Daniel Leidert
2014-02-15 12:16:43 UTC
Hi,
During packaging the latest bf release and updating the necessary
copyright information I found several issues with how third party
plugins are handled and handed to the user and would therefor like to
declare some requirements and suggestions:
- Add license information for third party plugins
Almost all third-party stuff (cssmin, jsbeautify, zencoding) misses
copyright and/or licensing information in the bf source package. This
can be legally problematic (not only to the bf authors but also to the
user base!). probably something like adding COPYING.foo to the source
package is sufficient. I further suggest to add a section to the README
file to declare, where you got the copy from and that the license
information can be found in COPYING.foo. JFTR: all third-party stuff
seems to be licensed under an MIT license.
- Update plugins from time to time
At least jsmin, cssmin and jsbeautify have seen development since we
included a copy of them in Bluefish. The zen-coding plugin has been
renamed and moved (and seems to miss the python stuff now?!). Now
remember that you are responsible for every bug in these third-party
applications too (especially if we maybe ship a copy with a serious
security bug). IMO if we include third-party stuff, it should be
watched, updated and tested.
I consider the above requirements. Now the next one refers to the second
point and is also a packaging aspect:
- Don't install a copy of this third party stuff if a system wide
installed copy already exists
For Debian I found, that at least cssmin is now packaged and actively
maintained. It is newer then what bf ships and it might contain
bug-fixes our copy doesn't have. So I suggest to do two things: during
configuration check (and allow a manual override), if a python module
exists (python -c 'import cssmin') and depending on the result, (a)
don't install our copy and (b) call it from src/rcfile.c with a system
wide python import command. Maybe we can also do the check during
runtime. Other distributions might already have copies of zencoding,
jsmin (2.0.9) etc.
Regards, Daniel
During packaging the latest bf release and updating the necessary
copyright information I found several issues with how third party
plugins are handled and handed to the user and would therefor like to
declare some requirements and suggestions:
- Add license information for third party plugins
Almost all third-party stuff (cssmin, jsbeautify, zencoding) misses
copyright and/or licensing information in the bf source package. This
can be legally problematic (not only to the bf authors but also to the
user base!). probably something like adding COPYING.foo to the source
package is sufficient. I further suggest to add a section to the README
file to declare, where you got the copy from and that the license
information can be found in COPYING.foo. JFTR: all third-party stuff
seems to be licensed under an MIT license.
- Update plugins from time to time
At least jsmin, cssmin and jsbeautify have seen development since we
included a copy of them in Bluefish. The zen-coding plugin has been
renamed and moved (and seems to miss the python stuff now?!). Now
remember that you are responsible for every bug in these third-party
applications too (especially if we maybe ship a copy with a serious
security bug). IMO if we include third-party stuff, it should be
watched, updated and tested.
I consider the above requirements. Now the next one refers to the second
point and is also a packaging aspect:
- Don't install a copy of this third party stuff if a system wide
installed copy already exists
For Debian I found, that at least cssmin is now packaged and actively
maintained. It is newer then what bf ships and it might contain
bug-fixes our copy doesn't have. So I suggest to do two things: during
configuration check (and allow a manual override), if a python module
exists (python -c 'import cssmin') and depending on the result, (a)
don't install our copy and (b) call it from src/rcfile.c with a system
wide python import command. Maybe we can also do the check during
runtime. Other distributions might already have copies of zencoding,
jsmin (2.0.9) etc.
Regards, Daniel