The PackageKit UpdateDetail signal provides markdown in the
`update_text` and uses remarkable to parse the markdown contents.
Remarkable however has not been updated since 6 years, additionally it
requires us to use `dangerouslySetInnerHTML` which can lead to XSS
issues.
The npm ecosystem has two other markdown alternatives `react-markdown`
and a `markdown-to-jsx`. The latter has zero dependencies while
`react-markdown` has eleven and requires additional plugins like
`rehype-external-links` to add a rel/target to external links.
https://www.freedesktop.org/software/PackageKit/gtk-doc/Transaction.htmlhttps://github.com/jonschlinkert/remarkable/issues/438
We're trying to get rid of this module and this is one of the last
users. It isn't really using anything from the module either, other
than the `api` GitHub instance (which it could easily create for itself
directly).
Let's use the GitHub methods directly for everything. One minor fix:
you close GitHub issues with PATCH, not POST.
The cockpit-wsinstance static user was replaced with DynamicUser in
version 330. Cleaning up the obsolete user on upgrade is no longer
necessary, as Debian stable already ships version 337. Drop both the
workaround and the adduser dependency.
Replace full LGPL/GPL/MIT/BSD license header with
SPDX-License-Identifier in all source files. This is more concise and
makes the license information machine readable.
Keep the full text of ISC for src/common/cockpitbase64.[hc], it's small
enough and only used in this pair of files. Also keep the CC-BY-SA
paragraph in pkg/storaged/icons/gnome-icons.jsx as explained in the
previous commit.
See https://reuse.software/spec-2.0/#2-include-a-copyright-notice-and-license-in-each-filehttps://issues.redhat.com/browse/COCKPIT-1742
The bridge, and also some parts of pkg/lib/ are GPL-3.0-and-later
licensed, not LGPL-2.1. At some point we should clean this up, but for
now accept the status quo and ship the GPL 3 text.
The four patternfly react-templates copies in pkg/lib are MIT licensed.
Rename/add them to "LICENSES/<spdx>.txt" as recommended by
https://reuse.software/spec-2.0/
Note: pkg/storaged/icons/gnome-icons.jsx is CC-BY-SA-3.0 licensed (or
LGPL-3.0). This does not have a canonical plaintext format, just the
webpage. So don't copy that, retaining the current license header in
that file is good enough.
Adjust the .spec accordingly.
This resulted in "License: ISC and MIT" for argparse, which is
confusing. Most packages in it are MIT, while
test/resolver/nested_symlinks/mylib/* is ISC.
Refine this by considering each directory with a package.json as a
separate ting initially, and then merging paths to into their parent
paragraph if they have the same license.
Assisted-by: Claude <noreply@anthropic.com>
Drop cockpithacks-glib by increasing our dependency to 2.68:
- the stderr logging hack was only needed before 2.67
- g_assert_no_error is available since 2.66
The oldest glib version we need to contend with is 2.68.4 on rhel-9-2,
so this should be fine.
Change a g_memdup() call to g_memdup2() to avoid a warning: the new API
is the same as the old one except that it takes `gsize` instead of
`guint`, avoiding integer overflow problems.
We used to need this as a runtime dependency when cockpit-ws contained
support for TLS, but since 198b48a3d2 ("ws: Drop TLS support") there
is no reason for it anymore.
We still need to leave it as a build-time dependency because our unit
tests use GIO as a TLS client.
This was meant to protect us from weird terminal-tampering effects of
npm and webpack but we don't use either of those as part of our build
process anymore. We can probably drop this by now.
Commit 5b5e29a6 (5 years ago, Cockpit 248) dropped that module and just
kept a stub as backwards compatibility, with warnings on upgrades. Let's
finally remove this. RHEL 9.0 shipped with Cockpit 264, so the real
module was never in there.
Users who still have that will now get a "no such module" in the journal
log, which is ok.
/usr/bin/asciidoctor does resolve when using dnf however under zypper
or subsequently building in obs this fails. It seems the more correct
way of handling this is through rubygem(asciidoctor) which works under
both package managers
zypper does not supported path based installing of packages but
`BuildRequires` does, circumventing unneeded churn of updating the spec
file for every new Ruby version
Tumbleweed is a rolling release distro so the Ruby dependency updates
every now and then. Zypper does not support path based BuildRequires
like dnf does.
Commit a30e928bdb broke the /devel scenario, as we always
rebuilt the bundle during RPM build. Change the spec to accept a
pre-defined `%{rebuild_bundle}`, and pass that from test/image-prepare.
Done automatically with `uscan --update-watchfile`.
Fixes lintian "older-debian-watch-file-standard 4" info.
lintian < 2.127.0 does not recognize this yet, so we have to ignore its
complaint on older Debian/Ubuntu releases.
esbuild on Debian's ppc64 keeps failing:
> TypeError: esbuild.context is not a function
> at build (file:///build/reproducible-path/cockpit-354/build.js:207:43)
But making these build dependencies architecture specific was bogus
anyway: These are only relevant for the "Architecture: all" packages,
which are built on amd64. The bundle builds are just thrown away on all
other architectures.
So make this explicit and correct, and declare these as
`Build-Depends-Indep:` instead.
With this we can get rid of asciidoc-py dependency altogether and
instead rely on the docs being prebundled before installation.
Include the built guide and manpages into the release tarball for that.
Fixes#22670https://issues.redhat.com/browse/COCKPIT-1370
Signed-off-by: Freya Gustavsson <freya@venefilyn.se>
Co-Authored-By: Martin Pitt <mpitt@redhat.com>
esbuild and nodejs are not available on the non-primary Debian
architectures, Restrict the build deps to the available architectures,
and keep the prebuilt dist/ for the others.
To get `make-sysext` to work with my system I need to add Bazzite here
to ensure it installs it correctly, otherwise it shows as unsupported
distro. Bazzite is built upon Fedora and is a bootc-based system.
We could do modifications here to look for `$ID_LIKE` instead, but for
now I just added Bazzite.
See-also: https://github.com/cockpit-project/cockpit/issues/22690
Signed-off-by: Freya Gustavsson <freya@venefilyn.se>
With the created AsciiDoc files for documentation we can now update our
build structure to generate the HTML and Manpage files both during build
and package distribution.
Changes
- Uses AsciiDoctor or asciidoc-py and a2x to generate HTML and Manpages.
- Generated HTML and Manpage files moved to `doc/output/`.
- Support packaging docs on all distributions Cockpit deploys to.
- Add package dependencies for AsciiDoctor and asciidoc-py.
- Safety fallback in automake file to search for either asciidoctor or
asciidoc-py in terms of priority.
Known issues
- Links in guide pages goes to new files for the pages themselves, which
meant we now generate HTML files for all `.adoc` files and not just
`index.html`.
With the removal of fonts we also managed to break the build pipeline
that automake generated for us. As the doc guide fonts make rule was
removed, which relied on `$(DIST_STAMP)` rule, automake optimized the
build process and in turn broke the workflow. As a workaround the
`$(DIST_STAMP)` rule was added to the index rule as a dep to help
automake generate it the way we want it.
As the workaround is a hack and not a real solution, this needs to be
fixed in another PR to make sure these dependency issues do not occur if
we were to remove `$(DIST_STAMP)` from a rule.
We also need the `$(DIST_STAMP)` to appear last in the doc generation or
something, likely race condition, may cause the `index.html` to only
contain `{}`.
Related-to: https://github.com/cockpit-project/cockpit/issues/22648
Related-to: https://github.com/cockpit-project/cockpit/issues/22647
Co-authored-by: Aleksandra Fedorova <afedorova@redhat.com>
Signed-off-by: Freya Gustavsson <freya@venefilyn.se>
Now that we ship the node modules tarball as part of the source, we need
to document its copyrights and licenses. Update
tools/build-debian-copyright to the version in cockpit-{files,podman}
(we can drop their copies and import from cockpit afterwards), and
adjust the copyright template accordingly: add missing licenses and
update the comment about `dist/`.
