Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.maint.python > #10897

Updating nbconvert : problems with privacy breaches

Show key headers only | View raw

Hi,

looking into finishing packaging nbconvert's latest version (thanks 
Ondřej Nový and Gordon Ball for the help!), lintian had quite a few 
complaints about privacy breaches:

W: python-nbconvert-doc: privacy-breach-generic 
usr/share/doc/python-nbconvert-doc/html/customizing.html [<script 
src="https://cdnjs.cloudflare.com/ajax/libs/require.js/2.1.10/require.min.js">] 
(https://cdnjs.cloudflare.com/ajax/libs/require.js/2.1.10/require.min.js)
E: python-nbconvert-doc: privacy-breach-uses-embedded-file 
usr/share/doc/python-nbconvert-doc/html/customizing.html You may use the 
libjs-jquery package. 
(https://cdnjs.cloudflare.com/ajax/libs/jquery/2.0.3/jquery.min.js)
E: python-nbconvert-doc: privacy-breach-uses-embedded-file 
usr/share/doc/python-nbconvert-doc/html/customizing.html You may use the 
libjs-mathjax package. 
(https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.1/mathjax.js?config=tex-ams_html)


And indeed grepping the source code, there are a few places with links 
to cloudflare.com :

./docs/source/customizing.ipynb:    "    <script 
src=\"https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.0/MathJax.js?config=TeX-AMS_HTML\"></script>\n",
./nbconvert/postprocessors/serve.py:    reveal_cdn = 
Unicode("https://cdnjs.cloudflare.com/ajax/libs/reveal.js/3.5.0",
./nbconvert/exporters/slides.py:        return 
'https://cdnjs.cloudflare.com/ajax/libs/reveal.js/3.5.0'
./nbconvert/exporters/slides.py: 
"https://cdnjs.cloudflare.com/ajax/libs/require.js/2.1.10/require.min.js",
./nbconvert/exporters/slides.py: 
"https://cdnjs.cloudflare.com/ajax/libs/jquery/2.0.3/jquery.min.js",
./nbconvert/exporters/slides.py: 
"https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css",
./nbconvert/templates/html/full.tpl:<script 
src="https://cdnjs.cloudflare.com/ajax/libs/require.js/2.1.10/require.min.js"></script>
./nbconvert/templates/html/full.tpl:<script 
src="https://cdnjs.cloudflare.com/ajax/libs/jquery/2.0.3/jquery.min.js"></script>
./nbconvert/templates/html/mathjax.tpl:{%- macro 
mathjax(url='https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.1/MathJax.js?config=TeX-AMS_HTML') 
-%}

Touching docs/source/customizing.ipynb to patch out cloudflare links 
should be ok : it's the source of customizing.html, which ends up in 
python-nbconvert-doc and is directly used on a Debian system. I don't 
break anything by patching it.

But the other files... it's about changing the exporters and templates 
during document generation ; and the resulting files might then get used 
on non-Debian systems. In short : if I tamper with them to use Debian 
local packages, that basically means nbconvert in Debian will produce 
broken documents.

Perhaps patching customizing.html after it was built (using sed 
magic...) is an acceptable solution?

Since I don't feel sure about my course of action, I thought it would be 
better to ask for advice and ideas here.

Cheers,

jpuydt on irc.debian.org

Back to linux.debian.maint.python | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Updating nbconvert : problems with privacy breaches Julien Puydt <julien.puydt@laposte.net> - 2018-09-14 21:20 +0200
  Re: Updating nbconvert : problems with privacy breaches Diane Trout <diane@ghic.org> - 2018-09-15 07:40 +0200
    Re: Updating nbconvert : problems with privacy breaches Julien Puydt <julien.puydt@laposte.net> - 2018-09-29 16:10 +0200

csiph-web