GNU bug report logs - #60904
[PATCH 05/25] gnu: Add go-github-com-google-safehtml.

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 60904 in the body.
You can then email your comments to 60904 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Katherine Cox-Buday <cox.katherine.e <at> gmail.com>
To: guix-patches <at> gnu.org
Cc: Katherine Cox-Buday <cox.katherine.e <at> gmail.com>
Subject: [PATCH 05/25] gnu: Add go-github-com-google-safehtml.
Date: Tue, 17 Jan 2023 18:44:50 -0700

* gnu/packages/golang.scm (go-github-com-google-safehtml): New variable.
---
 gnu/packages/golang.scm | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/gnu/packages/golang.scm b/gnu/packages/golang.scm
index 677d58d831..9f7a8160de 100644
--- a/gnu/packages/golang.scm
+++ b/gnu/packages/golang.scm
@@ -10921,6 +10921,31 @@ (define-public go-github-com-google-go-jsonnet
 implementation.")
     (license license:asl2.0)))
 
+(define-public go-github-com-google-safehtml
+  (package
+    (name "go-github-com-google-safehtml")
+    (version "0.1.0")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                    (url "https://github.com/google/safehtml")
+                    (commit (string-append "v" version))))
+              (file-name (git-file-name name version))
+              (sha256
+               (base32
+                "0j2xjy8xrk9y9k6bqpvimj84i6hg1wwsyvwsb0axhmp49cmnrp86"))))
+    (build-system go-build-system)
+    (arguments
+     '(#:import-path "github.com/google/safehtml"))
+    (propagated-inputs `(("go-golang-org-x-text" ,go-golang-org-x-text)))
+    (home-page "https://github.com/google/safehtml")
+    (synopsis "Safe HTML for Go")
+    (description
+     "Package safehtml provides immutable string-like types which represent values
+that are guaranteed to be safe, by construction or by escaping or sanitization,
+to use in various HTML contexts and with various DOM APIs.")
+    (license license:bsd-3)))
+
 (define-public go-github-com-google-shlex
   (package
     (name "go-github-com-google-shlex")
-- 
2.38.1

Message #22 received at 60904 <at> debbugs.gnu.org (full text, mbox):

From: "(" <paren <at> disroot.org>
To: "Katherine Cox-Buday" <cox.katherine.e <at> gmail.com>, <60904 <at> debbugs.gnu.org>
Subject: Re: [bug#60904] [PATCH 05/25] gnu: Add go-github-com-google-safehtml.
Date: Mon, 06 Feb 2023 22:04:50 +0000

[Message part 1 (text/plain, inline)]

* gnu/packages/golang.scm (go-github-com-google-safehtml): New variable.

> --- a/gnu/packages/golang.scm
> +++ b/gnu/packages/golang.scm

> @@ -10921,6 +10921,31 @@ (define-public go-github-com-google-go-jsonnet

> +    (propagated-inputs `(("go-golang-org-x-text" ,go-golang-org-x-text)))

Please use new-style inputs.

> +    (synopsis "Safe HTML for Go")

  (synopsis "Go type for storing HTML data")

> +    (description
> +     "Package safehtml provides immutable string-like types which represent values
> +that are guaranteed to be safe, by construction or by escaping or sanitization,
> +to use in various HTML contexts and with various DOM APIs.")

  (description
   "This package provides a Go library for storing HTML data as an immutable string-like
  value.")

    -- (

[signature.asc (application/pgp-signature, inline)]

Message #25 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Katherine Cox-Buday <cox.katherine.e <at> gmail.com>
To: "( via Guix-patches" via <guix-patches <at> gnu.org>
Cc: "\(" <paren <at> disroot.org>, 60904 <at> debbugs.gnu.org
Subject: Re: [bug#60904] [PATCH 05/25] gnu: Add go-github-com-google-safehtml.
Date: Tue, 07 Feb 2023 09:41:08 -0700

"( via Guix-patches" via <guix-patches <at> gnu.org> writes:

> * gnu/packages/golang.scm (go-github-com-google-safehtml): New variable.
>
>> --- a/gnu/packages/golang.scm
>> +++ b/gnu/packages/golang.scm
>
>> @@ -10921,6 +10921,31 @@ (define-public go-github-com-google-go-jsonnet
>
>> +    (propagated-inputs `(("go-golang-org-x-text" ,go-golang-org-x-text)))
>
> Please use new-style inputs.

Ugh, +1, and sorry I missed this. I don't know why the importer doesn't
do this by default yet. I suppose that's another patch that needs to
happen.

I also don't know why `guix style` and `guix lint` didn't catch this.

>> +    (synopsis "Safe HTML for Go")
>
>   (synopsis "Go type for storing HTML data")

(see other response, wondering if we should take upstream synopses or
not)

>> +    (description
>> +     "Package safehtml provides immutable string-like types which represent values
>> +that are guaranteed to be safe, by construction or by escaping or sanitization,
>> +to use in various HTML contexts and with various DOM APIs.")
>
>   (description
>    "This package provides a Go library for storing HTML data as an immutable string-like
>   value.")

I disagree with this suggestion: the extra context about construction or
escaping takes me from "why would I want to store HTML data in a
struct", to, "oh this is a way to preclude passing around invalid/unsafe
HTML around".

-- 
Katherine

Message #31 received at submit <at> debbugs.gnu.org (full text, mbox):

From: "(" <paren <at> disroot.org>
To: "Katherine Cox-Buday" <cox.katherine.e <at> gmail.com>, "( via Guix-patches
 via" <guix-patches <at> gnu.org>
Cc: 60904 <at> debbugs.gnu.org
Subject: Re: [bug#60904] [PATCH 05/25] gnu: Add go-github-com-google-safehtml.
Date: Tue, 07 Feb 2023 17:45:15 +0000

[Message part 1 (text/plain, inline)]

On Tue Feb 7, 2023 at 4:41 PM GMT, Katherine Cox-Buday wrote:
> >> +    (description
> >> +     "Package safehtml provides immutable string-like types which represent values
> >> +that are guaranteed to be safe, by construction or by escaping or sanitization,
> >> +to use in various HTML contexts and with various DOM APIs.")
> >
> >   (description
> >    "This package provides a Go library for storing HTML data as an immutable string-like
> >   value.")
>
> I disagree with this suggestion: the extra context about construction or
> escaping takes me from "why would I want to store HTML data in a
> struct", to, "oh this is a way to preclude passing around invalid/unsafe
> HTML around".

That's true.  There's no problem with incorporating it, but many upstream descriptions
are a bit too focused on the internals for guix IMO.  So I tried to construct a
description that got the point across without being too detailed; I probably went
too far.  (Also, I know it's a Go convention, but I personally think we should
remove the "package <name> is ..." phrasing where possible.)

How about this instead:

  (description
   "This package provides a Go library for storing HTML data as an immutable string-like
  value that is guaranteed to be safe to use in various HTML- and DOM-related contexts.")

    -- (

[signature.asc (application/pgp-signature, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.