From bc99092@sac.sfbay.sun.com Thu Jul 23 06:42:58 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6NDgvDJ026645 for ; Thu, 23 Jul 2009 06:42:57 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n6NDgnsu006160; Thu, 23 Jul 2009 21:42:56 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN80022XM3JE000@nwk-avmta-1.sfbay.Sun.COM>; Thu, 23 Jul 2009 06:42:55 -0700 (PDT) Received: from dm-sfbay-01.sfbay.sun.com ([129.145.155.118]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN80097BM3H0PB0@nwk-avmta-1.sfbay.Sun.COM>; Thu, 23 Jul 2009 06:42:53 -0700 (PDT) Received: from sac.sfbay.sun.com (sac.SFBay.Sun.COM [129.146.226.132]) by dm-sfbay-01.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n6NDgqri049987; Thu, 23 Jul 2009 06:42:52 -0700 (PDT) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6NDgod9026640; Thu, 23 Jul 2009 06:42:50 -0700 (PDT) Received: (from bc99092@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id n6NDgoWU026636; Thu, 23 Jul 2009 06:42:50 -0700 (PDT) Date: Thu, 23 Jul 2009 06:42:50 -0700 (PDT) From: Brian Cameron Subject: WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] To: LSARC-ext@sun.com Cc: Alfred.Peng@sun.com, desktop-discuss@opensolaris.org Message-id: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 7398 Template Version: @(#)sac_nextcase 1.68 02/23/09 SMI This information is Copyright 2009 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: WebKit 1.1.x 1.2. Name of Document Author/Supplier: Author: Alfred Peng 1.3 Date of This Document: 23 July, 2009 4. Technical Description Copyright 2009 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: WebKit 1.1.x 1.2. Name of Document Author/Supplier: Alfred Peng 1.3. Date of This Document: 07/21/2009 1.3.1. Date this project was conceived: 10/01/2006 1.4. Name of Major Document Customer(s)/Consumer(s): 1.4.1. The PAC or CPT you expect to review your project: Solaris PAC 1.4.2. The ARC(s) you expect to review your project: LSARC 1.4.3. The Director/VP who is "Sponsoring" this project: robert.odea@sun.com 1.4.4. The name of your business unit: Software - OPG 1.5. Email Aliases: 1.5.1. Responsible Manager: leo.binchy@sun.com 1.5.2. Responsible Engineer: alfred.peng@sun.com 1.5.3. Marketing Manager: glynn.foster@sun.com 1.5.4. Interest List: desktop-discuss@opensolaris.org 2. Project Summary 2.1. Project Description: WebKit is an open source web browser engine. It's also the name of the Mac OS X system framework version of the engine that's used by Safari, Dashboard, Mail, and many other OS X applications. WebKit's HTML and JavaScript code began as a branch of the KHTML and KJS libraries from KDE. WebKit can be built on top of different widget backends, which includes GTK, Qt, wxWidgets and some others as well. For this case, WebKit will be built with GTK+ on Solaris. It's the engine that will be used for embedding a browser in various GNOME applications, devhelp/yelp for example. WebKitGTK+ is a community sub-project maintained mostly by GNOME and GTK+ developers. It's implemented directly on top of GTK+, GLib and GNOME libraries and provides lightweight web viewing and editing features as well as being the basis for complete web browser applications. It supports the latest web standards and offers good performance and memory usage characteristics on the desktop. The release schedule for WebKitGTK+ will be matched with GNOME's 6-month release cycle. Currently, GNOME applications including devhelp/epiphany have switched to link against WebKit. 4. Technical Description: 4.1. Details: WebKit has the following features: - CSS 2.1, CSS3 support. - DOM (Document Object Model) - Styleable form controls with CSS. - Drosera (A JavaScript debugger for WebKit that can be used with any application that uses WebKit) - Enhanced Rich Text Editing. - XML techologies support, including XPath, SVG and XSLTProcessor (JavaScript API for XSLT). - Netscape-style (NPAPI) plugins support. - WebKit embedding API (provides clients with a public API for loading, displaying and manipulating Web content.) New in 1.1.x: - HTTP auth with optional GNOME keyring storage. - HTML5 media element support. - Spell check support. WebKit supports the AT-SPI accessibility layer since version 1.0.x. The GNOME accessibility team are working hard with WebKit team to ensure WebKit is accessible when GNOME 2.28 is released. The libcURL HTTP backend support has been removed from WebKit 1.1.x. The default HTTP backend is now libsoup. WebKit uses libsoup to verify the peer's certificates for HTTPS connections. Currently, WebKit accepts all SSL certificates automatically by default as libsoup doesn't support client SSL certificate. Meanwhile, libsoup is also used for HTTP auth handling with optional GNOME Keyring support. WebKit 1.1.x enables HTML5 Video support by using GStreamer framework as the media backend. This makes it possible for the video content to be embedded in SVG and manipulated with CSS and JavaScript. 4.2. Bug/RFE Number(s): None. 4.3. In Scope: See above. 4.4. Out of Scope: See above. 4.5. Interfaces: This section only hightlights the changes since LSARC/2008/782. Exported Interface: Interface Stability Comment ---------------------------------------------------------------------------- /usr/lib/libwebkit-1.0.so.1 Obsolete Volatile Symbolic link /usr/lib/${MACH64}/libwebkit-1.0.so.1 Obsolete Volatile Symbolic link /usr/lib/libwebkit-1.0.so Volatile Symbolic link /usr/lib/libwebkit-1.0.so.2 Volatile Symbolic link /usr/lib/libwebkit-1.0.so.2.7.0 Volatile webkit lib /usr/lib/${MACH64}/libwebkit-1.0.so Volatile Symbolic link /usr/lib/${MACH64}/libwebkit-1.0.so.2 Volatile Symbolic link /usr/lib/${MACH64}/libwebkit-1.0.so.2.7.0 Volatile 64bit webkit lib Imported Interfaces: Interface Stability Comments ---------------------------------------------------------------------------- cURL Obsolete Uncommitted PSARC/2007/165 libsoup, GStreamer Committed LSARC/2007/520 4.6. Doc Impact: None. 4.7. I18N/L10N Impact: The JDS team and the G11N team are working together to evaluate and provide I18N/L10N support. 4.8. Packaging & Delivery: The project will be delivering the following packages: SUNWwebkit SUNWwebkit-devel 4.9. Security Impact: WebKit uses libsoup to verify the peer's certificates for HTTPS connections, instead of libcurl. Currently, WebKit accepts all SSL certificates automatically by default as libsoup doesn't support client SSL certificate. Meanwhile, libsoup is also used for HTTP auth handling with optional GNOME Keyring support. 4.10. Dependencies: None. 5. Reference Documents: 1. SUNWwebkit,SUNWwebkit-devel pkgmap pkginfo depend 2. XDG Base Directory Specification http://standards.freedesktop.org/basedir-spec/latest/ar01s03.html 3. WebKit community http://webkit.org/ http://webkitgtk.org/ 4. WebKit wiki page http://trac.webkit.org/wiki 5. References for web standards: CSS 2.1: http://www.w3.org/TR/CSS21/ CSS 3: http://www.w3.org/Style/CSS/current-work#CSS3 DOM: http://www.w3.org/DOM/ XPath: http://www.w3.org/TR/xpath SVG: http://www.w3.org/Graphics/SVG/ XSLT: http://www.w3.org/TR/xslt HTML5: http://www.w3.org/TR/html5/ 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: Desktop 6.5. ARC review type: FastTrack 6.6. ARC Exposure: open From stefan.teleman@sun.com Thu Jul 23 06:49:34 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6NDnXPa026676 for ; Thu, 23 Jul 2009 06:49:33 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n6NDnT5S009692; Thu, 23 Jul 2009 21:49:30 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN800F05MEHKZ00@brm-avmta-1.central.sun.com>; Thu, 23 Jul 2009 07:49:29 -0600 (MDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.63]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN800887MEGX440@brm-avmta-1.central.sun.com>; Thu, 23 Jul 2009 07:49:28 -0600 (MDT) Received: from [10.7.250.8] (punchin-client-10-7-250-8.SFBay.Sun.COM [10.7.250.8]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id n6NDnQbM326251; Thu, 23 Jul 2009 06:49:26 -0700 (PDT) Date: Thu, 23 Jul 2009 09:49:26 -0400 From: Stefan Teleman Subject: Re: WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> To: Brian Cameron Cc: LSARC-ext@sun.com, desktop-discuss@opensolaris.org, Alfred.Peng@sun.com Reply-to: stefan.teleman@sun.com Message-id: <4A686A66.7080109@Sun.COM> Organization: Sun Microsystems, Inc. MIME-version: 1.0 Content-type: text/plain; charset=UTF-8; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> User-Agent: Thunderbird 2.0.0.19 (X11/20090218) Status: RO Content-Length: 399 Brian Cameron wrote: > Imported Interfaces: > > Interface Stability Comments > ---------------------------------------------------------------------------- > > cURL Obsolete Uncommitted PSARC/2007/165 CURL is Uncommitted, not Obsolete. --Stefan -- Stefan Teleman Sun Microsystems, Inc. stefan.teleman@Sun.COM From Alfred.Peng@sun.com Thu Jul 23 06:56:10 2009 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6NDuAZ3027105 for ; Thu, 23 Jul 2009 06:56:10 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n6NDu8Lb027652 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Thu, 23 Jul 2009 06:56:10 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN800G0NMPLBG00@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.COM); Thu, 23 Jul 2009 07:56:09 -0600 (MDT) Received: from sineb-mail-2.sun.com ([192.18.19.7]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN8008YLMPJX530@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.COM); Thu, 23 Jul 2009 07:56:08 -0600 (MDT) Received: from fe-apac-06.sun.com (fe-apac-06.sun.com [192.18.19.177] (may be forged)) by sineb-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n6NDu79s026557 for ; Thu, 23 Jul 2009 13:56:07 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KN800H00MHZ5P00@mail-apac.sun.com> for LSARC-ext@Sun.COM (ORCPT LSARC-ext@Sun.COM); Thu, 23 Jul 2009 21:56:07 +0800 (SGT) Received: from [172.22.131.50] ([unknown] [155.69.195.98]) by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KN800169MPJJ230@mail-apac.sun.com>; Thu, 23 Jul 2009 21:56:07 +0800 (SGT) Date: Thu, 23 Jul 2009 21:56:10 +0800 From: Alfred Peng Subject: Re: WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A686A66.7080109@Sun.COM> Sender: Alfred.Peng@sun.com To: Stefan.Teleman@sun.com Cc: Brian Cameron , LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <4A686BFA.3090902@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A686A66.7080109@Sun.COM> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1.1) Gecko/20090721 Thunderbird/3.0b3 Status: RO Content-Length: 560 On 07/23/09 09:49 PM, Stefan Teleman wrote: > Brian Cameron wrote: > > >> Imported Interfaces: >> >> Interface Stability Comments >> ---------------------------------------------------------------------------- >> >> cURL Obsolete Uncommitted PSARC/2007/165 >> > CURL is Uncommitted, not Obsolete. Hi Stefan, The interface cURL is marked as "Obsolete Uncommitted" here. It means this interface is removed from LSARC/2008/782: Webkit 1.0.3 for Solaris. Thanks, -Alfred From stefan.teleman@Sun.COM Thu Jul 23 07:03:39 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6NE3cP4027305 for ; Thu, 23 Jul 2009 07:03:39 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n6NE3bo7013801; Thu, 23 Jul 2009 15:03:37 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN800605N21GA00@nwk-avmta-1.sfbay.Sun.COM>; Thu, 23 Jul 2009 07:03:37 -0700 (PDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.59]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN8009P8N210RA0@nwk-avmta-1.sfbay.Sun.COM>; Thu, 23 Jul 2009 07:03:37 -0700 (PDT) Received: from [10.7.250.8] (punchin-client-10-7-250-8.SFBay.Sun.COM [10.7.250.8]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id n6NE3ZPL327671; Thu, 23 Jul 2009 07:03:35 -0700 (PDT) Date: Thu, 23 Jul 2009 10:03:35 -0400 From: Stefan Teleman Subject: Re: WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A686BFA.3090902@sun.com> To: Alfred Peng Cc: Brian Cameron , LSARC-ext@Sun.COM, desktop-discuss@opensolaris.org Reply-to: stefan.teleman@Sun.COM Message-id: <4A686DB7.7060507@Sun.COM> Organization: Sun Microsystems, Inc. MIME-version: 1.0 Content-type: text/plain; charset=UTF-8; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A686A66.7080109@Sun.COM> <4A686BFA.3090902@sun.com> User-Agent: Thunderbird 2.0.0.19 (X11/20090218) Status: RO Content-Length: 705 Alfred Peng wrote: > On 07/23/09 09:49 PM, Stefan Teleman wrote: >> Brian Cameron wrote: >> >> >>> Imported Interfaces: >>> >>> Interface Stability Comments >>> ---------------------------------------------------------------------------- >>> >>> cURL Obsolete Uncommitted PSARC/2007/165 >>> >> CURL is Uncommitted, not Obsolete. > Hi Stefan, > > The interface cURL is marked as "Obsolete Uncommitted" here. It means > this interface is removed from LSARC/2008/782: Webkit 1.0.3 for Solaris. Ah, now i get it. :-) Sorry for the noise. --Stefan -- Stefan Teleman Sun Microsystems, Inc. stefan.teleman@Sun.COM From Michael.Kearney@sun.com Thu Jul 23 07:21:37 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6NELag0027626 for ; Thu, 23 Jul 2009 07:21:37 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n6NELYr3025943 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Thu, 23 Jul 2009 22:21:36 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN800307NVZ3Z00@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.COM); Thu, 23 Jul 2009 07:21:35 -0700 (PDT) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN800L8PNVY3A60@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.COM); Thu, 23 Jul 2009 07:21:34 -0700 (PDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n6NELY6Y000230 for ; Thu, 23 Jul 2009 14:21:34 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KN800G00NNDYH00@mail-amer.sun.com> for LSARC-ext@Sun.COM (ORCPT LSARC-ext@Sun.COM); Thu, 23 Jul 2009 08:21:34 -0600 (MDT) Received: from [129.147.49.125] ([unknown] [129.147.49.125]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KN800002NVP8T80@mail-amer.sun.com>; Thu, 23 Jul 2009 08:21:25 -0600 (MDT) Date: Thu, 23 Jul 2009 08:21:41 -0600 From: Michael Kearney Subject: Re: WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> Sender: Michael.Kearney@sun.com To: Brian Cameron Cc: LSARC-ext@sun.com, Alfred.Peng@sun.com, desktop-discuss@opensolaris.org Message-id: <4A6871F5.6090606@Sun.com> MIME-version: 1.0 Content-type: multipart/mixed; boundary="Boundary_(ID_hkMpWzpP7GbYDRTclyfFVA)" X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> User-Agent: Thunderbird 2.0.0.19 (Windows/20081209) Status: RO Content-Length: 10724 This is a multi-part message in MIME format. --Boundary_(ID_hkMpWzpP7GbYDRTclyfFVA) Content-type: text/html; CHARSET=US-ASCII Content-transfer-encoding: 7BIT Why is section 1 partially duplicated?

Brian Cameron wrote: 
Template Version: @(#)sac_nextcase 1.68 02/23/09 SMI
This information is Copyright 2009 Sun Microsystems
1. Introduction
    1.1. Project/Component Working Name:
	 WebKit 1.1.x
    1.2. Name of Document Author/Supplier:
	 Author:  Alfred Peng
    1.3  Date of This Document:
	23 July, 2009
4. Technical Description
Copyright 2009 Sun Microsystems

1. Introduction
    1.1. Project/Component Working Name:

        WebKit 1.1.x

    1.2. Name of Document Author/Supplier:

        Alfred Peng

    1.3. Date of This Document:

        07/21/2009

        1.3.1. Date this project was conceived:

            10/01/2006

    1.4. Name of Major Document Customer(s)/Consumer(s):

        1.4.1. The PAC or CPT you expect to review your project:

            Solaris PAC

        1.4.2. The ARC(s) you expect to review your project:

            LSARC

        1.4.3. The Director/VP who is "Sponsoring" this project:

            robert.odea@sun.com

        1.4.4. The name of your business unit:

            Software - OPG

    1.5. Email Aliases:

        1.5.1. Responsible Manager:

            leo.binchy@sun.com

        1.5.2. Responsible Engineer:

            alfred.peng@sun.com

        1.5.3. Marketing Manager:

            glynn.foster@sun.com

        1.5.4. Interest List:

            desktop-discuss@opensolaris.org

2. Project Summary
   2.1. Project Description:

        WebKit is an open source web browser engine. It's also the name of the
        Mac OS X system framework version of the engine that's used by Safari,
        Dashboard, Mail, and many other OS X applications. WebKit's HTML and
        JavaScript code began as a branch of the KHTML and KJS libraries from
        KDE.

        WebKit can be built on top of different widget backends, which includes
        GTK, Qt, wxWidgets and some others as well. For this case, WebKit will
        be built with GTK+ on Solaris. It's the engine that will be used for
        embedding a browser in various GNOME applications, devhelp/yelp for
        example.

        WebKitGTK+ is a community sub-project maintained mostly by GNOME and
        GTK+ developers. It's implemented directly on top of GTK+, GLib and
        GNOME libraries and provides lightweight web viewing and editing
        features as well as being the basis for complete web browser
        applications. It supports the latest web standards and offers good
        performance and memory usage characteristics on the desktop.

        The release schedule for WebKitGTK+ will be matched with GNOME's
        6-month release cycle. Currently, GNOME applications including
        devhelp/epiphany have switched to link against WebKit.

4. Technical Description:
    4.1. Details:

        WebKit has the following features:
        - CSS 2.1, CSS3 support.
        - DOM (Document Object Model)
        - Styleable form controls with CSS.
        - Drosera (A JavaScript debugger for WebKit that can be used
          with any application that uses WebKit)
        - Enhanced Rich Text Editing.
        - XML techologies support, including XPath, SVG and XSLTProcessor
          (JavaScript API for XSLT).
        - Netscape-style (NPAPI) plugins support.
        - WebKit embedding API (provides clients with a public API for 
          loading, displaying and manipulating Web content.)  

        New in 1.1.x:
        - HTTP auth with optional GNOME keyring storage.
        - HTML5 media element support.
        - Spell check support.

        WebKit supports the AT-SPI accessibility layer since version 1.0.x.
        The GNOME accessibility team are working hard with WebKit team to ensure
        WebKit is accessible when GNOME 2.28 is released.

        The libcURL HTTP backend support has been removed from WebKit 1.1.x. The
        default HTTP backend is now libsoup. WebKit uses libsoup to verify the
        peer's certificates for HTTPS connections. Currently, WebKit accepts all
        SSL certificates automatically by default as libsoup doesn't support
        client SSL certificate. Meanwhile, libsoup is also used for HTTP auth
        handling with optional GNOME Keyring support.

        WebKit 1.1.x enables HTML5 Video support by using GStreamer framework
        as the media backend. This makes it possible for the video content to
        be embedded in SVG and manipulated with CSS and JavaScript.

    4.2. Bug/RFE Number(s):

        None.

    4.3. In Scope:

        See above.

    4.4. Out of Scope:

        See above.
    
    4.5. Interfaces:

  This section only hightlights the changes since LSARC/2008/782.

  Exported  Interface:

  Interface                              Stability          Comment        
   ----------------------------------------------------------------------------
  /usr/lib/libwebkit-1.0.so.1            Obsolete Volatile  Symbolic link
  /usr/lib/${MACH64}/libwebkit-1.0.so.1  Obsolete Volatile  Symbolic link
  /usr/lib/libwebkit-1.0.so              Volatile           Symbolic link
  /usr/lib/libwebkit-1.0.so.2            Volatile           Symbolic link
  /usr/lib/libwebkit-1.0.so.2.7.0        Volatile           webkit lib
  /usr/lib/${MACH64}/libwebkit-1.0.so    Volatile           Symbolic link
  /usr/lib/${MACH64}/libwebkit-1.0.so.2  Volatile           Symbolic link
  /usr/lib/${MACH64}/libwebkit-1.0.so.2.7.0
                                         Volatile           64bit webkit lib

  Imported Interfaces:

  Interface                           Stability             Comments 
   ----------------------------------------------------------------------------
  
  cURL                                Obsolete Uncommitted  PSARC/2007/165
  libsoup, GStreamer                  Committed             LSARC/2007/520

    4.6. Doc Impact:

        None.
    
    4.7. I18N/L10N Impact:

        The JDS team and the G11N team are working together to evaluate and
        provide I18N/L10N support.
    
    4.8. Packaging & Delivery:

        The project will be delivering the following packages:
        SUNWwebkit
        SUNWwebkit-devel
    
    4.9. Security Impact:

        WebKit uses libsoup to verify the peer's certificates for HTTPS
        connections, instead of libcurl. Currently, WebKit accepts all
        SSL certificates automatically by default as libsoup doesn't support
        client SSL certificate. Meanwhile, libsoup is also used for HTTP auth
        handling with optional GNOME Keyring support.

    4.10. Dependencies:

        None.

5. Reference Documents:

    1. SUNWwebkit,SUNWwebkit-devel	
       pkgmap
       pkginfo
       depend

    2. XDG Base Directory Specification
       http://standards.freedesktop.org/basedir-spec/latest/ar01s03.html
    
    3. WebKit community
       http://webkit.org/
       http://webkitgtk.org/

    4. WebKit wiki page 
       http://trac.webkit.org/wiki

    5. References for web standards:
       CSS 2.1: http://www.w3.org/TR/CSS21/
       CSS 3: http://www.w3.org/Style/CSS/current-work#CSS3
       DOM: http://www.w3.org/DOM/
       XPath: http://www.w3.org/TR/xpath
       SVG: http://www.w3.org/Graphics/SVG/
       XSLT: http://www.w3.org/TR/xslt
       HTML5: http://www.w3.org/TR/html5/

6. Resources and Schedule
    6.4. Steering Committee requested information
   	6.4.1. Consolidation C-team Name:
		Desktop
    6.5. ARC review type: FastTrack
    6.6. ARC Exposure: open

--
Michael Kearney
Staff Software Engineer

Sun Microsystems, Inc.
MS UBRM05-390, 500 Eldorado Blvd
Broomfield, CO 80021 US
Phone 303-272-2402
Fax 303-272-6554
Email Michael.Kearney@Sun.COM
--Boundary_(ID_hkMpWzpP7GbYDRTclyfFVA) Content-type: text/x-vcard; CHARSET=US-ASCII; name=Michael_Kearney.vcf Content-transfer-encoding: 7BIT Content-disposition: attachment; filename=Michael_Kearney.vcf begin:vcard fn:Michael Kearney n:Kearney;Michael org:Sun Microsystems, Inc.;Archive Core Engineering adr:500 Eldorado Blvd.;;Mailstop UBRM05-390;Broomfield;CO;80021;US email;internet:Michael.Kearney@Sun.com title:Staff Software Engineer tel;work:303-272-2402 tel;fax:303-272-6554 x-mozilla-html:TRUE url:http://www.sun.com/ version:2.1 end:vcard --Boundary_(ID_hkMpWzpP7GbYDRTclyfFVA)-- From James.Walker@Sun.COM Thu Jul 23 08:57:19 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6NFvJHI003492 for ; Thu, 23 Jul 2009 08:57:19 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n6NFvH8H048474 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Thu, 23 Jul 2009 09:57:19 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN80041ZSBIM900@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.COM); Thu, 23 Jul 2009 08:57:18 -0700 (PDT) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN800BM7SBG3Z70@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.COM); Thu, 23 Jul 2009 08:57:16 -0700 (PDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n6NFvGlD015627 for ; Thu, 23 Jul 2009 15:57:16 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KN800J00POSMN00@mail-amer.sun.com> for LSARC-ext@Sun.COM (ORCPT LSARC-ext@Sun.COM); Thu, 23 Jul 2009 09:57:16 -0600 (MDT) Received: from [172.20.25.153] ([unknown] [172.20.25.153]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KN800JH3SB3NT50@mail-amer.sun.com>; Thu, 23 Jul 2009 09:57:04 -0600 (MDT) Date: Thu, 23 Jul 2009 10:15:46 -0600 From: Jim Walker Subject: Re: WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> Sender: James.Walker@Sun.COM To: Brian Cameron Cc: LSARC-ext@Sun.COM, desktop-discuss@opensolaris.org, Alfred.Peng@Sun.COM Reply-to: James.Walker@Sun.COM Message-id: <4A688CB2.6070807@sun.com> Organization: Sun Microsystems, Inc. MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> User-Agent: Thunderbird 2.0.0.14 (X11/20080728) Status: RO Content-Length: 300 Brian Cameron wrote: > 4.8. Packaging & Delivery: > > The project will be delivering the following packages: > SUNWwebkit > SUNWwebkit-devel What's the difference between the two packages if any? Cheers, Jim BTW. You may want to update 1.4.4. OPG is not a BU anymore. From John.Fischer@sun.com Thu Jul 23 09:24:48 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6NGOmkH004713 for ; Thu, 23 Jul 2009 09:24:48 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n6NGOmuL064945 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Thu, 23 Jul 2009 10:24:48 -0600 (MDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN80070RTLAXG00@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 23 Jul 2009 10:24:46 -0600 (MDT) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN8008BZTL9X6D0@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 23 Jul 2009 10:24:46 -0600 (MDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n6NGOjr4002036 for ; Thu, 23 Jul 2009 16:24:45 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KN800I00S7UB700@mail-amer.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 23 Jul 2009 10:24:45 -0600 (MDT) Received: from [192.168.0.103] ([unknown] [76.20.56.47]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KN8006P6TKSC4B0@mail-amer.sun.com>; Thu, 23 Jul 2009 10:24:29 -0600 (MDT) Date: Thu, 23 Jul 2009 09:22:35 -0700 From: John Fischer Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A6871F5.6090606@Sun.com> Sender: John.Fischer@sun.com To: Michael Kearney Cc: Brian Cameron , LSARC-ext@sun.com, desktop-discuss@opensolaris.org Reply-to: John.Fischer@sun.com Message-id: <4A688E4B.9040102@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A6871F5.6090606@Sun.com> User-Agent: Thunderbird 2.0.0.21 (X11/20090505) Status: RO Content-Length: 8608 Michael, The first section is from the sac_nextcase script. The second one is from the form that the project team filled out. John Michael Kearney wrote: > Why is section 1 partially duplicated? > > Brian Cameron wrote: >> Template Version: @(#)sac_nextcase 1.68 02/23/09 SMI >> This information is Copyright 2009 Sun Microsystems >> 1. Introduction >> 1.1. Project/Component Working Name: >> WebKit 1.1.x >> 1.2. Name of Document Author/Supplier: >> Author: Alfred Peng >> 1.3 Date of This Document: >> 23 July, 2009 >> 4. Technical Description >> Copyright 2009 Sun Microsystems >> >> 1. Introduction >> 1.1. Project/Component Working Name: >> >> WebKit 1.1.x >> >> 1.2. Name of Document Author/Supplier: >> >> Alfred Peng >> >> 1.3. Date of This Document: >> >> 07/21/2009 >> >> 1.3.1. Date this project was conceived: >> >> 10/01/2006 >> >> 1.4. Name of Major Document Customer(s)/Consumer(s): >> >> 1.4.1. The PAC or CPT you expect to review your project: >> >> Solaris PAC >> >> 1.4.2. The ARC(s) you expect to review your project: >> >> LSARC >> >> 1.4.3. The Director/VP who is "Sponsoring" this project: >> >> robert.odea@sun.com >> >> 1.4.4. The name of your business unit: >> >> Software - OPG >> >> 1.5. Email Aliases: >> >> 1.5.1. Responsible Manager: >> >> leo.binchy@sun.com >> >> 1.5.2. Responsible Engineer: >> >> alfred.peng@sun.com >> >> 1.5.3. Marketing Manager: >> >> glynn.foster@sun.com >> >> 1.5.4. Interest List: >> >> desktop-discuss@opensolaris.org >> >> 2. Project Summary >> 2.1. Project Description: >> >> WebKit is an open source web browser engine. It's also the name of the >> Mac OS X system framework version of the engine that's used by Safari, >> Dashboard, Mail, and many other OS X applications. WebKit's HTML and >> JavaScript code began as a branch of the KHTML and KJS libraries from >> KDE. >> >> WebKit can be built on top of different widget backends, which includes >> GTK, Qt, wxWidgets and some others as well. For this case, WebKit will >> be built with GTK+ on Solaris. It's the engine that will be used for >> embedding a browser in various GNOME applications, devhelp/yelp for >> example. >> >> WebKitGTK+ is a community sub-project maintained mostly by GNOME and >> GTK+ developers. It's implemented directly on top of GTK+, GLib and >> GNOME libraries and provides lightweight web viewing and editing >> features as well as being the basis for complete web browser >> applications. It supports the latest web standards and offers good >> performance and memory usage characteristics on the desktop. >> >> The release schedule for WebKitGTK+ will be matched with GNOME's >> 6-month release cycle. Currently, GNOME applications including >> devhelp/epiphany have switched to link against WebKit. >> >> 4. Technical Description: >> 4.1. Details: >> >> WebKit has the following features: >> - CSS 2.1, CSS3 support. >> - DOM (Document Object Model) >> - Styleable form controls with CSS. >> - Drosera (A JavaScript debugger for WebKit that can be used >> with any application that uses WebKit) >> - Enhanced Rich Text Editing. >> - XML techologies support, including XPath, SVG and XSLTProcessor >> (JavaScript API for XSLT). >> - Netscape-style (NPAPI) plugins support. >> - WebKit embedding API (provides clients with a public API for >> loading, displaying and manipulating Web content.) >> >> New in 1.1.x: >> - HTTP auth with optional GNOME keyring storage. >> - HTML5 media element support. >> - Spell check support. >> >> WebKit supports the AT-SPI accessibility layer since version 1.0.x. >> The GNOME accessibility team are working hard with WebKit team to ensure >> WebKit is accessible when GNOME 2.28 is released. >> >> The libcURL HTTP backend support has been removed from WebKit 1.1.x. The >> default HTTP backend is now libsoup. WebKit uses libsoup to verify the >> peer's certificates for HTTPS connections. Currently, WebKit accepts all >> SSL certificates automatically by default as libsoup doesn't support >> client SSL certificate. Meanwhile, libsoup is also used for HTTP auth >> handling with optional GNOME Keyring support. >> >> WebKit 1.1.x enables HTML5 Video support by using GStreamer framework >> as the media backend. This makes it possible for the video content to >> be embedded in SVG and manipulated with CSS and JavaScript. >> >> 4.2. Bug/RFE Number(s): >> >> None. >> >> 4.3. In Scope: >> >> See above. >> >> 4.4. Out of Scope: >> >> See above. >> >> 4.5. Interfaces: >> >> This section only hightlights the changes since LSARC/2008/782. >> >> Exported Interface: >> >> Interface Stability Comment >> ---------------------------------------------------------------------------- >> /usr/lib/libwebkit-1.0.so.1 Obsolete Volatile Symbolic link >> /usr/lib/${MACH64}/libwebkit-1.0.so.1 Obsolete Volatile Symbolic link >> /usr/lib/libwebkit-1.0.so Volatile Symbolic link >> /usr/lib/libwebkit-1.0.so.2 Volatile Symbolic link >> /usr/lib/libwebkit-1.0.so.2.7.0 Volatile webkit lib >> /usr/lib/${MACH64}/libwebkit-1.0.so Volatile Symbolic link >> /usr/lib/${MACH64}/libwebkit-1.0.so.2 Volatile Symbolic link >> /usr/lib/${MACH64}/libwebkit-1.0.so.2.7.0 >> Volatile 64bit webkit lib >> >> Imported Interfaces: >> >> Interface Stability Comments >> ---------------------------------------------------------------------------- >> >> cURL Obsolete Uncommitted PSARC/2007/165 >> libsoup, GStreamer Committed LSARC/2007/520 >> >> 4.6. Doc Impact: >> >> None. >> >> 4.7. I18N/L10N Impact: >> >> The JDS team and the G11N team are working together to evaluate and >> provide I18N/L10N support. >> >> 4.8. Packaging & Delivery: >> >> The project will be delivering the following packages: >> SUNWwebkit >> SUNWwebkit-devel >> >> 4.9. Security Impact: >> >> WebKit uses libsoup to verify the peer's certificates for HTTPS >> connections, instead of libcurl. Currently, WebKit accepts all >> SSL certificates automatically by default as libsoup doesn't support >> client SSL certificate. Meanwhile, libsoup is also used for HTTP auth >> handling with optional GNOME Keyring support. >> >> 4.10. Dependencies: >> >> None. >> >> 5. Reference Documents: >> >> 1. SUNWwebkit,SUNWwebkit-devel >> pkgmap >> pkginfo >> depend >> >> 2. XDG Base Directory Specification >> http://standards.freedesktop.org/basedir-spec/latest/ar01s03.html >> >> 3. WebKit community >> http://webkit.org/ >> http://webkitgtk.org/ >> >> 4. WebKit wiki page >> http://trac.webkit.org/wiki >> >> 5. References for web standards: >> CSS 2.1: http://www.w3.org/TR/CSS21/ >> CSS 3: http://www.w3.org/Style/CSS/current-work#CSS3 >> DOM: http://www.w3.org/DOM/ >> XPath: http://www.w3.org/TR/xpath >> SVG: http://www.w3.org/Graphics/SVG/ >> XSLT: http://www.w3.org/TR/xslt >> HTML5: http://www.w3.org/TR/html5/ >> >> 6. Resources and Schedule >> 6.4. Steering Committee requested information >> 6.4.1. Consolidation C-team Name: >> Desktop >> 6.5. ARC review type: FastTrack >> 6.6. ARC Exposure: open >> >> >> > > -- > * Michael Kearney * > Staff Software Engineer > > *Sun Microsystems, Inc.* > MS UBRM05-390, 500 Eldorado Blvd > Broomfield, CO 80021 US > Phone 303-272-2402 > Fax 303-272-6554 > Email Michael.Kearney@Sun.COM > > > _______________________________________________ > desktop-discuss mailing list > desktop-discuss@opensolaris.org From John.Fischer@sun.com Thu Jul 23 09:27:06 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6NGR5dN004729 for ; Thu, 23 Jul 2009 09:27:05 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n6NGR2ti016082 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Thu, 23 Jul 2009 17:27:04 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN800A0RTP4ET00@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 23 Jul 2009 09:27:04 -0700 (PDT) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN800BAMTP24890@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 23 Jul 2009 09:27:02 -0700 (PDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n6NGR2tT014951 for ; Thu, 23 Jul 2009 16:27:02 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KN800000SCZUR00@mail-amer.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 23 Jul 2009 10:27:02 -0600 (MDT) Received: from [192.168.0.103] ([unknown] [76.20.56.47]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KN8006ULTOYC4C0@mail-amer.sun.com>; Thu, 23 Jul 2009 10:26:59 -0600 (MDT) Date: Thu, 23 Jul 2009 09:25:06 -0700 From: John Fischer Subject: Re: WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A688CB2.6070807@sun.com> Sender: John.Fischer@sun.com To: James.Walker@sun.com Cc: Brian Cameron , LSARC-ext@sun.com, desktop-discuss@opensolaris.org, Alfred.Peng@sun.com Reply-to: John.Fischer@sun.com Message-id: <4A688EE2.5010403@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A688CB2.6070807@sun.com> User-Agent: Thunderbird 2.0.0.21 (X11/20090505) Status: RO Content-Length: 705 Jim, The OSD (formerly JDS) group will have both a regular end user package and a developer package. The developer package will typically contain things relating to header files, package configuration scripts and sometimes developer documentation. Other packages that you will see with the OSD group will be root (and used to have doc) packages. Thanks, John Jim Walker wrote: > Brian Cameron wrote: >> 4.8. Packaging & Delivery: >> >> The project will be delivering the following packages: >> SUNWwebkit >> SUNWwebkit-devel > > What's the difference between the two packages if any? > > Cheers, > Jim > > BTW. You may want to update 1.4.4. OPG is not a BU > anymore. From storycrafter@gmail.com Thu Jul 23 11:09:10 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6NI99iP009444 for ; Thu, 23 Jul 2009 11:09:10 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n6NI93ak020178; Thu, 23 Jul 2009 19:09:09 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN800509YF6VJ00@nwk-avmta-1.sfbay.Sun.COM>; Thu, 23 Jul 2009 11:09:06 -0700 (PDT) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN8001ZAYF5NB10@nwk-avmta-1.sfbay.Sun.COM>; Thu, 23 Jul 2009 11:09:05 -0700 (PDT) Received: from relay43i.sun.com ([192.5.209.74]) by brmea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n6NHpM51029356; Thu, 23 Jul 2009 18:09:05 +0000 (GMT) Received: from mmp43es.mmp.us.syntegra.com ([160.41.221.12] [160.41.221.12]) by relay43i.sun.com with ESMTP id BT-MMP-787495; Thu, 23 Jul 2009 18:09:05 +0000 (Z) Received: from relay45i.sun.com (relay45i.sun.com [192.5.209.94]) by mmp43es.mmp.us.syntegra.com with ESMTP id BT-MMP-16133065; Thu, 23 Jul 2009 17:38:19 +0000 (Z) Received: from ey-out-1920.google.com ([74.125.78.147] [74.125.78.147]) by relay4i.sun.com with ESMTP id BT-MMP-17332370; Thu, 23 Jul 2009 17:38:19 +0000 (Z) Received: by ey-out-1920.google.com with SMTP id 13so289642eye.50 for ; Thu, 23 Jul 2009 10:37:28 -0700 (PDT) Received: by 10.210.111.5 with SMTP id j5mr2974508ebc.55.1248370648679; Thu, 23 Jul 2009 10:37:28 -0700 (PDT) Received: from ?172.16.202.89? (68-252-106-20.ded.ameritech.net [68.252.106.20]) by mx.google.com with ESMTPS id 28sm719554eye.30.2009.07.23.10.37.26 (version=TLSv1/SSLv3 cipher=RC4-MD5) ; Thu, 23 Jul 2009 10:37:27 -0700 (PDT) Date: Thu, 23 Jul 2009 12:37:24 -0500 From: Mark Martin Subject: Re: WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> To: Brian Cameron Cc: LSARC-ext@sun.com, desktop-discuss@opensolaris.org, Alfred.Peng@sun.com Message-id: <4A689FD4.1070502@gmail.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from :user-agent:mime-version:to:cc:subject:references:in-reply-to :content-type:content-transfer-encoding; bh=UYPCRL/UgWduOjCtm8m6rXJ34Nt9CBnCa1ghlTSFzX4=; b=ER65wjWU6diLzfr07fNBtmZXJ9YaXFSNOTYLetIW3tpGxpQxq7U4yhTYtI0+v2/NcH 4/RFkGjGCzZ3BafnUOCdAZ9tjqN1tWEpXj8WA18gmEgsdwkHeJP6+uG+b+N1GriB7wsI LoeTT06HaIJG8UlCvNUhEFQD69pKbq2As7b3w= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=trtWAFMAS5Q1Dw2nMUA+6hqFXJiKeFKE7BCaQLx58EoMDNkuIHc7k6PajrdCtZ+oBM h1rCBnzYBYNuxOfh15nJJw52a1gpHDK6gjvW8a6XFLZIXKlQ9M/20ySodyYDbPLUOt9D G3c4oZXz8ieVOEdh/G25jnpN4x3egbgvty+0k= X-PMX-Version: 5.4.1.325704 X-Brightmail-Tracker: AAAAAA== X-Antispam: No, score=0.0/5.0, scanned in 4.361sec at (localhost [127.0.0.1]) by smf-spamd v1.3.1 - http://smfs.sf.net/ References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) Status: RO Content-Length: 964 Brian Cameron wrote: > The libcURL HTTP backend support has been removed from WebKit 1.1.x. The > default HTTP backend is now libsoup. WebKit uses libsoup to verify the > peer's certificates for HTTPS connections. Currently, WebKit accepts all > SSL certificates automatically by default as libsoup doesn't support > client SSL certificate. Meanwhile, libsoup is also used for HTTP auth > handling with optional GNOME Keyring support. > I had some concern regarding the SSL certifcate support mentioned here. The research I've done indicates that libsoup would support certificate validation if the app (i.e. consumers of WebKit?) passes a CA certificate file, but by default, does not require this and exhibits the behavior you describe. Could you please confirm this? That puts the onus of providing CA certificate file configuration to consumers of the WebKit library that want validation, correct? From James.Walker@Sun.COM Thu Jul 23 12:52:38 2009 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6NJqbWc014683 for ; Thu, 23 Jul 2009 12:52:37 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n6NJqaNE026100 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Thu, 23 Jul 2009 12:52:37 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN90011D37PNV00@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.COM); Thu, 23 Jul 2009 12:52:37 -0700 (PDT) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN90014D37NNHD0@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.COM); Thu, 23 Jul 2009 12:52:35 -0700 (PDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n6NJqZ1T016983 for ; Thu, 23 Jul 2009 19:52:35 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KN900A001L1QR00@mail-amer.sun.com> for LSARC-ext@Sun.COM (ORCPT LSARC-ext@Sun.COM); Thu, 23 Jul 2009 13:52:35 -0600 (MDT) Received: from [172.20.25.153] ([unknown] [172.20.25.153]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KN9007DN37FZ260@mail-amer.sun.com> for LSARC-ext@Sun.COM (ORCPT LSARC-ext@Sun.COM); Thu, 23 Jul 2009 13:52:28 -0600 (MDT) Date: Thu, 23 Jul 2009 14:11:10 -0600 From: Jim Walker Subject: Re: WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A688EE2.5010403@sun.com> Sender: James.Walker@Sun.COM To: Brian Cameron Cc: LSARC-ext@Sun.COM, desktop-discuss@opensolaris.org, Alfred.Peng@Sun.COM Reply-to: James.Walker@Sun.COM Message-id: <4A68C3DE.40606@sun.com> Organization: Sun Microsystems, Inc. MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A688CB2.6070807@sun.com> <4A688EE2.5010403@sun.com> User-Agent: Thunderbird 2.0.0.14 (X11/20080728) Status: RO Content-Length: 1022 John Fischer wrote: > Jim, > > The OSD (formerly JDS) group will have both a regular end user package > and a developer package. The developer package will typically contain > things relating to header files, package configuration scripts and > sometimes developer documentation. Other packages that you will see > with the OSD group will be root (and used to have doc) packages. Thanks John. This brings up another point. This case is a delta case for LSARC/2008/782. http://arc.opensolaris.org/caselog/LSARC/2008/782/mail What version of WebKit will be included in the package(s)? It looks like 1.1.11 is the current version. Are there any header file changes, so the header file directory should at least be listed? Is this directory going to continue to be used? /usr/include/webkit-1.0 Are these files going to continue to be used? /usr/lib/pkgconfig/webkit-1.0.pc /usr/lib/${MACH64}/pkgconfig/webkit-1.0.pc libwebkit-1.0* is being used in the library naming instead of libwebkit-1.1* why? Cheers, Jim From John.Fischer@sun.com Thu Jul 23 13:22:46 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6NKMkuq015646 for ; Thu, 23 Jul 2009 13:22:46 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n6NKMjQt058587 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Thu, 23 Jul 2009 14:22:46 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN9002014LXAN00@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 23 Jul 2009 13:22:45 -0700 (PDT) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN900JHL4LWD080@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 23 Jul 2009 13:22:45 -0700 (PDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n6NKMi99028603 for ; Thu, 23 Jul 2009 20:22:44 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KN9009004D99300@mail-amer.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 23 Jul 2009 14:22:44 -0600 (MDT) Received: from [192.168.0.103] ([unknown] [76.20.56.47]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KN900JGQ4LU5YD0@mail-amer.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 23 Jul 2009 14:22:42 -0600 (MDT) Date: Thu, 23 Jul 2009 13:20:49 -0700 From: John Fischer Subject: Re: WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A68C3DE.40606@sun.com> Sender: John.Fischer@sun.com To: James.Walker@sun.com Cc: Brian Cameron , LSARC-ext@sun.com, desktop-discuss@opensolaris.org, Alfred.Peng@sun.com Reply-to: John.Fischer@sun.com Message-id: <4A68C621.9080008@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A688CB2.6070807@sun.com> <4A688EE2.5010403@sun.com> <4A68C3DE.40606@sun.com> User-Agent: Thunderbird 2.0.0.21 (X11/20090505) Status: RO Content-Length: 2233 Jim, Most of these I can not answer but I can answer the library version question because I asked it prior to the fast track submission. I'll let the project team answer the others and they can correct me if I am wrong. Note, I am not part of this project just know enough about it to answer some of these issues. To build the project the team uses the JDS build environment which uses a spec file. The spec file usually simply packages what ever is built during the build process. Thus if a component of the project installs into a versioned directory then the packaging will reflect that fact. Most of your questions revolve around why things are installed into a specific versioned directory or file and should now be answered. Furthermore, the project team is simply following what is being done within the community. The community bumped the version of the library from libwebkit-1.0.so.1 to libwebkit-1.0.so.2. Thus the project team followed suite. I had hoped that they would have explained this within the proposal prior to submission because it is a fairly obvious ARC type of question. Thanks, John Jim Walker wrote: > John Fischer wrote: >> Jim, >> >> The OSD (formerly JDS) group will have both a regular end user package >> and a developer package. The developer package will typically contain >> things relating to header files, package configuration scripts and >> sometimes developer documentation. Other packages that you will see >> with the OSD group will be root (and used to have doc) packages. > > Thanks John. > > This brings up another point. This case is a delta case for > LSARC/2008/782. > > http://arc.opensolaris.org/caselog/LSARC/2008/782/mail > > What version of WebKit will be included in the package(s)? > > It looks like 1.1.11 is the current version. > > Are there any header file changes, so the header file directory > should at least be listed? > > Is this directory going to continue to be used? > > /usr/include/webkit-1.0 > > Are these files going to continue to be used? > > /usr/lib/pkgconfig/webkit-1.0.pc > /usr/lib/${MACH64}/pkgconfig/webkit-1.0.pc > > libwebkit-1.0* is being used in the library naming instead of > libwebkit-1.1* why? > > Cheers, > Jim From Alfred.Peng@sun.com Fri Jul 24 03:14:08 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6OAE8lm015615 for ; Fri, 24 Jul 2009 03:14:08 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n6OAE7mI017434 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Fri, 24 Jul 2009 04:14:08 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KNA00G0573J0R00@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 24 Jul 2009 03:14:07 -0700 (PDT) Received: from sineb-mail-2.sun.com ([192.18.19.7]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KNA00F4G73FYD00@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 24 Jul 2009 03:14:06 -0700 (PDT) Received: from fe-apac-05.sun.com (fe-apac-05.sun.com [192.18.19.176] (may be forged)) by sineb-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n6OAE3XD008805 for ; Fri, 24 Jul 2009 10:14:03 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KNA007007327600@mail-apac.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 24 Jul 2009 18:14:03 +0800 (SGT) Received: from [172.22.165.44] ([unknown] [155.69.195.151]) by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KNA00FV873EQVC0@mail-apac.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 24 Jul 2009 18:14:02 +0800 (SGT) Date: Fri, 24 Jul 2009 18:14:06 +0800 From: Alfred Peng Subject: Re: WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A68C621.9080008@sun.com> Sender: Alfred.Peng@sun.com To: John.Fischer@sun.com Cc: James.Walker@sun.com, Brian Cameron , LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <4A69896E.40802@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A688CB2.6070807@sun.com> <4A688EE2.5010403@sun.com> <4A68C3DE.40606@sun.com> <4A68C621.9080008@sun.com> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1.1) Gecko/20090721 Thunderbird/3.0b3 Status: RO Content-Length: 5601 Hi John, Sorry for not making things clear before the arc submission. Previously, we submitted the arc case LSARC/2008/782 to integrate WebKit 1.0.x to OpenSolaris for GNOME 2.26. Actually, there was no official release for WebKit GTK port at that time. We just grabbed the version information from configure.ac: m4_define([webkit_major_version], [1]) m4_define([webkit_minor_version], [0]) m4_define([webkit_micro_version], [3]) and considered it to be 1.0.3. The community didn't update the library version information back then as suggested by the GNU community[1], since everything was still under development without any release. The WebKit library version stayed "LIBWEBKITGTK_VERSION=1:0:0" for some time. Later on, GNOME community decided to delay the WebKit integration until GNOME 2.28. So we didn't integrate WebKit and also postponed the schedule. Since WebKit 1.1.x, the community decided to break ABI compatibility (refer to ChangeLog) and add some new major features (migrate from libcURL to libsoup, HTML5 media elements support etc.). Most importantly, they started to provide tarball releases. The 1.1.1 release should be the time when the library version was bumped from libwebkit-1.0.so.1 to libwebkit-1.0.so.2 (LIBWEBKITGTK_VERSION=2:0:0). Since then, they followed the suggestions from GNU to update the library version for each tarball releases, up until the latest one 1.1.11 (LIBWEBKITGTK_VERSION=10:0:8=>/usr/lib/libwebkit-1.0.so.2.8.0). The library will stay at "libwebkit-1.0.so.2" until the next major release. The "current"[1] and "age"[1] of the library version should keep changing in future 1.1.x release. So the WebKit library file will be "/usr/lib/libwebkit-1.0.so.2.x.0". Hi Jim, I'm not sure which WebKit version will be integrated as the community releases source tarball release frequently (the latest one is 1.1.11). That's the reason we put 1.1.x in the arc case. If the interfaces are changed in future WebKit 1.1.x release, I think another arc case will be necessary. As John mentioned, we usually follow what the community choose to do. The header files are installed to /usr/include/webkit-1.0 with the community release tarball, and the pc file is still called libwebkit-1.0.pc. This might be the community convention. We could take a look at GTK+ for comparison. The GTK+ version on my OpenSolaris b118 box is now 2.16.1. And: $ ls -ld /usr/include/gtk-2.0/ drwxr-xr-x 6 root bin 6 2009-04-29 17:14 /usr/include/gtk-2.0/ $ ls -l /usr/lib/pkgconfig/gtk+-2.0.pc -rw-r--r-- 1 root bin 359 2009-06-21 01:40 /usr/lib/pkgconfig/gtk+-2.0.pc Since there is no official WebKit 1.0.x release, I think it should be fine to still use webkit-1.0 to refer to 1.x release. As for the header files, I just compare the new pkgmap with the old one. They contain the same set of files. On the other hand, the "Exported Interface" /usr/include/webkit-1.0 was declared to be Volatile in the previously arc. I think it's not necessary to list the file changes in that folder. Please correct me if I'm wrong. Hope this address all the questions. Best Regards, -Alfred [1] http://www.gnu.org/software/libtool/manual/html_node/Updating-version-info.html#Updating-version-info. On 07/24/09 04:20 AM, John Fischer wrote: > Jim, > > Most of these I can not answer but I can answer the library version > question because I asked it prior to the fast track submission. I'll > let the project team answer the others and they can correct me if I > am wrong. Note, I am not part of this project just know enough about > it to answer some of these issues. > > To build the project the team uses the JDS build environment which > uses a spec file. The spec file usually simply packages what ever is > built during the build process. Thus if a component of the project > installs into a versioned directory then the packaging will reflect > that fact. Most of your questions revolve around why things are > installed into a specific versioned directory or file and should > now be answered. > > Furthermore, the project team is simply following what is being done > within the community. The community bumped the version of the library > from libwebkit-1.0.so.1 to libwebkit-1.0.so.2. Thus the project team > followed suite. I had hoped that they would have explained this > within the proposal prior to submission because it is a fairly obvious > ARC type of question. > > Thanks, > > John > > > > > > Jim Walker wrote: > >> John Fischer wrote: >> >>> Jim, >>> >>> The OSD (formerly JDS) group will have both a regular end user package >>> and a developer package. The developer package will typically contain >>> things relating to header files, package configuration scripts and >>> sometimes developer documentation. Other packages that you will see >>> with the OSD group will be root (and used to have doc) packages. >>> >> Thanks John. >> >> This brings up another point. This case is a delta case for >> LSARC/2008/782. >> >> http://arc.opensolaris.org/caselog/LSARC/2008/782/mail >> >> What version of WebKit will be included in the package(s)? >> >> It looks like 1.1.11 is the current version. >> >> Are there any header file changes, so the header file directory >> should at least be listed? >> >> Is this directory going to continue to be used? >> >> /usr/include/webkit-1.0 >> >> Are these files going to continue to be used? >> >> /usr/lib/pkgconfig/webkit-1.0.pc >> /usr/lib/${MACH64}/pkgconfig/webkit-1.0.pc >> >> libwebkit-1.0* is being used in the library naming instead of >> libwebkit-1.1* why? >> >> Cheers, >> Jim >> From Alfred.Peng@sun.com Fri Jul 24 03:52:03 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6OAq3tb015956 for ; Fri, 24 Jul 2009 03:52:03 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n6OAq2a0034579 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Fri, 24 Jul 2009 04:52:03 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KNA0010B8UQ1E00@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 24 Jul 2009 03:52:02 -0700 (PDT) Received: from sineb-mail-2.sun.com ([192.18.19.7]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KNA006RQ8UPZ250@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 24 Jul 2009 03:52:02 -0700 (PDT) Received: from fe-apac-06.sun.com (fe-apac-06.sun.com [192.18.19.177] (may be forged)) by sineb-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n6OAq0CD010307 for ; Fri, 24 Jul 2009 10:52:00 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KNA000008MM9J00@mail-apac.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 24 Jul 2009 18:52:00 +0800 (SGT) Received: from [172.22.165.44] ([unknown] [155.69.195.151]) by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KNA00LMJ8UOB8A0@mail-apac.sun.com>; Fri, 24 Jul 2009 18:52:00 +0800 (SGT) Date: Fri, 24 Jul 2009 18:52:03 +0800 From: Alfred Peng Subject: Re: WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A689FD4.1070502@gmail.com> Sender: Alfred.Peng@sun.com To: Mark Martin Cc: Brian Cameron , LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <4A699253.7070700@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A689FD4.1070502@gmail.com> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1.1) Gecko/20090721 Thunderbird/3.0b3 Status: RO Content-Length: 1588 Hi Mark, Thanks for pointing this out. The consumers of libsoup can point a file containing certificates for recognized SSL Certificate Authorities. HTTPS connections will be checked against these authorities, and rejected if they can't be verified (http://library.gnome.org/devel/libsoup/stable/libsoup-client-howto.html). On the WebKit side, it doesn't set any authorities and accepts all SSL certificates automatically. This could be a RFE for WebKit so that consumers of WebKit can pass the certificate for verification. Thanks, -Alfred On 07/24/09 01:37 AM, Mark Martin wrote: > Brian Cameron wrote: > >> The libcURL HTTP backend support has been removed from WebKit 1.1.x. The >> default HTTP backend is now libsoup. WebKit uses libsoup to verify the >> peer's certificates for HTTPS connections. Currently, WebKit accepts all >> SSL certificates automatically by default as libsoup doesn't support >> client SSL certificate. Meanwhile, libsoup is also used for HTTP auth >> handling with optional GNOME Keyring support. >> >> > > I had some concern regarding the SSL certifcate support mentioned here. > The research I've done indicates that libsoup would support certificate > validation if the app (i.e. consumers of WebKit?) passes a CA > certificate file, but by default, does not require this and exhibits the > behavior you describe. Could you please confirm this? That puts the > onus of providing CA certificate file configuration to consumers of the > WebKit library that want validation, correct? From James.Walker@sun.com Fri Jul 24 08:40:37 2009 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6OFeb5O026900 for ; Fri, 24 Jul 2009 08:40:37 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n6OFeb2Y015672 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Fri, 24 Jul 2009 08:40:37 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KNA00E0TM7PTI00@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 24 Jul 2009 08:40:37 -0700 (PDT) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KNA009ZCM7OBB60@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 24 Jul 2009 08:40:36 -0700 (PDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n6OFea6t028200 for ; Fri, 24 Jul 2009 15:40:36 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KNA00400M09BU00@mail-amer.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 24 Jul 2009 09:40:36 -0600 (MDT) Received: from [172.20.25.153] ([unknown] [172.20.25.153]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KNA006BFM7A18F0@mail-amer.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 24 Jul 2009 09:40:22 -0600 (MDT) Date: Fri, 24 Jul 2009 09:59:10 -0600 From: Jim Walker Subject: Re: WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A69896E.40802@sun.com> Sender: James.Walker@sun.com To: Alfred Peng Cc: John.Fischer@sun.com, Brian Cameron , LSARC-ext@sun.com, desktop-discuss@opensolaris.org Reply-to: James.Walker@sun.com Message-id: <4A69DA4E.9080800@sun.com> Organization: Sun Microsystems, Inc. MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A688CB2.6070807@sun.com> <4A688EE2.5010403@sun.com> <4A68C3DE.40606@sun.com> <4A68C621.9080008@sun.com> <4A69896E.40802@sun.com> User-Agent: Thunderbird 2.0.0.14 (X11/20080728) Status: RO Content-Length: 566 Alfred Peng wrote: > > As for the header files, I just compare the new pkgmap with the old one. > They contain the same set of files. On the other hand, the "Exported > Interface" /usr/include/webkit-1.0 was declared to be Volatile in the > previously arc. I think it's not necessary to list the file changes in > that folder. Please correct me if I'm wrong. That's fine. You don't need to list the header files for diffs. I just wanted to make sure ../webkit-1.0* was still being used. Thanks for the detail on the versioning. It is non-standard :) Cheers, Jim From storycrafter@gmail.com Thu Jul 30 11:14:24 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6UIEOf0021243 for ; Thu, 30 Jul 2009 11:14:24 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n6UIEHu0003803; Thu, 30 Jul 2009 11:14:22 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KNL00L0BXBYIC00@brm-avmta-1.central.sun.com>; Thu, 30 Jul 2009 12:14:22 -0600 (MDT) Received: from sca-ea-mail-3.sun.com ([192.18.43.21]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KNL00KU4XBX2F00@brm-avmta-1.central.sun.com>; Thu, 30 Jul 2009 12:14:22 -0600 (MDT) Received: from relay44i.sun.com ([192.5.209.118]) by sca-ea-mail-3.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n6UI2A22011972; Thu, 30 Jul 2009 18:14:21 +0000 (GMT) Received: from mmp41es.mmp.us.syntegra.com ([160.41.221.10] [160.41.221.10]) by relay44i.sun.com with ESMTP id BT-MMP-325749; Thu, 30 Jul 2009 18:14:21 +0000 (Z) Received: from relay44i.sun.com (relay44i.sun.com [192.5.209.118]) by mmp41es.mmp.us.syntegra.com with ESMTP id BT-MMP-29651797; Thu, 30 Jul 2009 18:14:17 +0000 (Z) Received: from rv-out-0708.google.com ([209.85.198.240] [209.85.198.240]) by relay4i.sun.com with ESMTP id BT-MMP-7140678; Thu, 30 Jul 2009 18:14:17 +0000 (Z) Received: by rv-out-0708.google.com with SMTP id f25so437844rvb.8 for ; Thu, 30 Jul 2009 11:14:00 -0700 (PDT) Received: by 10.141.41.16 with SMTP id t16mr1096070rvj.258.1248977640540; Thu, 30 Jul 2009 11:14:00 -0700 (PDT) Received: from ?172.16.202.89? (68-252-106-20.ded.ameritech.net [68.252.106.20]) by mx.google.com with ESMTPS id b39sm13645983rvf.23.2009.07.30.11.13.58 (version=TLSv1/SSLv3 cipher=RC4-MD5); Thu, 30 Jul 2009 11:13:59 -0700 (PDT) Date: Thu, 30 Jul 2009 13:13:57 -0500 From: Mark Martin Subject: Re: WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A699253.7070700@sun.com> To: Alfred Peng Cc: Brian Cameron , LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <4A71E2E5.4050002@gmail.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from :user-agent:mime-version:to:cc:subject:references:in-reply-to :content-type:content-transfer-encoding; bh=0gk6ZJ6RW5NDqGof6Yc60cKyhiJVAeXzU5QpAGSgu3k=; b=gCGk3QeFs5U6eorQvFMufO5fgrpTUbNh3sKGxU/r6qkXbJ8P2yQCXifSjmvRNd22Hz dHipb8JL5CCjMkAhvFHyr5XodiJemtP5JQRmrOsjl8IofExCCxVbVxG7Aag1RZoN0iLH vDWS5z39ADIV3aaJc1fZdmLbfiCWT+luBvp/w= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=VuH+dT+QPf2bkOn4x4adfUcMt0Qbddg08eQHgIPrCFShORKKdQtbCDy8DL7mLTrpQV b1icDA14upOXZvm+9FPjfHIwJAsEhnVrV2xMqPvGElW5Vd1MLSdwpBWY3s/Q8gbRdOhq zSujA8lLJkTowGSx9CElVHxCSbREpdscudA1c= X-PMX-Version: 5.4.1.325704 X-Brightmail-Tracker: AAAAAA== X-Antispam: No, score=-0.7/5.0, scanned in 3.440sec at (localhost [127.0.0.1]) by smf-spamd v1.3.1 - http://smfs.sf.net/ References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A689FD4.1070502@gmail.com> <4A699253.7070700@sun.com> User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) Status: RO Content-Length: 1617 Alfred Peng wrote: > Hi Mark, > > Thanks for pointing this out. > > The consumers of libsoup can point a file containing certificates for > recognized SSL Certificate Authorities. HTTPS connections will be > checked against these authorities, and rejected if they can't be > verified > (http://library.gnome.org/devel/libsoup/stable/libsoup-client-howto.html). > On the WebKit side, it doesn't set any authorities and accepts all SSL > certificates automatically. > > This could be a RFE for WebKit so that consumers of WebKit can pass the > certificate for verification. > Seems like we went from the prior WebKit (2008/782) requiring an override to accept all SSL to having that behavior by default. As in the original case (2008/782), this certainly seems appropriate for a documentation admonishment. I'd say that'd be quite a violation of user expectation to silently, by default, accept all certificates. I believe the stakes are raised, so I'm not sure if the "NOTES" section is the right place for this as it was in the last case. Before, risky behavior was only available with an override to the it-doesnt-work-at-all behavior. Now, it's the default. I don't know what the answer is, though, if it's not NOTES. "Beware, all ye consumers of WebKit: unless you pass a certificate for validation, SSL certificate validation is not enforced, and all certificates are considered valid, including those that really aren't.". As for an RFE, could you clarify a little on that? An RFE to enable users to pass the certificate in the first place? It's not even available as delivered here? From Alfred.Peng@sun.com Fri Jul 31 00:45:10 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6V7j9tQ022975 for ; Fri, 31 Jul 2009 00:45:10 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n6V7j1rg057670 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Fri, 31 Jul 2009 01:45:09 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KNM00201YV8WW00@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 31 Jul 2009 00:45:08 -0700 (PDT) Received: from sineb-mail-2.sun.com ([192.18.19.7]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KNM00HG5YV7HQ80@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 31 Jul 2009 00:45:08 -0700 (PDT) Received: from fe-apac-06.sun.com (fe-apac-06.sun.com [192.18.19.177] (may be forged)) by sineb-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n6V7j6bf015047 for ; Fri, 31 Jul 2009 07:45:06 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KNM00D00YOCLN00@mail-apac.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 31 Jul 2009 15:45:06 +0800 (SGT) Received: from [172.22.129.177] ([unknown] [155.69.197.206]) by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KNM00LJMYUG3W70@mail-apac.sun.com>; Fri, 31 Jul 2009 15:44:45 +0800 (SGT) Date: Fri, 31 Jul 2009 15:44:43 +0800 From: Alfred Peng Subject: Re: WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A71E2E5.4050002@gmail.com> Sender: Alfred.Peng@sun.com To: Mark Martin Cc: Brian Cameron , LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <4A72A0EB.7050906@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A689FD4.1070502@gmail.com> <4A699253.7070700@sun.com> <4A71E2E5.4050002@gmail.com> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1.1) Gecko/20090721 Thunderbird/3.0b3 Status: RO Content-Length: 2106 Hi Mark, On 07/31/09 02:13 AM, Mark Martin wrote: > Seems like we went from the prior WebKit (2008/782) requiring an > override to accept all SSL to having that behavior by default. > Yes, since the http backend was switched from libcURL to libsoup, the default behavior was changed in the latest WebKit to compare with the last one (2008/782). > As in the original case (2008/782), this certainly seems appropriate for > a documentation admonishment. I'd say that'd be quite a violation of > user expectation to silently, by default, accept all certificates. I > believe the stakes are raised, so I'm not sure if the "NOTES" section is > the right place for this as it was in the last case. Before, risky > behavior was only available with an override to the > it-doesnt-work-at-all behavior. Now, it's the default. I don't know > what the answer is, though, if it's not NOTES. > > "Beware, all ye consumers of WebKit: unless you pass a certificate for > validation, SSL certificate validation is not enforced, and all > certificates are considered valid, including those that really aren't.". > > As for an RFE, could you clarify a little on that? An RFE to enable > users to pass the certificate in the first place? It's not even > available as delivered here? > Sorry for not making things clear. libsoup does provide the support for passing certificate through the soup session. But WebKit doesn't. This is consistent with the last case 2008/782. The RFE could be to add certain API to WebKit and enable user/WebKit consumers specified certificate by using that interface. As for accepting certificates by default, we could roll back to the behavior of case 2008/782. That's to say, to disable https support by default. Currently, Evolution, which supports showing https pages, could be the only application in OpenSolaris that'll be impacted by this change. I think it's good to stress a little bit that there are no well known CA certificates shipped in OpenSolaris. So the https support has to be disabled for certain applications, including WebKit. Regards, -Alfred From storycrafter@gmail.com Mon Aug 3 07:10:10 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n73EA988010425 for ; Mon, 3 Aug 2009 07:10:10 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n73EA228008132; Mon, 3 Aug 2009 15:10:08 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KNT00C290OTN800@brm-avmta-1.central.sun.com>; Mon, 03 Aug 2009 08:10:05 -0600 (MDT) Received: from sca-ea-mail-3.sun.com ([192.18.43.21]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KNT003ND0OSHOC0@brm-avmta-1.central.sun.com>; Mon, 03 Aug 2009 08:10:05 -0600 (MDT) Received: from relay13i.sun.com (ip123.net129179-4.block1.us.syntegra.com [129.179.4.123]) by sca-ea-mail-3.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n73E5fBA025563; Mon, 03 Aug 2009 14:10:04 +0000 (GMT) Received: from mmp14es.mmp.us.syntegra.com ([160.41.208.14] [160.41.208.14]) by relay13i.sun.com with ESMTP id BT-MMP-729322; Mon, 03 Aug 2009 14:10:03 +0000 (Z) Received: from relay15i.sun.com (relay15i.sun.com [129.179.4.125]) by mmp14es.mmp.us.syntegra.com with ESMTP id BT-MMP-486023; Mon, 03 Aug 2009 14:09:59 +0000 (Z) Received: from mail-ew0-f212.google.com ([209.85.219.212] [209.85.219.212]) by relay1i.sun.com with ESMTP id BT-MMP-346737; Mon, 03 Aug 2009 14:05:45 +0000 (Z) Received: by ewy8 with SMTP id 8so1938095ewy.8 for ; Mon, 03 Aug 2009 07:04:48 -0700 (PDT) Received: by 10.211.202.1 with SMTP id e1mr7374183ebq.85.1249308275270; Mon, 03 Aug 2009 07:04:35 -0700 (PDT) Received: from ?172.16.202.89? (68-252-106-20.ded.ameritech.net [68.252.106.20]) by mx.google.com with ESMTPS id 24sm245486eyx.3.2009.08.03.07.04.32 (version=TLSv1/SSLv3 cipher=RC4-MD5) ; Mon, 03 Aug 2009 07:04:33 -0700 (PDT) Date: Mon, 03 Aug 2009 09:04:31 -0500 From: Mark Martin Subject: Re: WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A72A0EB.7050906@sun.com> To: Alfred Peng Cc: Brian Cameron , LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <4A76EE6F.1070802@gmail.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from :user-agent:mime-version:to:cc:subject:references:in-reply-to :content-type:content-transfer-encoding; bh=Vn66UcBqQ9/D75PjimYUJTIw4tOXsCnrvcwoXYFhQlQ=; b=rAODSvlDavd2dhv/PGXRRi5sl8awj3fLLWBml3CTFyYLkR0XT9GYf463lx7AequdU8 OdXvmVQPy3Si/p8p214zJcxP44vFXYja24zo92sG4TO3h5+TgU5LWpfLIz3S/XhJ8lj/ wAHSMCdV1muCG5JUnsQ+Q5VaXlISm6jRQGED0= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=KSbvkCeXPujia5Gm1XjZQQd7RWlnXV6gIUzJkF2IpNpTEzBbW04+hbqfe7sR1XLa+G EURoOVQfcTMnH48ExrdsxzF2seTgdhW2r95Xm58NdXtTzjZmo57Nzs66TOzmb1CB3+n/ QZ5/JrkgnCNmgBh7AM3m+pNO7BSlHcpY12Qd8= X-PMX-Version: 5.4.1.325704 X-Brightmail-Tracker: AAAAAA== X-Antispam: No, score=0.0/5.0, scanned in 0.809sec at (localhost [127.0.0.1]) by smf-spamd v1.3.1 - http://smfs.sf.net/ References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A689FD4.1070502@gmail.com> <4A699253.7070700@sun.com> <4A71E2E5.4050002@gmail.com> <4A72A0EB.7050906@sun.com> User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) Status: RO Content-Length: 429 Alfred Peng wrote: > > > As for accepting certificates by default, we could roll back to the > behavior of case 2008/782. That's to say, to disable https support by > default. Currently, Evolution, which supports showing https pages, could > be the only application in OpenSolaris that'll be impacted by this change. > This seems like the safest bet to me -- maintain the disabled by default behavior as in the last case. From Brian.Cameron@sun.com Tue Aug 4 12:13:10 2009 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n74JDAi5026937 for ; Tue, 4 Aug 2009 12:13:10 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n74JDA5b027175 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Tue, 4 Aug 2009 12:13:10 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KNV00G099DYVJ00@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.COM); Tue, 04 Aug 2009 12:13:10 -0700 (PDT) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KNV00G3V9DXS400@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.COM); Tue, 04 Aug 2009 12:13:10 -0700 (PDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n74JD5HA026559 for ; Tue, 04 Aug 2009 19:13:09 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KNV006008EZ1O00@mail-amer.sun.com> for LSARC-ext@Sun.COM (ORCPT LSARC-ext@Sun.COM); Tue, 04 Aug 2009 13:13:09 -0600 (MDT) Received: from [129.153.250.126] ([unknown] [129.153.250.126]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KNV00H2H9D5F160@mail-amer.sun.com>; Tue, 04 Aug 2009 13:12:42 -0600 (MDT) Date: Tue, 04 Aug 2009 14:12:58 -0500 From: Brian Cameron Subject: Re: WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> Sender: Brian.Cameron@sun.com To: Brian Cameron Cc: LSARC-ext@sun.com, Alfred.Peng@sun.com, desktop-discuss@opensolaris.org Message-id: <4A78883A.5070702@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> User-Agent: Thunderbird 2.0.0.21 (X11/20090622) Status: RO Content-Length: 8315 Note that this case was approved at today's LSARC meeting with the provision that the specification is updated so that HTTPS is disabled until the issue with certificates is better addressed, hopefully in a future release of WebKit. So this case is currently marked as "need spec". Alfred, can you provide an updated onepager that details how we will disable HTTPS support in WebKit, then the case can be marked as approved. Thanks, Brian Brian Cameron wrote: > Template Version: @(#)sac_nextcase 1.68 02/23/09 SMI > This information is Copyright 2009 Sun Microsystems > 1. Introduction > 1.1. Project/Component Working Name: > WebKit 1.1.x > 1.2. Name of Document Author/Supplier: > Author: Alfred Peng > 1.3 Date of This Document: > 23 July, 2009 > 4. Technical Description > Copyright 2009 Sun Microsystems > > 1. Introduction > 1.1. Project/Component Working Name: > > WebKit 1.1.x > > 1.2. Name of Document Author/Supplier: > > Alfred Peng > > 1.3. Date of This Document: > > 07/21/2009 > > 1.3.1. Date this project was conceived: > > 10/01/2006 > > 1.4. Name of Major Document Customer(s)/Consumer(s): > > 1.4.1. The PAC or CPT you expect to review your project: > > Solaris PAC > > 1.4.2. The ARC(s) you expect to review your project: > > LSARC > > 1.4.3. The Director/VP who is "Sponsoring" this project: > > robert.odea@sun.com > > 1.4.4. The name of your business unit: > > Software - OPG > > 1.5. Email Aliases: > > 1.5.1. Responsible Manager: > > leo.binchy@sun.com > > 1.5.2. Responsible Engineer: > > alfred.peng@sun.com > > 1.5.3. Marketing Manager: > > glynn.foster@sun.com > > 1.5.4. Interest List: > > desktop-discuss@opensolaris.org > > 2. Project Summary > 2.1. Project Description: > > WebKit is an open source web browser engine. It's also the name of the > Mac OS X system framework version of the engine that's used by Safari, > Dashboard, Mail, and many other OS X applications. WebKit's HTML and > JavaScript code began as a branch of the KHTML and KJS libraries from > KDE. > > WebKit can be built on top of different widget backends, which includes > GTK, Qt, wxWidgets and some others as well. For this case, WebKit will > be built with GTK+ on Solaris. It's the engine that will be used for > embedding a browser in various GNOME applications, devhelp/yelp for > example. > > WebKitGTK+ is a community sub-project maintained mostly by GNOME and > GTK+ developers. It's implemented directly on top of GTK+, GLib and > GNOME libraries and provides lightweight web viewing and editing > features as well as being the basis for complete web browser > applications. It supports the latest web standards and offers good > performance and memory usage characteristics on the desktop. > > The release schedule for WebKitGTK+ will be matched with GNOME's > 6-month release cycle. Currently, GNOME applications including > devhelp/epiphany have switched to link against WebKit. > > 4. Technical Description: > 4.1. Details: > > WebKit has the following features: > - CSS 2.1, CSS3 support. > - DOM (Document Object Model) > - Styleable form controls with CSS. > - Drosera (A JavaScript debugger for WebKit that can be used > with any application that uses WebKit) > - Enhanced Rich Text Editing. > - XML techologies support, including XPath, SVG and XSLTProcessor > (JavaScript API for XSLT). > - Netscape-style (NPAPI) plugins support. > - WebKit embedding API (provides clients with a public API for > loading, displaying and manipulating Web content.) > > New in 1.1.x: > - HTTP auth with optional GNOME keyring storage. > - HTML5 media element support. > - Spell check support. > > WebKit supports the AT-SPI accessibility layer since version 1.0.x. > The GNOME accessibility team are working hard with WebKit team to ensure > WebKit is accessible when GNOME 2.28 is released. > > The libcURL HTTP backend support has been removed from WebKit 1.1.x. The > default HTTP backend is now libsoup. WebKit uses libsoup to verify the > peer's certificates for HTTPS connections. Currently, WebKit accepts all > SSL certificates automatically by default as libsoup doesn't support > client SSL certificate. Meanwhile, libsoup is also used for HTTP auth > handling with optional GNOME Keyring support. > > WebKit 1.1.x enables HTML5 Video support by using GStreamer framework > as the media backend. This makes it possible for the video content to > be embedded in SVG and manipulated with CSS and JavaScript. > > 4.2. Bug/RFE Number(s): > > None. > > 4.3. In Scope: > > See above. > > 4.4. Out of Scope: > > See above. > > 4.5. Interfaces: > > This section only hightlights the changes since LSARC/2008/782. > > Exported Interface: > > Interface Stability Comment > ---------------------------------------------------------------------------- > /usr/lib/libwebkit-1.0.so.1 Obsolete Volatile Symbolic link > /usr/lib/${MACH64}/libwebkit-1.0.so.1 Obsolete Volatile Symbolic link > /usr/lib/libwebkit-1.0.so Volatile Symbolic link > /usr/lib/libwebkit-1.0.so.2 Volatile Symbolic link > /usr/lib/libwebkit-1.0.so.2.7.0 Volatile webkit lib > /usr/lib/${MACH64}/libwebkit-1.0.so Volatile Symbolic link > /usr/lib/${MACH64}/libwebkit-1.0.so.2 Volatile Symbolic link > /usr/lib/${MACH64}/libwebkit-1.0.so.2.7.0 > Volatile 64bit webkit lib > > Imported Interfaces: > > Interface Stability Comments > ---------------------------------------------------------------------------- > > cURL Obsolete Uncommitted PSARC/2007/165 > libsoup, GStreamer Committed LSARC/2007/520 > > 4.6. Doc Impact: > > None. > > 4.7. I18N/L10N Impact: > > The JDS team and the G11N team are working together to evaluate and > provide I18N/L10N support. > > 4.8. Packaging & Delivery: > > The project will be delivering the following packages: > SUNWwebkit > SUNWwebkit-devel > > 4.9. Security Impact: > > WebKit uses libsoup to verify the peer's certificates for HTTPS > connections, instead of libcurl. Currently, WebKit accepts all > SSL certificates automatically by default as libsoup doesn't support > client SSL certificate. Meanwhile, libsoup is also used for HTTP auth > handling with optional GNOME Keyring support. > > 4.10. Dependencies: > > None. > > 5. Reference Documents: > > 1. SUNWwebkit,SUNWwebkit-devel > pkgmap > pkginfo > depend > > 2. XDG Base Directory Specification > http://standards.freedesktop.org/basedir-spec/latest/ar01s03.html > > 3. WebKit community > http://webkit.org/ > http://webkitgtk.org/ > > 4. WebKit wiki page > http://trac.webkit.org/wiki > > 5. References for web standards: > CSS 2.1: http://www.w3.org/TR/CSS21/ > CSS 3: http://www.w3.org/Style/CSS/current-work#CSS3 > DOM: http://www.w3.org/DOM/ > XPath: http://www.w3.org/TR/xpath > SVG: http://www.w3.org/Graphics/SVG/ > XSLT: http://www.w3.org/TR/xslt > HTML5: http://www.w3.org/TR/html5/ > > 6. Resources and Schedule > 6.4. Steering Committee requested information > 6.4.1. Consolidation C-team Name: > Desktop > 6.5. ARC review type: FastTrack > 6.6. ARC Exposure: open > From Brian.Cameron@sun.com Wed Aug 5 13:35:26 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n75KZQIh010859 for ; Wed, 5 Aug 2009 13:35:26 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n75KZMwD049803 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Wed, 5 Aug 2009 14:35:25 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KNX00B017V1BH00@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 05 Aug 2009 13:35:25 -0700 (PDT) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KNX008597V0H6C0@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 05 Aug 2009 13:35:24 -0700 (PDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n75KZONs012938 for ; Wed, 05 Aug 2009 20:35:24 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KNX00F007HYRP00@mail-amer.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 05 Aug 2009 14:35:24 -0600 (MDT) Received: from [129.153.250.52] ([unknown] [129.153.250.52]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KNX003D87ULCB70@mail-amer.sun.com>; Wed, 05 Aug 2009 14:35:10 -0600 (MDT) Date: Wed, 05 Aug 2009 15:35:27 -0500 From: Brian Cameron Subject: Re: WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A78883A.5070702@sun.com> Sender: Brian.Cameron@sun.com To: Brian Cameron Cc: Brian Cameron , LSARC-ext@sun.com, Alfred.Peng@sun.com, desktop-discuss@opensolaris.org Message-id: <4A79ED0F.2080903@sun.com> MIME-version: 1.0 Content-type: multipart/mixed; boundary="Boundary_(ID_FZI5QToJv6pT/SCwHS2k3Q)" X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A78883A.5070702@sun.com> User-Agent: Thunderbird 2.0.0.21 (X11/20090622) Status: RO Content-Length: 9813 This is a multi-part message in MIME format. --Boundary_(ID_FZI5QToJv6pT/SCwHS2k3Q) Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT LSARC: The case materials have been updated to reflect that HTTPS support will be disabled. See attached updated onepager and a diff file that shows the differences between this version of the onepager and the previous version. I have marked this case as "closed approved". Thanks, Brian > Note that this case was approved at today's LSARC meeting with > the provision that the specification is updated so that HTTPS > is disabled until the issue with certificates is better addressed, > hopefully in a future release of WebKit. So this case is currently > marked as "need spec". > > Alfred, can you provide an updated onepager that details how we > will disable HTTPS support in WebKit, then the case can be marked > as approved. --Boundary_(ID_FZI5QToJv6pT/SCwHS2k3Q) Content-type: text/plain; name=webkit.diff Content-transfer-encoding: 7BIT Content-disposition: inline; filename=webkit.diff 109,112c109,113 < peer's certificates for HTTPS connections. Currently, WebKit accepts all < SSL certificates automatically by default as libsoup doesn't support < client SSL certificate. Meanwhile, libsoup is also used for HTTP auth < handling with optional GNOME Keyring support. --- > peer's certificates for HTTPS connections. Since there are no well > known CA certificates shipped in OpenSolaris, HTTPS support will be > disabled for WebKit by calling soup_session_async_new_with_options and > setting SOUP_SESSION_SSL_CA_FILE to "/dev/null". Meanwhile, libsoup is > also used for HTTP auth handling with optional GNOME Keyring support. 174,177c175,179 < connections, instead of libcurl. Currently, WebKit accepts all < SSL certificates automatically by default as libsoup doesn't support < client SSL certificate. Meanwhile, libsoup is also used for HTTP auth < handling with optional GNOME Keyring support. --- > connections, instead of libcurl. Since there are no well known CA > certificates shipped in OpenSolaris, HTTPS support will be disabled > for WebKit by calling soup_session_async_new_with_options and setting > SOUP_SESSION_SSL_CA_FILE to "/dev/null". Meanwhile, libsoup is also > used for HTTP auth handling with optional GNOME Keyring support. --Boundary_(ID_FZI5QToJv6pT/SCwHS2k3Q) Content-type: text/plain; name=onepager-webkitv6-4.txt Content-transfer-encoding: 7BIT Content-disposition: inline; filename=onepager-webkitv6-4.txt Copyright 2009 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: WebKit 1.1.x 1.2. Name of Document Author/Supplier: Alfred Peng 1.3. Date of This Document: 07/21/2009 1.3.1. Date this project was conceived: 10/01/2006 1.4. Name of Major Document Customer(s)/Consumer(s): 1.4.1. The PAC or CPT you expect to review your project: Solaris PAC 1.4.2. The ARC(s) you expect to review your project: LSARC 1.4.3. The Director/VP who is "Sponsoring" this project: robert.odea@sun.com 1.4.4. The name of your business unit: Software - OPG 1.5. Email Aliases: 1.5.1. Responsible Manager: leo.binchy@sun.com 1.5.2. Responsible Engineer: alfred.peng@sun.com 1.5.3. Marketing Manager: glynn.foster@sun.com 1.5.4. Interest List: desktop-discuss@opensolaris.org 2. Project Summary 2.1. Project Description: WebKit is an open source web browser engine. It's also the name of the Mac OS X system framework version of the engine that's used by Safari, Dashboard, Mail, and many other OS X applications. WebKit's HTML and JavaScript code began as a branch of the KHTML and KJS libraries from KDE. WebKit can be built on top of different widget backends, which includes GTK, Qt, wxWidgets and some others as well. For this case, WebKit will be built with GTK+ on Solaris. It's the engine that will be used for embedding a browser in various GNOME applications, devhelp/yelp for example. WebKitGTK+ is a community sub-project maintained mostly by GNOME and GTK+ developers. It's implemented directly on top of GTK+, GLib and GNOME libraries and provides lightweight web viewing and editing features as well as being the basis for complete web browser applications. It supports the latest web standards and offers good performance and memory usage characteristics on the desktop. The release schedule for WebKitGTK+ will be matched with GNOME's 6-month release cycle. Currently, GNOME applications including devhelp/epiphany have switched to link against WebKit. 4. Technical Description: 4.1. Details: WebKit has the following features: - CSS 2.1, CSS3 support. - DOM (Document Object Model) - Styleable form controls with CSS. - Drosera (A JavaScript debugger for WebKit that can be used with any application that uses WebKit) - Enhanced Rich Text Editing. - XML techologies support, including XPath, SVG and XSLTProcessor (JavaScript API for XSLT). - Netscape-style (NPAPI) plugins support. - WebKit embedding API (provides clients with a public API for loading, displaying and manipulating Web content.) New in 1.1.x: - HTTP auth with optional GNOME keyring storage. - HTML5 media element support. - Spell check support. WebKit supports the AT-SPI accessibility layer since version 1.0.x. The GNOME accessibility team are working hard with WebKit team to ensure WebKit is accessible when GNOME 2.28 is released. The libcURL HTTP backend support has been removed from WebKit 1.1.x. The default HTTP backend is now libsoup. WebKit uses libsoup to verify the peer's certificates for HTTPS connections. Since there are no well known CA certificates shipped in OpenSolaris, HTTPS support will be disabled for WebKit by calling soup_session_async_new_with_options and setting SOUP_SESSION_SSL_CA_FILE to "/dev/null". Meanwhile, libsoup is also used for HTTP auth handling with optional GNOME Keyring support. WebKit 1.1.x enables HTML5 Video support by using GStreamer framework as the media backend. This makes it possible for the video content to be embedded in SVG and manipulated with CSS and JavaScript. 4.2. Bug/RFE Number(s): None. 4.3. In Scope: See above. 4.4. Out of Scope: See above. 4.5. Interfaces: This section only hightlights the changes since LSARC/2008/782. Exported Interface: Interface Stability Comment ---------------------------------------------------------------------------- /usr/lib/libwebkit-1.0.so.1 Obsolete Volatile Symbolic link /usr/lib/${MACH64}/libwebkit-1.0.so.1 Obsolete Volatile Symbolic link /usr/lib/libwebkit-1.0.so Volatile Symbolic link /usr/lib/libwebkit-1.0.so.2 Volatile Symbolic link /usr/lib/libwebkit-1.0.so.2.7.0 Volatile webkit lib /usr/lib/${MACH64}/libwebkit-1.0.so Volatile Symbolic link /usr/lib/${MACH64}/libwebkit-1.0.so.2 Volatile Symbolic link /usr/lib/${MACH64}/libwebkit-1.0.so.2.7.0 Volatile 64bit webkit lib Imported Interfaces: Interface Stability Comments ---------------------------------------------------------------------------- cURL Obsolete Uncommitted PSARC/2007/165 libsoup, GStreamer Committed LSARC/2007/520 4.6. Doc Impact: None. 4.7. I18N/L10N Impact: The JDS team and the G11N team are working together to evaluate and provide I18N/L10N support. 4.8. Packaging & Delivery: The project will be delivering the following packages: SUNWwebkit SUNWwebkit-devel 4.9. Security Impact: WebKit uses libsoup to verify the peer's certificates for HTTPS connections, instead of libcurl. Since there are no well known CA certificates shipped in OpenSolaris, HTTPS support will be disabled for WebKit by calling soup_session_async_new_with_options and setting SOUP_SESSION_SSL_CA_FILE to "/dev/null". Meanwhile, libsoup is also used for HTTP auth handling with optional GNOME Keyring support. 4.10. Dependencies: None. 5. Reference Documents: 1. SUNWwebkit,SUNWwebkit-devel pkgmap pkginfo depend 2. XDG Base Directory Specification http://standards.freedesktop.org/basedir-spec/latest/ar01s03.html 3. WebKit community http://webkit.org/ http://webkitgtk.org/ 4. WebKit wiki page http://trac.webkit.org/wiki 5. References for web standards: CSS 2.1: http://www.w3.org/TR/CSS21/ CSS 3: http://www.w3.org/Style/CSS/current-work#CSS3 DOM: http://www.w3.org/DOM/ XPath: http://www.w3.org/TR/xpath SVG: http://www.w3.org/Graphics/SVG/ XSLT: http://www.w3.org/TR/xslt HTML5: http://www.w3.org/TR/html5/ --Boundary_(ID_FZI5QToJv6pT/SCwHS2k3Q)-- From Darren.Moffat@sun.com Thu Aug 6 02:11:46 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n769Bkvv006230 for ; Thu, 6 Aug 2009 02:11:46 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n769BQoP046805 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Thu, 6 Aug 2009 03:11:46 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KNY0001J6VLQ100@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 06 Aug 2009 02:11:45 -0700 (PDT) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KNY00I2S6VJLM20@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 06 Aug 2009 02:11:44 -0700 (PDT) Received: from fe-emea-10.sun.com (gmp-eb-lb-1-fe1.eu.sun.com [192.18.6.7] (may be forged)) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n769BfwV011728 for ; Thu, 06 Aug 2009 09:11:43 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KNY008005DX7E00@fe-emea-10.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 06 Aug 2009 10:11:29 +0100 (BST) Received: from [192.168.1.105] (cpc2-rdng20-2-0-cust917.15-3.cable.virginmedia.com [86.28.167.150]) by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KNY00HVO6V02690@fe-emea-10.sun.com>; Thu, 06 Aug 2009 10:11:25 +0100 (BST) Date: Thu, 06 Aug 2009 10:11:20 +0100 From: Darren J Moffat Subject: Re: WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A79ED0F.2080903@sun.com> Sender: Darren.Moffat@sun.com To: Brian Cameron Cc: Brian Cameron , LSARC-ext@sun.com, Alfred.Peng@sun.com, desktop-discuss@opensolaris.org Message-id: <4A7A9E38.1060602@Sun.COM> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A78883A.5070702@sun.com> <4A79ED0F.2080903@sun.com> User-Agent: Thunderbird 2.0.0.21 (X11/20090623) Status: RO Content-Length: 1067 Brian Cameron wrote: > > LSARC: > > The case materials have been updated to reflect that HTTPS support > will be disabled. See attached updated onepager and a diff file > that shows the differences between this version of the onepager and > the previous version. I'm comeing to this issue late. However I disagree with disabling HTTPS support for the reasons that were given. This is a toolkit it isn't an end application. Doing this disabling of HTTPS makes us unnecessarily different to other platforms that provide WebKit. If the issue is just that OpenSolaris doesn't have set of well known (ie the big public CA's) SSL trust anchors then lets fix that problem - it is actually known and is being addressed by the solaris security team. We shouldn't punish projects like this for that deficiency, particularly since it is possible for the admin/developer to rectify the situation. Also this is really no different several other similar cases with SSL. If HTTPS is not enabled then I will derail this case and call for a vote. -- Darren J Moffat From storycrafter@gmail.com Thu Aug 6 06:46:19 2009 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n76DkJ4w012629 for ; Thu, 6 Aug 2009 06:46:19 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n76Dk7UD011316; Thu, 6 Aug 2009 06:46:17 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KNY00D0JJL4VI00@nwk-avmta-1.sfbay.Sun.COM>; Thu, 06 Aug 2009 06:46:16 -0700 (PDT) Received: from sca-ea-mail-1.sun.com ([192.18.43.24]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KNY00951JL4G120@nwk-avmta-1.sfbay.Sun.COM>; Thu, 06 Aug 2009 06:46:16 -0700 (PDT) Received: from relay15i.sun.com (ip125.net129179-4.block1.us.syntegra.com [129.179.4.125]) by sca-ea-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n76DhMds017423; Thu, 06 Aug 2009 13:46:16 +0000 (GMT) Received: from mmp11es.mmp.us.syntegra.com ([160.41.208.11] [160.41.208.11]) by relay15i.sun.com with ESMTP id BT-MMP-866296; Thu, 06 Aug 2009 13:46:15 +0000 (Z) Received: from relay15i.sun.com (relay15i.sun.com [129.179.4.125]) by mmp11es.mmp.us.syntegra.com with ESMTP id BT-MMP-33068147; Thu, 06 Aug 2009 13:46:13 +0000 (Z) Received: from rv-out-0708.google.com ([209.85.198.249] [209.85.198.249]) by relay1i.sun.com with ESMTP id BT-MMP-5458288; Thu, 06 Aug 2009 13:45:07 +0000 (Z) Received: by rv-out-0708.google.com with SMTP id f25so142170rvb.8 for ; Thu, 06 Aug 2009 06:44:52 -0700 (PDT) Received: by 10.141.42.17 with SMTP id u17mr6365051rvj.85.1249566292395; Thu, 06 Aug 2009 06:44:52 -0700 (PDT) Received: from ?172.16.202.89? (68-252-106-20.ded.ameritech.net [68.252.106.20]) by mx.google.com with ESMTPS id g22sm3388rvb.58.2009.08.06.06.44.50 (version=TLSv1/SSLv3 cipher=RC4-MD5) ; Thu, 06 Aug 2009 06:44:51 -0700 (PDT) Date: Thu, 06 Aug 2009 08:44:48 -0500 From: Mark Martin Subject: Re: WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A7ADB76.2000801@gmail.com> To: Darren J Moffat Cc: Brian Cameron , Brian Cameron , LSARC-ext@sun.com, Alfred.Peng@sun.com, desktop-discuss@opensolaris.org Message-id: <4A7ADE50.70402@gmail.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from :user-agent:mime-version:to:cc:subject:references:in-reply-to :content-type:content-transfer-encoding; bh=paWV0LXcmbfDvSAuwAI9v27s9qvCBYo6KeB3NBdBn3E=; b=We4EYyZ6fnpZcjW+G0YuWKXx8ArMzEED51QfNtaa/E1fvO0lEup0xDrFfcGL/E1Ck/ mzwQKlXKFH5iAKOpkskkQv3EdroLH4IYavSb+i2bNpUKum32GJxeeXeUrcllgVLFMA64 r2aggKZgctU3YHGGMZIMLtMbqRR/wPHxF285E= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=W4STPkDDfhllK5r87/+FELTio4m18Aka8TdvnRBBpLd5xLaNXkTv3d5YlsjuJl1hEs TJTa7OqIR3MhJxDz6x0Xsy9VRyxlMZQbl6twldEG3oRErP+8OBFRD1i/Yl8/luagd/eP 172CqjAHT7JhvnJIaEVs3M7tXhLr6TN7zL4Vo= X-PMX-Version: 5.4.1.325704 X-Brightmail-Tracker: AAAAAA== X-Antispam: No, score=0.0/5.0, scanned in 0.054sec at (localhost [127.0.0.1]) by smf-spamd v1.3.1 - http://smfs.sf.net/ References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A78883A.5070702@sun.com> <4A79ED0F.2080903@sun.com> <4A7A9E38.1060602@Sun.COM> <4A7ADB76.2000801@gmail.com> User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) Status: RO Content-Length: 970 Mark Martin wrote: > Darren J Moffat wrote: >> >> Also this is really no different several other similar cases with SSL. >> >> If HTTPS is not enabled then I will derail this case and call for a >> vote. >> > > I don't think the only issue is the lack of a handy, well known cert > repository; the fact that the underlying implementation doesn't > validate properly would probably surprise folks. > > The choices that I saw were: > a) Deliver with HTTPS disabled by default. Principle of least > astonishment. > b) Deliver with (incomplete and ostensibly unsafe) HTTPS enabled by > default. > > If you're insisting on B, how do you advise managing the gap? Log a > bug? Document a warning? Assume developers will be diligent or just > know? Apologies for the reply to self, but I forgot to mention that option A was the behavior from the first case, and since the classification was changed from consolidation private, I believe the exposure is increased. From storycrafter@gmail.com Thu Aug 6 06:49:52 2009 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n76DnqVh012647 for ; Thu, 6 Aug 2009 06:49:52 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n76Dnk4k013238; Thu, 6 Aug 2009 06:49:50 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KNY0070NJR1YH00@brm-avmta-1.central.sun.com>; Thu, 06 Aug 2009 07:49:49 -0600 (MDT) Received: from sca-ea-mail-3.sun.com ([192.18.43.21]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KNY002Q7JR06E50@brm-avmta-1.central.sun.com>; Thu, 06 Aug 2009 07:49:49 -0600 (MDT) Received: from relay42i.sun.com ([192.5.209.72]) by sca-ea-mail-3.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n76DhRn8008768; Thu, 06 Aug 2009 13:49:48 +0000 (GMT) Received: from mmp42es.mmp.us.syntegra.com ([160.41.221.11] [160.41.221.11]) by relay42i.sun.com with ESMTP id BT-MMP-1942750; Thu, 06 Aug 2009 13:49:47 +0000 (Z) Received: from relay41i.sun.com (relay41i.sun.com [192.5.209.70]) by mmp42es.mmp.us.syntegra.com with ESMTP id BT-MMP-42250956; Thu, 06 Aug 2009 13:34:12 +0000 (Z) Received: from mail-pz0-f204.google.com ([209.85.222.204] [209.85.222.204]) by relay4i.sun.com with ESMTP id BT-MMP-4012464; Thu, 06 Aug 2009 13:34:12 +0000 (Z) Received: by pzk42 with SMTP id 42so924071pzk.17 for ; Thu, 06 Aug 2009 06:32:43 -0700 (PDT) Received: by 10.114.39.11 with SMTP id m11mr12227458wam.46.1249565563238; Thu, 06 Aug 2009 06:32:43 -0700 (PDT) Received: from ?172.16.202.89? (68-252-106-20.ded.ameritech.net [68.252.106.20]) by mx.google.com with ESMTPS id v39sm15079492wah.27.2009.08.06.06.32.39 (version=TLSv1/SSLv3 cipher=RC4-MD5); Thu, 06 Aug 2009 06:32:40 -0700 (PDT) Date: Thu, 06 Aug 2009 08:32:38 -0500 From: Mark Martin Subject: Re: WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A7A9E38.1060602@Sun.COM> To: Darren J Moffat Cc: Brian Cameron , Brian Cameron , LSARC-ext@sun.com, Alfred.Peng@sun.com, desktop-discuss@opensolaris.org Message-id: <4A7ADB76.2000801@gmail.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from :user-agent:mime-version:to:cc:subject:references:in-reply-to :content-type:content-transfer-encoding; bh=xhyX9Evd4oQs2nEnDjyrBa5JhYUKaG7Hm+4UvIshZbE=; b=gxio0uET8LP72u7CasdjU8PUAId99BHvfzwYwRoORQ6s9obpkSqjTTyOj0+lJvI1jm I0uYbCroE4QqGgLUsjKw+C8bD4xj3NcZL+DEiuA8xuG70BElZSKOVtVt1dxHjWvMMex6 PnOae5SCOoyUW2FxpJvH79a/5J0uI7ZzL96i4= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=paXc6cLJMmCFKG91wjoLmFZmWDYdODGvLWaJmCqAzU4DYbJaLhpZKUmKDPb8s+ENGN Hc41vuoY+H9KDqymLsVNKCLzYpTc77NPh6bfEshI1Zzz0fYHklHLBq7kkvXx0jTzzJ/P pcR/S+bVHbfHPMYhNZZ7wYZgMcBNNe4UPDCU8= X-PMX-Version: 5.4.1.325704 X-Brightmail-Tracker: AAAAAA== X-Antispam: No, score=-2.6/5.0, scanned in 7.248sec at (localhost [127.0.0.1]) by smf-spamd v1.3.1 - http://smfs.sf.net/ References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A78883A.5070702@sun.com> <4A79ED0F.2080903@sun.com> <4A7A9E38.1060602@Sun.COM> User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) Status: RO Content-Length: 1630 Darren J Moffat wrote: > Brian Cameron wrote: >> >> LSARC: >> >> The case materials have been updated to reflect that HTTPS support >> will be disabled. See attached updated onepager and a diff file >> that shows the differences between this version of the onepager and >> the previous version. > > I'm comeing to this issue late. However I disagree with disabling > HTTPS support for the reasons that were given. > > This is a toolkit it isn't an end application. Doing this disabling > of HTTPS makes us unnecessarily different to other platforms that > provide WebKit. > > If the issue is just that OpenSolaris doesn't have set of well known > (ie the big public CA's) SSL trust anchors then lets fix that problem > - it is actually known and is being addressed by the solaris security > team. > We shouldn't punish projects like this for that deficiency, > particularly since it is possible for the admin/developer to rectify > the situation. > > Also this is really no different several other similar cases with SSL. > > If HTTPS is not enabled then I will derail this case and call for a vote. > I don't think the only issue is the lack of a handy, well known cert repository; the fact that the underlying implementation doesn't validate properly would probably surprise folks. The choices that I saw were: a) Deliver with HTTPS disabled by default. Principle of least astonishment. b) Deliver with (incomplete and ostensibly unsafe) HTTPS enabled by default. If you're insisting on B, how do you advise managing the gap? Log a bug? Document a warning? Assume developers will be diligent or just know? From Darren.Moffat@sun.com Thu Aug 6 07:47:36 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n76Ela8e013585 for ; Thu, 6 Aug 2009 07:47:36 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n76ElX44006968 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Thu, 6 Aug 2009 07:47:36 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KNY00D05MFB9K00@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 06 Aug 2009 08:47:35 -0600 (MDT) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KNY0023AMFA6LE0@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 06 Aug 2009 08:47:34 -0600 (MDT) Received: from fe-emea-10.sun.com (gmp-eb-lb-1-fe1.eu.sun.com [192.18.6.7] (may be forged)) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n76ElX6t002217 for ; Thu, 06 Aug 2009 14:47:33 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KNY00600M1G3400@fe-emea-10.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 06 Aug 2009 15:47:17 +0100 (BST) Received: from [192.168.1.105] (cpc2-rdng20-2-0-cust917.15-3.cable.virginmedia.com [86.28.167.150]) by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KNY00B2NMETUHA0@fe-emea-10.sun.com>; Thu, 06 Aug 2009 15:47:17 +0100 (BST) Date: Thu, 06 Aug 2009 15:47:12 +0100 From: Darren J Moffat Subject: Re: WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A7ADB76.2000801@gmail.com> Sender: Darren.Moffat@sun.com To: Mark Martin Cc: Brian Cameron , Brian Cameron , LSARC-ext@sun.com, Alfred.Peng@sun.com, desktop-discuss@opensolaris.org Message-id: <4A7AECF0.4040801@Sun.COM> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A78883A.5070702@sun.com> <4A79ED0F.2080903@sun.com> <4A7A9E38.1060602@Sun.COM> <4A7ADB76.2000801@gmail.com> User-Agent: Thunderbird 2.0.0.21 (X11/20090623) Status: RO Content-Length: 1057 Mark Martin wrote: > I don't think the only issue is the lack of a handy, well known cert > repository; the fact that the underlying implementation doesn't > validate properly would probably surprise folks. That really depends on what you mean by "validate properly", sure there are standards that define how this is done but one persons proper validation is also over the top for other cases and highly in sufficient for others. > The choices that I saw were: > a) Deliver with HTTPS disabled by default. Principle of least > astonishment. By disabled by default is it available to consumers of WebKit easily or do they have to rebuild it ? > b) Deliver with (incomplete and ostensibly unsafe) HTTPS enabled by > default. > > If you're insisting on B, how do you advise managing the gap? Log a > bug? Document a warning? Assume developers will be diligent or just know? To be able to answer that I need to understand if this gap exists on other platforms delivering WebKit or is it somehow unique to OpenSolaris ? -- Darren J Moffat From Brian.Cameron@Sun.COM Thu Aug 6 14:31:20 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n76LVKuE000837 for ; Thu, 6 Aug 2009 14:31:20 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n76LVKSB014795 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Thu, 6 Aug 2009 14:31:20 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KNZ00703546CT00@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 06 Aug 2009 15:31:18 -0600 (MDT) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KNZ00DKG546VQC0@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 06 Aug 2009 15:31:18 -0600 (MDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n76LVIVO008007 for ; Thu, 06 Aug 2009 21:31:18 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KNZ00G003MTSQ00@mail-amer.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 06 Aug 2009 15:31:18 -0600 (MDT) Received: from [10.0.0.5] ([unknown] [67.167.203.84]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KNZ0020053PWTB0@mail-amer.sun.com>; Thu, 06 Aug 2009 15:31:11 -0600 (MDT) Date: Thu, 06 Aug 2009 16:31:15 -0500 From: Brian Cameron Subject: Re: WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A7AECF0.4040801@Sun.COM> Sender: Brian.Cameron@Sun.COM To: Darren J Moffat Cc: Mark Martin , Brian Cameron , LSARC-ext@Sun.COM, Alfred.Peng@Sun.COM, desktop-discuss@opensolaris.org Message-id: <4A7B4BA3.4070700@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A78883A.5070702@sun.com> <4A79ED0F.2080903@sun.com> <4A7A9E38.1060602@Sun.COM> <4A7ADB76.2000801@gmail.com> <4A7AECF0.4040801@Sun.COM> User-Agent: Thunderbird 2.0.0.21 (X11/20090622) Status: RO Content-Length: 1346 Since the discussion on this case has gotten controversial again, I have changed the status in the IAM file to "waiting fast-track" and increased the timeout to 08/12. Alfred, can you respond to Darren and Mark's issues? Thanks, Brian Darren J Moffat wrote: > Mark Martin wrote: >> I don't think the only issue is the lack of a handy, well known cert >> repository; the fact that the underlying implementation doesn't >> validate properly would probably surprise folks. > > That really depends on what you mean by "validate properly", sure there > are standards that define how this is done but one persons proper > validation is also over the top for other cases and highly in sufficient > for others. > >> The choices that I saw were: >> a) Deliver with HTTPS disabled by default. Principle of least >> astonishment. > > By disabled by default is it available to consumers of WebKit easily or > do they have to rebuild it ? > >> b) Deliver with (incomplete and ostensibly unsafe) HTTPS enabled by >> default. >> >> If you're insisting on B, how do you advise managing the gap? Log a >> bug? Document a warning? Assume developers will be diligent or just >> know? > > To be able to answer that I need to understand if this gap exists on > other platforms delivering WebKit or is it somehow unique to OpenSolaris ? > From Alfred.Peng@Sun.COM Fri Aug 7 00:27:08 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n777R8iK020988 for ; Fri, 7 Aug 2009 00:27:08 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n777R8Z4029593 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Fri, 7 Aug 2009 00:27:08 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KNZ00G01WP87C00@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 07 Aug 2009 00:27:08 -0700 (PDT) Received: from sineb-mail-1.sun.com ([192.18.19.6]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KNZ00C2GWP73MD0@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 07 Aug 2009 00:27:08 -0700 (PDT) Received: from fe-apac-05.sun.com (fe-apac-05.sun.com [192.18.19.176] (may be forged)) by sineb-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n777R6GC013831 for ; Fri, 07 Aug 2009 07:27:06 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KNZ00900WO47300@mail-apac.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 07 Aug 2009 15:27:06 +0800 (SGT) Received: from [192.168.1.71] ([unknown] [121.6.32.168]) by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KNZ00J5KWP6QAL0@mail-apac.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 07 Aug 2009 15:27:06 +0800 (SGT) Date: Fri, 07 Aug 2009 15:27:08 +0800 From: Alfred Peng Subject: Re: WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A7AECF0.4040801@Sun.COM> Sender: Alfred.Peng@Sun.COM To: Darren J Moffat Cc: Mark Martin , Brian Cameron , LSARC-ext@Sun.COM, desktop-discuss@opensolaris.org Message-id: <4A7BD74C.10708@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A78883A.5070702@sun.com> <4A79ED0F.2080903@sun.com> <4A7A9E38.1060602@Sun.COM> <4A7ADB76.2000801@gmail.com> <4A7AECF0.4040801@Sun.COM> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1.1) Gecko/20090721 Lightning/1.0pre Thunderbird/3.0b3 Status: RO Content-Length: 1399 Hi Darren/Mark, Before I started the arc case, I sent a query with regards to this HTTPS support issue to the WebKit community. Dan Winship, the libsoup developer, gave me some insight into the problem: http://lists.macosforge.org/pipermail/webkit-dev/2009-June/008566.html. Roughly there are two points from the reply: - An x509 file containing the certificate can be passed to SoupSession for verification. In this way, only the "correctly-named non-expired certificates signed by one of those CAs" will be accepted, all others will be rejected. From the libsoup client howto: http://library.gnome.org/devel/libsoup/stable/libsoup-client-howto.html, I think it's possible to make WebKit accept user-specified certificate with some coding. On the other hand, we could point the SOUP_SESSION_SSL_CA_FILE to the system bundled certificates if that's available. - "There is not currently any way to let the application decide on a case-by-case basis whether or not to accept a certificate." With Firefox, users can decide whether they want to accept a certificate. Users won't be able to do this with WebKit. As for the current status of the WebKit HTTPS support, I've verified with the WebKit test Program, named GtkLauncher. It's a very simple browser GUI. GtkLauncher can accept all the https request by default. If I patch the code as Dan suggested, it denies all the https website instead. From the source code: http://svn.webkit.org/repository/webkit/trunk/WebCore/platform/network/soup/ResourceHandleSoup.cpp, Status: RO you can notice that WebKit uses soup_session_async_new to create the SoupSession without setting any additional options. That's the reason why WebKit ignores all certificate validation and accepts all certificates by default I think. On 08/ 6/09 10:47 PM, Darren J Moffat wrote: > Mark Martin wrote: > >> I don't think the only issue is the lack of a handy, well known cert >> repository; the fact that the underlying implementation doesn't >> validate properly would probably surprise folks. >> > That really depends on what you mean by "validate properly", sure there > are standards that define how this is done but one persons proper > validation is also over the top for other cases and highly in sufficient > for others. > > >> The choices that I saw were: >> a) Deliver with HTTPS disabled by default. Principle of least >> astonishment. >> > By disabled by default is it available to consumers of WebKit easily or > do they have to rebuild it ? > A possible workaround is that we could patch the code to enable environment variable checking so that consumers of WebKit can switch on the https support easily (no need to rebuild). By doing this, the HTTPS support of WebKit 1.1.x will be consistent with the last WebKit arc case. Just need to note that WebKit will still ignore the certificate verification in this case. >> b) Deliver with (incomplete and ostensibly unsafe) HTTPS enabled by >> default. >> >> If you're insisting on B, how do you advise managing the gap? Log a >> bug? Document a warning? Assume developers will be diligent or just know? >> > To be able to answer that I need to understand if this gap exists on > other platforms delivering WebKit or is it somehow unique to OpenSolaris ? There is an old version of WebKit in Ubuntu repository: http://packages.ubunut.com/jaunty/libwebkit-1.0-1. It still uses libcURL from the dependency list. With package "ca-certificates" installed on Ubuntu by default, WebKit can accept the authorized certificates. However, it won't accept the server certificates that can't be match with the system bundled ones. That's to say, some of the https website will fail to load. Since WebKit 1.1.x is targeted for GNOME 2.28, I think it'll be probably available for the next Ubuntu release. We'll know how Ubuntu handles HTTPS support with libsoup then. Personally I'd propose to disable the HTTPS support for now and push the integration of certificates to OpenSolaris. When it's ready, we can enable the HTTPS support. Thanks, -Alfred From lists@mcintyreweb.com Fri Aug 7 01:12:50 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n778Cn3G021825 for ; Fri, 7 Aug 2009 01:12:50 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n778Cj7j016383; Fri, 7 Aug 2009 16:12:47 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KNZ00M0FYT5CA00@nwk-avmta-1.sfbay.Sun.COM>; Fri, 07 Aug 2009 01:12:41 -0700 (PDT) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KNZ00GRCYT3YV20@nwk-avmta-1.sfbay.Sun.COM>; Fri, 07 Aug 2009 01:12:40 -0700 (PDT) Received: from relay13i.sun.com (ip123.net129179-4.block1.us.syntegra.com [129.179.4.123]) by brmea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n7784VpC000781; Fri, 07 Aug 2009 08:12:39 +0000 (GMT) Received: from mmp11es.mmp.us.syntegra.com ([160.41.208.11] [160.41.208.11]) by relay13i.sun.com with ESMTP id BT-MMP-1049890; Fri, 07 Aug 2009 08:12:39 +0000 (Z) Received: from relay15i.sun.com (relay15i.sun.com [129.179.4.125]) by mmp11es.mmp.us.syntegra.com with ESMTP id BT-MMP-35060518; Fri, 07 Aug 2009 08:12:34 +0000 (Z) Received: from remote.mcintyreweb.com ([67.23.1.228] [67.23.1.228]) by relay1i.sun.com with ESMTP id BT-MMP-7635608; Fri, 07 Aug 2009 08:12:34 +0000 (Z) Received: from twins.i.mcintyreweb.com (unknown [64.166.3.74]) by remote.mcintyreweb.com (Postfix) with ESMTPS id 93F2810C270; Fri, 07 Aug 2009 01:12:32 -0700 (PDT) Date: Fri, 07 Aug 2009 01:12:30 -0700 From: Hugh McIntyre Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A7BD74C.10708@sun.com> To: Alfred Peng Cc: Darren J Moffat , desktop-discuss@opensolaris.org, Mark Martin , LSARC-ext@sun.com Message-id: <4A7BE1EE.8040808@mcintyreweb.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 X-Brightmail-Tracker: AAAAAA== X-Antispam: No, score=-0.7/5.0, scanned in 4.209sec at (localhost [127.0.0.1]) by smf-spamd v1.3.1 - http://smfs.sf.net/ References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A78883A.5070702@sun.com> <4A79ED0F.2080903@sun.com> <4A7A9E38.1060602@Sun.COM> <4A7ADB76.2000801@gmail.com> <4A7AECF0.4040801@Sun.COM> <4A7BD74C.10708@sun.com> User-Agent: Thunderbird 2.0.0.22 (Macintosh/20090605) Status: RO Content-Length: 2647 Alfred Peng wrote: > Hi Darren/Mark, > > Before I started the arc case, I sent a query with regards to this HTTPS > support issue to the WebKit community. Dan Winship, the libsoup > developer, gave me some insight into the problem: > http://lists.macosforge.org/pipermail/webkit-dev/2009-June/008566.html. > > Roughly there are two points from the reply: > > - An x509 file containing the certificate can be passed to SoupSession > for verification. In this way, only the "correctly-named non-expired > certificates signed by one of those CAs" will be accepted, all others > will be rejected. From the libsoup client howto: > http://library.gnome.org/devel/libsoup/stable/libsoup-client-howto.html, > I think it's possible to make WebKit accept user-specified certificate > with some coding. On the other hand, we could point the > SOUP_SESSION_SSL_CA_FILE to the system bundled certificates if that's > available. So roughly speaking this seems to give 3 options: 1. Solaris adds some code to set SOUP_SESSION_SSL_CA_FILE based on an environment variable or system default if they exist by default, else either /dev/null (no HTTPS) or the default (no checking). 2. Solaris ships with SOUP_SESSION_SSL_CA_FILE set to /dev/null (HTTPS disabled) but with documentation saying that users can call g_object_set(..., SOUP_SESSION_SSL_CA_FILE, ...) to define either a valid CA file to enable support with checking or reset to NULL which seems to be claimed to turn checking back off. (Details in the link above). 3. Or a similar option to (2) where WebKit ships unmodified with no checking, but the documentation states in a clear WARNING section that https accesses include no checking unless the user sets SOUP_SESSION_SSL_CA_FILE to a valid file (or /dev/null). Personally, #2 may be the best option especially if this can be made to default to a system-supplied CA file if shipped. Since option (1) may give the same effect but with more coding and more Solaris-only options such as environment variables. However this assumes that there's not a large bunch of existing WebKit clients that people want to download and "./configure; make; make install" without adding these calls to the code. Really, any of these options seem workable, but it seems there should at least be a warning in the docs if connections are silently accepted without any checking. > Personally I'd propose to disable the HTTPS support for now and push the > integration of certificates to OpenSolaris. When it's ready, we can > enable the HTTPS support. I would at least document how people can enable support, if this indeed works. Hugh. From Alfred.Peng@sun.com Fri Aug 7 02:40:20 2009 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n779eKGv023089 for ; Fri, 7 Aug 2009 02:40:20 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n779eHBe027097 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Fri, 7 Aug 2009 02:40:18 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KO000H132V4NQ00@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 07 Aug 2009 03:40:16 -0600 (MDT) Received: from sineb-mail-1.sun.com ([192.18.19.6]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KO000KCR2V12180@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 07 Aug 2009 03:40:15 -0600 (MDT) Received: from fe-apac-05.sun.com (fe-apac-05.sun.com [192.18.19.176] (may be forged)) by sineb-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n779eDtP021610 for ; Fri, 07 Aug 2009 09:40:13 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KO000H002OZVJ00@mail-apac.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 07 Aug 2009 17:40:13 +0800 (SGT) Received: from [192.168.1.71] ([unknown] [121.6.32.168]) by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KO0001282V0BH40@mail-apac.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 07 Aug 2009 17:40:13 +0800 (SGT) Date: Fri, 07 Aug 2009 17:40:15 +0800 From: Alfred Peng Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A7BE1EE.8040808@mcintyreweb.com> Sender: Alfred.Peng@sun.com To: Hugh McIntyre Cc: Darren J Moffat , desktop-discuss@opensolaris.org, Mark Martin , LSARC-ext@sun.com Message-id: <4A7BF67F.8080809@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A78883A.5070702@sun.com> <4A79ED0F.2080903@sun.com> <4A7A9E38.1060602@Sun.COM> <4A7ADB76.2000801@gmail.com> <4A7AECF0.4040801@Sun.COM> <4A7BD74C.10708@sun.com> <4A7BE1EE.8040808@mcintyreweb.com> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1.1) Gecko/20090721 Lightning/1.0pre Thunderbird/3.0b3 Status: RO Content-Length: 1328 On 08/ 7/09 04:12 PM, Hugh McIntyre wrote: > So roughly speaking this seems to give 3 options: > > 1. Solaris adds some code to set SOUP_SESSION_SSL_CA_FILE based on an > environment variable or system default if they exist by default, else > either /dev/null (no HTTPS) or the default (no checking). > > 2. Solaris ships with SOUP_SESSION_SSL_CA_FILE set to /dev/null (HTTPS > disabled) but with documentation saying that users can call > g_object_set(..., SOUP_SESSION_SSL_CA_FILE, ...) to define either a > valid CA file to enable support with checking or reset to NULL which > seems to be claimed to turn checking back off. (Details in the link above). > > 3. Or a similar option to (2) where WebKit ships unmodified with no > checking, but the documentation states in a clear WARNING section that > https accesses include no checking unless the user sets > SOUP_SESSION_SSL_CA_FILE to a valid file (or /dev/null). > > Personally, #2 may be the best option especially if this can be made to > default to a system-supplied CA file if shipped. Since option (1) may > give the same effect but with more coding and more Solaris-only options > such as environment variables. > Thanks for the comments. Option #2 looks good to me. I'll add those to the manual page if people agree with this. Thanks, -Alfred From Alfred.Peng@Sun.COM Fri Aug 7 03:04:04 2009 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n77A44HF023555 for ; Fri, 7 Aug 2009 03:04:04 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n77A42JA005383 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Fri, 7 Aug 2009 03:04:04 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KO000K0L3YR5F00@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.COM); Fri, 07 Aug 2009 04:04:03 -0600 (MDT) Received: from sineb-mail-2.sun.com ([192.18.19.7]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KO000KK03YQ1Q90@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.COM); Fri, 07 Aug 2009 04:04:03 -0600 (MDT) Received: from fe-apac-06.sun.com (fe-apac-06.sun.com [192.18.19.177] (may be forged)) by sineb-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n77A41te003834 for ; Fri, 07 Aug 2009 10:04:01 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KO000D003SVZR00@mail-apac.sun.com> for LSARC-ext@Sun.COM (ORCPT LSARC-ext@Sun.COM); Fri, 07 Aug 2009 18:04:01 +0800 (SGT) Received: from [192.168.1.71] ([unknown] [121.6.32.168]) by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KO000BV23YMOBG0@mail-apac.sun.com>; Fri, 07 Aug 2009 18:04:01 +0800 (SGT) Date: Fri, 07 Aug 2009 18:04:00 +0800 From: Alfred Peng Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A72A0EB.7050906@sun.com> Sender: Alfred.Peng@Sun.COM To: Mark Martin Cc: Brian Cameron , LSARC-ext@Sun.COM, desktop-discuss@opensolaris.org Message-id: <4A7BFC10.7040204@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A689FD4.1070502@gmail.com> <4A699253.7070700@sun.com> <4A71E2E5.4050002@gmail.com> <4A72A0EB.7050906@sun.com> User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) Status: RO Content-Length: 984 Alfred Peng: >> As for an RFE, could you clarify a little on that? An RFE to enable >> users to pass the certificate in the first place? It's not even >> available as delivered here? >> >> > Sorry for not making things clear. libsoup does provide the support for > passing certificate through the soup session. But WebKit doesn't. This > is consistent with the last case 2008/782. The RFE could be to add > certain API to WebKit and enable user/WebKit consumers specified > certificate by using that interface. Hi Mark, Need to make a correction for the previous comment. It's not necessary to have a RFE for that to work. WebKit consumers/users can pass the certificate to the SoupSession by using: g_object_set (webkit_get_default_session (), SOUP_SESSION_SSL_CA_FILE, "...", NULL); Please refer to http://lists.macosforge.org/pipermail/webkit-dev/2009-June/008566.html for detail. Sorry for the confusion. Best, -Alfred From Darren.Moffat@Sun.COM Fri Aug 7 07:13:28 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n77EDRBd000013 for ; Fri, 7 Aug 2009 07:13:28 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n77EDQGT003520 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Fri, 7 Aug 2009 15:13:27 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KO000F0FFIDJN00@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 07 Aug 2009 07:13:25 -0700 (PDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KO0008TIFIBS150@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 07 Aug 2009 07:13:24 -0700 (PDT) Received: from fe-emea-10.sun.com (gmp-eb-lb-1-fe1.eu.sun.com [192.18.6.7] (may be forged)) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n77EDM7v019071 for ; Fri, 07 Aug 2009 14:13:22 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KO000100DBCIZ00@fe-emea-10.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 07 Aug 2009 15:13:07 +0100 (BST) Received: from [192.168.1.105] (cpc2-rdng20-2-0-cust917.15-3.cable.virginmedia.com [86.28.167.150]) by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KO0004Y9FHD7Q40@fe-emea-10.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 07 Aug 2009 15:12:50 +0100 (BST) Date: Fri, 07 Aug 2009 15:12:44 +0100 From: Darren J Moffat Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A7BF67F.8080809@sun.com> Sender: Darren.Moffat@Sun.COM To: Alfred Peng Cc: Hugh McIntyre , desktop-discuss@opensolaris.org, Mark Martin , LSARC-ext@Sun.COM Message-id: <4A7C365C.7030907@Sun.COM> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A78883A.5070702@sun.com> <4A79ED0F.2080903@sun.com> <4A7A9E38.1060602@Sun.COM> <4A7ADB76.2000801@gmail.com> <4A7AECF0.4040801@Sun.COM> <4A7BD74C.10708@sun.com> <4A7BE1EE.8040808@mcintyreweb.com> <4A7BF67F.8080809@sun.com> User-Agent: Thunderbird 2.0.0.21 (X11/20090623) Status: RO Content-Length: 357 Alfred Peng wrote: > Thanks for the comments. > > Option #2 looks good to me. I'll add those to the manual page if people > agree with this. I still haven't seen an answer to what happens on other platforms that ship webkit. How is webkit delivered and documented on Linux distros ? Why should we be different to other platforms ? -- Darren J Moffat From storycrafter@gmail.com Fri Aug 7 08:13:52 2009 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n77FDqvw025541 for ; Fri, 7 Aug 2009 08:13:52 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n77FDl80017282; Fri, 7 Aug 2009 08:13:51 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KO00060FIB2DB00@brm-avmta-1.central.sun.com>; Fri, 07 Aug 2009 09:13:50 -0600 (MDT) Received: from sca-ea-mail-4.sun.com ([192.18.43.22]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KO0004BTIB2D210@brm-avmta-1.central.sun.com>; Fri, 07 Aug 2009 09:13:50 -0600 (MDT) Received: from relay41i.sun.com ([192.5.209.70]) by sca-ea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n77FDn6p029979; Fri, 07 Aug 2009 15:13:49 +0000 (GMT) Received: from mms49es.mms.us.syntegra.com ([160.41.221.232] [160.41.221.232]) by relay41i.sun.com with ESMTP id BT-MMP-2033681; Fri, 07 Aug 2009 15:13:49 +0000 (Z) Received: from relay43i.sun.com (relay43i.sun.com [192.5.209.74]) by mms49es.mms.us.syntegra.com with ESMTP id BT-MMP-42179183; Fri, 07 Aug 2009 15:13:24 +0000 (Z) Received: from mail-yx0-f179.google.com ([209.85.210.179] [209.85.210.179]) by relay4i.sun.com with ESMTP id BT-MMP-8806787; Fri, 07 Aug 2009 15:13:24 +0000 (Z) Received: by yxe9 with SMTP id 9so1921724yxe.30 for ; Fri, 07 Aug 2009 08:12:32 -0700 (PDT) Received: by 10.90.31.13 with SMTP id e13mr1043562age.1.1249657952509; Fri, 07 Aug 2009 08:12:32 -0700 (PDT) Received: from ?172.16.202.89? (68-252-106-20.ded.ameritech.net [68.252.106.20]) by mx.google.com with ESMTPS id 38sm3301341aga.79.2009.08.07.08.12.31 (version=TLSv1/SSLv3 cipher=RC4-MD5) ; Fri, 07 Aug 2009 08:12:31 -0700 (PDT) Date: Fri, 07 Aug 2009 10:12:30 -0500 From: Mark Martin Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A7C365C.7030907@Sun.COM> To: Darren J Moffat Cc: Alfred Peng , Hugh McIntyre , desktop-discuss@opensolaris.org, LSARC-ext@sun.com Message-id: <4A7C445E.6070301@gmail.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from :user-agent:mime-version:to:cc:subject:references:in-reply-to :content-type:content-transfer-encoding; bh=ak6W7se+rmbyBt2wlnVmW+GWQMJTOc9z5cGzOND2zfI=; b=IhsFzKW/TTpEYC1SbcJn3Ja9PGFaRq8aNdLUWntfrvWKnlY88nrjSVxpN/O0Vz8Eng YZ5stbwyTKcoMAvmQ2jiSrXJ5sjQ/JAXhSqpFO95fB1g+FGP0CShf7aFONpLkFZcggoR sbAqyJyAbUfdWswqx20Rw4qwU2+Mn7oqKPTY0= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=xErB3minqFD5envRCnvhVlMzA6u3Rtrk+c3pWk0cLugx1K1QB/ggVy7K6c4qyQqekN kWo11UJ+pxmiotytSAJYsa8wEKa4QsLzJnJAjvCX30o2pKtUFmiC6sQaSodIorvjpG3B euLonuHeslqEF3+jCCS0YUP1b1MvNdpd+9YzQ= X-PMX-Version: 5.4.1.325704 X-Brightmail-Tracker: AAAAAA== X-Antispam: No, score=-2.6/5.0, scanned in 5.936sec at (localhost [127.0.0.1]) by smf-spamd v1.3.1 - http://smfs.sf.net/ References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A78883A.5070702@sun.com> <4A79ED0F.2080903@sun.com> <4A7A9E38.1060602@Sun.COM> <4A7ADB76.2000801@gmail.com> <4A7AECF0.4040801@Sun.COM> <4A7BD74C.10708@sun.com> <4A7BE1EE.8040808@mcintyreweb.com> <4A7BF67F.8080809@sun.com> <4A7C365C.7030907@Sun.COM> User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) Status: RO Content-Length: 2644 Darren J Moffat wrote: > Alfred Peng wrote: >> Thanks for the comments. >> >> Option #2 looks good to me. I'll add those to the manual page if people >> agree with this. > > I still haven't seen an answer to what happens on other platforms that > ship webkit. How is webkit delivered and documented on Linux distros ? > > Why should we be different to other platforms ? > In truth, Darren, it's hard to find real documentation on this particular package for various Linux distros. We seem to be the only community that either caught or cared about the default libsoup behavior. I suspect it's an almost certainty that they deliver the package untouched from the upstream. I also suspect that it's installed as a dependency for some other package 90%+ of the time. But also, although I really did look, I'm not sure why we're reviewing delivery into Linux distros. I completely understand the "familiarity" refrain that is often espoused, but that's such a broad brush to use to paint over packages. While it may be convenient and prudent for Linux distros to just deliver the package with 0% change, they also don't have the certificate issue we seem to have. And as near as I can tell, Linux familiarity was a directive given by marketing as a means to provide a similar experience to developers. I doubt it was a directive given because package delivery in Linux distros is such a robust and sound engineering model. I appreciate the need to provide the bounty of product packages that Linux currently enjoys, believe it or not. Adoption is critical to the future of OpenSolaris (the community AND the commercial distribution) -- Linux is a development platform target we are currently *chasing*. But I don't think we have to emulate Linux developers library delivery to the exclusion of all other architectural concerns. If we end up delivering WebKit in pseudo parity with Linux distros, then I believe the precedent we'd be setting would be: "When in doubt, Linux familiarity trumps perceived security gaps." If the answer to all future FOSS library packaging questions is "what would Linux do?", then I see a diminishing value for LSARC in the nascent reality called OpenSolaris(tm). I'd rather use the familiarity mantra to define strategic decisions (should we port this? should we port that?), but it's of less value to me at a tactical level. Although the possible security impact is rather high (in my estimation), the risk of occurrence has to be really quite small. We've probably spent more energy and time debating this than the likely window of mishap. I'm ready to move on. From urosn@live.com Fri Aug 7 09:22:42 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n77GMgsx005832 for ; Fri, 7 Aug 2009 09:22:42 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n77GMeF0026974; Fri, 7 Aug 2009 09:22:41 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KO000D09LHSEL00@brm-avmta-1.central.sun.com>; Fri, 07 Aug 2009 10:22:40 -0600 (MDT) Received: from sca-ea-mail-1.sun.com ([192.18.43.24]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KO0004LELHRD270@brm-avmta-1.central.sun.com>; Fri, 07 Aug 2009 10:22:40 -0600 (MDT) Received: from relay43i.sun.com ([192.5.209.74]) by sca-ea-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n77GMd8U021375; Fri, 07 Aug 2009 16:22:39 +0000 (GMT) Received: from mms48es.mms.us.syntegra.com ([160.41.221.230] [160.41.221.230]) by relay43i.sun.com with ESMTP id BT-MMP-2063339; Fri, 07 Aug 2009 16:20:38 +0000 (Z) Received: from relay45i.sun.com (relay45i.sun.com [192.5.209.94]) by mms48es.mms.us.syntegra.com with ESMTP id BT-MMP-41998388; Fri, 07 Aug 2009 16:20:30 +0000 (Z) Received: from BAY0-OMC3-S10.bay0.hotmail.com ([65.54.246.210] [65.54.246.210]) by relay4i.sun.com with ESMTP id BT-MMP-9523301; Fri, 07 Aug 2009 16:20:30 +0000 (Z) Received: from BAY104-W14 ([65.54.175.114]) by BAY0-OMC3-S10.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Fri, 07 Aug 2009 09:20:29 -0700 Date: Fri, 07 Aug 2009 17:20:29 +0100 From: Uros Nedic Subject: RE: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A7BD74C.10708@sun.com> X-Originating-IP: [92.244.142.205] To: alfred.peng@sun.com, darren.moffat@sun.com Cc: DesktopDiscuss , storycrafter@gmail.com, lsarc-ext@sun.com Message-id: MIME-version: 1.0 Content-type: text/plain; charset=iso-8859-2 Content-transfer-encoding: 7BIT Importance: Normal X-PMX-Version: 5.4.1.325704 X-Brightmail-Tracker: AAAAAA== X-Antispam: No, score=-2.6/5.0, scanned in 7.478sec at (localhost [127.0.0.1]) by smf-spamd v1.3.1 - http://smfs.sf.net/ References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A78883A.5070702@sun.com> <4A79ED0F.2080903@sun.com> <4A7A9E38.1060602@Sun.COM> <4A7ADB76.2000801@gmail.com> <4A7AECF0.4040801@Sun.COM> <4A7BD74C.10708@sun.com> X-OriginalArrivalTime: 07 Aug 2009 16:20:29.0926 (UTC) FILETIME=[FB131060:01CA177A] Status: RO Content-Length: 5532 As a pure observer of this communication I would like to add one suggestion which, maybe, could be helpful. As far as I know Google's Chrome browser uses WebKit as well as Apple's Safari on both platforms (Win and Mac). You could ask Google and Apple engineers how they solved this problem. In Chrome when one certificate is not certified by some 'well known' CA browser just ask user what he would like to do. So it *is* possible to deal with this issue. I did not have time digging more deeply through Google's mailing lists on code.google.com nor to see Apple's but as far as I saw there they solved this issue. Hope it helps! Uros Nedic, MSc Belgrade, Serbia P.S: Please do not disable HTTPS. I'd be big mistake, from my perspective. ---------------------------------------- > Date: Fri, 7 Aug 2009 15:27:08 +0800 > From: Alfred.Peng@Sun.COM > To: Darren.Moffat@Sun.COM > CC: desktop-discuss@opensolaris.org; storycrafter@gmail.com; LSARC-ext@Sun.COM > Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] > > Hi Darren/Mark, > > Before I started the arc case, I sent a query with regards to this HTTPS > support issue to the WebKit community. Dan Winship, the libsoup > developer, gave me some insight into the problem: > http://lists.macosforge.org/pipermail/webkit-dev/2009-June/008566.html. > Roughly there are two points from the reply: > > - An x509 file containing the certificate can be passed to SoupSession > for verification. In this way, only the "correctly-named non-expired > certificates signed by one of those CAs" will be accepted, all others > will be rejected. From the libsoup client howto: > http://library.gnome.org/devel/libsoup/stable/libsoup-client-howto.html, > I think it's possible to make WebKit accept user-specified certificate > with some coding. On the other hand, we could point the > SOUP_SESSION_SSL_CA_FILE to the system bundled certificates if that's > available. > > - "There is not currently any way to let the application decide on a > case-by-case basis whether or not to accept a certificate." With > Firefox, users can decide whether they want to accept a certificate. > Users won't be able to do this with WebKit. > > As for the current status of the WebKit HTTPS support, I've verified > with the WebKit test Program, named GtkLauncher. It's a very simple > browser GUI. GtkLauncher can accept all the https request by default. If > I patch the code as Dan suggested, it denies all the https website instead. > >>From the source code: > http://svn.webkit.org/repository/webkit/trunk/WebCore/platform/network/soup/ResourceHandleSoup.cpp, > you can notice that WebKit uses soup_session_async_new to create the > SoupSession without setting any additional options. That's the reason > why WebKit ignores all certificate validation and accepts all > certificates by default I think. > > On 08/ 6/09 10:47 PM, Darren J Moffat wrote: >> Mark Martin wrote: >> >>> I don't think the only issue is the lack of a handy, well known cert >>> repository; the fact that the underlying implementation doesn't >>> validate properly would probably surprise folks. >>> >> That really depends on what you mean by "validate properly", sure there >> are standards that define how this is done but one persons proper >> validation is also over the top for other cases and highly in sufficient >> for others. >> >> >>> The choices that I saw were: >>> a) Deliver with HTTPS disabled by default. Principle of least >>> astonishment. >>> >> By disabled by default is it available to consumers of WebKit easily or >> do they have to rebuild it ? >> > A possible workaround is that we could patch the code to enable > environment variable checking so that consumers of WebKit can switch on > the https support easily (no need to rebuild). By doing this, the HTTPS > support of WebKit 1.1.x will be consistent with the last WebKit arc > case. Just need to note that WebKit will still ignore the certificate > verification in this case. >>> b) Deliver with (incomplete and ostensibly unsafe) HTTPS enabled by >>> default. >>> >>> If you're insisting on B, how do you advise managing the gap? Log a >>> bug? Document a warning? Assume developers will be diligent or just know? >>> >> To be able to answer that I need to understand if this gap exists on >> other platforms delivering WebKit or is it somehow unique to OpenSolaris ? > There is an old version of WebKit in Ubuntu repository: > http://packages.ubunut.com/jaunty/libwebkit-1.0-1. It still uses libcURL > from the dependency list. With package "ca-certificates" installed on > Ubuntu by default, WebKit can accept the authorized certificates. > However, it won't accept the server certificates that can't be match > with the system bundled ones. That's to say, some of the https website > will fail to load. Since WebKit 1.1.x is targeted for GNOME 2.28, I > think it'll be probably available for the next Ubuntu release. We'll > know how Ubuntu handles HTTPS support with libsoup then. > > Personally I'd propose to disable the HTTPS support for now and push the > integration of certificates to OpenSolaris. When it's ready, we can > enable the HTTPS support. > > Thanks, > -Alfred > _______________________________________________ > desktop-discuss mailing list > desktop-discuss@opensolaris.org _________________________________________________________________ Share your memories online with anyone you want. http://www.microsoft.com/middleeast/windows/windowslive/products/photos-share.aspx?tab=1 From matt@greenviolet.net Fri Aug 7 10:36:01 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n77Ha04M007852 for ; Fri, 7 Aug 2009 10:36:01 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n77HZvwu000387; Fri, 7 Aug 2009 10:35:59 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KO00042LOVYNN00@nwk-avmta-1.sfbay.Sun.COM>; Fri, 07 Aug 2009 10:35:58 -0700 (PDT) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KO000K4EOVXKLE0@nwk-avmta-1.sfbay.Sun.COM>; Fri, 07 Aug 2009 10:35:58 -0700 (PDT) Received: from relay42i.sun.com ([192.5.209.72]) by brmea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n77HZqel016455; Fri, 07 Aug 2009 17:35:57 +0000 (GMT) Received: from mmp41es.mmp.us.syntegra.com ([160.41.221.10] [160.41.221.10]) by relay42i.sun.com with ESMTP id BT-MMP-2070433; Fri, 07 Aug 2009 17:35:56 +0000 (Z) Received: from relay45i.sun.com (relay45i.sun.com [192.5.209.94]) by mmp41es.mmp.us.syntegra.com with ESMTP id BT-MMP-44581717; Fri, 07 Aug 2009 17:35:52 +0000 (Z) Received: from bay0-omc2-s13.bay0.hotmail.com ([65.54.246.149] [65.54.246.149]) by relay4i.sun.com with ESMTP id BT-MMP-9660557; Fri, 07 Aug 2009 17:35:52 +0000 (Z) Received: from BAY142-DS4 ([65.55.153.31]) by bay0-omc2-s13.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Fri, 07 Aug 2009 10:35:51 -0700 Date: Fri, 07 Aug 2009 10:35:24 -0700 From: Matt Lewandowsky Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A7BF67F.8080809@sun.com> X-Originating-IP: [66.92.7.5] To: Alfred Peng Cc: LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V14.0.8064.206 X-Mailer: Microsoft Windows Live Mail 14.0.8064.206 Content-type: text/plain; format=flowed; charset=iso-8859-1; reply-type=original Content-transfer-encoding: 7BIT Importance: Normal X-Priority: 3 X-MSMail-priority: Normal X-PMX-Version: 5.4.1.325704 X-Brightmail-Tracker: AAAAAA== X-Originating-Email: [matt@greenviolet.net] X-Antispam: No, score=0.0/5.0, scanned in 4.264sec at (localhost [127.0.0.1]) by smf-spamd v1.3.1 - http://smfs.sf.net/ References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A78883A.5070702@sun.com> <4A79ED0F.2080903@sun.com> <4A7A9E38.1060602@Sun.COM> <4A7ADB76.2000801@gmail.com> <4A7AECF0.4040801@Sun.COM> <4A7BD74C.10708@sun.com> <4A7BE1EE.8040808@mcintyreweb.com> <4A7BF67F.8080809@sun.com> X-OriginalArrivalTime: 07 Aug 2009 17:35:51.0312 (UTC) FILETIME=[8207D100:01CA1785] Status: RO Content-Length: 0 From "Alfred Peng" , August 07, 2009 2:40 AM: Status: RO Content-Length: 1389 > On 08/ 7/09 04:12 PM, Hugh McIntyre wrote: >> 2. Solaris ships with SOUP_SESSION_SSL_CA_FILE set to /dev/null (HTTPS >> disabled) but with documentation saying that users can call >> g_object_set(..., SOUP_SESSION_SSL_CA_FILE, ...) to define either a >> valid CA file to enable support with checking or reset to NULL which >> seems to be claimed to turn checking back off. (Details in the link >> above). > > Option #2 looks good to me. I'll add those to the manual page if people > agree with this. I agree. This option seems sane to me, as well, as long as consumers of WebKit can *easily* change this. i.e. The man page needs to have an explicit example as to how to enable the CA file (or /dev/null). If no other platform has considered the security implications yet, it's quite viable whatever gets done here will be used as the reference elsewhere. Therefore, it's vital that what differs ought to be explicitly and obviously defined. This will also help porters with quickly (minimal effort beyond configure && make && make install) achieving "feature-parity" on OpenSolaris when porting things which rely upon WebKit. Just my two cents, but as I am awaiting integration of WebKit so that I can port a couple of things which depend on it, I thought now would be the time to chime in. :) Warmest, --Matt -- Matt Lewandowsky Greenviolet http://greenviolet.net/ From Alfred.Peng@Sun.COM Sat Aug 8 03:14:16 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n78AEFle015488 for ; Sat, 8 Aug 2009 03:14:15 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n78AE9Xa000068 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Sat, 8 Aug 2009 18:14:14 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KO100409Z3NF900@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Sat, 08 Aug 2009 03:14:11 -0700 (PDT) Received: from sineb-mail-2.sun.com ([192.18.19.7]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KO100JNLZ3KRC90@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Sat, 08 Aug 2009 03:14:11 -0700 (PDT) Received: from fe-apac-05.sun.com (fe-apac-05.sun.com [192.18.19.176] (may be forged)) by sineb-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n78AE8JY004190 for ; Sat, 08 Aug 2009 10:14:08 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KO100200YMORC00@mail-apac.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Sat, 08 Aug 2009 18:14:08 +0800 (SGT) Received: from [192.168.1.71] ([unknown] [121.6.32.168]) by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KO100BFJZ3JWV00@mail-apac.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Sat, 08 Aug 2009 18:14:08 +0800 (SGT) Date: Sat, 08 Aug 2009 18:14:08 +0800 From: Alfred Peng Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A7C365C.7030907@Sun.COM> Sender: Alfred.Peng@Sun.COM To: Darren J Moffat Cc: Hugh McIntyre , desktop-discuss@opensolaris.org, Mark Martin , LSARC-ext@Sun.COM Message-id: <4A7D4FF0.9060500@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A78883A.5070702@sun.com> <4A79ED0F.2080903@sun.com> <4A7A9E38.1060602@Sun.COM> <4A7ADB76.2000801@gmail.com> <4A7AECF0.4040801@Sun.COM> <4A7BD74C.10708@sun.com> <4A7BE1EE.8040808@mcintyreweb.com> <4A7BF67F.8080809@sun.com> <4A7C365C.7030907@Sun.COM> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1.1) Gecko/20090721 Lightning/1.0pre Thunderbird/3.0b3 Status: RO Content-Length: 834 On 08/ 7/09 10:12 PM, Darren J Moffat wrote: > Alfred Peng wrote: > >> Thanks for the comments. >> >> Option #2 looks good to me. I'll add those to the manual page if people >> agree with this. >> > I still haven't seen an answer to what happens on other platforms that > ship webkit. How is webkit delivered and documented on Linux distros ? > > Why should we be different to other platforms ? Hi Darren, I've replied about my investigation on Ubuntu: http://opensolaris.org/jive/thread.jspa?threadID=109764&tstart=0. In short, the latest WebKit 1.1.x hasn't been integrated yet. As for Fedora, I didn't tried myself. From the Fedora package database, WebKit Gtk port isn't integrated yet: https://admin.fedoraproject.org/pkgdb/packages/name/webkitgtk?_csrf_token=e729b2a1e1ea9658f9ea1d9fc446aa1066b36843. Best, -Alfred From Alfred.Peng@sun.com Sat Aug 8 03:32:34 2009 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n78AWXpV015551 for ; Sat, 8 Aug 2009 03:32:33 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n78AWXt7011344 for <@sunmail2sca.sfbay.sun.com:lsarc-ext@sun.com>; Sat, 8 Aug 2009 03:32:33 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KO100H03ZY88Q00@brm-avmta-1.central.sun.com> for lsarc-ext@sun.com (ORCPT lsarc-ext@sun.com); Sat, 08 Aug 2009 04:32:32 -0600 (MDT) Received: from sineb-mail-2.sun.com ([192.18.19.7]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KO1002NLZY6YL40@brm-avmta-1.central.sun.com> for lsarc-ext@sun.com (ORCPT lsarc-ext@sun.com); Sat, 08 Aug 2009 04:32:32 -0600 (MDT) Received: from fe-apac-06.sun.com (fe-apac-06.sun.com [192.18.19.177] (may be forged)) by sineb-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n78AWUTH004321 for ; Sat, 08 Aug 2009 10:32:30 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KO100A00ZHPWB00@mail-apac.sun.com> for lsarc-ext@sun.com (ORCPT lsarc-ext@sun.com); Sat, 08 Aug 2009 18:32:30 +0800 (SGT) Received: from [192.168.1.71] ([unknown] [121.6.32.168]) by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KO1000D7ZY6Z930@mail-apac.sun.com> for lsarc-ext@sun.com (ORCPT lsarc-ext@sun.com); Sat, 08 Aug 2009 18:32:30 +0800 (SGT) Date: Sat, 08 Aug 2009 18:32:31 +0800 From: Alfred Peng Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: Sender: Alfred.Peng@sun.com To: Uros Nedic Cc: Darren.Moffat@sun.com, DesktopDiscuss , storycrafter@gmail.com, lsarc-ext@sun.com Message-id: <4A7D543F.9090301@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A78883A.5070702@sun.com> <4A79ED0F.2080903@sun.com> <4A7A9E38.1060602@Sun.COM> <4A7ADB76.2000801@gmail.com> <4A7AECF0.4040801@Sun.COM> <4A7BD74C.10708@sun.com> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1.1) Gecko/20090721 Lightning/1.0pre Thunderbird/3.0b3 Status: RO Content-Length: 6004 Hi Uros, Chrome browser does depend on WebKit. From its source code (788M source tarball, HUGE) and ChangeLog, I don't think Chrome uses libsoup for HTTPS support on Win and Mac. From the libsoup developer (link below), "there is not currently any way to let the application decide on a case-by-case basis whether or not to accept a certificate" with libsoup. I doubt whether the way Google/Apple engineers used to solve this HTTPS support problem can apply to our case. Thanks, -Alfred On 08/ 8/09 12:20 AM, Uros Nedic wrote: > As a pure observer of this communication I would like to > add one suggestion which, maybe, could be helpful. > > As far as I know Google's Chrome browser uses WebKit as > well as Apple's Safari on both platforms (Win and Mac). > > You could ask Google and Apple engineers how they solved > this problem. > > In Chrome when one certificate is not certified by some > 'well known' CA browser just ask user what he would like > to do. So it *is* possible to deal with this issue. > > I did not have time digging more deeply through Google's > mailing lists on code.google.com nor to see Apple's but > as far as I saw there they solved this issue. > > Hope it helps! > > Uros Nedic, MSc > Belgrade, Serbia > > P.S: Please do not disable HTTPS. I'd be big mistake, from > my perspective. > > ---------------------------------------- > >> Date: Fri, 7 Aug 2009 15:27:08 +0800 >> From: Alfred.Peng@Sun.COM >> To: Darren.Moffat@Sun.COM >> CC: desktop-discuss@opensolaris.org; storycrafter@gmail.com; LSARC-ext@Sun.COM >> Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] >> >> Hi Darren/Mark, >> >> Before I started the arc case, I sent a query with regards to this HTTPS >> support issue to the WebKit community. Dan Winship, the libsoup >> developer, gave me some insight into the problem: >> http://lists.macosforge.org/pipermail/webkit-dev/2009-June/008566.html. >> > >> Roughly there are two points from the reply: >> >> - An x509 file containing the certificate can be passed to SoupSession >> for verification. In this way, only the "correctly-named non-expired >> certificates signed by one of those CAs" will be accepted, all others >> will be rejected. From the libsoup client howto: >> http://library.gnome.org/devel/libsoup/stable/libsoup-client-howto.html, >> I think it's possible to make WebKit accept user-specified certificate >> with some coding. On the other hand, we could point the >> SOUP_SESSION_SSL_CA_FILE to the system bundled certificates if that's >> available. >> >> - "There is not currently any way to let the application decide on a >> case-by-case basis whether or not to accept a certificate." With >> Firefox, users can decide whether they want to accept a certificate. >> Users won't be able to do this with WebKit. >> >> As for the current status of the WebKit HTTPS support, I've verified >> with the WebKit test Program, named GtkLauncher. It's a very simple >> browser GUI. GtkLauncher can accept all the https request by default. If >> I patch the code as Dan suggested, it denies all the https website instead. >> >> >From the source code: >> http://svn.webkit.org/repository/webkit/trunk/WebCore/platform/network/soup/ResourceHandleSoup.cpp, >> you can notice that WebKit uses soup_session_async_new to create the >> SoupSession without setting any additional options. That's the reason >> why WebKit ignores all certificate validation and accepts all >> certificates by default I think. >> >> On 08/ 6/09 10:47 PM, Darren J Moffat wrote: >> >>> Mark Martin wrote: >>> >>> >>>> I don't think the only issue is the lack of a handy, well known cert >>>> repository; the fact that the underlying implementation doesn't >>>> validate properly would probably surprise folks. >>>> >>>> >>> That really depends on what you mean by "validate properly", sure there >>> are standards that define how this is done but one persons proper >>> validation is also over the top for other cases and highly in sufficient >>> for others. >>> >>> >>> >>>> The choices that I saw were: >>>> a) Deliver with HTTPS disabled by default. Principle of least >>>> astonishment. >>>> >>>> >>> By disabled by default is it available to consumers of WebKit easily or >>> do they have to rebuild it ? >>> >>> >> A possible workaround is that we could patch the code to enable >> environment variable checking so that consumers of WebKit can switch on >> the https support easily (no need to rebuild). By doing this, the HTTPS >> support of WebKit 1.1.x will be consistent with the last WebKit arc >> case. Just need to note that WebKit will still ignore the certificate >> verification in this case. >> >>>> b) Deliver with (incomplete and ostensibly unsafe) HTTPS enabled by >>>> default. >>>> >>>> If you're insisting on B, how do you advise managing the gap? Log a >>>> bug? Document a warning? Assume developers will be diligent or just know? >>>> >>>> >>> To be able to answer that I need to understand if this gap exists on >>> other platforms delivering WebKit or is it somehow unique to OpenSolaris ? >>> >> There is an old version of WebKit in Ubuntu repository: >> http://packages.ubunut.com/jaunty/libwebkit-1.0-1. It still uses libcURL >> from the dependency list. With package "ca-certificates" installed on >> Ubuntu by default, WebKit can accept the authorized certificates. >> However, it won't accept the server certificates that can't be match >> with the system bundled ones. That's to say, some of the https website >> will fail to load. Since WebKit 1.1.x is targeted for GNOME 2.28, I >> think it'll be probably available for the next Ubuntu release. We'll >> know how Ubuntu handles HTTPS support with libsoup then. >> >> Personally I'd propose to disable the HTTPS support for now and push the >> integration of certificates to OpenSolaris. When it's ready, we can >> enable the HTTPS support. >> >> Thanks, >> -Alfred >> From urosn@live.com Sat Aug 8 08:12:04 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n78FC4U7001187 for ; Sat, 8 Aug 2009 08:12:04 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n78FC2qT004027; Sat, 8 Aug 2009 09:12:03 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KO200605CW2CZ00@nwk-avmta-2.sfbay.sun.com>; Sat, 08 Aug 2009 08:12:02 -0700 (PDT) Received: from sca-ea-mail-3.sun.com ([192.18.43.21]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KO20017MCW1CME0@nwk-avmta-2.sfbay.sun.com>; Sat, 08 Aug 2009 08:12:01 -0700 (PDT) Received: from relay41i.sun.com ([192.5.209.70]) by sca-ea-mail-3.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n78FBgXL028924; Sat, 08 Aug 2009 15:12:01 +0000 (GMT) Received: from mmp41es.mmp.us.syntegra.com ([160.41.221.10] [160.41.221.10]) by relay41i.sun.com with ESMTP id BT-MMP-2112719; Sat, 08 Aug 2009 15:12:01 +0000 (Z) Received: from relay44i.sun.com (relay44i.sun.com [192.5.209.118]) by mmp41es.mmp.us.syntegra.com with ESMTP id BT-MMP-46420524; Sat, 08 Aug 2009 15:11:57 +0000 (Z) Received: from bay0-omc3-s28.bay0.hotmail.com ([65.54.246.228] [65.54.246.228]) by relay4i.sun.com with ESMTP id BT-MMP-2458007; Sat, 08 Aug 2009 15:11:57 +0000 (Z) Received: from BAY104-W14 ([65.54.175.114]) by bay0-omc3-s28.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Sat, 08 Aug 2009 08:11:56 -0700 Date: Sat, 08 Aug 2009 16:11:56 +0100 From: Uros Nedic Subject: RE: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A7D543F.9090301@sun.com> X-Originating-IP: [92.244.133.226] To: Alfred Peng Cc: Darren Moffar , DesktopDiscuss , storycrafter@gmail.com, lsarc-ext@sun.com Message-id: MIME-version: 1.0 Content-type: text/plain; charset=iso-8859-2 Content-transfer-encoding: 7BIT Importance: Normal X-PMX-Version: 5.4.1.325704 X-Brightmail-Tracker: AAAAAA== X-Antispam: No, score=-2.6/5.0, scanned in 3.755sec at (localhost [127.0.0.1]) by smf-spamd v1.3.1 - http://smfs.sf.net/ References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A78883A.5070702@sun.com> <4A79ED0F.2080903@sun.com> <4A7A9E38.1060602@Sun.COM> <4A7ADB76.2000801@gmail.com> <4A7AECF0.4040801@Sun.COM> <4A7BD74C.10708@sun.com> <4A7D543F.9090301@sun.com> X-OriginalArrivalTime: 08 Aug 2009 15:11:56.0218 (UTC) FILETIME=[9186C9A0:01CA183A] Status: RO Content-Length: 7542 I see. Also I saw libsoup's developer citation earlier, but I thought that this issue has been already solved earlier by Google or Apple. I have two more sugesstions: [1] Currently, Google is under heavy development of Google OS which will be Linux-based OS for netbooks. I'm sure they are going to implement libsoup as underlying layer for WebKit's HTTPS communication. I based my idea having that in my mind. Just ask them how they did such resolution. [2] Let we extend libsoup with additional interfaces capable to deal with this issue, or to change actual implementation of interface we have conflict with. Keep in mind that you are SUN guys which means we should deliver better software than Linux world. Also, maybe I could help since I'm basically Telecommunications Engineer but I do programming too. I came from the country where we have faculties based on Russian style educational system :). Best, Uros Nedic, MSc ---------------------------------------- > Date: Sat, 8 Aug 2009 18:32:31 +0800 > From: Alfred.Peng@Sun.COM > Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] > To: urosn@live.com > CC: Darren.Moffat@Sun.COM; desktop-discuss@opensolaris.org; storycrafter@gmail.com; lsarc-ext@Sun.COM > > Hi Uros, > > Chrome browser does depend on WebKit. From its source code (788M source > tarball, HUGE) and ChangeLog, I don't think Chrome uses libsoup for > HTTPS support on Win and Mac. From the libsoup developer (link below), > "there is not currently any way to let the application decide on a > case-by-case basis whether or not to accept a certificate" with libsoup. > I doubt whether the way Google/Apple engineers used to solve this HTTPS > support problem can apply to our case. > > Thanks, > -Alfred > > On 08/ 8/09 12:20 AM, Uros Nedic wrote: >> As a pure observer of this communication I would like to >> add one suggestion which, maybe, could be helpful. >> >> As far as I know Google's Chrome browser uses WebKit as >> well as Apple's Safari on both platforms (Win and Mac). >> >> You could ask Google and Apple engineers how they solved >> this problem. >> >> In Chrome when one certificate is not certified by some >> 'well known' CA browser just ask user what he would like >> to do. So it *is* possible to deal with this issue. >> >> I did not have time digging more deeply through Google's >> mailing lists on code.google.com nor to see Apple's but >> as far as I saw there they solved this issue. >> >> Hope it helps! >> >> Uros Nedic, MSc >> Belgrade, Serbia >> >> P.S: Please do not disable HTTPS. I'd be big mistake, from >> my perspective. >> >> ---------------------------------------- >> >>> Date: Fri, 7 Aug 2009 15:27:08 +0800 >>> From: Alfred.Peng@Sun.COM >>> To: Darren.Moffat@Sun.COM >>> CC: desktop-discuss@opensolaris.org; storycrafter@gmail.com; LSARC-ext@Sun.COM >>> Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] >>> >>> Hi Darren/Mark, >>> >>> Before I started the arc case, I sent a query with regards to this HTTPS >>> support issue to the WebKit community. Dan Winship, the libsoup >>> developer, gave me some insight into the problem: >>> http://lists.macosforge.org/pipermail/webkit-dev/2009-June/008566.html. >>> >> >>> Roughly there are two points from the reply: >>> >>> - An x509 file containing the certificate can be passed to SoupSession >>> for verification. In this way, only the "correctly-named non-expired >>> certificates signed by one of those CAs" will be accepted, all others >>> will be rejected. From the libsoup client howto: >>> http://library.gnome.org/devel/libsoup/stable/libsoup-client-howto.html, >>> I think it's possible to make WebKit accept user-specified certificate >>> with some coding. On the other hand, we could point the >>> SOUP_SESSION_SSL_CA_FILE to the system bundled certificates if that's >>> available. >>> >>> - "There is not currently any way to let the application decide on a >>> case-by-case basis whether or not to accept a certificate." With >>> Firefox, users can decide whether they want to accept a certificate. >>> Users won't be able to do this with WebKit. >>> >>> As for the current status of the WebKit HTTPS support, I've verified >>> with the WebKit test Program, named GtkLauncher. It's a very simple >>> browser GUI. GtkLauncher can accept all the https request by default. If >>> I patch the code as Dan suggested, it denies all the https website instead. >>> >>>>From the source code: >>> http://svn.webkit.org/repository/webkit/trunk/WebCore/platform/network/soup/ResourceHandleSoup.cpp, >>> you can notice that WebKit uses soup_session_async_new to create the >>> SoupSession without setting any additional options. That's the reason >>> why WebKit ignores all certificate validation and accepts all >>> certificates by default I think. >>> >>> On 08/ 6/09 10:47 PM, Darren J Moffat wrote: >>> >>>> Mark Martin wrote: >>>> >>>> >>>>> I don't think the only issue is the lack of a handy, well known cert >>>>> repository; the fact that the underlying implementation doesn't >>>>> validate properly would probably surprise folks. >>>>> >>>>> >>>> That really depends on what you mean by "validate properly", sure there >>>> are standards that define how this is done but one persons proper >>>> validation is also over the top for other cases and highly in sufficient >>>> for others. >>>> >>>> >>>> >>>>> The choices that I saw were: >>>>> a) Deliver with HTTPS disabled by default. Principle of least >>>>> astonishment. >>>>> >>>>> >>>> By disabled by default is it available to consumers of WebKit easily or >>>> do they have to rebuild it ? >>>> >>>> >>> A possible workaround is that we could patch the code to enable >>> environment variable checking so that consumers of WebKit can switch on >>> the https support easily (no need to rebuild). By doing this, the HTTPS >>> support of WebKit 1.1.x will be consistent with the last WebKit arc >>> case. Just need to note that WebKit will still ignore the certificate >>> verification in this case. >>> >>>>> b) Deliver with (incomplete and ostensibly unsafe) HTTPS enabled by >>>>> default. >>>>> >>>>> If you're insisting on B, how do you advise managing the gap? Log a >>>>> bug? Document a warning? Assume developers will be diligent or just know? >>>>> >>>>> >>>> To be able to answer that I need to understand if this gap exists on >>>> other platforms delivering WebKit or is it somehow unique to OpenSolaris ? >>>> >>> There is an old version of WebKit in Ubuntu repository: >>> http://packages.ubunut.com/jaunty/libwebkit-1.0-1. It still uses libcURL >>> from the dependency list. With package "ca-certificates" installed on >>> Ubuntu by default, WebKit can accept the authorized certificates. >>> However, it won't accept the server certificates that can't be match >>> with the system bundled ones. That's to say, some of the https website >>> will fail to load. Since WebKit 1.1.x is targeted for GNOME 2.28, I >>> think it'll be probably available for the next Ubuntu release. We'll >>> know how Ubuntu handles HTTPS support with libsoup then. >>> >>> Personally I'd propose to disable the HTTPS support for now and push the >>> integration of certificates to OpenSolaris. When it's ready, we can >>> enable the HTTPS support. >>> >>> Thanks, >>> -Alfred >>> _________________________________________________________________ Share your memories online with anyone you want. http://www.microsoft.com/middleeast/windows/windowslive/products/photos-share.aspx?tab=1 From Darren.Moffat@sun.com Mon Aug 10 03:18:27 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7AAIQ4L005965 for ; Mon, 10 Aug 2009 03:18:26 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n7AAIOvd020572 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Mon, 10 Aug 2009 18:18:24 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KO500G07OMN2N00@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Mon, 10 Aug 2009 03:18:23 -0700 (PDT) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KO5003PDOMMR7B0@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Mon, 10 Aug 2009 03:18:23 -0700 (PDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-1-fe1.eu.sun.com [192.18.6.7] (may be forged)) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n7AAIL6e007221 for ; Mon, 10 Aug 2009 10:18:21 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KO500G00OCXEE00@fe-emea-09.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Mon, 10 Aug 2009 11:18:16 +0100 (BST) Received: from [192.168.1.105] (cpc2-rdng20-2-0-cust917.15-3.cable.virginmedia.com [86.28.167.150]) by fe-emea-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KO500132OMGIED0@fe-emea-09.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Mon, 10 Aug 2009 11:18:16 +0100 (BST) Date: Mon, 10 Aug 2009 11:18:09 +0100 From: Darren J Moffat Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: Sender: Darren.Moffat@sun.com To: Matt Lewandowsky Cc: Alfred Peng , LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <4A7FF3E1.2020408@Sun.COM> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A78883A.5070702@sun.com> <4A79ED0F.2080903@sun.com> <4A7A9E38.1060602@Sun.COM> <4A7ADB76.2000801@gmail.com> <4A7AECF0.4040801@Sun.COM> <4A7BD74C.10708@sun.com> <4A7BE1EE.8040808@mcintyreweb.com> <4A7BF67F.8080809@sun.com> User-Agent: Thunderbird 2.0.0.21 (X11/20090623) Status: RO Content-Length: 924 Matt Lewandowsky wrote: >> From "Alfred Peng" , August 07, 2009 2:40 AM: > >> On 08/ 7/09 04:12 PM, Hugh McIntyre wrote: >>> 2. Solaris ships with SOUP_SESSION_SSL_CA_FILE set to /dev/null (HTTPS >>> disabled) but with documentation saying that users can call >>> g_object_set(..., SOUP_SESSION_SSL_CA_FILE, ...) to define either a >>> valid CA file to enable support with checking or reset to NULL which >>> seems to be claimed to turn checking back off. (Details in the link >>> above). >> >> Option #2 looks good to me. I'll add those to the manual page if people >> agree with this. > > I agree. This option seems sane to me, as well, as long as consumers of > WebKit can *easily* change this. i.e. The man page needs to have an > explicit example as to how to enable the CA file (or /dev/null). So why not make this case dependent on the existence of a useful CA file? -- Darren J Moffat From Alfred.Peng@sun.com Mon Aug 10 10:42:27 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7AHgQsp020492 for ; Mon, 10 Aug 2009 10:42:27 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n7AHgF8l024108 for <@sunmail2sca.sfbay.sun.com:lsarc-ext@sun.com>; Tue, 11 Aug 2009 01:42:25 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KO600I0396N8500@nwk-avmta-1.sfbay.Sun.COM> for lsarc-ext@sun.com (ORCPT lsarc-ext@sun.com); Mon, 10 Aug 2009 10:42:23 -0700 (PDT) Received: from sineb-mail-1.sun.com ([192.18.19.6]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KO600JTZ969ULD0@nwk-avmta-1.sfbay.Sun.COM> for lsarc-ext@sun.com (ORCPT lsarc-ext@sun.com); Mon, 10 Aug 2009 10:42:22 -0700 (PDT) Received: from fe-apac-06.sun.com (fe-apac-06.sun.com [192.18.19.177] (may be forged)) by sineb-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n7AHg8JF007585 for ; Mon, 10 Aug 2009 17:42:08 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KO600G008W2D700@mail-apac.sun.com> for lsarc-ext@sun.com (ORCPT lsarc-ext@sun.com); Tue, 11 Aug 2009 01:42:08 +0800 (SGT) Received: from [192.168.1.71] ([unknown] [121.6.32.168]) by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KO600IBE967PW80@mail-apac.sun.com> for lsarc-ext@sun.com (ORCPT lsarc-ext@sun.com); Tue, 11 Aug 2009 01:42:08 +0800 (SGT) Date: Tue, 11 Aug 2009 01:42:13 +0800 From: Alfred Peng Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: Sender: Alfred.Peng@sun.com To: Uros Nedic Cc: Darren Moffar , DesktopDiscuss , storycrafter@gmail.com, lsarc-ext@sun.com Message-id: <4A805BF5.4080402@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A78883A.5070702@sun.com> <4A79ED0F.2080903@sun.com> <4A7A9E38.1060602@Sun.COM> <4A7ADB76.2000801@gmail.com> <4A7AECF0.4040801@Sun.COM> <4A7BD74C.10708@sun.com> <4A7D543F.9090301@sun.com> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1.1) Gecko/20090721 Lightning/1.0pre Thunderbird/3.0b3 Status: RO Content-Length: 8104 Hi Uros, Thanks for the suggestions. I've sent email to Chrome developers with regards to the HTTPS support of Chrome on Linux platform. The answer is that "Chrome does not use libsoup on Linux." Actually they use their own custom network stack on all platforms: http://src.chromium.org/viewvc/chrome/trunk/src/net/. -Alfred On 08/ 8/09 11:11 PM, Uros Nedic wrote: > I see. Also I saw libsoup's developer citation earlier, but > I thought that this issue has been already solved earlier > by Google or Apple. > > I have two more sugesstions: > > [1] Currently, Google is under heavy development of Google OS > which will be Linux-based OS for netbooks. I'm sure they are > going to implement libsoup as underlying layer for WebKit's > HTTPS communication. I based my idea having that in my mind. > Just ask them how they did such resolution. > > [2] Let we extend libsoup with additional interfaces capable > to deal with this issue, or to change actual implementation > of interface we have conflict with. > > Keep in mind that you are SUN guys which means we should deliver > better software than Linux world. Also, maybe I could help > since I'm basically Telecommunications Engineer but I do programming > too. I came from the country where we have faculties based > on Russian style educational system :). > > Best, > Uros Nedic, MSc > > ---------------------------------------- > >> Date: Sat, 8 Aug 2009 18:32:31 +0800 >> From: Alfred.Peng@Sun.COM >> Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] >> To: urosn@live.com >> CC: Darren.Moffat@Sun.COM; desktop-discuss@opensolaris.org; storycrafter@gmail.com; lsarc-ext@Sun.COM >> >> Hi Uros, >> >> Chrome browser does depend on WebKit. From its source code (788M source >> tarball, HUGE) and ChangeLog, I don't think Chrome uses libsoup for >> HTTPS support on Win and Mac. From the libsoup developer (link below), >> "there is not currently any way to let the application decide on a >> case-by-case basis whether or not to accept a certificate" with libsoup. >> I doubt whether the way Google/Apple engineers used to solve this HTTPS >> support problem can apply to our case. >> >> Thanks, >> -Alfred >> >> On 08/ 8/09 12:20 AM, Uros Nedic wrote: >> >>> As a pure observer of this communication I would like to >>> add one suggestion which, maybe, could be helpful. >>> >>> As far as I know Google's Chrome browser uses WebKit as >>> well as Apple's Safari on both platforms (Win and Mac). >>> >>> You could ask Google and Apple engineers how they solved >>> this problem. >>> >>> In Chrome when one certificate is not certified by some >>> 'well known' CA browser just ask user what he would like >>> to do. So it *is* possible to deal with this issue. >>> >>> I did not have time digging more deeply through Google's >>> mailing lists on code.google.com nor to see Apple's but >>> as far as I saw there they solved this issue. >>> >>> Hope it helps! >>> >>> Uros Nedic, MSc >>> Belgrade, Serbia >>> >>> P.S: Please do not disable HTTPS. I'd be big mistake, from >>> my perspective. >>> >>> ---------------------------------------- >>> >>> >>>> Date: Fri, 7 Aug 2009 15:27:08 +0800 >>>> From: Alfred.Peng@Sun.COM >>>> To: Darren.Moffat@Sun.COM >>>> CC: desktop-discuss@opensolaris.org; storycrafter@gmail.com; LSARC-ext@Sun.COM >>>> Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] >>>> >>>> Hi Darren/Mark, >>>> >>>> Before I started the arc case, I sent a query with regards to this HTTPS >>>> support issue to the WebKit community. Dan Winship, the libsoup >>>> developer, gave me some insight into the problem: >>>> http://lists.macosforge.org/pipermail/webkit-dev/2009-June/008566.html. >>>> >>>> >>> >>>> Roughly there are two points from the reply: >>>> >>>> - An x509 file containing the certificate can be passed to SoupSession >>>> for verification. In this way, only the "correctly-named non-expired >>>> certificates signed by one of those CAs" will be accepted, all others >>>> will be rejected. From the libsoup client howto: >>>> http://library.gnome.org/devel/libsoup/stable/libsoup-client-howto.html, >>>> I think it's possible to make WebKit accept user-specified certificate >>>> with some coding. On the other hand, we could point the >>>> SOUP_SESSION_SSL_CA_FILE to the system bundled certificates if that's >>>> available. >>>> >>>> - "There is not currently any way to let the application decide on a >>>> case-by-case basis whether or not to accept a certificate." With >>>> Firefox, users can decide whether they want to accept a certificate. >>>> Users won't be able to do this with WebKit. >>>> >>>> As for the current status of the WebKit HTTPS support, I've verified >>>> with the WebKit test Program, named GtkLauncher. It's a very simple >>>> browser GUI. GtkLauncher can accept all the https request by default. If >>>> I patch the code as Dan suggested, it denies all the https website instead. >>>> >>>> >From the source code: >>>> http://svn.webkit.org/repository/webkit/trunk/WebCore/platform/network/soup/ResourceHandleSoup.cpp, >>>> you can notice that WebKit uses soup_session_async_new to create the >>>> SoupSession without setting any additional options. That's the reason >>>> why WebKit ignores all certificate validation and accepts all >>>> certificates by default I think. >>>> >>>> On 08/ 6/09 10:47 PM, Darren J Moffat wrote: >>>> >>>> >>>>> Mark Martin wrote: >>>>> >>>>> >>>>> >>>>>> I don't think the only issue is the lack of a handy, well known cert >>>>>> repository; the fact that the underlying implementation doesn't >>>>>> validate properly would probably surprise folks. >>>>>> >>>>>> >>>>>> >>>>> That really depends on what you mean by "validate properly", sure there >>>>> are standards that define how this is done but one persons proper >>>>> validation is also over the top for other cases and highly in sufficient >>>>> for others. >>>>> >>>>> >>>>> >>>>> >>>>>> The choices that I saw were: >>>>>> a) Deliver with HTTPS disabled by default. Principle of least >>>>>> astonishment. >>>>>> >>>>>> >>>>>> >>>>> By disabled by default is it available to consumers of WebKit easily or >>>>> do they have to rebuild it ? >>>>> >>>>> >>>>> >>>> A possible workaround is that we could patch the code to enable >>>> environment variable checking so that consumers of WebKit can switch on >>>> the https support easily (no need to rebuild). By doing this, the HTTPS >>>> support of WebKit 1.1.x will be consistent with the last WebKit arc >>>> case. Just need to note that WebKit will still ignore the certificate >>>> verification in this case. >>>> >>>> >>>>>> b) Deliver with (incomplete and ostensibly unsafe) HTTPS enabled by >>>>>> default. >>>>>> >>>>>> If you're insisting on B, how do you advise managing the gap? Log a >>>>>> bug? Document a warning? Assume developers will be diligent or just know? >>>>>> >>>>>> >>>>>> >>>>> To be able to answer that I need to understand if this gap exists on >>>>> other platforms delivering WebKit or is it somehow unique to OpenSolaris ? >>>>> >>>>> >>>> There is an old version of WebKit in Ubuntu repository: >>>> http://packages.ubunut.com/jaunty/libwebkit-1.0-1. It still uses libcURL >>>> from the dependency list. With package "ca-certificates" installed on >>>> Ubuntu by default, WebKit can accept the authorized certificates. >>>> However, it won't accept the server certificates that can't be match >>>> with the system bundled ones. That's to say, some of the https website >>>> will fail to load. Since WebKit 1.1.x is targeted for GNOME 2.28, I >>>> think it'll be probably available for the next Ubuntu release. We'll >>>> know how Ubuntu handles HTTPS support with libsoup then. >>>> >>>> Personally I'd propose to disable the HTTPS support for now and push the >>>> integration of certificates to OpenSolaris. When it's ready, we can >>>> enable the HTTPS support. >>>> >>>> Thanks, >>>> -Alfred > From urosn@live.com Mon Aug 10 14:46:18 2009 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7ALkINN004200 for ; Mon, 10 Aug 2009 14:46:18 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n7ALkG0P019519; Mon, 10 Aug 2009 14:46:17 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KO60030LKH4A200@brm-avmta-1.central.sun.com>; Mon, 10 Aug 2009 15:46:16 -0600 (MDT) Received: from sca-ea-mail-2.sun.com ([192.18.43.25]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KO60001OKH0O420@brm-avmta-1.central.sun.com>; Mon, 10 Aug 2009 15:46:12 -0600 (MDT) Received: from relay13i.sun.com (ip123.net129179-4.block1.us.syntegra.com [129.179.4.123]) by sca-ea-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n7ALZeM4029769; Mon, 10 Aug 2009 21:46:11 +0000 (GMT) Received: from mmp11es.mmp.us.syntegra.com ([160.41.208.11] [160.41.208.11]) by relay13i.sun.com with ESMTP id BT-MMP-32851; Mon, 10 Aug 2009 21:46:11 +0000 (Z) Received: from relay15i.sun.com (relay15i.sun.com [129.179.4.125]) by mmp11es.mmp.us.syntegra.com with ESMTP id BT-MMP-43419031; Mon, 10 Aug 2009 21:46:05 +0000 (Z) Received: from bay0-omc3-s13.bay0.hotmail.com ([65.54.246.213] [65.54.246.213]) by relay1i.sun.com with ESMTP id BT-MMP-866904; Mon, 10 Aug 2009 21:36:26 +0000 (Z) Received: from BAY104-W56 ([65.54.175.156]) by bay0-omc3-s13.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959); Mon, 10 Aug 2009 14:34:59 -0700 Date: Mon, 10 Aug 2009 22:34:59 +0100 From: Uros Nedic Subject: RE: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A805BF5.4080402@sun.com> X-Originating-IP: [91.185.103.13] To: Alfred Peng Cc: Darren Moffar , DesktopDiscuss , storycrafter@gmail.com, lsarc-ext@sun.com Message-id: MIME-version: 1.0 Content-type: text/plain; charset=Windows-1252 Importance: Normal X-PMX-Version: 5.4.1.325704 X-Brightmail-Tracker: AAAAAA== X-Antispam: No, score=-2.6/5.0, scanned in 4.091sec at (localhost [127.0.0.1]) by smf-spamd v1.3.1 - http://smfs.sf.net/ References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A78883A.5070702@sun.com> <4A79ED0F.2080903@sun.com> <4A7A9E38.1060602@Sun.COM> <4A7ADB76.2000801@gmail.com> <4A7AECF0.4040801@Sun.COM> <4A7BD74C.10708@sun.com> <4A7D543F.9090301@sun.com> <4A805BF5.4080402@sun.com> X-OriginalArrivalTime: 10 Aug 2009 21:34:59.0762 (UTC) FILETIME=[699CC920:01CA1A02] Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by sac.sfbay.sun.com id n7ALkINN004200 Status: RO Content-Length: 8771 Is it possible that we base WebKit on Chrome's network stack? U. ---------------------------------------- > Date: Tue, 11 Aug 2009 01:42:13 +0800 > From: Alfred.Peng@Sun.COM > Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] > To: urosn@live.com > CC: Darren.Moffat@Sun.COM; desktop-discuss@opensolaris.org; storycrafter@gmail.com; lsarc-ext@Sun.COM > > Hi Uros, > > Thanks for the suggestions. > > I've sent email to Chrome developers with regards to the HTTPS support > of Chrome on Linux platform. The answer is that "Chrome does not use > libsoup on Linux." Actually they use their own custom network stack on > all platforms: http://src.chromium.org/viewvc/chrome/trunk/src/net/. > > -Alfred > > On 08/ 8/09 11:11 PM, Uros Nedic wrote: >> I see. Also I saw libsoup's developer citation earlier, but >> I thought that this issue has been already solved earlier >> by Google or Apple. >> >> I have two more sugesstions: >> >> [1] Currently, Google is under heavy development of Google OS >> which will be Linux-based OS for netbooks. I'm sure they are >> going to implement libsoup as underlying layer for WebKit's >> HTTPS communication. I based my idea having that in my mind. >> Just ask them how they did such resolution. >> >> [2] Let we extend libsoup with additional interfaces capable >> to deal with this issue, or to change actual implementation >> of interface we have conflict with. >> >> Keep in mind that you are SUN guys which means we should deliver >> better software than Linux world. Also, maybe I could help >> since I'm basically Telecommunications Engineer but I do programming >> too. I came from the country where we have faculties based >> on Russian style educational system :). >> >> Best, >> Uros Nedic, MSc >> >> ---------------------------------------- >> >>> Date: Sat, 8 Aug 2009 18:32:31 +0800 >>> From: Alfred.Peng@Sun.COM >>> Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] >>> To: urosn@live.com >>> CC: Darren.Moffat@Sun.COM; desktop-discuss@opensolaris.org; storycrafter@gmail.com; lsarc-ext@Sun.COM >>> >>> Hi Uros, >>> >>> Chrome browser does depend on WebKit. From its source code (788M source >>> tarball, HUGE) and ChangeLog, I don't think Chrome uses libsoup for >>> HTTPS support on Win and Mac. From the libsoup developer (link below), >>> "there is not currently any way to let the application decide on a >>> case-by-case basis whether or not to accept a certificate" with libsoup. >>> I doubt whether the way Google/Apple engineers used to solve this HTTPS >>> support problem can apply to our case. >>> >>> Thanks, >>> -Alfred >>> >>> On 08/ 8/09 12:20 AM, Uros Nedic wrote: >>> >>>> As a pure observer of this communication I would like to >>>> add one suggestion which, maybe, could be helpful. >>>> >>>> As far as I know Google's Chrome browser uses WebKit as >>>> well as Apple's Safari on both platforms (Win and Mac). >>>> >>>> You could ask Google and Apple engineers how they solved >>>> this problem. >>>> >>>> In Chrome when one certificate is not certified by some >>>> 'well known' CA browser just ask user what he would like >>>> to do. So it *is* possible to deal with this issue. >>>> >>>> I did not have time digging more deeply through Google's >>>> mailing lists on code.google.com nor to see Apple's but >>>> as far as I saw there they solved this issue. >>>> >>>> Hope it helps! >>>> >>>> Uros Nedic, MSc >>>> Belgrade, Serbia >>>> >>>> P.S: Please do not disable HTTPS. I'd be big mistake, from >>>> my perspective. >>>> >>>> ---------------------------------------- >>>> >>>> >>>>> Date: Fri, 7 Aug 2009 15:27:08 +0800 >>>>> From: Alfred.Peng@Sun.COM >>>>> To: Darren.Moffat@Sun.COM >>>>> CC: desktop-discuss@opensolaris.org; storycrafter@gmail.com; LSARC-ext@Sun.COM >>>>> Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] >>>>> >>>>> Hi Darren/Mark, >>>>> >>>>> Before I started the arc case, I sent a query with regards to this HTTPS >>>>> support issue to the WebKit community. Dan Winship, the libsoup >>>>> developer, gave me some insight into the problem: >>>>> http://lists.macosforge.org/pipermail/webkit-dev/2009-June/008566.html. >>>>> >>>>> >>>> >>>>> Roughly there are two points from the reply: >>>>> >>>>> - An x509 file containing the certificate can be passed to SoupSession >>>>> for verification. In this way, only the "correctly-named non-expired >>>>> certificates signed by one of those CAs" will be accepted, all others >>>>> will be rejected. From the libsoup client howto: >>>>> http://library.gnome.org/devel/libsoup/stable/libsoup-client-howto.html, >>>>> I think it's possible to make WebKit accept user-specified certificate >>>>> with some coding. On the other hand, we could point the >>>>> SOUP_SESSION_SSL_CA_FILE to the system bundled certificates if that's >>>>> available. >>>>> >>>>> - "There is not currently any way to let the application decide on a >>>>> case-by-case basis whether or not to accept a certificate." With >>>>> Firefox, users can decide whether they want to accept a certificate. >>>>> Users won't be able to do this with WebKit. >>>>> >>>>> As for the current status of the WebKit HTTPS support, I've verified >>>>> with the WebKit test Program, named GtkLauncher. It's a very simple >>>>> browser GUI. GtkLauncher can accept all the https request by default. If >>>>> I patch the code as Dan suggested, it denies all the https website instead. >>>>> >>>>>>From the source code: >>>>> http://svn.webkit.org/repository/webkit/trunk/WebCore/platform/network/soup/ResourceHandleSoup.cpp, >>>>> you can notice that WebKit uses soup_session_async_new to create the >>>>> SoupSession without setting any additional options. That's the reason >>>>> why WebKit ignores all certificate validation and accepts all >>>>> certificates by default I think. >>>>> >>>>> On 08/ 6/09 10:47 PM, Darren J Moffat wrote: >>>>> >>>>> >>>>>> Mark Martin wrote: >>>>>> >>>>>> >>>>>> >>>>>>> I don't think the only issue is the lack of a handy, well known cert >>>>>>> repository; the fact that the underlying implementation doesn't >>>>>>> validate properly would probably surprise folks. >>>>>>> >>>>>>> >>>>>>> >>>>>> That really depends on what you mean by "validate properly", sure there >>>>>> are standards that define how this is done but one persons proper >>>>>> validation is also over the top for other cases and highly in sufficient >>>>>> for others. >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>> The choices that I saw were: >>>>>>> a) Deliver with HTTPS disabled by default. Principle of least >>>>>>> astonishment. >>>>>>> >>>>>>> >>>>>>> >>>>>> By disabled by default is it available to consumers of WebKit easily or >>>>>> do they have to rebuild it ? >>>>>> >>>>>> >>>>>> >>>>> A possible workaround is that we could patch the code to enable >>>>> environment variable checking so that consumers of WebKit can switch on >>>>> the https support easily (no need to rebuild). By doing this, the HTTPS >>>>> support of WebKit 1.1.x will be consistent with the last WebKit arc >>>>> case. Just need to note that WebKit will still ignore the certificate >>>>> verification in this case. >>>>> >>>>> >>>>>>> b) Deliver with (incomplete and ostensibly unsafe) HTTPS enabled by >>>>>>> default. >>>>>>> >>>>>>> If you're insisting on B, how do you advise managing the gap? Log a >>>>>>> bug? Document a warning? Assume developers will be diligent or just know? >>>>>>> >>>>>>> >>>>>>> >>>>>> To be able to answer that I need to understand if this gap exists on >>>>>> other platforms delivering WebKit or is it somehow unique to OpenSolaris ? >>>>>> >>>>>> >>>>> There is an old version of WebKit in Ubuntu repository: >>>>> http://packages.ubunut.com/jaunty/libwebkit-1.0-1. It still uses libcURL >>>>> from the dependency list. With package "ca-certificates" installed on >>>>> Ubuntu by default, WebKit can accept the authorized certificates. >>>>> However, it won't accept the server certificates that can't be match >>>>> with the system bundled ones. That's to say, some of the https website >>>>> will fail to load. Since WebKit 1.1.x is targeted for GNOME 2.28, I >>>>> think it'll be probably available for the next Ubuntu release. We'll >>>>> know how Ubuntu handles HTTPS support with libsoup then. >>>>> >>>>> Personally I'd propose to disable the HTTPS support for now and push the >>>>> integration of certificates to OpenSolaris. When it's ready, we can >>>>> enable the HTTPS support. >>>>> >>>>> Thanks, >>>>> -Alfred >> > _________________________________________________________________ Drag n’ drop—Get easy photo sharing with Windows Live™ Photos. http://www.microsoft.com/windows/windowslive/products/photos.aspx From Alfred.Peng@Sun.COM Mon Aug 10 19:26:42 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7B2QfJH014968 for ; Mon, 10 Aug 2009 19:26:42 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n7B2Qfej032119 for <@sunmail2sca.sfbay.sun.com:lsarc-ext@sun.com>; Mon, 10 Aug 2009 20:26:41 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KO600K01XGHDV00@nwk-avmta-1.sfbay.Sun.COM> for lsarc-ext@sun.com (ORCPT lsarc-ext@sun.com); Mon, 10 Aug 2009 19:26:41 -0700 (PDT) Received: from sineb-mail-1.sun.com ([192.18.19.6]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KO600B7BXGFO3F0@nwk-avmta-1.sfbay.Sun.COM> for lsarc-ext@sun.com (ORCPT lsarc-ext@sun.com); Mon, 10 Aug 2009 19:26:41 -0700 (PDT) Received: from fe-apac-06.sun.com (fe-apac-06.sun.com [192.18.19.177] (may be forged)) by sineb-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n7B2QdHI020744 for ; Tue, 11 Aug 2009 02:26:39 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KO600D00XD9NB00@mail-apac.sun.com> for lsarc-ext@sun.com (ORCPT lsarc-ext@sun.com); Tue, 11 Aug 2009 10:26:39 +0800 (SGT) Received: from [192.168.1.71] ([unknown] [121.6.32.168]) by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KO600I5MXGEPWF0@mail-apac.sun.com> for lsarc-ext@sun.com (ORCPT lsarc-ext@sun.com); Tue, 11 Aug 2009 10:26:39 +0800 (SGT) Date: Tue, 11 Aug 2009 10:26:45 +0800 From: Alfred Peng Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: Sender: Alfred.Peng@Sun.COM To: Uros Nedic Cc: Darren Moffar , DesktopDiscuss , storycrafter@gmail.com, lsarc-ext@Sun.COM Message-id: <4A80D6E5.4000001@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A78883A.5070702@sun.com> <4A79ED0F.2080903@sun.com> <4A7A9E38.1060602@Sun.COM> <4A7ADB76.2000801@gmail.com> <4A7AECF0.4040801@Sun.COM> <4A7BD74C.10708@sun.com> <4A7D543F.9090301@sun.com> <4A805BF5.4080402@sun.com> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1.1) Gecko/20090721 Lightning/1.0pre Thunderbird/3.0b3 Status: RO Content-Length: 10258 To have better HTTPS support for WebKit, I think we have two options: - Work with the community to fix the bug in libsoup. - Submit a bug/RFE to add Chrome's network stack as an alternative network backend for WebKit. Since libsoup is tightly integrated into GNOME, I'd think option 1 will be a better/easier approach. Option 2 requires: - porting effort to make the Chrome network stack work on OpenSolaris first. It contains some platform specific code with a quick check, and depends on libevent and modp_b64 (base64 encoder/decoder). - expert from security team to evaluate the security impact of the Chrome network stack on OpenSolaris. - pushing the Chrome network stack to be included in GNOME and porting WebKit to the Chrome network stack. There might be other things that need to be done which I neglect. Please feel free to comment. Any help from the community is always appreciated. However, I don't think the WebKit integration should depend on all these. To integrate it is the first step (if we can come to an agreement on the HTTPS support), then people can further improve it. Thanks, -Alfred On 08/11/09 05:34 AM, Uros Nedic wrote: > Is it possible that we base WebKit on Chrome's network stack? > > U. > > ---------------------------------------- > >> Date: Tue, 11 Aug 2009 01:42:13 +0800 >> From: Alfred.Peng@Sun.COM >> Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] >> To: urosn@live.com >> CC: Darren.Moffat@Sun.COM; desktop-discuss@opensolaris.org; storycrafter@gmail.com; lsarc-ext@Sun.COM >> >> Hi Uros, >> >> Thanks for the suggestions. >> >> I've sent email to Chrome developers with regards to the HTTPS support >> of Chrome on Linux platform. The answer is that "Chrome does not use >> libsoup on Linux." Actually they use their own custom network stack on >> all platforms: http://src.chromium.org/viewvc/chrome/trunk/src/net/. >> >> -Alfred >> >> On 08/ 8/09 11:11 PM, Uros Nedic wrote: >> >>> I see. Also I saw libsoup's developer citation earlier, but >>> I thought that this issue has been already solved earlier >>> by Google or Apple. >>> >>> I have two more sugesstions: >>> >>> [1] Currently, Google is under heavy development of Google OS >>> which will be Linux-based OS for netbooks. I'm sure they are >>> going to implement libsoup as underlying layer for WebKit's >>> HTTPS communication. I based my idea having that in my mind. >>> Just ask them how they did such resolution. >>> >>> [2] Let we extend libsoup with additional interfaces capable >>> to deal with this issue, or to change actual implementation >>> of interface we have conflict with. >>> >>> Keep in mind that you are SUN guys which means we should deliver >>> better software than Linux world. Also, maybe I could help >>> since I'm basically Telecommunications Engineer but I do programming >>> too. I came from the country where we have faculties based >>> on Russian style educational system :). >>> >>> Best, >>> Uros Nedic, MSc >>> >>> ---------------------------------------- >>> >>> >>>> Date: Sat, 8 Aug 2009 18:32:31 +0800 >>>> From: Alfred.Peng@Sun.COM >>>> Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] >>>> To: urosn@live.com >>>> CC: Darren.Moffat@Sun.COM; desktop-discuss@opensolaris.org; storycrafter@gmail.com; lsarc-ext@Sun.COM >>>> >>>> Hi Uros, >>>> >>>> Chrome browser does depend on WebKit. From its source code (788M source >>>> tarball, HUGE) and ChangeLog, I don't think Chrome uses libsoup for >>>> HTTPS support on Win and Mac. From the libsoup developer (link below), >>>> "there is not currently any way to let the application decide on a >>>> case-by-case basis whether or not to accept a certificate" with libsoup. >>>> I doubt whether the way Google/Apple engineers used to solve this HTTPS >>>> support problem can apply to our case. >>>> >>>> Thanks, >>>> -Alfred >>>> >>>> On 08/ 8/09 12:20 AM, Uros Nedic wrote: >>>> >>>> >>>>> As a pure observer of this communication I would like to >>>>> add one suggestion which, maybe, could be helpful. >>>>> >>>>> As far as I know Google's Chrome browser uses WebKit as >>>>> well as Apple's Safari on both platforms (Win and Mac). >>>>> >>>>> You could ask Google and Apple engineers how they solved >>>>> this problem. >>>>> >>>>> In Chrome when one certificate is not certified by some >>>>> 'well known' CA browser just ask user what he would like >>>>> to do. So it *is* possible to deal with this issue. >>>>> >>>>> I did not have time digging more deeply through Google's >>>>> mailing lists on code.google.com nor to see Apple's but >>>>> as far as I saw there they solved this issue. >>>>> >>>>> Hope it helps! >>>>> >>>>> Uros Nedic, MSc >>>>> Belgrade, Serbia >>>>> >>>>> P.S: Please do not disable HTTPS. I'd be big mistake, from >>>>> my perspective. >>>>> >>>>> ---------------------------------------- >>>>> >>>>> >>>>> >>>>>> Date: Fri, 7 Aug 2009 15:27:08 +0800 >>>>>> From: Alfred.Peng@Sun.COM >>>>>> To: Darren.Moffat@Sun.COM >>>>>> CC: desktop-discuss@opensolaris.org; storycrafter@gmail.com; LSARC-ext@Sun.COM >>>>>> Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] >>>>>> >>>>>> Hi Darren/Mark, >>>>>> >>>>>> Before I started the arc case, I sent a query with regards to this HTTPS >>>>>> support issue to the WebKit community. Dan Winship, the libsoup >>>>>> developer, gave me some insight into the problem: >>>>>> http://lists.macosforge.org/pipermail/webkit-dev/2009-June/008566.html. >>>>>> >>>>>> >>>>>> >>>>> >>>>>> Roughly there are two points from the reply: >>>>>> >>>>>> - An x509 file containing the certificate can be passed to SoupSession >>>>>> for verification. In this way, only the "correctly-named non-expired >>>>>> certificates signed by one of those CAs" will be accepted, all others >>>>>> will be rejected. From the libsoup client howto: >>>>>> http://library.gnome.org/devel/libsoup/stable/libsoup-client-howto.html, >>>>>> I think it's possible to make WebKit accept user-specified certificate >>>>>> with some coding. On the other hand, we could point the >>>>>> SOUP_SESSION_SSL_CA_FILE to the system bundled certificates if that's >>>>>> available. >>>>>> >>>>>> - "There is not currently any way to let the application decide on a >>>>>> case-by-case basis whether or not to accept a certificate." With >>>>>> Firefox, users can decide whether they want to accept a certificate. >>>>>> Users won't be able to do this with WebKit. >>>>>> >>>>>> As for the current status of the WebKit HTTPS support, I've verified >>>>>> with the WebKit test Program, named GtkLauncher. It's a very simple >>>>>> browser GUI. GtkLauncher can accept all the https request by default. If >>>>>> I patch the code as Dan suggested, it denies all the https website instead. >>>>>> >>>>>> >From the source code: >>>>>> http://svn.webkit.org/repository/webkit/trunk/WebCore/platform/network/soup/ResourceHandleSoup.cpp, >>>>>> you can notice that WebKit uses soup_session_async_new to create the >>>>>> SoupSession without setting any additional options. That's the reason >>>>>> why WebKit ignores all certificate validation and accepts all >>>>>> certificates by default I think. >>>>>> >>>>>> On 08/ 6/09 10:47 PM, Darren J Moffat wrote: >>>>>> >>>>>> >>>>>> >>>>>>> Mark Martin wrote: >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>>> I don't think the only issue is the lack of a handy, well known cert >>>>>>>> repository; the fact that the underlying implementation doesn't >>>>>>>> validate properly would probably surprise folks. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>> That really depends on what you mean by "validate properly", sure there >>>>>>> are standards that define how this is done but one persons proper >>>>>>> validation is also over the top for other cases and highly in sufficient >>>>>>> for others. >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>>> The choices that I saw were: >>>>>>>> a) Deliver with HTTPS disabled by default. Principle of least >>>>>>>> astonishment. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>> By disabled by default is it available to consumers of WebKit easily or >>>>>>> do they have to rebuild it ? >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>> A possible workaround is that we could patch the code to enable >>>>>> environment variable checking so that consumers of WebKit can switch on >>>>>> the https support easily (no need to rebuild). By doing this, the HTTPS >>>>>> support of WebKit 1.1.x will be consistent with the last WebKit arc >>>>>> case. Just need to note that WebKit will still ignore the certificate >>>>>> verification in this case. >>>>>> >>>>>> >>>>>> >>>>>>>> b) Deliver with (incomplete and ostensibly unsafe) HTTPS enabled by >>>>>>>> default. >>>>>>>> >>>>>>>> If you're insisting on B, how do you advise managing the gap? Log a >>>>>>>> bug? Document a warning? Assume developers will be diligent or just know? >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>> To be able to answer that I need to understand if this gap exists on >>>>>>> other platforms delivering WebKit or is it somehow unique to OpenSolaris ? >>>>>>> >>>>>>> >>>>>>> >>>>>> There is an old version of WebKit in Ubuntu repository: >>>>>> http://packages.ubunut.com/jaunty/libwebkit-1.0-1. It still uses libcURL >>>>>> from the dependency list. With package "ca-certificates" installed on >>>>>> Ubuntu by default, WebKit can accept the authorized certificates. >>>>>> However, it won't accept the server certificates that can't be match >>>>>> with the system bundled ones. That's to say, some of the https website >>>>>> will fail to load. Since WebKit 1.1.x is targeted for GNOME 2.28, I >>>>>> think it'll be probably available for the next Ubuntu release. We'll >>>>>> know how Ubuntu handles HTTPS support with libsoup then. >>>>>> >>>>>> Personally I'd propose to disable the HTTPS support for now and push the >>>>>> integration of certificates to OpenSolaris. When it's ready, we can >>>>>> enable the HTTPS support. >>>>>> >>>>>> Thanks, >>>>>> -Alfred >>> >> > From lists@mcintyreweb.com Tue Aug 11 00:07:37 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7B77aVX016287 for ; Tue, 11 Aug 2009 00:07:37 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n7B74nlc020872; Tue, 11 Aug 2009 15:04:49 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KO700I07AC0K400@brm-avmta-1.central.sun.com>; Tue, 11 Aug 2009 01:04:48 -0600 (MDT) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KO7003IPABZYUD0@brm-avmta-1.central.sun.com>; Tue, 11 Aug 2009 01:04:47 -0600 (MDT) Received: from relay15i.sun.com (ip125.net129179-4.block1.us.syntegra.com [129.179.4.125]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n7B72ITr003146; Tue, 11 Aug 2009 07:04:47 +0000 (GMT) Received: from mmp11es.mmp.us.syntegra.com ([160.41.208.11] [160.41.208.11]) by relay15i.sun.com with ESMTP id BT-MMP-57673; Tue, 11 Aug 2009 07:04:43 +0000 (Z) Received: from relay13i.sun.com (relay13i.sun.com [129.179.4.123]) by mmp11es.mmp.us.syntegra.com with ESMTP id BT-MMP-44225174; Tue, 11 Aug 2009 07:04:39 +0000 (Z) Received: from remote.mcintyreweb.com ([67.23.1.228] [67.23.1.228]) by relay1i.sun.com with ESMTP id BT-MMP-1770122; Tue, 11 Aug 2009 06:58:59 +0000 (Z) Received: from twins.i.mcintyreweb.com (unknown [64.166.3.74]) by remote.mcintyreweb.com (Postfix) with ESMTPS id 0C44610C272; Mon, 10 Aug 2009 23:57:55 -0700 (PDT) Date: Mon, 10 Aug 2009 23:57:54 -0700 From: Hugh McIntyre Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: To: Uros Nedic Cc: Alfred Peng , lsarc-ext@sun.com, storycrafter@gmail.com, DesktopDiscuss , Darren Moffat Message-id: <4A811672.6000806@mcintyreweb.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 X-Brightmail-Tracker: AAAAAA== X-Antispam: No, score=-0.2/5.0, scanned in 3.141sec at (localhost [127.0.0.1]) by smf-spamd v1.3.1 - http://smfs.sf.net/ References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A78883A.5070702@sun.com> <4A79ED0F.2080903@sun.com> <4A7A9E38.1060602@Sun.COM> <4A7ADB76.2000801@gmail.com> <4A7AECF0.4040801@Sun.COM> <4A7BD74C.10708@sun.com> <4A7D543F.9090301@sun.com> User-Agent: Thunderbird 2.0.0.22 (Macintosh/20090605) Status: RO Content-Length: 1308 Uros Nedic wrote: > [2] Let we extend libsoup with additional interfaces capable > to deal with this issue, or to change actual implementation > of interface we have conflict with. If you look at the following libsoup bugs, it looks like libsoup is planning to add new certificate APIs, and therefore OpenSolaris should preferably not add it's own conflicting APIs. http://bugzilla.gnome.org/show_bug.cgi?id=507802 and http://bugzilla.gnome.org/show_bug.cgi?id=507801 (pass certs in memory, not just files) and http://bugzilla.gnome.org/show_bug.cgi?id=334021 There's more than a suggestion in one of these bugs that Fedora plans to migrate the SSL backend to Mozilla's NSS for Fedora at least, which OpenSolaris may not want to. But either way it seems this case should not get sidelined into inventing new APIs nor really get into a discussion of different WebKit network stacks. Instead the discussion should maybe stick to just the question of what the default HTTPS setting should be, whether Darren's suggestion of linking this case to shipping a working root CA file is appropriate, and how to document how to load alternate certs. For the documentation, it does seem this should be listed as some type of uncommitted if there is risk of another change in backend in future. Hugh. From Darren.Moffat@Sun.COM Tue Aug 11 02:01:52 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7B91qOo027997 for ; Tue, 11 Aug 2009 02:01:52 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n7B91nOE004091 for <@sunmail2sca.sfbay.sun.com:lsarc-ext@sun.com>; Tue, 11 Aug 2009 03:01:51 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KO700G05FR2U300@nwk-avmta-2.sfbay.sun.com> for lsarc-ext@sun.com (ORCPT lsarc-ext@sun.com); Tue, 11 Aug 2009 02:01:50 -0700 (PDT) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KO70017IFR15YB0@nwk-avmta-2.sfbay.sun.com> for lsarc-ext@sun.com (ORCPT lsarc-ext@sun.com); Tue, 11 Aug 2009 02:01:50 -0700 (PDT) Received: from fe-emea-10.sun.com (gmp-eb-lb-1-fe1.eu.sun.com [192.18.6.7] (may be forged)) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n7B91m5n002314 for ; Tue, 11 Aug 2009 09:01:49 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KO700D00F3W8M00@fe-emea-10.sun.com> for lsarc-ext@sun.com (ORCPT lsarc-ext@sun.com); Tue, 11 Aug 2009 10:01:38 +0100 (BST) Received: from [192.168.1.105] (cpc2-rdng20-2-0-cust917.15-3.cable.virginmedia.com [86.28.167.150]) by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KO700JBVFQJC080@fe-emea-10.sun.com> for lsarc-ext@sun.com (ORCPT lsarc-ext@sun.com); Tue, 11 Aug 2009 10:01:31 +0100 (BST) Date: Tue, 11 Aug 2009 10:01:23 +0100 From: Darren J Moffat Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A811672.6000806@mcintyreweb.com> Sender: Darren.Moffat@Sun.COM To: Hugh McIntyre Cc: Uros Nedic , Alfred Peng , lsarc-ext@Sun.COM, storycrafter@gmail.com, DesktopDiscuss Message-id: <4A813363.5030108@Sun.COM> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A78883A.5070702@sun.com> <4A79ED0F.2080903@sun.com> <4A7A9E38.1060602@Sun.COM> <4A7ADB76.2000801@gmail.com> <4A7AECF0.4040801@Sun.COM> <4A7BD74C.10708@sun.com> <4A7D543F.9090301@sun.com> <4A811672.6000806@mcintyreweb.com> User-Agent: Thunderbird 2.0.0.21 (X11/20090623) Status: RO Content-Length: 1787 Hugh McIntyre wrote: > Uros Nedic wrote: >> [2] Let we extend libsoup with additional interfaces capable >> to deal with this issue, or to change actual implementation >> of interface we have conflict with. > > If you look at the following libsoup bugs, it looks like > libsoup is planning to add new certificate APIs, and therefore > OpenSolaris should preferably not add it's own conflicting APIs. > > http://bugzilla.gnome.org/show_bug.cgi?id=507802 > > and > > http://bugzilla.gnome.org/show_bug.cgi?id=507801 (pass certs in memory, > not just files) > > and > > http://bugzilla.gnome.org/show_bug.cgi?id=334021 > > There's more than a suggestion in one of these bugs that Fedora plans to > migrate the SSL backend to Mozilla's NSS for Fedora at least, which > OpenSolaris may not want to. But either way it seems this case should > not get sidelined into inventing new APIs nor really get into a > discussion of different WebKit network stacks. I don't see why we wouldn't want to migrate to Mozilla NSS. In fact I would strongly encourage it. Some of the core developers of Mozilla NSS actually work for Sun. We already have core parts of OpenSolaris that either depend on NSS to function at all or can use it as an option. > Instead the discussion should maybe stick to just the question of what > the default HTTPS setting should be, whether Darren's suggestion of > linking this case to shipping a working root CA file is appropriate, and > how to document how to load alternate certs. Lets assume there is a file that had the same set of CA certificates as is present in firefox and it was in a format suitable for libsoup. With that assumption is there any reason not to have HTTPS enabled with Webkit pointing to that file ? -- Darren J Moffat From storycrafter@gmail.com Tue Aug 11 06:02:38 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7BD2bbm005252 for ; Tue, 11 Aug 2009 06:02:38 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n7BD2Wqj017803; Tue, 11 Aug 2009 14:02:36 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KO700E15QWA8T00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 11 Aug 2009 06:02:34 -0700 (PDT) Received: from sca-ea-mail-1.sun.com ([192.18.43.24]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KO7002ZKQW9L4E0@nwk-avmta-1.sfbay.Sun.COM>; Tue, 11 Aug 2009 06:02:33 -0700 (PDT) Received: from relay43i.sun.com ([192.5.209.74]) by sca-ea-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n7BCx9LD004817; Tue, 11 Aug 2009 13:02:33 +0000 (GMT) Received: from mmp41es.mmp.us.syntegra.com ([160.41.221.10] [160.41.221.10]) by relay43i.sun.com with ESMTP id BT-MMP-2334769; Tue, 11 Aug 2009 13:02:33 +0000 (Z) Received: from relay42i.sun.com (relay42i.sun.com [192.5.209.72]) by mmp41es.mmp.us.syntegra.com with ESMTP id BT-MMP-52111626; Tue, 11 Aug 2009 13:02:15 +0000 (Z) Received: from mail-yw0-f204.google.com ([209.85.211.204] [209.85.211.204]) by relay4i.sun.com with ESMTP id BT-MMP-1543161; Tue, 11 Aug 2009 13:02:15 +0000 (Z) Received: by mail-yw0-f204.google.com with SMTP id 42so5765324ywh.30 for ; Tue, 11 Aug 2009 06:02:14 -0700 (PDT) Received: by 10.90.118.19 with SMTP id q19mr1795729agc.54.1249995734527; Tue, 11 Aug 2009 06:02:14 -0700 (PDT) Received: from ?172.16.202.89? (68-252-106-20.ded.ameritech.net [68.252.106.20]) by mx.google.com with ESMTPS id 7sm6379231aga.27.2009.08.11.06.02.12 (version=TLSv1/SSLv3 cipher=RC4-MD5) ; Tue, 11 Aug 2009 06:02:13 -0700 (PDT) Date: Tue, 11 Aug 2009 08:02:11 -0500 From: Mark Martin Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A813363.5030108@Sun.COM> To: Darren J Moffat Cc: Hugh McIntyre , Uros Nedic , Alfred Peng , lsarc-ext@sun.com, DesktopDiscuss Message-id: <4A816BD3.6010705@gmail.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from :user-agent:mime-version:to:cc:subject:references:in-reply-to :content-type:content-transfer-encoding; bh=oyZ8jKwP6OKb94Aw5U6auoyGblnzwpHBEvSM7+3SHw0=; b=uJI5sFKpGsvSglzRE0W1OgdQJoXA/3umQPZCJKRpYlTiuhUJKdjUve9lUEBgTwlwBG CeN29jH/85Voz48YfpX/8rc9psZSGAanTauEuJ6IWglRRNf8MzIWRI2Phb9qzBORxY2O 5svxIACbK8iBcu+rAeNBd8iQLTyS2c+642S9Y= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=S0F/sYfO5g88VC92X046jUD/2MIFBeKSwzlEF8+JPuHAe1jz7OrhwkZZvKYnwB9un4 L5AAemi3EsmgSq8Nc9DVX1jbomwIMsmTKW/GsMD32ABDEcREfgitokwFfRAm8mGpG/2p P9JovX7Ior7BwvFql/GOapkruRYQkMSan+FkQ= X-PMX-Version: 5.4.1.325704 X-Brightmail-Tracker: AAAAAA== X-Antispam: No, score=-2.6/5.0, scanned in 10.910sec at (localhost [127.0.0.1]) by smf-spamd v1.3.1 - http://smfs.sf.net/ References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A78883A.5070702@sun.com> <4A79ED0F.2080903@sun.com> <4A7A9E38.1060602@Sun.COM> <4A7ADB76.2000801@gmail.com> <4A7AECF0.4040801@Sun.COM> <4A7BD74C.10708@sun.com> <4A7D543F.9090301@sun.com> <4A811672.6000806@mcintyreweb.com> <4A813363.5030108@Sun.COM> User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) Status: RO Content-Length: 3352 Darren J Moffat wrote: > Hugh McIntyre wrote: >> Uros Nedic wrote: >>> [2] Let we extend libsoup with additional interfaces capable >>> to deal with this issue, or to change actual implementation >>> of interface we have conflict with. >> >> If you look at the following libsoup bugs, it looks like >> libsoup is planning to add new certificate APIs, and therefore >> OpenSolaris should preferably not add it's own conflicting APIs. >> >> http://bugzilla.gnome.org/show_bug.cgi?id=507802 >> >> and >> >> http://bugzilla.gnome.org/show_bug.cgi?id=507801 (pass certs in memory, >> not just files) >> >> and >> >> http://bugzilla.gnome.org/show_bug.cgi?id=334021 >> >> There's more than a suggestion in one of these bugs that Fedora plans >> to migrate the SSL backend to Mozilla's NSS for Fedora at least, >> which OpenSolaris may not want to. But either way it seems this case >> should not get sidelined into inventing new APIs nor really get into >> a discussion of different WebKit network stacks. > > I don't see why we wouldn't want to migrate to Mozilla NSS. In fact I > would strongly encourage it. Some of the core developers of Mozilla > NSS actually work for Sun. We already have core parts of OpenSolaris > that either depend on NSS to function at all or can use it as an option. > >> Instead the discussion should maybe stick to just the question of >> what the default HTTPS setting should be, whether Darren's suggestion >> of linking this case to shipping a working root CA file is >> appropriate, and how to document how to load alternate certs. > > Lets assume there is a file that had the same set of CA certificates > as is present in firefox and it was in a format suitable for libsoup. > With that assumption is there any reason not to have HTTPS enabled > with Webkit pointing to that file ? > Makes sense to me. My experience so far is that in cases like this, an opinion is issued with advice language intended for project management/funding for another project to deliver that necessary deliverable. Do we need to continue to hold this project hostage or can we re-approve it with the directive that the PMO needs to fund a project to deliver CA certs so that we can switch the default from /dev/null to /home/of/certs? In the interest of moving along, I'd like to suggest something, thinking aloud as it were. I'm going to work on the assumption that delivery of CA certs involves only 3 non-trivial issues: a) where they go, and b) how/where are they obtained, and c) how to deal with CRL. Assuming that those issues could be solved by a quick discussion, then I believe the community could solve this issue quite quickly by proposing a project through the external project creation process, and delivering the dozen+/- certificates. I wonder if the aforementioned advice section could address an audience /other/ than the usual Sun funding sources -- would that be a first for an ARC advice to explicitly acknowledge an external community and source of projects? This seems like such a no-brainer that I'd like to offer leading that effort if I can get some confirmation on my assumptions. Of course, if the project team feels that they could name that tune in fewer notes, they're more than welcome to, and I'd still be happy to lend my keyboard in whatever way makes sense. From Darren.Moffat@sun.com Tue Aug 11 08:55:57 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7BFtvG5012999 for ; Tue, 11 Aug 2009 08:55:57 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n7BFtuqC015406 for <@sunmail2sca.sfbay.sun.com:lsarc-ext@sun.com>; Tue, 11 Aug 2009 08:55:56 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KO70030XYX8DV00@brm-avmta-1.central.sun.com> for lsarc-ext@sun.com (ORCPT lsarc-ext@Sun.COM); Tue, 11 Aug 2009 09:55:56 -0600 (MDT) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KO70098DYX6K0E0@brm-avmta-1.central.sun.com> for lsarc-ext@sun.com (ORCPT lsarc-ext@Sun.COM); Tue, 11 Aug 2009 09:55:55 -0600 (MDT) Received: from fe-emea-10.sun.com (gmp-eb-lb-1-fe1.eu.sun.com [192.18.6.7] (may be forged)) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n7BFtrYw002497 for ; Tue, 11 Aug 2009 15:55:53 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KO700A00YL25T00@fe-emea-10.sun.com> for lsarc-ext@Sun.COM (ORCPT lsarc-ext@Sun.COM); Tue, 11 Aug 2009 16:55:46 +0100 (BST) Received: from [192.168.1.105] (cpc2-rdng20-2-0-cust917.15-3.cable.virginmedia.com [86.28.167.150]) by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KO700FZSYWYXHA0@fe-emea-10.sun.com> for lsarc-ext@Sun.COM (ORCPT lsarc-ext@Sun.COM); Tue, 11 Aug 2009 16:55:46 +0100 (BST) Date: Tue, 11 Aug 2009 16:55:37 +0100 From: Darren J Moffat Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A816BD3.6010705@gmail.com> Sender: Darren.Moffat@sun.com To: Mark Martin Cc: Hugh McIntyre , Uros Nedic , Alfred Peng , LSARC-ext@sun.com, DesktopDiscuss Message-id: <4A819479.3090905@Sun.COM> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A78883A.5070702@sun.com> <4A79ED0F.2080903@sun.com> <4A7A9E38.1060602@Sun.COM> <4A7ADB76.2000801@gmail.com> <4A7AECF0.4040801@Sun.COM> <4A7BD74C.10708@sun.com> <4A7D543F.9090301@sun.com> <4A811672.6000806@mcintyreweb.com> <4A813363.5030108@Sun.COM> <4A816BD3.6010705@gmail.com> User-Agent: Thunderbird 2.0.0.21 (X11/20090623) Status: RO Content-Length: 2533 Mark Martin wrote: >>> Instead the discussion should maybe stick to just the question of >>> what the default HTTPS setting should be, whether Darren's suggestion >>> of linking this case to shipping a working root CA file is >>> appropriate, and how to document how to load alternate certs. >> >> Lets assume there is a file that had the same set of CA certificates >> as is present in firefox and it was in a format suitable for libsoup. >> With that assumption is there any reason not to have HTTPS enabled >> with Webkit pointing to that file ? >> > Makes sense to me. > > My experience so far is that in cases like this, an opinion is issued > with advice language intended for project management/funding for another > project to deliver that necessary deliverable. Do we need to continue > to hold this project hostage or can we re-approve it with the directive > that the PMO needs to fund a project to deliver CA certs so that we can > switch the default from /dev/null to /home/of/certs? Usually this would be a case dependency on this case so that it can't deliver until the case that delivers the CA certs bundle has delivered. > In the interest of moving along, I'd like to suggest something, thinking > aloud as it were. I'm going to work on the assumption that delivery of > CA certs involves only 3 non-trivial issues: a) where they go, and b) > how/where are they obtained, and c) how to deal with CRL. Assuming that > those issues could be solved by a quick discussion, then I believe the > community could solve this issue quite quickly by proposing a project > through the external project creation process, and delivering the > dozen+/- certificates. I wonder if the aforementioned advice section > could address an audience /other/ than the usual Sun funding sources -- > would that be a first for an ARC advice to explicitly acknowledge an > external community and source of projects? The project to do this is already in progress and I've just filed: PSARC/2009/430 Default system CA (X.509) Certificates So this case should be dependent on that one. In theory it doesn't need to depend on it to deliver since the absence of the CA file define in 2009/403 is equivalent to the default of /dev/null. So when 2009/403 does deliver this case automatically causes HTTPS to be enabled. Normally I wouldn't suggest this type of dependency but I think it is safe in this instance and it doesn't time this case to my delivery schedule for PSARC/2009/430. -- Darren J Moffat From Alfred.Peng@sun.com Tue Aug 11 22:17:31 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7C5HUCd013808 for ; Tue, 11 Aug 2009 22:17:31 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n7C5HR5L016665 for <@sunmail2sca.sfbay.sun.com:lsarc-ext@sun.com>; Wed, 12 Aug 2009 13:17:29 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KO9006030148F00@nwk-avmta-2.sfbay.sun.com> for lsarc-ext@sun.com (ORCPT lsarc-ext@sun.com); Tue, 11 Aug 2009 22:17:28 -0700 (PDT) Received: from sineb-mail-2.sun.com ([192.18.19.7]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KO900BOR00IQV90@nwk-avmta-2.sfbay.sun.com> for lsarc-ext@sun.com (ORCPT lsarc-ext@sun.com); Tue, 11 Aug 2009 22:17:28 -0700 (PDT) Received: from fe-apac-06.sun.com (fe-apac-06.sun.com [192.18.19.177] (may be forged)) by sineb-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n7C5H549013715 for ; Wed, 12 Aug 2009 05:17:05 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KO800900ZNOYV00@mail-apac.sun.com> for lsarc-ext@sun.com (ORCPT lsarc-ext@sun.com); Wed, 12 Aug 2009 13:17:05 +0800 (SGT) Received: from [192.168.1.71] ([unknown] [121.6.32.168]) by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KO900EPB00HWEG0@mail-apac.sun.com> for lsarc-ext@sun.com (ORCPT lsarc-ext@sun.com); Wed, 12 Aug 2009 13:17:05 +0800 (SGT) Date: Wed, 12 Aug 2009 13:17:11 +0800 From: Alfred Peng Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A813363.5030108@Sun.COM> Sender: Alfred.Peng@sun.com To: Darren J Moffat Cc: Hugh McIntyre , Uros Nedic , lsarc-ext@sun.com, storycrafter@gmail.com, DesktopDiscuss Message-id: <4A825057.4000704@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A78883A.5070702@sun.com> <4A79ED0F.2080903@sun.com> <4A7A9E38.1060602@Sun.COM> <4A7ADB76.2000801@gmail.com> <4A7AECF0.4040801@Sun.COM> <4A7BD74C.10708@sun.com> <4A7D543F.9090301@sun.com> <4A811672.6000806@mcintyreweb.com> <4A813363.5030108@Sun.COM> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1.1) Gecko/20090721 Lightning/1.0pre Thunderbird/3.0b3 Status: RO Content-Length: 1016 On 08/11/09 05:01 PM, Darren J Moffat wrote: >> Instead the discussion should maybe stick to just the question of what >> the default HTTPS setting should be, whether Darren's suggestion of >> linking this case to shipping a working root CA file is appropriate, and >> how to document how to load alternate certs. >> > Lets assume there is a file that had the same set of CA certificates as > is present in firefox and it was in a format suitable for libsoup. With > that assumption is there any reason not to have HTTPS enabled with > Webkit pointing to that file ? Hi Darren, I notice that a fast-track (PSARC/2009/430) has been created for CA (X.509) Certificates integration. Thanks a lot for working on this. With this set of CA certificates available, I think it's reasonable to enable HTTPS support for WebKit and point SOUP_SESSION_SSL_CA_FILE to "/etc/certs/cacert.pem". BTW, is there a test version of CA certificates file so that we can do some test with for WebKit? Best Regards, -Alfred From Darren.Moffat@Sun.COM Wed Aug 12 02:10:29 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7C9ASNv022411 for ; Wed, 12 Aug 2009 02:10:28 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n7C9AQ8T015986 for <@sunmail2sca.sfbay.sun.com:lsarc-ext@sun.com>; Wed, 12 Aug 2009 17:10:27 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KO900D01ATDBU00@nwk-avmta-1.sfbay.Sun.COM> for lsarc-ext@sun.com (ORCPT lsarc-ext@sun.com); Wed, 12 Aug 2009 02:10:25 -0700 (PDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KO9006AHATCEU30@nwk-avmta-1.sfbay.Sun.COM> for lsarc-ext@sun.com (ORCPT lsarc-ext@sun.com); Wed, 12 Aug 2009 02:10:25 -0700 (PDT) Received: from fe-emea-10.sun.com (gmp-eb-lb-1-fe1.eu.sun.com [192.18.6.7] (may be forged)) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n7C9AOH8013065 for ; Wed, 12 Aug 2009 09:10:24 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KO900I009ORA600@fe-emea-10.sun.com> for lsarc-ext@sun.com (ORCPT lsarc-ext@sun.com); Wed, 12 Aug 2009 10:10:15 +0100 (BST) Received: from [192.168.1.105] (cpc2-rdng20-2-0-cust917.15-3.cable.virginmedia.com [86.28.167.150]) by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KO900JNLASQI470@fe-emea-10.sun.com> for lsarc-ext@sun.com (ORCPT lsarc-ext@sun.com); Wed, 12 Aug 2009 10:10:02 +0100 (BST) Date: Wed, 12 Aug 2009 10:09:54 +0100 From: Darren J Moffat Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A825057.4000704@sun.com> Sender: Darren.Moffat@Sun.COM To: Alfred Peng Cc: LSARC-ext@Sun.COM, DesktopDiscuss Message-id: <4A8286E2.5020002@Sun.COM> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A78883A.5070702@sun.com> <4A79ED0F.2080903@sun.com> <4A7A9E38.1060602@Sun.COM> <4A7ADB76.2000801@gmail.com> <4A7AECF0.4040801@Sun.COM> <4A7BD74C.10708@sun.com> <4A7D543F.9090301@sun.com> <4A811672.6000806@mcintyreweb.com> <4A813363.5030108@Sun.COM> <4A825057.4000704@sun.com> User-Agent: Thunderbird 2.0.0.21 (X11/20090623) Status: RO Content-Length: 1129 Alfred Peng wrote: > On 08/11/09 05:01 PM, Darren J Moffat wrote: >>> Instead the discussion should maybe stick to just the question of what >>> the default HTTPS setting should be, whether Darren's suggestion of >>> linking this case to shipping a working root CA file is appropriate, and >>> how to document how to load alternate certs. >>> >> Lets assume there is a file that had the same set of CA certificates as >> is present in firefox and it was in a format suitable for libsoup. With >> that assumption is there any reason not to have HTTPS enabled with >> Webkit pointing to that file ? > Hi Darren, > > I notice that a fast-track (PSARC/2009/430) has been created for CA > (X.509) Certificates integration. Thanks a lot for working on this. > > With this set of CA certificates available, I think it's reasonable to > enable HTTPS support for WebKit and point SOUP_SESSION_SSL_CA_FILE to > "/etc/certs/cacert.pem". > > BTW, is there a test version of CA certificates file so that we can do > some test with for WebKit? Use this for your testing: http://curl.haxx.se/ca/cacert.pem -- Darren J Moffat From Brian.Cameron@sun.com Tue Aug 18 21:41:31 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7J4fV9A002363 for ; Tue, 18 Aug 2009 21:41:31 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n7J4fSNv014841 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Wed, 19 Aug 2009 05:41:30 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KOL00E05X14VE00@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.COM); Tue, 18 Aug 2009 21:41:28 -0700 (PDT) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KOL0084IX13E050@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.COM); Tue, 18 Aug 2009 21:41:28 -0700 (PDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n7J4fRHF013826 for ; Wed, 19 Aug 2009 04:41:27 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KOL00H00WZFPI00@mail-amer.sun.com> for LSARC-ext@Sun.COM (ORCPT LSARC-ext@Sun.COM); Tue, 18 Aug 2009 22:41:27 -0600 (MDT) Received: from [192.168.1.67] ([unknown] [69.213.24.197]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KOL00B3WX127AF0@mail-amer.sun.com>; Tue, 18 Aug 2009 22:41:27 -0600 (MDT) Date: Tue, 18 Aug 2009 23:41:52 -0500 From: Brian Cameron Subject: Re: WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> Sender: Brian.Cameron@sun.com To: Brian Cameron Cc: LSARC-ext@sun.com, Alfred.Peng@sun.com, desktop-discuss@opensolaris.org Message-id: <4A8B8290.2010301@sun.com> MIME-version: 1.0 Content-type: multipart/mixed; boundary="Boundary_(ID_J+eKKLHyDq2KXlTWITx7Wg)" X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1.1) Gecko/20090804 Thunderbird/3.0b3 Status: RO Content-Length: 4224 This is a multi-part message in MIME format. --Boundary_(ID_J+eKKLHyDq2KXlTWITx7Wg) Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT Based on the discussion so far, I have updated the WebKit onepager in the case materials. See attached diff file for details of these changes. This case was approved at the August 5th meeting, but then was re-opened when Darren Moffat raised issues with how SSL certificates are managed. I believe these updates addresses this remaining issue. If Darren can confirm we can mark the case closed. I extended the timer to August 21st to give time for this to happen. Thanks, Brian --Boundary_(ID_J+eKKLHyDq2KXlTWITx7Wg) Content-type: text/plain; name=webkit.diff Content-transfer-encoding: 7BIT Content-disposition: attachment; filename=webkit.diff --- onepager-webkitv6-4.txt Wed Aug 5 13:31:26 2009 +++ onepager-webkitv6-5.txt Tue Aug 18 21:29:50 2009 @@ -106,12 +106,22 @@ The libcURL HTTP backend support has been removed from WebKit 1.1.x. The default HTTP backend is now libsoup. WebKit uses libsoup to verify the - peer's certificates for HTTPS connections. Since there are no well - known CA certificates shipped in OpenSolaris, HTTPS support will be - disabled for WebKit by calling soup_session_async_new_with_options and - setting SOUP_SESSION_SSL_CA_FILE to "/dev/null". Meanwhile, libsoup is - also used for HTTP auth handling with optional GNOME Keyring support. + peer's certificates for HTTPS connections. With the integration of + system CA (X.509) Certificates, WebKit enables its HTTPS support by + calling soup_session_async_new_with_options and setting + SOUP_SESSION_SSL_CA_FILE to "/etc/certs/cacert.pem". By doing this, + WebKit will accept correctly-named non-expired certificates signed by + one of those CAs, and reject all others by default. WebKit consumers + can call + g_object_set(webkit_get_default_session(), + SOUP_SESSION_SSL_CA_FILE, ..., + NULL); + + to define a valid CA file for certificate verification. Meanwhile, + libsoup is also used for HTTP auth handling with optional GNOME Keyring + support. + WebKit 1.1.x enables HTML5 Video support by using GStreamer framework as the media backend. This makes it possible for the video content to be embedded in SVG and manipulated with CSS and JavaScript. @@ -153,6 +163,8 @@ cURL Obsolete Uncommitted PSARC/2007/165 libsoup, GStreamer Committed LSARC/2007/520 + Default system CA (X.509) Certificates + Committed PSARC/2009/430 4.6. Doc Impact: @@ -172,12 +184,21 @@ 4.9. Security Impact: WebKit uses libsoup to verify the peer's certificates for HTTPS - connections, instead of libcurl. Since there are no well known CA - certificates shipped in OpenSolaris, HTTPS support will be disabled - for WebKit by calling soup_session_async_new_with_options and setting - SOUP_SESSION_SSL_CA_FILE to "/dev/null". Meanwhile, libsoup is also - used for HTTP auth handling with optional GNOME Keyring support. + connections, instead of libcurl. With the integration of system CA + (X.509) Certificates, WebKit enables its HTTPS support by calling + soup_session_async_new_with_options and setting SOUP_SESSION_SSL_CA_FILE + to "/etc/certs/cacert.pem". By doing this, WebKit will accept + correctly-named non-expired certificates signed by one of those CAs, + and reject all others by default. WebKit consumers can call + + g_object_set(webkit_get_default_session(), + SOUP_SESSION_SSL_CA_FILE, ..., + NULL); + to define a valid CA file for certificate verification. Meanwhile, + libsoup is also used for HTTP auth handling with optional GNOME + Keyring support. + 4.10. Dependencies: None. --Boundary_(ID_J+eKKLHyDq2KXlTWITx7Wg)-- From William.Walker@sun.com Wed Aug 19 05:56:42 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7JCufSA025295 for ; Wed, 19 Aug 2009 05:56:42 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n7JCudkI020384 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Wed, 19 Aug 2009 13:56:41 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KOM00J03JYGYN00@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 19 Aug 2009 06:56:40 -0600 (MDT) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KOM007ZVJYFC050@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 19 Aug 2009 06:56:39 -0600 (MDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n7JCudJj026032 for ; Wed, 19 Aug 2009 12:56:39 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KOM00G00JY4VV00@mail-amer.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 19 Aug 2009 06:56:39 -0600 (MDT) Received: from [192.168.1.100] ([unknown] [68.112.255.247]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KOM004AKJYEID90@mail-amer.sun.com>; Wed, 19 Aug 2009 06:56:39 -0600 (MDT) Date: Wed, 19 Aug 2009 08:58:50 -0400 From: Willie Walker Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A8B8290.2010301@sun.com> Sender: William.Walker@sun.com To: Brian Cameron Cc: Brian Cameron , LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <2c9faf914fa6dde394af5117b883c95d@sun.com> MIME-version: 1.0 X-Mailer: Apple Mail (2.624) Content-type: text/plain; CHARSET=US-ASCII; format=flowed; delsp=yes Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A8B8290.2010301@sun.com> Status: RO Content-Length: 1300 Hi Brian: If there is a chance, some clarification should be made about the a11y statement. The WebKit team and GNOME teams are working hard to provide fundamental a11y support for WebKit, but there is a lot of work to do. See: http://mail.gnome.org/archives/desktop-devel-list/2009-July/ msg00066.html Furthermore, the first phase, which is what is being worked on now, does not include ARIA support: http://www.w3.org/WAI/intro/aria Currently, the WebKit a11y work is still on-going, and lack of resources from the WebKit side is putting WebKit a11y support at risk for 2.28.0. Will On Aug 19, 2009, at 12:41 AM, Brian Cameron wrote: > > Based on the discussion so far, I have updated the WebKit onepager > in the case materials. See attached diff file for details of these > changes. > > This case was approved at the August 5th meeting, but then was > re-opened when Darren Moffat raised issues with how SSL certificates > are managed. > > I believe these updates addresses this remaining issue. If Darren > can confirm we can mark the case closed. I extended the timer to > August 21st to give time for this to happen. > > Thanks, > > Brian > _______________________________________________ > desktop-discuss mailing list > desktop-discuss@opensolaris.org From Brian.Cameron@sun.com Wed Aug 19 16:09:15 2009 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7JN9FWk018591 for ; Wed, 19 Aug 2009 16:09:15 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n7JN9EBa026566 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Wed, 19 Aug 2009 16:09:15 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KON0080HCBFZE00@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 19 Aug 2009 16:09:15 -0700 (PDT) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KON008FFCBEV100@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 19 Aug 2009 16:09:14 -0700 (PDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n7JN9EAl015174 for ; Wed, 19 Aug 2009 23:09:14 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KON00H00C8K4E00@mail-amer.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 19 Aug 2009 17:09:14 -0600 (MDT) Received: from [192.168.1.67] ([unknown] [69.213.24.197]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KON00EFGCBCPD10@mail-amer.sun.com>; Wed, 19 Aug 2009 17:09:13 -0600 (MDT) Date: Wed, 19 Aug 2009 18:09:38 -0500 From: Brian Cameron Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <2c9faf914fa6dde394af5117b883c95d@sun.com> Sender: Brian.Cameron@sun.com To: Willie Walker Cc: Brian Cameron , LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <4A8C8632.8070208@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A8B8290.2010301@sun.com> <2c9faf914fa6dde394af5117b883c95d@sun.com> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1.1) Gecko/20090804 Thunderbird/3.0b3 Status: RO Content-Length: 964 Willie: > If there is a chance, some clarification should be made about the a11y > statement. The WebKit team and GNOME teams are working hard to provide > fundamental a11y support for WebKit, but there is a lot of work to do. See: > > http://mail.gnome.org/archives/desktop-devel-list/2009-July/msg00066.html > > Furthermore, the first phase, which is what is being worked on now, does > not include ARIA support: http://www.w3.org/WAI/intro/aria > > Currently, the WebKit a11y work is still on-going, and lack of resources > from the WebKit side is putting WebKit a11y support at risk for 2.28.0. What further clarification is needed aside from the information you provide above? Obviously there will be a negative impact to users who need a11y features if we integrate WebKit before these issues are addressed. Are you suggesting that WebKit not integrate in Solaris until it is more fully accessible? If so, what do you recommend be done instead? Brian From William.Walker@sun.com Wed Aug 19 17:14:48 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7K0Em3j011371 for ; Wed, 19 Aug 2009 17:14:48 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n7K0EkgM006469 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Wed, 19 Aug 2009 18:14:48 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KON00107FCNNH00@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 19 Aug 2009 17:14:47 -0700 (PDT) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KON00GJVFCMR440@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 19 Aug 2009 17:14:46 -0700 (PDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n7K0Ek3L025352 for ; Thu, 20 Aug 2009 00:14:46 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KON00600F4UB500@mail-amer.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 19 Aug 2009 18:14:46 -0600 (MDT) Received: from [192.168.1.103] ([unknown] [68.112.255.247]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KON003LPFCLFW10@mail-amer.sun.com>; Wed, 19 Aug 2009 18:14:46 -0600 (MDT) Date: Wed, 19 Aug 2009 20:12:24 -0400 From: Willie Walker Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A8C8632.8070208@sun.com> Sender: William.Walker@sun.com To: Brian Cameron Cc: Brian Cameron , LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <4A8C94E8.7020509@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A8B8290.2010301@sun.com> <2c9faf914fa6dde394af5117b883c95d@sun.com> <4A8C8632.8070208@sun.com> User-Agent: Thunderbird 2.0.0.21 (X11/20090323) Status: RO Content-Length: 1590 Hi Brian: The problem is that this portion of the document can mislead people into thinking WebKit a11y is working and complete: "WebKit supports the AT-SPI accessibility layer since version 1.0.x. The GNOME accessibility team are working hard with WebKit team to ensure WebKit is accessible when GNOME 2.28 is released." The clarification I provided hopefully would prevent any confusion. I'm not really the one to make the call about whether WebKit integrates or not, and will forward this on to my peers in the APO who can help make that call. Will Brian Cameron wrote: > > Willie: > >> If there is a chance, some clarification should be made about the a11y >> statement. The WebKit team and GNOME teams are working hard to provide >> fundamental a11y support for WebKit, but there is a lot of work to do. >> See: >> >> http://mail.gnome.org/archives/desktop-devel-list/2009-July/msg00066.html >> >> Furthermore, the first phase, which is what is being worked on now, does >> not include ARIA support: http://www.w3.org/WAI/intro/aria >> >> Currently, the WebKit a11y work is still on-going, and lack of resources >> from the WebKit side is putting WebKit a11y support at risk for 2.28.0. > > What further clarification is needed aside from the information you > provide above? Obviously there will be a negative impact to users who > need a11y features if we integrate WebKit before these issues are > addressed. > > Are you suggesting that WebKit not integrate in Solaris until it is > more fully accessible? If so, what do you recommend be done instead? > > Brian From Brian.Cameron@sun.com Thu Aug 20 11:13:11 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7KIDAsL024903 for ; Thu, 20 Aug 2009 11:13:11 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n7KICrH5008589 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Fri, 21 Aug 2009 02:13:10 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KOO00617T9UMY00@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 20 Aug 2009 11:13:06 -0700 (PDT) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KOO003ZTT9SCN50@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 20 Aug 2009 11:13:05 -0700 (PDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n7KID46w028083 for ; Thu, 20 Aug 2009 18:13:04 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KOO00E00SS95C00@mail-amer.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 20 Aug 2009 12:13:04 -0600 (MDT) Received: from [129.153.250.53] ([unknown] [129.153.250.53]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KOO00AL1T8W0PD0@mail-amer.sun.com>; Thu, 20 Aug 2009 12:12:32 -0600 (MDT) Date: Thu, 20 Aug 2009 13:12:57 -0500 From: Brian Cameron Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A8C8632.8070208@sun.com> Sender: Brian.Cameron@sun.com To: Brian Cameron Cc: Willie Walker , Brian Cameron , LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <4A8D9229.6010205@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A8B8290.2010301@sun.com> <2c9faf914fa6dde394af5117b883c95d@sun.com> <4A8C8632.8070208@sun.com> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1.1) Gecko/20090804 Thunderbird/3.0b3 Status: RO Content-Length: 1870 Willie: > Are you suggesting that WebKit not integrate in Solaris until it is > more fully accessible? If so, what do you recommend be done instead? I notice that you raised this issue in the thread "Who is using WebKit in GNOME 2.28" on the GNOME desktop-devel-list@gnome.org. From that discussion it sounds like yelp will not be using it in the 2.28 timeframe, but will likely switch to WebKit for GNOME 2.30. Other programs which use it are devhelp, epiphany, and seed. Is that a complete list? Of these, we only ship devhelp. Not sure about the plans for devhelp, or how important a11y support in devhelp is, so it would be good to get clarification about that. The main reason for integrating WebKit is so that it can be embedded in programs like yelp and devhelp. If WebKit is not usably accessible, then we can continue to deliver older versions of the yelp and devhelp modules which do not use WebKit and not lose any accessibility. That said, I do not think this needs to impact whether we deliver WebKit. When the Desktop team first delivered Firefox and Thunderbird they were also not usably accessible and it took some time for the upstream communities to address this. We can choose to deliver WebKit and also choose not to use it in programs like yelp and devkit if lack of accessibility is an issue for yelp and/or devkit. So, would it be acceptable to separate these two issues? We can approve WebKit for integration and then have a future case which will seek approval for making use of it in programs like yelp and devkit. Perhaps this could be addressed in the upcoming GNOME 2.28 Umbrella case. Would that be agreeable? At any rate, this case is due to time-out tomorrow, and this is the only remaining open issue. Do you think it will be possible to wrap up this issue by then, or do we need to further extend the timeout? Brian From William.Walker@sun.com Thu Aug 20 11:29:12 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7KITCTx025528 for ; Thu, 20 Aug 2009 11:29:12 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n7KISveG007856 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Thu, 20 Aug 2009 12:29:11 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KOO0070VU0MLY00@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 20 Aug 2009 11:29:10 -0700 (PDT) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KOO003UAU0MCK70@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 20 Aug 2009 11:29:10 -0700 (PDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n7KITAVK005444 for ; Thu, 20 Aug 2009 18:29:10 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KOO00400T1QE900@mail-amer.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 20 Aug 2009 12:29:10 -0600 (MDT) Received: from [192.168.1.103] ([unknown] [68.112.255.247]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KOO006L2U0L2730@mail-amer.sun.com>; Thu, 20 Aug 2009 12:29:09 -0600 (MDT) Date: Thu, 20 Aug 2009 10:26:46 -0400 From: Willie Walker Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A8D9229.6010205@sun.com> Sender: William.Walker@sun.com To: Brian Cameron Cc: Brian Cameron , LSARC-ext@sun.com, desktop-discuss@opensolaris.org Message-id: <4A8D5D26.3080808@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A8B8290.2010301@sun.com> <2c9faf914fa6dde394af5117b883c95d@sun.com> <4A8C8632.8070208@sun.com> <4A8D9229.6010205@sun.com> User-Agent: Thunderbird 2.0.0.21 (X11/20090323) Status: RO Content-Length: 3005 Hi Brian: Brian Cameron wrote: >> Are you suggesting that WebKit not integrate in Solaris until it is >> more fully accessible? If so, what do you recommend be done instead? > > I notice that you raised this issue in the thread "Who is using WebKit > in GNOME 2.28" on the GNOME desktop-devel-list@gnome.org. From that > discussion it sounds like yelp will not be using it in the 2.28 > timeframe, but will likely switch to WebKit for GNOME 2.30. Yep - I raised it there as a means to help us determine what we need to do for accessibility on the OpenSolaris desktop. > Other programs which use it are devhelp, epiphany, and seed. Is > that a complete list? Of these, we only ship devhelp. Not sure about > the plans for devhelp, or how important a11y support in devhelp is, so > it would be good to get clarification about that. The list came from the GNOME release team and was based upon jhbuild dependencies: http://mail.gnome.org/archives/desktop-devel-list/2009-August/msg00275.html I've no idea if it is complete or not, but I suspect it is. > The main reason for integrating WebKit is so that it can be embedded > in programs like yelp and devhelp. If WebKit is not usably accessible, > then we can continue to deliver older versions of the yelp and devhelp > modules which do not use WebKit and not lose any accessibility. > > That said, I do not think this needs to impact whether we deliver > WebKit. When the Desktop team first delivered Firefox and Thunderbird > they were also not usably accessible and it took some time for the > upstream communities to address this. Agreed. There are two purposes for this discussion. The first is to recognize that WebKit is not a shoe-in for a11y. I think this needs to be recorded in the ARC case and we need to track some sort of get well plan. The second is to understand the impact of shipping WebKit without a good a11y implementation. Given that yelp will likely stick with Gecko, the main touchpoint/intersection with OpenSolaris for 2.28 seems to be devhelp, and I believe that's probably OK. > So, would it be acceptable to separate these two issues? We can > approve WebKit for integration and then have a future case which > will seek approval for making use of it in programs like yelp and > devkit. Perhaps this could be addressed in the upcoming GNOME 2.28 > Umbrella case. Would that be agreeable? Yep! > At any rate, this case is due to time-out tomorrow, and this is the > only remaining open issue. Do you think it will be possible to > wrap up this issue by then, or do we need to further extend the > timeout? I think we're good to go. In addition, my ideal for the GNOME community would be that it's OK to develop against WebKit with a future goal of migrating to it, but that the default switches for GNOME modules should ensure that GNOME provides an accessible solution. With that, the upstream stuff in GNOME will cause fewer special-cases and issues downstream in OpenSolaris. Will From Brian.Cameron@Sun.COM Thu Aug 20 11:33:17 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7KIXG4f026230 for ; Thu, 20 Aug 2009 11:33:16 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n7KIX7tY005145 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Thu, 20 Aug 2009 19:33:15 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KOO00727U7EVA00@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.COM); Thu, 20 Aug 2009 11:33:14 -0700 (PDT) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KOO003KBU7DCN80@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.COM); Thu, 20 Aug 2009 11:33:14 -0700 (PDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n7KIXDfC007444 for ; Thu, 20 Aug 2009 18:33:13 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KOO00400T8AH400@mail-amer.sun.com> for LSARC-ext@Sun.COM (ORCPT LSARC-ext@Sun.COM); Thu, 20 Aug 2009 12:33:13 -0600 (MDT) Received: from [129.153.250.53] ([unknown] [129.153.250.53]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KOO009H0U76X650@mail-amer.sun.com>; Thu, 20 Aug 2009 12:33:07 -0600 (MDT) Date: Thu, 20 Aug 2009 13:33:32 -0500 From: Brian Cameron Subject: Re: [desktop-discuss] WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <4A8D5D26.3080808@sun.com> Sender: Brian.Cameron@Sun.COM To: Willie Walker Cc: Brian Cameron , LSARC-ext@Sun.COM, desktop-discuss@opensolaris.org Message-id: <4A8D96FC.3050206@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> <4A8B8290.2010301@sun.com> <2c9faf914fa6dde394af5117b883c95d@sun.com> <4A8C8632.8070208@sun.com> <4A8D9229.6010205@sun.com> <4A8D5D26.3080808@sun.com> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1.1) Gecko/20090804 Thunderbird/3.0b3 Status: RO Content-Length: 2082 Willie: >> The main reason for integrating WebKit is so that it can be embedded >> in programs like yelp and devhelp. If WebKit is not usably accessible, >> then we can continue to deliver older versions of the yelp and devhelp >> modules which do not use WebKit and not lose any accessibility. >> >> That said, I do not think this needs to impact whether we deliver >> WebKit. When the Desktop team first delivered Firefox and Thunderbird >> they were also not usably accessible and it took some time for the >> upstream communities to address this. > > Agreed. There are two purposes for this discussion. The first is to > recognize that WebKit is not a shoe-in for a11y. I think this needs to > be recorded in the ARC case and we need to track some sort of get well > plan. That seems reasonable. Future updates of WebKit will need to come through ARC again, and that will be a good time to review the state of its accessibility again. >> So, would it be acceptable to separate these two issues? We can >> approve WebKit for integration and then have a future case which >> will seek approval for making use of it in programs like yelp and >> devkit. Perhaps this could be addressed in the upcoming GNOME 2.28 >> Umbrella case. Would that be agreeable? > > Yep! Sounds good. In this case, I think this case will be approved tomorrow. Future ARC cases need to highlight any a11y impact by importing WebKit interfaces, and get separate approval. >> At any rate, this case is due to time-out tomorrow, and this is the >> only remaining open issue. Do you think it will be possible to >> wrap up this issue by then, or do we need to further extend the >> timeout? > > I think we're good to go. In addition, my ideal for the GNOME community > would be that it's OK to develop against WebKit with a future goal of > migrating to it, but that the default switches for GNOME modules should > ensure that GNOME provides an accessible solution. With that, the > upstream stuff in GNOME will cause fewer special-cases and issues > downstream in OpenSolaris. Good luck! :) Brian From Brian.Cameron@sun.com Fri Aug 21 18:00:15 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n7M10FqG007672 for ; Fri, 21 Aug 2009 18:00:15 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n7M10Fio037289 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Fri, 21 Aug 2009 19:00:15 -0600 (MDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KOR00E036SFWC00@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.COM); Fri, 21 Aug 2009 19:00:15 -0600 (MDT) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KOR000K76SEO240@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.COM); Fri, 21 Aug 2009 19:00:14 -0600 (MDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n7M10E6V029858 for ; Sat, 22 Aug 2009 01:00:14 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KOR001006JC6400@mail-amer.sun.com> for LSARC-ext@Sun.COM (ORCPT LSARC-ext@Sun.COM); Fri, 21 Aug 2009 19:00:14 -0600 (MDT) Received: from [129.153.250.167] ([unknown] [129.153.250.167]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KOR001H56SACA40@mail-amer.sun.com>; Fri, 21 Aug 2009 19:00:11 -0600 (MDT) Date: Fri, 21 Aug 2009 20:00:37 -0500 From: Brian Cameron Subject: Re: WebKit 1.1.x [LSARC/2009/409 FastTrack timeout 08/04/2009] In-reply-to: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> Sender: Brian.Cameron@sun.com To: Brian Cameron Cc: LSARC-ext@sun.com, Alfred.Peng@sun.com, desktop-discuss@opensolaris.org Message-id: <4A8F4335.7050903@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907231342.n6NDgoWU026636@sac.sfbay.sun.com> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1.1) Gecko/20090804 Thunderbird/3.0b3 Status: RO Content-Length: 8542 I am marking this case as closed approved since it times out today. I believe that all issues raised have been addressed. The two issues raised included: - Issues regarding how WebKit supports SSL certificates. Alfred Peng worked with Darren Moffat to address this issue, and the case materials were updated to reflect this. - Concern about a11y support. It was agreed that this case only integrates WebKit, and does not approve it to be embedded into other programs. Any module which embeds WebKit will need to be ARC'ed separately and provide details on any a11y impact. Thanks, Brian On 07/23/09 08:42, Brian Cameron wrote: > > Template Version: @(#)sac_nextcase 1.68 02/23/09 SMI > This information is Copyright 2009 Sun Microsystems > 1. Introduction > 1.1. Project/Component Working Name: > WebKit 1.1.x > 1.2. Name of Document Author/Supplier: > Author: Alfred Peng > 1.3 Date of This Document: > 23 July, 2009 > 4. Technical Description > Copyright 2009 Sun Microsystems > > 1. Introduction > 1.1. Project/Component Working Name: > > WebKit 1.1.x > > 1.2. Name of Document Author/Supplier: > > Alfred Peng > > 1.3. Date of This Document: > > 07/21/2009 > > 1.3.1. Date this project was conceived: > > 10/01/2006 > > 1.4. Name of Major Document Customer(s)/Consumer(s): > > 1.4.1. The PAC or CPT you expect to review your project: > > Solaris PAC > > 1.4.2. The ARC(s) you expect to review your project: > > LSARC > > 1.4.3. The Director/VP who is "Sponsoring" this project: > > robert.odea@sun.com > > 1.4.4. The name of your business unit: > > Software - OPG > > 1.5. Email Aliases: > > 1.5.1. Responsible Manager: > > leo.binchy@sun.com > > 1.5.2. Responsible Engineer: > > alfred.peng@sun.com > > 1.5.3. Marketing Manager: > > glynn.foster@sun.com > > 1.5.4. Interest List: > > desktop-discuss@opensolaris.org > > 2. Project Summary > 2.1. Project Description: > > WebKit is an open source web browser engine. It's also the name of the > Mac OS X system framework version of the engine that's used by Safari, > Dashboard, Mail, and many other OS X applications. WebKit's HTML and > JavaScript code began as a branch of the KHTML and KJS libraries from > KDE. > > WebKit can be built on top of different widget backends, which includes > GTK, Qt, wxWidgets and some others as well. For this case, WebKit will > be built with GTK+ on Solaris. It's the engine that will be used for > embedding a browser in various GNOME applications, devhelp/yelp for > example. > > WebKitGTK+ is a community sub-project maintained mostly by GNOME and > GTK+ developers. It's implemented directly on top of GTK+, GLib and > GNOME libraries and provides lightweight web viewing and editing > features as well as being the basis for complete web browser > applications. It supports the latest web standards and offers good > performance and memory usage characteristics on the desktop. > > The release schedule for WebKitGTK+ will be matched with GNOME's > 6-month release cycle. Currently, GNOME applications including > devhelp/epiphany have switched to link against WebKit. > > 4. Technical Description: > 4.1. Details: > > WebKit has the following features: > - CSS 2.1, CSS3 support. > - DOM (Document Object Model) > - Styleable form controls with CSS. > - Drosera (A JavaScript debugger for WebKit that can be used > with any application that uses WebKit) > - Enhanced Rich Text Editing. > - XML techologies support, including XPath, SVG and XSLTProcessor > (JavaScript API for XSLT). > - Netscape-style (NPAPI) plugins support. > - WebKit embedding API (provides clients with a public API for > loading, displaying and manipulating Web content.) > > New in 1.1.x: > - HTTP auth with optional GNOME keyring storage. > - HTML5 media element support. > - Spell check support. > > WebKit supports the AT-SPI accessibility layer since version 1.0.x. > The GNOME accessibility team are working hard with WebKit team to ensure > WebKit is accessible when GNOME 2.28 is released. > > The libcURL HTTP backend support has been removed from WebKit 1.1.x. The > default HTTP backend is now libsoup. WebKit uses libsoup to verify the > peer's certificates for HTTPS connections. Currently, WebKit accepts all > SSL certificates automatically by default as libsoup doesn't support > client SSL certificate. Meanwhile, libsoup is also used for HTTP auth > handling with optional GNOME Keyring support. > > WebKit 1.1.x enables HTML5 Video support by using GStreamer framework > as the media backend. This makes it possible for the video content to > be embedded in SVG and manipulated with CSS and JavaScript. > > 4.2. Bug/RFE Number(s): > > None. > > 4.3. In Scope: > > See above. > > 4.4. Out of Scope: > > See above. > > 4.5. Interfaces: > > This section only hightlights the changes since LSARC/2008/782. > > Exported Interface: > > Interface Stability Comment > ---------------------------------------------------------------------------- > /usr/lib/libwebkit-1.0.so.1 Obsolete Volatile Symbolic link > /usr/lib/${MACH64}/libwebkit-1.0.so.1 Obsolete Volatile Symbolic link > /usr/lib/libwebkit-1.0.so Volatile Symbolic link > /usr/lib/libwebkit-1.0.so.2 Volatile Symbolic link > /usr/lib/libwebkit-1.0.so.2.7.0 Volatile webkit lib > /usr/lib/${MACH64}/libwebkit-1.0.so Volatile Symbolic link > /usr/lib/${MACH64}/libwebkit-1.0.so.2 Volatile Symbolic link > /usr/lib/${MACH64}/libwebkit-1.0.so.2.7.0 > Volatile 64bit webkit lib > > Imported Interfaces: > > Interface Stability Comments > ---------------------------------------------------------------------------- > > cURL Obsolete Uncommitted PSARC/2007/165 > libsoup, GStreamer Committed LSARC/2007/520 > > 4.6. Doc Impact: > > None. > > 4.7. I18N/L10N Impact: > > The JDS team and the G11N team are working together to evaluate and > provide I18N/L10N support. > > 4.8. Packaging& Delivery: > > The project will be delivering the following packages: > SUNWwebkit > SUNWwebkit-devel > > 4.9. Security Impact: > > WebKit uses libsoup to verify the peer's certificates for HTTPS > connections, instead of libcurl. Currently, WebKit accepts all > SSL certificates automatically by default as libsoup doesn't support > client SSL certificate. Meanwhile, libsoup is also used for HTTP auth > handling with optional GNOME Keyring support. > > 4.10. Dependencies: > > None. > > 5. Reference Documents: > > 1. SUNWwebkit,SUNWwebkit-devel > pkgmap > pkginfo > depend > > 2. XDG Base Directory Specification > http://standards.freedesktop.org/basedir-spec/latest/ar01s03.html > > 3. WebKit community > http://webkit.org/ > http://webkitgtk.org/ > > 4. WebKit wiki page > http://trac.webkit.org/wiki > > 5. References for web standards: > CSS 2.1: http://www.w3.org/TR/CSS21/ > CSS 3: http://www.w3.org/Style/CSS/current-work#CSS3 > DOM: http://www.w3.org/DOM/ > XPath: http://www.w3.org/TR/xpath > SVG: http://www.w3.org/Graphics/SVG/ > XSLT: http://www.w3.org/TR/xslt > HTML5: http://www.w3.org/TR/html5/ > > 6. Resources and Schedule > 6.4. Steering Committee requested information > 6.4.1. Consolidation C-team Name: > Desktop > 6.5. ARC review type: FastTrack > 6.6. ARC Exposure: open >