prism.js - outdated, source-less binary

[onlyjob]

prism.js hasn't been touched since 2013 even though it is semantically versioned, well maintained library.

On top of that committed version is lacking source which is a serious breach of open source compliance because effectively minified code is equivalent of pre-compiled binary -- un-readable, non-modifiable and non-distributable in Debian.
It is a bad practice to commit binaries to VCS.

Please replace minified prism.js with original, uncompressed, up-to-date version.
I recommend using the following URL:

https://github.com/PrismJS/prism/raw/v1.15.0/prism.js

which I would note into prism.js.URL file to document file's origin.

Read more about pre-minified files here https://wiki.debian.org/onlyjob/no-minification

Thanks.

[koenpunt]

Not sure what you mean; but the prism.js file contains a license header, so I don't really see a problem there.

[onlyjob]

Availability of source code is a foundation of open source.
Here prism.js is provided only in compiled form, without source so license header is not good enough.

How do you know if prism.js hasn't been tampered with? It is not possible to re-build this file from source because source is missing...

Also it would be nice to update it to current version. Please? ;)

[koenpunt]

Availability of source code is a foundation of open source.

True, and we provide the source code of Chosen. But since we're not the author of Prism, and we're not distributing Prism itself as software, I believe we are free to use a minified version, as long as we mention the author/refer to the license.

It is not possible to re-build this file from source because source is missing...

Again, since we're not the author of Prism, there's no point in re-building the file. And if we want, we can always go to the source, and create a new minified version.

Also it would be nice to update it to current version. Please? ;)

Feel free to submit a PR! 😃

[onlyjob]

No it is not that simple. It is true that license pf Prism allows you to re-distribute binaries.
But it is good practice to distribute all binaries with source.

Your source distribution is incomplete without Prism source and obtaining correct source for this particular binary is not possible: its version is unknown and the librrary is so old that it pre-dates first Priism release. You can get the different version of the source but not for this particular binary.
You wouldn't be able to reproduceibly re-build the exact minifified binary which is committed to the source tree here.

Downstream we have a practical problem with open source compliance. We can't distribute source-less binaries at all. All sources must be included. How much it would affect chosen if Prism is entirely removed? It would at least break the examples but it is entirely avoidable if sources are provided.

I merely ask you to distribute Prism source. It is a small request and it appears to be easy enought to do. Also you can use the opportunity to upgrade very old library to the current version - isn't that enough as incentive of its own?

As for PR, I'll see what I can do but I'd rather trust maintainers of this repo to do necessary transitions...

Thanks.

[tjschuck]

@koenpunt This is just a dev/build dependency, and it's available on NPM. Should we just include it that way? Or is that more trouble than it's worth?

[onlyjob]

Removing prism.js is an option. Either way it should not be (re-)distributed in binary-only form.

Imagine a GNU/Linux distro shipping just binaries, claiming that sources used to build those binaries were once available in the internet... ;)

[koenpunt]

Imagine a GNU/Linux distro shipping just binaries, claiming that sources used to build those binaries were once available in the internet

I'm pretty sure there are binaries distributed in distro's, of which the source is not included. Of course this source is somewhere else available.

For that reason I think we can simple go with updating prism to a tagged version, and make sure that version is mentioned in the minified source.

Btw; why are you discussing prism, but not jQuery, of which we do not include the source either..

[tjschuck]

Hm, also, Prism isn't really a part of the source of Chosen at all — it's strictly for the Chosen website, and has nothing to do with Chosen-as-libary, per se. It's (correctly) not included in the pre-built distributions of Chosen, and isn't necessary for anyone to build Chosen from source themselves.

I'm now leaning towards just calling this a non-issue. We could potentially upgrade our version of Prism, and/or we could include it via NPM instead of vendoring it, but either of those would really be for the purposes of solving some actual problem for us. There's no OSS/distribution issue.

[koenpunt]

There's no OSS/distribution issue.

That's what I've been thinking too!

[onlyjob]

Guys, I'm disappointed with your response and resistance. Are you became so accustomed to bad practice and abuse of open source principles that it takes so much effort to deal with your denial of the issue?

If someone distributes source-less binaries it does not make it OK.

@koenpunt, could you please point out the exact commit where source of the prism.js file can be found (ideally accompanied by command to reproduce binary, identical to the committed one) before making a bald claim that the source is somewhere else? Where specifically? See?

It doesn't matter if source is available somewhere, unless it can be found but even if it can be found it is the best to provide complete sources. You can't rely on availability of source from some place else. What if source is no longe available there?

Using tagged version would be much better but please include the source as well. Alternatively (even better) you can just ship uncompressed version leaving minification to user.

If you distribute source-less jQuery then it is a problem too.
However I'm not concerned about jQuery as much as I'm concerned about prism.js.
Chosen has been incorporated into ZoneMinder which should comply with DFSG requirements. ZoneMinder ship its own version of jQuery (without reusing jQuery from Chosen) and only prism.js can not be (re-)distributed in its current state. Here is the right place to address the problem or prism.js would have to be removed downstream.

@tjschuck, thank you for clarifying that prism.js can be safely removed. I wasn't sure if it would be safe to drop it downstream.

Because of source-less files, OSS compliance is an issue to anyone who choses to incorporate source of this project into their distribution.

[onlyjob]

Correction: ZoneMinder incorporated Chosen with both minified and uncompressed jQuery.
Hence source-less jQuery is not currently a problem.

[koenpunt]

Are you became so accustomed to bad practice and abuse of open source principles that it takes so much effort to deal with your denial of the issue?

Being rude is not going to help anyone.

that the source is somewhere else? Where specifically? See?

If you'd read it correctly, you would know I was not talking about the source of prism, but about the source of certain binaries distributed with distros.

Hence I already suggested updating to a tagged version, to which source we then can refer to, if ever anyone has to.

But as @tjschuck mentioned, you won't be needing prism for the distribution, since it is only used for the html docs (that's why it lives in the docssupport folder).

[koenpunt]

But in terms of functionality I don't see any reason why we should update prism if the current one is working correctly.

[onlyjob]

Noted, prism.js is not required for normal functioning of Chosen. Thanks.

Updating libraries (even when they are not broken) is a normal dependency higiene - it just has to be done sometimes.
CHANGELOG might highlight some reasons for updating.
Fast forward to pick-up 5+ years of development and 600+ bugs fixed upstream.
What more incentive is needed to update unsupported library to its current version?
You can't even file a bug against that obsolete prism.js which is currently used...