Bug#863915: unblock: webkit2gtk/2.16.3-2

[Jeremy Bicha]

I apologize for not personally trying hard to push this through, but
if we don't unblock 2.16.3 in the next few days, it makes the Stable
Release process more difficult since we can't "practice" with easier
webkit2gtk point releases first.

Proposal for initial webkit2gtk updates in Debian 9
------------------------------------------------------------------------
Here's my thinking as to how the first webkit2gtk stable update could work.

1. A new webkit2gtk point release is released.
2. Since regressions are generally found within the first week and to
try to limit the work needed by the SRMs, we wait a week before
uploading to the s-p-u queue.
3. A SRM accepts it.
4. An email is sent out to the maintainers of the rdeps asking them to
please test their package with the new webkit2gtk version in s-p-u
within the next 2 weeks.
5. If no regressions are reported, the update is released in the next
Debian 9 point release.

Here's a filtered list of rdeps: https://paste.debian.net/961084/

These updates are also being done across all Linux distributions so I
believe the risk of a regression with this process is fairly low.

If that process goes well, then we can consider how we will handle the
new major release later this year.

Later webkit2gtk updates
------------------------------------
Based on the schedule of prior Debian point releases, I am concerned
about the longer gap between point releases later in Stretch's life. I
don't think it makes sense for Debian users to have to wait 4-5 months
for security updates. Maybe testing can still be done in s-p-u but
Security can push webkit2gtk versions from there out sooner.

Regressions from NOT updating
-----------------------------------------------
On the other hand, if we do not update webkit2gtk there will be
regressions too. A major recent example was Google changing their
websites which broke Google login (breaking a key part of GNOME Online
Accounts, Evolution, etc.) and the beta version of YouTube. This was
fixed a few weeks ago in 2.16.2 (and 2.14.7 but 2.14 is unsupported
now). https://launchpad.net/bugs/1687019

More diff info
-------------------
The debdiffs themselves are difficult to read. Here are the 2.16.2 and
the 2.16.3 updates:
https://launchpadlibrarian.net/319531521/webkit2gtk_2.16.1-1_2.16.2-1.diff.gz
https://launchpadlibrarian.net/321119967/webkit2gtk_2.16.2-1_2.16.3-1.diff.gz

webkit2gtk still uses trac and svn and there's no git mirror yet:
https://trac.webkit.org/log/webkit/releases/WebKitGTK/webkit-2.16
To see colored diffs, just select the radio buttons next to the 2
commits you want to diff and click View Changes. I believe 2.16.2 was
216485 and 2.16.3 is 217366. To view individual commits, you have to
click the radio buttons for the current and the previous commits and
click View Changes.

Thanks,
Jeremy Bicha