Bug#1090384: xfce4: desktop environment metapackage should provide a polkit agent

[Simon McVittie <smcv@debian.org>]

Package: xfce4
Version: 4.18
Severity: important

As discussed on #1076728, there is a de facto expectation that each "good"
desktop environment will provide a polkit authentication agent that is
suitable for it, similar to the expectation for o.fd.Notifications.

I've reported this as a bug in the xfce4 metapackage, but it might
make sense to push it down into a "smaller", lower-level package like
xfce4-session (I am not familiar with the details of XFCE's design).

There are two main ways to get a polkit agent:

1. Integrate it directly into the desktop shell, as has been done by
   GNOME since 3.0 and various GNOME derivatives like Phosh.
   XFCE has not done this, that I know of.

2. Depend on a separate polkit agent UI program that is appropriate for the
   desktop environment, and arrange for it to be started during graphical
   session login, either via /etc/xdg/autostart or by explicitly
   starting it. XFCE does not have its own polkit agent
   (https://github.com/ncopa/xfce-polkit exists, but is unmaintained and
   has not been packaged in Debian) so it will have to borrow
   someone else's.

One straightforward way to implement (2.) would be to add a dependency
on a specific polkit agent implementation that fits well into XFCE, or
an or-group (Depends: impl1|impl2|...) for more than one implementation,
where each implementation has an /etc/xdg/autostart/*.desktop whose
ShowIn and/or OnlyShowIn fields allow it to be run under XFCE.
If the chosen implementation is desktop-specific, it would be best to
contact its maintainers, let them know that XFCE is also relyiing on
that implementation, and perhaps offer to co-maintain it.

Note that merely adding a direct or indirect dependency on the
polkit-1-auth-agent virtual package is *not* enough to resolve this bug:
that virtual package is provided by some polkit agents that are either
integrated into a different desktop environment (gnome-shell, etc.),
or standalone programs that have an OnlyShowIn that excludes them from
being used by XFCE (polkit-kde-agent-1, etc.). Installing one of those
will not provide a working polkit authentication agent under XFCE.

Historically, policykit-1-gnome has been treated as the polkit agent of
last resort.  However, it was originally intended to be GNOME-specific,
and is a GNOME-2-era implementation which is no longer maintained
(see #990271), so I don't think anything involving a dependency on
policykit-1-gnome would be a good solution to this issue. If the XFCE
downstream or upstream maintainers feel that policykit-1-gnome is the
implementation they want to be using, then someone will need to fork
it under a less misleading name and become the fork's new upstream
maintainer. Borrowing a polkit agent from LXDE or MATE would probably
be a better solution.

I suspect that new installations of XFCE are currently pulling in the
unmaintained policykit-1-gnome by default, possibly via a long and
unintended dependency chain.

Comparing with some other major distros:

- Arch seems to install (their equivalent of) policykit-1-gnome by default,
  despite it being dead upstream, but offers xfce-polkit as an alternative;
- Fedora ships xfce-polkit

Please choose a suitable polkit agent and add it as a dependency, or at
least as a Recommends.

Thanks,
    smcv