Bug 1703864

Created attachment 1559718 [details]
builder-live.log of wxMaxima

compat-wxGTK3-gtk2 needs to be rebuilt due to removal of webkitgtk


Description of problem:
I was unable to build any application that is using compat-wxGTK3-gtk2.


Version-Release number of selected component (if applicable):
RHEL 7.6
CentOS 7.6 (COPR)


How reproducible:
Always


Steps to Reproduce:
Try to rebuild wxMaxima for EL7 using compat-wxGTK3-gtk2.
https://copr-be.cloud.fedoraproject.org/results/scx/wxMaxima/epel-7-x86_64/00890873-wxMaxima/wxMaxima-19.04.3-2.el7.src.rpm
This should apply as well to any program that uses compat-wxGTK3-gtk2.


Actual results:
http://web.archive.org/web/20190427143910/https://copr-be.cloud.fedoraproject.org/results/scx/wxMaxima/epel-7-x86_64/00890873-wxMaxima/builder-live.log
Especially this part:
https://pastebin.com/Di9jWDWz
/usr/bin/ld: warning: libwebkitgtk-1.0.so.0, needed by /usr/lib/gcc/x86_64-redhat-linux/4.8.5/../../../../lib64/libwx_gtk2u_webview-3.0-gtk2.so, not found (try using -rpath or -rpath-link)


Expected results:
Build successful, just like on Fedora.
https://copr.fedorainfracloud.org/coprs/scx/wxMaxima/build/890873/


Additional info:
The WebKitGtk+ (the webkitgtk and webkitgtk3 packages) was remove from EL and Fedora due to security reasons.
https://blogs.gnome.org/mcatanzaro/2016/02/01/on-webkit-security-updates/
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/AKVB363GFCHHJ5MTHGVYHYT6NLLTF5VM/


Possible solutions:
0. Use the unsupported webkitgtk package from Nux dextop repository.

https://centos.pkgs.org/7/nux-dextop-x86_64/webkitgtk-2.4.9-3.el7.nux.x86_64.rpm.html
However, this will not change the fact that the current setup for EPEL is just broken.


1. Re-add the webkitgtk package.

Some distributions (e.g. Debian) allows to use unsupported browser engines.
https://www.debian.org/releases/stable/amd64/release-notes/ch-information.en.html#browser-security
Debian 9 includes several browser engines which are affected by a steady stream of security vulnerabilities. The high rate of vulnerabilities and partial lack of upstream support in the form of long term branches make it very difficult to support these browsers with backported security fixes. Additionally, library interdependencies make it impossible to update to newer upstream releases. Therefore, browsers built upon the webkit, qtwebkit and khtml engines are included in stretch, but not covered by security support. These browsers should not be used against untrusted websites.

However, Fedora has already decided to remove the webkitgtk, so it would be very unlikely to re-add this again.


2. Rebuild compat-wxGTK3-gtk2 without webkitgtk.

Here is my proposed packaged based on compat-wxGTK3-gtk2-3.0.2-32.fc27 with fixes for EL6-EL7 and Fedora >= 28.
https://copr.fedorainfracloud.org/coprs/scx/compat-wxGTK3-gtk2/


3. Adapt the wxGTK3 package from Fedora. The compat-wxGTK3-gtk2 was merged into it some time ago.

Here is my proposed packaged based on wxGTK3-3.0.4-8.fc30 with fixes for EL6-EL7.
https://copr.fedorainfracloud.org/coprs/scx/wxGTK3/

Advantages:
- Works on EL6-EL7 as well as on Fedora 28-30 and Rawhide. Just one source package for all distributions should help to maintain it.
- Don't duplicate wxBase3 (non-GUI support classes from the wxWidgets library, e.g. libwx_baseu*.so.*).
- Can use SDL2 instead of SDL and gstreamer 1.0 instead of gstreamer 0.10.
- A lot of bug fixes.

Disadvantages:
- Due to the update from wxWidgets 3.0.2 to 3.0.4, it may require to rebuild current wxGTK3/compat-wxGTK3-gtk2 applications.


Please keep in mind that a lot of wxWidgets 3.0/3.1 applications may use gtk+3 backend instead of rely on gtk+2. However, there are still some minor bugs in gtk+3 version (wxGTK3) that cause incorrect behavior of some widgets. That is why in my opinion user should choose between Gtk+2 (perfect UI) and Gtk+3 (support for HiDPI and Portals).
The affected applications are:
- Aegisub
- Veracrypt
- wxMaxima

We can not pretend that the problem does not exist. These minor UI issues are real.

Example screenshots:
Gtk+2: https://i.imgur.com/no0cXt0.png
Gtk+3: https://i.imgur.com/RuJPR9x.png