Remove qtwebkit from touch image

[Pat McGowan]

The argument to remove this is based on the following:

The qtwebkit webview is deprecated for our sdk and we will not be supporting it long term
We are supporting an Oxide/Chromium solution for the Ubuntu.Webview
This was done largely for security reasons
The qtwebkit package is large and we would like to reduce image and install size
We want to discourage app devs from using this api any longer, the review tools have indicated this for several months

[Pat McGowan (pat-mcgowan)]

The current use by 20 apps in the store:
 - 2 apps that cannot be ported as of today
 - one app that would require a sizeable amount of work
 - one app that would require some work
 - 5 apps that would require minimal changes
 - 11 apps that wouldn’t require any changes (other than the imports)

(9) no specific QtWebKit API used, can be replaced by Ubuntu WebView without any changes:
  com.ubuntu.developer.bobo1993324.udropcabin
  com.ubuntu.developer.carloalberto.randomimagesrel
  com.ubuntu.developer.fabricio.mnmo-counters
  com.ubuntu.developer.hansueli.burri.xkcd-viewer
  com.ubuntu.developer.larochelle.brian.feed-the-aggregator
  com.ubuntu.developer.mlosli.panpipe
  com.ubuntu.developer.mzanetti.getmewheels2
  com.ubuntu.developer.yuntan.aztter
  ir.oneapp.oneperday

(2) actually uses an UbuntuWebView (version 0.1), can be replaced by Ubuntu WebView without any changes
  com.ubuntu.developer.mzanetti.ubuntu-fitbit-app
  com.ubuntu.developer.rschroll.beru

(4) uses WebView.onLoadingChanged, minimal changes needed
  com.nucleussystems.app.freshbookstimer
  com.ubuntu.developer.mitya57.touchwriter
  com.ubuntu.developer.qqworini.aesyweibo
  com.ubuntu.developer.qtros.twimgo

(1) uses onLoadProgressChanged, but can easily be rewritten to avoid that
  fr.skimbo.skimbou

(1) relies on the fact that QtWebKit’s WebView is a flickable, shouldn’t be too hard to port to Ubuntu WebView
  com.ubuntu.developer.brianrobles204.karma-machine

(1) uses lots of QtWebKit experimental APIs (it’s a browser app), sizeable amount of work to migrate to Ubuntu WebView (or more likely a raw Oxide WebView)
  com.ubuntu.developer.penk.slatekit-shell

(2) uses QtWebKit experimental APIs such as urlSchemeDelegates, cannot be replaced by Ubuntu/Oxide WebView as is
  com.ubuntu.developer.dpniel.dekko
  com.ubuntu.developer.zaspire.cordova-mobilespec

[Pat McGowan (pat-mcgowan)]

Bug 1260016 added for an API to allow defining custom URL scheme delegates

[Pat McGowan (pat-mcgowan)]

We need to remove the dependency from the html container, which depends on Oxide 1.3 which supports script injection.

[Pat McGowan (pat-mcgowan)]

We also need to update all webapps using a policy < 1.1
There are 24 such apps in the store

phablet@ubuntu-phablet:/opt/click.ubuntu.com$ grep -A 10 -B 10
ubuntu-webapp */current/*.json | grep policy_version | grep 1.0
com.and.maps/current/app.json-"policy_version": 1.0
com.lastpass.lpubuntu/current/lastpass.json- "policy_version": 1.0

com.ubuntu.developer.adrian-arroyocalle.social-share/current/social-share.json-
"policy_version": 1.0
com.ubuntu.developer.cwayne18.baidu/current/app.json- "policy_version": 1.0
com.ubuntu.developer.cwayne18.renren/current/app.json- "policy_version": 1.0
com.ubuntu.developer.cwayne18.weibo/current/weibo.json-"policy_version": 1.0
com.ubuntu.developer.daker.postrocktues/current/postrocktues.json-
"policy_version": 1.0
com.ubuntu.developer.danielholm.pingpong/current/pingpong.json-
"policy_version": 1.0
com.ubuntu.developer.danielholm.swedbank/current/swedbank.json-
"policy_version": 1.0
com.ubuntu.developer.danielholm.tradera/current/tradera.json-
"policy_version": 1.0
com.ubuntu.developer.geistschatten.social-groovy/current/app.json-"policy_version":
1.0
com.ubuntu.developer.hughisaacs2.acrylicstyle/current/app.json-"policy_version":
1.0
com.ubuntu.developer.nervatura.nervatura-mobile-client/current/nmc.json-"policy_version":
1.0
com.ubuntu.developer.ogra.blueblox-game/current/blueblox-game.json-"policy_version":
1.0
com.ubuntu.developer.ogra.fruity-pops/current/fruity-pops.json-"policy_version":
1.0
com.ubuntu.developer.ogra.pixel-runner/current/pixel-runner.json-"policy_version":
1.0
com.ubuntu.developer.ogra.pumpkin-smasher/current/pumpkin-smasher.json-"policy_version":
1.0
com.ubuntu.developer.ogra.zombie-apocalypse/current/zombie-apocalypse.json-"policy_version":
1.0
com.ubuntu.developer.sangshuduo.wechatunofficial/current/app.json-
"policy_version": 1.0
com.ubuntu.developer.thiebaud2001.01net/current/01net.json-
"policy_version": 1.1
com.ubuntu.developer.victorsemyonov.mymaps/current/app.json-"policy_version":
1.0
net.launchpad.click-webapps.lloyds-bank-uk/current/app.json-
"policy_version": 1.0
net.launchpad.click-webapps.tumblr/current/app.json- "policy_version": 1.0
net.launchpad.click-webapps.xkcd/current/app.json- "policy_version": 1.0

[Pat McGowan (pat-mcgowan)]

The bug to add script injection to oxide for use in the html container is bug #1221996

[Pat McGowan (pat-mcgowan)]

This may not make rtm and isnt critical

[Bill Filler (bfiller)]

opened a webbrowser-app task to track if there is any work needed on the browser or container side to remove this dependency. please mark invalid if not.

[Olivier Tilloy (osomon)]

I installed all 624 apps from the store (as of today) on a Nexus 7 running vivid-proposed (image #42), and grepped through them to get a picture of which still use QtWebKit. Here’s a summary:

 - 15 applications import (and supposedly use) QtWebKit directly:

    com.nucleussystems.app.freshbookstimer
    com.ubuntu.developer.brianrobles204.karma-machine
    com.ubuntu.developer.carloalberto.randomimagesrel
    com.ubuntu.developer.fabricio.mnmo-counters
    com.ubuntu.developer.hansueli.burri.xkcd-viewer
    com.ubuntu.developer.larochelle.brian.feed-the-aggregator
    com.ubuntu.developer.mitya57.touchwriter
    com.ubuntu.developer.mzanetti.getmewheels2
    com.ubuntu.developer.penk.slatekit-shell
    com.ubuntu.developer.qqworini.aesyweibo
    com.ubuntu.developer.qtros.twimgo
    com.ubuntu.developer.yuntan.aztter
    com.ubuntu.developer.zaspire.cordova-mobilespec
    fr.skimbo.skimbou
    ir.oneapp.oneperday

 - 10 applications import (and supposedly use) Ubuntu.Components.Extras.Browser 0.1, i.e. QtWebKit under the hood:

    com.ubuntu.developer.andrewsomething.stackbrowser
    com.ubuntu.developer.daker.bytesjack
    com.ubuntu.developer.daker.x-type
    com.ubuntu.developer.fcole90.feedspot
    com.ubuntu.developer.karthik.upadya1.ifacebook
    com.ubuntu.developer.karthik.upadya1.igplus
    com.ubuntu.developer.karthik.upadya1.imail
    com.ubuntu.developer.mdspencer.project-dashboard
    com.ubuntu.developer.sangshuduo.doubanfmunofficial
    com.wellsb.esv-bible

 - 4 applications import Ubuntu.Components.Extras.Browser 0.2 (i.e. Oxide under the hood), they could use a rename of the import to Ubuntu.Web 0.2:

    com.ubuntu.developer.alaak.uberbag
    com.ubuntu.developer.filip-dobrocky.gagger
    com.ubuntu.developer.karthik.upadya1.wikipediatouch
    com.ubuntu.developer.rschroll.beru

 - 16 applications import Ubuntu.Web 0.2 (i.e. Oxide under the hood), no change needed:

    com.canonical.payui
    com.ubuntu.developer.bobo1993324.pdfjsviewer
    com.ubuntu.developer.mhall119.ureadit
    com.viclog.2048
    com.ubuntu.developer.bobo1993324.udropcabin
    com.ubuntu.developer.danielholm.pingpong
    com.ubuntu.developer.dholbach.randomcats
    com.ubuntu.developer.mdspencer.project-dashboard
    com.ubuntu.developer.mlosli.panpipe
    com.ubuntu.developer.mzanetti.ubuntu-fitbit-app
    com.ubuntu.developer.qtros.yad
    com.ubuntu.developer.rayalez.hackernews
    com.ubuntu.developer.roman2861.zmusic
    com.ubuntu.developer.turan.mahmudov.ufoursquare
    com.viclog.flappybird
    cx.gould.ted.ubuntu-app-startup

 - 12 applications import com.canonical.Oxide, no change needed:

    com.ubuntu.reminders
    com.popey.calculator
    com.popey.sst
    com.ubuntu.developer.danielholm.stumble
    com.ubuntu.developer.dobey.delta-web
    com.ubuntu.developer.dpniel.dekko
    com.ubuntu.developer.mkamenjak77.4chanappextra
    com.ubuntu.developer.mkamenjak77.bluedragonbrowser
    com.ubuntu.developer.mkamenjak77.bugapp
    com.ubuntu.developer.mkamenjak77.googleplusapp
    com.ubuntu.developer.nathanosman.twobuntu-app
    com.ubuntu.developer.rschroll.beru

 - Additionally, there are still 15 webapps using version 1.0 of the policy, ...

[Olivier Tilloy (osomon)]

All the apps that still use QtWebKit (either explicitly or through Ubuntu.Components.Extras.Browser 0.1 or version 1.0 of the policy) should be rather straightforward to migrate to Oxide with minimal changes, without any work required in webbrowser-app.

There are two exceptions, which might not be that easy to port (if possible at all, assessing that would require in-depth analysis of their code):

    com.ubuntu.developer.penk.slatekit-shell
    com.ubuntu.developer.zaspire.cordova-mobilespec

[Olivier Tilloy (osomon)]

Leaving the webbrowser-app task open as the webapp container is currently built with QtWebKit support (for web applications that still use version 1.0 of the policy). Once those applications are updated to use version 1.1 of the policy, we can remove QtWebKit support, and a lot of conditional code with it.

[David Barth (dbarth)]

For webapp-container, ie webapps, I have sent emails to the maintainers of all the 20 webapps still using the 13.10 framework.

As of today, we have 8 of them already updated to 14.04, and 12 still pending.

For the Cordova sample app, we should be able to upload a new version shortly with the new cordova release which now supports Oxide directly.

[David Barth (dbarth)]

Keep in mind also that you can't transparently migrate apps to Oxide, because of the framework they are attached to. Apps still using the 13.10 framework will need an explicit upload, as the apparmor policy will only let them use Oxide if they declare 14.04+ and add the 'webview' policy_group. I counted 120 apps still using 13.10, out of which 20 are webapps.

[Pat McGowan (pat-mcgowan)]

Pushing out due to all the moving pieces

[Pat McGowan (pat-mcgowan)]

make it part of move to vivid

[Timo Jyrinki (timo-jyrinki)]

On latest vivid, the following binary packages still depend on libqt5webkit5, making it stay on the image:

signon-ui-x11 (signon-ui): libqt5webkit5
ubuntu-html5-container (ubuntu-html5-theme): qml-module-qtwebkit
webapp-container (webbrowser-app): qml-module-qtwebkit
qtdeclarative5-ubuntu-ui-extras-browser-plugin (webbrowser-app): qml-module-qtwebkit
ubuntu-sdk-libs (ubuntu-touch-meta): qml-module-qtwebkit

[David Barth (dbarth)]

The Cordova runtime has been updated to only use Oxide.

[Olivier Tilloy (osomon)]

As of today, com.ubuntu.developer.daker.x-type has been updated to use Oxide.

[David Barth (dbarth)]

For reference all published webapps have been migrated to the newer framework which uses Oxide:
- the upload of new webapp mandates the use of the Oxide-oriented frameworks for a few months
- developers have been informed of the change on the ubuntu-phone mailing list
- developers of webapps requiring a framework upgrade have been contacted individually and guided to upload updated click packages

[Pat McGowan (pat-mcgowan)]

What is left before this can be removed?

[Timo Jyrinki (timo-jyrinki)]

All of comment #15 is still valid: signon-ui, ubuntu-html5-theme and webbrowser-app need to stop using/depending on it.

I'll propose a branch against the seed to remove that depedency.

[Launchpad Janitor (janitor)]

This bug was fixed in the package ubuntu-touch-meta - 1.216

---------------
ubuntu-touch-meta (1.216) vivid; urgency=medium

  [ Timo Jyrinki ]
  * Refreshed dependencies
  * Added liboxideqt-qmlplugin to sdk-libs
  * Removed libqt5webkit5-dev from sdk-libs-dev (LP: #1362640)
  * Removed qml-module-qtwebkit from sdk-libs
 -- Daniel Holbach <email address hidden> Mon, 16 Mar 2015 10:11:26 +0100

[Timo Jyrinki (timo-jyrinki)]

The meta package update means webkit would drop from the images if the three remaining source packages would stop depending on it in the binaries installed on device.

[Timo Jyrinki (timo-jyrinki)]

Adding signon-plugin-oauth2 task, since it erroneously depends on now dummy package signon-ui, which Recommends signon-ui-x11, which is not needed on the images but brings the webkit dependency. Neither signon-ui-x11 or signon-ui dummy package should be on the phone images.

[Timo Jyrinki (timo-jyrinki)]

Correction: not Recommends, but Depends: signon-ui-x11 | ubuntu-system-settings-online-accounts (>= 0.4) - however, since signon-ui-x11 is listed first, and it does not conflict with u-s-s-o-a, it gets installed.

[Alberto Mardegan (mardy)]

Removing signon-ui. The fix will happen on the signon-plugin-oauth2 project.

[Launchpad Janitor (janitor)]

This bug was fixed in the package signon-plugin-oauth2 - 0.21+15.04.20150319-0ubuntu1

---------------
signon-plugin-oauth2 (0.21+15.04.20150319-0ubuntu1) vivid; urgency=medium

  [ Alberto Mardegan ]
  * Remove dependency on signon-ui (LP: #1362640)
 -- CI Train Bot <email address hidden> Thu, 19 Mar 2015 15:42:31 +0000

[Launchpad Janitor (janitor)]

This bug was fixed in the package ubuntu-html5-theme - 0.1.2+15.04.20150410-0ubuntu1

---------------
ubuntu-html5-theme (0.1.2+15.04.20150410-0ubuntu1) vivid; urgency=medium

  [ Alexandre Abreu ]
  * Remove QtWebkit support code (LP: #1362640)

  [ CI Train Bot ]
  * New rebuild forced.
 -- CI Train Bot <email address hidden> Fri, 10 Apr 2015 13:32:34 +0000

[Launchpad Janitor (janitor)]

This bug was fixed in the package webbrowser-app - 0.23+15.04.20150410-0ubuntu1

---------------
webbrowser-app (0.23+15.04.20150410-0ubuntu1) vivid; urgency=medium

  [ Alexandre Abreu ]
  * remove qtwebkit deps (LP: #1362640) (LP: #1362640)

  [ CI Train Bot ]
  * New rebuild forced.

  [ Justin McPherson ]
  * Command line options for media-hub use through Oxide.

  [ Olivier Tilloy ]
  * Update translation template.
 -- CI Train Bot <email address hidden> Fri, 10 Apr 2015 13:33:24 +0000

[Timo Jyrinki (timo-jyrinki)]

Removed from image #172 onwards:

http://people.canonical.com/~ogra/touch-image-stats/172.changes

Space savings from those four dropped packages: 380 + 614 + 500 + 22739 = 24233kB.

[David Barth (dbarth)]

\o/

On Wed, Apr 15, 2015 at 8:26 AM, Timo Jyrinki <email address hidden>
wrote:

> Removed from image #172 onwards:
>
> http://people.canonical.com/~ogra/touch-image-stats/172.changes
>
> Space savings from those four dropped packages: 380 + 614 + 500 + 22739
> = 24233kB.
>
> ** Changed in: canonical-devices-system-image
> Status: In Progress => Fix Committed
>
> --
> You received this bug notification because you are a bug assignee.
> https://bugs.launchpad.net/bugs/1362640
>
> Title:
> Remove qtwebkit from touch image
>
> To manage notifications about this bug go to:
>
> https://bugs.launchpad.net/canonical-devices-system-image/+bug/1362640/+subscriptions
>