libmozjs and gnome-shell

[Josselin Mouette]

[ Re-sent with team at security as recipient. Please don’t forget them in
subsequent replies. ] 

Hi all,

currently we build gjs, which contains the JS bindings required to run
gnome-shell, against the libmozjs version shipped by iceweasel. This
requires a bit of hackery, especially because libmozjs changes every 3
months, but it works and it allows to have only one libmozjs version in
the archive.
However, recently upstream made it clear that such a setup is absolutely
not supported, and they will not even try to fix bugs reported from
Debian systems.

They now use a snapshot of an older libmozjs, called libmozjs185, to
build gjs against. This snapshot has a bit of upstream support itself,
and is designed to be parallel-installable. Most other distributions
have given up and started to use it.

Eventually gnome-shell might migrate to using seed, which would solve
these issues by using libjavascriptcore instead, but this is probably
for wheezy+1, so we need a solution for wheezy.

What would you all think about packaging libmozjs185 and use it in
Debian too? Of course this code duplication makes long-term security
support more complicated. 

Thanks,
-- 
 .''`.      Josselin Mouette
: :' :
`. `'
  `-