Main Inclusion Report for webkit

Requirements

1. Availability: available for officially supported architectures.

2. Rationale:
   • provides alternative web browser engine to xulrunner.
   • enables build of alternative packages in main which can use webkit (e.g. epiphany).
3. Security:
   • These CVEs have been filed in the past:

     • http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2307 (mentioned in Ubuntu CVE tracker too, medium risk)

     • http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1026 (mentioned in Ubuntu CVE tracker too, medium risk)

     • http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1025 (mentioned in Ubuntu CVE tracker too, low risk)

     • http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1011

     • http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1010

     • http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0298 (mentioned in Ubuntu CVE tracker too, low risk)

     • http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5858

     • http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4701 (?)

     • http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4700

     • http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3944

     • http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3742

     • http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2408 (?)

     • http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2399

     • http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0342

     • http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4412

     • http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3946

     • http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3505

     • http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3705

     • http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2522

     • http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0976

   • 17 entries in Secunia.

   • No binaries running as root or suid/sgid.
   • Does not open any port. (?)
4. Quality Assurance:
   • Package works out of the box without configuration.
   • Package does not ask any debconf questions.

   • Good maintenance in Debian.

   • No open showstopper Debian bugs.

   • Active upstream.

   • 1 critical and 5 major bugs reported upstream.

5. Standards compliance:

   • Meets the FHS, Debian Policy.

   • Meets Debian library packaging guide standards.

   • Standard debhelper packaging.
6. Dependencies: all in main.

Reviewers

• authors: asac, Jazzva

https://launchpad.net/bugs/250738

• signed-off: asac (co-author)