webkitgtk+-2.4.10

[Pierre Labastie]

Reported by Fernando de Oliveira: ​http://lists.linuxfromscratch.org/pipermail/blfs-book/2016-March/059521.html

​https://lists.webkit.org/pipermail/webkit-gtk/2016-March/002656.html

http://webkitgtk.org/releases/webkitgtk-2.4.10.tar.xz (9.4MB)
   md5sum: 1b3f18d4087dfc648e8060c14e16e202
   sha256sum:
33fda4b20d7fec2d6e9399ba03ef3f6d2a733c628bd77d397880c44e4bf7c614

This is a bug fix release in the stable 2.4 series.

What's new in the WebKitGTK+ 2.4.10 release?
============================================

  - Fix rendering of form controls and scrollbars with GTK+ >= 3.19
  - Fix crashes on PPC64.
  - Fix the build on powerpc 32 bits.
  - Add ARM64 build support.
  - Translation updates: German, Spanish, French, Italian, Korean,
Brazilian Portuguese, Russian,
    Chinese.
  - Security fixes: CVE-2015-1120, CVE-2015-1076, CVE-2015-1071,
CVE-2015-1081, CVE-2015-1122,
    CVE-2015-1155, CVE-2014-1748, CVE-2015-3752, CVE-2015-5809,
CVE-2015-5928, CVE-2015-3749,
    CVE-2015-3659, CVE-2015-3748, CVE-2015-3743, CVE-2015-3731,
CVE-2015-3745, CVE-2015-5822,
    CVE-2015-3658, CVE-2015-3741, CVE-2015-3727, CVE-2015-5801,
CVE-2015-5788, CVE-2015-3747,
    CVE-2015-5794, CVE-2015-1127, CVE-2015-1153, CVE-2015-1083.

[Pierre Labastie]

Never took WebkitGTK+ before (or I have forgotten, which is the same). Will try.

[Pierre Labastie]

According to ​this blogpost, webkitgtk+-2.4 should not be used for web browsing. I think I've found that Midori can use the webkit2gtk-4.0 API (that is webkitgtk+-2.10.8) by passing -DHALF_BRO_INCOMP_WEBKIT2=ON, but the name of the switch looks scarry! On the other hand, browsing the web with insecure browsers is scarry too... Anyway, I'll test midori with this switch, and report here.

[Fernando de Oliveira]

Used

cmake -DCMAKE_INSTALL_PREFIX=/usr                    \
      -DCMAKE_BUILD_TYPE=Release                     \
      -DCMAKE_INSTALL_DOCDIR=/usr/share/doc/$PACKAGE \
      -DUSE_ZEITGEIST=OFF                            \
      -DHALF_BRO_INCOM_WEBKIT2=ON                    \
      -DUSE_GTK3=1 ..

webkit files open by midori:

$ sudo lsof -c midori 2>/dev/null | grep -i webkit
midori  27861 fernando  mem       REG               8,27  46696608   1239317 /usr/lib/libwebkit2gtk-4.0.so.37.11.11
midori  27861 fernando  mem       REG               8,27     51577   1239331 /usr/share/locale/pt_BR/LC_MESSAGES/WebKit2GTK-4.0.mo
midori  27861 fernando  mem       REG               8,27     26642   1239358 /usr/share/locale/pt/LC_MESSAGES/WebKit2GTK-4.0.mo
midori  27861 fernando   15u      REG               8,19      3072    557449 /home/fernando/.local/share/webkitgtk/localstorage/StorageTracker.db
midori  27861 fernando   20u      REG               8,19     69632     47008 /home/fernando/.local/share/webkit/icondatabase/WebpageIcons.db
midori  27861 fernando   74u      REG               8,19      3072    579036 /home/fernando/.local/share/webkitgtk/localstorage/http_www.mysql-apache-php.com_0.localstorage
midori  27861 fernando   75u      REG               8,19      3072    579069 /home/fernando/.local/share/webkitgtk/localstorage/https_www.hivelocity.net_0.localstorage

From the log:

$ xzgrep -i webkit /logs/midori-0.5.11-2016.03.16-20h57m58s.log.xz
-- Checking for modules 'gtk+-2.0>=2.24.0;webkit-1.0>=1.8.1;javascriptcoregtk-1.0'
--   Found webkit-1.0, version 2.4.10
HALF_BRO_INCOM_WEBKIT2:BOOL=OFF
-- Checking for modules 'gtk+-3.0>=3.10.0;webkit2gtk-4.0>=2.3.91'
--   Found webkit2gtk-4.0, version 2.10.8

first three lines are from inside build dir, using

cmake .. -LH | tee ../configure-$PACKAGE

thus, the default values. I was not finding them, because was incorrectly using the build one above, adding only -LH.

Then I remove the build dir, start counting time, create new buils, move there, so the two last lines are the good ones for the build.

It is working perfectly.

Accepting this one, the GIMP is the last one missing, but I will waitfor you to search if there is anything in that direction.

Remember, LFS-7.8.

[Pierre Labastie]

Thanks and very good findings, Fernando. I just have to test on LFS-7.9. For GIMP, it is alluded to in the blogpost above: I guess the dependency to webkitgtk-2.4 will remain. But it is used for the help system, not for browsing, so the security is less a concern...

[Pierre Labastie]

Tried Midori with first webkitGTK+-2.4, and then WebkitGGTK+2.10 (just adding the -DHALF_BRO_INCOM_WEBKIT2=ON switch). I had regular crashes with the first one, and no crashes with the second. I am not sure I test everything, though. For example, I am unable to get sound with any version...

[Pierre Labastie]

Well, I finally managed to listen to .wav sounds by associating aplay to this file type. So it is not the browser.

I am not very good with multimedia...

[Fernando de Oliveira]

Compiled against webkitgtk-2.10.8.

I used

​big_buck_bunny

[BLFS] ​Video problems

Tested also with YouTube video.

Will attach

Without problems.

After install, I used:

    update-desktop-database -q &&
    gtk-update-icon-cache -f -q -t /usr/share/icons/hicolor &&
    update-mime-database /usr/share/mime

Will attach complete lsof result.

[Fernando de Oliveira]

sudo lsof -c midori 2>/dev/null

[Pierre Labastie]

Thanks Fernando. Problem was: I was unable to play the video with parole. It took me a while to understand thatI had to reinstall gst-plugins-bad with support faad2, and to install gst-libav... Now the video plays with parole, and inside midori too.

So I'm closing this ticket now. I'll open another one for changing midori instructions.

Also, I'll mail to -dev to ask about adding some comments to the "parole" page.

Fixed at r17133