[PATCH] gnu: webkitgtk: Add locale and dri access to gtk sandbox in order to silence gtk locale warnings and enable hardware accelerated video, respectively.

Add @dridir@ and @localedir@ to bubblewrap gtk sandbox

'configure-bubblewrap-store-directory' phase, also supply locale

and dri directory paths to webkitgtk-adjust-bubblewrap-paths.patch

template.

Change-Id: Id1ffe23e56a8da4ff3c81a2cde7d9622f024bdea

---

.../patches/webkitgtk-adjust-bubblewrap-paths.patch | 8 +++++++-

gnu/packages/webkit.scm | 11 ++++++++++-

2 files changed, 17 insertions(+), 2 deletions(-)

Add @dridir@ and @localedir@ to bubblewrap gtk sandbox

'configure-bubblewrap-store-directory' phase, also supply locale

and dri directory paths to webkitgtk-adjust-bubblewrap-paths.patch

template.

Change-Id: Id1ffe23e56a8da4ff3c81a2cde7d9622f024bdea

---

Messed up dri-dir and locale dir

.../patches/webkitgtk-adjust-bubblewrap-paths.patch | 8 +++++++-

gnu/packages/webkit.scm | 11 ++++++++++-

2 files changed, 17 insertions(+), 2 deletions(-)

Hello,

So this patch fixes two things. First, it gives the webkit gtk process

access to va-api drivers, which allows hardware acceleration for video

and prevents the errors below:

0:00:00.489161195 21 0xfd4200 INFO vadisplay gstvadisplay.c:268:_va_info:<vadisplaydrm2> VA info: Trying to open /home/abhishek/.guix-profile/lib/dri/i965_drv_video.so

0:00:00.489224548 21 0xfd4200 INFO vadisplay gstvadisplay.c:268:_va_info:<vadisplaydrm2> VA info: Trying to open /run/current-system/profile/lib/dri/i965_drv_video.so

0:00:00.489278879 21 0xfd4200 INFO vadisplay gstvadisplay.c:268:_va_info:<vadisplaydrm2> VA info: va_openDriver() returns -1

0:00:00.489287135 21 0xfd4200 WARN vadisplay gstvadisplay.c:316:gst_va_display_initialize:<vadisplaydrm2> vaInitialize: unknown libva error

0:00:00.489302829 21 0xfd4200 ERROR msdkcontext gstmsdkcontext.c:183:gst_msdk_context_use_vaapi: Couldn't create a VA DRM display

Second, it gives access to the locale dir, which silences some warnings

of the sort below:

(process:2): Gtk-WARNING **: 02:21:08.731: Locale not supported by C library.

Using the fallback 'C' locale.

Yours sincerely,

Abhishek Cherath.

The reason the driver path stuff is particularly important is that I get

my env vars for LIBVA_DRIVERS_PATH from guix package --search paths as

follows

```bash

eval "$(guix package --search-paths \

-p $HOME/.config/guix/current \

-p $HOME/.guix-profile \

-p $HOME/.guix-extra-profiles/emacs/emacs \

-p $HOME/.guix-home/profile \

-p /run/current-system/profile)"

```

and this gives the following for LIBVA_DRIVERS_PATH:

```bash

export LIBVA_DRIVERS_PATH="/run/current-system/profile/lib/dri:/home/abhishek/.guix-profile/lib/dri"

```

This means that any sandboxed program with access to one of those won't

be able to use hardware acceleration. I only figured this out when I got

curious about why mpv could use hardware accel just fine but nyxt

couldn't. It's also a problem for firefox. Guess I should put in a bug

report there?

I mean *without* access.

Hello!

Abhishek Cherath <abhi@quic.us> writes:

This looks reasonable to me, thanks for your contribution! I suppose

for security reasons the file names must be static, e.g. cannot be

$HOME/.guix-profile/share/locale or similar?

LGTM; Liliana, I remember you would prefer not having webkitgtk changes

happen on master; do you have a suggestion of which branch this should

be committed to? gnome-team?

--

Thanks,

Maxim

It was a conservative choice, but not made for security reasons, I'm just not sure where and how this wrapper runs, and I was mildly tired of recompiling webkitgtk.

I'm not opposed to having it be $HOME, if that works; I don't see what security issues there could be.

On 31 March 2024 9:33:41?pm GMT-04:00, Maxim Cournoyer <maxim.cournoyer@gmail.com> wrote:

Am Sonntag, dem 31.03.2024 um 22:17 -0400 schrieb Abhishek Cherath:

I think dynamic choices should be possible – IIRC, std::strings are

used for arguments, but even if not, we're dealing with C++, so we can

allocate "on the stack".

Am Sonntag, dem 31.03.2024 um 21:33 -0400 schrieb Maxim Cournoyer:

We can do this on gnome-team, we still have some leftover world

rebuilds from 44.10. I'd prefer if stuff that rebuilds webkitgtk on

master were grafted, as it causes more than the prescribed 300 rebuilds

and is a nasty build itself.

Cheers

?. I can make that change tomorrow. One QoL thing. How do you run a program built in /tmp/<<build_folder>> without it complaining about store paths and suchlike?

I ask because ideally, I'd debug this by interrupting the webkit build somewhere while I have --keep-failed, then `guix shell -D webkitgtk --pure && . environment-variables`, then running the minibrowser. But that doesn't work because it complains about stuff not being in the store.

Oh, but I suppose I could use LD_LIBRARY_PATH unless it compiles in some strings. Will try.

?, so call this webkitgtk-bubblewrap-fixed and have a replacement field in the other package?

Am Montag, dem 01.04.2024 um 06:49 -0400 schrieb Abhishek Cherath:

You should be able to run things from the build folder, but you could

also throw a post-install error if needed. Just note that webkitgtk in

and of itself doesn't really come with a full browser, so you'd have to

compile one as well…

I think with webkit in particular the problem is that store paths are

getting hard-coded in places where file existence is required, so you

might want to replace those store paths with /tmp/guix-build/…

Ahh, sorry, grafts are for security purposes – changes like these would

have to go through the usual channels (i.e. gnome-team). We will be

jumping ahead to 46 at some point in the future, but for now the branch

is chill and we still need to catch up on stuff we missed for master.

Cheers

On Mon, 1 Apr 2024, Liliana Marie Prikler wrote:

I don't mean to hold up this patch, however, this reminded me to check and

It looks like we'll be do for a rebuild anyway for the new major version:

Best

Jack

Am Montag, dem 01.04.2024 um 14:11 -0400 schrieb Jack Hill:

Yeah, we're in great luck that we are chill on gnome-team atm. We can

do these big juicy webkit builds there, then do a mini-merge before we

start real work™ again.

Cheers

So I've no problem with adding the home profile paths and resubmitting to gnome-team, but I'll likely only be able to do that this weekend.

If anyone else wants to make the changes or merge this one as is for now, I have no problem.

close 69971

Hello,

I've made the changes and submitted as 70446 to gnome-team.

close 69971

close 69971