Re: gtk3 w/o dbus no longer possible?

[Thomas Klausner <wiz%NetBSD.org@localhost>]

On Sat, Nov 16, 2024 at 10:59:00PM +0000, David Holland wrote:
> On Sat, Nov 16, 2024 at 10:21:16PM +0000, Patrick Welche wrote:
>  > > gtk2 didn't depend on dbus prior to this.
>  > > 
>  > > Now it does; that's broken.
>  > 
>  > Why does that make it "broken"?
> 
> Because dbus is systemd-quality system design, and a lot of us don't
> want it on their systems.
> 
> But also: because it's very difficult to keep the thing from running
> if it's installed; because it installs setuid root frobs so it can't
> be contained to a single user account; and because of these factors,
> once it's running you get a whole new class of attack vectors/security
> risks.
> 
> It's one thing, in the absence of alternative infrastructure, to
> install it because you need it for something; it's another thing for
> large numbers of widely-used applications that don't need it to
> quietly start running it.

at-spi2-core has a atk_only option. You can enable it by

MESON_ARGS+= -Datk_only=true

Setting this needs changes to the package Makefile (for the config
file handling) and the PLIST.

If you come up with a patch for at-spi2-core to optionally(!) set this
flag but don't break the default of having this option on, we can
merge that. Then you can disable the dbus dependency on your systems.

I expect it will break a number of dependencies, so I'll not support
making that the default though.
 Thomas