From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from localhost (localhost [127.0.0.1]) by arlo.cworth.org (Postfix) with ESMTP id 2FEA66DE0183 for ; Wed, 6 Dec 2017 11:14:01 -0800 (PST) X-Virus-Scanned: Debian amavisd-new at cworth.org X-Spam-Flag: NO X-Spam-Score: -0.03 X-Spam-Level: X-Spam-Status: No, score=-0.03 tagged_above=-999 required=5 tests=[AWL=-0.030] autolearn=disabled Received: from arlo.cworth.org ([127.0.0.1]) by localhost (arlo.cworth.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Lq_lLrwh71qG for ; Wed, 6 Dec 2017 11:14:00 -0800 (PST) Received: from che.mayfirst.org (che.mayfirst.org [162.247.75.118]) by arlo.cworth.org (Postfix) with ESMTPS id 698096DE009B for ; Wed, 6 Dec 2017 11:14:00 -0800 (PST) Received: from fifthhorseman.net (unknown [38.109.115.130]) by che.mayfirst.org (Postfix) with ESMTPSA id 938EBF99A; Wed, 6 Dec 2017 14:13:58 -0500 (EST) Received: by fifthhorseman.net (Postfix, from userid 1000) id 646EE20568; Wed, 6 Dec 2017 14:13:55 -0500 (EST) From: Daniel Kahn Gillmor To: Brian Sniffen , notmuch@notmuchmail.org Subject: Re: web interface to notmuch In-Reply-To: <87indjnbp8.fsf@istari.evenmere.org> References: <87tvyvp4f2.fsf@istari.evenmere.org> <87376f13ho.fsf@fifthhorseman.net> <87indjnbp8.fsf@istari.evenmere.org> Date: Wed, 06 Dec 2017 14:13:52 -0500 Message-ID: <87y3mf4qkv.fsf@fifthhorseman.net> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" X-BeenThere: notmuch@notmuchmail.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "Use and development of the notmuch mail system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Dec 2017 19:14:01 -0000 --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable Hi Brian-- On Wed 2017-12-06 10:00:19 -0500, Brian Sniffen wrote: > Okay, https://github.com/briansniffen/notmuch/tree/nmweb is now rebased > onto the notmuchmail.org head as of this morning. All of the changes > are under contrib/notmuch-web. thanks for doing this!=20=20 traditionally, we've encouraged code contributions to come in in separate patches (not one big lump), with each commit clearly justifying their changes. And yes, tests would make it much more likely that this sweet contribution doesn't bitrot! one thing i note is you've included a copy of jquery directly. i think we want to avoid having retrieved or generated code in the repository. if there's an external dependency, the repo should point to it but it shouldn't include it. notmuch doesn't include gmime, but it states that it has gmime as a dependency (with specific versions), and lets the builder/maintainer retrieve the dependency themselves. This makes licensing, source vetting, and maintenance easier by ensuring that it all stays loosely coupled. Presumably you aren't signing up for ensuring that any security vulnerabilities in jquery get pushed into the notmuch repo too :) Maybe you could do a similar explicitly-stated dependency for jquery instead of including it directly? debian ships jquery as libjs-jquery, for example (though you could also use an explicit fetch from the web for systems that aren't running an OS that provides a packaged form of jquery). other folks might have other preferences, i hope they'll chime in. --dkg --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEOCdgUepHf6PklTkyFJitxsGSMjcFAlooQXAACgkQFJitxsGS Mjff3Q/9FUqukdF6696pfYrtdJ/NOzmYh4xr5oCI/GpCt2j70EgBT4R9rA+yg5Ht Ra0PhfCLl7xOjDVQd/p0ue3cH8JsyrM4xjT0nV2N6swLNcE5jCG+TWKYsfyhagYT 5gX/x7RKWma8OuYcwtzmGxQOldY+61HFQ+u51rSNPBMqCHN4iwitm8ZP40IeceyQ QXi9gNkHswOxzm51SWXsMiERarouHaY6CiPBkRwLNrFvQDAZKK1rbwUC4YFAc//c tUYeKFFLV/ptGYlzfgNvFHLY8o5obtocZ1n4198HuNKIlFOVNmFMVq33XSDG9AXB +vpgbzrF317NvNlkkC83EyKT0caufUI3n4cbwYnHytY2SSFOzdzSyPvCp7jto08N Ky4K4PZV39BlISItcpCPTKs9Yk02Ja9qkuzK7bqRHvm6sw+vZo/viKTMSEmDmaAi ziY3TCwwSwUnrm6ajfx554Kuwif43WiWuyg0iTAjtBEXJR1eod1HdG84uwU5Y+QA qOuflLgJR5zekAnb1Vdnk+NsU6gNRDRz8n0Ku9ngNNJPOrejFUqZU9+W7qd7xrfF R6OS7NdShjFbpsJdMUMFuFFQLvutRFoQZFf4MitXpAEH48lgss4zq0OASRIecdvy 1xgCfnKgafWGUa0Ro8As5g5e/qpSslzWtOj/N/JqlUqyidWjecg= =2Ue6 -----END PGP SIGNATURE----- --=-=-=--