Unsourced/undocumented libraries; missing license files; and other issues

[MTecknology]

I noticed that there are some compiled javascript files that don't list an upstream source. I was able to find some in public/assets/librejs/librejs.html, but seem to be missing the following:

dropzone-4.2.0
jquery.datetimepicker-2.4.5
jquery.are-you-sure
pdfjs-1.4.20
codemirror-5.17.0
autolink.js
gitgraph
draw
font-awesome-4.6.3
octicons-4.3.0
public/less/?
public/../github-min.js?
public/themes/fonts?

Could we get librejs.html updated with this information, please? Also, if there have been any modifications of these files, have they been documented anywhere?

While I was looking through public/img/, I saw images such as slack.png, openid-x.png, and github.png that I would assume are proprietary and don't provide sources. The emoji/ directory also seems to have a large number of images that probably have sources that I missed.

I would like to locate a license grant for any proprietary images or see documentation pointing at the upstream source and license. Ideally, I'd like some script that could be used without requiring network access that can reproduce the images in public/img/.

In a perfect would, the packaging process would strip public/ and rebuild everything in it, but the above is a bare minimum if I have any hope of getting this into Debian.

Thanks!!

[MTecknology]

Beyond just complete documentation, this actually represents a license violation in it's current state... as do many vendor/ dependencies, but the latter has been resolved in downstreams.

[MTecknology]

Clicked the wrong comment button...

[lofidevops]

Report from LibreJS (Firefox extension) on try.gitea.io running v1.1.0:

List of accepted JavaScript in https://try.gitea.io/

This script is detected as free
https://try.gitea.io/js/libs/jquery.are-you-sure.js
This script is detected as free
https://try.gitea.io/js/libs/emojify-1.1.0.min.js
This script is detected as free
https://try.gitea.io/js/libs/clipboard-1.5.9.min.js

List of blocked JavaScript in https://try.gitea.io/

This script is detected as nonfree, external, and as defining functions or methods
https://try.gitea.io/js/libs/autolink.js
NONTRIVIAL: eval has been found in code
https://try.gitea.io/js/index.js?v=1ed9cef4e7846494bd7df1cc16ae65fc
NONTRIVIAL: Creates an xhr object
https://try.gitea.io/js/jquery-1.11.3.min.js
NONTRIVIAL: Creates an xhr object
https://try.gitea.io/js/semantic-2.2.1.min.js

Web Labels pages being used for this session

https://try.gitea.io/assets/librejs/librejs.html

[bkcsoft]

@MTecknology Sorry for the late response 🙂

WRT Logos

Slack: https://slack.com/brand-guidelines

You're entitled to say that your website or application is integrated with Slack (we like people integrating with Slack!), but please don't use the Slack marks as part of the name of your company, application, product, or service, or in any logo you create.

OpenID: http://openid.net/add-openid/logos/

for use in presentations, articles, blog posts, etc.

(It'd say this falls under "etc.")

GitHub: https://github.com/logos

Do these awesome things:

Use the Octocat or GitHub logo to advertise that your product has built-in GitHub integration

WRT sources

Ideally, I'd like some script that could be used without requiring network access that can reproduce the images in public/img/.

Not really possible without polluting the repo with providers tar-balls (not always available either...)
We can however add public/img/gitlab.png.LICENSE and friends if that would make it better.

The emoji/ directory also seems to have a large number of images that probably have sources that I missed.

EmojiOne, we move it to public/plugins/emojione-{{ .Version }} and add their LICENSE-file in there...

the packaging process would strip public/ and rebuild everything in it

This would requires internet-access and is not an option. There's a reason why we have vendor/ 😉

[lunny]

It seems some PR fix this issue?

[bkcsoft]

@lunny No, #1728 is something completely different.

[MTecknology]

I'm only just now hopping back into this issue (Debian 9 released)

The problem I see with the slack logo's Brand Guidelines is this:

By using the Slack marks you agree to follow these guidelines as well as our Terms of Service and all our rules and policies.

This seems pretty unambiguous to me... by using the logo, you agree to their Brand Guidelines, their Terms of Service, and whatever "rules and policies" means. I'd prefer see the logo swapped out for '#' until that wording is changed. The rest of their guidelines seem perfectly reasonable, but this seems very wrong.

As for the javascript stuff, I get the impression @kwill is more capable than me at digging into how we can correctly get only foss javascript libraries in place and correctly documented. Digging through js stuff like this is quite difficult for me, but I do have a few thoughts (finally)...

• Stick all javascript in the public/js/ directory
• Drop the public/js/libs/ sub-directory
• Drop the version number from the filenames (big deal for off-line rebuild)
• Build a "proper" file documenting sources and version numbers
• [proper] don't know what that looks like, but machine/human readable would be excellent
• Remove everything that can't be attributed (git logs show some stuff is original... let's say what is)
• Same thing with assets, css, ... -pretty much- everything under public/

Not really possible without polluting the repo with providers tar-balls (not always available either...)
This would requires internet-access and is not an option. There's a reason why we have vendor/

I recall discussing w/ @bkcsoft, on IRC, what it means to build gitea without a network connection and without having vendor/ available. (Everything needs to come from a package already available in Debian.) At first, it meant ~100 golang libs needed to be added to the Debian repos (in the correct reverse dependency order...), now it means about 20 more javascript packages.

I'd like to get what's best and most correct figured out so I can beg someone to work on that while I learn how to package javascript libraries and then learn how correctly utilize those packages.

[lofidevops]

I don't actually know how, I just installed LibreJS in Firefox and recorded the results when visiting https://try.gitea.io :) I'll check if the listed libraries/files are already known to be free (I'm guessing they are).