search

rust-lang / mdBook

Create book from markdown files. Like Gitbook but implemented in Rust
https://rust-lang.github.io/mdBook/
Mozilla Public License 2.0
17.74k stars 1.61k forks source link

Replacing playpen_editor with a placeholder #495

Open infinity0 opened 6 years ago

infinity0 commented 6 years ago

Hi, version 0.0.26 of this package is included in the rust 1.22.1 release, and I'm packaging this for Debian.

Unfortunately it contains a lot of pre-built javascript files which I can't easily verify are FOSS. So I have to get rid of them. That is relatively straightforward to do, however as a courtesy for users I thought it would be nice to add a placeholder informing them that the playpen_editor functionality is not available in Debian. What would be the easiest way to do that?

steveklabnik commented 6 years ago

Sounds like we should fix this by being clearer about their licenses:

I believe that covers everything that's vendored.

infinity0 commented 6 years ago

It's not a licensing issue, it's the fact that those files are not source code ("preferred form of modification") in the first place. We don't include binary blobs in Debian on principle; declaring binary blobs as distributable under some particular FOSS license is missing the point of having free source code.

What normally happens is we remove the binary blobs, find their source code, and package them separately building them from scratch. This way, it's very clear that the binary blobs are built from particular source code. jquery and highlightjs are already in Debian in this way, so mdbook in Debian can symlink to these instead of embedding them.

However the other packages aren't in Debian, and nobody is likely to have the time to add them to Debian, so my only option is to remove them completely.

steveklabnik commented 6 years ago

Javascript souce files aren't source code? I've historically used debian, but not dug into its policies. That seems strange though.

steveklabnik commented 6 years ago

Okay, so I've read the relevant policies. I'm admittedly quite frustrated by them, but such is life.

I care about my users, I want them to have this functionality. Is there a way we can make this work without turning this stuff off? Does the source for these libraries have to be debian packages, or if I add a minification step in, is that acceptable?

Manishearth commented 6 years ago

However the other packages aren't in Debian, and nobody is likely to have the time to add them to Debian, so my only option is to remove them completely.

Can we vendor these scripts in tree along with a bash script for minification; and have the Debian package -- only the debian package -- use that script?

Michael-F-Bryan commented 6 years ago

Would a suitable alternative be to have both the source and minified versions side-by-side in the repository? That way we're still distributing the original source code and anyone who wants to can read/hack on that, while still using the minified versions to decrease the number of bytes transferred across the network.

Manishearth commented 6 years ago

I think that's not enough -- I can't verify this myself but I think they want it to be part of the build system so if there are any vulns or bugfixes they can be ported with no manual intervention.

infinity0 commented 6 years ago

Javascript souce files aren't source code?

The definition of source code we (and others) use is "preferred form of modification"; the point is to allow easy exercise of the "four freedoms of FOSS". Javascript minified code is about as easily-modifiable as assembly code so unfortunately we can't just include it as-is - if minified javascript code were acceptable as "source" then the same argument could be made for assembly.

have both the source and minified versions side-by-side

Having the source code next to the binary (js) code also isn't good enough because it's not a sufficient-enough guarantee that the binary code is actually built from the source code. The process has to be transparent.

Can we vendor these scripts in tree along with a bash script for minification; and have the Debian package -- only the debian package -- use that script?

That could work in theory yes, but this has to apply to all transitive dependencies so I didn't try it, because I guessed that it would be too much effort, and/or you would end up having to vendor half of the NPM ecosystem. (NPM does not re-build transitive dependencies, it just reuses whatever binary JS was uploaded to their repositories by the developer.)

infinity0 commented 6 years ago

The NPM ecosystem in general is not very easily adaptable to Debian and I gave up trying to do this a while ago. It's not a great situation I know, we just try to live with it the best we can. Sometimes, certain things can be packaged but it's an effort every time and I can't keep this up.

est31 commented 6 years ago

I would agree to working on a "reduced JS" mode where only a subset of the features are implemented or are implemented in non-js ways, if maintainers agree.

hnakamur commented 5 years ago

Hi, I sent merge requests to update the debian rustc package to 1.33.0 and I'm trying to package rustc 1.34.0 now and found this issue. I'd like to use full capability of this crate if possible.

Here are JavaScript and CSS files in commit cb94053779eb1c01367adf17b236eec0d59e9012

JavaScript files

CSS files

Could you tell me where I can get human editable source code for the following files?

As for bundler and minifier, how about using the following crates written in rust?

infinity0 commented 5 years ago

Minifiers and bundlers aren't appropriate for Debian.

shilangyu commented 4 years ago

So currently there is no way to minify the generated files with mdbook?