From 0facf52422c4225bd1b2febf049b983ab1bf9de1 Mon Sep 17 00:00:00 2001 From: Kellen Murphy Date: Tue, 21 Jul 2026 17:26:45 -0400 Subject: [PATCH] Ship highlight.js verbatim from @highlightjs/cdn-assets AMO's review of 1.9.4 is blocked on reproducing the minification of lib/highlight.min.js. That is unwinnable as long as we ship a custom build: there is no official artifact to checksum against, so the reviewer has to reproduce a build, and reproducing ours was never possible anyway -- package.json pinned highlight.js to a bare GitHub URL with no ref, the workflow re-resolved it with `npm install --package-lock-only` before clean-install, `npm audit fix` ran immediately before the build, and package-lock.json was stripped from the release archive. Nothing in the submitted zip identified a fixed version. Consume the project's own published distribution instead, pinned exactly, and copy the files without modification. @highlightjs/cdn-assets is highlight.js' own npm package rather than a third-party CDN rehost, so package-lock.json records the tarball URL and its SHA-512 integrity hash: a reviewer verifies the shipped files with `npm ci` and `diff`, with no build to reproduce. The es/ modules give core plus only the xml, http and properties grammars -- about 24 KB, slightly smaller than the custom build. A first-party shim registers them and exposes hljs as a global so the page's classic scripts are unchanged; every hljs call site is event-driven, so the deferred module script is not a timing hazard. cdn-assets has no 11.11.1 successor yet, so this pins one patch behind the 11.11.2 the lock-file previously resolved to. A documentable downgrade is worth more than an unreproducible build. Refs #109 --- .gitattributes | 3 ++- .github/workflows/build-release.yml | 29 ++++++++++++++--------------- attribution.md | 5 +++++ package-lock.json | 19 ++++++++++--------- package.json | 2 +- src/TraceWindow.html | 2 +- src/hljs-init.js | 16 ++++++++++++++++ 7 files changed, 49 insertions(+), 27 deletions(-) create mode 100644 src/hljs-init.js diff --git a/.gitattributes b/.gitattributes index be4674f..30b32f7 100644 --- a/.gitattributes +++ b/.gitattributes @@ -2,4 +2,5 @@ lib/.gitkeep export-ignore node_modules/ export-ignore test/ export-ignore vendor/ export-ignore -package-lock.json export-ignore +# package-lock.json is deliberately kept in the release archive: it is the provenance record +# for the third-party files in lib/, and AMO reviewers need it to verify them. diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml index 2360063..c83e19a 100644 --- a/.github/workflows/build-release.yml +++ b/.github/workflows/build-release.yml @@ -29,24 +29,23 @@ jobs: with: node-version: 24 - - name: Install & build assets - run: | - # Make sure the lock-file is up to date before we run clean-install - npm install --package-lock-only - npm clean-install - npm audit fix - - - name: Build custom (minimum) release of highlight.js - run: | - cd node_modules/highlight.js - npm install --package-lock-only - npm clean-install - npm run build - node tools/build.js xml properties http + - name: Install assets + # Deliberately a plain clean-install: package-lock.json is authoritative, so the + # published build is reproducible from the committed lock-file alone. Do not add + # `npm install --package-lock-only` or `npm audit fix` here -- both mutate the + # dependency tree at build time, which makes the shipped third-party files + # impossible for AMO reviewers to verify. + run: npm clean-install - name: Copy third-party dependencies to lib/ directory + # Copied verbatim from the @highlightjs/cdn-assets package, which is highlight.js' + # own published distribution. The files are byte-identical to that release, so a + # reviewer can verify them with `npm ci` and `diff` rather than reproducing a build. run: | - cp node_modules/highlight.js/build/highlight.min.js lib/highlight.min.js + cp node_modules/@highlightjs/cdn-assets/es/core.min.js lib/core.min.js + cp node_modules/@highlightjs/cdn-assets/es/languages/xml.min.js lib/xml.min.js + cp node_modules/@highlightjs/cdn-assets/es/languages/http.min.js lib/http.min.js + cp node_modules/@highlightjs/cdn-assets/es/languages/properties.min.js lib/properties.min.js cp node_modules/pako/dist/pako_inflate.min.js lib/pako_inflate.min.js - name: Clean release diff --git a/attribution.md b/attribution.md index d7ddd81..34b736b 100644 --- a/attribution.md +++ b/attribution.md @@ -15,6 +15,11 @@ License type: BSD 3-clause "New" or "Revised" License Project URL: https://github.com/highlightjs/highlight.js +Distribution: the files in `lib/` are copied verbatim, without modification, from the +project's own published distribution package `@highlightjs/cdn-assets`, pinned to version +11.11.1 in `package.json`. The exact tarball and its SHA-512 integrity hash are recorded in +`package-lock.json`, so the shipped files can be verified with `npm ci` followed by `diff`. + Original license text: ``` diff --git a/package-lock.json b/package-lock.json index 6652e0f..3ea1445 100644 --- a/package-lock.json +++ b/package-lock.json @@ -8,7 +8,7 @@ "name": "saml-tracer", "version": "1.9.2", "dependencies": { - "highlight.js": "github:highlightjs/highlight.js", + "@highlightjs/cdn-assets": "11.11.1", "pako": "~2.2" }, "devDependencies": { @@ -511,6 +511,15 @@ "dev": true, "license": "MIT" }, + "node_modules/@highlightjs/cdn-assets": { + "version": "11.11.1", + "resolved": "https://registry.npmjs.org/@highlightjs/cdn-assets/-/cdn-assets-11.11.1.tgz", + "integrity": "sha512-VEPdHzwelZ12hEX18BHduqxMZGolcUsrbeokHYxOUIm8X2+M7nx5QPtPeQgRxR9XjhdLv4/7DD5BWOlSrJ3k7Q==", + "license": "BSD-3-Clause", + "engines": { + "node": ">=12.0.0" + } + }, "node_modules/@istanbuljs/load-nyc-config": { "version": "1.1.0", "resolved": "https://registry.npmjs.org/@istanbuljs/load-nyc-config/-/load-nyc-config-1.1.0.tgz", @@ -1860,14 +1869,6 @@ "node": ">= 0.4" } }, - "node_modules/highlight.js": { - "version": "11.11.2", - "resolved": "git+ssh://git@github.com/highlightjs/highlight.js.git#5a5027abef61fad036db44b03ca2d8d0658bc3e4", - "license": "BSD-3-Clause", - "engines": { - "node": ">=12.0.0" - } - }, "node_modules/html-escaper": { "version": "2.0.2", "resolved": "https://registry.npmjs.org/html-escaper/-/html-escaper-2.0.2.tgz", diff --git a/package.json b/package.json index 4be59b6..59d8d7c 100644 --- a/package.json +++ b/package.json @@ -6,7 +6,7 @@ "test": "jest" }, "dependencies": { - "highlight.js": "github:highlightjs/highlight.js", + "@highlightjs/cdn-assets": "11.11.1", "pako": "~2.2" }, "devDependencies": { diff --git a/src/TraceWindow.html b/src/TraceWindow.html index 160d226..0c4fe79 100644 --- a/src/TraceWindow.html +++ b/src/TraceWindow.html @@ -39,7 +39,7 @@ - + diff --git a/src/hljs-init.js b/src/hljs-init.js new file mode 100644 index 0000000..b38ccde --- /dev/null +++ b/src/hljs-init.js @@ -0,0 +1,16 @@ +// Registers the highlight.js grammars SAML-tracer uses and exposes hljs as a global, +// so the classic (non-module) scripts on this page can keep calling hljs.highlightElement(). +// +// The imported files are unmodified artifacts from the @highlightjs/cdn-assets package, +// copied verbatim during the release build -- see .github/workflows/build-release.yml. +// Only this wrapper is first-party code. +import hljs from '../lib/core.min.js'; +import xml from '../lib/xml.min.js'; +import http from '../lib/http.min.js'; +import properties from '../lib/properties.min.js'; + +hljs.registerLanguage('xml', xml); +hljs.registerLanguage('http', http); +hljs.registerLanguage('properties', properties); + +window.hljs = hljs;