From 99d842b3810bf972884fea1e48023885307ee923 Mon Sep 17 00:00:00 2001
From: splitsec2 <35583321+splitsec2@users.noreply.github.com>
Date: Mon, 2 Nov 2026 20:35:07 -0600
Subject: [PATCH] build(docker): install Chromium from trixie-security without
 the snapshot pin (#1648)

Following the discussion on #1635, this drops the Chromium snapshot pin
and the apt preference, and installs whatever trixie-security currently
ships. Thanks @calibrain for suggesting we try it.

With no pin there is nothing left to go stale, so the scheduled check
that issue asked for isn't needed. Closes #1635.

I built the image from this branch and ran it as a scratch container. It
has Chromium 156.0.8078.79, and the bypass cleared DDoS-Guard on Anna's
Archive and returned search results. That challenge cleared on the
auto-wait step, so the click path wasn't exercised, same as the open
question in #1635.

One thing to know: the build cache is keyed on the Dockerfile text, so a
newer Debian Chromium only lands when that layer rebuilds, for example
on a base image bump.
---
 .../workflows/build-and-publish-docker-image.yml |  2 +-
 Dockerfile                                       | 16 +++-------------
 2 files changed, 4 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/build-and-publish-docker-image.yml b/.github/workflows/build-and-publish-docker-image.yml
index ab0b6c82..2835757c 100644
--- a/.github/workflows/build-and-publish-docker-image.yml
+++ b/.github/workflows/build-and-publish-docker-image.yml
@@ -77,7 +77,7 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           annotations: ${{ steps.meta.outputs.annotations }}
           # Runners are ephemeral, so without this every layer is rebuilt on every
-          # run: the pinned Chromium install, the dependency syncs, the driver
+          # run: the Chromium install, the dependency syncs, the driver
           # setup. Scoped per target so the two images do not evict each other. A cache
           # export error (ignore-error defaults to false) should not fail a finished publish.
           cache-from: type=gha,scope=${{ matrix.target }}
diff --git a/Dockerfile b/Dockerfile
index baaf4c1e..3821352a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -148,26 +148,16 @@ ENTRYPOINT ["/usr/bin/dumb-init", "--"]
 
 FROM base AS shelfmark
 
-# --- Chromium (PINNED to 156.0.8078.73) ---
-ARG CHROMIUM_VERSION=156.0.8078.73-1~deb13u1
-ARG CHROMIUM_SNAPSHOT=20261029T020000Z
-
-RUN echo "deb [check-valid-until=no] https://snapshot.debian.org/archive/debian-security/${CHROMIUM_SNAPSHOT}/ trixie-security main" \
-        > /etc/apt/sources.list.d/chromium-pin-snapshot.list && \
-    apt-get update -o Acquire::Retries=5 && \
+# --- Chromium (Debian's current build from trixie-security) ---
+RUN apt-get update -o Acquire::Retries=5 && \
     apt-get install -y --no-install-recommends -o Acquire::Retries=5 \
     # For dumb display
     xvfb \
-    chromium=${CHROMIUM_VERSION} \
-    chromium-common=${CHROMIUM_VERSION} \
+    chromium \
     # For tkinter (pyautogui)
     python3-tk \
     # For RAR extraction
     unrar-free && \
-    # Keep apt from "upgrading" chromium past the pin inside derived images
-    printf 'Package: chromium chromium-common\nPin: version %s\nPin-Priority: 1001\n' "${CHROMIUM_VERSION}" \
-        > /etc/apt/preferences.d/chromium-pin && \
-    rm /etc/apt/sources.list.d/chromium-pin-snapshot.list && \
     # Create symlink so rarfile library can find unrar
     ln -sf /usr/bin/unrar-free /usr/bin/unrar && \
     # Cleanup APT cache