From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp2 ([2001:41d0:2:bcc0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms0.migadu.com with LMTPS id cDA4MVVDUGGrAAAAgWs5BA (envelope-from ) for ; Sun, 26 Sep 2021 11:54:29 +0200 Received: from aspmx1.migadu.com ([2001:41d0:2:bcc0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp2 with LMTPS id 6BbULFVDUGFhaAAAB5/wlQ (envelope-from ) for ; Sun, 26 Sep 2021 09:54:29 +0000 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id A05B42F041 for ; Sun, 26 Sep 2021 11:54:29 +0200 (CEST) Received: from localhost ([::1]:45086 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1mUQrc-00064m-Rf for larch@yhetil.org; Sun, 26 Sep 2021 05:54:28 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:56968) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1mUQqE-0005Qd-Dd for bug-guix@gnu.org; Sun, 26 Sep 2021 05:53:02 -0400 Received: from debbugs.gnu.org ([209.51.188.43]:52616) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1mUQqE-0007fp-5d for bug-guix@gnu.org; Sun, 26 Sep 2021 05:53:02 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1mUQqE-0006Qo-2P for bug-guix@gnu.org; Sun, 26 Sep 2021 05:53:02 -0400 X-Loop: help-debbugs@gnu.org Subject: bug#34135: IceCat lacks WebGL support Resent-From: Mark H Weaver Original-Sender: "Debbugs-submit" Resent-CC: bug-guix@gnu.org Resent-Date: Sun, 26 Sep 2021 09:53:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 34135 X-GNU-PR-Package: guix X-GNU-PR-Keywords: To: Sarah Morgensen , Ludovic =?UTF-8?Q?Court=C3=A8s?= Received: via spool by 34135-submit@debbugs.gnu.org id=B34135.163264993824673 (code B ref 34135); Sun, 26 Sep 2021 09:53:02 +0000 Received: (at 34135) by debbugs.gnu.org; 26 Sep 2021 09:52:18 +0000 Received: from localhost ([127.0.0.1]:35929 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1mUQpW-0006Ps-Cn for submit@debbugs.gnu.org; Sun, 26 Sep 2021 05:52:18 -0400 Received: from world.peace.net ([64.112.178.59]:46660) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1mUQpT-0006Pf-OP for 34135@debbugs.gnu.org; Sun, 26 Sep 2021 05:52:17 -0400 Received: from mhw by world.peace.net with esmtpsa (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1mUQow-0002TP-Qp; Sun, 26 Sep 2021 05:51:42 -0400 From: Mark H Weaver In-Reply-To: <86y27kureb.fsf@mgsn.dev> References: <87o98cr6kx.fsf@gnu.org> <20190119180750.13c17654@lepiller.eu> <87womzlzhm.fsf@gnu.org> <87d0oqe7u2.fsf@elephly.net> <7A88B01C-EAB9-47BA-98EC-16F91C7993E7@lepiller.eu> <874la2l4j3.fsf@gnu.org> <86y27kureb.fsf@mgsn.dev> Date: Sun, 26 Sep 2021 05:50:18 -0400 Message-ID: <87h7e7ekcq.fsf@netris.org> MIME-Version: 1.0 Content-Type: text/plain X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: bug-guix@gnu.org List-Id: Bug reports for GNU Guix List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Ricardo Wurmus , 34135@debbugs.gnu.org Errors-To: bug-guix-bounces+larch=yhetil.org@gnu.org Sender: "bug-Guix" X-Migadu-Flow: FLOW_IN X-Migadu-Spam-Score: -4.00 Authentication-Results: aspmx1.migadu.com; none X-Migadu-Queue-Id: A05B42F041 X-Spam-Score: -4.00 X-Migadu-Scanner: scn0.migadu.com X-TUID: 9khFeolZNf8O Hi Sarah, Thanks for looking into this, and more generally for all the work you've been putting into Guix lately. Sarah Morgensen writes: > While it looks like preliminary precise whitelisting was done for > ffmpeg, it seems that this approach may require excessive effort for > WebGL. Perhaps, but I don't think that's yet been established. For what it's worth, as the maintainer of our IceCat package since the early years of Guix, I'm uncomfortable allowing the IceCat sandbox to obtain a complete list of software (with precise versions) installed on our users' systems. I hope that we will not give up so easily on precise whitelisting. > For example, after whitelisting libxcb, > it needs > > /gnu/store/w68jrgqqbfcakm27wm4zf7hmpgw294my-libxxf86vm-1.1.4/lib/libXxf86vm.so.1 > > and after whitelisting that one, > > /gnu/store/jwga98k68l0h5c45jx7z4jdjzhfc34vm-libxshmfence-1.3/lib/libxshmfence.so.1 > > and so on. I agree that this approach would be very tedious, but there are better ways. I faced a similar problem before I wrote the existing precise whitelisting code (which your proposed patch would remove): 'libavcodec' had too many dependencies, and I didn't want to maintain a list of them all. I eventually realized that 'libavcodec's RUNPATH would cover most of what was needed, and in fact only one additional directory needed to be added manually. Would you like to try adding the RUNPATHs of Mesa's libraries to the whitelist, i.e. using the same code that computes 'libavcodec-runpath'? To find the directories that must be added manually, how about scraping the *successful* log for a list of file names in /gnu/store and distilling it down to a set of packages? > Both the above are propagated-inputs in mesa. So, it seems > to "properly" fix this, we would need to read *all* input libraries > recursively. Even if we had to do that, it wouldn't be an excessive amount of effort. We already have the code to extract the RUNPATH of a library and add it to the whitelist. Doing that for all libraries found in FOO/lib/*.so for all inputs FOO shouldn't be much harder, no? What do you think? Would you like to try it? Regards, Mark -- Disinformation flourishes because many people care deeply about injustice but very few check the facts. Ask me about .