[MIR] chrome-gnome-shell

[Jeremy Bícha]

Availability
============
Co-maintained with Debian GNOME. arch:all package

Rationale
=========
Users of gnome-shell expect that they will be able to install (and uninstall, enable, disable, and configure) GNOME Shell extensions by visiting https://extensions.gnome.org/ in their web browser. It is a usability problem for users to have to install chrome-gnome-shell from the command line for that feature to work.

gnome-shell in Ubuntu 16.04 - 17.04 recommends chrome-gnome-shell.

Workaround: It is possible to install and uninstall extensions in GNOME Software in Ubuntu 17.04+. It is possible to enable and disable extensions; uninstall extensions; and configure any extension preferences in gnome-tweak-tool (not currently installed by default in Ubuntu 17.10 but it was always installed by default by Ubuntu GNOME).

Security
========
No known security issues

https://security-tracker.debian.org/tracker/source-package/chrome-gnome-shell
https://launchpad.net/chrome-gnome-shell/+cve

Quality assurance
=================
- Please subscribe Ubuntu Desktop Bugs to this package.

https://bugs.launchpad.net/ubuntu/+source/chrome-gnome-shell
https://bugs.debian.org/cgi-bin/pkgreport.cgi?src=chrome-gnome-shell
https://bugzilla.gnome.org/buglist.cgi?quicksearch=product%3A%20chrome-gnome-shell
https://github.com/nE0sIghT/chrome-gnome-shell-mirror/issues/

Dependencies
============
All runtime dependencies are in main
Supports both python2 and python3 but Ubuntu's packages uses just python3

Standards compliance
====================
4.1.3, dh compat 11, dh7-style simple rules

Maintenance
===========
- Actively developed upstream
https://git.gnome.org/browse/chrome-gnome-shell/log

- Debian packaging:
https://salsa.debian.org/gnome-team/chrome-gnome-shell

And here's the source code for the extensions.gnome.org website:
https://git.gnome.org/browse/extensions-web

Background Info
===============
Before Firefox 52, extensions.gnome.org used to work out-of-the-box with GNOME Shell because GNOME Shell provides a NPAPI plugin (Firefox no longer supports those plugin). The NPAPI plugin is still included in GNOME Shell for Epiphany's benefit since Epiphany has no support for WebExtensions.

The package name is because this package originally provided support for the Chrome browser, but now other browsers have adopted the WebExtensions API pioneered by Chrome.

Other Info
==========
chrome-gnome-shell has two parts, a system helper that's provided in this Ubuntu package and a WebExtension.

There is a banner when you first visit the site with a button to install the required WebExtension. The browser does not need to be restarted but the page needs to be refreshed.

It looks like chrome-gnome-shell has a background service that starts when you first start your browser. The service continues to run even after closing the browser.

https://wiki.gnome.org/Projects/GnomeShellIntegrationForChrome
https://addons.mozilla.org/firefox/addon/gnome-shell-integration/
https://chrome.google.com/webstore/detail/gnome-shell-integration/gphhapmejobijbbhgpjhcjognlahblep

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Mathieu Trudel-Lapierre (cyphermox)]

This isn't the first MIR request for chrome-gnome-shell is it?

Seems like I saw another MIR for this before, and it had not been accepted for some reason, opting to drop the dependency or something?

[Mathieu Trudel-Lapierre (cyphermox)]

I think I'm mixing it up with some other package with a similar name; I will review this.

[Mathieu Trudel-Lapierre (cyphermox)]

- chrome-gnome-shell is missing a team subscriber. Listing it in the MIR bug is not sufficient, we should see the subscription in place as a testament to a team signing up to support the package.

The package is otherwise fine to MIR.

[Sebastien Bacher (seb128)]

@Mathieu, that's probably something we want to ask the security team about as well, to know how they feel about the feature? The team subscription process is a bit backward, we subscribe currently before knowing if the MIR is going to be validated, would make more sense to subscribe between the "ack" and the promotion

[Mathieu Trudel-Lapierre (cyphermox)]

Regardless of whether the MIR is approved, if you want the package in main you care about its bugs, you should be signed up for it. This serves as a kind of "gate" too, so that random people can't sign you up for supporting something since only the desktop team can subscribe itself to a source package.

I had another look, let's indeed have this reviewed by the Security Team.

[Seth Arnold (seth-arnold)]

Hello,

Security team NAK for promoting chrome-gnome-shell to main.

We strongly believe this behavior, if desired, should be opt-in on the part of local administrators.

There are other concerns, such as:
- https://bugzil.la/1349874
- "The service continues to run even after closing the browser."
- an LTS release seems like the wrong time to introduce a new dependency upon an externally-controlled web service
- browser updates are one of the most important services we provide, and blocking web browser updates on correct functioning of an extension is not an option.

Thanks

[Mathieu Trudel-Lapierre (cyphermox)]

Marking incomplete so it still shows in my list, but is more clearly already looked at and NAKed by Security.

[Sebastien Bacher (seb128)]

Wouldn't "wontfix" be the correst status there? The desktop team is fine with the security team position and not providing that feature by default

[Launchpad Janitor (janitor)]

[Expired for chrome-gnome-shell (Ubuntu) because there has been no activity for 60 days.]