Vendored library policy
To simplify Bleach development, we're now vendoring certain libraries that
we use.
Vendored libraries must follow these rules:
- Vendored libraries must be pure Python--no compiling.
- Source code for the libary is included in this directory.
- License must be included in this repo and in the Bleach distribution.
- Requirements of the library become requirements of Bleach.
- No modifications to the library may be made.
Adding/Updating a vendored library
Way to vendor a library or update a version:
- Update vendor.txt with the library, version, and hash. You can use
hashin.
- Remove all old files and directories of the old version.
- Run pip_install_vendor.sh and check everything it produced in including
the .dist-info directory and contents.
Reviewing a change involving a vendored library
Way to verify a vendored library addition/update:
- Pull down the branch.
- Delete all the old files and directories of the old version.
- Run pip_install_vendor.sh.
- Run git diff and verify there are no changes.