1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
|
# Maintainer: Sam Sinclair <sam at playleft dot com>
# Contributor: Pujan Modha <pujan.pm@hotmail.com>
# Contributor: init_harsh
# /*
# * SPDX-FileCopyrightText: 2025 Arch Linux Contributors
# *
# * SPDX-License-Identifier: 0BSD
# */
From 3d4c102ba25545f8195e0d1c788a4ede6d569f9d Mon Sep 17 00:00:00 2001
From: Sam Sinclair <sam@playleft.com>
Date: Tue, 20 Jan 2026 11:19:30 +1100
Subject: [PATCH] update wrapper for arch
---
helium-wrapper | 58 +++++++++++++++++++++++++++++++++++++++++++++++---
1 file changed, 55 insertions(+), 3 deletions(-)
diff --git a/helium-wrapper b/helium-wrapper
index d8c6150..c1ad5be 100755
--- a/helium-wrapper
+++ b/helium-wrapper
@@ -1,17 +1,69 @@
-#!/bin/sh
+#!/usr/bin/env bash
# Copyright 2025 The Helium Authors
# You can use, redistribute, and/or modify this source code under
# the terms of the GPL-3.0 license that can be found in the LICENSE file.
# Replace when packaging, so that we can easily determine which
# distro the user is using if they open a bug report.
-export CHROME_VERSION_EXTRA="custom"
+export CHROME_VERSION_EXTRA="Arch Linux"
# Let the wrapped binary know that it has been run through the wrapper.
CHROME_WRAPPER="$(readlink -f "$0")"
HERE="$(dirname "$CHROME_WRAPPER")"
+# add SYS, USR, ENV flags support for Helium
+XDG_CONFIG_HOME="${XDG_CONFIG_HOME:-"$HOME/.config"}"
+
+SYS_CONF="/etc/helium-browser-flags.conf"
+USR_CONF="${XDG_CONFIG_HOME}/helium-browser-flags.conf"
+
+FLAGS=()
+
+append_flags_file() {
+ local file="$1"
+ [[ -r "$file" ]] || return 0
+ local line safe_line
+ # Filter comments & blank lines
+ while IFS= read -r line; do
+ [[ "$line" =~ ^[[:space:]]*(#|$) ]] && continue
+ # Sanitise: block command substitution; prevent $VAR and ~ expansion
+ case "$line" in
+ *\$\(*|*\`*)
+ echo "Warning: ignoring unsafe line in $file: $line" >&2
+ continue
+ ;;
+ esac
+ # Disable globbing during eval
+ set -f
+ # Prevent $VAR and ~ expansion while allowing eval to parse quotes & escapes
+ safe_line=${line//$/\\$}
+ safe_line=${safe_line//~/\\~}
+ eval "set -- $safe_line"
+ # Enable globbing for rest of the script
+ set +f
+ for token in "$@"; do
+ FLAGS+=("$token")
+ done
+ done < "$file"
+}
+
+append_flags_file "$SYS_CONF"
+append_flags_file "$USR_CONF"
+
+# Add environment var $HELIUM_USER_FLAGS
+if [[ -n "${HELIUM_USER_FLAGS:-}" ]]; then
+ # Split env contents on whitespace; users can quote if needed.
+ read -r -a ENV_FLAGS <<< "$HELIUM_USER_FLAGS"
+ FLAGS+=("${ENV_FLAGS[@]}")
+fi
+
export CHROME_WRAPPER
export LD_LIBRARY_PATH="$HERE:$HERE/lib:$HERE/lib.target${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}"
-exec "$HERE/helium" "$@"
+# Sanitize std{in,out,err} because they'll be shared with untrusted child
+# processes (http://crbug.com/376567).
+exec < /dev/null
+exec > >(exec cat)
+exec 2> >(exec cat >&2)
+
+exec "$HERE/helium" "${FLAGS[@]}" "$@"
--
2.52.0
|