Fix linux-browser-installer(8) on FreeBSD

If you want to play DRM locked media on FreeBSD or use web browser that is available on Linux but not on FreeBSD – like Opera or Brave for example – you had quite convenient way to do it – using linux-browser-installer script.

I use it since … I do not remember when – and it always worked like a charm … until recently.

Problem

After I wanted to try and test the upcoming FreeBSD 14.0 version – I started fresh with new installation in a separate ZFS Boot Environment – and then after copying my configs wanted to also enable and add Google Chrome to be able to watch DRM locked media … but this time the linux-browser-installer failed.

desktop % git clone https://github.com/mrclksr/linux-browser-installer.git
Cloning into 'linux-browser-installer'...
remote: Enumerating objects: 210, done.
remote: Counting objects: 100% (100/100), done.
remote: Compressing objects: 100% (31/31), done.
remote: Total 210 (delta 80), reused 76 (delta 69), pack-reused 110
Receiving objects: 100% (210/210), 31.55 KiB | 1.58 MiB/s, done.
Resolving deltas: 100% (125/125), done.

desktop % cd linux-browser-installer

desktop % su

desktop # ./linux-browser-installer chroot create
linux_enable: NO -> NO
ubuntu_enable:  -> YES
compat.linux.emul_path: /compat/ubuntu -> /compat/ubuntu
Updating FreeBSD repository catalogue...
FreeBSD repository is up to date.
All repositories are up to date.

No packages are required to be fetched.
Integrity check was successful.
tar: Removing leading '/' from member names
I: Retrieving InRelease 
I: Retrieving Packages 
I: Validating Packages 
I: Resolving dependencies of required packages...
I: Resolving dependencies of base packages...
I: Checking component main on http://archive.ubuntu.com/ubuntu...
I: Retrieving adduser 3.118ubuntu2
I: Validating adduser 3.118ubuntu2
I: Retrieving apt 2.0.2
I: Validating apt 2.0.2
(...)
I: Configuring libc-bin...
I: Configuring systemd...
I: Configuring ca-certificates...
I: Base system installed successfully.
mkdir: /compat/ubuntu/etc/localtime: File exists
cp: /compat/ubuntu/etc/localtime is not a directory
/bin/bash: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8)
perl: warning: Setting locale failed.
perl: warning: Please check that your locale settings:
        LANGUAGE = (unset),
        LC_ALL = "en_US.UTF-8",
        LC_COLLATE = "C",
        LANG = "C.UTF-8"
    are supported and installed on your system.
perl: warning: Falling back to a fallback locale ("C.UTF-8").
locale: Cannot set LC_CTYPE to default locale: No such file or directory
locale: Cannot set LC_MESSAGES to default locale: No such file or directory
locale: Cannot set LC_ALL to default locale: No such file or directory

Current default time zone: 'Europe/Warsaw'
Local time is now:      Wed Oct 11 10:33:24 CEST 2023.
Universal Time is now:  Wed Oct 11 08:33:24 UTC 2023.


compat.linux.emul_path: /compat/ubuntu -> /compat/ubuntu
/bin/bash: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8)
Get:1 http://archive.ubuntu.com/ubuntu focal InRelease [265 kB]
Get:2 http://archive.ubuntu.com/ubuntu focal-updates InRelease [114 kB]
Get:3 http://archive.ubuntu.com/ubuntu focal-security InRelease [114 kB]
Err:1 http://archive.ubuntu.com/ubuntu focal InRelease
  At least one invalid signature was encountered.
Err:2 http://archive.ubuntu.com/ubuntu focal-updates InRelease
  At least one invalid signature was encountered.
Err:3 http://archive.ubuntu.com/ubuntu focal-security InRelease
  At least one invalid signature was encountered.
Reading package lists... Done
W: GPG error: http://archive.ubuntu.com/ubuntu focal InRelease: At least one invalid signature was encountered.
E: The repository 'http://archive.ubuntu.com/ubuntu focal InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
W: GPG error: http://archive.ubuntu.com/ubuntu focal-updates InRelease: At least one invalid signature was encountered.
E: The repository 'http://archive.ubuntu.com/ubuntu focal-updates InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
W: GPG error: http://archive.ubuntu.com/ubuntu focal-security InRelease: At least one invalid signature was encountered.
E: The repository 'http://archive.ubuntu.com/ubuntu focal-security InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
/bin/bash: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8)
Reading package lists... Done
Building dependency tree... Done
The following packages will be REMOVED:
  rsyslog
0 upgraded, 0 newly installed, 1 to remove and 0 not upgraded.
After this operation, 1695 kB disk space will be freed.
perl: warning: Setting locale failed.
perl: warning: Please check that your locale settings:
        LANGUAGE = (unset),
        LC_ALL = "en_US.UTF-8",
        LC_COLLATE = "C",
        LANG = "C.UTF-8"
    are supported and installed on your system.
perl: warning: Falling back to a fallback locale ("C.UTF-8").
locale: Cannot set LC_CTYPE to default locale: No such file or directory
locale: Cannot set LC_MESSAGES to default locale: No such file or directory
locale: Cannot set LC_ALL to default locale: No such file or directory
(Reading database ... 11356 files and directories currently installed.)
Removing rsyslog (8.2001.0-1ubuntu1) ...
invoke-rc.d: could not determine current runlevel
 * Stopping enhanced syslogd rsyslogd                                                                                                                                                                                                                              [ OK ] 
/bin/bash: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8)
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Package gnupg is not available, but is referred to by another package.
This may mean that the package is missing, has been obsoleted, or
is only available from another source

E: Package 'gnupg' has no installation candidate
linux-browser-installer: Error: 'apt install -y gnupg' failed

I even keep old FreeBSD 13.1 ZFS Boot Environment where I could still watch DRM locked content … but after some time I was able to nail what the issue with linux-browser-installer is … something (again) changed in the Linux universe and suddenly all packages sources that were trusted yesterday are not trusted anymore … and that is the reason why the installer fails.

Solution

After some digging I found several ways to fix the issue. One of them is to add --allow-insecure-repositories and/or --allow-unauthenticated flags to the apt(8) command. The other one is to add [trusted=yes] to all apt(8) packages sources. I will use the latter as it takes less places to modify and seems simpler.

Example difference before and after modification:

BEFORE:
deb http://www.deb-multimedia.org jessie main

AFTER:
deb [trusted=yes] http://www.deb-multimedia.org jessie main

This is how linux-browser-installer looks after adding [trusted=yes] to all apt(8) packages sources.

desktop % grep -o '\"deb .*\"' linux-browser-installer | tr -d \"
deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ 
deb [arch=amd64] https://brave-browser-apt-release.s3.brave.com/ stable main
deb [arch=amd64] https://repo.vivaldi.com/archive/deb/ 
deb [arch=amd64] https://packages.microsoft.com/repos/edge stable main
deb https://deb.opera.com/opera-stable/ stable non-free
deb http://archive.ubuntu.com/ubuntu/ ${ubuntu_version} 
deb http://archive.ubuntu.com/ubuntu/ ${ubuntu_version}-updates 
deb http://archive.ubuntu.com/ubuntu/ ${ubuntu_version}-security 

desktop % grep -o '\"deb .*\"' linux-browser-installer.VERMADEN | tr -d \"
deb [trusted=yes arch=amd64] http://dl.google.com/linux/chrome/deb/ 
deb [trusted=yes arch=amd64] https://brave-browser-apt-release.s3.brave.com/ stable main
deb [trusted=yes arch=amd64] https://repo.vivaldi.com/archive/deb/ 
deb [trusted=yes arch=amd64] https://packages.microsoft.com/repos/edge stable main
deb [trusted=yes] https://deb.opera.com/opera-stable/ stable non-free
deb [trusted=yes] http://archive.ubuntu.com/ubuntu/ ${ubuntu_version} 
deb [trusted=yes] http://archive.ubuntu.com/ubuntu/ ${ubuntu_version}-updates 
deb [trusted=yes] http://archive.ubuntu.com/ubuntu/ ${ubuntu_version}-security 

Instructions

The current working procedure looks like that one below.

desktop % git clone https://github.com/mrclksr/linux-browser-installer.git

desktop % cd linux-browser-installer

desktop % fetch https://raw.githubusercontent.com/vermaden/scripts/master/linux-browser-installer.PATCH

desktop % patch < linux-browser-installer.PATCH 

desktop % su

desktop # ./linux-browser-installer chroot delete

desktop # ./linux-browser-installer chroot create

desktop # ./linux-browser-installer install chrome

This is how the properly applied patch(1) looks like.

desktop % patch < linux-browser-installer.PATCH 
Hmm...  Looks like a unified diff to me...
The text leading up to this was:
--------------------------
|--- linux-browser-installer.BCK        2023-10-11 08:59:18.296949000 +0200
|+++ linux-browser-installer    2023-10-11 09:51:53.672677000 +0200
--------------------------
Patching file linux-browser-installer using Plan A...
Hunk #1 succeeded at 127.
Hunk #2 succeeded at 166.
Hunk #3 succeeded at 191.
Hunk #4 succeeded at 230.
Hunk #5 succeeded at 262.
Hunk #6 succeeded at 336.
done

The DRM locked content seems to play fine in the Linux version of Google Chrome.

Hope that helps.

UPDATE 1 – Broken 13.2-RELEASE

It seams that the FreeBSD 13.2-RELEASE is the most problematic as either DRM content does not work at all now or there are sound issues.

• https://github.com/AppJail-makejails/brave#known-issues
• https://github.com/mrclksr/linux-browser-installer/issues/46

From the good news – the upcoming FreeBSD 14.0-RELEASE does not have these issues.

UPDATE 2 – Certificate Verification Failed

I just wanted to update the chroot and faced this issue shown below.

laptop % doas ./linux-browser-installer chroot upgrade
/bin/bash: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8)
Hit:1 http://archive.ubuntu.com/ubuntu focal InRelease
Ign:2 https://dl.google.com/linux/chrome/deb stable InRelease
Hit:3 http://archive.ubuntu.com/ubuntu focal-updates InRelease
Hit:4 http://archive.ubuntu.com/ubuntu focal-security InRelease
Err:5 https://dl.google.com/linux/chrome/deb stable Release
  Certificate verification failed: The certificate is NOT trusted. The certificate issuer is unknown.  Could not handshake: Error in the certificate verification. [IP: 142.251.36.46 443]
Reading package lists... Done                  
W: https://dl.google.com/linux/chrome/deb/dists/stable/InRelease: No system certificates available. Try installing ca-certificates.
W: https://dl.google.com/linux/chrome/deb/dists/stable/Release: No system certificates available. Try installing ca-certificates.
E: The repository 'https://dl.google.com/linux/chrome/deb stable Release' no longer has a Release file.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
laptop % 

The solutions seems to be forcefully removing current ca-certificates package and then adding the newest one.

Here are the steps that solved the problem for me.

Go here – http://security.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ – and copy link for the most up to date ca-certificates package. Just hit the Last Modified on the top to make searching faster.

Then issue these commands with the link you copied earlier.

laptop % doas chroot /compat/ubuntu /bin/bash
chroot # wget --no-check-certificate http://security.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20230311ubuntu0.23.04.1_all.deb
chroot # dpkg -r --force-depends ca-certificates
chroot # dpkg -i ca-certificates_20230311ubuntu0.23.04.1_all.deb 
chroot # apt update

Now you can run chroot upgrade as usual.

laptop % doas ./linux-browser-installer chroot upgrade

Issue is submitted here: https://github.com/mrclksr/linux-browser-installer/issues/49

EOF