Files
markdown-converter/tests/bundled-tools.test.js
T
amitwh 1e24b52f3e feat(legal): bundle small dependencies, add notices, credits, and GPL source offers
Bundle (v4.7.0):
- MarkItDown frozen to a single ~75MB per-platform binary (PyInstaller via
  npm run bundle:markitdown; ML extras excluded) — built and verified
  locally: HTML/XLSX/PDF conversions pass through the bundled binary, and
  the app resolves bin/linux/markitdown first at runtime
- Packaging copies bundled markitdown alongside Pandoc for win/mac/linux;
  FFmpeg/sharp/KaTeX/fonts were already bundled

Legal artifacts:
- THIRD-PARTY-NOTICES.md: complete license inventory of everything
  distributed (binaries, npm runtime deps, fonts, embedded Python packages)
- SOURCES.md: GPL §3(b) written source offers for Pandoc 3.9.0.2,
  ffmpeg-static's GPL build, and the PyInstaller bootloader; LGPL relinking
  note for libvips
- third-party-licenses/: canonical GPL-2.0, LGPL-2.1, MPL-2.0, Apache-2.0,
  OFL-1.1, PSF-Python texts
- Help > Third-Party Notices & Licenses: in-app viewer for both documents
- README: 'Bundled Dependencies, Legal Notices & Credits' section

Hardening:
- download-tools.js now SHA-256 pins every artifact, verifies after
  download AND against the cache on every run, and hard-fails on mismatch
  (closes security finding D6)

Large tools intentionally not bundled (documented): LibreOffice,
MiKTeX/TeX Live, ImageMagick, PlantUML+JRE, Calibre.

637/637 tests green; lint clean; clean boot; bundled binary verified.
2026-09-05 22:30:54 +05:30

96 lines
3.7 KiB
JavaScript

/**
* Tests for bundled external tools
*/
const fs = require('fs');
const path = require('path');
describe('Bundled Pandoc binary', () => {
const rootDir = path.resolve(__dirname, '..');
const platform = process.platform;
const binaryPath = path.join(rootDir, 'bin', platform, 'pandoc');
const windowsBinaryPath = path.join(rootDir, 'bin', platform, 'pandoc.exe');
test('Pandoc binary exists for current platform', () => {
const exists = fs.existsSync(binaryPath) || fs.existsSync(windowsBinaryPath);
expect(exists).toBe(true);
});
test('Pandoc binary is executable', () => {
if (platform === 'win32') {
expect(fs.existsSync(windowsBinaryPath)).toBe(true);
} else {
expect(fs.existsSync(binaryPath)).toBe(true);
const stats = fs.statSync(binaryPath);
expect(stats.mode & 0o111).toBeGreaterThan(0);
}
});
});
describe('Bundled MarkItDown binary (optional)', () => {
const rootDir = path.resolve(__dirname, '..');
const platform = process.platform;
const binaryPath = path.join(rootDir, 'bin', platform, 'markitdown');
const windowsBinaryPath = path.join(rootDir, 'bin', platform, 'markitdown.exe');
// The binary is built on demand (npm run bundle:markitdown), so CI machines
// that haven't built it yet skip these — but when present it must be valid.
const hasBinary = fs.existsSync(binaryPath) || fs.existsSync(windowsBinaryPath);
const which = platform === 'win32' ? windowsBinaryPath : binaryPath;
(hasBinary ? describe : describe.skip)('binary present', () => {
test('is executable', () => {
const stats = fs.statSync(which);
expect(stats.mode & 0o111).toBeGreaterThan(0);
});
test('answers --version', (done) => {
const { execFile } = require('child_process');
execFile(which, ['--version'], { timeout: 30000 }, (error, stdout) => {
expect(error).toBeNull();
expect(stdout.toLowerCase()).toContain('markitdown');
done();
});
}, 60000);
});
});
describe('Legal compliance artifacts', () => {
const rootDir = path.resolve(__dirname, '..');
test('THIRD-PARTY-NOTICES.md and SOURCES.md ship at the repo root', () => {
expect(fs.existsSync(path.join(rootDir, 'THIRD-PARTY-NOTICES.md'))).toBe(true);
expect(fs.existsSync(path.join(rootDir, 'SOURCES.md'))).toBe(true);
});
test('canonical copyleft license texts are present', () => {
for (const file of ['GPL-2.0.txt', 'LGPL-2.1.txt', 'MPL-2.0.txt', 'Apache-2.0.txt', 'OFL-1.1.txt']) {
expect(fs.existsSync(path.join(rootDir, 'third-party-licenses', file))).toBe(true);
}
});
test('notices mention every bundled external binary', () => {
const notices = fs.readFileSync(path.join(rootDir, 'THIRD-PARTY-NOTICES.md'), 'utf-8');
for (const component of ['Pandoc', 'FFmpeg', 'MarkItDown', 'libvips', 'KaTeX', 'JetBrains Mono']) {
expect(notices).toContain(component);
}
// GPL source offer must reference the sources document
expect(notices).toContain('SOURCES.md');
});
test('SOURCES.md covers every GPL-licensed binary with a source link', () => {
const sources = fs.readFileSync(path.join(rootDir, 'SOURCES.md'), 'utf-8');
for (const section of ['Pandoc', 'FFmpeg', 'PyInstaller', 'libvips']) {
expect(sources).toContain(section);
}
expect(sources).toMatch(/https:\/\/github\.com\/jgm\/pandoc/);
expect(sources).toMatch(/https:\/\/ffmpeg\.org\/releases\//);
});
test('packaging includes the legal documents in build.files', () => {
const pkg = JSON.parse(fs.readFileSync(path.join(rootDir, 'package.json'), 'utf-8'));
expect(pkg.build.files).toContain('THIRD-PARTY-NOTICES.md');
expect(pkg.build.files).toContain('SOURCES.md');
});
});