cef/tools/cefbuilds

CEF Builds JSON Tools

Tools for generating and maintaining the JSON index files used by the CEF Builds CDN and the CEF installer.

Files

Core libraries

• cef_json_builder.py — Builds and maintains the master index.json file that contains the full catalog of CEF binary distributions across all platforms, versions, and channels. Handles file metadata (name, size, sha1, last_modified), Chromium version mapping, and sandbox compatibility hashes.

• cef_installer_builder.py — Generates installer-optimized CDN query files from a populated cef_json_builder instance. Produces lightweight JSON files designed for efficient HTTP HEAD timestamp checks by the CEF installer.

Data files

• revoked.json — Manually maintained list of revoked CEF versions. Revoked versions are excluded from all installer-generated JSON output. The installer also fetches this file from the CDN and refuses to install any listed version.

Examples and tests

• cef_json_builder_example.py — Example script demonstrating cef_json_builder usage. Creates and updates a local index.json with fake file data.

• cef_json_builder_test.py — Unit tests for cef_json_builder.

• cef_installer_builder_test.py — Unit tests for cef_installer_builder.

CDN file formats

Master index

• index.json — Full data index of all CEF binary distributions. Generated by cef_json_builder. Keyed by platform, with version records sorted newest-first by file last_modified timestamp.

Installer query files

Generated by cef_installer_builder from the master index:

• stable.txt — Current stable milestone number (e.g., 137).

• {milestone}.json (e.g., 137.json) — Newest build per platform for a given milestone. Used by the installer to check if an update is available.

• {milestone}_{platform}.json (e.g., 137_windows64.json) — All builds for a milestone+platform combination, sorted newest-first.

• {abi_hash}_{platform}.json (e.g., abc123def4567890_windows64.json) — All builds compatible with a given ABI hash and platform across all milestones, sorted newest-first. Windows platforms only (tied to chrome_elf.dll / Chromium sandbox ABI).

Concepts

Platforms

Supported platforms: linux32, linux64, linuxarm, linuxarm64, macosarm64, macosx64, windows32, windows64, windowsarm64.

Distribution types

Each version may have files of these types: standard, minimal, client, tools, release_symbols, debug_symbols, signed.

The signed type contains code-signed archives with catalog files, used by the installer for verified installation.

Channels

Versions belong to either the stable or beta channel.

Version formats

• New-style: 137.3.5+g62d140e+chromium-137.0.7204.6
  • Short version: 137.3.5 (everything before the first +)
  • Milestone: 137 (major version number)
• Old-style: 3.2704.1414.g185cd6c (predates the installer format)

ABI hash (sandbox_compat)

A 16-character hex string identifying the Windows sandbox ABI compatibility level. Derived from cef_api_versions.json on GitHub. Versions sharing the same ABI hash can use the same chrome_elf.dll and are interchangeable from the sandbox's perspective.

Revocation

The revoked.json file lists versions that must not be installed. When passed to cef_installer_builder, revoked versions are automatically excluded from all generated output. The installer also fetches this file from the CDN at runtime and refuses to install any listed version.

Entries can revoke a single version or a range of versions:

{
  "revoked_versions": [
    {
      "version": "137.1.0",
      "reason": "CVE-2024-XXXXX: critical sandbox escape",
      "revoked_at": "2024-01-15T00:00:00Z"
    },
    {
      "version_min": "138.0.0",
      "version_max": "138.2.99",
      "reason": "CVE-2024-YYYYY: affects all 138.0–138.2 builds",
      "revoked_at": "2024-02-01T00:00:00Z"
    }
  ]
}

Single version (point revocation):

• version — Short version string (e.g., 137.1.0).

Version range (inclusive):

• version_min — Inclusive lower bound (e.g., 138.0.0).
• version_max — Inclusive upper bound (e.g., 138.2.99).

Common fields:

• reason — Human-readable explanation (CVE ID, bug reference, etc.).
• revoked_at — ISO 8601 timestamp of when the revocation was added.

A single-version entry using version is equivalent to setting both version_min and version_max to the same value. If both version and version_min/version_max are present, the range fields take precedence.

Running tests

cd cef/tools/cefbuilds
python3 -m unittest cef_json_builder_test -v
python3 -m unittest cef_installer_builder_test -v