Add LibreJS support

[ghost]

Since Etherpad is free software, it should be labelled as such.

Making it compatible with LibreJS would be a good way to do it, all it needs to be done is add some magnet links (paragraph 3.2.2.1) pointing to the correct license.

[jdittrich]

I did not know what LibreJS is, so for the ones that might work on this issue (or not): LibreJS

• defines a way to tell that your javascript(s) are free software.
• Provides an extension for firefox that blocks scripts that do not tell that extension that the code is free.

If you use the extensions, many websites will break, since they rely on non-free libraries (It would not break an etherpad installation, I assume, since etherpad code is free. However, this might not be the case for all addons, which could cause problems again)

[JohnMcLear]

It's low priority right now

[ghost]

This has been requested by rms.

Something you'd consider in a PR?

[JohnMcLear]

The reason it's tricky is because we minify and compress all javascript then load it using a require-esque style method.. I'd consider a PR for it if you can get it and then get RMS to bump me to merge it.

[ghost]

Can't a line just be added to the minified version in order to make it compliant? They did it both on the Wikipedia and FSFE instance.

[JohnMcLear]

Go for it but you are making the assumption the code is delivered minified (which it should be) however if the instance is not minifying (due to be being in develop mode) this wont be the case.

[ghost]

What minifier do you use to build the minified version of Etherpad by default?

[JohnMcLear]

I think yasjml does it but it's been a while since I took a look

[ghost]

OK, rather than mess with the JS I think it's best to modify the HTML templates directly.

Edit: Done, posted a PR at #3059

[JohnMcLear]

The only thing that's not clear is what if third party plugins are loaded?

Also why the link to third party files and not locally hosted? If the instance was run locally (not online) then access the license files would fail. I recommend including them(the licenses).

J

[ghost]

All the files that would need to be modified are here. In short:

/static/js/jquery-2.1.1.min.js
/static/js/jquery.js
/static/js/html10n.js
/static/js/l10n.js
/static/js/socket.io.js
/static/js/require-kernel.js
/static/custom/index.js
/static/custom/timeslider.js
/static/custom/pad.js
/static/js/admin/plugins.js
/static/js/admin/minify.json.js
/static/js/admin/settings.js
/static/js/admin/jquery.autosize.js

The change required for each JS file is pretty small:

// @license magnet:?xt=urn:btih:8e4f440f4c65981c5bf93c76d35135ba5064d8b7&dn=apache-2.0.txt
// All code
// @license-end

Third party scripts would of course need to have the same stuff on them, but that goes beyond what you can do (since those fall under the of responsibility of their respective authors).

I did not link to third party files in my PR - external links point to the licenses, which LibreJS needs. All links to Etherpad script are local.

The only issue with modifying the JS files directly is that when a library like Socket.IO is updated, it's easy to forget about @license and @license-end but of course, we could make a Makefile target to do that automatically.

Do you want me to change #3059 to use comments like I showed you above instead an external HTML page?

[JohnMcLear]

Yes please :) I worry about the external page being unreliable or exploited etc. torrents/magnet tracker should in theory be more reliable.

[ghost]

The problem with doing external JS files is that some (like socket.io.js and require-kernel.js) are downloaded by NPM separately from the repo, so the licensing info can't be applied to them directly.

The only way to get around this would be to set up a "postinstall" NPM script as explained here. I never tried it though, but it should work. Do you want me to go ahead with it?

(Side note, the HTML page is 100% static and cannot be exploited)

Edit: I ran some tests from LibreJS' own fixtures and the magnet link method does not work for external scripts, each of them needs the entire license notice. That's a lot of extra bandwidth needed to deliver the same scripts! I now suggest the HTML method is used instead.