Hi all (and if not all, feel free to add them to CC). I'd like to establish WebKit SIG (or some sort of group of people interested in WebKit in Fedora - no need for any official one) as it's quite an overhead to maintain such a big beast here. We have QtWebKit, WebKitGtk, Chromium, KHTML... All very similar but based on different toolkit, concept etc. and it's mess currently (with responsibilities etc).
What's the reason? - all WebKit-like implementations are very similar with only a little differences (toolkit...) - there are quite a lot of CVEs - it's time consuming to go over all CVEs (thanks for great job goes to Vincent Danen and other brave men from security response team) and most of patches could be shared - a lot of bugs affects all implementations - again patches sharing - sometimes the primary maintainer of one of WebKits is out of time - that means other team member could help - and probably many other reason like we are on the same WebKit ship (and if it's going to sink...)
What can I bring to the team? I'm a current primary QtWebKit maintainer (with help of rest KDE SIG people), upstream's WebKit security team member. I don't care about used toolkit - I offer help with Gtk and other ones too - what I care is user experience.
If you're interested in - please reply, I'd like to start Wiki page and we can talked about more details etc.
Thanks Jaroslav
On Fri, 2010-08-06 at 16:45 +0200, Jaroslav Reznik wrote:
Hi all (and if not all, feel free to add them to CC). I'd like to establish WebKit SIG (or some sort of group of people interested in WebKit in Fedora - no need for any official one) as it's quite an overhead to maintain such a big beast here. We have QtWebKit, WebKitGtk, Chromium, KHTML... All very similar but based on different toolkit, concept etc. and it's mess currently (with responsibilities etc).
I'm not sure about KHTML. Yes, WebKit is originally a fork of KHTML, but AFAIK the current code bases differ too much...
What's the reason?
- all WebKit-like implementations
are very similar with only a little differences (toolkit...)
Not sure how "little" the differences are, but yeah, there's a big common ground for all the ports and it would be ideal if we could separate it out.
- there are quite
a lot of CVEs - it's time consuming to go over all CVEs (thanks for great job goes to Vincent Danen and other brave men from security response team) and most of patches could be shared
It would much help if we knew which CVEs were already fixed by upstream and in which SVN snapshot and what SVN snapshot the ports are building on. It gets a bit tougher with stable branches which usually have backport fixes and such...
- a lot of bugs affects all implementations -
again patches sharing
Same as above.
- sometimes the primary maintainer of one of WebKits is
out of time - that means other team member could help
- and probably many
other reason like we are on the same WebKit ship (and if it's going to sink...)
+1
If you're interested in - please reply, I'd like to start Wiki page and we can talked about more details etc.
Yeah a wiki page would be helpful. Plus as I already outlined in another mail, this effort would be futile without full support from upstream -- I don't think there are *any* releases of WebKit core components at all so the ports differ a lot on which SVN snapshot they build upon, and to establish this common ground, cooperation from upstream is needed. For starters we should probably identify what our current position is -- i.e. what are the webkit ports used in fedora, which SVN snapshot they use, what are the core components of webkit, the differences in build systems, ... And outlining the idea of splitting/merging.
Anyway, I would be interested in helping, although I doubt I could help much, given my low to none knowledge of webkit internals and little time, but as a full time user of webkitgtk based apps, I'm highly interested in having them work in reasonable way.
Regards, Martin
On Friday, August 06, 2010 05:15:12 pm you wrote:
On Fri, 2010-08-06 at 16:45
+0200, Jaroslav Reznik wrote:
Hi all (and if not all, feel free to add
them to CC).
I'd like to establish WebKit SIG (or some sort of group
of people interested in WebKit in
Fedora - no need for any official one)
as it's quite an overhead to
maintain such a big beast here. We have
QtWebKit, WebKitGtk, Chromium,
KHTML... All very similar but based on
different toolkit, concept etc.
and it's mess currently (with
responsibilities etc).
I'm not sure about KHTML. Yes, WebKit is
originally a fork of KHTML, but
AFAIK the current code bases differ too
much...
It's more complicated - some parts are completely different, some backported from WebKit, some code is the same line-by-line, some rewritten. But with every WebKit's CVE we are trying to reproduce it in KHTML and if we can't reproduce it, we try to do a code review together with security response team.
What's the reason?
- all WebKit-like implementations
are
very similar with only a little differences (toolkit...)
Not sure how
"little" the differences are, but yeah, there's a big
common ground for all
the ports and it would be ideal if we could
separate it out.
Some issues are really toolkit-specific but from my observations - most of bugs applied on all WebKits.
- there are quite
a lot of CVEs - it's time consuming to
go over all CVEs (thanks for great
job goes to Vincent Danen and other
brave men from security response
team) and most of patches could be
shared
It would much help if we knew which CVEs were already fixed by
upstream
and in which SVN snapshot and what SVN snapshot the ports are
building
on. It gets a bit tougher with stable branches which usually have
backport fixes and such...
CVEs are usually fixed upstream but still you have to go through all bugs and check it in all WebKits implementations (snapshot revisions could help of course). WebKits shipped by Fedora usually differs - different snapshots (but not big changes).
- a lot of bugs affects all
implementations -
again patches sharing
Same as above.
sometimes the primary maintainer of one of WebKits is
out of time - that
means other team member could help
- and probably many
other reason
like we are on the same WebKit ship (and if it's going to
sink...)
+1
If you're interested in - please reply, I'd like to start Wiki
page and we can talked about more details
etc.
Yeah a wiki page would
be helpful. Plus as I already outlined in another
mail, this effort would be
futile without full support from upstream --
I don't think there are *any*
releases of WebKit core components at all
so the ports differ a lot on which
SVN snapshot they build upon, and to
establish this common ground,
cooperation from upstream is needed.
There's quite a big mess on WebKit's security list, Vincent suggested few changes, let's see. Another question is how to make releases in sync - to have same snapshots in Fedora.
For
starters we should probably identify what our current position is --
i.e.
what are the webkit ports used in fedora, which SVN snapshot they
use, what
are the core components of webkit, the differences in build
systems, ... And
outlining the idea of splitting/merging.
Any merging is really upstream (upstreams) problem but yes - we need to clean up WebKits situations - what we really have, who is consumer of which one etc.
Anyway, I would be
interested in helping, although I doubt I could help
much, given my low to
none knowledge of webkit internals and little
time, but as a full time user
of webkitgtk based apps, I'm highly
interested in having them work in
reasonable way.
Great (and yes, latest WebKits crashes - icedtea plugin is cross WebKits one)!
Jaroslav
Regards, Martin
On Fri, 2010-08-06 at 16:45 +0200, Jaroslav Reznik wrote:
If you're interested in - please reply, I'd like to start Wiki page and we can talked about more details etc.
Hey, thanks for taking this initiative. Since I recently made the mess bigger by creating a webkitgtk3 package, I should probaby raise my hand here...
On Friday, August 06, 2010 05:18:14 pm Matthias Clasen wrote:
On Fri,
2010-08-06 at 16:45 +0200, Jaroslav Reznik wrote:
If you're interested in
- please reply,
I'd like to start Wiki page and we can talked about more
details
etc.
Hey, thanks for taking this initiative. Since I recently
made the mess
bigger by creating a webkitgtk3 package, I should probaby
raise my hand
here...
Wow, another one (I wasn't aware of this). And we can expect one more from Qt side (standalone QtWebKit not bundled in Qt). Fun ;-)
Jaroslav
On Fri, 6 Aug 2010 16:45:39 +0200 Jaroslav Reznik jreznik@redhat.com wrote:
...snip...
If you're interested in - please reply, I'd like to start Wiki page and we can talked about more details etc.
I'm an interested webkitgtk user. ;)
I'm not sure how much time I have to help, but I'm happy to update/apply patches/patchmonkey webkitgtk.
kevin
On Friday, August 06, 2010 04:45:39 pm Jaroslav Reznik wrote:
If you're
interested in - please reply,
I'd like to start Wiki page and we can talked
about more details
etc.
There is already WebKit page on Wiki [1] but I'd like to use this one as the entry point for users, not for more concrete technical discussion. So I created another page under SIGs category [2] (is there any policy for creation of SIGs? I wasn't very successful looking for it but I'm quite tired already). Please sign up and edit tasks section according to what do you find to be important to start SIG.
[1] https://fedoraproject.org/wiki/WebKit [2] https://fedoraproject.org/wiki/SIGs/WebKit
Jaroslav
Thanks Jaroslav
--
Jaroslav Řezník jreznik@redhat.com Software Engineer - Base Operating Systems Brno
Office: +420 532 294 275 Mobile: +420 602 797 774 Red Hat, Inc. http://cz.redhat.com/
On Fri, Aug 6, 2010 at 12:11 PM, Jaroslav Reznik jreznik@redhat.com wrote:
On Friday, August 06, 2010 04:45:39 pm Jaroslav Reznik wrote:
If you're
interested in - please reply,
I'd like to start Wiki page and we can talked
about more details
etc.
There is already WebKit page on Wiki [1] but I'd like to use this one as the entry point for users, not for more concrete technical discussion. So I created another page under SIGs category [2] (is there any policy for creation of SIGs? I wasn't very successful looking for it but I'm quite tired already). Please sign up and edit tasks section according to what do you find to be important to start SIG.
It may be wise to engage the various upstream projects and other distributions for this. Even webkit upstream battles with problems as you have the two big players, Apple and Google, on different release schedules.
Thanks for jumping on this, a couple of us were chatting about this just the other day, it's desperately needed.
Le vendredi 06 août 2010 à 18:11 +0200, Jaroslav Reznik a écrit :
(is there any policy for creation of SIGs? I wasn't very successful looking for it but I'm quite tired already).
The policy for creating SIGs is that there are no policy for creating SIGs. Just rock. A SIG is pretty informal, the formal Fedora organisation unit is the sub-project (Art, I18n, etc)
On Fri, 2010-08-06 at 18:11 +0200, Jaroslav Reznik wrote:
There is already WebKit page on Wiki [1] but I'd like to use this one as the entry point for users, not for more concrete technical discussion. So I created another page under SIGs category [2] (is there any policy for creation of SIGs? I wasn't very successful looking for it but I'm quite tired already). Please sign up and edit tasks section according to what do you find to be important to start SIG.
So, I've done some initial filling up the WebKitsInFedora [3] page. It will probably need more details on what svn snapshots the various versions use, adding reference to spot's chromium, what are the port specifics (libsoup vs. curl, ...),... Feel free to add this info :)
[1] https://fedoraproject.org/wiki/WebKit [2] https://fedoraproject.org/wiki/SIGs/WebKit
[3] https://fedoraproject.org/wiki/SIGs/WebKit/WebKitsInFedora
Martin
Hi,
I'm interested too! Do we cover embedded platforms?
-Ilyes Gouta
On Fri, Aug 6, 2010 at 9:48 PM, Martin Sourada martin.sourada@gmail.com wrote:
On Fri, 2010-08-06 at 18:11 +0200, Jaroslav Reznik wrote:
There is already WebKit page on Wiki [1] but I'd like to use this one as the entry point for users, not for more concrete technical discussion. So I created another page under SIGs category [2] (is there any policy for creation of SIGs? I wasn't very successful looking for it but I'm quite tired already). Please sign up and edit tasks section according to what do you find to be important to start SIG.
So, I've done some initial filling up the WebKitsInFedora [3] page. It will probably need more details on what svn snapshots the various versions use, adding reference to spot's chromium, what are the port specifics (libsoup vs. curl, ...),... Feel free to add this info :)
[1] https://fedoraproject.org/wiki/WebKit [2] https://fedoraproject.org/wiki/SIGs/WebKit
[3] https://fedoraproject.org/wiki/SIGs/WebKit/WebKitsInFedora
Martin
-- devel mailing list devel@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/devel
On Friday, August 06, 2010 04:45:39 pm Jaroslav Reznik wrote:
Just an update: we hava our own WebKit SIG mailing list [1]. Feel free to subscribe.
[1] https://admin.fedoraproject.org/mailman/listinfo/webkit
Thanks Jaroslav