-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Wed, 22 Jan 2020 13:44:09 +0100 Source: webkit2gtk Architecture: source Version: 2.26.3-1 Distribution: unstable Urgency: high Maintainer: Debian WebKit Maintainers <pkg-webkit-maintainers@lists.alioth.debian.org> Changed-By: Alberto Garcia <berto@igalia.com> Closes: 944731 948106 948839 949430 Changes: webkit2gtk (2.26.3-1) unstable; urgency=high . * New upstream release. * The WebKitGTK security advisory WSA-2019-0006 lists the following security fixes in the latest versions of WebKitGTK: + CVE-2019-8765, CVE-2019-8821, CVE-2019-8822 (fixed in 2.24.4) + CVE-2019-8710, CVE-2019-8743, CVE-2019-8764, CVE-2019-8766, CVE-2019-8782, CVE-2019-8808, CVE-2019-8815 (fixed in 2.26.0) + CVE-2019-8783, CVE-2019-8811, CVE-2019-8813, CVE-2019-8816, CVE-2019-8819, CVE-2019-8820, CVE-2019-8823 (fixed in 2.26.1) + CVE-2019-8812, CVE-2019-8814 (fixed in 2.26.2) * Build without the bubblewrap sandbox if the required dependencies are not available (Closes: #944731): + debian/rules: - Pass -DENABLE_BUBBLEWRAP_SANDBOX depending on whether libseccomp is installed. - Add runtime dependencies on bubblewrap and xdg-dbus-proxy conditionally to the status of ENABLE_BUBBLEWRAP_SANDBOX. + debian/control: - Don't require bubblewrap, xdg-dbus-proxy or libseccomp-dev in alpha, ia64, m68k, riscv64, sh4 or sparc64. * Enable USE_WPE_RENDERER: + debian/control: - Add build dependency on libwpebackend-fdo-1.0-dev. + debian/rules: - Set USE_WPE_RENDERER depending on whether wpebackend-fdo is available or not (this allows disabling it by simply removing the build dependency). * debian/rules: + Use -g1 in all builds. The webkit2gtk debug packages are huge and I'm not convinced that they have been very useful for reporting bugs. Using -g1 is enough for a basic backtrace and it makes the packages easier to handle. + Install the NEWS file using debian/libwebkit2gtk-4.0-37.docs. * debian/control: + Switch build dependency from libenchant-dev to libenchant-2-dev (Closes: #948106). + Add build dependency on libx11-xcb-dev (Closes: #949430). + Add Rules-Requires-Root: no. * debian/patches/use-python3.patch: + The unversioned python interpreter (i.e. Python 2) is not installed by default anymore, so use Python 3 instead (Closes: #948839). * debian/patches/user-agent-branding.patch: + Refresh. * debian/libwebkit2gtk-4.0-37.symbols: + Add Build-Depends-Package field. * debian/copyright: + Update copyright years. Checksums-Sha1: 19a5ae1212600e706f095cbdd99c1a3a72e67b96 4349 webkit2gtk_2.26.3-1.dsc 8d5a7b4f330788847f85e1b2cb6191435dcf9f28 19331900 webkit2gtk_2.26.3.orig.tar.xz 063114a43648b554baddc6b4efe9805bb851b7a1 195 webkit2gtk_2.26.3.orig.tar.xz.asc ad4d35a600034879cfa5d372efe1bd41e23549a2 62740 webkit2gtk_2.26.3-1.debian.tar.xz 6c75a3d81135a02aca01937d701bcea3a59fb151 16435 webkit2gtk_2.26.3-1_source.buildinfo Checksums-Sha256: 95a29ea5f388a88b52d00ff56113d3e785705d8686e3ee34654f39c9b54bc393 4349 webkit2gtk_2.26.3-1.dsc add51153943cc11d90a7038d0ea5f6332281e6c0be0640f802a211b035f0e611 19331900 webkit2gtk_2.26.3.orig.tar.xz 29c373afe34e33881af8d93a255913442a582fca2ace2644926a2586b237a87d 195 webkit2gtk_2.26.3.orig.tar.xz.asc a8b40068e042de8bcae8cc7b07dfb90f8acaedaacc276ca26b0dd8298d379a1a 62740 webkit2gtk_2.26.3-1.debian.tar.xz 1d868a58788bd8a56d9eb8c8d4ccbce4a079e1d005e459089c24753dc7d53a50 16435 webkit2gtk_2.26.3-1_source.buildinfo Files: 8655d499e8e20b66dc67755c1f3b65c2 4349 web optional webkit2gtk_2.26.3-1.dsc 4c27d59a032710dae3cffa5990bb6aea 19331900 web optional webkit2gtk_2.26.3.orig.tar.xz 80f7114d7d5183897b6904af200a3339 195 web optional webkit2gtk_2.26.3.orig.tar.xz.asc 5d3ae1b091d74deaf7bac2847d588643 62740 web optional webkit2gtk_2.26.3-1.debian.tar.xz 62c6b048dae59e5e11c4fa8c1b9538b0 16435 web optional webkit2gtk_2.26.3-1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEYrwugQBKzlHMYFizAAyEYu0C2AIFAl4oRkIACgkQAAyEYu0C 2AK0yA/7Br6M3XbvRivDwgn1q4xtB2lh3npPHFN8KvcWBWw2MSdMBzBI8kfWEuuy eOh2aH9Todq7XUQkjoU2uRfxHm1AtTSDXX3VS17TOegosqyyLDIB++wEop0WIluF 6tIVgZYlK2LshHYILvonhQkGDEwNSdpMfVFsqroMbocbJzkHz6c1wYvmvG+gBWmO G4soRzzx7lmOINo3vI5OHeK+uKHBEVfdagrvvpEgcPZSYzEZbY3re1749mk80kDP 1yszy0tceZYfYdj0ihhonCqm7YGpXqyFDWt26SYKKscvnJLw2fvFCDpBb6JwgG8y rac4q10n/FKmZDdTB4ecMNyYWLS+zMMuHmQpCuQTPcuXSO5LQpU1GL/qMR6qyHKU uuMDUittZqZYXo9vY00nAkCi4Cn5jJRw5ucrlW1hxlxDrIEl2rVxR2u+tZRNQFVm 7ifd9+Tp1ZRuDo7M9xujE04Ktglo9mTTfAlRdisQ8RkNaXXXcCCKFppy1VnFiLGC 1BsBGubyU9O7xq6/wwE4xjXB6e2U/1tpRQT/4zLxSDBuSn9N9p607Ss3xeMg9RuO lx43AAJbfxr1fnBKFE3tKT7qcShWMCFAUQe49OQtZM+lSbcEuajZ5as1snu2C1B5 sfCfpVL5dGgSXXE8hvmVCGfPwHOG6hOeOBT+sS50aBBy85My2Hk= =SSV9 -----END PGP SIGNATURE-----