max / alloy

State Helium's version and license split in the stack doc Two caveats the browser swap's brief asked for and the rewrite left out. The package is at 0.14.9.1, which is young for the program that faces the whole internet, and that belongs next to the -bin provenance note rather than being discoverable only from an rpm query. The license split belongs there because a repo that never takes a GPL dependency should say plainly why a GPL-3.0 browser is not one: Helium's own code is GPL-3.0, its imported ungoogled-chromium code stays BSD-3-Clause, and nothing in Alloy links either, which is the same aggregation footing Distrobox, greetd and tuigreet already sit on.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: Max Johnson <me@maxj.phd> · 2026-07-30 22:01 UTC

Signed with PGP, not checked

Commit: 2a6f8c109cd94eeec58fd03ff2261da1bc4348ad

Parent: e9a7a7b

1 file changed, +2 insertions, -2 deletions

M docs/STACK.md +2 -2

			@@ -139,7 +139,7 @@
139	139
140	140		Helium baked into the image as the default, unconfigured. Helium is ungoogled-chromium with the behavior Alloy used to hand-build on top of Firefox already set upstream: ads, trackers, cookie banners and third-party cookies blocked by default, fingerprinting tampered with, no analytics, and no network request at all on first launch. Alloy ships no policy file, no preference seed, no chrome CSS and no extension pin for it. Shipping nothing is the reason it is the default, not an omission next to it. The packaging rules this follows are in the wiki note `alloy-packaging-policy`; the short form is that an app earns a recommendation by not needing configuration, which is the same test that picked helix over a configured vim.
141	141
142		-	The package is `helium-browser-bin` from Terra, the repo Alloy already enables for satty.
	142	+	The package is `helium-browser-bin` from Terra, the repo Alloy already enables for satty, currently 0.14.9.1. Helium's own code is GPL-3.0; what it imports from ungoogled-chromium keeps its BSD-3-Clause terms. Nothing in Alloy links either, so this sits on the same aggregation footing as Distrobox, greetd and tuigreet, which are GPL-3.0-only in the image already.
143	143
144	144		What Alloy used to ship here, and no longer does. Five files went with this change: an enterprise policy pinning uBlock Origin and disabling telemetry, Pocket, studies, sponsored tiles and password saving; a `mozilla.cfg` of around fifty default prefs; the autoconfig pointer that loaded it; a `profiles.ini` naming a fixed-path profile; and roughly two hundred lines of `userChrome.css`. That CSS described its own purpose in its header as "Helium-style ultra-compact horizontal". It was emulating a browser that is packaged, so the emulation had no reason to exist. The fifty prefs were not only cosmetic, and dropping them on a browser with bad defaults would be indefensible. It is affordable here because the recommended browser already behaves that way.
145	145
			@@ -150,7 +150,7 @@
150	150		Accepted costs:
151	151		- The day/night switch reaching the browser is unverified. The deleted `mozilla.cfg` set `ui.systemUsesDarkTheme = 0`, so Alloy was deliberately fighting the portal and the portal path has never been observed working here. If it turns out not to drive Helium, that is recorded as a defect in the appearance propagation and fixed there. Per-app chrome CSS does not come back for it.
152	152		- No blocker is pinned. Helium's blocking is a browser feature rather than a forced extension, which also means a user who disables it has disabled it, with nothing in the image arguing.
153		-	- `-bin` provenance. Terra repackages an upstream binary rather than building from source, and this is the most attack-exposed program in the image. It is still better provenance than the alternatives: Helium has no official Flatpak and upstream refuses to make one, holding that Chromium cannot be packaged as a Flatpak without breaking its internal sandbox, so every Flatpak of it is an unofficial community repackaging.
	153	+	- `-bin` provenance, and a pre-1.0 version. Terra repackages an upstream binary rather than building from source, and this is the most attack-exposed program in the image. Helium is also at 0.14.x, which is young for the piece of the system that faces the whole internet. It is still better provenance than the alternatives: Helium has no official Flatpak and upstream refuses to make one, holding that Chromium cannot be packaged as a Flatpak without breaking its internal sandbox, so every Flatpak of it is an unofficial community repackaging.
154	154		- Updates come with the image. A browser inside the image moves when the image is rebuilt rather than on its own channel. `alloy update` shows what is booted, what is staged, and how to roll back; reporting how far behind the image's packages have fallen, with the browser called out rather than buried in a bulk count, is filed work and not yet shipped.
155	155
156	156		Rejected: