MathJax, npm and LibreJS

[Gavin Smith]

I would like advice on how to refer to MathJax JS libraries (for use
by the texi2any program and HTML produced for Texinfo manuals), and
in general libraries provided through npm.

I have read

https://www.gnu.org/software/librejs/free-your-javascript.html

and this:

https://www.gnu.org/licenses/javascript-labels.html

However, this part of the second link has a problem:

> The third cell provides a link to the JavaScript's source code. The
> source code file can be a single, unminified JavaScript file, a
> .tar.gz archive, or a .zip archive. If a source archive includes
> multiple JavaScript files, the archive must include a file named
> 00-INDEX that lists the order in which individual source files should
> be concatenated to produce a single file that's equivalent to what's
> hosted on the site.

This doesn't seem to cover projects that produce JavaScript files by
some complex build process that is more than just concatenating files.
For example, MathJax uses npm to download dependencies and to build
the JavaScript files.  These instructions appear to be correct:

http://docs.mathjax.org/en/latest/web/hosting.html#mathjax-git

The "component files" referred to there are the JavaScript files that
an HTML file needs to refer to.

I have not seen much discussion of npm in relation to the LibreJS
initiative, but from my understanding of it it is quite problematic.
If users are going to be able to access to the source code of
JavaScript programs then they need to be able to download all of
the dependencies too.  npm provides these dependencies through a
centralised repository, but this may change or break over time
depending on the decisions and wishes of package developers
and/or npm Inc. (a subsidiary of Microsoft).  This famously
happened in 2016 when a commonly-used package was unpublished:
https://www.theregister.com/2016/03/23/npm_left_pad_chaos/

Hence, what I have in mind to do is to bundle the MathJax source with
all of its dependencies along with a README file explaining how to
build it using npm.   After getting the most recent version from git,
run "npm install", and then create a tarball of everything you get.
I would reference an upload of this tarball in the third column of
the labels table.

Would this be a good approach for using MathJax or any other npm
package?

This would provide a backstop in case npm and/or MathJax stop
distributing all the necessary source code.  Unfortunately, this
is a huge file: 205M.  Users could be directed to MathJax's own
instructions in the first instance, so they may not be downloading
the huge file that often: it is just there in case npm and/or MathJax
break in the future.

I imagine that each entity with a webpage referencing MathJax would
distribute this file if they wanted to make sure the source code for
it was available (even if this wasn't required by the licences of
MathJax or its dependencies).

For example, the GNU project could have one upload of this file that
the Texinfo manuals of GNU packages could refer to.  Other entities
could provide copies separately to avoid the problem of centralised
hosting (in principle it is bad whether the FSF or npm Inc. does it).

PS I am not really looking for criticism of the idea of using MathJax
with Texinfo here.  If anybody wants to discuss that, please write to
bug-texinfo@gnu.org.