[webkit-gtk] About the policy of (non) updating minimum build-dependencies

[Michael Gratton]

On Thu, Jul 7, 2016 at 3:22 AM, Carlos Alberto Lopez Perez 
<clopez at igalia.com> wrote:

> "WebKitGTK+ has to build both on the last version of Debian stable and
> the last version of Ubuntu LTS".
> 
> That means that we can raise any build-dependency version to:
> 
> maxVersionDependencyWebKitGTK+ = std::min(DebianStable, UbuntuLTS);
> 
> Both this two distributions are quite conservative in regards to 
> raising
> versions of dependency and have a ~2-year release cycle. I think that
> aiming at building in both, is at the same time: conservative enough 
> and
> flexible enough.
> 
>  - I think is conservative enough because I don't foresee this could
> cause any problems to any downstream. In the end we are aiming at
> supporting two of the most conservative/stable distributions.
> 
>  - I think this is flexible enough because it allows to raise the
> version of the dependencies each 2 years at least, which allows us to
> use or depend on new features more easily than nowadays.
> 
> 
> For example, nowadays Debian 8 stable has GTK+ 3.14, and Ubuntu 16.04
> LTS has GTK+ 3.18. This means that now we could raise the GTK+
> dependency to 3.14.
> 
> If the next year Debian 9 includes GTK+ 3.22, then we can raise it to
> 3.18 (until Ubuntu 18.04 is released)
> 
> Opinions?

Maybe the best argument for maintaining compatibility with older GTK+ 
versions is to make backporting security updates more appealing or even 
possible for LTS distros, so perhaps it's worth look at some other LTS 
distros and versions? This will keep the min build deps lower for 
longer, but might help with convincing distros to actually update their 
packages as security bugs are fixed.

Eg. Ubuntu is still supporting 12.04 (GTK+ 3.4) until April next year, 
and 14.04 (GTK+ 3.10) until April 2019[0]. OpenSUSE 3.14 (GTK+ 3.10 I 
think?) is their current Evergreen and will be supported through to 
November[1], while RHEL4 is supported through to the end of March next 
year, and RHEL 5 until November 2020 (no idea what GTK versions they 
support however - maybe only GTK+ 2.x!)[2].  The next Debian stable 
won't be released until early 2018, and will have at least GTK 3.20, 
likely higher.

So if the rule was extended to (say) the last two LTS releases for all 
known LTS distros, then the min would be GTK+ 3.10 through until April 
2019 due to Ubuntu 14.04, at which time it would jump up 3.18 — 
unless OpenSUSE's new Evergreen or someone else is still supporting 
something lower.

Also, it's probably worth keeping in mind what upstream is planning for 
speeding up GTK+ releases going forward[0]. If this happens there will 
be a new major GTK+ releases every few years, so to provide support for 
LTS versions of distros, WebKitGTK+ may need to start cutting branches 
for each, since major versions may not be trivially backwards 
compatible?

//Mike

[0] - <https://wiki.ubuntu.com/Releases>
[1] - <https://en.wikipedia.org/wiki/OpenSUSE#Version_history>
[2] - 
<https://en.wikipedia.org/wiki/Red_Hat_Enterprise_Linux#Product_life_cycle>
[3] - <https://blogs.gnome.org/desrt/2016/06/13/gtk-4-0-is-not-gtk-4/>

-- 
⊨ Michael Gratton, Percept Wrangler.
⚙ <http://mjog.vee.net/>