[v3] package/chartjs: bump to version 3.9.1

Install only minified Javascript source.  No more CSS required.

https://github.com/chartjs/Chart.js/releases/tag/v3.9.1

License file has updated copyright years to 2014-2022.

Signed-off-by: Ignacy Gawędzki <ignacy.gawedzki@green-communications.fr>
---
 package/chartjs/Config.in    |  3 +++
 package/chartjs/chartjs.hash |  4 ++--
 package/chartjs/chartjs.mk   | 14 ++++++++------
 3 files changed, 13 insertions(+), 8 deletions(-)

Hello Ignacy,

On Tue, 13 Sep 2022 11:32:35 +0200
Ignacy Gawędzki <ignacy.gawedzki@green-communications.fr> wrote:

> Install only minified Javascript source.  No more CSS required.
> 
> https://github.com/chartjs/Chart.js/releases/tag/v3.9.1
> 
> License file has updated copyright years to 2014-2022.
> 
> Signed-off-by: Ignacy Gawędzki <ignacy.gawedzki@green-communications.fr>
> ---
>  package/chartjs/Config.in    |  3 +++
>  package/chartjs/chartjs.hash |  4 ++--
>  package/chartjs/chartjs.mk   | 14 ++++++++------
>  3 files changed, 13 insertions(+), 8 deletions(-)
> 
> diff --git a/package/chartjs/Config.in b/package/chartjs/Config.in
> index 73cc9b7750..c1cc717410 100644
> --- a/package/chartjs/Config.in
> +++ b/package/chartjs/Config.in
> @@ -1,4 +1,7 @@
>  config BR2_PACKAGE_CHARTJS
> +	depends on BR2_PACKAGE_HOST_QEMU_USER_ARCH_SUPPORTS # host-nodejs
> +	depends on BR2_HOST_GCC_AT_LEAST_8 # host-nodejs
> +	select BR2_PACKAGE_HOST_NODEJS
>  	bool "chartjs"
>  	help
>  	  Chart.js, a simple yet flexible JavaScript charting library
> diff --git a/package/chartjs/chartjs.hash b/package/chartjs/chartjs.hash
> index f8614ec385..85f131df40 100644
> --- a/package/chartjs/chartjs.hash
> +++ b/package/chartjs/chartjs.hash
> @@ -1,3 +1,3 @@
>  # Locally computed:
> -sha256  9ef3697e279a585c79730f35dba16ad4e24ddeed49a150adb341c31f191fb78e  chartjs-2.9.4.tar.gz
> -sha256  7b43caae91f31b18dc81fae6e0f7aa1acbecaa6d84e3249905cbe15308307d67  LICENSE.md
> +sha256  b94faf2699d1d3b44f8733b0d380c7db72c46dbccef7008ac88f2fec5bc4eb25  chartjs-3.9.1.tar.gz
> +sha256  5a0877ad6d818529be4f33009d0942cdf7e2ed7656156f4aba7308459a546030  LICENSE.md
> diff --git a/package/chartjs/chartjs.mk b/package/chartjs/chartjs.mk
> index 2748a94d36..720fa25091 100644
> --- a/package/chartjs/chartjs.mk
> +++ b/package/chartjs/chartjs.mk
> @@ -4,20 +4,22 @@
>  #
>  ################################################################################
>  
> -CHARTJS_VERSION = 2.9.4
> +CHARTJS_VERSION = 3.9.1
>  CHARTJS_SITE = $(call github,chartjs,Chart.js,v$(CHARTJS_VERSION))
>  CHARTJS_LICENSE = MIT
>  CHARTJS_LICENSE_FILES = LICENSE.md
>  CHARTJS_CPE_ID_VENDOR = chartjs
>  CHARTJS_CPE_ID_PRODUCT = chart.js
>  
> +CHARTJS_DEPENDENCIES = host-nodejs
> +
> +define CHARTJS_BUILD_CMDS
> +	cd $(@D) && $(NPM) install && $(NPM) run build

This is a bit worrying. What does it do? Does it download/install
additional stuff? If so, it breaks reproducibility of the build, the
download infrastructure logic, the legal-info logic, etc.

Could you provide more background on this?

Thanks!

Thomas

On Sat, Sep 17, 2022 at 03:17:55PM +0200, thus spake Thomas Petazzoni:
> Hello Ignacy,

Hi,

> [...]
> > +define CHARTJS_BUILD_CMDS
> > +	cd $(@D) && $(NPM) install && $(NPM) run build
> 
> This is a bit worrying. What does it do? Does it download/install
> additional stuff? If so, it breaks reproducibility of the build, the
> download infrastructure logic, the legal-info logic, etc.
> 
> Could you provide more background on this?

Yes, this downloads and builds additional stuff.  I'm about to send a
v4 with a package-lock.json file which makes the dependencies stick to
precise versions, in order to make the builds reproducible (the
package-lock.json file is locally generated, since it is not provided
upstream).

There are already ongoing discussions about the way several new javascript
packages (forge, openlayers, vue.js) are to be built.  Since
retrieving ready-to-use files from registry.npmjs.org is not an
option, these have to be built using host-nodejs.

For me, both ways do the job, please tell me which one to use and I'll
be happy with it.

Thanks.

Ignacy

Hello Ignacy,

On Mon, 19 Sep 2022 11:16:07 +0200
Ignacy Gawędzki <ignacy.gawedzki@green-communications.fr> wrote:

> Yes, this downloads and builds additional stuff.  I'm about to send a
> v4 with a package-lock.json file which makes the dependencies stick to
> precise versions, in order to make the builds reproducible (the
> package-lock.json file is locally generated, since it is not provided
> upstream).
> 
> There are already ongoing discussions about the way several new javascript
> packages (forge, openlayers, vue.js) are to be built.  Since
> retrieving ready-to-use files from registry.npmjs.org is not an
> option, these have to be built using host-nodejs.
> 
> For me, both ways do the job, please tell me which one to use and I'll
> be happy with it.

We discussed this package (and another JS library with the same issue)
during the Buildroot Developers Meeting this week-end.

The consensus is that for now we prefer to continue using the
pre-generated JS files. Indeed, building host-nodejs is super long, and
very annoying just to get a small JS library built.

Longer term, what we would like is:

 - Be able to use a pre-compiled NodeJS for the host instead of
   building our own host-nodejs. This is what we already do for Rust.

 - Implement vendoring support for NodeJS packages, like we have done
   for Go and Rust. Vendoring support means that the "npm install" part
   that downloads the dependencies would be done during the download
   step, and all dependencies would be integrated inside the package
   tarball in DL_DIR.

So for your next revision of the patch, you can switch back to using
the pre-generated JS files. Then if you are brave and want to give a
try at implementing the two points mentioned above, it would be amazing!

Thanks a lot!

Thomas

On Mon, Sep 19, 2022 at 11:46:17AM +0200, thus spake Thomas Petazzoni:
> So for your next revision of the patch, you can switch back to using
> the pre-generated JS files. Then if you are brave and want to give a
> try at implementing the two points mentioned above, it would be amazing!

Then I'll switch back to pre-generated JS files for now.  For the
moment, I'm too much in a hurry to be brave.

The v2-as-v4 is coming in the next post.

Ignacy