GNU bug report logs - #26176
What to do about unmaintained frameworks like webkitgtk@2.4 in Guix?

Previous Next

Full log

View this message in rfc822 format

From: help-debbugs <at> gnu.org (GNU bug Tracking System)
To: Leo Famulari <leo <at> famulari.name>
Subject: bug#26176: closed (Re: bug#26176: What to do about unmaintained
 frameworks like webkitgtk <at> 2.4 in Guix?)
Date: Sat, 09 Jun 2018 05:12:02 +0000

[Message part 1 (text/plain, inline)]

Your bug report

#26176: What to do about unmaintained frameworks like webkitgtk <at> 2.4 in Guix?

which was filed against the guix package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to 26176 <at> debbugs.gnu.org.

-- 
26176: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=26176
GNU Bug Tracking System
Contact help-debbugs <at> gnu.org with problems

[Message part 2 (message/rfc822, inline)]

From: Chris Marusich <cmmarusich <at> gmail.com>
To: Leo Famulari <leo <at> famulari.name>
Cc: 26176-done <at> debbugs.gnu.org
Subject: Re: bug#26176: What to do about unmaintained frameworks like
 webkitgtk <at> 2.4 in Guix?
Date: Fri, 08 Jun 2018 22:11:10 -0700

[Message part 3 (text/plain, inline)]

Leo Famulari <leo <at> famulari.name> writes:

> Several packages still depend on webkitgtk <at> 2.4, which is
> unmaintained upstream and surely contains many serious security
> vulnerabilities.

We've removed webkitgtk-2.4 in commit
38039b4fa917c7516535167fb082ea63850ee578, which has been merged into
master (according to 'git branch --all --contains
38039b4fa917c7516535167fb082ea63850ee578'), so I'm closing this bug
report.

-- 
Chris

[signature.asc (application/pgp-signature, inline)]

[Message part 5 (message/rfc822, inline)]

From: Leo Famulari <leo <at> famulari.name>
To: bug-guix <at> gnu.org
Subject: What to do about unmaintained frameworks like webkitgtk <at> 2.4 in Guix?
Date: Sun, 19 Mar 2017 16:44:14 -0400

[Message part 6 (text/plain, inline)]

We do a good job of deploying security updates to webkitgtk <at> 2.14.
Typically, we push the update within 24 hours.

However, several packages still depend on webkitgtk <at> 2.4, which is
unmaintained upstream and surely contains many serious security
vulnerabilities.

$ guix refresh -l webkitgtk <at> 2.4
Building the following 6 packages would ensure 10 dependent packages are
rebuilt: aria-maestosa-1.4.11 wxmaxima-16.04.2 filezilla-3.24.1
elixir-1.3.2 kicad-4.0-1.4ee344e audacity-2.1.2

People who install these packages probably do not expect to install
software containing publicly disclosed security vulnerabilities.

We should try to make these packages use a maintained version of
webkitgtk.

If that's not possible, what should we do?

Here is a primer on the tangled world of webkit forks and versions:
https://blogs.gnome.org/mcatanzaro/2016/02/01/on-webkit-security-updates/

It states that distros should not expect webkitgtk <at> 2.4 to receive
security updates:
------
We could attempt to provide security backports to WebKitGTK+ 2.4. This
would be very time consuming and therefore very expensive, so count this
out.
------

[signature.asc (application/pgp-signature, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.