GNU bug report logs - #26176
What to do about unmaintained frameworks like webkitgtk@2.4 in Guix?

Previous Next

Full log

Message #11 received at 26176 <at> debbugs.gnu.org (full text, mbox):

From: Efraim Flashner <efraim <at> flashner.co.il>
To: Leo Famulari <leo <at> famulari.name>, 26176 <at> debbugs.gnu.org
Subject: Re: bug#26176: What to do about unmaintained frameworks like
 webkitgtk <at> 2.4 in Guix?
Date: Mon, 20 Mar 2017 08:50:54 +0200

[Message part 1 (text/plain, inline)]

On Sun, Mar 19, 2017 at 10:17:38PM +0000, ng0 wrote:
> Leo Famulari transcribed 2.1K bytes:
> > We do a good job of deploying security updates to webkitgtk <at> 2.14.
> > Typically, we push the update within 24 hours.
> > 
> > However, several packages still depend on webkitgtk <at> 2.4, which is
> > unmaintained upstream and surely contains many serious security
> > vulnerabilities.
> > 
> > $ guix refresh -l webkitgtk <at> 2.4
> > Building the following 6 packages would ensure 10 dependent packages are
> > rebuilt: aria-maestosa-1.4.11 wxmaxima-16.04.2 filezilla-3.24.1
> > elixir-1.3.2 kicad-4.0-1.4ee344e audacity-2.1.2
> > 
> > People who install these packages probably do not expect to install
> > software containing publicly disclosed security vulnerabilities.
> > 
> > We should try to make these packages use a maintained version of
> > webkitgtk.
> 
> Maybe those packages are already confirmed to work with 2.14, in some
> commit in upstream software. If they aren't, and we can't make them
> build with 2.14 in a functional way, it would serve a broad spectrum of
> clients including Guix users to get in contact with the affected
> package.
> 

Good news on that front! 

$ guix refresh -l wxwidgets
Building the following 5 packages would ensure 6 dependent packages are
rebuilt: aria-maestosa-1.4.11 wxmaxima-16.04.2 filezilla-3.24.1
elixir-1.3.2 audacity-2.1.2

kicad uses wxwidgets built with gtk+-2, and the one that didn't show up
at all, gnucash, uses webkitgtk/gtk+-2, which is the gtk+@2 version of
webkit <at> 2.4.

Wxwidgets currently is built with webkit <at> 2.4, but it looks like it
supports webkit.

I'm currently working on testing wxwidgets built with webkit to see if
that takes care of everything currently relying on webkit <at> ancient other
than gnucash.

-- 
Efraim Flashner   <efraim <at> flashner.co.il>   אפרים פלשנר
GPG key = A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted

[signature.asc (application/pgp-signature, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.