Opened 4 years ago

Last modified 11 months ago

#52408 reopened defect

Update claws-mail to use webkit2-gtk

Reported by: jeremyhu (Jeremy Huddleston Sequoia) Owned by: pmetzger (Perry E. Metzger)
Priority: Normal Milestone:
Component: ports Version: 2.3.4
Keywords: Cc:
Port: claws-mail

Description

Please update claws-mail to use webkit2-gtk rather than webkit-gtk.

The older version of webkit-gtk hasn't been supported upstream for quite some time and is full of vulnerabilities.

See #52398

Attachments (1)

claws-mail.patch (1010 bytes) - added by pmetzger (Perry E. Metzger) 4 years ago.
Patch to upgrade the Portfile

Download all attachments as: .zip

Change History (12)

comment:1 Changed 4 years ago by pmetzger (Perry E. Metzger)

Do you have a patch in mind? If not, I'll try to look at it soon.

Changed 4 years ago by pmetzger (Perry E. Metzger)

Attachment: claws-mail.patch added

Patch to upgrade the Portfile

comment:2 Changed 4 years ago by pmetzger (Perry E. Metzger)

Never mind, I did the most obvious possible fix to the Portfile and it worked. Please see the attached "claws-mail.patch". If someone will upgrade the Portfile we're done.

comment:3 Changed 4 years ago by jeremyhu (Jeremy Huddleston Sequoia)

That change looks quite scary to me.

What in the claws-mail build system determines to use webkit2-gtk or webkit-gtk if both are installed? Was the port just broken before this change and now this fixes an implicit dependency bug?

comment:4 Changed 4 years ago by pmetzger (Perry E. Metzger)

I have no idea. The Portfile hack in question wasn't mine to begin with.

comment:5 Changed 4 years ago by pmetzger (Perry E. Metzger)

In fact, an otool -L of /opt/local/lib/claws-mail/plugins/fancy.so indicates it doesn't work correctly. :(

Ah well. It was all too easy I suppose.

The builds of the plugin subsystem have always been a bit scary to me I have to say.

comment:6 Changed 3 years ago by mf2k (Frank Schima)

Resolution: fixed
Status: newclosed

In bad58eb36a8159c470664ba0d940df730fa464bf/macports-ports:

claws-mail: Require webkit2-gtk. Possible fix for older OSes.

Closes: #52408

comment:7 Changed 3 years ago by mf2k (Frank Schima)

comment:8 Changed 18 months ago by dbevans (David B. Evans)

Resolution: fixed
Status: closedreopened

I'm reopening this ticket as claws-mail still doesn't support the webkitgtk-4.0 API provided by webkit2-gtk and, therefore, just changing the dependency from webkit-gtk to webkit2-gtk is ineffective in resolving this problem. Truly fixing the problem would require porting claws-mail from gtk2 to gtk3 and adopting the webkit2-gtk API. Both changes are non-trivial and although there has been some discussion upstream over the years, it appears nothing has come of it to date. I don't think using our own patch for this is a good idea unless it is accepted upstream.

See https://lists.claws-mail.org/pipermail/users/2018-January/020575.html for last mention upstream that I know of but there may be some continuing work that I don't know of.

Currently, claws-mail opportunistically builds the fancy plugin only if the old webkit-gtk happens to be installed.

As only claws-mail's fancy plugin requires webkit-gtk, an alternative solution would be to just disable this plugin (to avoid the opportunistic building) and remove the dependency on webkit2-gtk.

See my PR https://github.com/macports/macports-ports/pull/3527

Of course, removing webkit-gtk/webkit-gtk-2.0 from MacPorts would result in the same effect.

I understand that the current maintainer of this port is reticent to remove the fancy plugin, but most other distributions have removed the outdated webgit-gtk/webkit-gtk-2.0 distributions some time ago and I think it is time that we did likewise.

See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=790199 for debian's history on this issue.

Last edited 18 months ago by dbevans (David B. Evans) (previous) (diff)

comment:9 Changed 18 months ago by pmetzger (Perry E. Metzger)

So as I said in the pull request, it appears that there's a functioning but unreleased gtk3 port of the code now. My current thought is to package a development version of claws-mail, disable the fancy plugin in the normal version, enable it in the development version. I am actively looking at this.

comment:10 Changed 18 months ago by dbevans (David B. Evans)

Sounds good but I'd suggest going ahead with disabling the plugin in the current port to make it clear that (most times) the port builds with fancy disabled unless the undeclared dependency webkit-gtk is active. The change would definity improve the repeatability of the build.

comment:11 Changed 11 months ago by dbevans (David B. Evans)

In fcad7a566b7871fb7f1aa5ef9fb2bb8300271a93/macports-ports (master):

claws-mail: update to version 3.17.4, configuration, dependencies

This PR can be seen as a temporary (hopefully more palatible) alternative to previous PR3527 that
completely disabled building of the fancy plugin due to the dependency on deprecated webkit-gtk.

By default, this new PR disables plugins fancy and new litehtml_viewer (which requires Google's
libgumbo not yet ported to MacPorts). The improper dependency on webkit2-gtk has been removed
and a +fancy variant is added which correctly adds the dependency on webkit-gtk and enables the
build of the fancy plugin. This eliminates the previously reported behavior of opportunisticaly building
the fancy plugin if webgit-gtk happened to be installed and requires the user to make a conscious decision
to build the plugin.

Note that progress is being made (slowly) on the upstream gtk3 branch which not only updates claws-mail to gtk3
but ports the fancy plugin to webkit2-gtk3.

See #52408
See https://github.com/macports/macports-ports/pull/3527

Note: See TracTickets for help on using tickets.