Bug#1148244: swt4-gtk: please disable webkit2gtk dependency on big-endian
Simon McVittie
smcv at debian.org
Thu Oct 1 10:15:07 BST 2026
On Fri, 18 Sep 2026 at 11:45:50 +0100, Simon McVittie wrote:
>swt4-gtk currently builds an Architecture: any package,
>libswt-webkit-gtk-4-jni, which Depends on WebKitGTK libraries. Please
>limit building of this package to little-endian architectures, so that
>we can remove its old s390x binaries without them coming back (and being
>uninstallable) in the next upload.
The other way this could be handled, if not by disabling this one binary
package, would be to remove src:swt4-gtk and everything that depends on
it from s390x.
I believe that would mean removing binaries from these source packages
from s390x:
libjogl2-java
openjfx
scilab
swt4-gtk
resulting in these Architecture: all packages becoming unbuildable on s390x:
biglybt
controlsfx
eclipse-equinox
eclipse-jdt-debug
eclipse-jdt-ui
eclipse-linuxtools
eclipse-platform
eclipse-platform-ui
eclipse-remote
eclipse-swtchart
eclipse-wtp
equinox-p2
freecol
insubstantial
ipscan
jftp
king
libiscwt-java
libmiglayout-java
mediathekview
nattable
pdfsam
piccolo
stegosuite
swtchart
triplea
tuxguitar
That's a somewhat larger impact on the software available on s390x, but
has the advantage of not requiring packaging changes in src:swt4-gtk.
The latest webkit2gtk security advisory lists around 200 CVEs, so I
think continuing to hold it back to 2.52.x for the benefit of an
architecture where GUIs aren't normally run would be doing a disservice
to our users, and it might be time to start removing these packages from
s390x? They can always come back later if the swt4-gtk packaging is
updated.
Thanks,
smcv
More information about the pkg-java-maintainers
mailing list