Proposed mass bug filing for webkitgtk/webkitgtk3 package removal

[Michael Catanzaro]

Hi,

I propose to carry out a mass bug filing with the bug title: "Remove
webkitgtk/webkitgtk3 dependency" (depending on which package is
dependend on) and following text:

"""
The webkitgtk/webkitgtk3 package will be removed from rawhide after
Fedora 26 is branched due to the high number of unfixed security
vulnerabilities. You must remove this dependency or your package will
not be present in Fedora 27.

Please refer to [1] for a FAQ on this matter and be advised that for
some packages this may require a substantial amount of work.

[1] https://lists.fedoraproject.org/archives/list/[e-mail]
ject.org/thread/AKVB363GFCHHJ5MTHGVYHYT6NLLTF5VM/
"""

Michael
_______________________________________________
devel-announce mailing list
devel-announce(a)lists.fedoraproject.org
https://lists.fedoraproject.org/admin/lists/[e-mail]...

[Michael Catanzaro]

On Fri, 2016-09-02 at 07:34 -0500, Michael Catanzaro wrote:
>  Hi,
>  
>  I propose to carry out a mass bug filing with the bug title: "Remove
>  webkitgtk/webkitgtk3 dependency" (depending on which package is
>  dependend on) and following text:
>  
>  """
>  The webkitgtk/webkitgtk3 package will be removed from rawhide after
>  Fedora 26 is branched due to the high number of unfixed security
>  vulnerabilities. You must remove this dependency or your package will
>  not be present in Fedora 27.
>  
>  Please refer to [1] for a FAQ on this matter and be advised that for
>  some packages this may require a substantial amount of work.
>  
>  [1] https://lists.fedoraproject.org/archives/list/[e-mail]
>  ro
>  ject.org/thread/AKVB363GFCHHJ5MTHGVYHYT6NLLTF5VM/
>  """
>  
>  Michael 
Hi,

I'm going to go ahead with this next week. I'm sending this "reminder"
now to make sure everyone has a full week to see the proposal before I
start filing bugs. I previously mailed devel-announce as required by
our mass bug filing policy, but I believe the moderator has not
approved the announcement yet.

Michael

[Michael Catanzaro]

On Mon, 2016-09-05 at 08:36 -0500, Michael Catanzaro wrote:
>  > I propose to carry out a mass bug filing with the bug title:
>  "Remove
>  > webkitgtk/webkitgtk3 dependency" (depending on which package is
>  > dependend on) and following text: 
I've started filing bugs and will continue throughout the week.

Michael

[Michael Catanzaro]

On Tue, 2016-09-13 at 23:26 -0500, Michael Catanzaro wrote:
>  I've started filing bugs and will continue throughout the week.
>  
>  Michael 
Well nevermind that, I'm (mostly) finished:

https://bugzilla.redhat.com/show_bug.cgi?id=1375784

The one thing I did not do was file individual bugs for all of the
dependencies of wxGTK3. There are quite a few. Anyone know if this
package will be ported to WebKit2? If it's likely to happen, then we
probably don't need to file bugs for its dependencies as most of them
won't need to change anything. But if it's not likely to happen in
time, then I will file bugs for its dependencies to let them know they
are in trouble and should look into helping wxGTK3.

Michael

[Jens Lody]

Am 14.09.2016 05:26, schrieb Michael Catanzaro:
>  On Tue, 2016-09-13 at 23:26 -0500, Michael Catanzaro wrote:
> > I've started filing bugs and will continue throughout the week.
> >  
> >  Michael 
>  
>  Well nevermind that, I'm (mostly) finished:
>  
>  https://bugzilla.redhat.com/show_bug.cgi?id=1375784
>  
>  The one thing I did not do was file individual bugs for all of the
>  dependencies of wxGTK3. There are quite a few. Anyone know if this
>  package will be ported to WebKit2? If it's likely to happen, then we
>  probably don't need to file bugs for its dependencies as most of them
>  won't need to change anything. But if it's not likely to happen in
>  time, then I will file bugs for its dependencies to let them know they
>  are in trouble and should look into helping wxGTK3.
>   
The wxWidgets devs are aware of the change:
http://trac.wxwidgets.org/ticket/17650
but the bug was tagged as "gsoc", so it will probably take some time 
until the change is really done.
>  
>  Michael 
Jens

[Scott Talbert]

On Wed, 14 Sep 2016, Michael Catanzaro wrote:

>  On Tue, 2016-09-13 at 23:26 -0500, Michael Catanzaro wrote:
> > I've started filing bugs and will continue throughout the week.
> >
> > Michael
>
>  Well nevermind that, I'm (mostly) finished:
>
>  https://bugzilla.redhat.com/show_bug.cgi?id=1375784
>
>  The one thing I did not do was file individual bugs for all of the
>  dependencies of wxGTK3. There are quite a few. Anyone know if this
>  package will be ported to WebKit2? If it's likely to happen, then we
>  probably don't need to file bugs for its dependencies as most of them
>  won't need to change anything. But if it's not likely to happen in
>  time, then I will file bugs for its dependencies to let them know they
>  are in trouble and should look into helping wxGTK3. 
Yes, it's in progress:
http://trac.wxwidgets.org/ticket/17650

Scott

[Christian Stadelmann]

1. your link is broken. This should work:
https://lists.fedoraproject.org/archives/list/devel%40lists.fedoraproject...

2. I like the idea!

3. about the FESCO exceptions:

>   Question: What if my application doesn't process untrusted
> input?
>  
>  Answer: If you're sure your application never processes untrusted input, it is a
> special flower. You should request a bundling exception from FESCo if you do not intend to
> upgrade. 
gnucash does use webkitgtk for rendering charts with JavaScript libraries, so it will
probably need this exception. Anyway, I think it's a bad idea to bundle webkitgtk into
gnucash. Maybe we should just wait after the mass bug filing until the F26/rawhide split.

4. Btw: In the mail referenced above you've written about an update to QtWebKit. How
is it going? Are there any links? How are contingency plans for QtWebKit? Since it has
probably even more security bugs, isn't it time to deprecate it as well?

[Michael Catanzaro]

Thanks for the feedback!

I think the link is actually fine in the devel-announce version of the
mail that you didn't get to see. It's indeed broken by my reply quotes.

On Mon, 2016-09-05 at 16:27 +0000, Christian Stadelmann wrote:
>  4. Btw: In the mail referenced above you've written about an
> update
>  to QtWebKit. How is it going? Are there any links? How are
>  contingency plans for QtWebKit? Since it has probably even more
>  security bugs, isn't it time to deprecate it as well? 
It's under development in [1], which is based on WebKitGTK+'s 2.12
branch. I think the path forward here is not to deprecate QtWebKit, but
to switch to this new upstream as soon as it's considered ready (which
is not yet).

[1] https://github.com/annulen/webkit/tree/qtwebkit-stable

[Richard W.M. Jones]

On Fri, Sep 02, 2016 at 07:34:04AM -0500, Michael Catanzaro wrote:
>  Hi,
>  
>  I propose to carry out a mass bug filing with the bug title: "Remove
>  webkitgtk/webkitgtk3 dependency" (depending on which package is
>  dependend on) and following text:
>  
>  """
>  The webkitgtk/webkitgtk3 package will be removed from rawhide after
>  Fedora 26 is branched due to the high number of unfixed security
>  vulnerabilities. You must remove this dependency or your package will
>  not be present in Fedora 27.
>  
>  Please refer to [1] for a FAQ on this matter and be advised that for
>  some packages this may require a substantial amount of work.
>  
>  [1] https://lists.fedoraproject.org/archives/list/[e-mail]
>  ject.org/thread/AKVB363GFCHHJ5MTHGVYHYT6NLLTF5VM/
>  """ 
Is there a Perl binding of webkit2 in Fedora?

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
virt-builder quickly builds VMs from scratch
http://libguestfs.org/virt-builder.1.html

[Daniel P. Berrange]

On Tue, Sep 06, 2016 at 09:01:27AM +0100, Richard W.M. Jones wrote:
>  On Fri, Sep 02, 2016 at 07:34:04AM -0500, Michael Catanzaro wrote:
>  > Hi,
>  > 
>  > I propose to carry out a mass bug filing with the bug title: "Remove
>  > webkitgtk/webkitgtk3 dependency" (depending on which package is
>  > dependend on) and following text:
>  > 
>  > """
>  > The webkitgtk/webkitgtk3 package will be removed from rawhide after
>  > Fedora 26 is branched due to the high number of unfixed security
>  > vulnerabilities. You must remove this dependency or your package will
>  > not be present in Fedora 27.
>  > 
>  > Please refer to [1] for a FAQ on this matter and be advised that for
>  > some packages this may require a substantial amount of work.
>  > 
>  > [1] https://lists.fedoraproject.org/archives/list/[e-mail]
>  > ject.org/thread/AKVB363GFCHHJ5MTHGVYHYT6NLLTF5VM/
>  > """
>  
>  Is there a Perl binding of webkit2 in Fedora? 
The webkitgtk4 packages include a gobject introspection typelib, so you
can likely use Glib::Object::Introspection to get access to the webkit2
APIs that way.

Regards,
Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|