bug#34135: IceCat lacks WebGL support

[Mark H Weaver]

Hi Sarah,

Thanks for looking into this, and more generally for all the work you've
been putting into Guix lately.

Sarah Morgensen <iskarian@mgsn.dev> writes:
> While it looks like preliminary precise whitelisting was done for
> ffmpeg, it seems that this approach may require excessive effort for
> WebGL.

Perhaps, but I don't think that's yet been established.

For what it's worth, as the maintainer of our IceCat package since the
early years of Guix, I'm uncomfortable allowing the IceCat sandbox to
obtain a complete list of software (with precise versions) installed on
our users' systems.  I hope that we will not give up so easily on
precise whitelisting.

> For example, after whitelisting libxcb,
> it needs
>
>   
> /gnu/store/w68jrgqqbfcakm27wm4zf7hmpgw294my-libxxf86vm-1.1.4/lib/libXxf86vm.so.1
>
> and after whitelisting that one,
>
>   
> /gnu/store/jwga98k68l0h5c45jx7z4jdjzhfc34vm-libxshmfence-1.3/lib/libxshmfence.so.1
>
> and so on.

I agree that this approach would be very tedious, but there are better
ways.  I faced a similar problem before I wrote the existing precise
whitelisting code (which your proposed patch would remove): 'libavcodec'
had too many dependencies, and I didn't want to maintain a list of them
all.  I eventually realized that 'libavcodec's RUNPATH would cover most
of what was needed, and in fact only one additional directory needed to
be added manually.

Would you like to try adding the RUNPATHs of Mesa's libraries to the
whitelist, i.e. using the same code that computes 'libavcodec-runpath'?

To find the directories that must be added manually, how about scraping
the *successful* log for a list of file names in /gnu/store and
distilling it down to a set of packages?

> Both the above are propagated-inputs in mesa.  So, it seems
> to "properly" fix this, we would need to read *all* input libraries
> recursively.

Even if we had to do that, it wouldn't be an excessive amount of effort.
We already have the code to extract the RUNPATH of a library and add it
to the whitelist.  Doing that for all libraries found in FOO/lib/*.so
for all inputs FOO shouldn't be much harder, no?

What do you think?  Would you like to try it?

    Regards,
      Mark

-- 
Disinformation flourishes because many people care deeply about injustice
but very few check the facts.  Ask me about <https://stallmansupport.org>.