Comment 2 for bug 1973033

MIR team ACK under the constraint to have some answer on the weak testing story, aligning it with the wpe library seems to be the best course of action I think
This does need a security review, so I'll assign ubuntu-security.

Notes:
Recommended TODOs:
To paraphrase Christian:
- You already know the testing is weak, the higher level test in webkit2gtk
  seems fine for autopkgtest, but is there something we could do at the lower
  level in the backend itself for build time checks?

[Duplication]
There is no other package in main providing the same functionality.

[Dependencies]
OK:
- no other Dependencies to MIR due to this
- checked with check-mir
- not listed in seeded-in-ubuntu
- none of the (potentially auto-generated) dependencies (Depends
  and Recommends) that are present after build are not in main
- no -dev/-debug/-doc packages that need exclusion
- No dependencies in main that are only superficially tested requiring more tests now.

[Embedded sources and static linking]
OK:
- no embedded source present
- no static linking
- does not have odd Built-Using entries

OK:
- not a go package, no extra constraints to consider in that regard

[Security]
OK:
- history of CVEs does not look concerning
- does not run a daemon as root
- does not use lib*v8 directly
- does not open a port/socket
- does not use centralized online accounts
- does not integrate arbitrary javascript into the desktop
- does not deal with system authentication (eg, pam), etc)
- does not deal with security attestation (secure boot, tpm, signatures)

Problems:
Dependent of webkit, parse web content. Requesting thus a security review.

[Common blockers]
OK:
- does not FTBFS currently
- no new python2 dependency

Problems:
- Testing story is weak both during build and autopktests tests, look at the summary and recommended TODOs.

[Packaging red flags]
OK:
- Ubuntu does not carry a delta
- symbols tracking is in place
- d/watch is present and looks ok (if needed, e.g. non-native)
- Upstream update history is good
- Debian/Ubuntu update history is good
- the current release is packaged
- promoting this does not seem to cause issues for MOTUs that so far
- no massive Lintian warnings
- d/rules is rather clean
- It is not on the lto-disabled list

[Upstream red flags]
OK:
- no Errors/warnings during the build
- no incautious use of malloc/sprintf (as far as we can check it)
- no use of sudo, gksu, pkexec, or LD_LIBRARY_PATH (usage is OK inside
  tests)
- no use of user nobody
- no use of setuid
- no important open bugs (crashers, etc) in Debian or Ubuntu
- not part of the UI for extra checks
- no translation present, but none needed for this case

Problems:
Parts of webkit-gtk, see above for security review