QtWebkit will be removed from openSUSE Tumbleweed soon
Hello, QtWebKit was a rendering engine for web content released with Qt until 5.6. It was replaced with QtWebEngine after that. Despite a community fork in 2016, nothing really happened to keep it alive and secure. Quoting the QtWebKit release page on Github: "WARNING: This release is based on old WebKit revision with known unpatched vulnerabilities. Please use it carefully and avoid visiting untrusted websites and using it for transmission of sensitive data." It's time to drop it from openSUSE Tumbleweed. The good news, most QtWebKit remaining users were just caused by obsolete 'BuildRequires'. Most were cleaned during the week end. Pending SRs: - FreeCAD (SR#902666 replaces the dependency) - qgis (SR#903291 disables the optional dependency) - owncloud-client (it needs an unrelated code fix) - notepadqq (SR#903352 replaces the old version with a git snapshot) Packages that could use snapshots: - quiterss The upstream website looks down. There are 2 github repo (QuiteRSS/quiterss2 and QuiteRSS/quiterss). Both don't have hard dependency on QtWebKit. - leechcraft Last release in 2014. We're already using snapshots. QtWebKit looks optional. The less good news, a couple packages also have to be dropped. KDE packages that will be dropped: - trojita (no activity upstream) - kwebkitpart - kdewebkit Packages with no upstream activity and/or no alternative port: - wkhtmltopdf which is a dependency for python-hide-code and python-pdfkit - swift-im - smtube - goldendict Christophe
On 7/1/21 10:03 AM, Christophe Giboudeaux wrote:
The less good news, a couple packages also have to be dropped.
The even lesser good news is that QtWebEngine has a dramatically reduced portability and basically supports only architectures that Google cares about while QtWebKit worked on any architecture. QtWebEngine:
https://buildd.debian.org/status/package.php?p=qtwebkit-opensource-src&suite=sid
QtWebKit:
https://buildd.debian.org/status/package.php?p=qtwebkit-opensource-src&suite=sid
So, anyone using a modern POWER desktop or a RISC-V machine is left behind. Adrian
On Thursday 2021-07-01 10:13, John Paul Adrian Glaubitz wrote:
On 7/1/21 10:03 AM, Christophe Giboudeaux wrote:
The less good news, a couple packages also have to be dropped.
The even lesser good news is that QtWebEngine has a dramatically reduced portability and basically supports only architectures that Google cares about while QtWebKit worked on any architecture.
The care/investment for $x_topic by an audience is propertional to the incentive for $x_player to care enough about that audience... [Put in various x, be it politics, browsers - or the color of one's car.]
On 7/1/21 10:43 AM, Jan Engelhardt wrote:
The care/investment for $x_topic by an audience is propertional to the incentive for $x_player to care enough about that audience...
"But Intel is making everything closed source. We want free access to their firmware source code. We've been pushing x86 to become the most popular architecture ignoring that it's 100% proprietary and now complain that we don't have open hardware." Yes.
On Thursday 2021-07-01 10:52, John Paul Adrian Glaubitz wrote:
On 7/1/21 10:43 AM, Jan Engelhardt wrote:
The care/investment for $x_topic by an audience is propertional to the incentive for $x_player to care enough about that audience...
"But Intel is making everything closed source. We want free access to their firmware source code. We've been pushing x86 to become the most popular architecture ignoring that it's 100% proprietary and now complain that we don't have open hardware."
Well, yes? Isn't that just what I meant? Some people cared about libre operating systems, so (a few decades back) they started GNU. Some people cared about open hardware, so they went to start projects like openpower. Perhaps some day, some people care about browsers again, but right now, it's just seemingly “20 Google devs, and 1 maintainer per distro”. That reminds me. Geminispace[1]! It is the embodient of people who are not just fed up with the complexity of browsers (more like operating systems already) and documents alike. [1] https://en.wikipedia.org/wiki/Gemini_(protocol)
On Thursday, 1 July 2021 10:13:50 CEST John Paul Adrian Glaubitz wrote:
On 7/1/21 10:03 AM, Christophe Giboudeaux wrote:
The less good news, a couple packages also have to be dropped.
The even lesser good news is that QtWebEngine has a dramatically reduced portability and basically supports only architectures that Google cares about while QtWebKit worked on any architecture.
If IBM, Apple or any company behind those archs provides patches for Chromium, I'm sure we'll find a way to integrate them.
https://build.opensuse.org/package/show/openSUSE:Factory:RISCV/libqt5-qtwebe... Andreas. -- Andreas Schwab, SUSE Labs, schwab@suse.de GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE 1748 E4D4 88E3 0EEA B9D7 "And now for something completely different."
On 7/1/21 1:56 PM, Andreas Schwab wrote:
https://build.opensuse.org/package/show/openSUSE:Factory:RISCV/libqt5-qtwebe...
Ah, there is at least a riscv64 support patch for V8, nice. But still, I personally think it's a step backwards and I expect Google to remove more architectures from V8 in the future as they already threatened to get rid of MIPS support. Adrian
Am Donnerstag, 1. Juli 2021, 13:56:37 CEST schrieb Andreas Schwab:
https://build.opensuse.org/package/show/openSUSE:Factory:RISCV/libqt5-qtwebe ngine
Consequently, it fails to build: [ 5253s] FAILED: gen/third_party/devtools-frontend/src/front_end/components/components.js [ 5253s] /usr/bin/python2 ../../3rdparty/chromium/third_party/node/node.py ../../3rdparty/chromium/third_party/devtools-frontend/src/node_modules/rollup/dist/bin/rollup --silent --plugin terser --config ../../3rdparty/chromium/third_party/devtools-frontend/src/front_end/rollup.config.js --input gen/third_party/devtools-frontend/src/front_end/components/components.prebundle.js --file gen/third_party/devtools-frontend/src/front_end/components/components.js [ 5253s] Traceback (most recent call last): [ 5253s] File "../../3rdparty/chromium/third_party/node/node.py", line 63, in <module> [ 5253s] RunNode(sys.argv[1:]) [ 5253s] File "../../3rdparty/chromium/third_party/node/node.py", line 58, in RunNode [ 5253s] raise RuntimeError('%s failed: %s' % (cmd, stderr)) [ 5253s] RuntimeError: ['/usr/bin/node', '../../3rdparty/chromium/third_party/devtools-frontend/src/node_modules/rollup/dist/bin/rollup', '--silent', '--plugin', 'terser', '--config', '../../3rdparty/chromium/third_party/devtools-frontend/src/front_end/rollup.config.js', '--input', 'gen/third_party/devtools-frontend/src/front_end/components/components.prebundle.js', '--file', 'gen/third_party/devtools-frontend/src/front_end/components/components.js'] failed: Call retries were exceeded [ 5253s] [ 5253s] [!] (plugin terser) Error: Call retries were exceeded [ 5253s] Error: Call retries were exceeded [ 5253s] at ChildProcessWorker.initialize (/home/abuild/rpmbuild/BUILD/qtwebengine-everywhere-src-5.15.5/src/3rdparty/chromium/third_party/devtools-frontend/src/node_modules/jest-worker/build/workers/ChildProcessWorker.js:193:21) [ 5253s] at ChildProcessWorker.onExit (/home/abuild/rpmbuild/BUILD/qtwebengine-everywhere-src-5.15.5/src/3rdparty/chromium/third_party/devtools-frontend/src/node_modules/jest-worker/build/workers/ChildProcessWorker.js:263:12) [ 5253s] at ChildProcess.emit (node:events:394:28) [ 5253s] at Process.ChildProcess._handle.onexit (node:internal/child_process:290:12) [ 5253s] [ 5253s] Why I don't wonder, that node is the culprit here. Pete
On Jul 06 2021, Hans-Peter Jansen wrote:
Why I don't wonder, that node is the culprit here.
v8 is still very young for riscv. I had to backport a few commits to make it even compile in this version of node. But an earlier version actually worked good enough to let webengine to build. Andreas. -- Andreas Schwab, SUSE Labs, schwab@suse.de GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE 1748 E4D4 88E3 0EEA B9D7 "And now for something completely different."
On Tue, Jul 06, 2021 at 06:34:13PM +0200, Andreas Schwab wrote:
On Jul 06 2021, Hans-Peter Jansen wrote:
Why I don't wonder, that node is the culprit here.
v8 is still very young for riscv. I had to backport a few commits to make it even compile in this version of node. But an earlier version actually worked good enough to let webengine to build.
There was a V8 update in node in version 16.4.0 which could have introduced something that broke on riscv. node includes the v8 test suite in its git repository. The git branch of node16 is in devel:languages:nodejs:staging/nodejs16 so maybe that could help in isolating what goes wrong there. - Adam
Hi Christophe, Forwarded to leechcraft upstream. Please inform me if there is any deadline. чт, 1 июл. 2021 г. в 11:08, Christophe Giboudeaux <christophe@krop.fr>:
Hello,
QtWebKit was a rendering engine for web content released with Qt until 5.6. It was replaced with QtWebEngine after that.
Despite a community fork in 2016, nothing really happened to keep it alive and secure. Quoting the QtWebKit release page on Github:
"WARNING: This release is based on old WebKit revision with known unpatched vulnerabilities. Please use it carefully and avoid visiting untrusted websites and using it for transmission of sensitive data."
It's time to drop it from openSUSE Tumbleweed.
The good news, most QtWebKit remaining users were just caused by obsolete 'BuildRequires'. Most were cleaned during the week end.
Pending SRs: - FreeCAD (SR#902666 replaces the dependency) - qgis (SR#903291 disables the optional dependency) - owncloud-client (it needs an unrelated code fix) - notepadqq (SR#903352 replaces the old version with a git snapshot)
Packages that could use snapshots: - quiterss The upstream website looks down. There are 2 github repo (QuiteRSS/quiterss2 and QuiteRSS/quiterss). Both don't have hard dependency on QtWebKit. - leechcraft Last release in 2014. We're already using snapshots. QtWebKit looks optional.
The less good news, a couple packages also have to be dropped.
KDE packages that will be dropped: - trojita (no activity upstream) - kwebkitpart - kdewebkit
Packages with no upstream activity and/or no alternative port: - wkhtmltopdf which is a dependency for python-hide-code and python-pdfkit - swift-im - smtube - goldendict
Christophe
-- Best regards, Dmitriy Perlow
Hi Christophe, Am 01.07.21 um 10:03 schrieb Christophe Giboudeaux:
Hello,
QtWebKit was a rendering engine for web content released with Qt until 5.6. It was replaced with QtWebEngine after that.
...
It's time to drop it from openSUSE Tumbleweed.
The good news, most QtWebKit remaining users were just caused by obsolete 'BuildRequires'. Most were cleaned during the week end.
...
Packages that could use snapshots: - quiterss The upstream website looks down. There are 2 github repo (QuiteRSS/quiterss2 and QuiteRSS/quiterss). Both don't have hard dependency on QtWebKit. - leechcraft Last release in 2014. We're already using snapshots. QtWebKit looks optional.
Add openshot-qt to that list. Remember the discussion about it failing because we removed the QtWebKit support in python-qt5. Hopefully it is the only remaining Python package having a transitive dependency on QtWebKit through python-qt5 which is not picked up through your check on BuildRequires. Ben
On Thursday, 1 July 2021 10:29:21 CEST Ben Greiner wrote:
Add openshot-qt to that list. Remember the discussion about it failing because we removed the QtWebKit support in python-qt5.
Hopefully it is the only remaining Python package having a transitive dependency on QtWebKit through python-qt5 which is not picked up through your check on BuildRequires.
This is reported upstream and the Gentoo maintainer also asked for a new release: https://github.com/OpenShot/openshot-qt/issues/4166 I'll prepare a snapshot.
Am 01.07.21 um 10:53 schrieb Christophe Giboudeaux:
On Thursday, 1 July 2021 10:29:21 CEST Ben Greiner wrote:
Add openshot-qt to that list. Remember the discussion about it failing because we removed the QtWebKit support in python-qt5.
Hopefully it is the only remaining Python package having a transitive dependency on QtWebKit through python-qt5 which is not picked up through your check on BuildRequires.
This is reported upstream and the Gentoo maintainer also asked for a new release: https://github.com/OpenShot/openshot-qt/issues/4166
I'll prepare a snapshot.
I already did 3 weeks ago: https://build.opensuse.org/package/show/home:bnavigator:branches:multimedia:... It also needs the other packages in that same project. Including inheriting cppzmq-devel from Factory instead of multimedia:libs (!) But as the upstream issue which you mentioned states, this is far from a stable release.
El jue, 1 jul 2021 a las 13:10, Ben Greiner (<code@bnavigator.de>) escribió:
Am 01.07.21 um 10:53 schrieb Christophe Giboudeaux:
On Thursday, 1 July 2021 10:29:21 CEST Ben Greiner wrote:
Add openshot-qt to that list. Remember the discussion about it failing because we removed the QtWebKit support in python-qt5.
Hopefully it is the only remaining Python package having a transitive dependency on QtWebKit through python-qt5 which is not picked up through your check on BuildRequires.
This is reported upstream and the Gentoo maintainer also asked for a new release: https://github.com/OpenShot/openshot-qt/issues/4166
I'll prepare a snapshot.
I already did 3 weeks ago: https://build.opensuse.org/package/show/home:bnavigator:branches:multimedia:... It also needs the other packages in that same project. Including inheriting cppzmq-devel from Factory instead of multimedia:libs (!)
But as the upstream issue which you mentioned states, this is far from a stable release.
Thank You Ben! You builded libopenshot and libopenshot-audio too? I couldn't add the repo: https://build.opensuse.org/repositories/home:bnavigator:branches:multimedia:... I mean the only way is login to https://build.opensuse.org and download the packages. Regards, Juan -- USA LINUX OPENSUSE QUE ES SOFTWARE LIBRE, NO NECESITAS PIRATEAR NADA Y NI TE VAS A PREOCUPAR MAS POR LOS VIRUS Y SPYWARES: http://www.opensuse.org/es/ Puedes visitar mi blog en: http://jerbes.blogspot.com.ar/
Dne 01. 07. 21 v 10:03 Christophe Giboudeaux napsal(a):
QtWebKit was a rendering engine for web content released with Qt until 5.6. It was replaced with QtWebEngine after that.
On that note: we are working on eliminating Python 2 from Factory and libqt5-qtwebengine with chromium are two out of three last packages in Ring 1 which require it. Is there any hope on that front. I see (not very active) https://bugs.chromium.org/p/chromium/issues/detail?id=941669 , but what is the status of libqt5-qtwebengine? Is the latter dependent on the resolution of the former? Best, Matěj -- https://matej.ceplovi.cz/blog/, Jabber: mcepl@ceplovi.cz GPG Finger: 3C76 A027 CA45 AD70 98B5 BC1D 7920 5802 880B C9D8 Reading after a certain age diverts the mind too much from its creative pursuits. Any man who reads too much and uses his own brain too little falls into lazy habits of thinking, just as the man who spends too much time in the theater is tempted to be content with living vicariously instead of living his own life. -- Albert Einstein to The Saturday Evening Post, October 1929
On Thursday, 1 July 2021 15:23:27 CEST Matěj Cepl wrote:
Dne 01. 07. 21 v 10:03 Christophe Giboudeaux napsal(a):
QtWebKit was a rendering engine for web content released with Qt until 5.6. It was replaced with QtWebEngine after that.
On that note: we are working on eliminating Python 2 from Factory and libqt5-qtwebengine with chromium are two out of three last packages in Ring 1 which require it. Is there any hope on that front. I see (not very active) https://bugs.chromium.org/p/chromium/issues/detail?id=941669 , but what is the status of libqt5-qtwebengine? Is the latter dependent on the resolution of the former?
Yes. QtWebEngine itself doesn't need python2, only chromium does. One of the FreeBSD maintainer did some work[1] but it's not ready yet[2] [1] https://github.com/freebsd/freebsd-ports-kde/blob/webengine-python3/www/ qt5-webengine/files/python3-build.diff [2] https://mail.kde.org/pipermail/distributions/2020-September/000865.html
It's pretty sad. Yes, using qtwebkit to display web content that you don't control is a bad idea (that's why there is a webengine for leechcraft-poshuku, I personally use it, and everything works). But if this is something like a wysiwyg editor, or even a chat window in leechcraft-azoth, then qtwebkitwidgets is quite normal there (but webenginewidgets is not, creating a tab by process to display one and a half html tags is somehow so-so). If the editor can be turned off for now, then I would not like leechcraft-azoth. And although I have been planning to support various rendering backends with plugins for a long time, I still need to sit down and do it, and this is at least a week of full-fledged work. And even in
Hi again, From LeechCraft developer: this case, I would like to leave the support for qtwebkitwidgets — it's somehow more lightweight.
What are the deadlines for removing qtwebkit from openSUSE?
From my side: is there any possibility to save qtwebkitwidgets with sterilized qtwebkit as a dependency? чт, 1 июл. 2021 г. в 11:08, Christophe Giboudeaux <christophe@krop.fr>:
Hello,
QtWebKit was a rendering engine for web content released with Qt until 5.6. It was replaced with QtWebEngine after that.
Despite a community fork in 2016, nothing really happened to keep it alive and secure. Quoting the QtWebKit release page on Github:
"WARNING: This release is based on old WebKit revision with known unpatched vulnerabilities. Please use it carefully and avoid visiting untrusted websites and using it for transmission of sensitive data."
It's time to drop it from openSUSE Tumbleweed.
The good news, most QtWebKit remaining users were just caused by obsolete 'BuildRequires'. Most were cleaned during the week end.
Pending SRs: - FreeCAD (SR#902666 replaces the dependency) - qgis (SR#903291 disables the optional dependency) - owncloud-client (it needs an unrelated code fix) - notepadqq (SR#903352 replaces the old version with a git snapshot)
Packages that could use snapshots: - quiterss The upstream website looks down. There are 2 github repo (QuiteRSS/quiterss2 and QuiteRSS/quiterss). Both don't have hard dependency on QtWebKit. - leechcraft Last release in 2014. We're already using snapshots. QtWebKit looks optional.
The less good news, a couple packages also have to be dropped.
KDE packages that will be dropped: - trojita (no activity upstream) - kwebkitpart - kdewebkit
Packages with no upstream activity and/or no alternative port: - wkhtmltopdf which is a dependency for python-hide-code and python-pdfkit - swift-im - smtube - goldendict
Christophe
-- Best regards, Dmitriy Perlow
On Friday, 2 July 2021 07:35:01 CEST Dmitriy Perlow wrote:
What are the deadlines for removing qtwebkit from openSUSE?
From my side: is there any possibility to save qtwebkitwidgets with sterilized qtwebkit as a dependency?
No. I never used leechcraft. I have no idea how important its plugins are. Is it possible to disable the ones using qtwebkit without making the application useless? For 'simple' rendering, using QTextBrowser may also be an option. (example: https://invent.kde.org/sdk/umbrello/-/merge_requests/16#note_131069) Christophe
2021-07-01 11:03, Christophe Giboudeaux rašė:
Hello,
QtWebKit was a rendering engine for web content released with Qt until 5.6. It was replaced with QtWebEngine after that. <...>
The less good news, a couple packages also have to be dropped. <...> Packages with no upstream activity and/or no alternative port: <...> - goldendict
Hi, GoldenDict is still live. Alghough http://goldendict.org/ site is out-dated, newer 1.5rc / master versions lives in github https://github.com/goldendict/goldendict Unfortunately, there is no plans to port from QtWebKit to QtWebEngine soon, see https://github.com/goldendict/goldendict/issues/677 https://github.com/goldendict/goldendict/issues/1240 -- regards, Mindaugas
On Saturday, 3 July 2021 19:21:58 CEST opensuse.lietuviu.kalba wrote:
2021-07-01 11:03, Christophe Giboudeaux rašė:
Hello,
QtWebKit was a rendering engine for web content released with Qt until 5.6. It was replaced with QtWebEngine after that. <...>
The less good news, a couple packages also have to be dropped. <...> Packages with no upstream activity and/or no alternative port: <...> - goldendict
Hi,
GoldenDict is still live. Alghough http://goldendict.org/ site is out-dated, newer 1.5rc / master versions lives in github https://github.com/goldendict/goldendict
goldentag 1.5.0-RC2 was released... 5 years ago. That's not a good sign.
Unfortunately, there is no plans to port from QtWebKit to QtWebEngine soon, see
I saw these reports. That's why it has to be dropped from openSUSE Factory. Christophe
Op 01-07-2021 om 10:03 schreef Christophe Giboudeaux:
- smtube
Maybe this will be solved. See https://github.com/smplayer-dev/smtube/issues/7#issuecomment-873527340 Cor
Hello, Progress report on this topic: The cleanup is mostly done. 3 delete requests are still pending. When done, two packages will still depend on QtWebKit: leechcraft and smtube. The Leechcraft port is ongoing [1], but I don't see any related change in smtube yet [2]. If nothing happens upstream, it will also be removed from openSUSE:Factory. [1] https://dev.leechcraft.org/issues/2076 [2] https://github.com/smplayer-dev/smtube/issues/7 Christophe
Hi. QtWebkit became truly optional for leechcraft: https://build.opensuse.org/request/show/928448 вс, 15 авг. 2021 г. в 12:55, Christophe Giboudeaux <christophe@krop.fr>:
Hello,
Progress report on this topic:
The cleanup is mostly done. 3 delete requests are still pending.
When done, two packages will still depend on QtWebKit: leechcraft and smtube.
The Leechcraft port is ongoing [1], but I don't see any related change in smtube yet [2]. If nothing happens upstream, it will also be removed from openSUSE:Factory.
[1] https://dev.leechcraft.org/issues/2076 [2] https://github.com/smplayer-dev/smtube/issues/7
Christophe
-- Best regards, Dmitriy Perlow
On Monday, 1 November 2021 11:06:00 CET Dmitriy Perlow wrote:
Hi.
QtWebkit became truly optional for leechcraft: https://build.opensuse.org/request/show/928448
Great! I'll suibmit a delete request for smtube (the author doesn't plan to port it) and we can finally get rid of qtwebkit. Christophe
El jue, 1 jul 2021 a las 5:08, Christophe Giboudeaux (<christophe@krop.fr>) escribió:
Hello,
QtWebKit was a rendering engine for web content released with Qt until 5.6. It was replaced with QtWebEngine after that.
Despite a community fork in 2016, nothing really happened to keep it alive and secure. Quoting the QtWebKit release page on Github:
"WARNING: This release is based on old WebKit revision with known unpatched vulnerabilities. Please use it carefully and avoid visiting untrusted websites and using it for transmission of sensitive data."
It's time to drop it from openSUSE Tumbleweed.
The good news, most QtWebKit remaining users were just caused by obsolete 'BuildRequires'. Most were cleaned during the week end.
Pending SRs: - FreeCAD (SR#902666 replaces the dependency) - qgis (SR#903291 disables the optional dependency) - owncloud-client (it needs an unrelated code fix) - notepadqq (SR#903352 replaces the old version with a git snapshot)
Packages that could use snapshots: - quiterss The upstream website looks down. There are 2 github repo (QuiteRSS/quiterss2 and QuiteRSS/quiterss). Both don't have hard dependency on QtWebKit. - leechcraft Last release in 2014. We're already using snapshots. QtWebKit looks optional.
The less good news, a couple packages also have to be dropped.
KDE packages that will be dropped: - trojita (no activity upstream) - kwebkitpart - kdewebkit
Packages with no upstream activity and/or no alternative port: - wkhtmltopdf which is a dependency for python-hide-code and python-pdfkit - swift-im - smtube - goldendict
Openshot-qt is ported definitively to QtWebEngine? Thanks, Juan -- USA LINUX OPENSUSE QUE ES SOFTWARE LIBRE, NO NECESITAS PIRATEAR NADA Y NI TE VAS A PREOCUPAR MAS POR LOS VIRUS Y SPYWARES: http://www.opensuse.org/es/ Puedes visitar mi blog en: http://jerbes.blogspot.com.ar/
participants (12)
-
Adam Majer -
Andreas Schwab -
Ben Greiner -
Christophe Giboudeaux -
Cor Blom -
Dmitriy Perlow -
Hans-Peter Jansen -
Jan Engelhardt -
John Paul Adrian Glaubitz -
Juan Erbes -
Matěj Cepl -
opensuse.lietuviu.kalba