Replacing playpen_editor with a placeholder

[infinity0]

Hi, version 0.0.26 of this package is included in the rust 1.22.1 release, and I'm packaging this for Debian.

Unfortunately it contains a lot of pre-built javascript files which I can't easily verify are FOSS. So I have to get rid of them. That is relatively straightforward to do, however as a courtesy for users I thought it would be nice to add a placeholder informing them that the playpen_editor functionality is not available in Debian. What would be the easiest way to do that?

[steveklabnik]

Sounds like we should fix this by being clearer about their licenses:

• store.js: MIT
• jquery: MIT
• highlight.js: BSD 3-clause
• clipboard.js: MIT
• ace editor: BSD 3-clause

I believe that covers everything that's vendored.

[infinity0]

It's not a licensing issue, it's the fact that those files are not source code ("preferred form of modification") in the first place. We don't include binary blobs in Debian on principle; declaring binary blobs as distributable under some particular FOSS license is missing the point of having free source code.

What normally happens is we remove the binary blobs, find their source code, and package them separately building them from scratch. This way, it's very clear that the binary blobs are built from particular source code. jquery and highlightjs are already in Debian in this way, so mdbook in Debian can symlink to these instead of embedding them.

However the other packages aren't in Debian, and nobody is likely to have the time to add them to Debian, so my only option is to remove them completely.

[steveklabnik]

Javascript souce files aren't source code? I've historically used debian, but not dug into its policies. That seems strange though.

[steveklabnik]

Okay, so I've read the relevant policies. I'm admittedly quite frustrated by them, but such is life.

I care about my users, I want them to have this functionality. Is there a way we can make this work without turning this stuff off? Does the source for these libraries have to be debian packages, or if I add a minification step in, is that acceptable?

[Manishearth]

However the other packages aren't in Debian, and nobody is likely to have the time to add them to Debian, so my only option is to remove them completely.

Can we vendor these scripts in tree along with a bash script for minification; and have the Debian package -- only the debian package -- use that script?

[Michael-F-Bryan]

Would a suitable alternative be to have both the source and minified versions side-by-side in the repository? That way we're still distributing the original source code and anyone who wants to can read/hack on that, while still using the minified versions to decrease the number of bytes transferred across the network.

[Manishearth]

I think that's not enough -- I can't verify this myself but I think they want it to be part of the build system so if there are any vulns or bugfixes they can be ported with no manual intervention.

[infinity0]

Javascript souce files aren't source code?

The definition of source code we (and others) use is "preferred form of modification"; the point is to allow easy exercise of the "four freedoms of FOSS". Javascript minified code is about as easily-modifiable as assembly code so unfortunately we can't just include it as-is - if minified javascript code were acceptable as "source" then the same argument could be made for assembly.

have both the source and minified versions side-by-side

Having the source code next to the binary (js) code also isn't good enough because it's not a sufficient-enough guarantee that the binary code is actually built from the source code. The process has to be transparent.

Can we vendor these scripts in tree along with a bash script for minification; and have the Debian package -- only the debian package -- use that script?

That could work in theory yes, but this has to apply to all transitive dependencies so I didn't try it, because I guessed that it would be too much effort, and/or you would end up having to vendor half of the NPM ecosystem. (NPM does not re-build transitive dependencies, it just reuses whatever binary JS was uploaded to their repositories by the developer.)

[infinity0]

The NPM ecosystem in general is not very easily adaptable to Debian and I gave up trying to do this a while ago. It's not a great situation I know, we just try to live with it the best we can. Sometimes, certain things can be packaged but it's an effort every time and I can't keep this up.

[est31]

I would agree to working on a "reduced JS" mode where only a subset of the features are implemented or are implemented in non-js ways, if maintainers agree.

[hnakamur]

Hi, I sent merge requests to update the debian rustc package to 1.33.0 and I'm trying to package rustc 1.34.0 now and found this issue. I'd like to use full capability of this crate if possible.

Here are JavaScript and CSS files in commit cb94053

JavaScript files

• ./src/theme/playpen_editor/mode-rust.js

  • minified, no source?

• ./src/theme/playpen_editor/ace.js

  • minified, https://github.com/ajaxorg/ace, which version?

• ./src/theme/playpen_editor/theme-tomorrow_night.js

  • minified, no source?

• ./src/theme/playpen_editor/editor.js

  • human editable source

• ./src/theme/playpen_editor/theme-dawn.js

  • minified, no source?

• ./src/theme/highlight.js

  • minified, https://github.com/highlightjs/highlight.js v9.12.0

• ./src/theme/searcher/mark.min.js

  • minified, https://github.com/julmot/mark.js v8.11.1

• ./src/theme/searcher/elasticlunr.min.js

  • minified, https://github.com/weixsong/elasticlunr.js 0.9.5

• ./src/theme/searcher/searcher.js

  • human editable source

• ./src/theme/clipboard.min.js

  • minified, https://zenorocha.github.io/clipboard.js v1.6.1

• ./src/theme/book.js

  • human editable source

CSS files

• ./src/theme/tomorrow-night.css

  • human editable source

• ./src/theme/highlight.css

  • human editable source

• ./src/theme/css/general.css

  • human editable source

• ./src/theme/css/print.css

  • human editable source

• ./src/theme/css/variables.css

  • human editable source

• ./src/theme/css/chrome.css

  • human editable source

• ./src/theme/ayu-highlight.css

  • human editable source

• ./src/theme/FontAwesome/css/font-awesome.min.css

  • minified, https://github.com/FortAwesome/Font-Awesome 4.7.0

Could you tell me where I can get human editable source code for the following files?

• ./src/theme/playpen_editor/mode-rust.js
• ./src/theme/playpen_editor/theme-tomorrow_night.js
• ./src/theme/playpen_editor/editor.js
• ./src/theme/playpen_editor/theme-dawn.js

As for bundler and minifier, how about using the following crates written in rust?

• bundler: https://github.com/nathan/pax
• minifier: https://github.com/GuillaumeGomez/minifier-rs
  • There is a warning in README about this crate is at a very early stage of development, but I can minify https://github.com/FortAwesome/Font-Awesome/blob/v4.7.0/css/font-awesome.css successfully. The output is different from https://github.com/FortAwesome/Font-Awesome/blob/v4.7.0/css/font-awesome.min.css, but I think it will do.

[infinity0]

Minifiers and bundlers aren't appropriate for Debian.

[shilangyu]

So currently there is no way to minify the generated files with mdbook?