Ubuntu & Songbird, sitting in a tree…..

Thursday, Dec 11. 2008  –  Category: OpenSource, Songbird

I’ve spent the past two days down in Mountain View.  Yesterday I spent some time at the Ubuntu Developer Summit meeting with the great guys from the Ubuntu Mozilla-team to see about integrating Songbird into Ubuntu (ideally Jaunty, but we’ll see).  It’s a pretty common request from our Ubuntu users to get a Songbird .deb into Ubuntu’s repositories so users can easily ‘apt-get install songbird’.  Unfortunately, it’s not as easy as simply taking the GetDeb.net Songbird package and plopping that into an apt repo.

There are concerns from both the Ubuntu & Songbird side.  I’ll try to cover some of the major ones here:

  • Security updates and backports for XULRunner. Ubuntu has XULRunner already… Firefox uses it in fact.  They want Songbird to use the system XULRunner so they only have to sustain and maintain one copy of XULRunner.  As it is currently, Songbird has its own private patched copy of XULRunner, which means the Ubuntu Mozilla-team would need to backport security fixes to both the system XULRunner and Songbird’s XULRunner.
  • So why doesn’t Ubuntu just use Songbird’s XULRunner for both Firefox & Songbird?  Agreements with Mozilla.  In order to use the Firefox branding and trademarks, Ubuntu needs to maintain an approved XULRunner build that Mozilla blesses.  Putting in Songbird’s patches may regress Firefox which would lead to bad user impressions of Firefox and thus taint Mozilla & Firefox’s brand and image.
  • Supporting Releases.  This is somewhat related to the security/backporting issue… but POTI (the company developing Songbird) only supports the most recently released version of Songbird.  We release roughly every 3 months… quite frequently!  So, we just released Songbird 1.0 last week.  If a XULRunner exploit comes out, we won’t back-port it Songbird 0.7 or 0.6 which we released earlier this year.  Ubuntu has a release guarantee which more or less means they would need to support a release or two back… not to mention their LTS (long term support) policy which means they’d be supporting ancient versions of Songbird which we (POTI) wouldn’t even think once (let alone twice) about supporting.
So what can we do?  There’s definitely a ton of user interest from Ubuntu users who want Songbird available… one of the ideas asac and I were tossing around was putting a Songbird package into universe instead of main.  The difference is subtle to the end-user (both are apt-get installable), but main has stricter support and security guarantees than universe does.  Check out the Ubuntu page detailing more on the differences.

Putting a Songbird package into the universe would allow for users to be able to install it, whilst allowing Ubuntu to have some more leeway in terms of having a less-restrictive sustaining guarantee.  It’s definitely a nascent idea at the moment, but hopefully we’ll make some progress on proceeding down this path so that Songbird will be a one command install away for Ubuntu users… stay tuned.

Update: My wording was perhaps poor… I didn’t mean to give the impression that there is not security in universe, or that security policies are somehow lax vs. main.  Specifically, universe might be a better option than main because instead of having to backport individual patches to the supported-release version (as would have to happen in main), we could instead just rev to the latest Songbird release (thus shifting some of the maintenance from the Ubuntu Mozilla-team over to the Songbird developers).  This doesn’t alleviate all concerns though as we still need to ensure we have a process for keeping Songbird packages in universe up to date.

Update 2: I’ve had it pointed out that my wording on “into universe instead of main” was also confusing.  Prior to Wednesday, I didn’t realise the difference between universe & main (not being an Ubuntu user myself).. and was under the impression that it was just a single level of packages/repositories… hence the “instead of” wording.  Certainly asac and the Ubuntu guys undoubtedly had been planning universe all along.

Tags: ,

4 Trackbacks to “Ubuntu & Songbird, sitting in a tree…..”

  1. Ubuntu & Songbird en el mismo paquete | Walhez
  2. makin257 - Ubuntu & Songbird, sitting in a tree...
  3. Supporting Songbird - Bits by Ben
  4. Supporting Songbird « Bits by Ben

32 Comments to “Ubuntu & Songbird, sitting in a tree…..”

  1. Robert O'Callahan Says:

    Do you have a list of the patches you apply to Gecko?

  2. Stephen Lau Says:

    @roc: We have a slightly out of date list here. preed and I plan to go through sometime soon to update and get an authoritative list.

  3. Wladimir Palant Says:

    Interesting. We briefly discussed the same issues for TomTom HOME (purely theoretical discussion since it isn’t open source). We try to keep the list of differences to the official version small (see http://www.tomtom.com/mpl/) but getting HOME into Linux package repositories would still be quite a challenge.

  4. Wolfgang Rosenauer Says:

    Just want to throw in that openSUSE has exactly the same issues with Songbird. It’s available in the popular Packman add on repository though.

  5. GeekShadow Says:

    I don’t think Songbird is really needed in Ubuntu. Maybe POTI just have to put the .deb file on getsongbird.com it would be better.

  6. Vadim P. Says:

    Here’s a tip: give a .deb to users from your homepage. That alone is way better than a .tar.bz2 or a .deb hidden away 3 (or more, but it was a pretty long way!) deep.

  7. antony Says:

    no, providing a .deb from some arbitrary website is not a good solution. Half the beauty of package management is that you don’t have to search around the web for debs.

    Luckily nor is maintaining a fork of xulrunner fun or efficient. Unify both and then you can put it in ubuntus universe repo.

  8. Vadim P. Says:

    @antony: Sure is, but that’s the solution Songbird is choosing right now. I wouldn’t call getdeb.net ‘arbitrary’ however – it’s security record is outstanding.

  9. User93 Says:

    (not being an Ubuntu user myself)…

    Then why are you writing about it?

  10. jnak Says:

    really, with mplayer what’s the point of songbird

  11. JW Says:

    With this development into DEB, all XULRunner issues aside, what are the plans for 64-bit versions and/or capabibility. there are many apps that are restricted to x86 arcitecture (see Adobe) and the work arounds are extensive and a pain. Does the Songbird development team plan to incorperate a 64-bity DEB? or is that sometime down the road around V2.0?

  12. Zac Says:

    I hope it gets sorted because Songbird will/could entice people from Windows. It’s still a work in progress so with more users it will improve faster. Now is the time to sort this out.

    This also an area which the whole Linux world need to fix – the ability to package, install, update easily.

  13. Stephen Lau Says:

    @Vadim – We don’t build a .deb ourselves… mostly because we haven’t had the resources to do the packaging and subsequent QA/testing it would require for us to be able to fully support it. The GetDeb.net .deb is a great resource, but people should realise that it’s not provided “officially” by Ubuntu/Canonical, nor by Songbird – and thus should have different support expectations.

    @User93 – Even though I don’t use Ubuntu, I still respect the fact that it’s a huge distribution and that a huge number of our Linux users are on it… I want Songbird to succeed and to gain distribution, so Ubuntu is a key part of that.

    @JW – Songbird already provides x86_64 Linux binaries from our website. When we figure out how to get Songbird into Ubuntu, I expect we’ll see both 32-bit & 64-bit .debs available.

  14. John S. Says:

    To listen to some of the complaints around the net as of late, you would think Songbird is a Windows only app. The portability of Unix / Linux applications between different distributions has always been a pain in the ass to say the least. In the good old day you could, as least build your own version, provided you could find all the correct pieces to put together. The repository concept is a wonderful idea. With that said, the problem is there are just too darn many distros, each with small differences. Which ones should survive and prevail? Hell, I not dumb enough to get into that one. I am currently running an Ubunto along with the new Fedora core 10. I like them both, but who is the best. No comment here.

  15. alice Says:

    really, with mplayer what’s the point of songbird..

  16. Justin Says:

    I haven’t tried Songbird, but it sounds promising. Will get my hands on it as soon as its 100% Ubuntu compatible.

  17. user Says:

    put it in the universe… the end user won’t care.

  18. teddy Says:

    really, with mplayer what’s the point of songbird…

  19. Jef Spaleta Says:

    The Fedora review for songbird hinges on the same XULRunner issues. It seems multiple distributions are in agreement over not wanting multiple copies of xulrunner in. Maybe its because gecko/xulrunner vulnerabilities are a significant risk and represent a significant portion of the security errata they deal with?

    https://rhn.redhat.com/errata/rhel-server-errata-security.html look at those “critical” firefox errata updates in the rhel url. The previous 6 rhel errata for firefox were deemed critical and involved updates to xulrunner.

    That’s something not to take lightly by any distributor, even the faster moving Fedora.

    The author of this very blog,Stephen Lau, was seen in the Fedora review discussion in August talking with Fedora contributors concerning the underlying XULRunner issues. That’s 4 months! And Stephen is just now getting around to blogging about the problems associated with Songbird’s usage of a highly patched XULRunner? Fascinating.


    How is the xulrunner songbird patch list fairing for inclusion in upstream xulrunner?

    This isn’t a new problem with gecko/XULRunner based apps. The gecko related libraries have historically been developed in a way that encourages local copy “forking.” Since gecko was never advertised as a set of system libraries with a reliable API, people would stash copies of the codebase in their apps to get a static API for their own application needs, as a quick fix. Because of the historic API instability of gecko, applications developers have consistently adapted by forking it as needed and use it as internal project code. Raise your hand if you remember galeon. Songbird just happens to be the latest application to push the boundary and put more demands on gecko/xulrunner.

    This sort of local code forking is a real problem for distributors across the board. The mozilla branding requirements only complicate the problem even more because it binds the distributor’s hands somewhat by giving preferential treatment for firefox’s needs over other applications of the common libraries. Would distributors willingly allow gnome based application to do this sort of thing with pango or cairo or gtk.. or dbus? Include private patched copies of these libraries on an application by application basis instead of using the available system libraries? No. Distributors would free to patch the system libraries at their discretion, something we can’t do for xulrunner without jeopardizing the firefox branding.

    If this broken development/integration situation continues, and xulrunner integration continues to be constrained by non-technical issues like trademark access, I think we’ll find that over time webkit will grow to be the more attractive development target for 3rd party applications. The non-technical trademark access rules are killing the ability of distribution maintainers to broker near-term integration compromises for multiple applications by including targeted patchsets before upstream adoption.


  20. anon Says:

    Can you get your patches upstream? Firefox has more users than Songbird, so Songbird should work with Firefox’s xulrunner, not the other way around.

  21. 'That' guy Says:

    Here’s a wacky idea!

    What if we get songbird into Debian?

  22. web design Says:

    Really? Songbird isn’t in Ubuntu’s repos? That’s really odd. I use Gentoo, and I use Banshee, so I don’t follow Ubuntu much anymore.

  23. Stephen Lau Says:

    @anon – We’re actively upstreaming our patches, but it’s a slot process. You can see our Songbird tracker bug at bugs.mozilla.org to see all the various bugs we have upstreamed so far, and the ones that are still waiting. The point is that XULRunner is supposed to be a platform… not beholden to any app – whether it be Songbird OR Firefox.

    @’That’ guy – Wouldn’t be any easier… in fact, it would be all of the same problems + Debian would balk at trademark/branding issues above and beyond what Ubuntu would have.

  24. Erik Says:

    really, with mplayer what’s the point of songbird…

  25. durruti Says:

    @Erik, @teddy, the others (probably the same person) who also wrote “really, with mplayer what’s the point of songbird…”

    Have you ever used Songbird? I suspect not, it is not simply a media player (otherwise I would agree with your question as mplayer will play anything, it’s great, I use it as my default media player). Songbird however browses music on the internet (mplayer doesn’t do this), so they are different. Songbird is also a much better music manager, one that would rival itunes. If you don’t need these things you probably don’t need songbird.

    Keep up the good work POTI.

  26. Jonathan Breedlove Says:

    Just wanted to echo the “keep up the good work” sentiment-I have Songbird on two boxes currently (an Ubuntu 8.04/Hardy desktop & a Linux Mint Elyssa, using the same repositories) and I don’t think that it was too hard to get it on either (pretty much just a download & install from tarball sort of situation, if I remember correctly).

    That being said, getting it into the Universe would be great-I’d love to be able to just apt-get an update or handle it with the package manager. I’m sure that you’ll all figure it out & I’m looking forward to it.

  27. Helia Says:

    As a recent switcher from Windows to Linux/Ubuntu (jaunty) it was easy to install from a deb package. The package from http://unter-hund.com/2009/04/17/songbird-112-installer/ installed, but did not automatically integrate into the menu and produced non-critical GStreamer warnings. These are other reasons that I hope to see resolved once an synaptic integration is available.

    Thanks to POTI for songbird and for working on the ubuntu integration.

  28. minivitale Says:

    what i really want to see is something for us dual-booters so that I can use the same library, plugins, and settings in Windows (XP) and Ubuntu. that would switch me over 100% no question to songbird, as maintaining 2 different pieces of software is obnoxious and time consuming. i was hoping that songbird would already have that functionality.

  29. Andy06 Says:


    It already does :) Just like Firefox, all you need to do is shift your profile folder to the common data partition and then use profile manager of songbird to point to it. It contains all your extensions,settings and plugins. Your songbird will look and behave exactly the same since it will be using exactly the same profile.

    Underneath, it behaves exactly like Firefox so its predictable and a great asset.

  30. Isaiah Says:

    really, with mplayer what’s the point of songbird..

  31. Chauncellor Says:

    oi, will you shut up?

  32. Brian Russell Says:

    the download page correctly recognized me as an ubuntu user but gave me a tar.gz download – with no instructions! I unzipped the directory and tried running things but it just RAN songbird and didn’t install it. Luckily, I was able to find http://skyzim.com/songbird-1-4-3-installer/ which was what I (and to be sure most users) was looking for. works great!

    thanks for this great app! I would recommend including a link to the download on skyzim’s site if you are not going to offer a .deb file on your own site..

Leave a Reply

Recent posts