Bug#987958: buster-pu: package liferea/1.12.6-1+deb10u1

2021-06-10 Thread Adam D. Barratt
On Thu, 2021-06-10 at 11:19 +0200, Paul Gevers wrote:
> Hi Adam,
> 
> On 30-05-2021 22:06, Paul Gevers wrote:
> > On Sun, 2 May 2021 20:23:30 +0200 Paul Gevers 
> > wrote:
> > > [ Reason ]
> > > It used to be enough to declare the liferea custom scheme as
> > > local to access resources with a file scheme, but for WebKit2Gtk
> > > >= 2.32 it looks like it is necessary to register the custom
> > > scheme with a handler.
> > > Although WebKit2Gtk hasn't been updated to 2.32 in stable yet, I
> > > understand that it will be relatively soon for security support
> > > reasons.
> > 
> > webkit2gtk 2.32.1-1~deb10u1 entered stable today. So this bug is
> > now
> > impacting liferea users in stable.
> 
> Upstream now has a blog post about it:
> 
> https://lzone.de/liferea/blog/Recent-WebKitGTK-HTML-renderer-instabilities?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+LifereaBlog+%28Liferea+Blog%29
> 
> I've just uploaded the version I had prepared.

Sorry, I could have sworn I replied to this the other day. :-(

Thanks for the update.

Regards,

Adam



Bug#987958: buster-pu: package liferea/1.12.6-1+deb10u1

2021-06-10 Thread Paul Gevers
Hi Adam,

On 30-05-2021 22:06, Paul Gevers wrote:
> On Sun, 2 May 2021 20:23:30 +0200 Paul Gevers  wrote:
>> [ Reason ]
>> It used to be enough to declare the liferea custom scheme as local to
>> access resources with a file scheme, but for WebKit2Gtk >= 2.32 it looks
>> like it is necessary to register the custom scheme with a handler.
>> Although WebKit2Gtk hasn't been updated to 2.32 in stable yet, I
>> understand that it will be relatively soon for security support reasons.
> 
> webkit2gtk 2.32.1-1~deb10u1 entered stable today. So this bug is now
> impacting liferea users in stable.

Upstream now has a blog post about it:

https://lzone.de/liferea/blog/Recent-WebKitGTK-HTML-renderer-instabilities?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+LifereaBlog+%28Liferea+Blog%29

I've just uploaded the version I had prepared.

Paul



OpenPGP_signature
Description: OpenPGP digital signature


Bug#987958: buster-pu: package liferea/1.12.6-1+deb10u1

2021-05-30 Thread Paul Gevers
Hi Adam,

On Sun, 2 May 2021 20:23:30 +0200 Paul Gevers  wrote:
> [ Reason ]
> It used to be enough to declare the liferea custom scheme as local to
> access resources with a file scheme, but for WebKit2Gtk >= 2.32 it looks
> like it is necessary to register the custom scheme with a handler.
> Although WebKit2Gtk hasn't been updated to 2.32 in stable yet, I
> understand that it will be relatively soon for security support reasons.

webkit2gtk 2.32.1-1~deb10u1 entered stable today. So this bug is now
impacting liferea users in stable.

Paul



OpenPGP_signature
Description: OpenPGP digital signature


Bug#987958: buster-pu: package liferea/1.12.6-1+deb10u1

2021-05-02 Thread Paul Gevers
Package: release.debian.org
User: release.debian@packages.debian.org
Usertags: pu
Tags: buster
Severity: normal

Dear Adam,

[ Reason ]
It used to be enough to declare the liferea custom scheme as local to
access resources with a file scheme, but for WebKit2Gtk >= 2.32 it looks
like it is necessary to register the custom scheme with a handler.
Although WebKit2Gtk hasn't been updated to 2.32 in stable yet, I
understand that it will be relatively soon for security support reasons.

Thanks to pabs for filing the bug (in unstable). Upstream fixed the
issue already and the patch is taken from there. I had to adapt it to
apply cleanly, but upstream was nice and confirmed that what I did was sane.

[ Impact ]
The summary bar in the main window will look odd.

[ Tests ]
Unfortunately, none. I still want to teach myself how to use qemu, but
otherwise I don't have the ability to try out the liferea with the change.

[ Risks ]
The involved code is not very complex.

[ Checklist ]
  [x] all changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in stable

[ Changes ]
Adapted upstream patch to work correctly with WebKit2Gtk >= 2.32.

[ Other info ]
I have chosen to not upload already, because I can't say that the patch
has been tested yet. If you agree that the risk is low, I'll go ahead
with the upload.

Paul
diff -Nru liferea-1.12.6/debian/changelog liferea-1.12.6/debian/changelog
--- liferea-1.12.6/debian/changelog 2018-12-09 21:44:09.0 +0100
+++ liferea-1.12.6/debian/changelog 2021-04-30 20:54:00.0 +0200
@@ -1,3 +1,10 @@
+liferea (1.12.6-1+deb10u1) buster; urgency=medium
+
+  * Add patch to work with webkit2gtk >= 2.32:
+34d26be00328a68d2f1625c78b54dc168da0648e.patch (Closes: #987448)
+
+ -- Paul Gevers   Fri, 30 Apr 2021 20:54:00 +0200
+
 liferea (1.12.6-1) unstable; urgency=medium
 
   * New upstream release
diff -Nru 
liferea-1.12.6/debian/patches/34d26be00328a68d2f1625c78b54dc168da0648e.patch 
liferea-1.12.6/debian/patches/34d26be00328a68d2f1625c78b54dc168da0648e.patch
--- 
liferea-1.12.6/debian/patches/34d26be00328a68d2f1625c78b54dc168da0648e.patch
1970-01-01 01:00:00.0 +0100
+++ 
liferea-1.12.6/debian/patches/34d26be00328a68d2f1625c78b54dc168da0648e.patch
2021-04-30 20:54:00.0 +0200
@@ -0,0 +1,52 @@
+From 0b199d75be2bc41575de71ed5b5e0a6aa08c30bd Mon Sep 17 00:00:00 2001
+From: Laetitia Berthelot 
+Date: Mon, 5 Apr 2021 14:26:38 +0200
+Subject: [PATCH] Register liferea custom scheme, fixes #973
+
+It used to be enought to declare the liferea custom scheme as local to
+access resources with file scheme, but for WebKit2Gtk >= 2.32 it looks
+like it is necessary to register the custom scheme with a handler.
+
+The handler doesn't do anything interesting for now as we just pass the
+content with webkit_web_view_load_bytes and use the file scheme to
+access resources, but it could be used to load Liferea resources in the
+future ...
+---
+ src/webkit/webkit.c | 17 +
+ 1 file changed, 17 insertions(+)
+
+diff --git a/src/webkit/webkit.c b/src/webkit/webkit.c
+index cc90e4ba0..e43c58149 100644
+--- a/src/webkit/webkit.c
 b/src/webkit/webkit.c
+@@ -370,6 +370,21 @@ liferea_webkit_impl_download_started (WebKitWebContext
*context,
+ }
+ 
+ static void
++liferea_webkit_handle_liferea_scheme (WebKitURISchemeRequest *request, 
gpointer user_data)
++{
++  const gchar *uri = webkit_uri_scheme_request_get_uri (request);
++  GInputStream *stream;
++  gssize length;
++  gchar *contents;
++
++  contents = g_strdup_printf ("Placeholder handler for liferea scheme. 
URI requested : %s", uri);
++  length = (gssize) strlen (contents);
++  stream = g_memory_input_stream_new_from_data (contents, length, g_free);
++  webkit_uri_scheme_request_finish (request, stream, length, 
"text/plain");
++  g_object_unref (stream);
++}
++
++static void
+ liferea_webkit_impl_init (LifereaWebKitImpl *self)
+ {
+   gbooleandisable_javascript, enable_plugins;
+@@ -379,6 +394,8 @@ liferea_webkit_impl_init (LifereaWebKitImpl *self)
+   self->dbus_connections = NULL;
+   self->settings = webkit_settings_new ();
+   font = webkit_get_font (&fontSize);
++  webkit_web_context_register_uri_scheme 
(webkit_web_context_get_default(), "liferea",
++  (WebKitURISchemeRequestCallback) 
liferea_webkit_handle_liferea_scheme,NULL,NULL);
+ 
+   security_manager = webkit_web_context_get_security_manager 
(webkit_web_context_get_default ());
+   webkit_security_manager_register_uri_scheme_as_local (security_manager, 
"liferea");
diff -Nru liferea-1.12.6/debian/patches/series 
liferea-1.12.6/debian/patches/series
--- liferea-1.12.6/debian/patches/series2018-12-09 21:44:09.0 
+0100
+++ liferea-1.12.6/debian/patches/series2021-04-30 20:54:00.0 
+0200
@@ -1,3 +1,4 @@
 debian-example-feeds.patch
 www-b