Amazon web app needs an implementation that does not require webbrowser-app

Status changed to 'Confirmed' because the bug affects multiple users.

I have a minimal working implementation.

Try It
------
sudo add-apt-repository ppa:jbicha/epiphany
sudo apt update
sudo apt install webapp-amazon
Log out then log back in (to run the required autostart)

Brief details
-------------
This is using Epiphany's webapp mode. The epiphany packaging is directly inspired by Fedora which has shipped epiphany like this for a while. Firefox is still Fedora's default browser and although this includes /usr/bin/epiphany, you'll want to install 'epiphany-browser' if you want the .desktop file. (Epiphany calls itself "Web" these days as part of GNOME's minimal naming strategy.)

epiphany uses the webkit2gtk engine which is already in main and is well-maintained by Ubuntu Security for 16.04+. epiphany has no other universe dependencies and is a relatively small package (less than 2 MB download, about 8.5 MB installed including all translations).

How to completely remove it
---------------------------
sudo apt purge webapp-amazon
rm ~/.local/share/applications/ubuntu-amazon-default.desktop
rm -r ~/.config/epiphany/app-ubuntu-amazon-default

(and of course run ppa-purge as long as this is still only in a PPA)

Other web apps
--------------
If we want to allow users to easily install other webapps that aren't part of the default install, it's a bit simpler. We just need to provide the appropriate appstream metadata to be able to use GNOME Software's Epiphany plugin.

I prepared one sample app for testing, but it is easy to add more components to the metadata file.

sudo apt install webapp-data
pkill gnome-software
gnome-software

Search for BBC News and install the app. The install is almost instant and it's only installed for the current user.

We need to ask the security team if they are okay with having Epiphany as a web browser in main, albeit limited to 'some' sites ('some' being either everything with one of those webapps, or Amazon depending on whether the plugin to gnome-software is enabled or not). At the moment webkit2gtk in main is only used for displaying content that is relatively controlled.

And the old Unity webapp had a wrapper which determined the Amazon store to launch using geolocation. I think we'll need to have something like that still.

I'm not ok with having epiphany in main at this time.

While there have been a number of webkit2gtk security updates recently, at this point in time we don't know how long it will continue to be maintained upstream in an API/ABI compatible way that would make it supportable for an LTS release. For now, I recommend just having it be used by applications in main that don't parse untrusted content.

Is there any reason why we don't just open it in the default browser? What would be the benefit in opening it in a browser the user doesn't normally use?

Marc, it sounds like you are describing just a simple bookmark instead of a webapp. If clicking the Amazon button just opens Amazon in Firefox, I think most of our users will just use Firefox directly to visit Amazon, which would make the Amazon "app" not very useful.

webkitgtk's current policy is for Ubuntu to be supported for at least 3 years. If we need more than that, we'll need to talk to them: https://trac.webkit.org/wiki/WebKitGTK/DependenciesPolicy

On Mon, May 08, 2017 at 11:14:42AM -0000, Marc Deslauriers wrote:
> I'm not ok with having epiphany in main at this time.
>
> While there have been a number of webkit2gtk security updates recently,
> at this point in time we don't know how long it will continue to be
> maintained upstream in an API/ABI compatible way that would make it
> supportable for an LTS release. For now, I recommend just having it be
> used by applications in main that don't parse untrusted content.
>
> Is there any reason why we don't just open it in the default browser?
> What would be the benefit in opening it in a browser the user doesn't
> normally use?

I think it's that the integration with the shell is a bit nicer, and it
would open the way for use of other webapps too. It's supposed to feel
more like an 'app' and less like opening a webpage.

But if that doesn't matter then we could probably just open the URL
(after generating the country-specific URL) and let the system handle
opening it in the user's browser.

--
Iain Lane [ <email address hidden> ]
Debian Developer [ <email address hidden> ]
Ubuntu Developer [ <email address hidden> ]

I wrote this using Geoclue and Geocode-glib to just open the country-specific URL in whatever you have configured.

Give it a go & see if it opens the right thing?

Need: gir1.2-geocodeglib-1.0 gir1.2-geoclue-2.0 geoclue-2.0 python3-gi

While firefox doesn't really have an 'app' mode¹, it can sort of be emulated by using a separate profile and a custom userChrome.css for that profile that hides most of the chrome.
See https://askubuntu.com/a/487954/167099 for details.

What this doesn't provide, afaict, is a way to customize the window title and icon (the shell will keep associating this new window to firefox instead of considering it a separate app).

¹ https://bugzilla.mozilla.org/show_bug.cgi?id=1283670

We really don't need an "app", a bookmark/shortcut is better IMHO (some discussion per 1517509). For other websites an app can be very useful, for Amazon I think it gets in the way (who wants to login to Amazon in two different browsers in Ubuntu).

The Epiphany webapp mode looks perfect for actual webapps.. I wonder if we can get any electron users to port to it..

I will just say: "[a]t the moment webkit2gtk in main is only used for displaying content that is relatively controlled" is a misunderstanding. Unless you're planning to get rid GNOME Shell's captive portal helper, then WebKit is going to be displaying whatever the local wireless network wants it to, whenever the local wireless network wants it to do so, without user intervention. (And with so many websites using HSTS nowadays, which breaks captive portals, you really don't want to disable the portal helper.)

Michael, Ubuntu (or Ubuntu GNOME) has not enabled NM's connectivity check by default yet, but I believe we're working on doing that for 17.10.

A side note: As a long time user of Ubuntu and Unity, some of the things I always purge from the system, since 12.10, is all unity-webapps*, all webbrowser-app* and all oxide* packages. Firefox is heavy enough for everything. Having two web browsers (one complete and one crippled) is useless in my opinion.

My script is in https://bileto.ubuntu.com/#/ticket/2755

(I forgot to add the bug #)

I think this bug has already been resolved.

Indeed, it was fixed with the addition of ubuntu-web-launchers to the default CD. Thanks!