Get rid of webkitgtk24 #18312

domenkozar · 2016-09-05T10:19:19Z

It can not be built in parallel so it takes 6+ hours to build, sometimes even 9h.

$ git grep webkitgtk24
pkgs/applications/editors/emacs-25/default.nix:, withXwidgets ? false, webkitgtk24x ? null, wrapGAppsHook ? null, glib_networking ? null
pkgs/applications/editors/emacs-25/default.nix:assert withXwidgets -> withGTK3 && webkitgtk24x != null;
pkgs/applications/editors/emacs-25/default.nix:    ++ stdenv.lib.optionals withXwidgets [webkitgtk24x wrapGAppsHook glib_networking];
pkgs/desktops/gnome-3/3.20/default.nix:  inherit (pkgs) glib gtk2 webkitgtk24x webkitgtk212x gtk3 gtkmm3 libcanberra;
pkgs/desktops/gnome-3/3.20/default.nix:  #   webkitgtk = webkitgtk24x;
pkgs/desktops/gnome-3/3.20/default.nix:    webkitgtk = webkitgtk24x;
pkgs/desktops/gnome-3/3.20/default.nix:    webkitgtk = webkitgtk24x;
pkgs/desktops/gnome-3/3.20/default.nix:    webkitgtk = webkitgtk24x;
pkgs/desktops/gnome-3/3.20/default.nix:    webkitgtk = webkitgtk24x;
pkgs/development/haskell-modules/configuration-common.nix:  webkitgtk3 = super.webkitgtk3.override { webkit = pkgs.webkitgtk24x; };
pkgs/development/haskell-modules/configuration-common.nix:  webkitgtk3-javascriptcore = super.webkitgtk3-javascriptcore.override { webkit = pkgs.webkitgtk24x; };
pkgs/development/haskell-modules/configuration-common.nix:  websnap = super.websnap.override { webkit = pkgs.webkitgtk24x; };
pkgs/tools/networking/mu/default.nix:, gtk3, webkitgtk24x, libsoup, icu }:
pkgs/tools/networking/mu/default.nix:    gtk3 webkitgtk24x ];
pkgs/top-level/all-packages.nix:  webkitgtk24x = callPackage ../development/libraries/webkitgtk/2.4.nix {
pkgs/top-level/all-packages.nix:  webkitgtk2 = webkitgtk24x.override {
pkgs/top-level/all-packages.nix:    webkitgtk = webkitgtk24x;
pkgs/top-level/all-packages.nix:    webkitgtk = webkitgtk24x;

cc @lethalman @DamienCassou

The text was updated successfully, but these errors were encountered:

domenkozar · 2016-09-05T10:20:55Z

@gebner could we bump webkitgtk version for mu? See ad41b8f

domenkozar · 2016-09-05T10:42:58Z

http://hydra.nixos.org/jobset/nixos/issue-18312-webkitgtk24-removal

domenkozar · 2016-09-05T11:03:52Z

http://hydra.nixos.org/eval/1290929?compare=release-16.09

domenkozar · 2016-09-05T11:20:44Z

Packages that need the old api should probably be just migrated to webkit 2.10

(cherry picked from commit 2ef4e9e) Signed-off-by: Domen Kožar <domen@dev.si>

gebner · 2016-09-05T18:13:32Z

Is webkitgtk210x the new version with the old API? I just tried to build mu against it, but apparently we don't build webkitgtk210x on hydra. Is there a reason for hydra not building it?

RamKromberg · 2016-09-06T03:48:04Z

@gebner No. There's no one "old api". We've covered this all in #17308 but essentially there were 4 API deprecations resulting in 4 distinct branches: 2.4, 2.6, 2.10 & 2.12.

In fact, upstream doesn't support 2.4, 2.6 & 2.10 and considers 2.12 the stable branch. Worse, the 2.10 branch had consecutive security issues and ended up getting stricken off the change-logs as if it was some development unstable branch...

groxxda · 2016-09-29T08:42:57Z

I was hoping we could remove webkitgtk for gnome 3.22, but it turns out, it's still needed...
https://bugs.launchpad.net/ubuntu/+source/bijiben/+bug/1588150
For us this affects bijiben and geary 😞

groxxda · 2016-09-29T08:47:16Z

More uses:

git grep 'webkitgtk2[^41]'
pkgs/applications/audio/guitarix/default.nix:, webkitgtk2, wrapGAppsHook, zita-convolver, zita-resampler
pkgs/applications/audio/guitarix/default.nix:    libsndfile lilv lv2 serd sord sratom webkitgtk2 zita-convolver
pkgs/applications/editors/eclipse/build-eclipse.nix:{ stdenv, makeDesktopItem, freetype, fontconfig, libX11, libXrender, zlib, jdk, glib, gtk2, libXtst, webkitgtk2, makeWrapper, ... }:
pkgs/applications/editors/eclipse/build-eclipse.nix:      --prefix LD_LIBRARY_PATH : ${stdenv.lib.makeLibraryPath ([ glib gtk2 libXtst ] ++ stdenv.lib.optional (webkitgtk2 != null) webkitgtk2)} \
pkgs/applications/editors/eclipse/default.nix:, webkitgtk2 ? null  # for internal web browser
pkgs/applications/networking/browsers/dwb/default.nix:{ stdenv, fetchgit, pkgconfig, makeWrapper, libsoup, webkitgtk2, gtk2, gnutls
pkgs/applications/networking/browsers/dwb/default.nix:    webkitgtk2 gtk2 gnutls json_c m4 ];
pkgs/applications/networking/mailreaders/claws-mail/default.nix:    ++ optional enablePluginFancy webkitgtk2;
pkgs/applications/office/osmo/default.nix:, libarchive, gtkspell2, webkitgtk2, libgringotts }:
pkgs/applications/office/osmo/default.nix:    gtkspell2 webkitgtk2 libgringotts ];
pkgs/applications/video/miro/default.nix:, pythonPackages, pyrex096, ffmpeg, boost, glib, gtk2, webkitgtk2, libsoup
pkgs/applications/video/miro/default.nix:    pkgconfig pyrex096 ffmpeg boost glib gtk2 webkitgtk2 libsoup
pkgs/development/haskell-modules/configuration-common.nix:  webkit = super.webkit.override { webkit = pkgs.webkitgtk2; };
pkgs/top-level/all-packages.nix:  webkitgtk2 = webkitgtk24x.override {
pkgs/top-level/all-packages.nix:    webkit = webkitgtk2;
pkgs/top-level/all-packages.nix:      webkit = webkitgtk2;
pkgs/top-level/all-packages.nix:    webkit = webkitgtk2;
pkgs/top-level/all-packages.nix:    webkit = webkitgtk2;
pkgs/top-level/all-packages.nix:    webkitgtk = webkitgtk2;
pkgs/top-level/all-packages.nix:    webkit = webkitgtk2;
pkgs/top-level/all-packages.nix:    webkit = webkitgtk2;
pkgs/top-level/python-packages.nix:      pkgs.libxslt pkgs.libsoup pkgs.webkitgtk2 pkgs.icu

grahamc · 2016-10-22T12:51:20Z

How are these projects still using such an old dependency?

vcunat · 2016-10-22T13:18:21Z

I think it's mainly upstream not adding support; I've got no idea why that goes so slowly. As a consequence, e.g. the latest Debian (unstable) still defaults to 2.4.x, and even same in Arch.

domenkozar · 2017-02-09T12:49:09Z

https://blogs.gnome.org/mcatanzaro/2017/02/08/an-update-on-webkit-security-updates/

grahamc · 2017-02-09T12:50:07Z

joachifm · 2017-02-09T12:51:59Z

I vote to remove the support and mark packages that have a hard dependency on it as broken. I think emacs xwidget support is a bit of a gimmick so I for one wouldn't consider it a great loss if it had to be disabled.

grahamc · 2017-02-09T13:58:27Z

emacs 25.2 upgrades wxwidgets to use a recent webkitgtk.

vcunat · 2017-02-09T14:27:03Z

Marking webkitgtk24 itself as broken should be enough. That won't propagate to nix-env -qa normally, but it will throw the message on evaluation.

bendlas · 2017-02-15T19:22:19Z

bendlas · 2017-02-15T19:45:54Z

I think emacs xwidget support is a bit of a gimmick so I for one wouldn't consider it a great loss if it had to be disabled.

That. In fact, people over at freenode#emacs were horrified, when I told them the other day, that the xwidget browser thing had javascript support turned on.

bendlas · 2017-02-24T02:20:55Z

It seems unlikely, for all the mentioned packages to be fixed in time for the upcoming stable. I'd support marking webkitgtk24 as broken. I've been running a patch to do so for 2 master rebuilds now. The kde5 derivation continues to evaluate and for gnome3 I've just had to deactivate an optional package bijiben, see

We can continue to allow wkgtk24 for packages after assessing the security risk:
- guitarix
  Uses its (optional) wkgtk dependecy for a preset downloader. As long as nobody hacks that page, it should be fine.
- gnucash26, seems to use wkgtk for help browser and possibly online banking features (i.e. bank-controlled content)
  gnucash probably is too big to fail ;-)
- bijiben, if we don't want to drop it from gnome3's optional pacakges @lethalman ?
  It seems to use wkgtk for rendering user generated content (notes)
- ...
We should not continue to allow wkgtk24 for these packages, by default:
- eclipse
  It's an optional dependency anyway, and it enables an integrated web browser (!)
- emacs
  see previous message
- clawsmail
- miro
  Those seem likely to be exposed to uncontrolled content through email / rss
- ...

See NixOS#18312

grahamc · 2017-02-27T12:22:29Z

With @joachifm's PR merged, it isn't removed but it is disabled by default.

vcunat · 2018-02-08T17:28:23Z

Let's close. Webkit 2.4 is unusable unless you explicitly disable security check; that seems fair, and it's up to packages using this to choose (update).

domenkozar added this to the 16.09 milestone Sep 5, 2016

domenkozar added a commit to domenkozar/nixpkgs that referenced this issue Sep 5, 2016

Remove webkitgtk24 NixOS#18312

9bd1bc9

domenkozar mentioned this issue Sep 5, 2016

Zero Hydra Failures for 16.09 #18209

Closed

17 tasks

This was referenced Sep 5, 2016

webkitgtk+ vulnerabilities #12023

Closed

drop support for webkit pre-2.10.x (e.g. 2.4) triton/triton#26

Closed

domenkozar added a commit that referenced this issue Sep 5, 2016

webkitgtk24: build in parallel until #18312

2ef4e9e

domenkozar added a commit that referenced this issue Sep 5, 2016

webkitgtk24: build in parallel until #18312

d2275f4

(cherry picked from commit 2ef4e9e) Signed-off-by: Domen Kožar <domen@dev.si>

domenkozar modified the milestones: 17.03, 16.09 Sep 12, 2016

vcunat mentioned this issue Feb 9, 2017

Vulnerability Roundup 21 #22549

Closed

40 tasks

FRidh mentioned this issue Feb 9, 2017

Remove webkitgtk24x and packages depending on it #22588

Closed

10 tasks

domenkozar modified the milestones: 17.09, 17.03 Feb 9, 2017

grahamc added 1.severity: blocker 1.severity: security labels Feb 9, 2017

globin added this to Open in Blocking Issues 17.09 Feb 14, 2017

fpletz mentioned this issue Feb 26, 2017

luakit: remove #23205

Merged

joachifm mentioned this issue Feb 26, 2017

webkitgtk24x: mark as insecure #23225

Merged

joachifm added a commit to joachifm/nixpkgs that referenced this issue Feb 26, 2017

webkitgtk24x: mark as insecure

442b589

See NixOS#18312

vcunat removed the 1.severity: blocker label Feb 27, 2017

fpletz removed this from Open in Blocking Issues 17.09 Feb 28, 2017

langston-barrett mentioned this issue Jul 10, 2017

Upgrade to newer version of webkitgtk leksah/leksah#445

Closed

fpletz modified the milestones: 17.09, 18.03 Sep 17, 2017

vcunat mentioned this issue Oct 22, 2017

webkitgtk 2.4: fixup build by using older icu again #30623

Merged

8 tasks

vcunat closed this as completed Feb 8, 2018

worldofpeace mentioned this issue Dec 5, 2019

🙈️ Remove webkitgtk24x #75040

Merged

10 tasks

adrianpk added a commit to adrianpk/nixpkgs that referenced this issue May 31, 2024

webkitgtk24: build in parallel until NixOS#18312

09342cd

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Get rid of webkitgtk24 #18312

Get rid of webkitgtk24 #18312

domenkozar commented Sep 5, 2016 •

edited

Loading

domenkozar commented Sep 5, 2016

domenkozar commented Sep 5, 2016

domenkozar commented Sep 5, 2016

domenkozar commented Sep 5, 2016

gebner commented Sep 5, 2016

RamKromberg commented Sep 6, 2016

groxxda commented Sep 29, 2016

groxxda commented Sep 29, 2016

grahamc commented Oct 22, 2016

vcunat commented Oct 22, 2016 •

edited

Loading

domenkozar commented Feb 9, 2017

grahamc commented Feb 9, 2017 •

edited by jtojnar

Loading

joachifm commented Feb 9, 2017

grahamc commented Feb 9, 2017

vcunat commented Feb 9, 2017

bendlas commented Feb 15, 2017 •

edited by fpletz

Loading

bendlas commented Feb 15, 2017

bendlas commented Feb 24, 2017 •

edited

Loading

grahamc commented Feb 27, 2017

vcunat commented Feb 8, 2018 •

edited

Loading

Get rid of webkitgtk24 #18312

Get rid of webkitgtk24 #18312

Comments

domenkozar commented Sep 5, 2016 • edited Loading

domenkozar commented Sep 5, 2016

domenkozar commented Sep 5, 2016

domenkozar commented Sep 5, 2016

domenkozar commented Sep 5, 2016

gebner commented Sep 5, 2016

RamKromberg commented Sep 6, 2016

groxxda commented Sep 29, 2016

groxxda commented Sep 29, 2016

grahamc commented Oct 22, 2016

vcunat commented Oct 22, 2016 • edited Loading

domenkozar commented Feb 9, 2017

grahamc commented Feb 9, 2017 • edited by jtojnar Loading

joachifm commented Feb 9, 2017

grahamc commented Feb 9, 2017

vcunat commented Feb 9, 2017

bendlas commented Feb 15, 2017 • edited by fpletz Loading

bendlas commented Feb 15, 2017

bendlas commented Feb 24, 2017 • edited Loading

grahamc commented Feb 27, 2017

vcunat commented Feb 8, 2018 • edited Loading

domenkozar commented Sep 5, 2016 •

edited

Loading

vcunat commented Oct 22, 2016 •

edited

Loading

grahamc commented Feb 9, 2017 •

edited by jtojnar

Loading

bendlas commented Feb 15, 2017 •

edited by fpletz

Loading

bendlas commented Feb 24, 2017 •

edited

Loading

vcunat commented Feb 8, 2018 •

edited

Loading