Under the hood
The whole project is a handful of bash scripts with strong opinions. This is the map.
Repository layout
| Path | Purpose |
|---|---|
| env.sh | Shared knobs: jobs, URLs, build dir, GN args, test command, promote list, cycle length. |
| lib/common.sh | Sourced helpers: logging, version comparison, tag resolution, depot_tools bootstrap, git tuning, gclient writer. |
| fetch-chromium.sh | First run: disk check (~120 GB), depot_tools clone, parallel sync at newest stable tag, seed patch dirs, write BASE_VERSION. |
| fluorite-release.sh | Cycle runner: self-gated by LAST_CYCLE stamp; discard tree, fresh sync, patch, build, test, promote. |
| apply-security-update.sh | Mid-cycle security path: fast-forward pinned base to include a milestone fix, rebuild. |
| secwatch-weekly.sh | Weekly orchestrator (systemd target): run watch container, react to rc=10, then the self-gated release script. |
| docker/secwatch/ | The watcher image: Dockerfile plus check logic with the 0/10/fail exit contract. |
| deploy/ | fluorite-secwatch.service and .timer units for unattended weekly runs. |
| fluorite/BASE_VERSION | Single line: the upstream tag the current tree and artifacts correspond to. |
| fluorite/LAST_CYCLE | Epoch timestamp of the last completed cycle — the calendar gate. |
| fluorite/patches/ | Live patch layer, re-applied every sync. See the patches page. |
| fluorite/pending/ | Review queue plus watcher output (REPORT.md, PENDING_UPDATE). |
| fluorite/dist/<ver>/ | Promoted artifacts per blessed version. |
Environment knobs
All defaults live in env.sh; every one can be overridden inline:
| Variable | Default | Meaning |
|---|---|---|
| JOBS | $(nproc) | Parallel repo streams for gclient sync; ~16–24 saturates most lines, lower it if googlesource throttles you. |
| CHROMIUM_URL | googlesource src.git | Upstream mirror used for tags and syncing. |
| DEPOT_TOOLS_DIR | ~/depot_tools | Cloned automatically when missing. |
| BUILD_DIR | out/LTS | Build output directory inside the tree. |
| GN_ARGS | official, no components | is_official_build=true is_component_build=false symbol_level=0 blink_symbol_level=0. |
| TEST_CMD | (empty) | Post-build test suite; empty skips the gate, e.g. ./fluorite/tests/run.sh $PWD/out/LTS. |
| PROMOTE_FILES | see below | Files copied into dist on promotion: chrome, icudtl.dat, resources.pak, both chrome_100/200_percent.pak, v8_context_snapshot.bin. |
| CYCLE_DAYS | 42 | Minimum days between full cycles; LAST_CYCLE stamp enforces it. |
Common commands
./fetch-chromium.sh FORCE_CYCLE=1 ./fluorite-release.sh JOBS=24 FORCE_CYCLE=1 ./fluorite-release.sh TEST_CMD="./fluorite/tests/run.sh $PWD/out/LTS" ./fluorite-release.sh systemctl start fluorite-secwatch.service journalctl -u fluorite-secwatch.service -f cat fluorite/BASE_VERSION fluorite/LAST_CYCLE ls fluorite/dist/
Heads up: lib/common.sh is meant to be sourced, not executed — running it directly exits on purpose. And never point a browser profile into the build tree; see the install page.