PolicyKit shipped in Ubuntu 20.04 has version 0.105 from 2012. Currently Fedora 33 ships version 0.116. I know there was a change in configuration files starting from version 0.106 (they became written in Javascript) but...come on...Ubuntu is shipping an obsolete security piece of software. Anyone knows more news about why is this happenning? Is anyone aware of this? Thanks!
0
Add a comment
|
1 Answer
See LP#1086783.
Essentially, the new version's inclusion was initially blocked due to the dependency on mozjs, which was considered by Marc Deslauriers to be too insecure and unsupported to be supported by Canonical (as polkit is a core security component, it and its dependencies would have to be in main, to be officially supported by Canonical).
There's been some recent activity as mozjs is now in main (some versions, anyway) due to being a dependency of GNOME Shell. Robert Ancell was gathering opinions in this Ubuntu Discourse post in January 2020, so you can comment there, if you have use cases for the newer version.
In a very promising update, the package index now shows v122 being packaged for Mantic (23.10). This Ubuntu Desktop Engineering update post says:
I’m happy to announce that polkitd 122 landed in mantic. You might wonder why I’m leading with this update, until you read that the previous version, 105, was released in 2012! The blocker for a straightforward upgrade was polkit moved to javascript-based rules, and to support that, it introduced a dependency on Duktape 4. That is now sorted and all rules have been rewritten in javascript.
The time of JavaScript is nigh.
-
-
Now I see why my custom polkit rules were being ignored since I upgraded to Mantic…– NovHakNov 8, 2023 at 7:01