Early notification about the upcoming Chrome Stable releases?

[Sébastien Marchand]

Hi,

During BlinkOn we talked about the fact that it'd be really useful for Chromium embedders (Brave, Arc, Opera, etc) to be notified in advance about the version number of the new Stable releases (e.g. Tuesday security hotfix builds). We usually know that there will be a new release every Tuesday but we only know the release number once the Chrome rollout starts. It means that we have to play catchup to fix the latest security vulnerabilities asap.

I think that it'd be nice to have a way to be notified about the version number of the version that has been sent to QA for validation the day before the release. It'd help us patch these security issues in our Chromium based products more quickly and keep our users secure. I understand that there's no guarantee that a release will actually ship until it starts shipping, but I think that it'd be nice to have a chance to prepare in advance if possible.

Is this something that the Chrome team would be willing to expose?

Thanks!

[Sébastien Marchand]

Gentle ping for this. I understand that it could require some extra work for the Chrome TPMs (adding Srinivas and Krishna to this thread) but it feels like it'd really help keep all the Chromium based browsers secure. I'd be happy to provide some help if needed.

[Sébastien Marchand]

Hi,

one more gentle ping for this :). Is @infr...@chromium.org the right mailing list to discuss this? 

Thanks

[Srinivas Sista]

Adding @Gary Tong  and @Erik Staab  here for inputs

[Sébastien Marchand]

On Tue, Nov 14, 2023 at 6:31 PM Srinivas Sista <sriniv...@google.com> wrote:

Adding @Ben Mason  

Sebastien, 

Just want to see how this flow will work for you with out any changes needed, Stable release dates are published and available in chromiumdash and since we cut RC build one day before that, you can get the list of changes that landed on the branch until that time and that should cover all the changes that would be part of the RC build. this will cover all planned releases. Unplanned releases are rare and may 10-12 a year, and we are hoping with weekly security re-spins that number would come down further. 

> we cut RC build one day before that

This is the kind of information I was looking for! Thanks! I wasn't sure if the release was always supposed to be based on the branch state the day *before* the release or if it was sometimes based on an older version (e.g. cutting a branch on Friday for a release on Tuesday).

The challenge here is that this still doesn't seem to tell us which exact version will end up being used for the release. If I look at https://chromium.googlesource.com/chromium/src/+log/refs/branch-heads/6045/chrome/VERSION I can see that there's been a lot of patch number bumps on Monday, it doesn't seem like there's a way to tell which one has been selected for the release without looking at Chromium Dash? (which mean waiting for the release to begin).

Thanks

 

Srinivas

[Sébastien Marchand]

Hey,

This week is a good example of why having a notification mechanism for respins could be great. There hasn't been any release yesterday despite the fact that some CLs have been merged in the M123 branch since the last respin. So it's not clear to us if a respin is coming, in which case we should hold off on releasing until this Chrome respin is ready. 

Thanks,

On Wed, Nov 15, 2023 at 6:13 AM Ben Mason <benm...@google.com> wrote:

Security patches that are to be included in a release can be found by looking at changes landed on the relevant release branch. The branch numbers can be found on https://chromiumdash.appspot.com/branches. If you were to include all of those changes before the Tuesday release then you would be up to date.