Activity log for bug #1689317

Date Who What changed Old value New value Message
2017-05-08 14:51:56 Jeremy Bícha bug added bug
2017-05-08 14:52:23 Jeremy Bícha bug added subscriber MIR approval team
2017-05-08 14:55:40 Jeremy Bícha description Availability ============ Co-maintained with Debian GNOME. Built for all supported architectures. Changes from Debian: - Update to 3.24 - 07_bookmarks.patch: Add Ubuntu default bookmarks (as seen in Firefox) - add_new_window_action.patch: Backported from 3.25, improves Unity integration a bit - ubuntu_titlebars.patch: headerbar revert when run in Unity 7 Rationale ========= Needed for Ubuntu to have a proper webapp feature, particularly for Amazon in the default install (LP: #1688627) The alternatives are to either 1) ship Chromium, or 2) water down the webapp feature to just be basically a bookmark which would have poor desktop integration and wouldn't really be a webapp at all, 3) or drop the webapp feature from the default install Security ======== The most recent fixed security bug is LP: #1661805 (fixed in 16.04 LTS and up) https://security-tracker.debian.org/tracker/source-package/epiphany-browser https://launchpad.net/epiphany-browser/+cve epiphany-browser is far smaller than either Firefox or Chromium since most of its browser functionality (and security vulnerability) is provided by webkit2gtk. epiphany does not support HSTS https://bugzilla.gnome.org/628298 New in epiphany 3.24 is off-by-default support for integrated HTTPS Everywhere using libhttpseverywhere (not yet packaged in Debian/Ubuntu) https://git.gnome.org/browse/libhttpseverywhere Epiphany currently has no support for webextensions. NPAPI plugins are still supported. Quality assurance ================= The Desktop Bugs and Desktop Packages teams are already subscribed. https://bugs.launchpad.net/ubuntu/+source/epiphany-browser https://bugs.debian.org/cgi-bin/pkgreport.cgi?src=epiphany-browser https://bugzilla.gnome.org/buglist.cgi?quicksearch=product%3A"epiphany" No autopkgtest. Tests aren't being run because of https://bugzilla.gnome.org/782246 Once that's fixed, we'll be sure to make failed tests fail the build. Dependencies ============ There are 2 binary universe dependencies, browser-plugin-evince (for integrated PDF viewing) and libwebkit2gtk-4.0-37-gtk2 (for Flash support, but see LP: #1689313). Both of those already have their sources in main and neither is required for basic webapps. Standards compliance ==================== 3.9.8 Maintenance =========== - Actively developed upstream (the primary developer is paid to work on webkitgtk) https://git.gnome.org/browse/epiphany-browser dh7-style short rules, compat level 10 3.25.1 uses meson for building instead of autotools. Debian packaging uses svn, but we're hoping to convert to git this year (which will allow for Ubuntu branches): https://sources.debian.net/src/epiphany-browser/unstable/debian/ Background information ====================== The intent here is to split epiphany-browser into 2 packages. The existing package would only contain the .desktop and appstream metadata and depend on the other package (provisionally named epiphany-browser-runtime) which would contain /usr/bin/epiphany-browser and the rest of the app. This is what Fedora does so that they can continue to have only one browser in the default install (Firefox) but still support webapps. Therefore, only epiphany-browser-runtime and epiphany-browser-data would be in main; the other epiphany-browser package would remain in universe. I intend to upload this split version to Ubuntu but I want to see if I can get feedback from Debian about the proposed package name and split first. Availability ============ Co-maintained with Debian GNOME. Built for all supported architectures. Changes from Debian: - Update to 3.24 - 07_bookmarks.patch: Add Ubuntu default bookmarks (as seen in Firefox) - add_new_window_action.patch: Backported from 3.25, improves Unity integration a bit - ubuntu_titlebars.patch: headerbar revert when run in Unity 7 Rationale ========= Needed for Ubuntu to have a proper webapp feature, particularly for Amazon in the default install (LP: #1688627) The alternatives are to either 1) ship Chromium, or 2) water down the webapp feature to just be basically a bookmark which would have poor desktop integration and wouldn't really be a webapp at all, 3) or drop the webapp feature from the default install Security ======== The most recent fixed security bug is LP: #1661805 (fixed in 16.04 LTS and up) https://security-tracker.debian.org/tracker/source-package/epiphany-browser https://launchpad.net/epiphany-browser/+cve epiphany-browser is far smaller than either Firefox or Chromium since most of its browser functionality (and security vulnerability) is provided by webkit2gtk. epiphany does not support HSTS https://bugzilla.gnome.org/628298 New in epiphany 3.24 is off-by-default support for integrated HTTPS Everywhere using libhttpseverywhere (not yet packaged in Debian/Ubuntu) https://git.gnome.org/browse/libhttpseverywhere Epiphany currently has no support for webextensions. NPAPI plugins are still supported. Quality assurance ================= The Desktop Bugs and Desktop Packages teams are already subscribed. https://bugs.launchpad.net/ubuntu/+source/epiphany-browser https://bugs.debian.org/cgi-bin/pkgreport.cgi?src=epiphany-browser https://bugzilla.gnome.org/buglist.cgi?quicksearch=product%3A"epiphany" No autopkgtest. Tests aren't being run because of https://bugzilla.gnome.org/782246 Once that's fixed, we'll be sure to make failed tests fail the build. Dependencies ============ There are 2 binary universe dependencies, browser-plugin-evince (for integrated PDF viewing) and libwebkit2gtk-4.0-37-gtk2 (for Flash support, but see LP: #1689313). Both of those already have their sources in main and neither is required for basic webapps. Standards compliance ==================== 3.9.8 Maintenance =========== - Actively developed upstream (the primary developer is paid to work on webkitgtk) https://git.gnome.org/browse/epiphany-browser dh7-style short rules, compat level 10 3.25.1 uses meson for building instead of autotools. Debian packaging uses svn, but we're hoping to convert to git this year (which will allow for Ubuntu branches): https://sources.debian.net/src/epiphany-browser/unstable/debian/ Background information ====================== The intent here is to split epiphany-browser into 2 packages. The existing package would only contain the .desktop and appstream metadata and depend on the other package (provisionally named epiphany-browser-runtime) which would contain /usr/bin/epiphany-browser and the rest of the app. This is what Fedora does so that they can continue to have only one browser in the default install (Firefox) but still support webapps. Therefore, only epiphany-browser-runtime and epiphany-browser-data would be in main; the other epiphany-browser package would remain in universe. I intend to upload this split version to Ubuntu but I want to see if I can get feedback from Debian about the proposed package name and split first. epiphany was in main until Ubuntu 9.10 "Karmic" (no MIR).
2017-05-31 18:48:53 Mathieu Trudel-Lapierre epiphany-browser (Ubuntu): assignee Ubuntu Security Team (ubuntu-security)
2017-06-29 00:10:37 Emily Ratliff epiphany-browser (Ubuntu): assignee Ubuntu Security Team (ubuntu-security) Mathieu Trudel-Lapierre (cyphermox)
2017-07-12 20:52:26 Mathieu Trudel-Lapierre epiphany-browser (Ubuntu): status New Incomplete
2017-07-12 20:52:28 Mathieu Trudel-Lapierre epiphany-browser (Ubuntu): assignee Mathieu Trudel-Lapierre (cyphermox)
2017-07-12 21:36:57 Jeremy Bícha removed subscriber MIR approval team
2017-09-11 04:17:44 Launchpad Janitor epiphany-browser (Ubuntu): status Incomplete Expired