[Qtwebengine] QTWebengine compliance with FSDG

[Kai Koehne]

> -----Original Message-----
> From: QtWebEngine [mailto:qtwebengine-bounces+kai.koehne=qt.io at qt-
> project.org] On Behalf Of Luke
> Sent: Tuesday, January 24, 2017 12:46 AM
> To: qtwebengine at qt-project.org
> Cc: Parabola Mail List <dev at lists.parabola.nu>
> Subject: [Qtwebengine] QTWebengine compliance with FSDG
> 
> Hello,
> I am currently a packager for Parabola GNU/Linux-libre. While investigating
> the change from Webkit to Webengine, I discovered several concerning
> issues that affect our compliance with the Free Software Foundation's Free
> System Distribution Guidelines (FSDG).[1] I am hopeful that some
> developers will be able to clarify these issues for us as it affects hundreds of
> projects downstream including nearly all of KDE, as well as many QT
> programs.
> 
> In particular, your website claims it is not just a rendering engine, "it is the
> entire Chromium platform."[2]

This means that Qt WebEngine not only use the rendering engine of Chromium, but also the networking stack, plugin architecture etc. It doesn't mean though that we support every single feature of Chrome.

> If this is true, there are many outstanding issues with Chromium which we
> would need to be addressed.
> 
> 1) Was any attempt made to remove Google specific code from Chromium
> prior to preparing QTWebengine?
> - If not, could ungoogled-chromium patches be applied to your code?[3]
>
> By default, Chromium has many lines of code that make internet queries to
> Google. Building it using the default settings essentially puts your browser
> into the cloud. As mentioned in the GNU.org article "Who does that server
> really serve?"[4], free software is only free when you are in control. Any use
> of Google API, Google Sync, Google Hangouts, and Google OK, does not
> classify as free software.

Not sure what you mean by "Google API", but we do not ship code for Google Sync, and Google OK, and do not compile in hangout services.

Qt WebEngine should never 'call home' to Google servers. 

> 2) Is any form of proprietary code such as Adobe pepperflash, webvine
> DRM[5], or proprietary codecs included? If so, can they be removed or
> disabled with a compile time option?

We do not include Adobe Flash, or Widevine (but support finding them at runtime). We ship some proprietary codecs in the sources, these need to be enabled explicitly during build though (default is off).

> 3) Is it possible to compile QTWebengine with specific chrome://flags?[6]
> 
> Due to privacy and security concerns of Geolocation API, and GamePad API,
> among others, we would like to have the ability to disable these settings for
> our distribution.

There's no general mechanism, we're open to add compile time flags though for cases where it makes sense.

Please file feature requests for these at https://bugreports.qt.io/ .

That said, most flags also have matching command line arguments, which you can use with Qt WebEngine, too.

> 4) Was any work done to fix outstanding proxy leaks in Chromium, which
> ignore system proxy settings?[7]

To my knowledge we didn't do any specific patches in this area. Anyhow, the bug you linked is pretty convoluted, so it's hard for me to say in what way it applies to Qt WebEngine. 

> Once these issues are resolved we will able to include QTWebengine in our
> distribution without issue, otherwise we may have to remove it. Due to this
> being a core package we are hesitant to remove it due to the hundreds of
> packages now depending upon it.

Alright, I hope I could clarify some things :) Feel free to ask if you need further information.

Regards

Kai Koehne

> Thank you for your time and concern regarding this important matter.
> 
> 
> Sincerely,
> Luke
> Parabola GNU/Linux-libre Packager
> https://parabola.nu
> 
> 1. https://www.gnu.org/distros/free-system-distribution-guidelines.html
> 2. https://wiki.qt.io/QtWebEngine
> 3. https://github.com/Eloston/ungoogled-chromium
> 4. https://www.gnu.org/philosophy/who-does-that-server-really-serve.html
> 5. http://defectivebydesign.org/
> 6. http://stackoverflow.com/questions/17060363/google-chrome-how-can-i-
> programmatically-enable-chrome-flags-some-of-the-mod
> 7. https://bugs.chromium.org/p/chromium/issues/detail?id=80722#c33
>