688073 - Add UglifyJS/CleanCSS to addons-dev

Status: RESOLVED FIXED

(Infrastructure & Operations Graveyard :: WebOps: Other, task)

Description

[Gregory Koberger (:gkoberger)]

We need to add UglifyJS to https://addons-dev.allizom.org/

1) Install uglify (something like "npm install uglify-js")
2) Add this to settings_local.py: UGLIFY_BIN = 'uglifyjs'

3) You can test to make sure things worked by running "manage.py compress_assets".  If there's no errors, we should be good to go.

Note that the npm package is called "uglify-js", however the command itself is "uglifyjs".

This is for addons-dev only; not prod.  Let me know if there's any other info you need.  Thanks!

More about UglifyJS: https://github.com/mishoo/UglifyJS

Comment 1

[Wil Clouser [:clouserw]]

If you install the packages on prod now, we don't need another bug and we can adjust the settings_local when we do a push.  If you want to install packages on prod during a push, let me know and I'll add it to the push notes.

Comment 2

[Gregory Koberger (:gkoberger)]

I was going to create another bug, but I figure it'd be easier for IT if I just put this here.  If not, I can split them up.

We also need "clean-css", which can be installed the same way as above on addons-dev (and prod, if you'd prefer to do that now).

https://github.com/GoalSmashers/clean-css

COMPLETE RECAP:

1) Install UglifyJS addons-dev (and prod?):
   npm install uglify-js

2) Install Clean-CSS on addons-dev (and prod?):
   npm install clean-css

3) Update settings_local.py on addons-dev (not prod):
   UGLIFY_BIN = 'uglifyjs'
   CLEANCSS_BIN = 'cleancss'

Comment 3

[Jeremy Orem [:oremj]]

As we install more node packages it is becoming difficult to maintain RPMs for all of them.

In this case we are asked to install two node packages: uglifyjs and cleancss, but cleancss has a dependency, "optimist" and "optimist" has the dependency "wordwrap". I haven't checked if wordwrap has any dependencies.

We need to figure out a better way of installing these. NPM is fine with me, but security will need to sign off on its use first, so assigning this bug to security to look at NPM.

Comment 4

[Wil Clouser [:clouserw]]

Any updates?

Comment 5

[Corey Shields [:cshields]]

(In reply to Wil Clouser [:clouserw] from comment #4)
> Any updates?

will try to raise more infrasec eyes..

Comment 6

[Joe Stevensen [:joe]]

Talked about this in IRC with petef. To reiterate:

You would like to create custom RPMs for a given application and that RPM will install the necessary NPM's (node.js packages) and it's dependencies. The RPMs will be deployed via puppet. In the event that a NPM needs to be updated (bugfix or security fix), the RPM will be updated and a new version deployed via puppet.

We're ok with this approach. We don't see any additional risk in doing this. However we would like to see documentation on custom RPMs. We want to make sure we are able to keep track of the versions of software used in these RPMs and that these RPMs are maintained.

Comment 7

[Potch [:potch]]

Joe,

NPM is the Node Package Manager (http://npmjs.org/), and not a custom packaging solution. We're looking for infrasec input into whether you would feel comfortable with using said manager to install these packages into our server environment instead of trying to juggle RPMs.

Comment 8

[Jeremy Orem [:oremj]]

I think we've decided to make rpms for each node package (https://github.com/oremj/npm2rpm/) and then deploy those rpms via puppet.

Comment 9

[Jeremy Orem [:oremj]]

As far as keeping a list, you can assume that all packages of the form nodejs-<name>*rpm in the mozilla rpm repository are custom RPMs built by npm2rpm.

Comment 10

[Jeremy Orem [:oremj]]

cleancss and uglifyjs have been installed on the addons admin server.