WebKit(s) SIG

[Jaroslav Reznik]

Hi all (and if not all, feel free to add them to CC).
I'd like to establish
WebKit SIG (or some sort of group of people interested in WebKit in Fedora -
no need for any official one) as it's quite an overhead to maintain such a big
beast here. We have QtWebKit, WebKitGtk, Chromium, KHTML... All very similar
but based on different toolkit, concept etc. and it's mess currently (with
responsibilities etc).

What's the reason?
- all WebKit-like implementations
are very similar with only a little differences (toolkit...)
- there are quite
a lot of CVEs - it's time consuming to go over all CVEs (thanks for great job
goes to Vincent Danen and other brave men from security response team) and
most of patches could be shared
- a lot of bugs affects all implementations -
again patches sharing
- sometimes the primary maintainer of one of WebKits is
out of time - that means other team member could help
- and probably many
other reason like we are on the same WebKit ship (and if it's going to
sink...)

What can I bring to the team?
I'm a current primary QtWebKit
maintainer (with help of rest KDE SIG people), upstream's WebKit security team
member. I don't care about used toolkit - I offer help with Gtk and other ones
too - what I care is user experience.

If you're interested in - please reply,
I'd like to start Wiki page and we can talked about more details
etc.

Thanks
Jaroslav
-- 
Jaroslav Řezník <jreznik(a)redhat.com&gt;
Software
Engineer - Base Operating Systems Brno

Office: [phone]
Mobile: +420
602 797 774
Red Hat, Inc.                               http://cz.redhat.com/

[Martin Sourada]

On Fri, 2010-08-06 at 16:45 +0200, Jaroslav Reznik wrote: 
>  Hi all (and if not all, feel free to add them to CC).
>  I'd like to establish
>  WebKit SIG (or some sort of group of people interested in WebKit in Fedora -
>  no need for any official one) as it's quite an overhead to maintain such a big
>  beast here. We have QtWebKit, WebKitGtk, Chromium, KHTML... All very similar
>  but based on different toolkit, concept etc. and it's mess currently (with
>  responsibilities etc).
>   
I'm not sure about KHTML. Yes, WebKit is originally a fork of KHTML, but
AFAIK the current code bases differ too much...

>  What's the reason?
>  - all WebKit-like implementations
>  are very similar with only a little differences (toolkit...) 
Not sure how
"little" the differences are, but yeah, there's a big
common ground for all the ports and it would be ideal if we could
separate it out.

>  - there are quite
>  a lot of CVEs - it's time consuming to go over all CVEs (thanks for great job
>  goes to Vincent Danen and other brave men from security response team) and
>  most of patches could be shared 
It would much help if we knew which CVEs were
already fixed by upstream
and in which SVN snapshot and what SVN snapshot the ports are building
on. It gets a bit tougher with stable branches which usually have
backport fixes and such...

>  - a lot of bugs affects all implementations -
>  again patches sharing 
Same as above.

>  - sometimes the primary maintainer of one of WebKits is
>  out of time - that means other team member could help
>  - and probably many
>  other reason like we are on the same WebKit ship (and if it's going to
>  sink...)
>   
+1


>  If you're interested in - please reply,
>  I'd like to start Wiki page and we can talked about more details
>  etc.
>   
Yeah a wiki page would be helpful. Plus as I already outlined in another
mail, this effort would be futile without full support from upstream --
I don't think there are *any* releases of WebKit core components at all
so the ports differ a lot on which SVN snapshot they build upon, and to
establish this common ground, cooperation from upstream is needed. For
starters we should probably identify what our current position is --
i.e. what are the webkit ports used in fedora, which SVN snapshot they
use, what are the core components of webkit, the differences in build
systems, ... And outlining the idea of splitting/merging.

Anyway, I would be interested in helping, although I doubt I could help
much, given my low to none knowledge of webkit internals and little
time, but as a full time user of webkitgtk based apps, I'm highly
interested in having them work in reasonable way.

Regards,
Martin

[Jaroslav Reznik]

On Friday, August 06, 2010 05:15:12 pm you wrote:
>  On Fri, 2010-08-06 at 16:45 
+0200, Jaroslav Reznik wrote:
>  > Hi all (and if not all, feel free to add 
them to CC).
>  > I'd like to establish
>  > WebKit SIG (or some sort of group 
of people interested in WebKit in
>  > Fedora - no need for any official one) 
as it's quite
an overhead to
>  > maintain such a big beast here. We have 
QtWebKit,
WebKitGtk, Chromium,
>  > KHTML... All very similar but based on 
different toolkit,
concept etc.
>  > and it's mess currently (with 
responsibilities etc).
>  
>  I'm not sure about KHTML. Yes, WebKit is 
originally a fork of KHTML, but
>  AFAIK the current code bases differ too 
much...

It's more complicated - some parts are completely different, some
backported from WebKit, some code is the same line-by-line, some rewritten.
But with every WebKit's CVE we are trying to reproduce it in KHTML and if we
can't reproduce it, we try to do a code review together with security response
team.

>  > What's the reason?
>  > - all WebKit-like implementations
>  > are 
very similar with only a little differences (toolkit...)
>  
>  Not sure how 
"little" the differences are, but yeah, there's a big
>  common ground for all 
the ports and it would be ideal if we
could
>  separate it out. 
Some issues
are really toolkit-specific but from my observations - most of bugs applied on
all WebKits.

>  > - there are quite
>  > a lot of CVEs - it's time consuming to 
go over all CVEs (thanks for great
>  > job goes to Vincent Danen and other 
brave men from
security response
>  > team) and most of patches could be 
shared
>  
>  It would much help if we knew which CVEs were already fixed by 
upstream
>  and in which SVN snapshot and what SVN snapshot the ports are
building
>  on. It gets a bit tougher with stable branches which usually have
>  
backport fixes and such...

CVEs are usually fixed upstream but still you have
to go through all bugs and check it in all WebKits implementations (snapshot
revisions could help of course). WebKits shipped by Fedora usually differs -
different snapshots (but not big changes). 

>  > - a lot of bugs affects all 
implementations -
>  > again patches sharing
>  
>  Same as above.
>  
>  > - 
sometimes the primary maintainer of one of WebKits is
>  > out of time - that 
means other team member could help
>  > - and probably many
>  > other reason 
like we are on the same WebKit ship (and if it's going to
>  > sink...)
>  
>  
+1
>  
>  > If you're interested in - please reply,
>  > I'd like to start Wiki 
page and we can talked about more details
>  > etc.
>  
>  Yeah a wiki page would 
be helpful. Plus as I already outlined in another
>  mail, this effort would be 
futile without full support from
upstream --
>  I don't think there are *any* 
releases of WebKit core
components at all
>  so the ports differ a lot on which 
SVN snapshot they build
upon, and to
>  establish this common ground, 
cooperation from upstream is
needed. 

There's quite a big mess on WebKit's
security list, Vincent suggested few changes, let's see. Another question is
how to make releases in sync - to have same snapshots in Fedora.

>  For
>  
starters we should probably identify what our current position is --
>  i.e. 
what are the webkit ports used in fedora, which SVN
snapshot they
>  use, what 
are the core components of webkit, the differences in
build
>  systems, ... And 
outlining the idea of splitting/merging.

Any merging is really upstream
(upstreams) problem but yes - we need to clean up WebKits situations - what we
really have, who is consumer of which one etc. 

>  Anyway, I would be 
interested in helping, although I doubt I
could help
>  much, given my low to 
none knowledge of webkit internals and
little
>  time, but as a full time user 
of webkitgtk based apps, I'm
highly
>  interested in having them work in 
reasonable way.

Great (and yes, latest WebKits crashes - icedtea plugin is
cross WebKits one)!

Jaroslav

>  Regards,
>  Martin 
-- 
Jaroslav Řezník
<jreznik(a)redhat.com&gt;
Software Engineer - Base Operating Systems Brno

Office:
[phone]
Mobile: [phone]
Red Hat, Inc.                       
       http://cz.redhat.com/

[Matthias Clasen]

On Fri, 2010-08-06 at 16:45 +0200, Jaroslav Reznik wrote:

>  If you're interested in - please reply,
>  I'd like to start Wiki page and we can talked about more details
>  etc. 
Hey, thanks for taking this initiative. Since I recently made the mess
bigger by creating a webkitgtk3 package, I should probaby raise my hand
here...

[Jaroslav Reznik]

On Friday, August 06, 2010 05:18:14 pm Matthias Clasen wrote:
>  On Fri, 
2010-08-06 at 16:45 +0200, Jaroslav Reznik wrote:
>  > If you're interested in 
- please reply,
>  > I'd like to start Wiki page and we can talked about more
details
>  > etc.
>  
>  Hey, thanks for taking this initiative. Since I recently 
made the mess
>  bigger by creating a webkitgtk3 package, I should probaby 
raise
my hand
>  here... 
Wow, another one (I wasn't aware of this). And we can
expect one more from Qt side (standalone QtWebKit not bundled in Qt). Fun
;-)

Jaroslav
-- 
Jaroslav Řezník <jreznik(a)redhat.com&gt;
Software Engineer -
Base Operating Systems Brno

Office: [phone]
Mobile: [phone]
774
Red Hat, Inc.                               http://cz.redhat.com/

[Kevin Fenzi]

On Fri, 6 Aug 2010 16:45:39 +0200
Jaroslav Reznik <jreznik(a)redhat.com&gt; wrote:

...snip...

>  If you're interested in - please reply,
>  I'd like to start Wiki page and we can talked about more details
>  etc. 
I'm an interested webkitgtk user. ;) 

I'm not sure how much time I have to help, but I'm happy to
update/apply patches/patchmonkey webkitgtk. 

kevin

[Jaroslav Reznik]

On Friday, August 06, 2010 04:45:39 pm Jaroslav Reznik wrote:
>  If you're 
interested in - please reply,
>  I'd like to start Wiki page and we can talked 
about more
details
>  etc. 
There is already WebKit page on Wiki [1] but I'd
like to use this one as the entry point for users, not for more concrete
technical discussion. So I created another page under SIGs category [2] (is
there any policy for creation of SIGs? I wasn't very successful looking for it
but I'm quite tired already). Please sign up and edit tasks section according
to what do you find to be important to start SIG.

[1]
https://fedoraproject.org/wiki/WebKit
[2]
https://fedoraproject.org/wiki/SIGs/WebKit

Jaroslav

>  Thanks
>  Jaroslav 
--

Jaroslav Řezník <jreznik(a)redhat.com&gt;
Software Engineer - Base Operating
Systems Brno

Office: [phone]
Mobile: [phone]
Red Hat, Inc. 
                             http://cz.redhat.com/

[Josh Bressers]

On Fri, Aug 6, 2010 at 12:11 PM, Jaroslav Reznik <jreznik(a)redhat.com&gt; wrote:

>  On Friday, August 06, 2010 04:45:39 pm Jaroslav Reznik wrote:
>  > If you're
>  interested in - please reply,
>  > I'd like to start Wiki page and we can talked
>  about more details
>  > etc.
>
>  There is already WebKit page on Wiki [1] but I'd
>  like to use this one as the entry point for users, not for more concrete
>  technical discussion. So I created another page under SIGs category [2] (is
>  there any policy for creation of SIGs? I wasn't very successful looking for
>  it
>  but I'm quite tired already). Please sign up and edit tasks section
>  according
>  to what do you find to be important to start SIG.
>
>  
It may be wise to engage the various upstream projects and other
distributions for this. Even webkit upstream battles with problems as you
have the two big players, Apple and Google, on different release schedules.

Thanks for jumping on this, a couple of us were chatting about this just the
other day, it's desperately needed.

-- 
    JB

[Nicolas Mailhot]

Le vendredi 06 août 2010 à 18:11 +0200, Jaroslav Reznik a écrit :
>  (is
>  there any policy for creation of SIGs? I wasn't very successful looking for it
>  but I'm quite tired already). 
The policy for creating SIGs is that there are no policy for creating
SIGs. Just rock. A SIG is pretty informal, the formal Fedora
organisation unit is the sub-project (Art, I18n, etc)

-- 
Nicolas Mailhot

[Martin Sourada]

On Fri, 2010-08-06 at 18:11 +0200, Jaroslav Reznik wrote: 
>  There is already WebKit page on Wiki [1] but I'd
>  like to use this one as the entry point for users, not for more concrete
>  technical discussion. So I created another page under SIGs category [2] (is
>  there any policy for creation of SIGs? I wasn't very successful looking for it
>  but I'm quite tired already). Please sign up and edit tasks section according
>  to what do you find to be important to start SIG.
>   
So, I've done some initial filling up the WebKitsInFedora [3] page. It
will probably need more details on what svn snapshots the various
versions use, adding reference to spot's chromium, what are the port
specifics (libsoup vs. curl, ...),... Feel free to add this info :)

>  [1]
>  https://fedoraproject.org/wiki/WebKit
>  [2]
>  https://fedoraproject.org/wiki/SIGs/WebKit
>   
[3] https://fedoraproject.org/wiki/SIGs/WebKit/WebKitsInFedora

Martin

[Ilyes Gouta]

Hi,

I'm interested too! Do we cover embedded platforms?

-Ilyes Gouta

On Fri, Aug 6, 2010 at 9:48 PM, Martin Sourada <martin.sourada(a)gmail.com&gt; wrote:
>  On Fri, 2010-08-06 at 18:11 +0200, Jaroslav Reznik wrote:
> > There is already WebKit page on Wiki [1] but I'd
> > like to use this one as the entry point for users, not for more concrete
> > technical discussion. So I created another page under SIGs category [2] (is
> > there any policy for creation of SIGs? I wasn't very successful looking for it
> > but I'm quite tired already). Please sign up and edit tasks section according
> > to what do you find to be important to start SIG.
> >
>  So, I've done some initial filling up the WebKitsInFedora [3] page. It
>  will probably need more details on what svn snapshots the various
>  versions use, adding reference to spot's chromium, what are the port
>  specifics (libsoup vs. curl, ...),... Feel free to add this info :)
>
> > [1]
> > https://fedoraproject.org/wiki/WebKit
> > [2]
> > https://fedoraproject.org/wiki/SIGs/WebKit
> >
>  [3] https://fedoraproject.org/wiki/SIGs/WebKit/WebKitsInFedora
>
>  Martin
>
>  --
>  devel mailing list
>  devel(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/devel
>

[Muayyad AlSadi]

I'm developing a pywebkitgtk application, so I'm interested too

[Huzaifa Sidhpurwala]

Hi,


> If you're interested in - please reply,
> I'd like to start Wiki page and we can talked about more details
> etc. 
Count me in :)

Regards,
Huzaifa Sidhpurwala

[Jaroslav Reznik]

On Friday, August 06, 2010 04:45:39 pm Jaroslav Reznik wrote:

Just an update:
we hava our own WebKit SIG mailing list [1]. Feel free to subscribe.

[1] https://admin.fedoraproject.org/mailman/listinfo/webkit

Thanks
Jaroslav

-- 
Jaroslav Řezník <jreznik(a)redhat.com&gt;
Software Engineer - Base Operating Systems Brno

Office: [phone]
Mobile: [phone]
Red Hat, Inc.                               http://cz.redhat.com/