diff --git a/.gitattributes b/.gitattributes
index be4674f..30b32f7 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -2,4 +2,5 @@ lib/.gitkeep export-ignore
node_modules/ export-ignore
test/ export-ignore
vendor/ export-ignore
-package-lock.json export-ignore
+# package-lock.json is deliberately kept in the release archive: it is the provenance record
+# for the third-party files in lib/, and AMO reviewers need it to verify them.
diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index 2360063..c83e19a 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -29,24 +29,23 @@ jobs:
with:
node-version: 24
- - name: Install & build assets
- run: |
- # Make sure the lock-file is up to date before we run clean-install
- npm install --package-lock-only
- npm clean-install
- npm audit fix
-
- - name: Build custom (minimum) release of highlight.js
- run: |
- cd node_modules/highlight.js
- npm install --package-lock-only
- npm clean-install
- npm run build
- node tools/build.js xml properties http
+ - name: Install assets
+ # Deliberately a plain clean-install: package-lock.json is authoritative, so the
+ # published build is reproducible from the committed lock-file alone. Do not add
+ # `npm install --package-lock-only` or `npm audit fix` here -- both mutate the
+ # dependency tree at build time, which makes the shipped third-party files
+ # impossible for AMO reviewers to verify.
+ run: npm clean-install
- name: Copy third-party dependencies to lib/ directory
+ # Copied verbatim from the @highlightjs/cdn-assets package, which is highlight.js'
+ # own published distribution. The files are byte-identical to that release, so a
+ # reviewer can verify them with `npm ci` and `diff` rather than reproducing a build.
run: |
- cp node_modules/highlight.js/build/highlight.min.js lib/highlight.min.js
+ cp node_modules/@highlightjs/cdn-assets/es/core.min.js lib/core.min.js
+ cp node_modules/@highlightjs/cdn-assets/es/languages/xml.min.js lib/xml.min.js
+ cp node_modules/@highlightjs/cdn-assets/es/languages/http.min.js lib/http.min.js
+ cp node_modules/@highlightjs/cdn-assets/es/languages/properties.min.js lib/properties.min.js
cp node_modules/pako/dist/pako_inflate.min.js lib/pako_inflate.min.js
- name: Clean release
diff --git a/attribution.md b/attribution.md
index d7ddd81..34b736b 100644
--- a/attribution.md
+++ b/attribution.md
@@ -15,6 +15,11 @@ License type: BSD 3-clause "New" or "Revised" License
Project URL: https://github.com/highlightjs/highlight.js
+Distribution: the files in `lib/` are copied verbatim, without modification, from the
+project's own published distribution package `@highlightjs/cdn-assets`, pinned to version
+11.11.1 in `package.json`. The exact tarball and its SHA-512 integrity hash are recorded in
+`package-lock.json`, so the shipped files can be verified with `npm ci` followed by `diff`.
+
Original license text:
```
diff --git a/package-lock.json b/package-lock.json
index 6652e0f..3ea1445 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8,7 +8,7 @@
"name": "saml-tracer",
"version": "1.9.2",
"dependencies": {
- "highlight.js": "github:highlightjs/highlight.js",
+ "@highlightjs/cdn-assets": "11.11.1",
"pako": "~2.2"
},
"devDependencies": {
@@ -511,6 +511,15 @@
"dev": true,
"license": "MIT"
},
+ "node_modules/@highlightjs/cdn-assets": {
+ "version": "11.11.1",
+ "resolved": "https://registry.npmjs.org/@highlightjs/cdn-assets/-/cdn-assets-11.11.1.tgz",
+ "integrity": "sha512-VEPdHzwelZ12hEX18BHduqxMZGolcUsrbeokHYxOUIm8X2+M7nx5QPtPeQgRxR9XjhdLv4/7DD5BWOlSrJ3k7Q==",
+ "license": "BSD-3-Clause",
+ "engines": {
+ "node": ">=12.0.0"
+ }
+ },
"node_modules/@istanbuljs/load-nyc-config": {
"version": "1.1.0",
"resolved": "https://registry.npmjs.org/@istanbuljs/load-nyc-config/-/load-nyc-config-1.1.0.tgz",
@@ -1860,14 +1869,6 @@
"node": ">= 0.4"
}
},
- "node_modules/highlight.js": {
- "version": "11.11.2",
- "resolved": "git+ssh://git@github.com/highlightjs/highlight.js.git#5a5027abef61fad036db44b03ca2d8d0658bc3e4",
- "license": "BSD-3-Clause",
- "engines": {
- "node": ">=12.0.0"
- }
- },
"node_modules/html-escaper": {
"version": "2.0.2",
"resolved": "https://registry.npmjs.org/html-escaper/-/html-escaper-2.0.2.tgz",
diff --git a/package.json b/package.json
index 4be59b6..59d8d7c 100644
--- a/package.json
+++ b/package.json
@@ -6,7 +6,7 @@
"test": "jest"
},
"dependencies": {
- "highlight.js": "github:highlightjs/highlight.js",
+ "@highlightjs/cdn-assets": "11.11.1",
"pako": "~2.2"
},
"devDependencies": {
diff --git a/src/TraceWindow.html b/src/TraceWindow.html
index 160d226..0c4fe79 100644
--- a/src/TraceWindow.html
+++ b/src/TraceWindow.html
@@ -39,7 +39,7 @@
-
+
diff --git a/src/hljs-init.js b/src/hljs-init.js
new file mode 100644
index 0000000..b38ccde
--- /dev/null
+++ b/src/hljs-init.js
@@ -0,0 +1,16 @@
+// Registers the highlight.js grammars SAML-tracer uses and exposes hljs as a global,
+// so the classic (non-module) scripts on this page can keep calling hljs.highlightElement().
+//
+// The imported files are unmodified artifacts from the @highlightjs/cdn-assets package,
+// copied verbatim during the release build -- see .github/workflows/build-release.yml.
+// Only this wrapper is first-party code.
+import hljs from '../lib/core.min.js';
+import xml from '../lib/xml.min.js';
+import http from '../lib/http.min.js';
+import properties from '../lib/properties.min.js';
+
+hljs.registerLanguage('xml', xml);
+hljs.registerLanguage('http', http);
+hljs.registerLanguage('properties', properties);
+
+window.hljs = hljs;