net-libs/webkit-gtk: bump to 2.16.1 for 33+ security fixes
Fixes CVE-2016-9642, CVE-2016-9643, CVE-2017-2367, CVE-2017-2376, CVE-2017-2377,
CVE-2017-2386, CVE-2017-2392, CVE-2017-2394, CVE-2017-2395, CVE-2017-2396,
CVE-2017-2405, CVE-2017-2415, CVE-2017-2419, CVE-2017-2433, CVE-2017-2442,
CVE-2017-2445, CVE-2017-2446, CVE-2017-2447, CVE-2017-2454, CVE-2017-2455,
CVE-2017-2457, CVE-2017-2459, CVE-2017-2460, CVE-2017-2464, CVE-2017-2465,
CVE-2017-2466, CVE-2017-2468, CVE-2017-2469, CVE-2017-2470, CVE-2017-2471,
CVE-2017-2475, CVE-2017-2476, CVE-2017-2481 and further fixes for CVE-2017-2364.
Upstream says 2.16.1 fixes more security bugs than these, over 2.16.0 release,
but that they didn't have CVE numbers as of yet.
Add some seemingly necessary perl build dependencies (which everyone probably
had installed anyways). This perl build dep list is by no means complete.
Includes preliminary patch from Kent to not start requiring perl[ithreads] for
building (over perl with whatever ithreads choice), which would be disastrous
for us.
Upstream has replaced gnutls with libgcrypt. The experimental API unstable DOM
stuff was dropped completely (but isn't used since epiphany-3.22), while the
webkit2gtkinjectedbundle-j1.patch patch in earlier version modified lines that
were there for it - so hopefully -j1 MAKEOPTS building still works with that
patch dropped.
CREDENTIAL_STORAGE option was renamed to LIBSECRET.
flex build dep seems to have been dropped and gstreamer requirement upped to 1.2.3.
harfbuzz 1.3.3 is useful for it for some optional fixes, so guarantee it.
Gentoo-bug: 614876
Thanks-to: Kent Fredric <kentnl@gentoo.org>
projects / gentoo.git / commit