The openstack-manuals contains minified javascript

[Thomas Goirand]

Hi there!

These files should be removed from the openstack-manual repository:

# find . -iname '*.min*'
./www/static/common/js/bootstrap.min.js
./www/static/common/js/bootstrap-hover-dropdown.min.js
./www/static/common/css/font-awesome.min.css
./www/static/common/css/bootstrap.min.css

Indeed, these are considered already compiled binaries, and are not acceptable by downstream distribution. It is also a very bad practice with potential security issues:

https://zyan.scripts.mit.edu/blog/backdooring-js/

Here, we don't even know what compressor was used. What should be done, if we really want to use minified javascript, is to minify them at build time. I would also strongly advise to not embed things which are already available from XStatic packages.

[Anne Gentle (annegentle)]

Is this a duplicate bug?

[Amulya Battu (battu-amulya)]

Fix is created at https://review.openstack.org/240723

[Andreas Jaeger (jaegerandi)]

Note that we can only remove them if there are either completely unused or there is an alternate way of publishing the javascript. Just removing these files is *not* enough.

[Alexandra Settle (alexandra-settle)]

Is someone able to verify whether or not these files are completely unused and don't affect other files as Andreas said?
Marking as incomplete until we're able to confirm.
Thanks.

[Thomas Goirand (thomas-goirand)]

Hi Alexandra,

A simple grep shows that the files are indeed in use. Also, please don't set this to a low priority, as this blocks my upload to Debian (and I would like to upload to Debian some of the guides from openstack-manuals).

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/330731

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/330731
Committed: https://git.openstack.org/cgit/openstack/openstack-manuals/commit/?id=2187b83bef2ca142715e218d02f138cff2fc9042
Submitter: Jenkins
Branch: master

commit 2187b83bef2ca142715e218d02f138cff2fc9042
Author: Ryan Selden <email address hidden>
Date: Thu Jun 16 17:30:59 2016 +0000

    Removed minimized files

    Font-awesome and bootstrap files were included minimized
    Removed font-awesome which was only used from the CDN
    Replaced bootstrap minimized files with regular ones
    Updated references to bootstrap files

    Change-Id: I6bb74549b762e7502a8e1966fc4b6b53fe54c163
    Closes-bug: #1501641

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/347761
Committed: https://git.openstack.org/cgit/openstack/openstack-manuals/commit/?id=592916d33e64cca469b29812bfb4cc06549bf0b7
Submitter: Jenkins
Branch: master

commit 592916d33e64cca469b29812bfb4cc06549bf0b7
Author: Thomas Goirand <email address hidden>
Date: Wed Jul 27 13:07:21 2016 +0200

    Replace minified jquery by source version

    The file www/static/common/js/jquery-1.11.0.js is a source-less
    non-free blob, which wouldn't fit in downstream distributions.
    This patch replaces it by jquery-1.11.3.js in a non-minified
    way.

    Partial-Bug: 1501641
    Change-Id: Ia7088601423f1fad0681bef4521ba4c114101d3a

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/openstack-manuals 15.0.0 release.