Groups > linux.debian.bugs.dist > #1178943

Bug#1057755: Qt WebEngine Security Support In Stable

From	Soren Stoutner <soren@stoutner.com>
Newsgroups	linux.debian.bugs.dist, linux.debian.devel.release
Subject	Bug#1057755: Qt WebEngine Security Support In Stable
Date	2023-12-16 21:30 +0100
Message-ID	<HLJsl-e2JR-7@gated-at.bofh.it> (permalink)
References	<HIy0p-c3Z0-1@gated-at.bofh.it> <HL5bz-dDSk-1@gated-at.bofh.it> <HIy0p-c3Z0-1@gated-at.bofh.it> <HL5bz-dDSk-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Alberto

On Thursday, December 14, 2023 6:23:57 PM MST Alberto Garcia wrote:
> I would like to offer my (outsider) perspective as the Debian
> WebKitGTK / WPE WebKit maintainer.

Thanks for that perspective.  It is very informative.

> - The project created a policy to support Debian and Ubuntu LTS by not
>   bumping the dependencies:

What WebKitGTK has accomplished is impressive.  Specifically, that you are able 
to release updated packages, including feature updates, cleanly into stable 
and oldstable.  As you point out, doing so with Qt WebEngine would require 
significant changes to the way upstream works.

Luckily, my intentions are much less ambitions.  I would julst like to handle 
security support for stable without adding full new feature releases.

> If you still want to give it a go maybe try updating the Qt WebEngine
> via backports first, although if that requires that the Qt / KDE
> maintainers stick to a specific LTE branch then you need to coordinate
> that with them first.

I think this is the best way forward.  Bookworm released with an LTS version 
of Qt 5 and a non-LTS version of Qt 6.  It seems it should be fairly easy to 
start maintaining proper security support for Qt 5 WebEngine through 
backports.  If we can get trixie to release with an LTS version of Qt 6, we 
can then maintain security updates for both versions of Qt.  Based on how well 
that works, we can then evaluate using the standard security infrastructure to 
handle these instead of backports.

Something similar has already been done once through a stable point release.  
Bookworm released with qtwebengine-opensource-src 5.15.8+dfsg-1, but 
5.15.13+dfsg-1~deb12u1 was later uploaded.  Perhaps Dmitry could provide some 
insight into the motivation behind the update and any difficulties that were 
encountered.

At this point, the biggest remaining question is what is the private header 
that angelfish is using in Qt WebEngine and why?  Can one of the angelfish 
maintainers or someone else familiar with the reasoning provide an 
explanation?

Thanks,

Soren

-- 
Soren Stoutner
soren@stoutner.com

Thread

Bug#1057755: qt6-webengine: Support security updates in stable Soren Stoutner <soren@stoutner.com> - 2023-12-08 02:40 +0100
  Bug#1057755: Qt WebEngine Security Support In Stable Patrick Franz <deltaone@debian.org> - 2023-12-13 21:20 +0100
    Re: Bug#1057755: Qt WebEngine Security Support In Stable Soren Stoutner <soren@stoutner.com> - 2023-12-13 22:20 +0100
      Bug#1057755: Qt WebEngine Security Support In Stable Patrick Franz <deltaone@debian.org> - 2023-12-13 23:10 +0100
        Bug#1057755: Qt WebEngine Security Support In Stable Soren Stoutner <soren@stoutner.com> - 2023-12-14 00:50 +0100
          Bug#1057755: Qt WebEngine Security Support In Stable Mike Gabriel <sunweaver@debian.org> - 2023-12-14 09:10 +0100
      Re: Bug#1057755: Qt WebEngine Security Support In Stable Adrian Bunk <bunk@debian.org> - 2023-12-14 02:40 +0100
        Re: Bug#1057755: Qt WebEngine Security Support In Stable Soren Stoutner <soren@stoutner.com> - 2023-12-14 05:00 +0100
          Re: Bug#1057755: Qt WebEngine Security Support In Stable Paul Gevers <elbrus@debian.org> - 2023-12-14 08:40 +0100
            Re: Bug#1057755: Qt WebEngine Security Support In Stable Soren Stoutner <soren@stoutner.com> - 2023-12-14 08:50 +0100
              Re: Bug#1057755: Qt WebEngine Security Support In Stable Paul Gevers <elbrus@debian.org> - 2023-12-14 09:10 +0100
                Re: Bug#1057755: Qt WebEngine Security Support In Stable Soren Stoutner <soren@stoutner.com> - 2023-12-14 21:00 +0100
          Re: Bug#1057755: Qt WebEngine Security Support In Stable Adrian Bunk <bunk@debian.org> - 2023-12-14 13:40 +0100
          Bug#1057755: Qt WebEngine Security Support In Stable Alberto Garcia <berto@igalia.com> - 2023-12-15 02:30 +0100
            Bug#1057755: Qt WebEngine Security Support In Stable Soren Stoutner <soren@stoutner.com> - 2023-12-16 21:30 +0100
              Bug#1057755: Qt WebEngine Security Support In Stable Adrian Bunk <bunk@debian.org> - 2023-12-17 00:20 +0100
                Bug#1057755: Qt WebEngine Security Support In Stable Soren Stoutner <soren@stoutner.com> - 2023-12-17 00:40 +0100
                Bug#1057755: Qt WebEngine Security Support In Stable Patrick Franz <deltaone@debian.org> - 2023-12-17 01:00 +0100
                Bug#1057755: Qt WebEngine Security Support In Stable Soren Stoutner <soren@stoutner.com> - 2023-12-17 01:30 +0100
                Bug#1057755: Qt WebEngine Security Support In Stable Soren Stoutner <soren@stoutner.com> - 2023-12-17 02:10 +0100
                Bug#1057755: Qt WebEngine Security Support In Stable Adrian Bunk <bunk@debian.org> - 2023-12-17 11:20 +0100
                Bug#1057755: Qt WebEngine Security Support In Stable Soren Stoutner <soren@stoutner.com> - 2023-12-18 18:40 +0100
                Bug#1057755: Qt WebEngine Security Support In Stable Dmitry Shachnev <mitya57@debian.org> - 2023-12-20 15:10 +0100
                Bug#1057755: Qt WebEngine Security Support In Stable Soren Stoutner <soren@stoutner.com> - 2023-12-20 20:30 +0100
                Bug#1057755: Qt WebEngine Security Support In Stable Dmitry Shachnev <mitya57@debian.org> - 2023-12-20 21:30 +0100
                Bug#1057755: Qt WebEngine Security Support In Stable Soren Stoutner <soren@stoutner.com> - 2023-12-20 22:10 +0100
                Bug#1057755: Qt WebEngine Security Support In Stable Dmitry Shachnev <mitya57@debian.org> - 2023-12-21 11:10 +0100
                Bug#1057755: Qt WebEngine Security Support In Stable Soren Stoutner <soren@stoutner.com> - 2023-12-21 21:00 +0100
                Bug#1057755: Qt WebEngine Security Support In Stable Dmitry Shachnev <mitya57@debian.org> - 2023-12-21 22:00 +0100
                Bug#1057755: Qt WebEngine Security Support In Stable Soren Stoutner <soren@stoutner.com> - 2023-12-22 23:00 +0100
                Bug#1057755: Qt WebEngine Security Support In Stable Dmitry Shachnev <mitya57@debian.org> - 2023-12-20 14:40 +0100
  Bug#1057755: Qt WebEngine Security Support In Stable Adrian Bunk <bunk@debian.org> - 2023-12-15 00:30 +0100
  Bug#1057755: Qt WebEngine Security Support In Stable Adrian Bunk <bunk@debian.org> - 2023-12-15 09:50 +0100
    Bug#1057755: Qt WebEngine Security Support In Stable Moritz Muehlenhoff <jmm@inutil.org> - 2023-12-15 20:30 +0100
  Bug#1057755: Qt WebEngine Security Support In Stable Ratchanan Srirattanamet <ratchanan@ubports.com> - 2023-12-23 15:10 +0100
  Bug#1057755: Qt WebEngine Security Support In Stable Adrian Bunk <bunk@debian.org> - 2023-12-24 12:00 +0100

csiph-web