Bug#1148244: swt4-gtk: please disable webkit2gtk dependency on big-endian

Simon McVittie smcv at debian.org
Thu Oct 1 10:15:07 BST 2026


On Fri, 18 Sep 2026 at 11:45:50 +0100, Simon McVittie wrote:
>swt4-gtk currently builds an Architecture: any package,
>libswt-webkit-gtk-4-jni, which Depends on WebKitGTK libraries. Please
>limit building of this package to little-endian architectures, so that
>we can remove its old s390x binaries without them coming back (and being
>uninstallable) in the next upload.

The other way this could be handled, if not by disabling this one binary 
package, would be to remove src:swt4-gtk and everything that depends on 
it from s390x.

I believe that would mean removing binaries from these source packages
from s390x:

libjogl2-java
openjfx
scilab
swt4-gtk

resulting in these Architecture: all packages becoming unbuildable on s390x:

biglybt
controlsfx
eclipse-equinox
eclipse-jdt-debug
eclipse-jdt-ui
eclipse-linuxtools
eclipse-platform
eclipse-platform-ui
eclipse-remote
eclipse-swtchart
eclipse-wtp
equinox-p2
freecol
insubstantial
ipscan
jftp
king
libiscwt-java
libmiglayout-java
mediathekview
nattable
pdfsam
piccolo
stegosuite
swtchart
triplea
tuxguitar

That's a somewhat larger impact on the software available on s390x, but 
has the advantage of not requiring packaging changes in src:swt4-gtk.

The latest webkit2gtk security advisory lists around 200 CVEs, so I 
think continuing to hold it back to 2.52.x for the benefit of an 
architecture where GUIs aren't normally run would be doing a disservice 
to our users, and it might be time to start removing these packages from 
s390x? They can always come back later if the swt4-gtk packaging is 
updated.

Thanks,
     smcv



More information about the pkg-java-maintainers mailing list