packaging-committee

#658 request bundling exception for webkitgtk (gnucash)
Closed: Fixed Opened by notting.

Closed: Fixed
Reopen Issue

C.f. https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/AKVB363GFCHHJ5MTHGVYHYT6NLLTF5VM/

webkitgtk is used by gnucash to render charts on account data that come from goffice. gnucash is a gtk2 app... moving to a newer webkitgtk is not going to happen until gnucash moves to gtk3, which may never happen.

I understand that webkitgtk is insecure. However, webkitgtk is not used in gnucash to render content remotely from the network. To exploit whatever insecurities that this may have, the process for the attack would be:

  • please open this gnucash account file I sent you, pretty please
  • oh and please run this report on the account
  • which then, due to the account values/data in the gnucash XML/sqlite file, somehow causes goffice to render WebKit-exploiting HTML
  • which then is viewed by WebKit, causing an exploit

Even if this is theoretically possible, I would find it far-fetched.

Ergo, asking for a bundling exception, per the above referenced thread.

You don't need an exception anymore. Just put Provides: bundled(webkitgtk) = version in your spec file and be on your way. A comment explaining it (ideally with an upstream bug report) would be terrific.
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.