Is your feature request related to a problem? Please describe.
Decidim currently has dependencies for several external software libraries (“gems”) that have rather small communities. This causes a “bus factor” risk for the code base that can lead to awkward maintenance issues in case support is ended for some of these dependencies. Another risk is the low exposure of these gems to security audits and external testing which can lead, for example, to security vulnerabilities.
Describe the solution you'd like
To replace or remove:
Describe alternatives you've considered
I have initially identified some gems to be replaced by analyzing some metrics (such as stars, forks, etc) and thought that we should replace others (like doc2text, fog-local, doorkeeper-i18n...) but I was corrected by @ahukkanen as some of these changes didn't make much sense (like the risk was low because some are from specs) or there weren't any good alternatives.
Additional context
For transparency and to have it documented, here's the table with the gems that we analyzed.
| Gem |
My opinion |
Mainio Tech opinion |
Notes |
| doc2text |
Replace |
Keep |
Converts ODT documents to participatory texts within the proposals component. The only potential alternative that has recent commit history and a larger community is the henkei gem but it would also add a Java dependency for the Apache Tika toolkit. Current solution is more ruby like but needs to be kept an eye on. Could be considered for rewrite within Decidim but for the use case we don’t believe would be worth the effort. |
| w3c_rspec_validators |
Replace |
Keep |
Only used for testing workflows to ensure Decidim has valid HTML. The gem itself is a wrapper for w3c_validators which does an HTTP request to the well maintained W3C validation service and reads its response. Easy to replace in case necessary and does not affect Decidim applications. |
| anchored |
Replace |
Replace |
Used to create automatically links within proposals, debates and private messages. There is a more popular gem named rinku to provide similar functionality but does not seem to be actively maintained anymore. Required functionality to be rewritten within Decidim. |
| fog-local |
Replace |
Keep |
Required to store files locally in Decidim, so this is necessary after the move to ActiveStorage. The fog gem itself is well maintained and popular. This gem is maintained by the same organization. |
| nobspw |
Replace |
Replace |
Provides password matching against a known database of weak passwords. Create a similar password blacklist from a known source and check the passwords against that list within Decidim’s own validator. Required functionality to be rewritten within Decidim. |
| doorkeeper-i18n |
Replace |
Keep |
Provides locales for the Doorkeeper gem which is well maintained. Doorkeeper is needed for running Decidim as an oauth2 authentication provider. Doorkeeper itself is well maintained and this gem localizes it. |
| simplecov-cobertura |
Replace |
Keep |
Only a dependency for the testing workflows. Formats the code coverage reports for Cobertura. Does not affect Decidim applications. |
| truncato |
Replace |
Replace |
Used to truncate HTML texts to shorter texts that contain HTML markup before and after the truncation. Difficult to replicate all the functionality that the gem provides but it should be manageable to create a good enough alternative within Decidim that works for the Decidim use cases. |
| seven_zip_ruby |
Replace |
Keep |
Used to encrypt and password protect specific files in Decidim. There are no better maintained alternatives available that provide strong encryption for zip files. There has been some discussion for Rubyzip to incorporate AES encryption in that library but there is no recent activity regarding that. Keep an eye on the related discussion for Rubyzip or implement AES encryption to Rubyzip (search for “AES” from the repository pull requests). |
| wisper-rspec |
Replace |
Keep |
Only a dependency for the testing workflows. Allows writing rspec tests for the publish events within Decidim commands. Does not affect Decidim applications. |
| rspec-cells |
Replace |
Keep |
Only used for testing workflows. Allows testing the Decidim cells. Does not affect Decidim applications. |
| etherpad-lite |
Replace |
Replace |
Used to retrieve text through Etherpad API and retrieving Etherpad public or read-only IDs from the same API. Required functionality to be rewritten within Decidim. |
| searchlight/spotlight |
Replace |
Replace |
To be replaced with Ransack that provides similar functionality. |
| system_test_html_scr eenshots |
N/A |
Replace |
Takes screenshots of the browser test results for inspection during the test workflows. Dependency requirements are blocking Rails 6.1 update and the gem is not well maintained. Consists of one simple helper for the RSpec tests that can be moved to Decidim codebase. Required functionality to be moved to Decidim. |
Does this issue could impact on users private data?
It's a refactor, so it shouldn't change the behavior.
Funded by
Decidim Association
Note: this issue definition was largely made by @ahukkanen and @lahdeero, they explain it all really well, I just made some formatting 😄
Is your feature request related to a problem? Please describe.
Decidim currently has dependencies for several external software libraries (“gems”) that have rather small communities. This causes a “bus factor” risk for the code base that can lead to awkward maintenance issues in case support is ended for some of these dependencies. Another risk is the low exposure of these gems to security audits and external testing which can lead, for example, to security vulnerabilities.
Describe the solution you'd like
To replace or remove:
searchlightwithransackwhich is already a core dependency #8748Describe alternatives you've considered
I have initially identified some gems to be replaced by analyzing some metrics (such as stars, forks, etc) and thought that we should replace others (like doc2text, fog-local, doorkeeper-i18n...) but I was corrected by @ahukkanen as some of these changes didn't make much sense (like the risk was low because some are from specs) or there weren't any good alternatives.
Additional context
For transparency and to have it documented, here's the table with the gems that we analyzed.
Does this issue could impact on users private data?
It's a refactor, so it shouldn't change the behavior.
Funded by
Decidim Association
Note: this issue definition was largely made by @ahukkanen and @lahdeero, they explain it all really well, I just made some formatting 😄