Qtwebengine

Qtwebengine

[Andreas Enge]

Hello,

I am trying to update Qt to 5.5.0. Unfortunately, it does not compile;
there are error messages such as
../../../src/3rdparty/chromium/ui/gfx/codec/jpeg_codec.cc: In function ‘boolean gfx::
{anonymous}::FillInputBuffer(j_decompress_ptr)’:
../../../src/3rdparty/chromium/ui/gfx/codec/jpeg_codec.cc:362:10: error: cannot conve
rt ‘bool’ to ‘boolean’ in return
   return false;
../../../src/3rdparty/chromium/ui/gfx/codec/jpeg_codec.cc:276:32: error: invalid conv
ersion from ‘int’ to ‘boolean’ [-fpermissive]
   jpeg_start_compress(&cinfo, 1);

We might use too aggressive type checking here. Anyway, I seem to recall that
we discussed leaving out the building of chromium altogether due to security
considerations?

In this case, it should be enough to pass the configure flag
"-skip qtwebengine". I am trying out a build now, and if you agree and
everything goes well, would push like this.

Andreas

Re: Qtwebengine

[Andreas Enge]

[-- Attachment #1: Type: text/plain, Size: 193 bytes --]

Attached is the patch.

Vlc still compiles with the new qt. Liblxqt does not; we might need to
add qt 5.4 again as a separate package. Hydra should tell us if there is
more damage...

Andreas


[-- Attachment #2: 0001-gnu-qt-Update-to-5.5.0.patch --]
[-- Type: text/plain, Size: 11409 bytes --]

From 544976bc995182440ab07f6e02dbc4deb6a3f320 Mon Sep 17 00:00:00 2001
From: Andreas Enge <andreas@enge.fr>
Date: Sat, 25 Jul 2015 16:02:38 +0200
Subject: [PATCH] gnu: qt: Update to 5.5.0.

* gnu/packages/qt.scm (qt): Update to 5.5.0. Update download location.
  Drop patch and snippet.
  [arguments]: Add configure flag to drop qtwebengine module bundling
  chromium.
  [inputs]: Add harfbuzz to avoid use of bundled copy.
  (qt-4)[inputs]: Remove inherited harfbuzz again.
* gnu/packages/patches/qt5-conflicting-typedefs.patch: Delete file.
* gnu-system.am (dist_patch_DATA): Unregister patch.
* gnu/packages/patches/qt5-runpath.patch: Adapt patch.
---
 gnu-system.am                                      |  1 -
 .../patches/qt5-conflicting-typedefs.patch         | 70 ----------------------
 gnu/packages/patches/qt5-runpath.patch             | 16 ++---
 gnu/packages/qt.scm                                | 51 +++++++++-------
 4 files changed, 37 insertions(+), 101 deletions(-)
 delete mode 100644 gnu/packages/patches/qt5-conflicting-typedefs.patch

diff --git a/gnu-system.am b/gnu-system.am
index d6635fe..560f0ca 100644
--- a/gnu-system.am
+++ b/gnu-system.am
@@ -602,7 +602,6 @@ dist_patch_DATA =						\
   gnu/packages/patches/qemu-CVE-2015-4106-pt8.patch		\
   gnu/packages/patches/qt4-ldflags.patch			\
   gnu/packages/patches/qt4-tests.patch				\
-  gnu/packages/patches/qt5-conflicting-typedefs.patch		\
   gnu/packages/patches/qt5-runpath.patch			\
   gnu/packages/patches/ratpoison-shell.patch			\
   gnu/packages/patches/readline-link-ncurses.patch		\
diff --git a/gnu/packages/patches/qt5-conflicting-typedefs.patch b/gnu/packages/patches/qt5-conflicting-typedefs.patch
deleted file mode 100644
index 751452c..0000000
--- a/gnu/packages/patches/qt5-conflicting-typedefs.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-See <https://bugreports.qt.io/browse/QTBUG-45205>.
-
-diff --git a/qtwebengine/src/core/chromium_gpu_helper.cpp b/qtwebengine/src/core/chromium_gpu_helper.cpp
-index c7c97e6..ef574ec 100644
---- a/qtwebengine/src/core/chromium_gpu_helper.cpp
-+++ b/qtwebengine/src/core/chromium_gpu_helper.cpp
-@@ -40,13 +40,15 @@
- 
- #include "chromium_gpu_helper.h"
- 
--#include "content/common/gpu/gpu_channel_manager.h"
--#include "content/common/gpu/sync_point_manager.h"
--#include "content/gpu/gpu_child_thread.h"
-+// Including gpu/command_buffer headers before content/gpu headers makes sure that
-+// guards are defined to prevent duplicate definition errors with forward declared
-+// GL typedefs cascading through content header includes.
- #include "gpu/command_buffer/service/mailbox_manager.h"
- #include "gpu/command_buffer/service/texture_manager.h"
- 
--#include <QtGlobal> // We need this for the Q_OS_QNX define.
-+#include "content/common/gpu/gpu_channel_manager.h"
-+#include "content/common/gpu/sync_point_manager.h"
-+#include "content/gpu/gpu_child_thread.h"
- 
- #ifdef Q_OS_QNX
- #include "content/common/gpu/stream_texture_qnx.h"
-diff --git a/qtwebengine/src/core/gl_surface_qt.cpp b/qtwebengine/src/core/gl_surface_qt.cpp
-index 4fe2f21..5a27aa9 100644
---- a/qtwebengine/src/core/gl_surface_qt.cpp
-+++ b/qtwebengine/src/core/gl_surface_qt.cpp
-@@ -49,8 +49,6 @@
- #include "base/logging.h"
- #include "base/memory/scoped_ptr.h"
- #include "content/common/gpu/image_transport_surface.h"
--#include "content/common/gpu/gpu_channel_manager.h"
--#include "content/common/gpu/gpu_command_buffer_stub.h"
- #include "ui/gl/egl_util.h"
- #include "ui/gl/gl_context.h"
- #include "ui/gl/gl_implementation.h"
-@@ -544,7 +542,9 @@ GLSurface::CreateViewGLSurface(gfx::AcceleratedWidget window)
- }  // namespace gfx
- 
- namespace content {
--scoped_refptr<gfx::GLSurface> ImageTransportSurface::CreateNativeSurface(GpuChannelManager* manager, GpuCommandBufferStub* stub, const gfx::GLSurfaceHandle& handle)
-+class GpuCommandBufferStub;
-+class GpuChannelManager;
-+scoped_refptr<gfx::GLSurface> ImageTransportSurface::CreateNativeSurface(GpuChannelManager*, GpuCommandBufferStub*, const gfx::GLSurfaceHandle&)
- {
-     QT_NOT_USED
-     return scoped_refptr<gfx::GLSurface>();
-diff --git a/qtwebengine/src/3rdparty/chromium/gpu/command_buffer/common/gles2_cmd_format.h b/qtwebengine/src/3rdparty/chromium/gpu/command_buffer/common/gles2_cmd_format.h
-index 04a3dc3..506cf00 100644
---- a/qtwebengine/src/3rdparty/chromium/gpu/command_buffer/common/gles2_cmd_format.h
-+++ b/qtwebengine/src/3rdparty/chromium/gpu/command_buffer/common/gles2_cmd_format.h
-@@ -20,6 +20,7 @@
- #include "gpu/command_buffer/common/cmd_buffer_common.h"
- #include "gpu/command_buffer/common/gles2_cmd_ids.h"
- 
-+#ifndef GL_VERSION_1_5
- // GL types are forward declared to avoid including the GL headers. The problem
- // is determining which GL headers to include from code that is common to the
- // client and service sides (GLES2 or one of several GL implementations).
-@@ -47,6 +48,7 @@ typedef signed long long int GLsizeiptr;
- typedef khronos_intptr_t GLintptr;
- typedef khronos_ssize_t  GLsizeiptr;
- #endif
-+#endif
- 
- namespace gpu {
- namespace gles2 {
diff --git a/gnu/packages/patches/qt5-runpath.patch b/gnu/packages/patches/qt5-runpath.patch
index a6cbb26..d045d39 100644
--- a/gnu/packages/patches/qt5-runpath.patch
+++ b/gnu/packages/patches/qt5-runpath.patch
@@ -1,9 +1,11 @@
 Allow the use of DT_RUNPATH.  This fixes a bug whereby libQt5WebEngineCore.so
 ends up having an empty RUNPATH.
 
---- qt-everywhere-opensource-src-5.4.1/qtwebengine/src/3rdparty/chromium/build/common.gypi	2015-04-14 10:21:09.330925545 +0200
-+++ qt-everywhere-opensource-src-5.4.1/qtwebengine/src/3rdparty/chromium/build/common.gypi	2015-04-14 10:21:38.735106097 +0200
-@@ -4142,19 +4142,6 @@
+
+diff -u -r qt-everywhere-opensource-src-5.5.0.orig/qtwebengine/src/3rdparty/chromium/build/common.gypi qt-everywhere-opensource-src-5.5.0/qtwebengine/src/3rdparty/chromium/build/common.gypi
+--- qt-everywhere-opensource-src-5.5.0.orig/qtwebengine/src/3rdparty/chromium/build/common.gypi	2015-06-29 22:09:36.000000000 +0200
++++ qt-everywhere-opensource-src-5.5.0/qtwebengine/src/3rdparty/chromium/build/common.gypi	2015-07-25 15:32:57.999411191 +0200
+@@ -4448,19 +4448,6 @@
                '-B<!(cd <(DEPTH) && pwd -P)/<(binutils_dir)',
              ],
            }],
@@ -19,7 +21,7 @@ ends up having an empty RUNPATH.
 -            'ldflags': [
 -              '-Wl,--disable-new-dtags',
 -            ],
--          }]
-         ],
-       },
-     }],
+-          }],
+           ['gcc_version>=47 and clang==0', {
+             'target_conditions': [
+               ['_toolset=="target"', {
diff --git a/gnu/packages/qt.scm b/gnu/packages/qt.scm
index 313d639..fcb0c3c 100644
--- a/gnu/packages/qt.scm
+++ b/gnu/packages/qt.scm
@@ -37,6 +37,7 @@
   #:use-module (gnu packages glib)
   #:use-module (gnu packages gnuzilla)
   #:use-module (gnu packages gperf)
+  #:use-module (gnu packages gtk)
   #:use-module (gnu packages icu4c)
   #:use-module (gnu packages image)
   #:use-module (gnu packages linux)
@@ -95,26 +96,20 @@ X11 (yet).")
 (define-public qt
   (package
     (name "qt")
-    (version "5.4.2")
+    (version "5.5.0")
     (source (origin
              (method url-fetch)
-             (uri (string-append "http://download.qt-project.org/official_releases/qt/"
-                                 (string-copy version 0 (string-rindex version #\.))
-                                 "/" version
-                                 "/single/qt-everywhere-opensource-src-"
-                                 version ".tar.xz"))
+             (uri
+               (string-append
+                 "http://download.qt.io/official_releases/qt/"
+                 (version-major+minor version)
+                 "/" version
+                 "/single/qt-everywhere-opensource-src-"
+                 version ".tar.xz"))
              (sha256
-              (base32
-               "09gay5cimfdb0apy60v7z4r4zkl2vjysdppzihpla8dp2c30fvcc"))
-             (patches (list (search-patch "qt5-conflicting-typedefs.patch")
-                            (search-patch "qt5-runpath.patch")))
-             (snippet
-              '(begin
-                 ;; Remove broken symlinks.
-                 (delete-file "qtwebengine/src/3rdparty/chromium/third_party/\
-mesa/src/src/gallium/state_trackers/d3d1x/w32api")
-                 (delete-file "qtwebengine/src/3rdparty/chromium/third_party/\
-webrtc/tools/e2e_quality/audio/perf")))))
+               (base32
+                 "1by2l8wxbqwvs7anb5ggmqhn2cfmhyw3a23bp1yyd240rdpa38ky"))
+             (patches (list (search-patch "qt5-runpath.patch")))))
     (build-system gnu-build-system)
     (propagated-inputs
      `(("mesa" ,mesa)))
@@ -126,6 +121,7 @@ webrtc/tools/e2e_quality/audio/perf")))))
        ("fontconfig" ,fontconfig)
        ("freetype" ,freetype)
        ("glib" ,glib)
+       ("harfbuzz" ,harfbuzz)
        ("icu4c" ,icu4c)
        ("libjpeg" ,libjpeg)
        ("libmng" ,libmng)
@@ -179,11 +175,13 @@ webrtc/tools/e2e_quality/audio/perf")))))
                 (("/bin/pwd") (which "pwd")))
               (substitute* "qtbase/src/corelib/global/global.pri"
                 (("/bin/ls") (which "ls")))
-              (substitute* "qtwebengine/src/3rdparty/chromium/build/common.gypi"
-                (("/bin/echo") (which "echo")))
-              (substitute* "qtwebengine/src/3rdparty/chromium/third_party/\
-WebKit/Source/build/scripts/scripts.gypi"
-                (("/usr/bin/gcc") (which "gcc")))
+              ;; commented out since qtwebengine is not built, but left in
+              ;; for reference
+;;               (substitute* "qtwebengine/src/3rdparty/chromium/build/common.gypi"
+;;                 (("/bin/echo") (which "echo")))
+;;               (substitute* "qtwebengine/src/3rdparty/chromium/third_party/\
+;; WebKit/Source/build/scripts/scripts.gypi"
+;;                 (("/usr/bin/gcc") (which "gcc")))
               (setenv "NINJA_PATH" (which "ninja"))
               ;; do not pass "--enable-fast-install", which makes the
               ;; configure process fail
@@ -198,6 +196,12 @@ WebKit/Source/build/scripts/scripts.gypi"
                       "-openssl-linked"
                       ;; explicitly link with dbus instead of dlopening it
                       "-dbus-linked"
+                      ;; drop chromium model (qtwebengine); it fails
+                      ;; compilation in 5.5:
+                      ;; 3rdparty/chromium/ui/gfx/codec/jpeg_codec.cc:362:10:
+                      ;; error: cannot convert ‘bool’ to ‘boolean’ in return
+                      ;; and might pose security problems.
+                      "-skip" "qtwebengine"
                       ;; drop special machine instructions not supported
                       ;; on all instances of the target
                       ,@(if (string-prefix? "x86_64"
@@ -240,7 +244,8 @@ developers using C++ or QML, a CSS & JavaScript like language.")
                "183fca7n7439nlhxyg1z7aky0izgbyll3iwakw4gwivy16aj5272"))
              (patches (map search-patch
                            '("qt4-ldflags.patch" "qt4-tests.patch")))))
-    (inputs `(,@(alist-delete "libjpeg" (package-inputs qt))
+    (inputs `(,@(alist-delete "harfbuzz"
+                              (alist-delete "libjpeg" (package-inputs qt)))
               ("libjepg" ,libjpeg-8)
               ("libsm" ,libsm)))
 
-- 
2.4.3

Re: Qtwebengine

[宋文武]

Andreas Enge <andreas@enge.fr> writes:

> Attached is the patch.
>
> Vlc still compiles with the new qt. Liblxqt does not; we might need to
> add qt 5.4 again as a separate package. Hydra should tell us if there is
> more damage...
>
> Andreas
>
> From 544976bc995182440ab07f6e02dbc4deb6a3f320 Mon Sep 17 00:00:00 2001
> From: Andreas Enge <andreas@enge.fr>
> Date: Sat, 25 Jul 2015 16:02:38 +0200
> Subject: [PATCH] gnu: qt: Update to 5.5.0.
>
> * gnu/packages/qt.scm (qt): Update to 5.5.0. Update download location.
>   Drop patch and snippet.
>   [arguments]: Add configure flag to drop qtwebengine module bundling
>   chromium.
>   [inputs]: Add harfbuzz to avoid use of bundled copy.
>   (qt-4)[inputs]: Remove inherited harfbuzz again.
> * gnu/packages/patches/qt5-conflicting-typedefs.patch: Delete file.
> * gnu-system.am (dist_patch_DATA): Unregister patch.
> * gnu/packages/patches/qt5-runpath.patch: Adapt patch.
> ---
>  gnu-system.am                                      |  1 -
>  .../patches/qt5-conflicting-typedefs.patch         | 70 ----------------------
>  gnu/packages/patches/qt5-runpath.patch             | 16 ++---
>  gnu/packages/qt.scm                                | 51 +++++++++-------
>  4 files changed, 37 insertions(+), 101 deletions(-)
>  delete mode 100644 gnu/packages/patches/qt5-conflicting-typedefs.patch
>
> diff --git a/gnu-system.am b/gnu-system.am
> index d6635fe..560f0ca 100644
> --- a/gnu-system.am
> +++ b/gnu-system.am
> @@ -602,7 +602,6 @@ dist_patch_DATA =						\
>    gnu/packages/patches/qemu-CVE-2015-4106-pt8.patch		\
>    gnu/packages/patches/qt4-ldflags.patch			\
>    gnu/packages/patches/qt4-tests.patch				\
> -  gnu/packages/patches/qt5-conflicting-typedefs.patch		\
>    gnu/packages/patches/qt5-runpath.patch			\
>    gnu/packages/patches/ratpoison-shell.patch			\
>    gnu/packages/patches/readline-link-ncurses.patch		\
> diff --git a/gnu/packages/patches/qt5-conflicting-typedefs.patch b/gnu/packages/patches/qt5-conflicting-typedefs.patch
> deleted file mode 100644
> index 751452c..0000000
> --- a/gnu/packages/patches/qt5-conflicting-typedefs.patch
> +++ /dev/null
> @@ -1,70 +0,0 @@
> -See <https://bugreports.qt.io/browse/QTBUG-45205>.
> -
> -diff --git a/qtwebengine/src/core/chromium_gpu_helper.cpp b/qtwebengine/src/core/chromium_gpu_helper.cpp
> -index c7c97e6..ef574ec 100644
> ---- a/qtwebengine/src/core/chromium_gpu_helper.cpp
> -+++ b/qtwebengine/src/core/chromium_gpu_helper.cpp
> -@@ -40,13 +40,15 @@
> - 
> - #include "chromium_gpu_helper.h"
> - 
> --#include "content/common/gpu/gpu_channel_manager.h"
> --#include "content/common/gpu/sync_point_manager.h"
> --#include "content/gpu/gpu_child_thread.h"
> -+// Including gpu/command_buffer headers before content/gpu headers makes sure that
> -+// guards are defined to prevent duplicate definition errors with forward declared
> -+// GL typedefs cascading through content header includes.
> - #include "gpu/command_buffer/service/mailbox_manager.h"
> - #include "gpu/command_buffer/service/texture_manager.h"
> - 
> --#include <QtGlobal> // We need this for the Q_OS_QNX define.
> -+#include "content/common/gpu/gpu_channel_manager.h"
> -+#include "content/common/gpu/sync_point_manager.h"
> -+#include "content/gpu/gpu_child_thread.h"
> - 
> - #ifdef Q_OS_QNX
> - #include "content/common/gpu/stream_texture_qnx.h"
> -diff --git a/qtwebengine/src/core/gl_surface_qt.cpp b/qtwebengine/src/core/gl_surface_qt.cpp
> -index 4fe2f21..5a27aa9 100644
> ---- a/qtwebengine/src/core/gl_surface_qt.cpp
> -+++ b/qtwebengine/src/core/gl_surface_qt.cpp
> -@@ -49,8 +49,6 @@
> - #include "base/logging.h"
> - #include "base/memory/scoped_ptr.h"
> - #include "content/common/gpu/image_transport_surface.h"
> --#include "content/common/gpu/gpu_channel_manager.h"
> --#include "content/common/gpu/gpu_command_buffer_stub.h"
> - #include "ui/gl/egl_util.h"
> - #include "ui/gl/gl_context.h"
> - #include "ui/gl/gl_implementation.h"
> -@@ -544,7 +542,9 @@ GLSurface::CreateViewGLSurface(gfx::AcceleratedWidget window)
> - }  // namespace gfx
> - 
> - namespace content {
> --scoped_refptr<gfx::GLSurface> ImageTransportSurface::CreateNativeSurface(GpuChannelManager* manager, GpuCommandBufferStub* stub, const gfx::GLSurfaceHandle& handle)
> -+class GpuCommandBufferStub;
> -+class GpuChannelManager;
> -+scoped_refptr<gfx::GLSurface> ImageTransportSurface::CreateNativeSurface(GpuChannelManager*, GpuCommandBufferStub*, const gfx::GLSurfaceHandle&)
> - {
> -     QT_NOT_USED
> -     return scoped_refptr<gfx::GLSurface>();
> -diff --git a/qtwebengine/src/3rdparty/chromium/gpu/command_buffer/common/gles2_cmd_format.h b/qtwebengine/src/3rdparty/chromium/gpu/command_buffer/common/gles2_cmd_format.h
> -index 04a3dc3..506cf00 100644
> ---- a/qtwebengine/src/3rdparty/chromium/gpu/command_buffer/common/gles2_cmd_format.h
> -+++ b/qtwebengine/src/3rdparty/chromium/gpu/command_buffer/common/gles2_cmd_format.h
> -@@ -20,6 +20,7 @@
> - #include "gpu/command_buffer/common/cmd_buffer_common.h"
> - #include "gpu/command_buffer/common/gles2_cmd_ids.h"
> - 
> -+#ifndef GL_VERSION_1_5
> - // GL types are forward declared to avoid including the GL headers. The problem
> - // is determining which GL headers to include from code that is common to the
> - // client and service sides (GLES2 or one of several GL implementations).
> -@@ -47,6 +48,7 @@ typedef signed long long int GLsizeiptr;
> - typedef khronos_intptr_t GLintptr;
> - typedef khronos_ssize_t  GLsizeiptr;
> - #endif
> -+#endif
> - 
> - namespace gpu {
> - namespace gles2 {
> diff --git a/gnu/packages/patches/qt5-runpath.patch b/gnu/packages/patches/qt5-runpath.patch
> index a6cbb26..d045d39 100644
> --- a/gnu/packages/patches/qt5-runpath.patch
> +++ b/gnu/packages/patches/qt5-runpath.patch
> @@ -1,9 +1,11 @@
>  Allow the use of DT_RUNPATH.  This fixes a bug whereby libQt5WebEngineCore.so
>  ends up having an empty RUNPATH.
>  
> ---- qt-everywhere-opensource-src-5.4.1/qtwebengine/src/3rdparty/chromium/build/common.gypi	2015-04-14 10:21:09.330925545 +0200
> -+++ qt-everywhere-opensource-src-5.4.1/qtwebengine/src/3rdparty/chromium/build/common.gypi	2015-04-14 10:21:38.735106097 +0200
> -@@ -4142,19 +4142,6 @@
> +
> +diff -u -r qt-everywhere-opensource-src-5.5.0.orig/qtwebengine/src/3rdparty/chromium/build/common.gypi qt-everywhere-opensource-src-5.5.0/qtwebengine/src/3rdparty/chromium/build/common.gypi
> +--- qt-everywhere-opensource-src-5.5.0.orig/qtwebengine/src/3rdparty/chromium/build/common.gypi	2015-06-29 22:09:36.000000000 +0200
> ++++ qt-everywhere-opensource-src-5.5.0/qtwebengine/src/3rdparty/chromium/build/common.gypi	2015-07-25 15:32:57.999411191 +0200
> +@@ -4448,19 +4448,6 @@
>                 '-B<!(cd <(DEPTH) && pwd -P)/<(binutils_dir)',
>               ],
>             }],
> @@ -19,7 +21,7 @@ ends up having an empty RUNPATH.
>  -            'ldflags': [
>  -              '-Wl,--disable-new-dtags',
>  -            ],
> --          }]
> -         ],
> -       },
> -     }],
> +-          }],
> +           ['gcc_version>=47 and clang==0', {
> +             'target_conditions': [
> +               ['_toolset=="target"', {
> diff --git a/gnu/packages/qt.scm b/gnu/packages/qt.scm
> index 313d639..fcb0c3c 100644
> --- a/gnu/packages/qt.scm
> +++ b/gnu/packages/qt.scm
> @@ -37,6 +37,7 @@
>    #:use-module (gnu packages glib)
>    #:use-module (gnu packages gnuzilla)
>    #:use-module (gnu packages gperf)
> +  #:use-module (gnu packages gtk)
>    #:use-module (gnu packages icu4c)
>    #:use-module (gnu packages image)
>    #:use-module (gnu packages linux)
> @@ -95,26 +96,20 @@ X11 (yet).")
>  (define-public qt
>    (package
>      (name "qt")
> -    (version "5.4.2")
> +    (version "5.5.0")
>      (source (origin
>               (method url-fetch)
> -             (uri (string-append "http://download.qt-project.org/official_releases/qt/"
> -                                 (string-copy version 0 (string-rindex version #\.))
> -                                 "/" version
> -                                 "/single/qt-everywhere-opensource-src-"
> -                                 version ".tar.xz"))
> +             (uri
> +               (string-append
> +                 "http://download.qt.io/official_releases/qt/"
> +                 (version-major+minor version)
> +                 "/" version
> +                 "/single/qt-everywhere-opensource-src-"
> +                 version ".tar.xz"))
>               (sha256
> -              (base32
> -               "09gay5cimfdb0apy60v7z4r4zkl2vjysdppzihpla8dp2c30fvcc"))
> -             (patches (list (search-patch "qt5-conflicting-typedefs.patch")
> -                            (search-patch "qt5-runpath.patch")))
> -             (snippet
> -              '(begin
> -                 ;; Remove broken symlinks.
> -                 (delete-file "qtwebengine/src/3rdparty/chromium/third_party/\
> -mesa/src/src/gallium/state_trackers/d3d1x/w32api")
> -                 (delete-file "qtwebengine/src/3rdparty/chromium/third_party/\
> -webrtc/tools/e2e_quality/audio/perf")))))
> +               (base32
> +                 "1by2l8wxbqwvs7anb5ggmqhn2cfmhyw3a23bp1yyd240rdpa38ky"))
> +             (patches (list (search-patch "qt5-runpath.patch")))))
>      (build-system gnu-build-system)
>      (propagated-inputs
>       `(("mesa" ,mesa)))
> @@ -126,6 +121,7 @@ webrtc/tools/e2e_quality/audio/perf")))))
>         ("fontconfig" ,fontconfig)
>         ("freetype" ,freetype)
>         ("glib" ,glib)
> +       ("harfbuzz" ,harfbuzz)
>         ("icu4c" ,icu4c)
>         ("libjpeg" ,libjpeg)
>         ("libmng" ,libmng)
> @@ -179,11 +175,13 @@ webrtc/tools/e2e_quality/audio/perf")))))
>                  (("/bin/pwd") (which "pwd")))
>                (substitute* "qtbase/src/corelib/global/global.pri"
>                  (("/bin/ls") (which "ls")))
> -              (substitute* "qtwebengine/src/3rdparty/chromium/build/common.gypi"
> -                (("/bin/echo") (which "echo")))
> -              (substitute* "qtwebengine/src/3rdparty/chromium/third_party/\
> -WebKit/Source/build/scripts/scripts.gypi"
> -                (("/usr/bin/gcc") (which "gcc")))
> +              ;; commented out since qtwebengine is not built, but left in
> +              ;; for reference
> +;;               (substitute* "qtwebengine/src/3rdparty/chromium/build/common.gypi"
> +;;                 (("/bin/echo") (which "echo")))
> +;;               (substitute* "qtwebengine/src/3rdparty/chromium/third_party/\
> +;; WebKit/Source/build/scripts/scripts.gypi"
> +;;                 (("/usr/bin/gcc") (which "gcc")))
>                (setenv "NINJA_PATH" (which "ninja"))
You could remove or comment out ninja too, it's used to build webengine.
>                ;; do not pass "--enable-fast-install", which makes the
>                ;; configure process fail
> @@ -198,6 +196,12 @@ WebKit/Source/build/scripts/scripts.gypi"
>                        "-openssl-linked"
>                        ;; explicitly link with dbus instead of dlopening it
>                        "-dbus-linked"
> +                      ;; drop chromium model (qtwebengine); it fails
> +                      ;; compilation in 5.5:
> +                      ;; 3rdparty/chromium/ui/gfx/codec/jpeg_codec.cc:362:10:
> +                      ;; error: cannot convert ‘bool’ to ‘boolean’ in return
> +                      ;; and might pose security problems.
> +                      "-skip" "qtwebengine"
>                        ;; drop special machine instructions not supported
>                        ;; on all instances of the target
>                        ,@(if (string-prefix? "x86_64"

The below are for qt-4?
> @@ -240,7 +244,8 @@ developers using C++ or QML, a CSS & JavaScript like language.")
>                 "183fca7n7439nlhxyg1z7aky0izgbyll3iwakw4gwivy16aj5272"))
>               (patches (map search-patch
>                             '("qt4-ldflags.patch" "qt4-tests.patch")))))
> -    (inputs `(,@(alist-delete "libjpeg" (package-inputs qt))
> +    (inputs `(,@(alist-delete "harfbuzz"
> +                              (alist-delete "libjpeg" (package-inputs qt)))
>                ("libjepg" ,libjpeg-8)
>                ("libsm" ,libsm)))
>  
> -- 
> 2.4.3
+1 for remove qtwebengine.

(I tried to split Qt into submodules, but it seems to require a lot of
effort which I couldn't give now :-( )

Re: Qtwebengine

[Mark H Weaver]

宋文武 <iyzsong@gmail.com> writes:
> +1 for remove qtwebengine.

Agreed.

> (I tried to split Qt into submodules, but it seems to require a lot of
> effort which I couldn't give now :-( )

On that subject: I vaguely recall you saying that the system 'pcre'
couldn't be used by Qt before because it wasn't built with
--enable-pcre16.  I added that feature to 'pcre' in the last
core-updates cycle, in commit 16f71908308106d098fa44104e177e328c593359.

      Mark

Re: Qtwebengine

[Andreas Enge]

On Sun, Jul 26, 2015 at 11:34:45PM +0800, 宋文武 wrote:
> You could remove or comment out ninja too, it's used to build webengine.

Thanks for the suggestion, I did and pushed.

> The below are for qt-4?

Yes. I added harfbuzz as an input to qt 5, and took it out again for qt-4.

On Sun, Jul 26, 2015 at 05:07:18PM -0400, Mark H Weaver wrote:
> 宋文武 <iyzsong@gmail.com> writes:
> > +1 for remove qtwebengine.

Done and pushed, only for qt 5. I tried the flag "-skip qtwebengine" for qt-4,
and it was not recognised. Apparently this modularisation appears only
in qt 5.

On Sun, Jul 26, 2015 at 11:34:45PM +0800, 宋文武 wrote:
> (I tried to split Qt into submodules, but it seems to require a lot of
> effort which I couldn't give now :-( )

I looked into the "submodules" directory on the download server, and also
tried to search a bit the documentation, but did not quite understand whether
it was possible to build the different qt libraries separately. My impression
was that it was not possible. To me, it looks as if these different modules
first need to be unpacked in a common place and then be compiled all together.
The same could then be reached by configuring with "-skip this -skip that",
except that one would not need to download the modules that will not be
compiled. 

Andreas

Re: Qtwebengine

[Andreas Enge]

On Sun, Jul 26, 2015 at 05:07:18PM -0400, Mark H Weaver wrote:
> On that subject: I vaguely recall you saying that the system 'pcre'
> couldn't be used by Qt before because it wasn't built with
> --enable-pcre16.  I added that feature to 'pcre' in the last
> core-updates cycle, in commit 16f71908308106d098fa44104e177e328c593359.

The configure log of qt 5 contains this line:
  PCRE ................... system

So it seems to work now.

Andreas

Re: Qtwebengine

[宋文武]

Andreas Enge <andreas@enge.fr> writes:

> On Sun, Jul 26, 2015 at 11:34:45PM +0800, 宋文武 wrote:
>> You could remove or comment out ninja too, it's used to build webengine.
>
> Thanks for the suggestion, I did and pushed.
>
>> The below are for qt-4?
>
> Yes. I added harfbuzz as an input to qt 5, and took it out again for
> qt-4.
OK.
>
> On Sun, Jul 26, 2015 at 05:07:18PM -0400, Mark H Weaver wrote:
>> 宋文武 <iyzsong@gmail.com> writes:
>> > +1 for remove qtwebengine.
>
> Done and pushed, only for qt 5. I tried the flag "-skip qtwebengine" for qt-4,
> and it was not recognised. Apparently this modularisation appears only
> in qt 5.
Yes, qt4 don't have it.
>
> On Sun, Jul 26, 2015 at 11:34:45PM +0800, 宋文武 wrote:
>> (I tried to split Qt into submodules, but it seems to require a lot of
>> effort which I couldn't give now :-( )
>
> I looked into the "submodules" directory on the download server, and also
> tried to search a bit the documentation, but did not quite understand whether
> it was possible to build the different qt libraries separately. My impression
> was that it was not possible. To me, it looks as if these different modules
> first need to be unpacked in a common place and then be compiled all together.
> The same could then be reached by configuring with "-skip this -skip that",
> except that one would not need to download the modules that will not be
> compiled.
It's indeed possible since nixpkgs did it:
<https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/libraries/qt-5/5.4/default.nix>

I think the tricks are at build time for qmake:
<https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/libraries/qt-5/5.4/setup-hook.sh>

And set QT_PLUGIN_PATH, QML2_IMPORT_PATH, etc. at runtime time.

Re: Qtwebengine

[Andreas Enge]

On Mon, Jul 27, 2015 at 09:43:21PM +0800, 宋文武 wrote:
> It's indeed possible since nixpkgs did it:
> <https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/libraries/qt-5/5.4/default.nix>
> I think the tricks are at build time for qmake:
> <https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/libraries/qt-5/5.4/setup-hook.sh>

Interesting, but without knowing Nix, these recipes are difficult to under-
stand.

> And set QT_PLUGIN_PATH, QML2_IMPORT_PATH, etc. at runtime time.

Which does not make the use easier. Could these be defined as search paths
by qt-base? In any case, feel free to implement a more modular qt, for me
this is not a priority.

Thanks!

Andreas

Security updates for bundled copies of libraries in Qt

[Mark H Weaver]

Andreas Enge <andreas@enge.fr> writes:
> In any case, feel free to implement a more modular qt, for me
> this is not a priority.

Fair enough, but consider this: IMO, the most severe problem with using
bundled copies of libraries has to do with security updates.  We have
yet to develop a security policy, but in my opinion we should not allow
software with known security flaws to remain in Guix for more than a
short time.  Either someone must take responsibility for applying
security fixes to a given package, or else that package should be
removed.  Does that make sense?

I've been doing my best to apply security fixes to Guix in a timely
fashion -- which turns out to be a big job and I could use more help --
but I'm *not* willing to do the duplicated work of applying the same
fixes to the bundled copies of libraries in Qt.  If our Qt packages are
going to use bundled copies of libraries, then someone needs to take
responsibility for applying security updates to those copies.

Any takers?

In the meantime, I honestly have no idea what security holes exist in
our Qt packages, so I've purged all software that depends on Qt from my
system.

      Mark

Re: Security updates for bundled copies of libraries in Qt

[Andreas Enge]

Hello,

On Sun, Aug 02, 2015 at 03:24:18PM -0400, Mark H Weaver wrote:
> Andreas Enge <andreas@enge.fr> writes:
> > In any case, feel free to implement a more modular qt, for me
> > this is not a priority.
> 
> Fair enough, but consider this: IMO, the most severe problem with using
> bundled copies of libraries has to do with security updates.  We have
> yet to develop a security policy, but in my opinion we should not allow
> software with known security flaws to remain in Guix for more than a
> short time.  Either someone must take responsibility for applying
> security fixes to a given package, or else that package should be
> removed.  Does that make sense?

bundled copies are definitely very annoying, and I agree we should try
to avoid them. But the question on whether Qt should be built in a modular
fashion (supposedly, that would mean that there would be different output
packages with different libraries?) is orthogonal to the problem of bundled
libraries, if I understand things correctly.

Already now, we can drop modules from our build, as we did for
qtwebengine bundlind chromium. Are there others we should drop?

> In the meantime, I honestly have no idea what security holes exist in
> our Qt packages, so I've purged all software that depends on Qt from my
> system.

I think it would be nice if we could drop qt-4; I recently switched vlc over
to qt-5.

Could you maybe try if our current qt-5 package could be enabled on mips?
My one-core machine is so incredibly slow that I do not have the courage
to try compiling there...

> I've been doing my best to apply security fixes to Guix in a timely
> fashion -- which turns out to be a big job and I could use more help

How do you do it? Are you subscribed to the CVEs, or do you look them
up manually? Could the search for them be automated for our packages?

Andreas

Re: Security updates for bundled copies of libraries in Qt

[Ludovic Courtès]

Mark H Weaver <mhw@netris.org> skribis:

> Fair enough, but consider this: IMO, the most severe problem with using
> bundled copies of libraries has to do with security updates.  We have
> yet to develop a security policy, but in my opinion we should not allow
> software with known security flaws to remain in Guix for more than a
> short time.  Either someone must take responsibility for applying
> security fixes to a given package, or else that package should be
> removed.  Does that make sense?

I think it is clear that we must avoid bundled libraries, and it seems
there’s consensus on this.  Would someone like to prepare a subsection
on this under “Packaging Guidelines”?

As for the policy of removing packages that lack security updates, I’d
be all for it in an ideal world.  However, I wonder if we can afford to
follow an all-or-nothing policy this strictly at this point.

To palliate our limited development resources, what we do need is tools
(perhaps an extension to ‘guix refresh’ or ‘guix lint’) to at least
determine whether there are unpatched CVEs in our packages.  I know this
is possible because the Nixpkgs Monitor has something like that:
<https://github.com/Phreedom/nixpkgs-monitor>.

I’ve just opened a bug for it.  Any takers?

> I've been doing my best to apply security fixes to Guix in a timely
> fashion -- which turns out to be a big job and I could use more help --
> but I'm *not* willing to do the duplicated work of applying the same
> fixes to the bundled copies of libraries in Qt.  If our Qt packages are
> going to use bundled copies of libraries, then someone needs to take
> responsibility for applying security updates to those copies.

In <https://lists.gnu.org/archive/html/guix-devel/2015-06/msg00302.html>
there was consensus that, to begin with, we should remove the bundled
Chromium and all the things it pulls from Qt5, and 宋文武
half-volunteered ;-) to work on the modular Qt5.

I’ve open a bug to keep track of this (bugs.gnu.org seems to be
currently unreachable, though.)

Ludo’.

Re: Security updates for bundled copies of libraries in Qt

[Andreas Enge]

On Tue, Aug 18, 2015 at 04:59:13PM +0200, Ludovic Courtès wrote:
> In <https://lists.gnu.org/archive/html/guix-devel/2015-06/msg00302.html>
> there was consensus that, to begin with, we should remove the bundled
> Chromium and all the things it pulls from Qt5

This was done in commit f7fb0ccb6980de7e54eabe008c0c7b73241b3494.

Andreas

Re: Security updates for bundled copies of libraries in Qt

[Ludovic Courtès]

Andreas Enge <andreas@enge.fr> skribis:

> On Tue, Aug 18, 2015 at 04:59:13PM +0200, Ludovic Courtès wrote:
>> In <https://lists.gnu.org/archive/html/guix-devel/2015-06/msg00302.html>
>> there was consensus that, to begin with, we should remove the bundled
>> Chromium and all the things it pulls from Qt5
>
> This was done in commit f7fb0ccb6980de7e54eabe008c0c7b73241b3494.

Oh nice, thanks.

Ludo’.