Unsourced/undocumented libraries; missing license files; and other issues #1484

MTecknology · 2017-04-11T07:17:12Z

I noticed that there are some compiled javascript files that don't list an upstream source. I was able to find some in public/assets/librejs/librejs.html, but seem to be missing the following:

dropzone-4.2.0
jquery.datetimepicker-2.4.5
jquery.are-you-sure
pdfjs-1.4.20
codemirror-5.17.0
autolink.js
gitgraph
draw
font-awesome-4.6.3
octicons-4.3.0
public/less/?
public/../github-min.js?
public/themes/fonts?

Could we get librejs.html updated with this information, please? Also, if there have been any modifications of these files, have they been documented anywhere?

While I was looking through public/img/, I saw images such as slack.png, openid-x.png, and github.png that I would assume are proprietary and don't provide sources. The emoji/ directory also seems to have a large number of images that probably have sources that I missed.

I would like to locate a license grant for any proprietary images or see documentation pointing at the upstream source and license. Ideally, I'd like some script that could be used without requiring network access that can reproduce the images in public/img/.

In a perfect would, the packaging process would strip public/ and rebuild everything in it, but the above is a bare minimum if I have any hope of getting this into Debian.

Thanks!!

MTecknology · 2017-04-18T02:03:02Z

Beyond just complete documentation, this actually represents a license violation in it's current state... as do many vendor/ dependencies, but the latter has been resolved in downstreams.

MTecknology · 2017-04-18T02:03:18Z

Clicked the wrong comment button...

lofidevops · 2017-04-21T13:39:28Z

Report from LibreJS (Firefox extension) on try.gitea.io running v1.1.0:

List of accepted JavaScript in https://try.gitea.io/

This script is detected as free
https://try.gitea.io/js/libs/jquery.are-you-sure.js
This script is detected as free
https://try.gitea.io/js/libs/emojify-1.1.0.min.js
This script is detected as free
https://try.gitea.io/js/libs/clipboard-1.5.9.min.js

List of blocked JavaScript in https://try.gitea.io/

This script is detected as nonfree, external, and as defining functions or methods
https://try.gitea.io/js/libs/autolink.js
NONTRIVIAL: eval has been found in code
https://try.gitea.io/js/index.js?v=1ed9cef4e7846494bd7df1cc16ae65fc
NONTRIVIAL: Creates an xhr object
https://try.gitea.io/js/jquery-1.11.3.min.js
NONTRIVIAL: Creates an xhr object
https://try.gitea.io/js/semantic-2.2.1.min.js

Web Labels pages being used for this session

https://try.gitea.io/assets/librejs/librejs.html

bkcsoft · 2017-04-25T17:53:32Z

@MTecknology Sorry for the late response 🙂

WRT Logos

Slack: https://slack.com/brand-guidelines

You're entitled to say that your website or application is integrated with Slack (we like people integrating with Slack!), but please don't use the Slack marks as part of the name of your company, application, product, or service, or in any logo you create.

OpenID: http://openid.net/add-openid/logos/

for use in presentations, articles, blog posts, etc.

(It'd say this falls under "etc.")

GitHub: https://github.com/logos

Do these awesome things:

Use the Octocat or GitHub logo to advertise that your product has built-in GitHub integration

WRT sources

Ideally, I'd like some script that could be used without requiring network access that can reproduce the images in public/img/.

Not really possible without polluting the repo with providers tar-balls (not always available either...)
We can however add public/img/gitlab.png.LICENSE and friends if that would make it better.

The emoji/ directory also seems to have a large number of images that probably have sources that I missed.

EmojiOne, we move it to public/plugins/emojione-{{ .Version }} and add their LICENSE-file in there...

the packaging process would strip public/ and rebuild everything in it

This would requires internet-access and is not an option. There's a reason why we have vendor/ 😉

lunny · 2017-05-31T01:12:52Z

It seems some PR fix this issue?

bkcsoft · 2017-06-01T18:15:19Z

@lunny No, #1728 is something completely different.

MTecknology · 2017-07-04T07:00:14Z

I'm only just now hopping back into this issue (Debian 9 released)

The problem I see with the slack logo's Brand Guidelines is this:

By using the Slack marks you agree to follow these guidelines as well as our Terms of Service and all our rules and policies.

This seems pretty unambiguous to me... by using the logo, you agree to their Brand Guidelines, their Terms of Service, and whatever "rules and policies" means. I'd prefer see the logo swapped out for '#' until that wording is changed. The rest of their guidelines seem perfectly reasonable, but this seems very wrong.

As for the javascript stuff, I get the impression @kwill is more capable than me at digging into how we can correctly get only foss javascript libraries in place and correctly documented. Digging through js stuff like this is quite difficult for me, but I do have a few thoughts (finally)...

Stick all javascript in the public/js/ directory
Drop the public/js/libs/ sub-directory
Drop the version number from the filenames (big deal for off-line rebuild)
Build a "proper" file documenting sources and version numbers
[proper] don't know what that looks like, but machine/human readable would be excellent
Remove everything that can't be attributed (git logs show some stuff is original... let's say what is)
Same thing with assets, css, ... -pretty much- everything under public/

Not really possible without polluting the repo with providers tar-balls (not always available either...)
This would requires internet-access and is not an option. There's a reason why we have vendor/

I recall discussing w/ @bkcsoft, on IRC, what it means to build gitea without a network connection and without having vendor/ available. (Everything needs to come from a package already available in Debian.) At first, it meant ~100 golang libs needed to be added to the Debian repos (in the correct reverse dependency order...), now it means about 20 more javascript packages.

I'd like to get what's best and most correct figured out so I can beg someone to work on that while I learn how to package javascript libraries and then learn how correctly utilize those packages.

lofidevops · 2017-07-04T11:44:55Z

I don't actually know how, I just installed LibreJS in Firefox and recorded the results when visiting https://try.gitea.io :) I'll check if the listed libraries/files are already known to be free (I'm guessing they are).

bkcsoft · 2017-07-04T17:43:04Z

At first, it meant ~100 golang libs needed to be added to the Debian repos (in the correct reverse dependency order...), now it means about 20 more javascript packages.

Unless these have a separate package for each version that don't conflict with eachother you're gonna have a bad time.

Drop the version number from the filenames (big deal for off-line rebuild)

Build a "proper" file documenting sources and version numbers

machine/human readable

Remove everything that can't be attributed (git logs show some stuff is original... let's say what is)

Same thing with assets, css, ... -pretty much- everything under public/

This can mostly be addressed by using npm/yarn (just like we use govendor for go deps). The only thing we might have issues with is figuring out what we're actually using, and which version of it we're using.

As for the Slack-logo, I think we can just replace all mentions of "Slack" with "Mattermost" TBH, since the API for Mattermost is a superset of Slacks API.

bkcsoft · 2017-07-04T17:45:22Z

Drop the public/js/libs/ sub-directory

This is generally a bad idea, since now you have to manually figure out what is vendored and what is original content. From a PMs point-of-view I'd prefer to have js/libs since then I could just rm -rf public/js/libs and go with that.

Packaging JS-libs separately is going to break though ~~unless you create symlinks all over the place...~~ that's gonna break too since the webserver isn't going to allow following symlinks 😒

MTecknology · 2017-07-30T06:42:29Z

How about ...?

public/
  css/
  js/
  img/
  ^-- custom stuff covered under 
vendor/
  vendor.json
  ^- upstream location, packaged version (or date + git tag)
  less/
  img/
    emoji/
  js/
    autolink.js
    clipboard.min.js
    emojify.min.js
    semantic.min.js
    ^- no version numbers in file names
  plugins/

Then I get to exclude only public/vendor/ and rebuild it during the build process, which lets me make sure the package meets DFSG. If I can check off that box, then #1524 can get a push in the right direction, and we'd be that much closer to closing #31 and #122.

MTecknology · 2017-08-01T06:02:55Z

@kwill I did a bit of a rework, as earlier described. I'm struggling to figure out why librejs isn't detecting some scripts like highlight.pack.js and gitgraph aren't being detected as free despite being in librejs.html. I have my copy currently hosted at http://tempgit.lustfield.net:3000/mike/test/graph. Beyond that, it seems like the new structure and update of public/ manages to resolve this issue as well as C0.0 of #1534.

) (#2241) * Cleaning up public/ and documenting js/css libs. This commit mostly addresses #1484 by moving vendor'ed plugins into a vendor/ directory and documenting their upstream source and license in vendor/librejs.html. This also proves gitea is using only open source js/css libraries which helps toward reaching #1524. * Removing unused css file. The version of this file in use is located at: vendor/plugins/highlight/github.css * Cleaned up librejs.html and added javascript header A SafeJS function was added to templates/helper.go to allow keeping comments inside of javascript. A javascript comment was added in the header of templates/base/head.tmpl to mark all non-inline source as free. The librejs.html file was updated to meet the current librejs spec. I have now verified that the librejs plugin detects most of the scripts included in gitea and suspect the non-free detections are the result of a bug in the plugin. I believe this commit is enough to meet the C0.0 requirement of #1534. * Updating SafeJS function per lint suggestion * Added VERSIONS file, per request

strk · 2017-08-23T22:28:46Z

Still to be ported to 1.2 branch (before it is finalized)

MTecknology · 2017-08-23T23:50:22Z

After PR #2374, if there are no other issues from PR #2375, I will create a PR to cherry-pick these changes.

This commit cherry picks the following commits (master -> v1.2): a915a09 874f9be 233bbcf Ref: #1484 Signed-off-by: Michael Lustfield <michael@lustfield.net>

lofidevops · 2017-10-31T12:06:49Z

Long overdue test results running LibreJS on Gitea Version d545e32 try.gitea.io. Success:

List of accepted JavaScript in https://try.gitea.io/

    This script is detected as free
    https://try.gitea.io/vendor/plugins/cssrelpreload/loadCSS.min.js
    This script is detected as free
    https://try.gitea.io/vendor/plugins/cssrelpreload/cssrelpreload.min.js
    This script is detected as free
    https://try.gitea.io/vendor/plugins/jquery/jquery.min.js
    This script is detected as free
    https://try.gitea.io/vendor/plugins/jquery.areyousure/jquery.are-you-sure.js
    This script is detected as free
    https://try.gitea.io/vendor/plugins/autolink/autolink.js
    This script is detected as free
    https://try.gitea.io/vendor/plugins/emojify/emojify.min.js
    This script is detected as free
    https://try.gitea.io/vendor/plugins/clipboard/clipboard.min.js
    This script is detected as free
    https://try.gitea.io/vendor/plugins/vue/vue.min.js
    This script is detected as free
    https://try.gitea.io/vendor/plugins/semantic/semantic.min.js

    Script appears to be free under the following license: Expat License (sometimes called MIT Licensed)

    	/*
    	@licstart  The following is the entire license notice for the
            JavaScript code in this page.

    	Copyright (c) 2016 The Gitea Authors
    	Copyright (c) 2015 The Gogs Authors

    	Permission is hereby granted, free of charge, to any person obtaining a copy
    	of this software and associated documentation files (the "Software"), to deal
    	in the Software without restriction, including without limitation the rights
    	to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
    	copies of the Software, and to permit persons to whom the Software is
    	furnished to do so, subject to the following conditions:

    	The above copyright notice and this permission notice shall be included in
    	all copies or substantial portions of the Software.

    	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
    	IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    	FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
    	AUTHORS OR COPYRIGH…

    Script appears to be free under the following license: Expat License (sometimes called MIT Licensed) -- This script is trivial
    [{"attribute":"onload","value":"this.rel='stylesheet'"}]

    This script is free according to a JS Web Labels page visited recently (at https://try.gitea.io/vendor/librejs.html# )
    https://try.gitea.io/js/index.js?v=d3c4579ed0a3d20038d5e2ff5d1251c2

List of blocked JavaScript in https://try.gitea.io/

    LibreJS did not block any scripts on this page:
        There may be no scripts on this page (check source, C-u).
        All the scripts on this page may be trivial and/or free.
        You may have whitelisted this domain name or url from the preferences (Type about:addons in your location bar to check)
        You may have clicked the "allow all scripts" button, which causes LibreJS to load all JavaScript on a page regardless of whether it is free, trivial, nontrivial or nonfree. This policy is effective for the entire duration of a Firefox session.
        If for any reason you think LibreJS should have blocked JavaScript code on this page, please report this issue to: bug-librejs@gnu.org

Web Labels pages being used for this session

    https://try.gitea.io/vendor/librejs.html

lunny added the type/docs This PR mainly updates/creates documentation label Apr 11, 2017

MTecknology changed the title ~~Unsourced JS libraries and other files~~ Unsourced JS libraries and missing license Apr 12, 2017

MTecknology closed this as completed Apr 18, 2017

MTecknology reopened this Apr 18, 2017

strk mentioned this issue Apr 20, 2017

Achieve at least a "C" on GNU ethical repository criteria #1524

Closed

9 tasks

strk mentioned this issue May 28, 2017

Fix FOUC on Firefox #1728

Merged

MTecknology mentioned this issue Jul 4, 2017

Provide releases and deb/rpm packages via Bintray #31

Closed

MTecknology changed the title ~~Unsourced JS libraries and missing license~~ Unsourced/undocumented libraries; missing license files; and other issues Jul 31, 2017

MTecknology mentioned this issue Jul 31, 2017

Added vendor dir for js/css libs; Documented sources (#1484) #2241

Merged

bkcsoft closed this as completed in #2241 Aug 23, 2017

MTecknology mentioned this issue Aug 24, 2017

Move 3rd party js/css into public/vendor and document sources #2383

Merged

go-gitea locked and limited conversation to collaborators Nov 23, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Unsourced/undocumented libraries; missing license files; and other issues #1484

Unsourced/undocumented libraries; missing license files; and other issues #1484

MTecknology commented Apr 11, 2017 •

edited

Loading

MTecknology commented Apr 18, 2017

MTecknology commented Apr 18, 2017

lofidevops commented Apr 21, 2017

bkcsoft commented Apr 25, 2017

Do these awesome things:

lunny commented May 31, 2017

bkcsoft commented Jun 1, 2017

MTecknology commented Jul 4, 2017 •

edited

Loading

lofidevops commented Jul 4, 2017

bkcsoft commented Jul 4, 2017 •

edited

Loading

bkcsoft commented Jul 4, 2017 •

edited

Loading

MTecknology commented Jul 30, 2017 •

edited

Loading

MTecknology commented Aug 1, 2017 •

edited

Loading

strk commented Aug 23, 2017 via email

MTecknology commented Aug 23, 2017

lofidevops commented Oct 31, 2017

Unsourced/undocumented libraries; missing license files; and other issues #1484

Unsourced/undocumented libraries; missing license files; and other issues #1484

Comments

MTecknology commented Apr 11, 2017 • edited Loading

MTecknology commented Apr 18, 2017

MTecknology commented Apr 18, 2017

lofidevops commented Apr 21, 2017

bkcsoft commented Apr 25, 2017

WRT Logos

Slack: https://slack.com/brand-guidelines

OpenID: http://openid.net/add-openid/logos/

GitHub: https://github.com/logos

Do these awesome things:

WRT sources

lunny commented May 31, 2017

bkcsoft commented Jun 1, 2017

MTecknology commented Jul 4, 2017 • edited Loading

lofidevops commented Jul 4, 2017

bkcsoft commented Jul 4, 2017 • edited Loading

bkcsoft commented Jul 4, 2017 • edited Loading

MTecknology commented Jul 30, 2017 • edited Loading

MTecknology commented Aug 1, 2017 • edited Loading

strk commented Aug 23, 2017 via email

MTecknology commented Aug 23, 2017

lofidevops commented Oct 31, 2017

MTecknology commented Apr 11, 2017 •

edited

Loading

MTecknology commented Jul 4, 2017 •

edited

Loading

bkcsoft commented Jul 4, 2017 •

edited

Loading

bkcsoft commented Jul 4, 2017 •

edited

Loading

MTecknology commented Jul 30, 2017 •

edited

Loading

MTecknology commented Aug 1, 2017 •

edited

Loading