Re: [Gimp-developer] New GIMP configure warning/error

[Jehan Pagès <jehan marmottard gmail com>]

Hi,

On Sat, May 13, 2017 at 6:25 AM, Partha Bagchi <partha1b gmail com> wrote:
> On Thu, May 11, 2017 at 3:03 PM, Jehan Pagès <jehan marmottard gmail com>
> wrote:
> > Hi,
> >
> > On Thu, May 11, 2017 at 8:53 PM, Partha Bagchi <partha1b gmail com> wrote:
> > > On Thu, May 11, 2017 at 2:49 PM, Alexandre Prokoudine <
> > > alexandre prokoudine gmail com> wrote:
> > >
> > > > On Thu, May 11, 2017 at 9:34 PM, Partha Bagchi wrote:
> > > >
> > > > > I am perplexed to see that we need glib-networking suddenly since my
> > > > > git
> > > > > pull from a couple of days ago? Is there a reason to requiring glib
> > > > > networking support?
> > > >
> > > > To quote from https://git.gnome.org/browse/gimp/commit/?id=
> > > > bb196607693b2a8fa95f033966506cbf3c377d81
> > > >
> > > > "Use a code test inspired by libsoup configure test. This is a hard
> > > > dependency because HTTPS should not be considered an option anymore.
> > > > Nowadays most websites will use HTTPS by default, HTTP gives SEO
> > > > penalties and browsers are starting to display various security
> > > > warnings on HTTP websites. Also the experience will be significantly
> > > > degraded without SSL/TLS support since the help browser will fail to
> > > > load the manual remotely, and opening various remote files on secure
> > > > protocols will fail. Note: the test cannot be performed while
> > > > cross-compiling. In this case, we will just display a warning for
> > > > packagers to be at least well aware of this dependency."
> > > >
> > > > Alex
> > > >
> > > > Yes, I read the quote but am still perplexed. the only (?) place we
> > > > need
> > > http/https support is to load images from an URI? Is it not sufficient
> > > to
> > > make that optional instead of introducing one more dependency?
> >
> > No, there are at least 2 features affected: open remote files indeed
> > and the help browser (help will fail showing with an error since our
> > websites are now https only). This last one was getting quite a lot of
> > report on the tracker and was very bad experience.
> > Anyway nowadays https is the standard for web access. Not supporting
> > this is not acceptable IMO.
> >
> > Jehan
>
>
> Hi,
>
> You realize that for platforms other than Linux, that if you wish to install
> glib-networking, you have to install

Yes I realize that dependencies have often dependencies themselves.
Unless there is something which proves to be impossible to compile on
other platforms, I don't see the problem.

> gnutls which requires that you install
> nettle which in turn requires that you install gmp?

gnutls is a SSL/TLS lib (the feature we need). And from my searches,
nettle is apparently a cryptographic library and gmp would be an
arithmetic library. This does make total sense for a SSL/TLS lib
(which is a cryptographic protocol, and cryptography usually needs a
lot of arithmetic).
I don't see your point. That doesn't seem at all far fetched
dependencies for the feature we need, quite the opposite.

> All this because you
> want remote help files and remote images be accessed from GIMP? Does this
> seem reasonable to you?

It does seem absolutely reasonable, yes. I would even say that in
2017, not having support for TLS/SSL when we have web access
requirement would be the thing which is absolutely non-reasonable.

I am rerunning a crossbuild again to check that everything is all
right, just to make sure. What I can say is that there exists
pre-built packages for glib-networking (and all the dependencies) so I
could install it and all its dependencies in about 10 seconds inside
my crossbuild environment (using my tool called crossroad, with a
single command: crossroad install glib-networking). So first it means
that glib-networking is buildable for Windows and in you have the
right tools, that's really not much of a hassle. Now on Windows, I
have no idea how hard things are. But I assume you have various helper
tools too.

I really don't see the big deal here. And I don't see on which ground
it may seem acceptable to not have secure protocols support when the
whole internet is fighting these last few years for getting rid of
non-secure protocols (for very obvious and understandable reasons).
This is like trying to go against the flow.

Jehan

> Thanks,
> Partha



-- 
ZeMarmot open animation film
http://film.zemarmot.net
Patreon: https://patreon.com/zemarmot
Tipeee: https://www.tipeee.com/zemarmot