Updating the video.js that we use to avoid an XSS attack. Yikes! ;\
[mediagoblin.git] / extlib / README
1 =========================
2 External Library README
3 =========================
4
5 DO NOT "FIX" CODE IN THIS DIRECTORY.
6
7 ONLY UPSTREAM VERSIONS OF SOFTWARE GO IN THIS DIRECTORY.
8
9 This directory is provided as a courtesy to our users who might be
10 unable or unwilling to find and install libraries we depend on.
11
12 If we "fix" software in this directory, we hamstring users who do the
13 right thing and keep a single version of upstream libraries in a
14 system-wide library. We introduce subtle and maddening bugs where
15 our code is "accidentally" using the "wrong" library version. We may
16 unwittingly interfere with other software that depends on the
17 canonical release versions of those same libraries!
18
19 Forking upstream software for trivial reasons makes us bad citizens in
20 the Free Software community and adds unnecessary heartache for our
21 users. Don't make us "that" project.
22
23
24 FAQ
25 ===
26
27 :Q: What should we do when we find a bug in upstream software?
28
29 :A: First and foremost, REPORT THE BUG, and if possible send in a patch.
30
31 Watch for a release of the upstream software and integrate with it
32 when it's released.
33
34 In the meantime, work around the bug, if at all possible. Usually,
35 it's quite possible, if slightly harder or less efficient.
36
37 :Q: What if the bug can't be worked around?
38
39 :A: If the upstream developers have accepted a bug patch, it's
40 undesirable but acceptable to apply that patch to the library in
41 the ``extlib/`` dir. Ideally, use a release version for upstream or a
42 version control system snapshot.
43
44 Note that this is a last resort.
45
46 :Q: What if upstream is unresponsive or won't accept a patch?
47
48 :A: Try again.
49
50 :Q: I tried again, and upstream is still unresponsive and nobody's
51 checked on my patch. Now what?
52
53 :A: If the upstream project is moribund and there's a way to adopt it,
54 propose having the MediaGoblin dev team adopt the project. Or, adopt
55 it yourself.
56
57 :Q: What if there's no upstream authority and it can't be adopted?
58
59 :A: Then we fork it. Make a new name and a new version. Include it in
60 ``lib/`` instead of ``extlib/``, and use the GMG_* prefix to change
61 the namespace to avoid collisions (or something like that).
62
63 This is a last resort; consult with the rest of the dev group
64 before taking this radical step.
65
66 :Q: What about submodules?
67
68 :A: pdf.js is supplied as a submodule, and other software may use that too,
69 to add a new submodule:
70 git submodule add <git-repo-of-fun-project> extlib/fun-project
71
72 Use it just like a snapshotted extlib directory. When a new clone of mediagoblin
73 is made you need to run
74
75 git submodule init
76 git submodule update
77
78 As noted in HackingHowto
79
80 Thanks
81 ======
82
83 This policy originally copied from Status.net. Many many thanks to them
84 for working out such a nice system for doing things.