Re: [Tracker] 3.20 target bugs

[Carlos Garnacho <carlosg gnome org>]

Hey,

(CCing the Tracker ML for this one)

On Thu, Feb 18, 2016 at 1:35 PM, Matthias Clasen
<matthias clasen gmail com> wrote:
> While we are still waiting for 3.19.90 to appear, here is an initial
> review of the bugs that have been marked as "GNOME target: 3.20"
> during this cycle. Since this is the first review, the list is
> somewhat long, and a bit of a mixed bag, I expect us to narrow it down
> for .91. In any case, all these bugs are well worth fixing, and if you
> can get one of the off the list, you will make 3.20 a better release.
>
> Please help out if you can!
>
> Matthias, for the release team
>
>
>
> Fallout from GTK+ changes (CSS and others)
> ------------------------------------------------------------------
>
> 761765     bijiben     Notes have a grey background rather than a custom color
> 762137     nautilus     GtkPlacesSidebar: row selection jumps around
> 760525     gtk+         Labels in dialog buttons misaligned
> 760560     gtk+         Icon buttons wider in GTK+ 3.19.6
> 757503     gtk+         Selected text is white on white (invisible) -
> WebKit1 / GTK+ 3.19.7 & Adwaita
> 761686     gtk+         GtkTreeView theming problems
> 758893     gnome-shell     Journal spam: Gdk-WARNING **:
> gdk-frame-clock: layout continuously requested, giving up after 4
> tries
>
> Power / Battery life problems
> -----------------------------------------
>
> 752070     polari         polari uses a lot of cpu
> 762194     tracker     Indexes on battery
>
> Deprecation cleanup & build issues
> ---------------------------------------------------
>
> 760887     NetworkManager     Do not depend on deprecated libnm-glib
> or dbus-glib when we only want to build the new libnma library
> 760946     NetworkManager     nm-connection-editor still uses dbus-glib
> 757934     gobject-intros     g-ir-scanner should not use system-provided CFLAGS
> 751588     evolution     Port to WebKit2
> 751185     empathy     Use clutter-gst-3.0
> 749001     empathy     Port to webkit2
> 728293     bijiben     Port to WebKit2 or GtkTextView
> 705069     gnome-music     Port from dbus-python to Gio GDBus API
> 686373     general     [META] Switch to WebKit2
>
> Accessibility regressions
> ------------------------------------
>
> 762136     nautilus     Progress of file and folder operations is no
> longer accessible to screen readers
>
> Wayland issues
> -----------------------
>
> 749913     mutter         wayland: Send frame callbacks when native
> hardware cursors get set
> 760745     mutter         100% CPU : Error transferring wayland clipboard to X11
> 762104     mutter         handle dnd drops on the root window
> 760567     gtk+         GDK screen size does not count for HiDPI on Wayland
> 756579     gtk+         GTK should let GDK position menus
> 748098     gdm         monitors.xml not working in GDM when running
> under Wayland
> 695806     general     [TRACKER] Wayland support
>
> Crashes & serious misbehavior
> ---------------------------------------------
>
> 761613     mutter     crash with xwayland glamor
> 761157     libsecret     libsecret-0.18.4 seems to crash gnome-shell
> 755721     glib         g_inotify_file_monitor_start called with
> nullpointer for dirname causes a segfault
> 761175     librsvg     Svg rendering regression from commit 3ae509 onwards
> 750508     gnome-session     Logout is broken (a) when session
> inhibitor is active and (b) after logout is canceled once
> 761317     gnome-settings-daemon     housekeeping: /tmp/.X11-unix/X0
> socket gets removed during housecleaning

I would like to drop https://bugzilla.gnome.org/show_bug.cgi?id=762226 here.

In short, sqlite has hidden stuff that Tracker needs behind a compile
time option (disabled by default) because of security concerns, and
Tracker only stumbles on this at runtime.

AFAICT the security concerns come from arbitrary execution of SQL
being able to alter later queries by overriding the full-text search
tokenizer, so they don't apply to Tracker (our SQL comes from a
bizarre state machine, but doesn't qualify as "arbitrary"). Most
immediately, I'll add a configure time check for this feature,
although I don't think it's ok to advice distros to enable
fts3_tokenizer system-wide. Solutions I can think of are:

- Including a static copy of sqlite in Tracker, with fts3_tokenizer() enabled
- Updating to the newer but code-wise incompatible fts5 (we use fts4),
which provides other similar hooks we can use. It's probably too
bleeding edge though, it was considered "experimental" not long ago
[1], and I haven't seen a word saying otherwise in later release
notes.

In this situation, the second option is a matter of time, I'd just
wish there were a longer board to walk.

Cheers,
  Carlos

[1] http://sqlite.org/releaselog/3_9_0.html