Flatpak-building a legacy GTK2 app that uses WebKit

[Bastien Nocera]

On Wed, 2019-01-02 at 10:16 -0500, Dominic Delabruere wrote:
> Hello all,
> 
> Last night I was acquainting myself with flatpak-builder, and trying
> to use it to build a sandboxed version of gnome-inform7 [1]. Inform 7
> has not-yet-open-sourced core component and a historically slow
> release cycle; the most recent release was in 2015 [2] and its
> packages for popular Linux distributions are becoming antiquated as
> outdated dependencies disappear from official repos. I'm not yet a
> contributor to it, just a past user who wanted to try it again. So
> last night I was trying to see if I could get the UI working on
> Fedora
> 29 by building it for Flatpak (instead of using a VM, or reverting
> important shared libraries to a deprecated version). But I'm finding
> it a little difficult to satisfy one particular dependency: a
> GTK2-compatible version of WebKit. gnome-inform7 uses WebKit to
> display local and dynamically generated HTML, and this is a central
> part of the UI. The oldest version of org.gnome.Platform and
> org.gnome.Sdk I could find was 3.24, and neither of these ships with
> such a version of WebKit. I've found that compiling it is very time
> consuming and brings in its own dependencies. (I've had trouble
> bundling a version of geoclue that the autotools configuration for
> WebKit will accept; I can get flatpak-builder to build a recent
> version of geoclue with meson, but then, in the next module of my
> manifest, the configuration script for WebKit reports that geoclue
> was
> not detected. I tried an older version of geoclue before giving up
> for
> the night, but building this version with autotools failed because of
> yet another dependency.) I found some discussion on an MR for the
> Flathub configuration for the GIMP [3], where it was ultimately
> decided to go ahead with building WebKit as a module in the manifest,
> despite all the time it added to the build. However, participants in
> the discussion mention the possibility of keeping the GIMP on an
> older
> version (of the Flatpak GNOME runtime, I'm assuming?) to avoid
> problems with WebKit. Is there some Flatpak SDK/Runtime I haven't
> found yet, that ships with a GTK2-compatible version of WebKit?

There aren't any SDKs shipping GTK2 versions of WebKit. They're not
supported anymore, and probably full of security holes.

So, given that you have chosen to build your own GTK2 WebKit :)

I don't think you should care too much about whether Geoclue support is
built into your build of WebKit, because there's just no way this
program would be allowed access to the network, given the number of
security issues a GTK2 WebKit is likely to have. Most of the rest of
the WebKit dependencies should already be easily available.

Cheers