On Thu, 2013-08-15 at 13:45 -0700, T.C. Hollingsworth wrote: > It's come to my attention that a number of packages contain Flash (.swf) files, > but absolutely none of them have BuildRequires on a free software Flash > toolchain, nor do any of them seem to be shipping the source for these files. > :-( > > It has never been permissible to included prebuilt files of this nature in > Fedora [1], and FPC unequivocally stated during today's meeting that they have > no interest in making an exception for this. > > Please remove this prohibited content from your packages, or ensure that any > included .swf files are built from source using a free software toolchain like > `swfc` during the %build phase. A list of affected packages sorted by owner is > included below, and I'll be filing bugs for these soon. > > -T.C. > > [1] https://fedoraproject.org/wiki/Packaging:Guidelines#No_inclusion_of_pre-built_binaries_or_libraries > > limb roundcubemail > ngompa tinymce So, tinymce has a 'media' plugin which lets you embed media in HTML you're editing with it. If it thinks the media might need playing with Flash, it'll generate HTML that tries to use a Flash player - moxieplayer.swf - to play it (sometimes as a fallback from HTML5). Just nuking moxieplayer.swf doesn't stop tinymce generating HTML that looks for it, so that's not really the way to go. But I think I found a way to patch the plugin not to try and use moxieplayer.swf and just to spit out nice clean HTML instead. I also bumped tinymce to the latest upstream release, since it hadn't been bumped since 2011 and was *ancient*. Testing of this is very welcome. I've sent the build to Rawhide and F20 for now. roundcubemail is on this list because it bundles tinymce, basically. I think it should be trivial to replace its bundled tinymce with the system-wide one. I'm going to test installing the updated and de-Flashed tinymce along with a roundcubemail build patched to use a system-wide tinymce on my own server and check that it works okay that way. If it does, I'll submit that combination to all Fedora releases. I suspect many other packages on the list may be there because they're bundling tinymce. In most cases, unbundling it ought to be trivial; it seems like the 3.x series of tinymce maintained compatibility well, so I think it shouldn't be a problem to use system-wide tinymce. But I'll look into it some more tomorrow. askbot is the only package right now using the systemwide tinymce. I'm assuming ask.fp.o runs on EL, but I'm not sure. Any infra folks reading this, would you be interested in checking ask.fp.o behaves sensibly with de-Flashed tinymce 3.5.8? I don't think the Flash issue should matter at all because it looks like askbot customizes the tinymce editor widget somewhat and doesn't actually expose the media plugin _at all_. I don't see why it wouldn't work with tinymce 3.5.8 - in fact it ought to work better - but we should probably check. Random note: patching minifed javascript is a giant fucking PITA, and we can't edit the 'source' javascript for tinymce and re-minify it because Fedora doesn't have yuicompressor - https://bugzilla.redhat.com/show_bug.cgi?id=745515 . Sigh. -- Adam Williamson Fedora QA Community Monkey IRC: adamw | Twitter: AdamW_Fedora | identi.ca: adamwfedora http://www.happyassassin.net -- devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/devel Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
