[webkit-reviews] review denied: [Bug 113282] [GTK] Bump required versions of some dependencies : [Attachment 195078] Updated patch

[bugzilla-daemon at webkit.org]

Martin Robinson <mrobinson at webkit.org> has denied Carlos Garcia Campos
<cgarcia at igalia.com>'s request for review:
Bug 113282: [GTK] Bump required versions of some dependencies
https://bugs.webkit.org/show_bug.cgi?id=113282

Attachment 195078: Updated patch
https://bugs.webkit.org/attachment.cgi?id=195078&action=review

------- Additional Comments from Martin Robinson <mrobinson at webkit.org>
View in context: https://bugs.webkit.org/attachment.cgi?id=195078&action=review


Looks good. r- only because the new modules in the moduleset.

> ChangeLog:10
> +	   Bump libsoup version to 2.42, since it fixes important security
> +	   issues. libsoup requires a newer version of glib, this patch also
> +	   updates other dependencies:

I'm fairly certain that the security issue does not actually depend on the
version of libsoup. When landing this do you mind fixing the ChangeLog to avoid
future confusion?

> Tools/gtk/jhbuild.modules:24
> +	 <dep package="atk"/>

The JHbuild moduleset is only for modules that need a specific version for the
layout tests to pass. On the other hand, if a dependency is simply hard to get
it should go into the optional moduleset. For instance, Cairo is there because
even if you have a recent version of Cairo on your system, your version of
Cairo might have rasterization differences from the version the bots are
running. I've been very careful lately about adding new ones, since it adds a
lot of overhead to compilation.

> Tools/gtk/jhbuild.modules:177
> +	      
hash="sha256:9e0e7eb5d3f7401ccf521fbc289fc1fa0923b7c7833729e2ed7696f7b848893e"
> +	       md5sum="a632a38d2983c2a88679672d00940128"/>

Lately we've only been listing the SHA and not both the SHA and the md5sum
(which is a bit overkill).