Hi Michael,

There are a couple problems with checking in a version of ICU.

* Other libraries used by WebKit have dependencies on ICU. For our ports 
harfbuzz, libxml2, libxslt, libpsl and CFlite all require ICU.
* ICU doesn't come with a CMake build system and its non-trivial to make one. 
We've largely used this https://github.com/LibCMaker/ICU_CMake_Files to handle 
building ICU but its use is also why ICU is the library we aren't able to 
update on a regular cadence.
* We aren't terribly good with updating things in ThirdParty. Sometimes this is 
because there aren't releases, see gtest. Others because they don't actually 
have releases, see ANGLE. On top of that there might be local modifications to 
make things work within WebKit.

Could you possibly give some overview of how WebKit is packaged by Linux 
distributions? I would have thought they would use flatpack/jhbuild to get the 
dependencies that the WPE/GTK ports are using especially if those dependencies 
have their own set of bug and security fixes. My experience with Linux is 
minimal so some context here would be appreciated.

For our ports we use vcpkg to build and manage dependencies. We host it at 
https://github.com/WebKitForWindows/WebKitRequirements and have an internal 
fork for PlayStation. I'm guessing it's probably similar to flatpack/jhbuild in 
terms of functionality but in our case we just use GitHub releases to have 
binaries ready.

Perhaps there are better ways for us to approach the requirements that would be 
beneficial to all ports?

-----Original Message-----
From: webkit-dev <webkit-dev-boun...@lists.webkit.org> On Behalf Of Michael 
Sent: Thursday, April 9, 2020 10:32 AM
To: Kirsling, Ross <ross.kirsl...@sony.com>
Cc: webkit-dev@lists.webkit.org
Subject: Re: [webkit-dev] Introducing a minimum ICU version for WebKit

Any objections to uploading a bundled ICU 60 under Source/ThirdParty?

Seems easier than forcing downstreams to work out bundling themselves. 
Most major distros will just stop providing WebKit security updates if we don't 
bundle it for them. E.g. this is sure to kill Ubuntu's current long streak of 
providing our updates to Ubuntu 16.04.

webkit-dev mailing list
webkit-dev mailing list

Reply via email to