State of the javascript

oh no it's now okay let's go thank you very much for being here I think the last talk for of the morning uh Bastian rarez is going to talk to us about the state of JavaScript in Dean I'm really very grateful that someone else than me is taking care of that thank you so I am Roa I am Debian developer I work mainly on image magic but is High popcorn packages and today also I will present my work on JavaScript so uh a contents warning please if you are if you studed theorical computer science uh pass your way if you think that well are better Ru than Square ra pass your way also and if you think that reason gr the world it's not for you so for first historical problem is that it is a packages with a popcorn weekly popcorn of half a million and this packages is dedicated to test if a number is odd so uh there are also the version for is even if you need it not is odd does not work uh notice that we have seven ver and free meur ver for of these packages one dependency of this packages is his number but and uh FTP Master remarked that the metadata is more than the Cod and um first approach was to patch every package because we have half about 1,000 reverse depends of these packages so we patch it uh every packages but it's done not Square well so the solution was thanks to Raphael to use something that was not considered for this is was multiple Upstream packages us it mainly for liber liber need a packages for COD a packages for Doc and another packages for some for translation so we we we need to pack them in one packages so RAF do the hard work the problem was it was ConEd only for a package with a single version or us we need to put small small packages with different version so the idea is was to use concatenation of versioning this is is a wellknown JavaScript sham and we could not use plus because we uh we take we conflict with the Security Plus so we use plus till because we are after but before it work until I eat the path Mass limits due to rock rock jolet cd5 system that is uh 127 sh sh not you B and but I ignore it because I think we need CD after this day the problem is that I eat a not well exercised cod paff in deck so I crush it duck due to versioning I I think I must be thinking by FTP master I exercise some well known not wellknown code paath um the problem is that even if D was fixed I am it uh the name Max limit because ER is not a release architecture so if my package name with version exceed uh two 255 sh I could not name the package so I need something that was strictly increasing function of version the idea of fad was oh fortunately every package ver JavaScript package is major minor patch so or we could use add as an increasing version so let's do your homwork I have a component a main component 206 I have a component one 2 4 a component 2 2.1 a component 3 10 Z the result is 20.6 plus till shum 13.2 do5 and it's strictly increasing if I increase one of the version we get youan stort [Laughter] work of myself and Y it perfectly work it was use that for before it was not free but you see the idea it was documented in You Man pages I think we must if we have any volunteer in the room for put this in Dean policy please ask I need volunteer our problem shum is not compatible with dfsg and of individual versioning where should I put the dffg in the cheum I could not add G is not a number okay shum is not compatible with jit versioning fortunately sh sha is not an increasing version is not increasing with verion it's a cryptographic ash so if verion is one more sha will not be one more so how can I pass jit versioning to this Sham this need to be documenting in the policy the problem also is that versioning in Debian is not fully specified so what name means every I suppose everybody in the room know what mean this vering dfsg plus Deb um 11 U1 till the Deb 10 U1 what is it any idea it is a back Port of security fix from bookr to Bull and it is the only safe version SC do you know that backport work only by luck against security support because a b is before d it work in in some case not all uh do you know uh uh do you see documentation for the plus ready suffix no so I have open a bug against Dev please comment and get consensus uh another problem what is a new version for youan and tracker from for now we consider that a new version and remember on usan is when the main version increase not the component increase we need technically it could be solved but we need policy and process and documentation so now we get the sources of every small package is EV is odd I suppose you follow it okay so develper is not ready for 10 20 components to be compilated separately so first we try to use a loop in bash in the make file is it not scalable so y had invented pgs tools that is a th wrapper WR in P in order to compete it from the documentation what they do so we wrap on dash uh Auto configurer and we populate everything right we build by launching shell extract from do Debian GS component name build and we run in the right order we run also auto test not that we populate build variable that is not version every sub component get virtual providers so you can Depends for instance if you want to depend on node even that is packages no odd you say you use nod TR even eal some verion it work because we use Virtual provide problem brakes doesn't work because braks doesn't work against virtual provides example if you want to see that is the tree of one of the packages with a small snippet in every directory in no icon so it is workable we have some process and it could work okay now we went this was the past we go to the present uh JavaScript is now compiled it we have no JavaScript packages there are always comped from typescript that gu type um check we use often rollup and web pack the definition of web pack it take the dependency generates a dependency graph allowe web developer to use a modular approach from we application development purpose for me it's ring a bell it's oh GCC it's the same definition by GCC GCC what is a GCC it's a program I take a graph and generate machine code so we have a new arh triplate Brer White Park es 2023 also we have some sub AR we compile from s 2023 but we could compile from an older CPU virtual CPU that is es6 some but we are also some incompatible well pack Packer computer Brer R so and mute thanks for your work on Cross competing we are cross competing statically against a virtual CPU all so on the deban side I reassure you we try to avoid static linking and we do import we patch the packages if you can by importing dynamically the library so you we try to avoid add static packing uh so news of years everything is Javascript I need some C library compil to JavaScript for instance I need a regs extended raps library to be comped in JavaScript so we can oh why do we reinvent to well take libz and compete it to JavaScript and get it on the browser all uh do security team know about this Upstream way of life is to take a copy of the C library on GitHub add on the RO directory some ja JavaScript B P code and then statically link using sang to JavaScript then web pack do you know what is w i ASM oh JavaScript was too slow so we Implement a binary layer virtual CPU in your browser so now we compile C to WM or C to Java to JavaScript to WM plan the plan for me simple is to inject uh we need to use multistream table to inject JavaScript B plates in CBR packages and we use sim link to get the compilation right then make problem starting linking mean using we are ready technically but we need process and policy we create binary package that AR all I need B binary non- Mainer upload for as all we do really team work JavaScript doob when we so BM and the problem is that I need n Mainer upload for I pop package for JavaScript policy process if I went to compile to WM Li Z I need so it's not the mainten work to maintain the JavaScript Bower plate and WM need to be handled for me the longterm way will be to have a partial arh isomorph to arall JavaScript may need to be interested so previous week work I attri to get salsa to uh to test all my reverse depths for me thanks to Josh so here you see no types script measure s so BMP and I try everything on salsa automatically you commit you recom it's work on progress I need thanks to Josh I need to Upstream this to salci infrastructure R team is interested ASW team also does read team see also and maybe we will get Auto package test on salsa okay now next stream CGS versus MGS is two JavaScript way of plugin that are incompatible package a in common JavaScript need package B version two in common JavaScript Package C in MGS need package B VRA in MGS package D need unmade code for link A and B andac statically everything here we lost security team so we create a fin rer that convert MGS to CGS so only one sources version if bv2 and vitra are a compatible but not AB compatible it work now we will talk a large part of problem that is problem between share and keyboard every I think there are no lot of talk about this but some VM s are lost but included in major project but are said safe because they they were compilated from R but sources are lost Implement another thing that is really funny some people impl cryptographic uh procedure in JavaScript because they need it for wallet of coin in the Brower uh sorry but Gade multiplication is sensitive to time Channel attack and I cannot prove that virtual machine is time sensitive safe because it's like proving Val problem so sorry no way interpersonal problem I will not talk about a pack package was banned for npm due to security problem and need an appy change in order to be secure I do not want to update th I created a new package from B verion with a new name philosophical open problem about code Beauty I have some FR due to some tab usage and I'm that cut Source new program web pack are bad so we invent a new a new warer tshai TSH need some package I they need ja V2 but need package B comp Jack V V3 TI need to be comped boing L problem I need a time machine because Upstream made andmade par that does not publish uh and this the problem is that also I need a DOT expert in order to avoid Loop in Reverse depth we have bootstrapping L conclusion we could not avoid JavaScript we need it for taxes declaration and for me I need it for the food of my to choose the food of my side at the school so JavaScript team is small help is welcome we solve real problem in the de infrastructure we solve security problem we are only three French guy cap Y and myself longterm goal my long it Ro compile Firefox from Debian sources and chromium any question [Applause] yeah yeah uh elut as Alpha question because we only have five seconds thank you I think you mentioned built using on one of your slides are you aware of the distinction introduced by the go team between static buildt using and built using one is for licensing reasons and one is for security and we use it for static linking yeah so consider replacing that with a different head of static build using inspired by the go team okay so we need to PCH thank you for the idea I think we are down in time uh it's um uh lunchtime um there's cheese stuff okay see you soon thank you [Applause]