-run welcome page | No, branding related | N/A |
| [0014-disable-seed-based-field-trials](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0014-disable-seed-based-field-trials.patch) | Disable seed-based field trials (variations) | Yes | Disabled [in secureblue policies](https://github.com/secureblue/secureblue/blob/live/config/files/usr/etc/chromium/policies/managed/hardening.json#L10) for everything except critical fixes |
| [0015-disable-fetching-variations](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0015-disable-fetching-variations.patch) | Disable fetching variations | Yes | Disabled [in secureblue policies](https://github.com/secureblue/secureblue/blob/live/config/files/usr/etc/chromium/policies/managed/hardening.json#L10) for everything except critical fixes |
| [0016-disable-WebView-variations-support](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0016-disable-WebView-variations-support.patch) | Disable WebView variations support | No, Android only | N/A |
| [0017-disable-navigation-error-correction-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0017-disable-navigation-error-correction-by-default.patch) | Disable navigation error correction by default | Yes | Disabled [in secureblue policies](https://github.com/secureblue/secureblue/blob/live/config/files/usr/etc/chromium/policies/managed/hardening.json#L32) |
| [0018-disable-contextual-search-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0018-disable-contextual-search-by-default.patch) | Disable contextual search by default | No, Android only | N/A |
| [0019-disable-network-prediction-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0019-disable-network-prediction-by-default.patch) | Disable network prediction by default | Yes | Disabled [in secureblue policies](https://github.com/secureblue/secureblue/blob/live/config/files/usr/etc/chromium/policies/managed/hardening.json#L16) |
| [0020-disable-metrics-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0020-disable-metrics-by-default.patch) | Disable metrics by default | Yes | Disabled [in secureblue policies](https://github.com/secureblue/secureblue/blob/live/config/files/usr/etc/chromium/policies/managed/hardening.json#L15) |
| [0021-disable-hyperlink-auditing-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0031-disable-hyperlink-auditing-by-default.patch) | Disable hyperlink auditing by default | Yes | Set [in secureblue chromium.conf](https://github.com/secureblue/secureblue/blob/live/config/scripts/setchromiumflags.sh) |
| [0022-disable-showing-popular-sites-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0022-disable-showing-popular-sites-by-default.patch) | Disable showing popular sites by default | Yes | Set [in secureblue chromium.conf](https://github.com/secureblue/secureblue/blob/live/config/scripts/setchromiumflags.sh) |
| [0023-disable-article-suggestions-feature-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0023-disable-article-suggestions-feature-by-default.patch) | Disable article suggestions feature by default | Yes | MISSING |
| [0024-disable-content-feed-suggestions-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0024-disable-content-feed-suggestions-by-default.patch) | Disable content feed suggestions by default | Yes | Set [in secureblue chromium.conf](https://github.com/secureblue/secureblue/blob/live/config/scripts/setchromiumflags.sh) |
| [0025-disable-sensors-access-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0025-disable-sensors-access-by-default.patch) | Disable sensors access by default | Yes | Disabled [in secureblue policies](https://github.com/secureblue/secureblue/blob/live/config/files/usr/etc/chromium/policies/managed/hardening.json#L3) |
| [0026-block-playing-protected-media-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0026-block-playing-protected-media-by-default.patch) | Block playing protected media by default | Yes | MISSING |
| [0027-disable-third-party-cookies-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0027-disable-third-party-cookies-by-default.patch) | Disable third-party cookies by default | Yes | Disabled [in secureblue policies](https://github.com/secureblue/secureblue/blob/live/config/files/usr/etc/chromium/policies/managed/hardening.json#L8) |
| [0028-disable-background-sync-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0028-disable-background-sync-by-default.patch) | Disable background sync by default | No, not desired | N/A |
| [0029-disable-payment-support-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0029-disable-payment-support-by-default.patch) | Disable payment support by default | Yes | Disabled [in secureblue policies](https://github.com/secureblue/secureblue/blob/live/config/files/usr/etc/chromium/policies/managed/hardening.json#L17) |
| [0030-disable-media-router-media-remoting-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0030-disable-media-router-media-remoting-by-default.patch) | Disable media router media remoting by default | Yes | Disabled [in secureblue policies](https://github.com/secureblue/secureblue/blob/live/config/files/usr/etc/chromium/policies/managed/hardening.json#L4) |
| [0031-disable-media-router-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0031-disable-media-router-by-default.patch) | Disable media router by default | Yes | Disabled [in secureblue policies](https://github.com/secureblue/secureblue/blob/live/config/files/usr/etc/chromium/policies/managed/hardening.json#L4) |
| [0032-disable-offering-translations-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0032-disable-offering-translations-by-default.patch) | Disable offering translations by default | Yes | Disabled [in secureblue policies](https://github.com/secureblue/secureblue/blob/live/config/files/usr/etc/chromium/policies/managed/hardening.json#L26) |
| [0033-disable-browser-sign-in-feature-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0033-disable-browser-sign-in-feature-by-default.patch) | Disable browser sign-in feature by default | Yes | Disabled [in secureblue policies](https://github.com/secureblue/secureblue/blob/live/config/files/usr/etc/chromium/policies/managed/hardening.json#L32) |
| [0034-disable-browser-autologin-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0034-disable-browser-autologin-by-default.patch) | Disable browser autologin feature by default | Yes | Disabled [in secureblue policies](https://github.com/secureblue/secureblue/blob/live/config/files/usr/etc/chromium/policies/managed/hardening.json#L32) |
| [0035-disable-safe-browsing-reporting-opt-in-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0035-disable-safe-browsing-reporting-opt-in-by-default.patch) | Disable safe browsing reporting opt-in by default | Yes | Disabled [in secureblue policies](https://github.com/secureblue/secureblue/blob/live/config/files/usr/etc/chromium/policies/managed/hardening.json#L31) |
| [0036-disable-unused-safe-browsing-option-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0036-disable-unused-safe-browsing-option-by-default.patch) | Disable safe browsing due to lack of Play Services | No, Android only | N/A |
| [0037-disable-media-DRM-preprovisioning-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0037-disable-media-DRM-preprovisioning-by-default.patch) | Disables media DRM preprovisioning | Yes | Set [in secureblue chromium.conf](https://github.com/secureblue/secureblue/blob/live/config/scripts/setchromiumflags.sh) |
| [0038-disable-autofill-server-communication-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0038-disable-autofill-server-communication-by-default.patch) | Disables autofill server communication | Yes | Set [in secureblue chromium.conf](https://github.com/secureblue/secureblue/blob/live/config/scripts/setchromiumflags.sh) |
| [0039-disable-component-updater-pings-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0039-disable-component-updater-pings-by-default.patch) | Disables component updater pings | Yes | MISSING |
| [0040-disable-search-provider-logo](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0040-disable-search-provider-logo.patch) | Disables search provider logo | No, branding related | N/A |
| [0041-disable-trivial-subdomain-hiding](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0041-disable-trivial-subdomain-hiding.patch) | Disables trivial subdomain hiding | Yes | MISSING |
| [0042-disable-learn-more-link-in-incognito-new-tab](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0042-disable-learn-more-link-in-incognito-new-tab.patch) | Disables learn more link in incognito new tab | No, branding related | N/A |
| [0043-disable-Omaha-update-check-support](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0043-disable-Omaha-update-check-support.patch) | Disables Omaha update check support | No, not desired | N/A |
| [0044-disable-GaiaAuthFetcher-code-due-to-upstream-bug](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0044-disable-GaiaAuthFetcher-code-due-to-upstream-bug.patch) | Disables GaiaAuthFetcher code due to upstream bug | No, not desired| N/A |
| [0045-Disable-adding-a-signed-out-avatar-on-new-tab-pages-](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0045-Disable-adding-a-signed-out-avatar-on-new-tab-pages-.patch) | Disables adding a signed-out avatar on new tab pages | No, not desired | N/A |
| [0046-Disable-newer-privacy-sandbox-features-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0046-Disable-newer-privacy-sandbox-features-by-default.patch) | Disables newer privacy sandbox features | Yes | Set [in secureblue chromium.conf](https://github.com/secureblue/secureblue/blob/live/config/scripts/setchromiumflags.sh) |
| [0047-Disable-WebGPU-in-Android-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0047-Disable-WebGPU-in-Android-by-default.patch) | Disables WebGPU in Android | No, Android only | N/A |
| [0048-Disable-top-toolbar-button-Translate-option-by-defau.patch](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0048-Disable-top-toolbar-button-Translate-option-by-defau.patch) | Disable top toolbar button | No, Android only | N/A |
| [0049-always-use-local-new-tab-page](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0049-always-use-local-new-tab-page.patch) | Always use local new tab page | No, not desired | N/A |
| [0050-mark-non-secure-origins-as-dangerous](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0050-mark-non-secure-origins-as-dangerous.patch) | Marks non-secure origins as dangerous | Yes | MISSING |
| [0051-most-private-WebRTC-IP-handling-policy-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0051-most-private-WebRTC-IP-handling-policy-by-default.patch) | Most private WebRTC IP handling policy by default | Yes | Set [in secureblue policies](https://github.com/secureblue/secureblue/blob/live/config/files/usr/etc/chromium/policies/managed/hardening.json#L29) |
| [0052-stub-out-the-battery-status-API](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0052-stub-out-the-battery-status-API.patch) | Stubs out the battery status API | No, Android only | N/A |
| [0053-stop-ignoring-download-location-prompt-setting](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0053-stop-ignoring-download-location-prompt-setting.patch) | Stops ignoring download location prompt setting | No, Android only | N/A |
| [0054-show-download-prompt-again-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0054-show-download-prompt-again-by-default.patch) | Shows download prompt again by default | No, Android only | N/A |
| [0055-disable-trials-of-privacy-aware-analytics-advertisin](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0055-disable-trials-of-privacy-aware-analytics-advertisin.patch) | Disables trials of privacy-aware analytics advertising | Yes | MISSING |
| [0056-disable-using-Play-services-fonts](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0056-disable-using-Play-services-fonts.patch) | Disables using Play services fonts | No, Android only | N/A |
| [0057-disable-appending-variations-header](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0057-disable-appending-variations-header.patch) | Disables appending variations header | No, not desired | N/A |
| [0058-Disable-detailed-language-settings-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0058-Disable-detailed-language-settings-by-default.patch) | Disables detailed language settings by default | No, not desired | N/A |
| [0059-disable-fetching-optimization-guides-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0059-disable-fetching-optimization-guides-by-default.patch) | Disables fetching optimization guides by default | Yes | Set [in secureblue chromium.conf](https://github.com/secureblue/secureblue/blob/live/config/scripts/setchromiumflags.sh) |
| [0060-set-default-search-engine-to-DuckDuckGo](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0060-set-default-search-engine-to-DuckDuckGo.patch) | Sets default search engine to DuckDuckGo | No, not desired | N/A |
| [0061-set-original-package-to-org.chromium.chrome](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0061-set-original-package-to-org.chromium.chrome.patch) | Sets original package to org.chromium.chrome | No, Android only | N/A |
| [0062-Make-HTTPS-only-mode-the-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0062-Make-HTTPS-only-mode-the-default.patch) | Makes HTTPS-only mode the default | Yes | Set [in secureblue policies](https://github.com/secureblue/secureblue/blob/live/config/files/usr/etc/chromium/policies/managed/hardening.json#L13) |
| [0063-require-HTTPS-for-component-updates](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0063-require-HTTPS-for-component-updates.patch) | Requires HTTPS for component updates | Yes | MISSING |
| [0064-use-vanadium.app-for-component-updates](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0064-use-vanadium.app-for-component-updates.patch) | Use vanadium.app for component updates | No, not desired | N/A |
| [0065-use-grapheneos.network-when-verifying-DNS-over-HTTPS](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0065-use-grapheneos.network-when-verifying-DNS-over-HTTPS.patch) | Use grapheneos.network when verifying DNS over HTTPS | No, not desired | N/A |
| [0066-Use-GrapheneOS-connectivity-check-as-well-for-Help-a](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0066-Use-GrapheneOS-connectivity-check-as-well-for-Help-a.patch) | Use GrapheneOS connectivity check as well for Help | No, not desired | N/A |
| [0067-enable-memory-tagging-in-all-processes](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0067-enable-memory-tagging-in-all-processes.patch) | Enable memory tagging in all processes | No, Android only | N/A |
| [0068-bugfix-do-not-attempt-to-re-enable-memory-tagging](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0068-bugfix-do-not-attempt-to-re-enable-memory-tagging.patch) | Bugfix: do not attempt to re-enable memory tagging | No, Android only | N/A |
| [0069-enable-prefetch-privacy-changes-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0069-enable-prefetch-privacy-changes-by-default.patch) | Enable prefetch privacy changes by default | Yes | Set [in secureblue chromium.conf](https://github.com/secureblue/secureblue/blob/live/config/scripts/setchromiumflags.sh) |
| [0070-enable-split-cache-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0069-enable-split-cache-by-default.patch) | Enable split cache by default | Yes | Set [in secureblue chromium.conf](https://github.com/secureblue/secureblue/blob/live/config/scripts/setchromiumflags.sh) |
| [0071-enable-partitioning-connections-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0071-enable-partitioning-connections-by-default.patch) | Enable partitioning connections by default | Yes | Set [in secureblue chromium.conf](https://github.com/secureblue/secureblue/blob/live/config/scripts/setchromiumflags.sh) |
| [0072-enable-dubious-Do-Not-Track-feature-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0072-enable-dubious-Do-Not-Track-feature-by-default.patch) | Enable dubious Do Not Track feature by default | No, not desired | N/A |
| [0073-enable-strict-site-isolation-by-default-on-Android](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0073-enable-strict-site-isolation-by-default-on-Android.patch) | Enable strict site isolation by default on Android | No, Android only | N/A |
| [0074-Enable-strict-origin-isolation-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0074-Enable-strict-origin-isolation-by-default.patch) | Enable strict origin isolation by default | Yes | Set [in secureblue chromium.conf](https://github.com/secureblue/secureblue/blob/live/config/scripts/setchromiumflags.sh) |
| [0075-Enable-reduce-accept-language-header-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0075-Enable-reduce-accept-language-header-by-default.patch) | Enable reduce accept language header by default | No, fingerprinting related | N/A |
| [0076-enable-process-isolated-sandboxed-iframes-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0076-enable-process-isolated-sandboxed-iframes-by-default.patch) | Enable process isolated sandboxed iframes by default | Yes | Set [in secureblue chromium.conf](https://github.com/secureblue/secureblue/blob/live/config/scripts/setchromiumflags.sh) |
| [0077-use-Google-Chrome-branding-for-client-hints](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0077-use-Google-Chrome-branding-for-client-hints.patch) | Use Google Chrome branding for client hints | No, fingerprinting related | N/A |
| [0078-add-trichrome-browser-apk-targets](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0078-add-trichrome-browser-apk-targets.patch) | Add trichrome browser APK targets | No, Android only | N/A |
| [0079-Remove-logo-from-chrome-version](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0079-Remove-logo-from-chrome-version.patch) | Remove logo from Chrome version | No, Android only | N/A |
| [0080-redirect-settings-help-icon](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0080-redirect-settings-help-icon.patch) | Redirect settings help icon | No, branding related | N/A |
| [0081-remove-Google-prefix-from-storage-settings-label](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0081-remove-Google-prefix-from-storage-settings-label.patch) | Remove Google prefix from storage settings label | No, branding related | N/A |
| [0082-remove-Help-feedback-menu-entry](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0082-remove-Help-feedback-menu-entry.patch) | Remove Help feedback menu entry | No, Android only | N/A |
| [0083-hide-passwords.google.com-link-when-not-supported](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0083-hide-passwords.google.com-link-when-not-supported.patch) | Hide passwords.google.com link when not supported | No, Android only | N/A |
| [0084-temporary-Always-partition-third-party-storage](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0084-temporary-Always-partition-third-party-storage.patch) | Temporary always partition third-party storage | Yes | Set [in secureblue chromium.conf](https://github.com/secureblue/secureblue/blob/live/config/scripts/setchromiumflags.sh) |
| [0085-update-trichrome_library_apk-expectation-file](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0085-update-trichrome_library_apk-expectation-file.patch) | Update trichrome_library_apk expectation file | No, Android only | N/A |
| [0086-Consolidate-downstream-changes-in-dependencies-sourc](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0086-Consolidate-downstream-changes-in-dependencies-sourc.patch) | Consolidate downstream changes in dependencies source | No, Android only | N/A |
| [0087-Consolidate-downstream-strings-in-a-separate-file-fo](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0087-Consolidate-downstream-strings-in-a-separate-file-fo.patch) | Consolidate downstream strings in a separate file | No, branding related | N/A |
| [0088-Utility-class-for-adding-shared-preference-keys](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0088-Utility-class-for-adding-shared-preference-keys.patch) | Utility class for adding shared preference keys | No, Android only | N/A |
| [0089-Helper-class-for-modifying-preferences-at-chrome-lay](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0089-Helper-class-for-modifying-preferences-at-chrome-lay.patch) | Helper class for modifying preferences at Chrome layer | No, Android only | N/A |
| [0090-Utility-class-for-modifying-preferences-at-Privacy-s](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0090-Utility-class-for-modifying-preferences-at-Privacy-s.patch) | Utility class for modifying preferences at Privacy settings layer | No, Android only | N/A |
| [0091-Remove-not-applicable-additional-terms-of-services](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0091-Remove-not-applicable-additional-terms-of-services.patch) | Remove not applicable additional terms of services | No, branding related | N/A |
| [0092-remove-Google-terms-of-use-and-privacy-policy](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0092-remove-Google-terms-of-use-and-privacy-policy.patch) | Remove Google terms of use and privacy policy | No, branding related | N/A |
| [0093-disable-unused-password-check-feature](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0093-disable-unused-password-check-feature.patch) | Disable unused password check feature | No, Android only | N/A |
| [0094-remove-unwanted-sync-and-services-link](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0094-remove-unwanted-sync-and-services-link.patch) | Remove unwanted sync and services link | No, branding related | N/A |
| [0095-remove-safety-check-menu](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0095-remove-safety-check-menu.patch) | Remove safety check menu | No, not desired | N/A |
| [0096-remove-unwanted-account-and-services-section](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0096-remove-unwanted-account-and-services-section.patch) | Remove unwanted account and services section | No, not desired | N/A |
| [0097-remove-translate-offer-preference](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0097-remove-translate-offer-preference.patch) | Remove translate offer preference | Yes | Disabled [in secureblue policies](https://github.com/secureblue/secureblue/blob/live/config/files/usr/etc/chromium/policies/managed/hardening.json#L26) |
| [0098-Hide-Sign-In-preference-when-disallowed](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0098-Hide-Sign-In-preference-when-disallowed.patch) | Hide Sign-In preference when disallowed | No, not desired | N/A |
| [0099-Hide-currently-no-op-preload-settings](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0099-Hide-currently-no-op-preload-settings.patch) | Hide currently no-op preload settings | No, not desired | N/A |
| [0100-Remove-privacy-trials-preference-UI](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0100-Remove-privacy-trials-preference-UI.patch) | Remove privacy trials preference UI | No, not desired | N/A |
| [0101-Remove-privacy-guides-preference-UI](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0101-Remove-privacy-guides-preference-UI.patch) | Remove privacy guides preference UI | No, not desired | N/A |
| [0102-Move-search-suggestions-back-to-privacy-section](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0102-Move-search-suggestions-back-to-privacy-section.patch) | Move search suggestions back to privacy section | No, not desired | N/A |
| [0103-Toggle-for-closing-tabs-on-exit](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0103-Toggle-for-closing-tabs-on-exit.patch) | Toggle for closing tabs on exit | No, not desired | N/A |
| [0104-Toggle-for-navigating-external-URL-in-incognito](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0104-Toggle-for-navigating-external-URL-in-incognito.patch) | Toggle for navigating external URL in incognito | No, not desired | N/A |
| [0105-Do-not-clear-the-url-bar-on-focus-by-default-for-sea](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0105-Do-not-clear-the-url-bar-on-focus-by-default-for-sea.patch) | Do not clear the URL bar on focus by default for search | No, Android only | N/A |
| [0106-Handle-web-search-action-in-browser](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0106-Handle-web-search-action-in-browser.patch) | Handle web search action in browser | No, Android only | N/A |
| [0107-Support-opening-external-web-search-in-incognito](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0107-Support-opening-external-web-search-in-incognito.patch) | Support opening external web search in incognito | No, Android only | N/A |
| [0108-Extend-opening-links-from-external-apps-in-incognito](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0108-Extend-opening-links-from-external-apps-in-incognito.patch) | Extend opening links from external apps in incognito for custom tabs | No, Android only | N/A |
| [0109-Extend-opening-links-from-external-apps-in-incognito](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0109-Extend-opening-links-from-external-apps-in-incognito.patch) | Extend opening links from external apps incognito for search tabs | No, Android only | N/A |
| [0110-Extend-opening-links-from-external-apps-in-incognito](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0110-Extend-opening-links-from-external-apps-in-incognito.patch) | Extend opening links from external apps in incognito for share intents | No, Android only | N/A |
| [0111-Do-not-select-search-query-text-when-opening-web-and](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0111-Do-not-select-search-query-text-when-opening-web-and.patch) | Do not select search query text when opening web and | No, Android only | N/A |
| [0112-Implement-UI-for-JIT-site-settings](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0112-Implement-UI-for-JIT-site-settings.patch) | Implement UI for JIT site settings | Yes | JIT is globally disabled [in secureblue config](https://github.com/secureblue/secureblue/blob/live/config/files/usr/etc/chromium/policies/managed/hardening.json.readme.md) |
| [0113-Implement-UI-for-WebRTC-toggle](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0113-Implement-UI-for-WebRTC-toggle.patch) | Implement UI for WebRTC toggle | No, not desired | N/A |
| [0114-make-cross-origin-referrer-behavior-configurable](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0115-make-cross-origin-referrer-behavior-configurable.patch) | Make cross-origin referrer behavior configurable | No, not desired | N/A |
| [0115-Derive-high-entropy-client-hints-with-reduced-user-a](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0115-Derive-high-entropy-client-hints-with-reduced-user-a.patch) | Derive high entropy client hints with reduced user agent | No, fingerprinting related | N/A |
| [0116-temporary-Disable-changes-to-high-entropy-client-hin](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0116-temporary-Disable-changes-to-high-entropy-client-hin.patch) | Temporary disable changes to high entropy client hints | No, fingerprinting related | N/A |
| [0117-Add-missing-null-check-for-password-manager-autofill](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0117-Add-missing-null-check-for-password-manager-autofill.patch) | Add missing null check for password manager autofill | No, not desired | N/A |
| [0118-Drop-workaround-with-android-autofill-in-compatibili](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0118-Drop-workaround-with-android-autofill-in-compatibili.patch) | Drop workaround with Android autofill in compatibility | No, Android only | N/A |
| [0119-Enable-android-autofill-on-http-authentication-dialo](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0119-Enable-android-autofill-on-http-authentication-dialo.patch) | Enable Android autofill on HTTP authentication dialog | No, Android only | N/A |
| [0120-Enable-usage-of-Android-Autofill-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0120-Enable-usage-of-Android-Autofill-by-default.patch) | Enable Android Autofill by default | No, Android only | N/A |
| [0121-Disable-Play-services-dependent-password-manager-pre](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0121-Disable-Play-services-dependent-password-manager-pre.patch) | Disable Play services dependent password manager | No, Android only | N/A |
| [0122-Use-local-list-of-supported-languages-for-Language-s](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0122-Use-local-list-of-supported-languages-for-Language-s.patch) | Use local list of supported languages for Language settings | Yes | MISSING |
| [0123-Add-an-easily-extensible-way-to-reference-targets-ea](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0123-Add-an-easily-extensible-way-to-reference-targets-ea.patch) | Add an easily extensible way to reference targets easily in ninja | No, not desired | N/A |
| [0124-Add-a-new-config-like-apk-target-for-building](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0124-Add-a-new-config-like-apk-target-for-building.patch) | Add a new config-like apk target for building | No, Android only | N/A |
| [0125-config-Directly-reference-config-apk-build-target](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0125-config-Directly-reference-config-apk-build-target.patch) | Directly reference config apk build target | No, Android only | N/A |
| [0126-config-Generate-ConfigInfo-from-config-apk](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0126-config-Generate-ConfigInfo-from-config-apk.patch) | Generate ConfigInfo from config apk | No, Android only | N/A |
| [0127-config-Provide-targets-for-linking-and-inclusion-of-](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0127-config-Provide-targets-for-linking-and-inclusion-of-.patch) | Provide targets for linking and inclusion of ConfigInfo in apk | No, Android only | N/A |
| [0128-config-Include-the-ConfigInfo-class-for-Monochrome-a](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0128-config-Include-the-ConfigInfo-class-for-Monochrome-a.patch) | Include the ConfigInfo class for Monochrome and Trichrome targets | No, Android only | N/A |
| [0129-config-Include-the-ConfigInfo-class-for-WebView-targ](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0129-config-Include-the-ConfigInfo-class-for-WebView-targ.patch) | Include the ConfigInfo class for WebView targets with java code | No, Android only | N/A |
| [0130-config-test-Add-ConfigInfo-on-necessary-integration-](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0130-config-test-Add-ConfigInfo-on-necessary-integration-.patch) | Add ConfigInfo on necessary integration test targets | No, Android only | N/A |
| [0131-config-Add-proto-definitions-for-feature-flags-and-o](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0131-config-Add-proto-definitions-for-feature-flags-and-o.patch) | Add proto definitions for feature flags and out-of-band component shipping | No, Android only | N/A |
| [0132-config-Add-protobuf-generator-parser-for-config-apk-](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0132-config-Add-protobuf-generator-parser-for-config-apk-.patch) | Add protobuf generator, parser for config apk contents | No, Android only | N/A |
| [0133-config-generator-Initial-configuration-for-config-ap](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0133-config-generator-Initial-configuration-for-config-ap.patch) | Initial configuration for config apk | No, Android only | N/A |
| [0134-config-parser-Add-config-parser-for-browser-and-webv](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0134-config-parser-Add-config-parser-for-browser-and-webv.patch) | Add config parser for browser and WebView | No, Android only | N/A |
| [0135-filter-lists-Helper-script-for-fetching-content-filt](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0135-filter-lists-Helper-script-for-fetching-content-filt.patch) | Helper script for fetching content filtering... | No, Android only | N/A |
| [0136-config-add-new-needed-deps-to-fetch-filter-lists](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0136-config-add-new-needed-deps-to-fetch-filter-lists.patch) | Add new needed dependencies to fetch filter lists | No, Android only | N/A |
| [0137-config-Build-target-for-android-assets-including-the](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0137-config-Build-target-for-android-assets-including-the.patch) | Build target for android assets including the content filtering file | No, Android only | N/A |
| [0138-config-Build-target-for-android-assets-for-config-fi](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0138-config-Build-target-for-android-assets-for-config-fi.patch) | Build target for android assets for config file protobuf | No, Android only | N/A |
| [0139-config-Add-the-needed-component-and-protobuf-file-fo](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0139-config-Add-the-needed-component-and-protobuf-file-fo.patch) | Add the needed component and protobuf file for parsing | No, Android only | N/A |
| [0140-Extension-of-build-system-for-java-files-in-base-lay](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0140-Extension-of-build-system-for-java-files-in-base-lay.patch) | Extension of build system for java files in base layer | No, Android only | N/A |
| [0141-Add-hooks-for-applying-flags-features-at-runtime](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0141-Add-hooks-for-applying-flags-features-at-runtime.patch) | Add hooks for LibraryLoader on early initialization and command line switches | No, Android only | N/A |
| [0142-Add-hooks-for-LibraryLoader-on-early-initialization-](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0142-Add-hooks-for-LibraryLoader-on-early-initialization-.patch) | Add hooks for LibraryLoader on early initialization and command line switches | No, Android only | N/A |
| [0143-Add-hooks-for-initializing-contents-of-VanadiumConfi](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0143-Add-hooks-for-initializing-contents-of-VanadiumConfi.patch) | Add hooks for initializing contents of VanadiumConfig app | No, Android only | N/A |
| [0144-Extension-of-build-system-at-android-specific-subres](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0144-Extension-of-build-system-at-android-specific-subres.patch) | Extension of build system at android-specific subresource filter sources | No, Android only | N/A |
| [0145-Expose-fetching-config-state-for-content-filtering-t](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0145-Expose-fetching-config-state-for-content-filtering-t.patch) | Expose fetching config state for content filtering to native calls | No, Android only | N/A |
| [0146-Use-ruleset-from-config-apk-whenever-it-s-present](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0146-Use-ruleset-from-config-apk-whenever-it-s-present.patch) | Use ruleset from config apk whenever it's present | No, Android only | N/A |
| [0147-content-filtering-Add-update-handling-of-subresource](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0147-content-filtering-Add-update-handling-of-subresource.patch) | Add update handling of subresource filter component from config apk | No, Android only | N/A |
| [0148-Extension-of-build-system-for-static-library-deps-at](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0148-Extension-of-build-system-for-static-library-deps-at.patch) | Extension of build system for static library deps at browser layer | No, Android only | N/A |
| [0149-Update-subresource-filter-from-config-apk](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0149-Update-subresource-filter-from-config-apk.patch) | Update subresource filter from config apk | No, Android only | N/A |
| [0150-Use-the-content-filtering-from-config-app-when-avail](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0150-Use-the-content-filtering-from-config-app-when-avail.patch) | Use the content filtering from config app when available | No, Android only | N/A |
| [0151-subresource-filter-rules-version-on-about-Vanadium-s](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0151-subresource-filter-rules-version-on-about-Vanadium-s.patch) | subresource filter rules version on about Vanadium settings page | No, Android only | N/A |
| [0152-don-t-show-subresource-filter-UI-for-site](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0152-don-t-show-subresource-filter-UI-for-site.patch) | Don't show subresource filter UI for site | No, Android only | N/A |
| [0153-enable-subresource-filter-on-all-sites](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0153-enable-subresource-filter-on-all-sites.patch) | Enable subresource filter on all sites | No, Android only | N/A |
| [0154-Use-the-old-naming-convention-of-Ads-in-ads-site-set](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0154-Use-the-old-naming-convention-of-Ads-in-ads-site-set.patch) | Use the old naming convention of Ads in ads site settings | No, Android only | N/A |
| [0155-config-generator-Always-enable-CredentialManager-API](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0155-config-generator-Always-enable-CredentialManager-API.patch) | config-generator: Always enable CredentialManager APIs for all apps | No, Android only | N/A |
| [0156-Enable-CredentialManager-APIs-for-all-apps-supportin](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0156-Enable-CredentialManager-APIs-for-all-apps-supportin.patch) | Enable CredentialManager APIs for all apps supporting passkeys | No, Android only | N/A |
| [0157-Add-support-for-calling-added-APIs-from-custom-OS](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0157-Add-support-for-calling-added-APIs-from-custom-OS.patch) | Add support for calling added APIs from custom OS | No, not desired | N/A |
| [0158-filter-lists-Update-script-to-also-include-saving-sh](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0158-filter-lists-Update-script-to-also-include-saving-sh.patch) | filter-lists: Update script to also include saving sha256 digest | No, Android only | N/A |
| [0159-config-Remove-support-for-broadcast-receiver-for-fet](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0159-config-Remove-support-for-broadcast-receiver-for-fet.patch) | config: Remove support for broadcast receiver for fetching updates in the parser itself | No, Android only | N/A |
| [0160-enable-hybrid-post-quantum-key-exchange-on-Android](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0160-enable-hybrid-post-quantum-key-exchange-on-Android.patch) | enable hybrid post-quantum key exchange on Android | No, android only | N/A |
| [0161-Resolve-more-regex-syntax-warning-for-python-scripts](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0161-Resolve-more-regex-syntax-warning-for-python-scripts.patch) | Resolve more regex syntax warning for python scripts for Python 3.12 | No, not desired | N/A |
| [0162-fix-more-syntax-warnings-in-third_party-jni_zero-for](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0162-fix-more-syntax-warnings-in-third_party-jni_zero-for.patch) | fix more syntax warnings in //third_party/jni_zero for Python 3.12 | No, not desired | N/A |
| [0163-fix-another-Python-3.12-syntax-warning](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0163-fix-another-Python-3.12-syntax-warning.patch) | fix another Python 3.12 syntax warning | No, not desired | N/A |
| [0164-Revert-Fixit-Update-Password-Manager-to-Google-Passw](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0164-Revert-Fixit-Update-Password-Manager-to-Google-Passw.patch) | Revert "[Fixit] Update Password Manager to Google Password Manager" | No, Android only | N/A |
| [0165-Enable-content-settings-partitioning-by-default](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0165-Enable-content-settings-partitioning-by-default.patch) | Enable content settings partitioning by default | Yes | Set [in secureblue chromium.conf](https://github.com/secureblue/secureblue/blob/live/config/scripts/setchromiumflags.sh) |
| [0166-Match-skipping-compatibility-check-default-value-che](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0166-Match-skipping-compatibility-check-default-value-che.patch) | Match skipping compatibility check default value checks in
java as well | No, Android only | N/A |
| [0167-Set-Toolbar-shortcut-default-to-new-tab-instead-of-a](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0167-Set-Toolbar-shortcut-default-to-new-tab-instead-of-a.patch) | Set Toolbar shortcut default to new tab instead of auto | No, Android only | N/A |
| [0168-temp-config-generator-Forcibly-skip-checks-for-andro](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0168-temp-config-generator-Forcibly-skip-checks-for-andro.patch) | temp: config-generator: Forcibly skip checks for android | No, Android only | N/A |
| [0169-temp-config-generator-Forcibly-disable-translate-opt](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0169-temp-config-generator-Forcibly-disable-translate-opt.patch) | temp: config-generator: Forcibly disable translate option on
toolbar shortcut options | No, Android only | N/A |
| [0170-Revert-M122-content-make-disable-jit-actually-disabl](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0170-Revert-M122-content-make-disable-jit-actually-disabl.patch) | Revert "[M122] content: make disable-jit actually disable
high-tier v8 compilers" | Yes | Set [in secureblue chromium.conf](https://github.com/secureblue/secureblue/blob/live/config/scripts/setchromiumflags.sh) |
| [0171-config-parser-Add-support-for-conditional-parsing-of](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0171-config-parser-Add-support-for-conditional-parsing-of.patch) | config-parser: Add support for conditional parsing of
portions of config app | No, Android only | N/A |
| [0172-config-Add-new-definitions-for-additional-components](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0172-config-Add-new-definitions-for-additional-components.patch) | config: Add new definitions for additional components and its
conditions | No, Android only | N/A |
| [0173-config-Add-support-for-generating-configs-with-addit](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0173-config-Add-support-for-generating-configs-with-addit.patch) | config: Add support for generating configs with additional components and its condition | No, Android only | N/A |
| [0174-config-parser-add-support-for-parsing-conditional-co](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0174-config-parser-add-support-for-parsing-conditional-co.patch) | config-parser: add support for parsing conditional components | No, Android only | N/A |
| [0175-Add-a-method-to-hook-at-Application.attachBaseContex](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0175-Add-a-method-to-hook-at-Application.attachBaseContex.patch) | Add a method to hook at Application.attachBaseContext() call | No, Android only | N/A |
| [0176-Add-hooks-for-ChromeApplicationImpl-to-initialize-co](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0176-Add-hooks-for-ChromeApplicationImpl-to-initialize-co.patch) | Add hooks for ChromeApplicationImpl to initialize conditionals for config app | No, Android only | N/A |
| [0177-content-filtering-Add-support-for-updating-content-f](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0177-content-filtering-Add-support-for-updating-content-f.patch) | content-filtering: Add support for updating content filtering
when accept-language is changed | No, Android only | N/A |
| [0178-Add-support-for-conditional-content-filtering-compon](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0178-Add-support-for-conditional-content-filtering-compon.patch) | Add support for conditional content filtering component based
on language settings | No, Android only | N/A |
| [0179-add-support-for-german-specific-langauge-content-fil](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0179-add-support-for-german-specific-langauge-content-fil.patch) | add support for german-specific langauge content filtering
when German language is set | No, Android only | N/A |
| [0180-temporary-config-disable-conditional-component-if-de](https://github.com/GrapheneOS/Vanadium/blob/main/patches/0180-temporary-config-disable-conditional-component-if-de.patch) | temporary: config: disable conditional component if declared
such in config holder app | No, Android only | N/A |

4
recipes/common/gui-packages.yml
View File

@@ -1,9 +1,10 @@
type: rpm-ostree
repos:
- https://copr.fedorainfracloud.org/coprs/secureblue/bubblejail/repo/fedora-%OS_VERSION%/secureblue-bubblejail-fedora-%OS_VERSION%.repo
- https://copr.fedorainfracloud.org/coprs/secureblue/hardened-chromium/repo/fedora-%OS_VERSION%/secureblue-hardened-chromium-fedora-%OS_VERSION%.repo
install:
- headsetcontrol
- chromium
- hardened-chromium
- mediainfo
- bubblejail
- usbguard-notifier
@@ -12,6 +13,7 @@ install:
remove:
- openssh-server
- fedora-chromium-config
- fedora-flathub-remote
- open-vm-tools
- open-vm-tools-desktop

1
recipes/common/gui-scripts.yml
View File

@@ -1,4 +1,3 @@
type: script
scripts:
- disablecups.sh
- setchromiumflags.sh