[Pkg-privacy-maintainers] Bug#955957: torbrowser-launcher: Depends on deprecated dbus-glib

[smcv at debian.org]

Source: torbrowser-launcher
Severity: normal
Tags: sid bullseye
Control: block 895291 by -1
User: pkg-utopia-maintainers at lists.alioth.debian.org
Usertags: dbus-glib-deprecation

dbus-glib is a deprecated D-Bus library with some significant design
flaws, and is essentially unmaintained. I would like to minimize its
use, and eventually remove it from Debian. There will not be a
version that fixes its design flaws, because that would be a major
compatibility break, and any user of dbus-glib who is willing to port
their application to a newer, incompatible version should instead be
porting their application to a better D-Bus implementation such as
GDBus.

For most purposes, the recommended replacement for dbus-glib is the
GDBus family of APIs in GLib, found in <gio/gio.h>. This does not add
an additional dependency, because dbus-glib already depends on a
sufficiently new version of GLib. A porting guide is available in the
GLib documentation:
<https://developer.gnome.org/gio/stable/ch35.html>. Practical
examples of porting from dbus-glib to GDBus can be found in the git
history of most older GNOME applications.

Alternatives to GDBus, with different design emphasis and trade-offs,
include sd-bus (systemd's D-Bus implementation), QtDBus (Qt's D-Bus
API), and libdbus (the low-level reference D-Bus implementation).
Please contact the D-Bus mailing list <dbus at lists.freedesktop.org>
if you are unsure which D-Bus implementation is most suitable for a
particular package.

Some libraries expose dbus-glib as part of their API/ABI, in which
case removing the deprecated dependency requires breaking API/ABI
(telepathy-glib is a good example). For these libraries, maintainers
should talk to the dependent library's upstream developers about
whether the dependent library should break API/ABI and switch to
GDBus, or whether the dependent library should itself be deprecated.

In a few cases, the package uses the reference D-Bus library libdbus
for all D-Bus-related APIs, and only uses dbus-glib as a way to
connect libdbus to the GLib main loop: if the only functions
referenced from dbus-glib are dbus_connection_setup_with_g_main() and
dbus_server_setup_with_g_main(), then you are in this situation. The
recommended replacement in this case is to bundle the dbus-gmain
branch from the dbus-glib git repository, for example as a `git
subtree` or `git submodule`. For example, dbus-python's GLib
integration now works like this. See
<https://gitlab.freedesktop.org/dbus/dbus-glib/blob/dbus-gmain/README
.md> for more details.