bug#15549: hydra.gnu.org uses nontrivial and nonfree javascript

bug#15549: hydra.gnu.org uses nontrivial and nonfree javascript

[christophe.jarry]

Hello,

If I go to http://hydra.gnu.org/jobset/gnu/master with Firefox, addon
GNU LibreJS 5.4 [1] reports this:

    List of accepted JavaScript in
    http://hydra.gnu.org/jobset/gnu/master

    this script has been tagged as free software by LibreJS authors:
    http://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js


    List of blocked JavaScript in
    http://hydra.gnu.org/jobset/gnu/master

    NONTRIVIAL: eval has been found in code:
    http://ajax.googleapis.com/ajax/libs/jqueryui/1.10.1/jquery-ui.min.js

    NONTRIVIAL: eval has been found in code:
    http://hydra.gnu.org/static/bootstrap/js/bootstrap.min.js

    This script is detected as nonfree, external, and as defining
    functions or methods:
    http://hydra.gnu.org/static/js/bootbox.min.js

    This script is detected as nonfree, external, and as defining
    functions or methods:
    http://hydra.gnu.org/static/js/common.js

    This script is detected as inline, nonfree, defining functions or
    methods, and the rest of the page as loading external scripts:
        $(function() { makeLazyTab("tabs-jobs",
"http://hydra.gnu.org/jobset/gnu/master/jobs-tab"); });

Is it possible to use only free javascript for this page?

[1] http://www.gnu.org/software/librejs

Christophe

bug#15549: hydra.gnu.org uses nontrivial and nonfree javascript

[Ludovic Courtès]

Hi,

christophe.jarry@ouvaton.org skribis:

> If I go to http://hydra.gnu.org/jobset/gnu/master with Firefox, addon
> GNU LibreJS 5.4 [1] reports this:

Thanks for the report!

>     List of accepted JavaScript in
>     http://hydra.gnu.org/jobset/gnu/master
>
>     this script has been tagged as free software by LibreJS authors:
>     http://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
>
>
>     List of blocked JavaScript in
>     http://hydra.gnu.org/jobset/gnu/master
>
>     NONTRIVIAL: eval has been found in code:
>     http://ajax.googleapis.com/ajax/libs/jqueryui/1.10.1/jquery-ui.min.js

So jquery itself is free, but since it’s using ‘eval’ it might be
evaluating third-party non-free code, is that right?

>     NONTRIVIAL: eval has been found in code:
>     http://hydra.gnu.org/static/bootstrap/js/bootstrap.min.js

Same here.

>     This script is detected as nonfree, external, and as defining
>     functions or methods:
>     http://hydra.gnu.org/static/js/bootbox.min.js

That file points to http://bootboxjs.com/license.txt, which is the
MIT/X11 license.

So do I get it right that it’s just a matter of letting LibreJS know
about it?

>     This script is detected as nonfree, external, and as defining
>     functions or methods:
>     http://hydra.gnu.org/static/js/common.js

That file is actually part of Hydra, which is GPLv3+:

  https://github.com/NixOS/hydra/blob/master/src/root/static/js/common.js

>     This script is detected as inline, nonfree, defining functions or
>     methods, and the rest of the page as loading external scripts:
>         $(function() { makeLazyTab("tabs-jobs",
> "http://hydra.gnu.org/jobset/gnu/master/jobs-tab"); });

This comes from Hydra’s source:

  https://github.com/NixOS/hydra/blob/master/src/root/jobset.tt

> Is it possible to use only free javascript for this page?

AFAICS it’s actually the case.  However, all this lacks the right tags
for LibreJS to recognize it.

Could you tell us what’s needed to make it work?

I can then submit a patch for Hydra itself.  It would be neat if someone
else would submit the JQuery/Bootstrap parts, though.

Thanks,
Ludo’.

bug#15549: hydra.gnu.org uses nontrivial and nonfree javascript

[Ricardo Wurmus]

Ludovic Courtès <ludo@gnu.org> writes:

> AFAICS it’s actually the case.  However, all this lacks the right tags
> for LibreJS to recognize it.
>
> Could you tell us what’s needed to make it work?
>
> I can then submit a patch for Hydra itself.  It would be neat if someone
> else would submit the JQuery/Bootstrap parts, though.

Has our version of hydra diverged from upstream, or are we just using an
old version?

We need to add license comments to the JavaScript files and to
non-trivial embedded script blocks.

I would like to do this, but I don’t know where the code is that I
should edit, or if this should just be done on our single
soon-to-be-obsolete hydra.gnu.org instance.

--
Ricardo

GPG: BCA6 89B6 3655 3801 C3C6  2150 197A 5888 235F ACAC
https://elephly.net

bug#15549: hydra.gnu.org uses nontrivial and nonfree javascript

[Ludovic Courtès]

Ricardo Wurmus <rekado@elephly.net> skribis:

> Ludovic Courtès <ludo@gnu.org> writes:
>
>> AFAICS it’s actually the case.  However, all this lacks the right tags
>> for LibreJS to recognize it.
>>
>> Could you tell us what’s needed to make it work?
>>
>> I can then submit a patch for Hydra itself.  It would be neat if someone
>> else would submit the JQuery/Bootstrap parts, though.
>
> Has our version of hydra diverged from upstream, or are we just using an
> old version?

We run an old and slightly modified version of Hydra.  (Unfortunately,
we followed worst practices here, which means the changes are only on
hydra.gnu.org.)

> We need to add license comments to the JavaScript files and to
> non-trivial embedded script blocks.
>
> I would like to do this, but I don’t know where the code is that I
> should edit, or if this should just be done on our single
> soon-to-be-obsolete hydra.gnu.org instance.

I depends on the breadth of the changes.  Where are the license tags
missing?  Is it mostly in .js files, or in <script> tags?

Thanks,
Ludo’.

bug#15549: hydra.gnu.org uses nontrivial and nonfree javascript

[Ricardo Wurmus]

Ludovic Courtès <ludo@gnu.org> writes:

>> We need to add license comments to the JavaScript files and to
>> non-trivial embedded script blocks.
>>
>> I would like to do this, but I don’t know where the code is that I
>> should edit, or if this should just be done on our single
>> soon-to-be-obsolete hydra.gnu.org instance.
>
> I depends on the breadth of the changes.  Where are the license tags
> missing?  Is it mostly in .js files, or in <script> tags?

We don’t need to add anything to .js files if we can write a table
containing the relative paths to all scripts and their licenses.

Here is an example:

    http://guix.mdc-berlin.de/javascript

A link to this table must be placed on all pages that load the scripts
(it would be enough to modify the page template).  I’d begin by
collecting information for all scripts under /static/js and then
annotate all inline scripts with two-line license comments.

I don’t think I ever got access to hydra.gnu.org; I volunteer to make
the required changes (I’ve done this before for rcas.mdc-berlin.de and
guix.mdc-berlin.de).

--
Ricardo

GPG: BCA6 89B6 3655 3801 C3C6  2150 197A 5888 235F ACAC
https://elephly.net

bug#15549: hydra.gnu.org uses nontrivial and nonfree javascript

[Maxim Cournoyer]

Ricardo Wurmus <rekado@elephly.net> writes:

> Ludovic Courtès <ludo@gnu.org> writes:
>
>>> We need to add license comments to the JavaScript files and to
>>> non-trivial embedded script blocks.
>>>
>>> I would like to do this, but I don’t know where the code is that I
>>> should edit, or if this should just be done on our single
>>> soon-to-be-obsolete hydra.gnu.org instance.
>>
>> I depends on the breadth of the changes.  Where are the license tags
>> missing?  Is it mostly in .js files, or in <script> tags?
>
> We don’t need to add anything to .js files if we can write a table
> containing the relative paths to all scripts and their licenses.
>
> Here is an example:
>
>     http://guix.mdc-berlin.de/javascript
>
> A link to this table must be placed on all pages that load the scripts
> (it would be enough to modify the page template).  I’d begin by
> collecting information for all scripts under /static/js and then
> annotate all inline scripts with two-line license comments.
>
> I don’t think I ever got access to hydra.gnu.org; I volunteer to make
> the required changes (I’ve done this before for rcas.mdc-berlin.de and
> guix.mdc-berlin.de).

I believe there are also LibreJS problems with our Guix packages page
at: https://www.gnu.org/software/guix/packages/

Maxim

bug#15549: hydra.gnu.org uses nontrivial and nonfree javascript

[Ludovic Courtès]

Hi,

Ricardo Wurmus <rekado@elephly.net> skribis:

> I don’t think I ever got access to hydra.gnu.org; I volunteer to make
> the required changes (I’ve done this before for rcas.mdc-berlin.de and
> guix.mdc-berlin.de).

I’ve created the “rekado” account with your public key.  However, you
need to ask sysadmins@fsf.org to white list one or more IPs you’ll be
connecting from.  (I’ll email more info off-list.)

Let us know how it goes, and try to keep a patch of the changes you
make!

Thank you,
Ludo’.

bug#15549: hydra.gnu.org uses nontrivial and nonfree javascript

[Ricardo Wurmus]

Hi Ludo,

Ludovic Courtès <ludo@gnu.org> writes:

> Ricardo Wurmus <rekado@elephly.net> skribis:
>
>> I don’t think I ever got access to hydra.gnu.org; I volunteer to make
>> the required changes (I’ve done this before for rcas.mdc-berlin.de and
>> guix.mdc-berlin.de).
>
> I’ve created the “rekado” account with your public key.  However, you
> need to ask sysadmins@fsf.org to white list one or more IPs you’ll be
> connecting from.  (I’ll email more info off-list.)

Thanks.  I can now connect via fencepost.

> Let us know how it goes, and try to keep a patch of the changes you
> make!

I’ll try to make myself familiar with how things are set up and then
carefully make my changes (mostly additions) and record them as a patch.

--
Ricardo

GPG: BCA6 89B6 3655 3801 C3C6  2150 197A 5888 235F ACAC
https://elephly.net

bug#15549: hydra.gnu.org uses nontrivial and nonfree javascript

[Christophe Jarry]

> AFAICS it's actually the case.  However, all this lacks the right
> tags for LibreJS to recognize it.
>
> Could you tell us what's needed to make it work?

You should be able to do it with the instructions on those pages:

http://www.gnu.org/software/librejs/free-your-javascript
https://www.gnu.org/licenses/javascript-labels

Christophe

bug#15549: hydra.gnu.org uses nontrivial and nonfree javascript

[Thompson, David]

On Thu, Aug 28, 2014 at 3:02 PM, Christophe Jarry <cjarry@cjarry.org> wrote:
>> AFAICS it's actually the case.  However, all this lacks the right
>> tags for LibreJS to recognize it.
>>
>> Could you tell us what's needed to make it work?
>
> You should be able to do it with the instructions on those pages:
>
> http://www.gnu.org/software/librejs/free-your-javascript
> https://www.gnu.org/licenses/javascript-labels

I'd just like to point out that hydra.gnu.org does *NOT* use non-free
javascript. I can assure you that everything is free software.
LibreJS just needs to be told so using a very specific metadata
format.  I really do not like that LibreJS tells users that they are
running non-free code and encourages them to complain to site admins
about it when really LibreJS doesn't know anything. I wish LibreJS
would change the messaging but that seems unlikely.

Part of my old job at the FSF was making sure LibreJS didn't complain
about things on FSF-run sites.  It took a lot of time to do and I
don't think it was ever worth the effort.  I haven't used LibreJS in
years and probably never will again.

- Dave

bug#15549: hydra.gnu.org uses nontrivial and nonfree javascript

[Ricardo Wurmus]

Hi Dave,

> I'd just like to point out that hydra.gnu.org does *NOT* use non-free
> javascript. I can assure you that everything is free software.
> LibreJS just needs to be told so using a very specific metadata
> format.

I think that the idea of machine readable license information is good.
Obviously, it is very early to rely on something like this, because it
is hardly used by anyone.  By adding this information to websites we
maintain we can change that a little.

> I really do not like that LibreJS tells users that they are
> running non-free code and encourages them to complain to site admins
> about it when really LibreJS doesn't know anything.

Yes, “complain” is really not a nice default.

> Part of my old job at the FSF was making sure LibreJS didn't complain
> about things on FSF-run sites.  It took a lot of time to do and I
> don't think it was ever worth the effort.  I haven't used LibreJS in
> years and probably never will again.

With current versions of LibreJS I found it pretty easy to make the
changes to websites that are required to keep LibreJS from complaining.

The only gotcha was that the browser has to be restarted after changes
to license information.

--
Ricardo

GPG: BCA6 89B6 3655 3801 C3C6  2150 197A 5888 235F ACAC
https://elephly.net

bug#15549: hydra.gnu.org uses nontrivial and nonfree javascript

[Adonay Felipe Nogueira]

Do you by chance know of some way I can contribute directly to the
development of hydra.gnu.org web site?

If there is at least a way to make a copy of the web pages, I can try
making a LibreJS-compliant version of them --- the only thing needed
would be some server to test them if they need a server-side language or
CGI/FastCGI application.

I noticed that the site seens to be based on NixOS's Hydra. If you want,
I can do customization based on NixOS's instead. Just say the word. ;)

"Thompson, David" <dthompson2@worcester.edu> writes:

> I'd just like to point out that hydra.gnu.org does *NOT* use non-free
> javascript. I can assure you that everything is free software.
> LibreJS just needs to be told so using a very specific metadata
> format.  I really do not like that LibreJS tells users that they are
> running non-free code and encourages them to complain to site admins
> about it when really LibreJS doesn't know anything. I wish LibreJS
> would change the messaging but that seems unlikely.
>
> Part of my old job at the FSF was making sure LibreJS didn't complain
> about things on FSF-run sites.  It took a lot of time to do and I
> don't think it was ever worth the effort.  I haven't used LibreJS in
> years and probably never will again.
>
> - Dave

-- 
- https://libreplanet.org/wiki/User:Adfeno
- Palestrante e consultor sobre /software/ livre (não confundir com
  gratis).
- "WhatsApp"? Ele não é livre. Por favor, veja formas de se comunicar
  instantaneamente comigo no endereço abaixo.
- Contato: https://libreplanet.org/wiki/User:Adfeno#vCard
- Arquivos comuns aceitos (apenas sem DRM): Corel Draw, Microsoft
  Office, MP3, MP4, WMA, WMV.
- Arquivos comuns aceitos e enviados: CSV, GNU Dia, GNU Emacs Org, GNU
  GIMP, Inkscape SVG, JPG, LibreOffice (padrão ODF), OGG, OPUS, PDF
  (apenas sem DRM), PNG, TXT, WEBM.

bug#15549: hydra.gnu.org needs to declare its javascript licenses for

[Joshua Branson]

This is still an issue.  There are a couple of eval issues and some inline code that raises flags for LibreJs.

Joshua

bug#15549: hydra.gnu.org needs to declare its javascript licenses for LibreJS

[swedebugia]

Hi

I vote for closing this as "won't fix" now we are moving away and
concentrate on cuirass at ci.guixsd.info.

-- 
Cheers 
Swedebugia

bug#15549: hydra.gnu.org needs to declare its javascript licenses for LibreJS

[Ludovic Courtès]

swedebugia@riseup.net skribis:

> Hi
>
> I vote for closing this as "won't fix" now we are moving away and
> concentrate on cuirass at ci.guixsd.info.

Indeed, done!