RUSTSEC-2024-0420: gtk-rs GTK3 bindings - no longer maintained

[github-actions]

gtk-rs GTK3 bindings - no longer maintained

Details
Status	unmaintained
Package	gtk-sys
Version	0.18.2
URL	gtk-rs/gtk3-rs@508a69b
Date	2024-03-04

The gtk-rs GTK3 bindings are no longer maintained.

The maintainers have archived the repository, and added a note to the crate
description and its README.md that the crates are no longer maintained.

Please take a look at gtk4-rs instead.

See [advisory page](https://rustsec.org/advisories/RUSTSEC-2024-0420.html) for additional details.

[ulidtko]

Hi @FabianLars... Did you just close the issue, or was it actually fixed?

The bot has said this already, maybe I should reword: the dependency gtk is EOL. gtk4 should be used instead; see https://lib.rs/crates/gtk

To explain where I'm coming from: my tauri build of an app, not so relevant which — failed on Kubuntu 24.04 LTS, like so:

   Compiling gio-sys v0.18.1
   Compiling gdk-sys v0.18.2
   Compiling cairo-sys-rs v0.18.2
   Compiling gdk-pixbuf-sys v0.18.0
   Compiling glib-macros v0.18.5
   Compiling atk-sys v0.18.2
   Compiling log v0.4.25
   Compiling anyhow v1.0.95
   Compiling pango-sys v0.18.0
error: failed to run custom build command for `gdk-sys v0.18.2`

Caused by:
  process didn't exit successfully: `/home/ulidtko/src/elasticvue/src-tauri/target/release/build/gdk-sys-e814b490eeee1b2f/build-script-build` (exit status: 1)
  --- stdout
  cargo:rerun-if-env-changed=GDK_3.0_NO_PKG_CONFIG
  cargo:rerun-if-env-changed=PKG_CONFIG_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG
  cargo:rerun-if-env-changed=PKG_CONFIG
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_PATH
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_LIBDIR
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR_x86_64-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR_x86_64_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_SYSROOT_DIR
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR

  --- stderr

  pkg-config exited with status code 1
  > PKG_CONFIG_ALLOW_SYSTEM_CFLAGS=1 pkg-config --libs --cflags gdk-3.0 gdk-3.0 >= 3.22

  The system library `gdk-3.0` required by crate `gdk-sys` was not found.
  The file `gdk-3.0.pc` needs to be installed and the PKG_CONFIG_PATH environment variable must contain its parent directory.
  The PKG_CONFIG_PATH environment variable is not set.

  HINT: if you have installed the library, try setting PKG_CONFIG_PATH to the directory containing `gdk-3.0.pc`.

I'm well aware about pkg-config; and was able to install the missing headers and .pc files with:

sudo apt install -y \
        libgtk-3-dev \
        libatk1.0-dev \
        libjavascriptcoregtk-4.1-dev \
        libsoup-3.0-dev \
        libwebkit2gtk-4.1-dev

so then, build continued.

However, just out of curiosity: is it being considered at all? https://docs.gtk.org/gtk4/migrating-3to4.html
Anything noted that community could help with?

From here, it's pretty much guaranteed that gtk3 builds will be getting worse and worse over time.

So it's worrying to find this issue as the best existing discussion. Not a big fan of gtk myself; but LMK if I should perhaps start a dedicated thread on GTK 4.

[FabianLars]

The whole section about the build error honestly makes no sense. If Tauri would already use gtk4 you'd still have to install dev packages...

And yes, we will either switch to gtk4 or drop gtk completely (unlikely). I wanted to have this switch be the main thing in tauri v3 but with cef in the poc phase i'm not so sure if that's realistic

#11942
tauri-apps/wry#1228
tauri-apps/muda#259
tauri-apps/webkit2gtk-rs#94

The tray icon is the biggest blocker because there's no libappindicator for gtk4 so it needs to be rewritten to use that one freedesktop spec i forgot its name of. There's a community member already working on it.

So, with the tray and menu being worked on that leaves 3 major things:

1. update our webkit2gtk bindings crate (or create a new one) for webkitgtk6 (i hoped that https://gitlab.gnome.org/World/Rust/webkit2gtk5-rs would take off but looks like it's dead)
2. tao needs a gtk4 backend
3. wry needs to swap to gtk4

The problem here is that all 3 tasks are pretty big tasks and i don't think we can find community members that are interested enough in this to actually tackle them. Same for the team itself tbh but sooner or later we have to force ourselves.

Edit: I forgot that there's https://gitlab.gnome.org/World/Rust/webkit6-rs as well, that may get us close enough to consider 1) to be a small task