Remove qtwebkit from touch image

Bug #1362640 reported by Pat McGowan on 2014-08-28
26
This bug affects 3 people
Affects Status Importance Assigned to Milestone
Canonical System Image
High
David Barth
Cordova Ubuntu
High
Maxim Ermilov
webapps-sprint
High
David Barth
webbrowser-app
Fix Released
High
Alexandre Abreu
signon-plugin-oauth2 (Ubuntu)
High
Alberto Mardegan
signon-ui (Ubuntu)
High
Alberto Mardegan
ubuntu-html5-theme (Ubuntu)
High
Alexandre Abreu
ubuntu-touch-meta (Ubuntu)
Critical
Pat McGowan
webbrowser-app (Ubuntu)
High
Alexandre Abreu

Bug Description

The argument to remove this is based on the following:

The qtwebkit webview is deprecated for our sdk and we will not be supporting it long term
We are supporting an Oxide/Chromium solution for the Ubuntu.Webview
This was done largely for security reasons
The qtwebkit package is large and we would like to reduce image and install size
We want to discourage app devs from using this api any longer, the review tools have indicated this for several months

Related branches

Pat McGowan (pat-mcgowan) wrote :

The current use by 20 apps in the store:
 - 2 apps that cannot be ported as of today
 - one app that would require a sizeable amount of work
 - one app that would require some work
 - 5 apps that would require minimal changes
 - 11 apps that wouldn’t require any changes (other than the imports)

(9) no specific QtWebKit API used, can be replaced by Ubuntu WebView without any changes:
  com.ubuntu.developer.bobo1993324.udropcabin
  com.ubuntu.developer.carloalberto.randomimagesrel
  com.ubuntu.developer.fabricio.mnmo-counters
  com.ubuntu.developer.hansueli.burri.xkcd-viewer
  com.ubuntu.developer.larochelle.brian.feed-the-aggregator
  com.ubuntu.developer.mlosli.panpipe
  com.ubuntu.developer.mzanetti.getmewheels2
  com.ubuntu.developer.yuntan.aztter
  ir.oneapp.oneperday

(2) actually uses an UbuntuWebView (version 0.1), can be replaced by Ubuntu WebView without any changes
  com.ubuntu.developer.mzanetti.ubuntu-fitbit-app
  com.ubuntu.developer.rschroll.beru

(4) uses WebView.onLoadingChanged, minimal changes needed
  com.nucleussystems.app.freshbookstimer
  com.ubuntu.developer.mitya57.touchwriter
  com.ubuntu.developer.qqworini.aesyweibo
  com.ubuntu.developer.qtros.twimgo

(1) uses onLoadProgressChanged, but can easily be rewritten to avoid that
  fr.skimbo.skimbou

(1) relies on the fact that QtWebKit’s WebView is a flickable, shouldn’t be too hard to port to Ubuntu WebView
  com.ubuntu.developer.brianrobles204.karma-machine

(1) uses lots of QtWebKit experimental APIs (it’s a browser app), sizeable amount of work to migrate to Ubuntu WebView (or more likely a raw Oxide WebView)
  com.ubuntu.developer.penk.slatekit-shell

(2) uses QtWebKit experimental APIs such as urlSchemeDelegates, cannot be replaced by Ubuntu/Oxide WebView as is
  com.ubuntu.developer.dpniel.dekko
  com.ubuntu.developer.zaspire.cordova-mobilespec

Pat McGowan (pat-mcgowan) wrote :

Bug 1260016 added for an API to allow defining custom URL scheme delegates

Pat McGowan (pat-mcgowan) wrote :

We need to remove the dependency from the html container, which depends on Oxide 1.3 which supports script injection.

Pat McGowan (pat-mcgowan) wrote :

We also need to update all webapps using a policy < 1.1
There are 24 such apps in the store

phablet@ubuntu-phablet:/opt/click.ubuntu.com$ grep -A 10 -B 10
ubuntu-webapp */current/*.json | grep policy_version | grep 1.0
com.and.maps/current/app.json-"policy_version": 1.0
com.lastpass.lpubuntu/current/lastpass.json- "policy_version": 1.0

com.ubuntu.developer.adrian-arroyocalle.social-share/current/social-share.json-
"policy_version": 1.0
com.ubuntu.developer.cwayne18.baidu/current/app.json- "policy_version": 1.0
com.ubuntu.developer.cwayne18.renren/current/app.json- "policy_version": 1.0
com.ubuntu.developer.cwayne18.weibo/current/weibo.json-"policy_version": 1.0
com.ubuntu.developer.daker.postrocktues/current/postrocktues.json-
"policy_version": 1.0
com.ubuntu.developer.danielholm.pingpong/current/pingpong.json-
"policy_version": 1.0
com.ubuntu.developer.danielholm.swedbank/current/swedbank.json-
"policy_version": 1.0
com.ubuntu.developer.danielholm.tradera/current/tradera.json-
"policy_version": 1.0
com.ubuntu.developer.geistschatten.social-groovy/current/app.json-"policy_version":
1.0
com.ubuntu.developer.hughisaacs2.acrylicstyle/current/app.json-"policy_version":
1.0
com.ubuntu.developer.nervatura.nervatura-mobile-client/current/nmc.json-"policy_version":
1.0
com.ubuntu.developer.ogra.blueblox-game/current/blueblox-game.json-"policy_version":
1.0
com.ubuntu.developer.ogra.fruity-pops/current/fruity-pops.json-"policy_version":
1.0
com.ubuntu.developer.ogra.pixel-runner/current/pixel-runner.json-"policy_version":
1.0
com.ubuntu.developer.ogra.pumpkin-smasher/current/pumpkin-smasher.json-"policy_version":
1.0
com.ubuntu.developer.ogra.zombie-apocalypse/current/zombie-apocalypse.json-"policy_version":
1.0
com.ubuntu.developer.sangshuduo.wechatunofficial/current/app.json-
"policy_version": 1.0
com.ubuntu.developer.thiebaud2001.01net/current/01net.json-
"policy_version": 1.1
com.ubuntu.developer.victorsemyonov.mymaps/current/app.json-"policy_version":
1.0
net.launchpad.click-webapps.lloyds-bank-uk/current/app.json-
"policy_version": 1.0
net.launchpad.click-webapps.tumblr/current/app.json- "policy_version": 1.0
net.launchpad.click-webapps.xkcd/current/app.json- "policy_version": 1.0

tags: added: touch-2014-09-25
Changed in ubuntu-touch-meta (Ubuntu):
assignee: nobody → Pat McGowan (pat-mcgowan)
status: Triaged → In Progress
Pat McGowan (pat-mcgowan) wrote :

The bug to add script injection to oxide for use in the html container is bug #1221996

Pat McGowan (pat-mcgowan) wrote :

This may not make rtm and isnt critical

tags: added: ota-1
removed: touch-2014-09-25
Olli Ries (ories) on 2014-11-26
Changed in canonical-devices-system-image:
assignee: nobody → Canonical Devices Products (canonical-devices-products-team)
importance: Undecided → High
milestone: none → r1
status: New → Confirmed
Bill Filler (bfiller) on 2014-12-03
Changed in webbrowser-app:
importance: Undecided → High
assignee: nobody → Olivier Tilloy (osomon)
Bill Filler (bfiller) wrote :

opened a webbrowser-app task to track if there is any work needed on the browser or container side to remove this dependency. please mark invalid if not.

tags: added: ww51
Olivier Tilloy (osomon) wrote :
Download full text (3.9 KiB)

I installed all 624 apps from the store (as of today) on a Nexus 7 running vivid-proposed (image #42), and grepped through them to get a picture of which still use QtWebKit. Here’s a summary:

 - 15 applications import (and supposedly use) QtWebKit directly:

    com.nucleussystems.app.freshbookstimer
    com.ubuntu.developer.brianrobles204.karma-machine
    com.ubuntu.developer.carloalberto.randomimagesrel
    com.ubuntu.developer.fabricio.mnmo-counters
    com.ubuntu.developer.hansueli.burri.xkcd-viewer
    com.ubuntu.developer.larochelle.brian.feed-the-aggregator
    com.ubuntu.developer.mitya57.touchwriter
    com.ubuntu.developer.mzanetti.getmewheels2
    com.ubuntu.developer.penk.slatekit-shell
    com.ubuntu.developer.qqworini.aesyweibo
    com.ubuntu.developer.qtros.twimgo
    com.ubuntu.developer.yuntan.aztter
    com.ubuntu.developer.zaspire.cordova-mobilespec
    fr.skimbo.skimbou
    ir.oneapp.oneperday

 - 10 applications import (and supposedly use) Ubuntu.Components.Extras.Browser 0.1, i.e. QtWebKit under the hood:

    com.ubuntu.developer.andrewsomething.stackbrowser
    com.ubuntu.developer.daker.bytesjack
    com.ubuntu.developer.daker.x-type
    com.ubuntu.developer.fcole90.feedspot
    com.ubuntu.developer.karthik.upadya1.ifacebook
    com.ubuntu.developer.karthik.upadya1.igplus
    com.ubuntu.developer.karthik.upadya1.imail
    com.ubuntu.developer.mdspencer.project-dashboard
    com.ubuntu.developer.sangshuduo.doubanfmunofficial
    com.wellsb.esv-bible

 - 4 applications import Ubuntu.Components.Extras.Browser 0.2 (i.e. Oxide under the hood), they could use a rename of the import to Ubuntu.Web 0.2:

    com.ubuntu.developer.alaak.uberbag
    com.ubuntu.developer.filip-dobrocky.gagger
    com.ubuntu.developer.karthik.upadya1.wikipediatouch
    com.ubuntu.developer.rschroll.beru

 - 16 applications import Ubuntu.Web 0.2 (i.e. Oxide under the hood), no change needed:

    com.canonical.payui
    com.ubuntu.developer.bobo1993324.pdfjsviewer
    com.ubuntu.developer.mhall119.ureadit
    com.viclog.2048
    com.ubuntu.developer.bobo1993324.udropcabin
    com.ubuntu.developer.danielholm.pingpong
    com.ubuntu.developer.dholbach.randomcats
    com.ubuntu.developer.mdspencer.project-dashboard
    com.ubuntu.developer.mlosli.panpipe
    com.ubuntu.developer.mzanetti.ubuntu-fitbit-app
    com.ubuntu.developer.qtros.yad
    com.ubuntu.developer.rayalez.hackernews
    com.ubuntu.developer.roman2861.zmusic
    com.ubuntu.developer.turan.mahmudov.ufoursquare
    com.viclog.flappybird
    cx.gould.ted.ubuntu-app-startup

 - 12 applications import com.canonical.Oxide, no change needed:

    com.ubuntu.reminders
    com.popey.calculator
    com.popey.sst
    com.ubuntu.developer.danielholm.stumble
    com.ubuntu.developer.dobey.delta-web
    com.ubuntu.developer.dpniel.dekko
    com.ubuntu.developer.mkamenjak77.4chanappextra
    com.ubuntu.developer.mkamenjak77.bluedragonbrowser
    com.ubuntu.developer.mkamenjak77.bugapp
    com.ubuntu.developer.mkamenjak77.googleplusapp
    com.ubuntu.developer.nathanosman.twobuntu-app
    com.ubuntu.developer.rschroll.beru

 - Additionally, there are still 15 webapps using version 1.0 of the policy, ...

Read more...

Olivier Tilloy (osomon) wrote :

All the apps that still use QtWebKit (either explicitly or through Ubuntu.Components.Extras.Browser 0.1 or version 1.0 of the policy) should be rather straightforward to migrate to Oxide with minimal changes, without any work required in webbrowser-app.

There are two exceptions, which might not be that easy to port (if possible at all, assessing that would require in-depth analysis of their code):

    com.ubuntu.developer.penk.slatekit-shell
    com.ubuntu.developer.zaspire.cordova-mobilespec

Changed in webbrowser-app:
status: New → Triaged
Olivier Tilloy (osomon) wrote :

Leaving the webbrowser-app task open as the webapp container is currently built with QtWebKit support (for web applications that still use version 1.0 of the policy). Once those applications are updated to use version 1.1 of the policy, we can remove QtWebKit support, and a lot of conditional code with it.

David Barth (dbarth) wrote :

For webapp-container, ie webapps, I have sent emails to the maintainers of all the 20 webapps still using the 13.10 framework.

As of today, we have 8 of them already updated to 14.04, and 12 still pending.

For the Cordova sample app, we should be able to upload a new version shortly with the new cordova release which now supports Oxide directly.

David Barth (dbarth) wrote :

Keep in mind also that you can't transparently migrate apps to Oxide, because of the framework they are attached to. Apps still using the 13.10 framework will need an explicit upload, as the apparmor policy will only let them use Oxide if they declare 14.04+ and add the 'webview' policy_group. I counted 120 apps still using 13.10, out of which 20 are webapps.

Changed in cordova-ubuntu:
assignee: nobody → Maxim Ermilov (zaspire)
importance: Undecided → High
status: New → Confirmed
status: Confirmed → Triaged
Pat McGowan (pat-mcgowan) wrote :

Pushing out due to all the moving pieces

Changed in canonical-devices-system-image:
milestone: ww51-2014 → ww05-2015
Olivier Tilloy (osomon) on 2014-12-09
tags: removed: ww51
Pat McGowan (pat-mcgowan) wrote :

make it part of move to vivid

Changed in canonical-devices-system-image:
milestone: ww05-2015 → ww11-2015
Timo Jyrinki (timo-jyrinki) wrote :

On latest vivid, the following binary packages still depend on libqt5webkit5, making it stay on the image:

signon-ui-x11 (signon-ui): libqt5webkit5
ubuntu-html5-container (ubuntu-html5-theme): qml-module-qtwebkit
webapp-container (webbrowser-app): qml-module-qtwebkit
qtdeclarative5-ubuntu-ui-extras-browser-plugin (webbrowser-app): qml-module-qtwebkit
ubuntu-sdk-libs (ubuntu-touch-meta): qml-module-qtwebkit

David Barth (dbarth) wrote :

The Cordova runtime has been updated to only use Oxide.

Changed in ubuntu-html5-theme (Ubuntu):
assignee: nobody → Alexandre Abreu (abreu-alexandre)
Changed in signon-ui (Ubuntu):
assignee: nobody → Alberto Mardegan (mardy)
status: New → Triaged
importance: Undecided → High
Changed in ubuntu-html5-theme (Ubuntu):
status: New → Triaged
importance: Undecided → High
Changed in webbrowser-app (Ubuntu):
assignee: nobody → Olivier Tilloy (osomon)
importance: Undecided → High
status: New → Triaged
Changed in cordova-ubuntu:
status: Triaged → Fix Released
Olivier Tilloy (osomon) wrote :

As of today, com.ubuntu.developer.daker.x-type has been updated to use Oxide.

David Barth (dbarth) wrote :

For reference all published webapps have been migrated to the newer framework which uses Oxide:
- the upload of new webapp mandates the use of the Oxide-oriented frameworks for a few months
- developers have been informed of the change on the ubuntu-phone mailing list
- developers of webapps requiring a framework upgrade have been contacted individually and guided to upload updated click packages

Pat McGowan (pat-mcgowan) wrote :

What is left before this can be removed?

Changed in canonical-devices-system-image:
assignee: Canonical Devices Products (canonical-devices-products-team) → David Barth (dbarth)
milestone: ww11-2015 → ww13-2015
Changed in canonical-devices-system-image:
status: Confirmed → In Progress
Timo Jyrinki (timo-jyrinki) wrote :

All of comment #15 is still valid: signon-ui, ubuntu-html5-theme and webbrowser-app need to stop using/depending on it.

I'll propose a branch against the seed to remove that depedency.

Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ubuntu-touch-meta - 1.216

---------------
ubuntu-touch-meta (1.216) vivid; urgency=medium

  [ Timo Jyrinki ]
  * Refreshed dependencies
  * Added liboxideqt-qmlplugin to sdk-libs
  * Removed libqt5webkit5-dev from sdk-libs-dev (LP: #1362640)
  * Removed qml-module-qtwebkit from sdk-libs
 -- Daniel Holbach <email address hidden> Mon, 16 Mar 2015 10:11:26 +0100

Changed in ubuntu-touch-meta (Ubuntu):
status: In Progress → Fix Released
Timo Jyrinki (timo-jyrinki) wrote :

The meta package update means webkit would drop from the images if the three remaining source packages would stop depending on it in the binaries installed on device.

Changed in ubuntu-html5-theme (Ubuntu):
status: Triaged → In Progress
Timo Jyrinki (timo-jyrinki) wrote :

Adding signon-plugin-oauth2 task, since it erroneously depends on now dummy package signon-ui, which Recommends signon-ui-x11, which is not needed on the images but brings the webkit dependency. Neither signon-ui-x11 or signon-ui dummy package should be on the phone images.

Changed in signon-plugin-oauth2 (Ubuntu):
importance: Undecided → High
assignee: nobody → Alberto Mardegan (mardy)
Timo Jyrinki (timo-jyrinki) wrote :

Correction: not Recommends, but Depends: signon-ui-x11 | ubuntu-system-settings-online-accounts (>= 0.4) - however, since signon-ui-x11 is listed first, and it does not conflict with u-s-s-o-a, it gets installed.

Alberto Mardegan (mardy) wrote :

Removing signon-ui. The fix will happen on the signon-plugin-oauth2 project.

Changed in signon-ui (Ubuntu):
status: Triaged → Invalid
Changed in signon-plugin-oauth2 (Ubuntu):
status: New → In Progress
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package signon-plugin-oauth2 - 0.21+15.04.20150319-0ubuntu1

---------------
signon-plugin-oauth2 (0.21+15.04.20150319-0ubuntu1) vivid; urgency=medium

  [ Alberto Mardegan ]
  * Remove dependency on signon-ui (LP: #1362640)
 -- CI Train Bot <email address hidden> Thu, 19 Mar 2015 15:42:31 +0000

Changed in signon-plugin-oauth2 (Ubuntu):
status: In Progress → Fix Released
David Barth (dbarth) on 2015-03-24
Changed in webbrowser-app:
status: Triaged → In Progress
Changed in webbrowser-app (Ubuntu):
status: Triaged → In Progress
assignee: Olivier Tilloy (osomon) → Alexandre Abreu (abreu-alexandre)
Changed in webbrowser-app:
assignee: Olivier Tilloy (osomon) → Alexandre Abreu (abreu-alexandre)
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ubuntu-html5-theme - 0.1.2+15.04.20150410-0ubuntu1

---------------
ubuntu-html5-theme (0.1.2+15.04.20150410-0ubuntu1) vivid; urgency=medium

  [ Alexandre Abreu ]
  * Remove QtWebkit support code (LP: #1362640)

  [ CI Train Bot ]
  * New rebuild forced.
 -- CI Train Bot <email address hidden> Fri, 10 Apr 2015 13:32:34 +0000

Changed in ubuntu-html5-theme (Ubuntu):
status: In Progress → Fix Released
Changed in canonical-devices-system-image:
milestone: ww13-2015 → ww17-2015
David Barth (dbarth) on 2015-04-14
Changed in webapps-sprint:
assignee: nobody → David Barth (dbarth)
importance: Undecided → High
status: New → In Progress
milestone: none → sprint-8
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package webbrowser-app - 0.23+15.04.20150410-0ubuntu1

---------------
webbrowser-app (0.23+15.04.20150410-0ubuntu1) vivid; urgency=medium

  [ Alexandre Abreu ]
  * remove qtwebkit deps (LP: #1362640) (LP: #1362640)

  [ CI Train Bot ]
  * New rebuild forced.

  [ Justin McPherson ]
  * Command line options for media-hub use through Oxide.

  [ Olivier Tilloy ]
  * Update translation template.
 -- CI Train Bot <email address hidden> Fri, 10 Apr 2015 13:33:24 +0000

Changed in webbrowser-app (Ubuntu):
status: In Progress → Fix Released
Olivier Tilloy (osomon) on 2015-04-14
Changed in webbrowser-app:
status: In Progress → Fix Released
Timo Jyrinki (timo-jyrinki) wrote :

Removed from image #172 onwards:

http://people.canonical.com/~ogra/touch-image-stats/172.changes

Space savings from those four dropped packages: 380 + 614 + 500 + 22739 = 24233kB.

Changed in canonical-devices-system-image:
status: In Progress → Fix Committed

\o/

On Wed, Apr 15, 2015 at 8:26 AM, Timo Jyrinki <email address hidden>
wrote:

> Removed from image #172 onwards:
>
> http://people.canonical.com/~ogra/touch-image-stats/172.changes
>
> Space savings from those four dropped packages: 380 + 614 + 500 + 22739
> = 24233kB.
>
> ** Changed in: canonical-devices-system-image
> Status: In Progress => Fix Committed
>
> --
> You received this bug notification because you are a bug assignee.
> https://bugs.launchpad.net/bugs/1362640
>
> Title:
> Remove qtwebkit from touch image
>
> To manage notifications about this bug go to:
>
> https://bugs.launchpad.net/canonical-devices-system-image/+bug/1362640/+subscriptions
>

David Barth (dbarth) on 2015-04-29
Changed in canonical-devices-system-image:
status: Fix Committed → Fix Released
Changed in webapps-sprint:
status: In Progress → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Duplicates of this bug

Other bug subscribers