git_admin/obsidian-vault
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
307aba7cf14b3849baaae47b5ef80ff0493db462
obsidian-vault/work/notes/webkit-macos-version-mapping.md
T

12 KiB
Executable File
Raw Blame History

title, tags, created, updated
title tags created updated
Mapping Apple OS builds to WebKit source releases
webkit
safari
macos
ios
crash
ravel
reference
2026-10-06 2026-10-06

Mapping Apple OS builds to WebKit source releases

Purpose

This document explains how to map a WebKit crash on macOS or iOS to:

  1. the exact Apple OS build;
  2. the exact system WebKit binary by Mach-O UUID;
  3. its CFBundleVersion and WebKit FULL_VERSION;
  4. the closest public WebKit source tag;
  5. the presence or absence of a source change.

The DuckDuckGo Apple browsers currently support macOS 12.3+ and iOS 15.0+. The deployment targets are defined in macOS/Configuration/Common.xcconfig and iOS/DuckDuckGo-iOS.xcodeproj/project.pbxproj in the Apple browsers repository.

Short answer

Use this chain for an exact mapping:

OS version + OS build
  -> WebKit Mach-O UUID from the crash report
  -> matching binary and UUID in Ravel
  -> WebKit CFBundleVersion from the OS or app telemetry
  -> remove the platform SYSTEM_VERSION_PREFIX
  -> WebKit FULL_VERSION
  -> public source tag or release branch
  -> inspect the released code for the fix

An OS major version identifies only a WebKit release train. It does not identify the exact WebKit revision because Apple updates WebKit in OS point and security releases.

Version fields

Field Example Meaning
OS version macOS 27.0.1 Marketing version
OS build 26A434 Exact Apple OS build; use this in Ravel
Mach-O UUID 70BEE322-... Exact WebKit binary identity for one architecture
CFBundleVersion 22625.1.29.11.28 System framework build version
SYSTEM_VERSION_PREFIX 22 Platform/OS prefix added by Apple's production build
WebKit FULL_VERSION 625.1.29.11.28 Release version without the system prefix
Source tag WebKit-7625.1.29.11.28 Candidate public source release
HTTP User-Agent AppleWebKit/605.1.15 Frozen compatibility token; not usable for this mapping

Supported OS release trains

These tables map each supported OS major to its initial Safari/WebKit release train. Always use the exact-build workflow for a crash or API-availability decision.

macOS 12.3+

macOS DDG support Safari release WebKit base FULL_VERSION macOS prefix Production bundle base Public source-tag family
12 Monterey 12.3+ 15 612.1.27 17 17612.1.27 Safari-612.1.27.*
13 Ventura Yes 16 614.1.25 18 18614.1.25 WebKit-7614.1.25.*
14 Sonoma Yes 17 616.1.27 19 19616.1.27 WebKit-7616.1.27.*
15 Sequoia Yes 18 619.1.26 20 20619.1.26 WebKit-7619.1.26.*
26 Tahoe Yes 26 622.1.22 21 21622.1.22 WebKit-7622.1.22.*
27 Golden Gate Yes 27 625.1.29 22 22625.1.29 WebKit-7625.1.29.*

iOS 15.0+

WebKit uses SYSTEM_VERSION_PREFIX = 8 for iPhone-family SDKs. Therefore the iOS production bundle version is 8 concatenated with FULL_VERSION.

iOS DDG support Safari release WebKit base FULL_VERSION iOS prefix Production bundle base Public source-tag family
15 15.0+ 15 612.1.27 8 8612.1.27 Safari-612.1.27.*
16 Yes 16 614.1.25 8 8614.1.25 WebKit-7614.1.25.*
17 Yes 17 616.1.27 8 8616.1.27 WebKit-7616.1.27.*
18 Yes 18 619.1.26 8 8619.1.26 WebKit-7619.1.26.*
26 Yes 26 622.1.22 8 8622.1.22 WebKit-7622.1.22.*
27 Yes 27 625.1.29 8 8625.1.29 WebKit-7625.1.29.*

iOS versions 19–25 do not exist; Apple changed the public version number from 18 to 26.

Exact builds verified in Ravel

Ravel is currently incomplete. A missing build means that Ravel does not index it, not that the OS lacks WebKit.

macOS examples

macOS Build WebKit UUID CFBundleVersion FULL_VERSION
26.5.2 25F84 49B21D99-8716-31B8-8686-71B287325F1D 21624.2.5.11.8 624.2.5.11.8
26.6 25G72 B090AABF-9A3B-3110-9DA9-F0F40FCEC972 21624.4.5.11.5 624.4.5.11.5
26.6.1 25G76 B090AABF-9A3B-3110-9DA9-F0F40FCEC972 21624.4.5.11.5 624.4.5.11.5
26.6.2 25G83 844AF253-CAF6-3623-9DAD-A055C5274E62 21624.5.1.11.3 624.5.1.11.3
27.0.1 26A434 70BEE322-37EE-3B22-8012-4F76BA105C29 22625.1.29.11.28 625.1.29.11.28
27.2 beta 26B5086k 6F6AB57E-1492-3950-9962-85B6AFD430A3 22625.2.4.1 625.2.4.1
27.2 beta 2 26B5091g 56B4AA44-CB66-3641-8B22-723C39B5BC6E 22625.2.5.11.1 625.2.5.11.1
27.2 beta 3 26B5101f B32D7081-AE42-3A2E-ACBB-CF4D4BE4F296 22625.2.7.1 625.2.7.1

macOS 26.6 and 26.6.1 contain the same WebKit binary: both UUID and CFBundleVersion match.

iOS examples

Ravel identifies iOS WebKit binaries and UUIDs, but its dyld-cache page does not expose the framework Info.plist value. Read CFBundleVersion at runtime or from an extracted IPSW before claiming an exact source release.

iOS Build WebKit UUID
26.6 23G71 7627FDAB-129E-32BB-A2AC-F0DC02853D4E
26.6.1 23G83 C39BD22C-3475-38AF-91BD-0B7574081011
26.6.2 23G90 C39BD22C-3475-38AF-91BD-0B7574081011
27.0.1 24A446 D12A79A6-98CB-323C-8F72-613AD0983BBC
27.2 beta 24B5084k 1FD67A57-D91B-3B26-9F4F-91AB8299B6E7
27.2 beta 2 24B5089g 509D51AD-2CF9-3982-BFD5-81221D1B903D
27.2 beta 3 24B5099f 0566BF55-2DC4-34F6-B211-96FFAA0A37A4

iOS 26.6.1 and 26.6.2 contain the same WebKit binary UUID.

Exact mapping procedure

1. Read the OS build and WebKit UUID

From an Apple crash report, record the OS version/build and the WebKit image UUID. Compare UUIDs without case or dashes, and match the architecture.

rg 'OS Version:|WebKit.*<' crash-report.crash

2. Find the binary in Ravel

Use the OS build and the correct binary path:

macOS: /System/Library/Frameworks/WebKit.framework/Versions/A/WebKit
iOS:   /System/Library/Frameworks/WebKit.framework/WebKit

Ravel URL pattern:

https://ravel.dbg.re/binary?build=<OS_BUILD>&domain=dyld_cache&path=<URL_ENCODED_BINARY_PATH>

The Ravel UUID must equal the crash-report UUID. A matching version string without a matching UUID is weaker evidence.

3. Read CFBundleVersion

From app code on either platform:

import WebKit

let webKitBundleVersion = Bundle(for: WKWebView.self)
    .object(forInfoDictionaryKey: "CFBundleVersion") as? String

On macOS, it can also be read without app changes:

defaults read /System/Library/Frameworks/WebKit.framework/Resources/Info CFBundleVersion

For iOS, log the runtime value on a test device or include it in crash/pixel metadata. Do not infer an exact iOS value from the same-numbered macOS release.

4. Remove SYSTEM_VERSION_PREFIX

Apple production builds concatenate the prefix and the WebKit version:

CFBundleVersion = SYSTEM_VERSION_PREFIX + FULL_VERSION
Platform OS Prefix
iOS All supported versions 8
macOS 12 17
macOS 13 18
macOS 14 19
macOS 15 20
macOS 26 21
macOS 27 22

Example:

22625.1.29.11.28 - prefix 22 -> 625.1.29.11.28

5. Resolve the public source release

For modern release trains, candidate tags use:

WebKit-7<FULL_VERSION>

Example:

625.1.29.11.28 -> WebKit-7625.1.29.11.28

The 612 train is an older naming exception:

612.1.27.* -> Safari-612.1.27.*

Check exact public tags and release branches:

git ls-remote --tags https://github.com/WebKit/WebKit.git 'WebKit-7625.1.29*'
git ls-remote --heads https://github.com/WebKit/WebKit.git 'safari-7625*'

An adjacent tag is only a bound, not an exact match. Apple may publish a binary before publishing the corresponding source tag.

6. Verify the fix in released source

Inspect the changed code in the candidate tag. This is stronger than checking one commit SHA because Apple may cherry-pick the change under a different SHA.

For the certificate-info crash discussed below:

git show <TAG>:Source/WebKit/UIProcess/WebFrameProxy.h \
  | rg 'commitCertificateInfo'

Old signature:

void commitCertificateInfo(const URL&);

Fixed signature from 318982@main:

void commitCertificateInfo(const URL&, bool hasCertificateInfo);

7. When the exact source tag is unavailable

Record the evidence level explicitly:

  1. UUID + CFBundleVersion: exact binary and release version are known.
  2. Symbols or disassembly: a specific ABI or behavior can be proven in the binary.
  3. Reproduction on the exact OS build: the bug can be proven present or absent.

Safari Technology Preview is a separate build. Its version does not prove the version of system WebKit.

Current certificate-info crash

The crash on macOS 27.0.1 maps as follows:

macOS:           27.0.1 (26A434)
Crash UUID:      70BEE322-37EE-3B22-8012-4F76BA105C29
Ravel UUID:      70BEE322-37EE-3B22-8012-4F76BA105C29
CFBundleVersion: 22625.1.29.11.28
Prefix:          22
FULL_VERSION:    625.1.29.11.28
Candidate tag:   WebKit-7625.1.29.11.28

The exact .11.28 source tag is not public as of 2026-10-06; .11.27 is public. The crash symbol and the WebKit-7625.1.29 source family both show the old one-argument signature. Therefore the fix is absent from macOS 27.0.1.

Ravel identifies macOS 27.2 beta binaries as 625.2.4.1, 625.2.5.11.1, and 625.2.7.1. Public WebKit-7625.2.* tags are not available as of 2026-10-06. The fix landed in 318982@main and Safari Technology Preview 251, so macOS 27.2 is a candidate for the first fixed system release, but source inclusion is not yet proven.

DuckDuckGo telemetry gap

Current pixels do not include the exact system WebKit CFBundleVersion. The HTTP User-Agent cannot fill this gap because Apple returns the frozen AppleWebKit/605.1.15 compatibility token.

Add one field to relevant crash and WebKit failure telemetry:

webkit_build=22625.1.29.11.28

Populate it from Bundle(for: WKWebView.self).CFBundleVersion. This makes OS-build-to-WebKit correlation deterministic on both macOS and iOS.

Sources

Limits

  • One OS major contains multiple WebKit updates; use the exact OS build for conclusions.
  • Ravel is in beta and does not index every historical Apple build.
  • Intel and Apple Silicon binaries may have different UUIDs.
  • An exact public tag may appear after Apple ships the binary.
  • Verify released code, not only commit ancestry, because fixes can be cherry-picked.
Reference in new issue View Git Blame Copy Permalink