From Fedora Project Wiki
(Change approved by FESCo)
 
(11 intermediate revisions by 3 users not shown)
Line 1: Line 1:
= libsoup 3: Part One =
= libsoup 3: Part One =
{{Change_Proposal_Banner}}


== Summary ==
== Summary ==
Line 14: Line 12:


== Current status ==
== Current status ==
[[Category:ChangePageIncomplete]]
[[Category:ChangeAcceptedF37]]
<!-- When your change proposal page is completed and ready for review and announcement -->
<!-- remove Category:ChangePageIncomplete and change it to Category:ChangeReadyForWrangler -->


<!-- Select proper category, default is Self Contained Change -->
<!-- Select proper category, default is Self Contained Change -->
Line 23: Line 19:
* Targeted release: [[Releases/37 | Fedora Linux 37 ]]  
* Targeted release: [[Releases/37 | Fedora Linux 37 ]]  
* Last updated: {{REVISIONYEAR}}-{{REVISIONMONTH}}-{{REVISIONDAY2}}  
* Last updated: {{REVISIONYEAR}}-{{REVISIONMONTH}}-{{REVISIONDAY2}}  
* FESCo issue: <will be assigned by the Wrangler>
* [https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/5A3J56MTK3RKSH4NZ6OYGF3NIN4GHJV3/ Devel list thread]
* Tracker bug: <will be assigned by the Wrangler>
* FESCo issue: [https://pagure.io/fesco/issue/2829 #2829]
* Tracker bug: [https://bugzilla.redhat.com/show_bug.cgi?id=2105119 #2105119]
* Release notes tracker: <will be assigned by the Wrangler>
* Release notes tracker: <will be assigned by the Wrangler>


Line 30: Line 27:
libsoup 3 was introduced in Fedora 36, but nothing actually uses it yet. For Fedora 37 and GNOME 43, many GNOME applications and libraries will switch from libsoup 2 to libsoup 3. libsoup 2 will remain in Fedora 37 as a compatibility library. Because libsoup is a sensitive network-facing HTTP library written in an unsafe language and where CVEs may have disastrous impact, it is not safe to leave libsoup 2 hanging around indefinitely, but we are not yet ready to remove it altogether. We will propose removing libsoup 2 (and all applications and libraries that still depend on it) for Fedora 39 in a separate change proposal.
libsoup 3 was introduced in Fedora 36, but nothing actually uses it yet. For Fedora 37 and GNOME 43, many GNOME applications and libraries will switch from libsoup 2 to libsoup 3. libsoup 2 will remain in Fedora 37 as a compatibility library. Because libsoup is a sensitive network-facing HTTP library written in an unsafe language and where CVEs may have disastrous impact, it is not safe to leave libsoup 2 hanging around indefinitely, but we are not yet ready to remove it altogether. We will propose removing libsoup 2 (and all applications and libraries that still depend on it) for Fedora 39 in a separate change proposal.


For Fedora 37 and Fedora 38, we propose a transition period where both libsoup 2 and libsoup 3 will coexist. Applications can switch to libsoup 3 without significant impact on the rest of the distribution, but libraries switching to libsoup 3 are very disruptive. Libraries have two options:
For Fedora 37 and Fedora 38, we propose a transition period where both libsoup 2 and libsoup 3 will coexist. Applications can switch to libsoup 3 without significant impact on the rest of the distribution, but libraries switching to libsoup 3 are very disruptive. Libraries have a few options:


* Recommended: provide a new API version for libsoup 3. This gives applications that depend on your library a transition period to switch from libsoup 2 to libsoup 3. Applications will bump to your new API version at the same time they transition to libsoup 3. If the application does not directly depend on libsoup and does not depend on libsoup via any other libraries, then this can be done at any time. Example: webkit2gtk-4.0 is the libsoup 2 version of WebKitGTK's GTK 3 API, while webkit2gtk-4.1 is the libsoup 3 version. Currently only webkit2gtk-4.0 is available in Fedora (via the webkit2gtk3 package), but webkit2gtk-4.1 will be made available as part of this change (package name TBD).
* Recommended: provide a new API version for libsoup 3. This gives applications that depend on your library a transition period to switch from libsoup 2 to libsoup 3. Applications will bump to your new API version at the same time they transition to libsoup 3. If the application does not directly depend on libsoup and does not depend on libsoup via any other libraries, then this can be done at any time. Example: webkit2gtk-4.0 is the libsoup 2 version of WebKitGTK's GTK 3 API, while webkit2gtk-4.1 is the libsoup 3 version. Currently only webkit2gtk-4.0 is available in Fedora (via the webkit2gtk3 package), but webkit2gtk-4.1 will be made available as part of this change (package name TBD). Other libraries taking this approach: geocode-glib, phodav.
* Not recommended: provide a build option to toggle between libsoup 2 and libsoup 3, while retaining the same API version. All applications that depend on your library must port to libsoup 3 at exactly the same time. Unfortunately, many GNOME libraries have selected this approach, and building these libraries with libsoup 3 enabled will be required for GNOME 43. Known affected libraries will include geocode-glib, libgweather, librest-1.0, libosinfo, and probably also libphodav. '''All applications that link to these libraries will crash on startup if they link to libsoup 2.'''
* Not recommended: provide a build option to toggle between libsoup 2 and libsoup 3, while retaining the same API version. All applications that depend on your library must port to libsoup 3 at exactly the same time. Unfortunately, many GNOME libraries have selected this approach, and building these libraries with libsoup 3 enabled will be required for GNOME 43. Known affected libraries will include libgweather, librest-1.0, libosinfo.
* Require libsoup 3 unconditionally. This option is recommended only for libraries used by very few applications. Known libraries taking this approach include evolution-data-server and gnome-online-accounts.


Because many GNOME libraries have adopted the second approach, applications that depend on these libraries, whether directly or indirectly, must take action immediately or they will crash.
Because many GNOME libraries have adopted the second approach, applications that depend on these libraries, whether directly or indirectly, must take action immediately or they will crash on startup. This is far from ideal. This transition is unlikely to go smoothly, but if we work together and coordinate with our fellow package maintainers, we should be OK.


== Feedback ==
== Feedback ==
Line 45: Line 43:


== Scope ==
== Scope ==
* Proposal owners: The proposal owner is working upstream to ensure GNOME 43 is buildable without conflicts between packages that require libsoup 2 dependencies vs. libsoup 3 dependencies. The proposal owner will also package webkit2gtk-4.1 for Fedora 37. Because this is a large transition that will require the efforts of dozens of developers, the proposal owner cannot help with individual Fedora packages.
* Proposal owners: The proposal owner is working upstream to ensure GNOME 43 is buildable without conflicts between packages that require libsoup 2 dependencies vs. libsoup 3 dependencies. The proposal owner will also package webkit2gtk-4.1 for Fedora 37. Because this is a large transition that will require the efforts of dozens of developers, the proposal owner can offer only limited help with individual Fedora packages.


* Other developers: Check your applications and libraries for direct or indirect dependencies on libsoup using ldd. You must assess each situation individually to decide the best course of action based on whether your dependencies require libsoup 2 or libsoup 3. If you're not sure where a dependency on libsoup comes from, use the lddtree tool from the pax-utils package.
* Other developers: Check your applications and libraries for direct or indirect dependencies on libsoup using ldd. You must assess each situation individually to decide the best course of action. If you're not sure where a dependency on libsoup comes from, use the lddtree tool from the pax-utils package. If you wind up stuck in an impossible situation where your software depends on both libsoup 2 and libsoup 3 simultaneously, ask other packagers for help to resolve the situation. We will need to work together to solve these issues.


* Release engineering: [https://pagure.io/releng/issue/10859 #10859]
* Release engineering: [https://pagure.io/releng/issue/10859 #10859]
Line 212: Line 210:
* Contingency deadline: Beta freeze
* Contingency deadline: Beta freeze
* Blocks release? Possibly. Applications that crash on startup will fail the "basic functionality test" release criterion.
* Blocks release? Possibly. Applications that crash on startup will fail the "basic functionality test" release criterion.


== Documentation ==
== Documentation ==

Latest revision as of 20:51, 15 July 2022

libsoup 3: Part One

Summary

libsoup 3 is a new API version of libsoup that provides support for HTTP/2. Unfortunately, it is incompatible with libsoup 2. To avoid misbehavior, applications will crash on startup if linked to both libsoup 2 and libsoup 3 at the same time. Because many libraries depend on libsoup, and applications have limited control over which libsoup they link to transitively, this transition will be tricky and requires attention from all Fedora packages that depend on libsoup, even if only indirectly.

Owner

Current status

Detailed Description

libsoup 3 was introduced in Fedora 36, but nothing actually uses it yet. For Fedora 37 and GNOME 43, many GNOME applications and libraries will switch from libsoup 2 to libsoup 3. libsoup 2 will remain in Fedora 37 as a compatibility library. Because libsoup is a sensitive network-facing HTTP library written in an unsafe language and where CVEs may have disastrous impact, it is not safe to leave libsoup 2 hanging around indefinitely, but we are not yet ready to remove it altogether. We will propose removing libsoup 2 (and all applications and libraries that still depend on it) for Fedora 39 in a separate change proposal.

For Fedora 37 and Fedora 38, we propose a transition period where both libsoup 2 and libsoup 3 will coexist. Applications can switch to libsoup 3 without significant impact on the rest of the distribution, but libraries switching to libsoup 3 are very disruptive. Libraries have a few options:

  • Recommended: provide a new API version for libsoup 3. This gives applications that depend on your library a transition period to switch from libsoup 2 to libsoup 3. Applications will bump to your new API version at the same time they transition to libsoup 3. If the application does not directly depend on libsoup and does not depend on libsoup via any other libraries, then this can be done at any time. Example: webkit2gtk-4.0 is the libsoup 2 version of WebKitGTK's GTK 3 API, while webkit2gtk-4.1 is the libsoup 3 version. Currently only webkit2gtk-4.0 is available in Fedora (via the webkit2gtk3 package), but webkit2gtk-4.1 will be made available as part of this change (package name TBD). Other libraries taking this approach: geocode-glib, phodav.
  • Not recommended: provide a build option to toggle between libsoup 2 and libsoup 3, while retaining the same API version. All applications that depend on your library must port to libsoup 3 at exactly the same time. Unfortunately, many GNOME libraries have selected this approach, and building these libraries with libsoup 3 enabled will be required for GNOME 43. Known affected libraries will include libgweather, librest-1.0, libosinfo.
  • Require libsoup 3 unconditionally. This option is recommended only for libraries used by very few applications. Known libraries taking this approach include evolution-data-server and gnome-online-accounts.

Because many GNOME libraries have adopted the second approach, applications that depend on these libraries, whether directly or indirectly, must take action immediately or they will crash on startup. This is far from ideal. This transition is unlikely to go smoothly, but if we work together and coordinate with our fellow package maintainers, we should be OK.

Feedback

Benefit to Fedora

Transitioning to libsoup 3 adds support for HTTP/2 and allows Fedora to continue packaging the latest versions of GNOME. If we do not transition to libsoup 3, then we will be unable to update certain GNOME packages to the latest version.

Scope

  • Proposal owners: The proposal owner is working upstream to ensure GNOME 43 is buildable without conflicts between packages that require libsoup 2 dependencies vs. libsoup 3 dependencies. The proposal owner will also package webkit2gtk-4.1 for Fedora 37. Because this is a large transition that will require the efforts of dozens of developers, the proposal owner can offer only limited help with individual Fedora packages.
  • Other developers: Check your applications and libraries for direct or indirect dependencies on libsoup using ldd. You must assess each situation individually to decide the best course of action. If you're not sure where a dependency on libsoup comes from, use the lddtree tool from the pax-utils package. If you wind up stuck in an impossible situation where your software depends on both libsoup 2 and libsoup 3 simultaneously, ask other packagers for help to resolve the situation. We will need to work together to solve these issues.
  • Policies and guidelines: No policy changes required
  • Trademark approval: N/A (not needed for this Change)
  • Alignment with Objectives: No alignment with current objectives

Upgrade/compatibility impact

If applications do not link to both libsoup 2 and libsoup 3, everything should be fine and users should not notice this transition. But applications that link to both libsoup 2 and libsoup 3 will crash on startup.

How To Test

Although it's possible that bugs will be introduced when porting an application from libsoup 2 to libsoup 3, we should focus on testing to see whether applications crash on startup. An application that does not crash immediately is probably good.

User Experience

Applications that use libsoup 3 will support HTTP/2, which multiplexes multiple HTTP requests over a single connection. Users may notice performance improvements.

Dependencies

$ dnf repoquery --whatdepends libsoup --latest-limit 1 --arch 'noarch,x86_64'
Last metadata expiration check: 0:37:45 ago on Mon 27 Jun 2022 10:43:26 AM CDT.
abrt-retrace-client-0:2.15.1-1.fc36.x86_64
badwolf-0:1.2.2-2.fc36.x86_64
bookworm-0:1.1.3-0.7.20200414git.c7c3643.fc36.x86_64
cawbird-0:1.4.2-3.fc36.x86_64
chatty-0:0.6.0-1.fc36.x86_64
chezdav-0:2.5-6.fc36.x86_64
claws-mail-plugins-fancy-0:4.1.0-1.fc36.x86_64
claws-mail-plugins-gdata-0:4.1.0-1.fc36.x86_64
coin-0:1.3.0-6.fc36.x86_64
cutter-0:1.2.7-6.fc36.x86_64
darktable-0:3.8.1-1.fc36.x86_64
dino-0:0.3.0-2.fc36.x86_64
dleyna-renderer-0:0.6.0-14.fc36.x86_64
dleyna-server-0:0.6.0-13.fc36.x86_64
dmapd-0:0.0.91-1.fc36.x86_64
elementary-calendar-0:6.1.1-1.fc36.x86_64
elementary-code-0:6.2.0-1.fc36.x86_64
elementary-mail-0:6.4.0-1.fc36.x86_64
elementary-photos-0:2.7.5-1.fc36.x86_64
elementary-planner-1:3.0.7-1.fc36.x86_64
elementary-tasks-0:6.2.0-1.fc36.x86_64
emacs-1:27.2-11.fc36.x86_64
ephemeral-0:7.1.0-3.fc36.x86_64
epiphany-1:42.2-1.fc36.x86_64
evolution-0:3.44.2-1.fc36.x86_64
evolution-chime-0:1.4.1-5.fc36.x86_64
evolution-data-server-0:3.44.2-1.fc36.x86_64
evolution-ews-0:3.44.2-1.fc36.x86_64
evolution-rspam-0:0.6.0-35.fc36.x86_64
evolution-rss-1:0.3.96-9.fc36.x86_64
exfalso-0:4.5.0-1.fc36.noarch
flatpak-0:1.12.7-2.fc36.x86_64
flatpak-builder-0:1.2.2-2.fc36.x86_64
flatpak-libs-0:1.12.7-2.fc36.x86_64
flatpak-tests-0:1.12.7-2.fc36.x86_64
fondo-0:1.6.1-2.fc36.x86_64
frogr-0:1.6-5.fc35.x86_64
gajim-0:1.4.4-1.fc36.noarch
gambas3-gb-gtk3-webview-0:3.17.2-1.fc36.x86_64
gamehub-0:0.16.3.2-4.fc36.x86_64
geany-plugins-geniuspaste-0:1.38-3.fc36.x86_64
geany-plugins-markdown-0:1.38-3.fc36.x86_64
geany-plugins-updatechecker-0:1.38-3.fc36.x86_64
geary-0:40.0-5.fc36.x86_64
geoclue2-0:2.6.0-2.fc36.x86_64
geocode-glib-0:3.26.2-5.fc36.x86_64
gfbgraph-0:0.2.4-2.fc36.x86_64
gnome-boxes-0:42.1-1.fc36.x86_64
gnome-builder-0:42.1-1.fc36.x86_64
gnome-calculator-0:42.1-1.fc36.x86_64
gnome-calendar-0:42.2-1.fc36.x86_64
gnome-games-0:40.0-3.fc36.x86_64
gnome-music-0:42.1-1.fc36.noarch
gnome-online-accounts-0:3.44.0-1.fc36.x86_64
gnome-panel-0:3.44.0-1.fc36.x86_64
gnome-software-0:42.2-4.fc36.x86_64
gnome-tweaks-0:42~beta-1.fc36.noarch
gnome-video-arcade-0:0.8.8-12.fc36.x86_64
goodvibes-0:0.7.2-2.fc36.x86_64
grilo-0:0.3.14-2.fc36.x86_64
grilo-plugins-0:0.3.14-3.fc36.x86_64
gsequencer-0:3.17.6-0.fc36.x86_64
gssdp-0:1.4.0.1-2.fc36.x86_64
gssdp-utils-0:1.4.0.1-2.fc36.x86_64
gthumb-1:3.12.1-1.fc36.x86_64
gtranslator-0:40.0-3.fc36.x86_64
gupnp-0:1.4.3-2.fc36.x86_64
gupnp-tools-0:0.10.3-1.fc36.x86_64
homebank-0:5.5.5-1.fc36.x86_64
libabiword-1:3.0.5-2.fc36.x86_64
libappstream-glib-0:0.7.18-4.fc36.x86_64
libchamplain-0:0.12.20-6.fc36.x86_64
libdmapsharing-0:2.9.41-6.fc36.x86_64
libdmapsharing4-0:3.9.10-5.fc36.x86_64
libepc-0:0.4.0-22.fc36.x86_64
libepc-ui-0:0.4.0-22.fc36.x86_64
libgda-tools-1:5.2.10-5.fc36.x86_64
libgda-web-1:5.2.10-5.fc36.x86_64
libgdata-0:0.18.1-4.fc36.x86_64
libgepub-0:0.6.0-9.fc36.x86_64
libgovirt-0:0.3.8-3.fc36.x86_64
libgrss-0:0.7.0-14.fc36.x86_64
libgweather-0:40.0-3.fc36.x86_64
libgweather4-0:4.0.0-1.fc36.x86_64
libmateweather-0:1.26.0-2.fc36.x86_64
libosinfo-0:1.10.0-1.fc36.x86_64
libphodav-0:2.5-6.fc36.x86_64
libsoup-devel-0:2.74.2-2.fc36.x86_64
libtimezonemap-0:0.4.5.1-11.fc36.x86_64
libtracker-sparql-0:3.3.1-1.fc36.x86_64
libtranslate-0:0.99-112.fc36.x86_64
liferea-1:1.13.7-2.fc36.x86_64
linphone-0:3.6.1-48.fc36.x86_64
logjam-1:4.6.2-27.fc36.x86_64
meteo-0:0.9.9.1-2.fc36.x86_64
midori-0:9.0-9.fc36.x86_64
mmsd-tng-0:1.8-1.fc36.x86_64
mpdscribble-0:0.22-24.fc36.x86_64
osinfo-db-tools-0:1.10.0-1.fc36.x86_64
osm-gps-map-0:1.1.0-10.fc36.x86_64
ostree-tests-0:2022.4-2.fc36.x86_64
perl-HTTP-Soup-0:0.01-26.fc36.x86_64
polari-0:42.0-1.fc36.x86_64
pragha-0:1.3.3-22.fc36.x86_64
purple-chime-0:1.4.1-5.fc36.x86_64
python3-nbxmpp-0:3.1.0-2.fc36.noarch
remmina-0:1.4.27-2.fc36.x86_64
rest-0:0.8.1-12.fc36.x86_64
rhythmbox-0:3.4.6-1.fc36.x86_64
rygel-0:0.40.3-1.fc36.x86_64
seahorse-0:42.0-1.fc36.x86_64
shotwell-0:0.31.3-8.fc36.x86_64
snapd-glib-0:1.58-4.fc36.x86_64
snapd-glib-tests-0:1.58-4.fc36.x86_64
snapd-qt-tests-0:1.58-4.fc36.x86_64
soup-sharp-0:2.42.2-6.20190810git0f36d10.fc36.x86_64
spice-glib-0:0.40-1.fc36.x86_64
srain-0:1.4.0-2.fc36.x86_64
surf-0:2.0-13.fc36.x86_64
switchboard-plug-onlineaccounts-0:6.5.0-1.fc36.x86_64
syncevolution-libs-1:2.0.0-3.fc36.x86_64
syncevolution-libs-akonadi-1:2.0.0-3.fc36.x86_64
taxi-0:2.0.1-2.fc36.x86_64
telepathy-gabble-0:0.18.4-18.fc36.x86_64
telepathy-salut-0:0.8.1-27.fc36.x86_64
uhttpmock-0:0.5.0-15.fc36.x86_64
vfrnav-0:20201231-22.fc36.x86_64
webkit2gtk3-0:2.36.3-1.fc36.x86_64
webkit2gtk3-devel-0:2.36.3-1.fc36.x86_64
xfce4-screenshooter-0:1.9.8-4.fc36.x86_64
xfce4-screenshooter-plugin-0:1.9.8-4.fc36.x86_64
xfce4-weather-plugin-0:0.11.0-3.fc36.x86_64 
yelp-libs-2:42.1-1.fc36.x86_64

Contingency Plan

  • Contingency mechanism: We may be required to switch particular packages back to libsoup 2. Due to interdependencies between packages, this could be quite disruptive.
  • Contingency deadline: Beta freeze
  • Blocks release? Possibly. Applications that crash on startup will fail the "basic functionality test" release criterion.

Documentation

Migrating from libsoup 2

Release Notes

Many applications and libraries now use libsoup 3, a new version of libsoup that adds support for HTTP/2.

Retrieved from "https://fedoraproject.org/w/index.php?title=Changes/libsoup_3:_Part_One&oldid=649493"