Update to 3.16

Required for gnome-control-center 3.16 (bug 1466245)

This bug was fixed in the package gnome-online-accounts - 3.16.3-1

---------------
gnome-online-accounts (3.16.3-1) unstable; urgency=medium

  * New upstream release.
  * Add Upstream-Name and Upstream-Contact to debian/copyright.

 -- Michael Biebl <email address hidden> Mon, 15 Jun 2015 20:31:35 +0200

gnome-online-accounts (3.16.2-1) unstable; urgency=medium

  * New upstream release.
  * Update Build-Depends, switch to Webkit2.
  * Enable Foursquare provider.
  * Install typelib files into multiarch paths.
  * Mark gir and dev packages as Multi-Arch: same.
  * Bump debhelper compatibility level to 9.
  * Install new web-extension component.
  * Update symbols files. Due to the removal of the Yahoo provider, the
    goa_yahoo_provider_get_type symbol was dropped from libgoa-backend-1.0-1.

 -- Michael Biebl <email address hidden> Tue, 02 Jun 2015 07:01:35 +0200

This is stuck in proposed due to the webkit2gtk-4.0 dependency. Bug 1469221 is tracking this transition, but there is quite some porting to be done.

Laney suggested it might be possible to move webkit3get-4.0 into main for building purposes only and demote the resulting binary packages (gnome-online-accounts and libgoa-backend-1.0-0) to universe.

However gnome-control-center requires libgoa-backend-1.0-0. g-c-c is only in main due to the shared data package, so in theory could be demoted to universe also if the shared data package moved into u-c-c

easier option seems to be keep g-c-c source in main, but demote all binary packges except the shared one. are the MIR team ok with this?

Jamie, can you comment on this from a MIR/security POV? I don't think we can simply demote the non-shared-binaries because most of them are depended on by at least something:

libgnome-control-center-dev <= deja-dup build-dep
libgnome-control-center1 <= deja-dup dep
gnome-control-center-dev <= compiz build-dep

But Jamie, maybe you can speak to the webkit stuff.

mterry, I have actaully been meaning to drop support for external panels from gnome-control-center, since deja-dup is the only remaining panel that uses it, and the patches we have in g-c-c to allow that are a pain to maintain. I'll sift through the patches over the weekend and then the g-c-c panel in dejadup can be disabaled at build time.

Seb is going to look at moving the compiz dep into u-c-c.

That should leave the only shared package being gnome-control-center-shared-data

and that first means that libgnome-control-center1/-dev will go away completely.

Dropping webkit dependencies is an important goal because we cannot current provide proper maintenance for webkit. It sounds like Tim is working on a solution which will obviate the need for g-c-c parts that need to be in main to depend on webkit, which is fantastic.

The g-c-c changes are ready and included in the branch in bug 1466245. deja-dup has been uploaded, which just leaves compiz, that should just be able to change the build-dep to unity-control-center-dev.

What action is needed from the MIR team here?

promote webkit2gtk (source only for the time being) to main

But in comment 8, Jamie says "It sounds like Tim is working on a solution which will obviate the need for g-c-c parts that need to be in main to depend on webkit, which is fantastic."

Which made me think we didn't need webkit2gtk in main.

I guess I read it now as no binary bits in main. But you still want the source in main for building the universe binaries.

Jamie, how OK is webkit2gtk in main as source-only?

mterry, yes that is correct.

gnome-online-accounts needs to stay in main, but the binaries that depend on webkit2gtk do not as they are only seeded in ubuntu-gnome.

gnome-control-center also needs to stay in main, since gnome-control-center-shared-data is used by unity-control-center, the remainder of the binaries can be demoted. compiz should build-dep on unity-control-center-dev instead, I will prepare a fix for that.

Having the binaries that depend on webkit2gtk be in universe with webkitgtk2 source only in main is fine (so long as later we don't allow its binaries to be promoted-- note the MainINclusionRequests page has this to say "New binary packages from existing source packages, where the source package is already in main, do not require reports"), so we probably need to refine that language.

I don't understand how source only promotion is going to fix the issue. Aren't the packages that use webkitgtk2 going to pull the -dev and the corresponding lib* packages from webkitgtk2 in during the build, and therefore those webkitgtk2 packages also need to be in main? (Did I miss a change to the archive on this point?)

yes your probably right, the webkit2gtk binaries would need to be in main for building purposes, but the binaries that built against those could be demoted to universe. Maybe that becomes too confusing? but not sure what else can be done, its incredibly unlikely that a full webkit2gtk transition can happen this cycle.

It would be confusing because people will think they are supported when they are not, which is no different than the current situation with the existing webkit (which we must not carry forward).

Ultimately (and I've said this before-- indeed it is part of the MIR team review process), I think Gnome should move to a supportable webengine. Oxide is designed specifically for this: the chromium content api updates for security, performance and web compatibility but the APIs exposed to apps remain stable. Oxide is designed to have an arbitrary number of bindings, and gtk bindings would be most welcome and benefit everyone. Perhaps webkitgtk APIs can map to oxide in ways to minimize transition pain, perhaps not. If this is something people are interested in (and I hope they are! :), please participate on the mailing list at https://launchpad.net/~oxide-developers.

Of course, this doesn't help for 15.10. I see only a few options currently:
 1. don't update to 3.16
 2. update to 3.16 but don't build the parts that need webkit so it can stay in main
 3. update to 3.16 but demote to main
 4. do a combination of 3 and 4: have 2 source packages, one that is in main but doesn't build with webkit and one that is in universe that does

Any of the above will satisfy/obviate this MIR from a security team standpoint, so unsubscribing us for now. Please feel free to resubscribe as needed.

"3. update to 3.16 but demote to main"

Obviously I mean, "3. update to 3.16 but demote to universe"

gnome-online-accounts is tangled up in many packages in main, and while it might be possible to split out the bits that require webkit2 into another source package and build those in universe, that seems like a horribly messy idea.

So I guess the only way forward is to revert patches in g-c-c that need the new g-o-a.

How about another angle, we drop the ancient webkit2gtk build from webkitgtk source (since both are built from the same source package, but are essentially independent builds) and add webkit2gtk to main (which doesnt include webkit1 at all)? thats gotta be better than the current situation, and the transition from webkit2gtk-3.0 to -4.0 should be easy. Sure you end up with two copies of webkit2gtk source, but only one set of binaries!

This bug was fixed in the package gnome-online-accounts - 3.18.2.1-1ubuntu1

---------------
gnome-online-accounts (3.18.2.1-1ubuntu1) xenial; urgency=medium

  * debian/patches/0001-Revert-back-to-webkit1.patch: Revert back to webkit1;
    we don't have a sufficient version of webkit2 in main. :(
  * 3.18 update (LP: #1466290)

gnome-online-accounts (3.18.2.1-1) unstable; urgency=medium

  * New upstream release which includes the fix for the missing
    org.gnome.Identity.service.in file.

gnome-online-accounts (3.18.2-1) unstable; urgency=medium

  * New upstream release.
  * Add data/org.gnome.Identity.service.in file which is missing from the dist
    tarball.

gnome-online-accounts (3.18.1-1) unstable; urgency=medium

  * New upstream release.
  * Update debian/libgoa-backend-1.0-1.symbols with one new addition.

gnome-online-accounts (3.18.0-1) unstable; urgency=medium

  * New upstream release.

gnome-online-accounts (3.17.92-1) experimental; urgency=medium

  * New upstream release candidate.
  * Update debian/libgoa-1.0-0b.symbols with new additions.
  * Update debian/libgoa-backend-1.0-1.symbols with one new addition.
  * Ship new goa-identity-service files in gnome-online-accounts pkg.

gnome-online-accounts (3.16.4-1) unstable; urgency=medium

  * New upstream release.

gnome-online-accounts (3.16.3-1) unstable; urgency=medium

  * New upstream release.
  * Add Upstream-Name and Upstream-Contact to debian/copyright.

gnome-online-accounts (3.16.2-1) unstable; urgency=medium

  * New upstream release.
  * Update Build-Depends, switch to Webkit2.
  * Enable Foursquare provider.
  * Install typelib files into multiarch paths.
  * Mark gir and dev packages as Multi-Arch: same.
  * Bump debhelper compatibility level to 9.
  * Install new web-extension component.
  * Update symbols files. Due to the removal of the Yahoo provider, the
    goa_yahoo_provider_get_type symbol was dropped from libgoa-backend-1.0-1.

 -- Iain Lane <email address hidden> Mon, 23 Nov 2015 19:44:19 +0000