Pull web-animations-js into third-party via the third_party/polymer/reproduce.sh script. Add necess…

Pull web-animations-js into third-party via the third_party/polymer/reproduce.sh script. Add necessary third_party bits.

R=cpu, dzhioev
BUG=424574
Committed: https://crrev.com/bcadd727094404da8b8db634f24ca3c92d4ffa59
Cr-Commit-Position: refs/heads/master@{#317119}

[Jeremy Klein, 2015-02-11 00:02:15]

See https://codereview.chromium.org/864173009/ for some more context on this.

https://codereview.chromium.org/917523002/diff/1/third_party/web-animations-j...
File third_party/web-animations-js/README.chromium (right):

https://codereview.chromium.org/917523002/diff/1/third_party/web-animations-j...
third_party/web-animations-js/README.chromium:4: Version: 1.0.5
Do you guys have any idea how I might be able to update this in reproduce.sh?

[michaelpg, 2015-02-11 00:02:20]

On 2015/02/10 23:56:55, Jeremy Klein wrote:

1. shouldn't web-animations-js be included in bower.json so we can specify the
exact version?
2. maybe we should keep this simple and save the mass-charset-change for a
separate CL. same with paper-dropdown[-menu].

[Jeremy Klein, 2015-02-11 00:07:21]

On 2015/02/11 00:02:20, michaelpg wrote:
> On 2015/02/10 23:56:55, Jeremy Klein wrote:
> 
> 1. shouldn't web-animations-js be included in bower.json so we can specify the
> exact version?
> 2. maybe we should keep this simple and save the mass-charset-change for a
> separate CL. same with paper-dropdown[-menu].

1) I tried to do that but got presubmit errors about missing bower deps because
the directory was moved. Any idea how to work around that?

2) paper-dropdown stuff isn't in this cl. I can move out the char-set stuff to
another cl if you want, but I figured it was relatively easy to ignore.

[Jeremy Klein, 2015-02-11 00:11:59]

On 2015/02/11 00:07:21, Jeremy Klein wrote:
> On 2015/02/11 00:02:20, michaelpg wrote:
> > On 2015/02/10 23:56:55, Jeremy Klein wrote:
> > 
> > 1. shouldn't web-animations-js be included in bower.json so we can specify
the
> > exact version?
> > 2. maybe we should keep this simple and save the mass-charset-change for a
> > separate CL. same with paper-dropdown[-menu].
> 
> 1) I tried to do that but got presubmit errors about missing bower deps
because
> the directory was moved. Any idea how to work around that?
> 
> 2) paper-dropdown stuff isn't in this cl. I can move out the char-set stuff to
> another cl if you want, but I figured it was relatively easy to ignore.

Sent out https://codereview.chromium.org/911353002/ for the utf8 thing.

[dzhioev (left Google), 2015-02-11 09:49:51]

On 2015/02/11 00:07:21, Jeremy Klein wrote:
> On 2015/02/11 00:02:20, michaelpg wrote:
> > On 2015/02/10 23:56:55, Jeremy Klein wrote:
> > 
> > 1. shouldn't web-animations-js be included in bower.json so we can specify
the
> > exact version?
> > 2. maybe we should keep this simple and save the mass-charset-change for a
> > separate CL. same with paper-dropdown[-menu].
> 
> 1) I tried to do that but got presubmit errors about missing bower deps
because
> the directory was moved. Any idea how to work around that?

I explicitly whitelisted web-animations in PRESUBMIT.py, you could do the same.
See this patch for reference:
git show a2233fb20e080b111488a49c81e438607bb4f907 --
third_party/polymer/PRESUBMIT.py

[dzhioev (left Google), 2015-02-11 10:07:28]

https://codereview.chromium.org/917523002/diff/40001/third_party/polymer/repr...
File third_party/polymer/reproduce.sh (right):

https://codereview.chromium.org/917523002/diff/40001/third_party/polymer/repr...
third_party/polymer/reproduce.sh:17: # Remove everything in web-animations-js
except README.chromium and OWNERS.
Let's put web-animations sources to some subdirectory of
third_party/web-animations-js, e.g. third_party/web-animations-js/src. It'll
make this script much simpler.

[Jeremy Klein, 2015-02-11 20:07:26]

Fixed the PRESUBMIT.py too.

https://codereview.chromium.org/917523002/diff/40001/third_party/polymer/repr...
File third_party/polymer/reproduce.sh (right):

https://codereview.chromium.org/917523002/diff/40001/third_party/polymer/repr...
third_party/polymer/reproduce.sh:17: # Remove everything in web-animations-js
except README.chromium and OWNERS.
On 2015/02/11 10:07:28, dzhioev wrote:
> Let's put web-animations sources to some subdirectory of
> third_party/web-animations-js, e.g. third_party/web-animations-js/src. It'll
> make this script much simpler.

There's already a src folder in web-animations-js so I think that would be a bit
confusing. Are you suggesting something like:

web-animations-js
  |_ README.chromium
  |_ OWNERS
  |_ sources
    |_ <everything actually in web-animations-js>

Is there any precedent in Chrome for this sort of thing already?

[Jeremy Klein, 2015-02-11 22:04:50]

jlklein@chromium.org changed reviewers:
+ felt@chromium.org

[Jeremy Klein, 2015-02-11 22:05:18]

+felt@ for security.

[dzhioev (left Google), 2015-02-12 10:00:30]

On 2015/02/11 20:07:26, Jeremy Klein wrote:
> Fixed the PRESUBMIT.py too.
> 
>
https://codereview.chromium.org/917523002/diff/40001/third_party/polymer/repr...
> File third_party/polymer/reproduce.sh (right):
> 
>
https://codereview.chromium.org/917523002/diff/40001/third_party/polymer/repr...
> third_party/polymer/reproduce.sh:17: # Remove everything in web-animations-js
> except README.chromium and OWNERS.
> On 2015/02/11 10:07:28, dzhioev wrote:
> > Let's put web-animations sources to some subdirectory of
> > third_party/web-animations-js, e.g. third_party/web-animations-js/src. It'll
> > make this script much simpler.
> 
> There's already a src folder in web-animations-js so I think that would be a
bit
> confusing. Are you suggesting something like:
> 
> web-animations-js
>   |_ README.chromium
>   |_ OWNERS
>   |_ sources
>     |_ <everything actually in web-animations-js>
Yes, that is what I'm suggesting.

> Is there any precedent in Chrome for this sort of thing already?

Many of them:
> $ ls -d third_party/*/src | wc -l
> 42
> $ ls -d third_party/*/src/src | wc -l
> 6

[Jeremy Klein, 2015-02-12 19:28:28]

On 2015/02/12 10:00:30, dzhioev wrote:
> On 2015/02/11 20:07:26, Jeremy Klein wrote:
> > Fixed the PRESUBMIT.py too.
> > 
> >
>
https://codereview.chromium.org/917523002/diff/40001/third_party/polymer/repr...
> > File third_party/polymer/reproduce.sh (right):
> > 
> >
>
https://codereview.chromium.org/917523002/diff/40001/third_party/polymer/repr...
> > third_party/polymer/reproduce.sh:17: # Remove everything in
web-animations-js
> > except README.chromium and OWNERS.
> > On 2015/02/11 10:07:28, dzhioev wrote:
> > > Let's put web-animations sources to some subdirectory of
> > > third_party/web-animations-js, e.g. third_party/web-animations-js/src.
It'll
> > > make this script much simpler.
> > 
> > There's already a src folder in web-animations-js so I think that would be a
> bit
> > confusing. Are you suggesting something like:
> > 
> > web-animations-js
> >   |_ README.chromium
> >   |_ OWNERS
> >   |_ sources
> >     |_ <everything actually in web-animations-js>
> Yes, that is what I'm suggesting.
> 
> > Is there any precedent in Chrome for this sort of thing already?
> 
> Many of them:
> > $ ls -d third_party/*/src | wc -l
> > 42
> > $ ls -d third_party/*/src/src | wc -l
> > 6

Done.

[felt, 2015-02-13 03:22:29]

felt@chromium.org changed reviewers:
+ jww@chromium.org
- felt@chromium.org

[felt, 2015-02-13 03:23:03]

felt@chromium.org changed reviewers:
+ felt@chromium.org

[felt, 2015-02-13 03:23:05]

jww@ is probably a better security reviewer for this, I think he had some
conversations with the Polymer team. jww, can you review this?

[dzhioev (left Google), 2015-02-13 12:28:26]

You forgot to remove several dot-files in third_party/web-animations-js after
moving sources to 'sources/'.


> jww@ is probably a better security reviewer for this, I think he had some
> conversations with the Polymer team. jww, can you review this?

Did you send a link to this review to security@chromium.org, as stated in
http://www.chromium.org/developers/adding-3rd-party-libraries ? I think they can
find a proper reviewer for this.

https://codereview.chromium.org/917523002/diff/100001/third_party/polymer/rep...
File third_party/polymer/reproduce.sh (right):

https://codereview.chromium.org/917523002/diff/100001/third_party/polymer/rep...
third_party/polymer/reproduce.sh:22: rm -rf
components/web-animations-js/node_modules
rm -rf components/web-animations-js/{test,node_modules}

https://codereview.chromium.org/917523002/diff/100001/third_party/polymer/rep...
third_party/polymer/reproduce.sh:26: rm -rf components/web-animations-js
Lines 23-26 could be replaced with a single line:
mv components/web-animations-js ../web-animations-js/sources

https://codereview.chromium.org/917523002/diff/100001/third_party/polymer/rep...
third_party/polymer/reproduce.sh:27: mv ../web-animations-js/sources/COPYING
../web-animations-js/sources/LICENSE
cp ../web-animations-js/sources/COPYING ../web-animations-js/LICENSE

[dzhioev (left Google), 2015-02-13 12:32:53]

On 2015/02/13 12:28:26, dzhioev wrote:
> > jww@ is probably a better security reviewer for this, I think he had some
> > conversations with the Polymer team. jww, can you review this?
> 
> Did you send a link to this review to mailto:security@chromium.org, as stated
in
> http://www.chromium.org/developers/adding-3rd-party-libraries ? I think they
can
> find a proper reviewer for this.
> 

Never mind, I thought I was replying to Jeremy.

[felt, 2015-02-13 15:00:56]

On 2015/02/13 12:32:53, dzhioev wrote:
> On 2015/02/13 12:28:26, dzhioev wrote:
> > > jww@ is probably a better security reviewer for this, I think he had some
> > > conversations with the Polymer team. jww, can you review this?
> > 
> > Did you send a link to this review to mailto:security@chromium.org, as
stated
> in
> > http://www.chromium.org/developers/adding-3rd-party-libraries ? I think they
> can
> > find a proper reviewer for this.
> > 
> 
> Never mind, I thought I was replying to Jeremy.

Someone did e-mail security@chromium.org about this several months ago. I
happened to be sheriff and did a cursory review at that time, with my chief
concern being that I wanted to know how we were going to keep pace with
Polymer changes given that Polymer is still under very active development.
It looks like third_party/polymer/reproduce.sh is meant to assuage that
concern.

The next question is whether this polymer code is going to introduce XSS
bugs where it's used. I was hoping jww could take a look at that since
that's one of his areas of strength. If he doesn't have time though, another
e-mail to security@chromium.org will be in order since it's been a few
months since the first one and I'm no longer sheriff. :)

[Jeremy Klein, 2015-02-13 18:26:41]

On 2015/02/13 12:28:26, dzhioev wrote:
> You forgot to remove several dot-files in third_party/web-animations-js after
> moving sources to 'sources/'.

Done.

> 
> 
> > jww@ is probably a better security reviewer for this, I think he had some
> > conversations with the Polymer team. jww, can you review this?
> 
> Did you send a link to this review to mailto:security@chromium.org, as stated
in
> http://www.chromium.org/developers/adding-3rd-party-libraries ? I think they
can
> find a proper reviewer for this.

Done.

> 
>
https://codereview.chromium.org/917523002/diff/100001/third_party/polymer/rep...
> File third_party/polymer/reproduce.sh (right):
> 
>
https://codereview.chromium.org/917523002/diff/100001/third_party/polymer/rep...
> third_party/polymer/reproduce.sh:22: rm -rf
> components/web-animations-js/node_modules
> rm -rf components/web-animations-js/{test,node_modules}
> 
>
https://codereview.chromium.org/917523002/diff/100001/third_party/polymer/rep...
> third_party/polymer/reproduce.sh:26: rm -rf components/web-animations-js
> Lines 23-26 could be replaced with a single line:
> mv components/web-animations-js ../web-animations-js/sources
> 
>
https://codereview.chromium.org/917523002/diff/100001/third_party/polymer/rep...
> third_party/polymer/reproduce.sh:27: mv ../web-animations-js/sources/COPYING
> ../web-animations-js/sources/LICENSE
> cp ../web-animations-js/sources/COPYING ../web-animations-js/LICENSE

[Jeremy Klein, 2015-02-13 18:27:14]

https://codereview.chromium.org/917523002/diff/100001/third_party/polymer/rep...
File third_party/polymer/reproduce.sh (right):

https://codereview.chromium.org/917523002/diff/100001/third_party/polymer/rep...
third_party/polymer/reproduce.sh:22: rm -rf
components/web-animations-js/node_modules
On 2015/02/13 12:28:26, dzhioev wrote:
> rm -rf components/web-animations-js/{test,node_modules}

Done.

https://codereview.chromium.org/917523002/diff/100001/third_party/polymer/rep...
third_party/polymer/reproduce.sh:26: rm -rf components/web-animations-js
On 2015/02/13 12:28:26, dzhioev wrote:
> Lines 23-26 could be replaced with a single line:
> mv components/web-animations-js ../web-animations-js/sources

Done.

https://codereview.chromium.org/917523002/diff/100001/third_party/polymer/rep...
third_party/polymer/reproduce.sh:27: mv ../web-animations-js/sources/COPYING
../web-animations-js/sources/LICENSE
On 2015/02/13 12:28:26, dzhioev wrote:
> cp ../web-animations-js/sources/COPYING ../web-animations-js/LICENSE

Done.

[Daniel Berlin, 2015-02-13 18:32:00]

dannyb@google.com changed reviewers:
+ dannyb@google.com

[Daniel Berlin, 2015-02-13 18:32:02]

lgtm for OSTPR

[Jeremy Klein, 2015-02-13 18:33:44]

jlklein@chromium.org changed reviewers:
- cpu@chromium.org

[Jeremy Klein, 2015-02-17 23:29:47]

Thanks, Daniel.

Friendly ping for security and Pavel. This CL is currently blocking a couple
others, so I'd really like to get it landed as soon as possible. Thanks!

[jww, 2015-02-18 00:29:08]

On 2015/02/17 23:29:47, Jeremy Klein wrote:
> Thanks, Daniel.
> 
> Friendly ping for security and Pavel. This CL is currently blocking a couple
> others, so I'd really like to get it landed as soon as possible. Thanks!

Hi there. Joel from Security here. This generally lgtm from a Security
perspective, but I'm a bit concerned about, in the long term, how a lot of this
code may make it difficult/impossible to implement Content Security Policy (CSP)
for our WebUI/Settings pages. In particular, there's a fairly liberal use of
inline scripts and eval in the code that's being added, which would make it
virtually impossible to use a meaningful CSP. Is this something that you've
considered? Is this something we can fix going forward?

Also, for reference, if you're not familiar with Content Security Policy, check
out: http://www.html5rocks.com/en/tutorials/security/content-security-policy/

[Jeremy Klein, 2015-02-18 00:38:28]

On 2015/02/18 00:29:08, jww wrote:
> On 2015/02/17 23:29:47, Jeremy Klein wrote:
> > Thanks, Daniel.
> > 
> > Friendly ping for security and Pavel. This CL is currently blocking a couple
> > others, so I'd really like to get it landed as soon as possible. Thanks!
> 
> Hi there. Joel from Security here. This generally lgtm from a Security
> perspective, but I'm a bit concerned about, in the long term, how a lot of
this
> code may make it difficult/impossible to implement Content Security Policy
(CSP)
> for our WebUI/Settings pages. In particular, there's a fairly liberal use of
> inline scripts and eval in the code that's being added, which would make it
> virtually impossible to use a meaningful CSP. Is this something that you've
> considered? Is this something we can fix going forward?
> 
> Also, for reference, if you're not familiar with Content Security Policy,
check
> out: http://www.html5rocks.com/en/tutorials/security/content-security-policy/

Thanks, Joel! My main source of experience working with Polymer has been with
Chrome Apps in Google3, so I'm pretty familiar with the CSP stuff. We haven't
run into any issues there yet in using web-animations-js. Part of that is
probably because we're vulcanizing everything to get rid of the inline scripts
(which we also do in Chrome). As for eval, I see one use of eval in
web-animations-js-next.min.js and it looks like its coming from:

https://github.com/web-animations/web-animations-js/blob/f2b89d742de1b32f61c3...

I'm not sure why we haven't hit any issues with that yet in our apps. Maybe we
aren't going down that code path? Adding timloh@ to cc to see if he has any
input on how we can get rid of that call to eval.

[jww, 2015-02-18 00:44:37]

On 2015/02/18 00:38:28, Jeremy Klein wrote:
> On 2015/02/18 00:29:08, jww wrote:
> > On 2015/02/17 23:29:47, Jeremy Klein wrote:
> > > Thanks, Daniel.
> > > 
> > > Friendly ping for security and Pavel. This CL is currently blocking a
couple
> > > others, so I'd really like to get it landed as soon as possible. Thanks!
> > 
> > Hi there. Joel from Security here. This generally lgtm from a Security
> > perspective, but I'm a bit concerned about, in the long term, how a lot of
> this
> > code may make it difficult/impossible to implement Content Security Policy
> (CSP)
> > for our WebUI/Settings pages. In particular, there's a fairly liberal use of
> > inline scripts and eval in the code that's being added, which would make it
> > virtually impossible to use a meaningful CSP. Is this something that you've
> > considered? Is this something we can fix going forward?
> > 
> > Also, for reference, if you're not familiar with Content Security Policy,
> check
> > out:
http://www.html5rocks.com/en/tutorials/security/content-security-policy/
> 
> Thanks, Joel! My main source of experience working with Polymer has been with
> Chrome Apps in Google3, so I'm pretty familiar with the CSP stuff. We haven't
> run into any issues there yet in using web-animations-js. Part of that is
> probably because we're vulcanizing everything to get rid of the inline scripts
> (which we also do in Chrome). As for eval, I see one use of eval in
So, just to clarify, all of these scripts have already been vulcanized so we
shouldn't see any inline scripts? I thought I saw some, but it may just have
been in the demo files, which obviously wouldn't be problematic.
> web-animations-js-next.min.js and it looks like its coming from:
> 
>
https://github.com/web-animations/web-animations-js/blob/f2b89d742de1b32f61c3...
> 
> I'm not sure why we haven't hit any issues with that yet in our apps. Maybe we
> aren't going down that code path? Adding timloh@ to cc to see if he has any
> input on how we can get rid of that call to eval.

[chromium-reviews, 2015-02-18 00:51:19]

Not exactly. To clarify, all Polymer components are vulcanized in
third_party/polymer/components-chromium. That means that our dependencies
on web-animations-js should all have sources extracted to their own js
files. The only use I see right now for web-animations-js from Polymer is
in:

https://codereview.chromium.org/917523002/diff/120001/third_party/polymer/com...

which is simply linking to the web-animations-js-next.min.js file in a src
tag. I think we should be OK on inline scripts for that reason. If people
start directly using web-animations-js outside of Polymer, they may run
into csp issues, though. They should really just be using the minified
verison of the source anyway though. I could even delete everything except
the minified srcs if that would make things clearer here.

On Tue Feb 17 2015 at 4:44:38 PM <jww@chromium.org> wrote:

> On 2015/02/18 00:38:28, Jeremy Klein wrote:
> > On 2015/02/18 00:29:08, jww wrote:
> > > On 2015/02/17 23:29:47, Jeremy Klein wrote:
> > > > Thanks, Daniel.
> > > >
> > > > Friendly ping for security and Pavel. This CL is currently blocking a
> couple
> > > > others, so I'd really like to get it landed as soon as possible.
> > Thanks!
> > >
> > > Hi there. Joel from Security here. This generally lgtm from a Security
> > > perspective, but I'm a bit concerned about, in the long term, how a lot
> > of
> > this
> > > code may make it difficult/impossible to implement Content Security
> > Policy
> > (CSP)
> > > for our WebUI/Settings pages. In particular, there's a fairly liberal
> > use of
> > > inline scripts and eval in the code that's being added, which would
> > make it
> > > virtually impossible to use a meaningful CSP. Is this something that
> > you've
> > > considered? Is this something we can fix going forward?
> > >
> > > Also, for reference, if you're not familiar with Content Security
> > Policy,
> > check
> > > out:
> http://www.html5rocks.com/en/tutorials/security/content-security-policy/
>
> > Thanks, Joel! My main source of experience working with Polymer has been
> > with
> > Chrome Apps in Google3, so I'm pretty familiar with the CSP stuff. We
> > haven't
> > run into any issues there yet in using web-animations-js. Part of that is
> > probably because we're vulcanizing everything to get rid of the inline
> > scripts
> > (which we also do in Chrome). As for eval, I see one use of eval in
> So, just to clarify, all of these scripts have already been vulcanized so
> we
> shouldn't see any inline scripts? I thought I saw some, but it may just
> have
> been in the demo files, which obviously wouldn't be problematic.
> > web-animations-js-next.min.js and it looks like its coming from:
>
>
> https://github.com/web-animations/web-animations-js/blob/
> f2b89d742de1b32f61c384779477534091cec822/src/dimension-handler.js#L57
>
> > I'm not sure why we haven't hit any issues with that yet in our apps.
> > Maybe we
> > aren't going down that code path? Adding timloh@ to cc to see if he has
> > any
> > input on how we can get rid of that call to eval.
>
>
>
> https://codereview.chromium.org/917523002/
>

To unsubscribe from this group and stop receiving emails from it, send an email
to chromium-reviews+unsubscribe@chromium.org.

[jww, 2015-02-18 00:53:16]

On 2015/02/18 00:51:19, chromium-reviews wrote:
> Not exactly. To clarify, all Polymer components are vulcanized in
> third_party/polymer/components-chromium. That means that our dependencies
> on web-animations-js should all have sources extracted to their own js
> files. The only use I see right now for web-animations-js from Polymer is
> in:
> 
>
https://codereview.chromium.org/917523002/diff/120001/third_party/polymer/com...
> 
> which is simply linking to the web-animations-js-next.min.js file in a src
> tag. I think we should be OK on inline scripts for that reason. If people
> start directly using web-animations-js outside of Polymer, they may run
> into csp issues, though. They should really just be using the minified
> verison of the source anyway though. I could even delete everything except
> the minified srcs if that would make things clearer here.
I don't think that's particularly necessary, but it would be great if the README
could be very specific about that. Thanks!
> 
> On Tue Feb 17 2015 at 4:44:38 PM <mailto:jww@chromium.org> wrote:
> 
> > On 2015/02/18 00:38:28, Jeremy Klein wrote:
> > > On 2015/02/18 00:29:08, jww wrote:
> > > > On 2015/02/17 23:29:47, Jeremy Klein wrote:
> > > > > Thanks, Daniel.
> > > > >
> > > > > Friendly ping for security and Pavel. This CL is currently blocking a
> > couple
> > > > > others, so I'd really like to get it landed as soon as possible.
> > > Thanks!
> > > >
> > > > Hi there. Joel from Security here. This generally lgtm from a Security
> > > > perspective, but I'm a bit concerned about, in the long term, how a lot
> > > of
> > > this
> > > > code may make it difficult/impossible to implement Content Security
> > > Policy
> > > (CSP)
> > > > for our WebUI/Settings pages. In particular, there's a fairly liberal
> > > use of
> > > > inline scripts and eval in the code that's being added, which would
> > > make it
> > > > virtually impossible to use a meaningful CSP. Is this something that
> > > you've
> > > > considered? Is this something we can fix going forward?
> > > >
> > > > Also, for reference, if you're not familiar with Content Security
> > > Policy,
> > > check
> > > > out:
> > http://www.html5rocks.com/en/tutorials/security/content-security-policy/
> >
> > > Thanks, Joel! My main source of experience working with Polymer has been
> > > with
> > > Chrome Apps in Google3, so I'm pretty familiar with the CSP stuff. We
> > > haven't
> > > run into any issues there yet in using web-animations-js. Part of that is
> > > probably because we're vulcanizing everything to get rid of the inline
> > > scripts
> > > (which we also do in Chrome). As for eval, I see one use of eval in
> > So, just to clarify, all of these scripts have already been vulcanized so
> > we
> > shouldn't see any inline scripts? I thought I saw some, but it may just
> > have
> > been in the demo files, which obviously wouldn't be problematic.
> > > web-animations-js-next.min.js and it looks like its coming from:
> >
> >
> > https://github.com/web-animations/web-animations-js/blob/
> > f2b89d742de1b32f61c384779477534091cec822/src/dimension-handler.js#L57
> >
> > > I'm not sure why we haven't hit any issues with that yet in our apps.
> > > Maybe we
> > > aren't going down that code path? Adding timloh@ to cc to see if he has
> > > any
> > > input on how we can get rid of that call to eval.
> >
> >
> >
> > https://codereview.chromium.org/917523002/
> >
> 
> To unsubscribe from this group and stop receiving emails from it, send an
email
> to mailto:chromium-reviews+unsubscribe@chromium.org.

[Jeremy Klein, 2015-02-18 01:00:51]

New patchsets have been uploaded after l-g-t-m from
dannyb@google.com,jww@chromium.org

[chromium-reviews, 2015-02-18 01:01:07]

Done.

On Tue Feb 17 2015 at 4:53:18 PM <jww@chromium.org> wrote:

> On 2015/02/18 00:51:19, chromium-reviews wrote:
> > Not exactly. To clarify, all Polymer components are vulcanized in
> > third_party/polymer/components-chromium. That means that our
> dependencies
> > on web-animations-js should all have sources extracted to their own js
> > files. The only use I see right now for web-animations-js from Polymer is
> > in:
>
>
> https://codereview.chromium.org/917523002/diff/120001/third_party/polymer/
> components-chromium/core-animation/web-animations.html
>
> > which is simply linking to the web-animations-js-next.min.js file in a
> src
> > tag. I think we should be OK on inline scripts for that reason. If people
> > start directly using web-animations-js outside of Polymer, they may run
> > into csp issues, though. They should really just be using the minified
> > verison of the source anyway though. I could even delete everything
> except
> > the minified srcs if that would make things clearer here.
> I don't think that's particularly necessary, but it would be great if the
> README
> could be very specific about that. Thanks!
>
> > On Tue Feb 17 2015 at 4:44:38 PM <mailto:jww@chromium.org> wrote:
>
> > > On 2015/02/18 00:38:28, Jeremy Klein wrote:
> > > > On 2015/02/18 00:29:08, jww wrote:
> > > > > On 2015/02/17 23:29:47, Jeremy Klein wrote:
> > > > > > Thanks, Daniel.
> > > > > >
> > > > > > Friendly ping for security and Pavel. This CL is currently
> > blocking a
> > > couple
> > > > > > others, so I'd really like to get it landed as soon as possible.
> > > > Thanks!
> > > > >
> > > > > Hi there. Joel from Security here. This generally lgtm from a
> > Security
> > > > > perspective, but I'm a bit concerned about, in the long term, how a
> > lot
> > > > of
> > > > this
> > > > > code may make it difficult/impossible to implement Content Security
> > > > Policy
> > > > (CSP)
> > > > > for our WebUI/Settings pages. In particular, there's a fairly
> > liberal
> > > > use of
> > > > > inline scripts and eval in the code that's being added, which would
> > > > make it
> > > > > virtually impossible to use a meaningful CSP. Is this something
> that
> > > > you've
> > > > > considered? Is this something we can fix going forward?
> > > > >
> > > > > Also, for reference, if you're not familiar with Content Security
> > > > Policy,
> > > > check
> > > > > out:
> > > http://www.html5rocks.com/en/tutorials/security/content-secu
> rity-policy/
> > >
> > > > Thanks, Joel! My main source of experience working with Polymer has
> > been
> > > > with
> > > > Chrome Apps in Google3, so I'm pretty familiar with the CSP stuff. We
> > > > haven't
> > > > run into any issues there yet in using web-animations-js. Part of
> > that is
> > > > probably because we're vulcanizing everything to get rid of the
> inline
> > > > scripts
> > > > (which we also do in Chrome). As for eval, I see one use of eval in
> > > So, just to clarify, all of these scripts have already been vulcanized
> > so
> > > we
> > > shouldn't see any inline scripts? I thought I saw some, but it may just
> > > have
> > > been in the demo files, which obviously wouldn't be problematic.
> > > > web-animations-js-next.min.js and it looks like its coming from:
> > >
> > >
> > > https://github.com/web-animations/web-animations-js/blob/
> > > f2b89d742de1b32f61c384779477534091cec822/src/dimension-handler.js#L57
> > >
> > > > I'm not sure why we haven't hit any issues with that yet in our apps.
> > > > Maybe we
> > > > aren't going down that code path? Adding timloh@ to cc to see if he
> > has
> > > > any
> > > > input on how we can get rid of that call to eval.
> > >
> > >
> > >
> > > https://codereview.chromium.org/917523002/
> > >
>
> > To unsubscribe from this group and stop receiving emails from it, send an
> email
> > to mailto:chromium-reviews+unsubscribe@chromium.org.
>
>
>
> https://codereview.chromium.org/917523002/
>

To unsubscribe from this group and stop receiving emails from it, send an email
to chromium-reviews+unsubscribe@chromium.org.

[Jeremy Klein, 2015-02-18 01:02:24]

jlklein@chromium.org changed reviewers:
+ estade@chromium.org
- felt@chromium.org

[jww, 2015-02-18 01:06:00]

On 2015/02/18 01:01:07, chromium-reviews wrote:
> Done.
> 
> On Tue Feb 17 2015 at 4:53:18 PM <mailto:jww@chromium.org> wrote:
> 
> > On 2015/02/18 00:51:19, chromium-reviews wrote:
> > > Not exactly. To clarify, all Polymer components are vulcanized in
> > > third_party/polymer/components-chromium. That means that our
> > dependencies
> > > on web-animations-js should all have sources extracted to their own js
> > > files. The only use I see right now for web-animations-js from Polymer is
> > > in:
> >
> >
> > https://codereview.chromium.org/917523002/diff/120001/third_party/polymer/
> > components-chromium/core-animation/web-animations.html
> >
> > > which is simply linking to the web-animations-js-next.min.js file in a
> > src
> > > tag. I think we should be OK on inline scripts for that reason. If people
> > > start directly using web-animations-js outside of Polymer, they may run
> > > into csp issues, though. They should really just be using the minified
> > > verison of the source anyway though. I could even delete everything
> > except
> > > the minified srcs if that would make things clearer here.
> > I don't think that's particularly necessary, but it would be great if the
> > README
> > could be very specific about that. Thanks!
> >
> > > On Tue Feb 17 2015 at 4:44:38 PM <mailto:jww@chromium.org> wrote:
> >
> > > > On 2015/02/18 00:38:28, Jeremy Klein wrote:
> > > > > On 2015/02/18 00:29:08, jww wrote:
> > > > > > On 2015/02/17 23:29:47, Jeremy Klein wrote:
> > > > > > > Thanks, Daniel.
> > > > > > >
> > > > > > > Friendly ping for security and Pavel. This CL is currently
> > > blocking a
> > > > couple
> > > > > > > others, so I'd really like to get it landed as soon as possible.
> > > > > Thanks!
> > > > > >
> > > > > > Hi there. Joel from Security here. This generally lgtm from a
> > > Security
> > > > > > perspective, but I'm a bit concerned about, in the long term, how a
> > > lot
> > > > > of
> > > > > this
> > > > > > code may make it difficult/impossible to implement Content Security
> > > > > Policy
> > > > > (CSP)
> > > > > > for our WebUI/Settings pages. In particular, there's a fairly
> > > liberal
> > > > > use of
> > > > > > inline scripts and eval in the code that's being added, which would
> > > > > make it
> > > > > > virtually impossible to use a meaningful CSP. Is this something
> > that
> > > > > you've
> > > > > > considered? Is this something we can fix going forward?
> > > > > >
> > > > > > Also, for reference, if you're not familiar with Content Security
> > > > > Policy,
> > > > > check
> > > > > > out:
> > > > http://www.html5rocks.com/en/tutorials/security/content-secu
> > rity-policy/
> > > >
> > > > > Thanks, Joel! My main source of experience working with Polymer has
> > > been
> > > > > with
> > > > > Chrome Apps in Google3, so I'm pretty familiar with the CSP stuff. We
> > > > > haven't
> > > > > run into any issues there yet in using web-animations-js. Part of
> > > that is
> > > > > probably because we're vulcanizing everything to get rid of the
> > inline
> > > > > scripts
> > > > > (which we also do in Chrome). As for eval, I see one use of eval in
> > > > So, just to clarify, all of these scripts have already been vulcanized
> > > so
> > > > we
> > > > shouldn't see any inline scripts? I thought I saw some, but it may just
> > > > have
> > > > been in the demo files, which obviously wouldn't be problematic.
> > > > > web-animations-js-next.min.js and it looks like its coming from:
> > > >
> > > >
> > > > https://github.com/web-animations/web-animations-js/blob/
> > > > f2b89d742de1b32f61c384779477534091cec822/src/dimension-handler.js#L57
> > > >
> > > > > I'm not sure why we haven't hit any issues with that yet in our apps.
> > > > > Maybe we
> > > > > aren't going down that code path? Adding timloh@ to cc to see if he
> > > has
> > > > > any
> > > > > input on how we can get rid of that call to eval.
> > > >
> > > >
> > > >
> > > > https://codereview.chromium.org/917523002/
> > > >
> >
> > > To unsubscribe from this group and stop receiving emails from it, send an
> > email
> > > to mailto:chromium-reviews+unsubscribe@chromium.org.
> >
> >
> >
> > https://codereview.chromium.org/917523002/
> >
> 
> To unsubscribe from this group and stop receiving emails from it, send an
email
> to mailto:chromium-reviews+unsubscribe@chromium.org.
Awesome, thanks.

[Evan Stade, 2015-02-18 01:07:01]

polymer_resources.grdp rslgtm

[Evan Stade, 2015-02-18 01:08:34]

lgtm

[Timothy Loh, 2015-02-18 03:15:59]

On 2015/02/18 00:38:28, Jeremy Klein wrote:
> On 2015/02/18 00:29:08, jww wrote:
> > On 2015/02/17 23:29:47, Jeremy Klein wrote:
> > > Thanks, Daniel.
> > > 
> > > Friendly ping for security and Pavel. This CL is currently blocking a
couple
> > > others, so I'd really like to get it landed as soon as possible. Thanks!
> > 
> > Hi there. Joel from Security here. This generally lgtm from a Security
> > perspective, but I'm a bit concerned about, in the long term, how a lot of
> this
> > code may make it difficult/impossible to implement Content Security Policy
> (CSP)
> > for our WebUI/Settings pages. In particular, there's a fairly liberal use of
> > inline scripts and eval in the code that's being added, which would make it
> > virtually impossible to use a meaningful CSP. Is this something that you've
> > considered? Is this something we can fix going forward?
> > 
> > Also, for reference, if you're not familiar with Content Security Policy,
> check
> > out:
http://www.html5rocks.com/en/tutorials/security/content-security-policy/
> 
> Thanks, Joel! My main source of experience working with Polymer has been with
> Chrome Apps in Google3, so I'm pretty familiar with the CSP stuff. We haven't
> run into any issues there yet in using web-animations-js. Part of that is
> probably because we're vulcanizing everything to get rid of the inline scripts
> (which we also do in Chrome). As for eval, I see one use of eval in
> web-animations-js-next.min.js and it looks like its coming from:
> 
>
https://github.com/web-animations/web-animations-js/blob/f2b89d742de1b32f61c3...
> 
> I'm not sure why we haven't hit any issues with that yet in our apps. Maybe we
> aren't going down that code path? Adding timloh@ to cc to see if he has any
> input on how we can get rid of that call to eval.

I'll rewrite this to not rely on eval, the call here is just evaluating a
numeric expression (the preceding lines validate this should be safe).

[Jeremy Klein, 2015-02-18 03:46:08]

On 2015/02/18 03:15:59, Timothy Loh wrote:
> On 2015/02/18 00:38:28, Jeremy Klein wrote:
> > On 2015/02/18 00:29:08, jww wrote:
> > > On 2015/02/17 23:29:47, Jeremy Klein wrote:
> > > > Thanks, Daniel.
> > > > 
> > > > Friendly ping for security and Pavel. This CL is currently blocking a
> couple
> > > > others, so I'd really like to get it landed as soon as possible. Thanks!
> > > 
> > > Hi there. Joel from Security here. This generally lgtm from a Security
> > > perspective, but I'm a bit concerned about, in the long term, how a lot of
> > this
> > > code may make it difficult/impossible to implement Content Security Policy
> > (CSP)
> > > for our WebUI/Settings pages. In particular, there's a fairly liberal use
of
> > > inline scripts and eval in the code that's being added, which would make
it
> > > virtually impossible to use a meaningful CSP. Is this something that
you've
> > > considered? Is this something we can fix going forward?
> > > 
> > > Also, for reference, if you're not familiar with Content Security Policy,
> > check
> > > out:
> http://www.html5rocks.com/en/tutorials/security/content-security-policy/
> > 
> > Thanks, Joel! My main source of experience working with Polymer has been
with
> > Chrome Apps in Google3, so I'm pretty familiar with the CSP stuff. We
haven't
> > run into any issues there yet in using web-animations-js. Part of that is
> > probably because we're vulcanizing everything to get rid of the inline
scripts
> > (which we also do in Chrome). As for eval, I see one use of eval in
> > web-animations-js-next.min.js and it looks like its coming from:
> > 
> >
>
https://github.com/web-animations/web-animations-js/blob/f2b89d742de1b32f61c3...
> > 
> > I'm not sure why we haven't hit any issues with that yet in our apps. Maybe
we
> > aren't going down that code path? Adding timloh@ to cc to see if he has any
> > input on how we can get rid of that call to eval.
> 
> I'll rewrite this to not rely on eval, the call here is just evaluating a
> numeric expression (the preceding lines validate this should be safe).

Great! Thanks, Tim!

[dzhioev (left Google), 2015-02-18 11:27:39]

Please find the second OWNER for web-animations-js dir (I think michaelpg@ would
be OK).
Also, please reword a title of the CL, to make it fit within limits.
LGTM after that.

[dzhioev (left Google), 2015-02-18 12:21:00]

Sorry, not LGTM. I missed one thing.

https://codereview.chromium.org/917523002/diff/140001/third_party/polymer/com...
File third_party/polymer/components-chromium/core-animation/web-animations.html
(right):

https://codereview.chromium.org/917523002/diff/140001/third_party/polymer/com...
third_party/polymer/components-chromium/core-animation/web-animations.html:10:
<script src="../web-animations-js/web-animations-next-lite.min.js"></script>
As far as I can understand, this include doesn't work. To make it work we need
to add another alias, mapping "../../../third_party/web-animations-js/sources"
to "polymer/web-animations-js" in shared_resources_data_source.cc.
The second option is to create symlink
"third_party/polymer/components-chromium/web-animations-js" pointing to
"third_party/web-animations-js/sources" and change path for web-animations in
polymer_resources.grdp.
I prefer the second option, but I'm not sure if it is OK to create such symlinks
in the source tree.

[Jeremy Klein, 2015-02-18 21:44:23]

New patchsets have been uploaded after l-g-t-m from estade@chromium.org

[Jeremy Klein, 2015-02-18 21:44:33]

On 2015/02/18 12:21:00, dzhioev wrote:
> Sorry, not LGTM. I missed one thing.
> 
>
https://codereview.chromium.org/917523002/diff/140001/third_party/polymer/com...
> File
third_party/polymer/components-chromium/core-animation/web-animations.html
> (right):
> 
>
https://codereview.chromium.org/917523002/diff/140001/third_party/polymer/com...
> third_party/polymer/components-chromium/core-animation/web-animations.html:10:
> <script src="../web-animations-js/web-animations-next-lite.min.js"></script>
> As far as I can understand, this include doesn't work. To make it work we need
> to add another alias, mapping "../../../third_party/web-animations-js/sources"
> to "polymer/web-animations-js" in shared_resources_data_source.cc.
> The second option is to create symlink
> "third_party/polymer/components-chromium/web-animations-js" pointing to
> "third_party/web-animations-js/sources" and change path for web-animations in
> polymer_resources.grdp.
> I prefer the second option, but I'm not sure if it is OK to create such
symlinks
> in the source tree.

Went with option 1 for concerns with symlinks on windows. See
https://groups.google.com/a/chromium.org/forum/#!topic/chromium-dev/-A07A8RxEPA.

[michaelpg, 2015-02-18 22:03:40]

michaelpg@chromium.org changed reviewers:
+ michaelpg@chromium.org

[michaelpg, 2015-02-18 22:03:41]

assuming this has been tested -- lgtm

https://codereview.chromium.org/917523002/diff/160001/content/browser/webui/s...
File content/browser/webui/shared_resources_data_source.cc (right):

https://codereview.chromium.org/917523002/diff/160001/content/browser/webui/s...
content/browser/webui/shared_resources_data_source.cc:31:
"polymer/web-animations-js/"},
nit: line should only be indented 3 spaces, to match above line

http://google-styleguide.googlecode.com/svn/trunk/cppguide.html#Braced_Initia...

[Jeremy Klein, 2015-02-18 22:07:32]

Tested via https://codereview.chromium.org/917893004/

https://codereview.chromium.org/917523002/diff/160001/content/browser/webui/s...
File content/browser/webui/shared_resources_data_source.cc (right):

https://codereview.chromium.org/917523002/diff/160001/content/browser/webui/s...
content/browser/webui/shared_resources_data_source.cc:31:
"polymer/web-animations-js/"},
On 2015/02/18 22:03:41, michaelpg wrote:
> nit: line should only be indented 3 spaces, to match above line
> 
>
http://google-styleguide.googlecode.com/svn/trunk/cppguide.html#Braced_Initia...

Already fixed in the most recent patch by git cl format :-).

[michaelpg, 2015-02-18 22:13:45]

On 2015/02/18 11:27:39, dzhioev wrote:
> Please find the second OWNER for web-animations-js dir (I think michaelpg@
would
> be OK).
> Also, please reword a title of the CL, to make it fit within limits.
> LGTM after that.

oh haha I interpreted this incorrectly. you didn't need my l-g-t-m.

yeah feel free to add me. and I'd say wait for dzhioev to l-g-t-m again.

[dzhioev_at_google, 2015-02-18 22:42:17]

On 2015/02/18 21:44:33, Jeremy Klein wrote:
> On 2015/02/18 12:21:00, dzhioev wrote:
> > Sorry, not LGTM. I missed one thing.
> > 
> >
>
https://codereview.chromium.org/917523002/diff/140001/third_party/polymer/com...
> > File
> third_party/polymer/components-chromium/core-animation/web-animations.html
> > (right):
> > 
> >
>
https://codereview.chromium.org/917523002/diff/140001/third_party/polymer/com...
> >
third_party/polymer/components-chromium/core-animation/web-animations.html:10:
> > <script src="../web-animations-js/web-animations-next-lite.min.js"></script>
> > As far as I can understand, this include doesn't work. To make it work we
need
> > to add another alias, mapping
"../../../third_party/web-animations-js/sources"
> > to "polymer/web-animations-js" in shared_resources_data_source.cc.
> > The second option is to create symlink
> > "third_party/polymer/components-chromium/web-animations-js" pointing to
> > "third_party/web-animations-js/sources" and change path for web-animations
in
> > polymer_resources.grdp.
> > I prefer the second option, but I'm not sure if it is OK to create such
> symlinks
> > in the source tree.
> 
> Went with option 1 for concerns with symlinks on windows. See
>
https://groups.google.com/a/chromium.org/forum/#!topic/chromium-dev/-A07A8RxEPA.

Thank you. LGTM

[Jeremy Klein, 2015-02-18 22:43:38]

The CQ bit was checked by jlklein@chromium.org

[dzhioev (left Google), 2015-02-18 22:44:16]

On 2015/02/18 22:42:17, dzhioev_at_google wrote:
> On 2015/02/18 21:44:33, Jeremy Klein wrote:
> > On 2015/02/18 12:21:00, dzhioev wrote:
> > > Sorry, not LGTM. I missed one thing.
> > > 
> > >
> >
>
https://codereview.chromium.org/917523002/diff/140001/third_party/polymer/com...
> > > File
> > third_party/polymer/components-chromium/core-animation/web-animations.html
> > > (right):
> > > 
> > >
> >
>
https://codereview.chromium.org/917523002/diff/140001/third_party/polymer/com...
> > >
> third_party/polymer/components-chromium/core-animation/web-animations.html:10:
> > > <script
src="../web-animations-js/web-animations-next-lite.min.js"></script>
> > > As far as I can understand, this include doesn't work. To make it work we
> need
> > > to add another alias, mapping
> "../../../third_party/web-animations-js/sources"
> > > to "polymer/web-animations-js" in shared_resources_data_source.cc.
> > > The second option is to create symlink
> > > "third_party/polymer/components-chromium/web-animations-js" pointing to
> > > "third_party/web-animations-js/sources" and change path for web-animations
> in
> > > polymer_resources.grdp.
> > > I prefer the second option, but I'm not sure if it is OK to create such
> > symlinks
> > > in the source tree.
> > 
> > Went with option 1 for concerns with symlinks on windows. See
> >
>
https://groups.google.com/a/chromium.org/forum/#!topic/chromium-dev/-A07A8RxEPA.
> 
> Thank you. LGTM

Sorry, used wrong account. LGTM

[commit-bot: I haz the power, 2015-02-18 22:44:44]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/917523002/180001

[commit-bot: I haz the power, 2015-02-19 00:05:48]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-02-19 00:05:50]

Try jobs failed on following builders:
  linux_chromium_rel_ng on tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)

[Jeremy Klein, 2015-02-19 01:18:13]

On 2015/02/19 00:05:50, I haz the power (commit-bot) wrote:
> Try jobs failed on following builders:
>   linux_chromium_rel_ng on tryserver.chromium.linux (JOB_FAILED,
>
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)

checklicenses.py is mad that .travis-setup.sh doesn't have a license header.
I've sent a pull request
(https://github.com/web-animations/web-animations-js/pull/21) to get that fixed
along with some other missing headers. However, we also don't need
.travis-setup.sh in Chromium anyway for the time-being. Would it be preferred to
add a suppress for this file until the change is merged upstream or just delete
.travis-setup.sh? The header also won't actually get pulled into Chromium by the
reproduce.sh script until a new version of web-animations-js is released and the
version is bumped in third_party/polymer/bower.json.

The other option is to also make the change locally in chromium and add a note
to README.chromium. Is that sort of thing acceptable in Chromium if there's a
link to the pull request?

[chromium-reviews, 2015-02-19 04:03:26]

Just delete it.
Dunno chromium rules, we'd normally mention it at bottom of README in
"Local changes"


On Wed, Feb 18, 2015 at 5:18 PM, <jlklein@chromium.org> wrote:

> On 2015/02/19 00:05:50, I haz the power (commit-bot) wrote:
>
>> Try jobs failed on following builders:
>>    linux_chromium_rel_ng on tryserver.chromium.linux (JOB_FAILED,
>>
>
> http://build.chromium.org/p/tryserver.chromium.linux/
> builders/linux_chromium_rel_ng/builds/34088)
>
> checklicenses.py is mad that .travis-setup.sh doesn't have a license
> header.
> I've sent a pull request
> (https://github.com/web-animations/web-animations-js/pull/21) to get that
> fixed
> along with some other missing headers. However, we also don't need
> .travis-setup.sh in Chromium anyway for the time-being. Would it be
> preferred to
> add a suppress for this file until the change is merged upstream or just
> delete
> .travis-setup.sh? The header also won't actually get pulled into Chromium
> by the
> reproduce.sh script until a new version of web-animations-js is released
> and the
> version is bumped in third_party/polymer/bower.json.
>
> The other option is to also make the change locally in chromium and add a
> note
> to README.chromium. Is that sort of thing acceptable in Chromium if
> there's a
> link to the pull request?
>
> https://codereview.chromium.org/917523002/
>

To unsubscribe from this group and stop receiving emails from it, send an email
to chromium-reviews+unsubscribe@chromium.org.

[Jeremy Klein, 2015-02-19 18:30:57]

New patchsets have been uploaded after l-g-t-m from
michaelpg@chromium.org,dzhioev@google.com,dzhioev@chromium.org

[Jeremy Klein, 2015-02-19 18:39:06]

On 2015/02/19 04:03:26, chromium-reviews wrote:
> Just delete it.
> Dunno chromium rules, we'd normally mention it at bottom of README in
> "Local changes"
> 
> 
> On Wed, Feb 18, 2015 at 5:18 PM, <mailto:jlklein@chromium.org> wrote:
> 
> > On 2015/02/19 00:05:50, I haz the power (commit-bot) wrote:
> >
> >> Try jobs failed on following builders:
> >>    linux_chromium_rel_ng on tryserver.chromium.linux (JOB_FAILED,
> >>
> >
> > http://build.chromium.org/p/tryserver.chromium.linux/
> > builders/linux_chromium_rel_ng/builds/34088)
> >
> > checklicenses.py is mad that .travis-setup.sh doesn't have a license
> > header.
> > I've sent a pull request
> > (https://github.com/web-animations/web-animations-js/pull/21) to get that
> > fixed
> > along with some other missing headers. However, we also don't need
> > .travis-setup.sh in Chromium anyway for the time-being. Would it be
> > preferred to
> > add a suppress for this file until the change is merged upstream or just
> > delete
> > .travis-setup.sh? The header also won't actually get pulled into Chromium
> > by the
> > reproduce.sh script until a new version of web-animations-js is released
> > and the
> > version is bumped in third_party/polymer/bower.json.
> >
> > The other option is to also make the change locally in chromium and add a
> > note
> > to README.chromium. Is that sort of thing acceptable in Chromium if
> > there's a
> > link to the pull request?
> >
> > https://codereview.chromium.org/917523002/
> >
> 
> To unsubscribe from this group and stop receiving emails from it, send an
email
> to mailto:chromium-reviews+unsubscribe@chromium.org.

Done.

[Jeremy Klein, 2015-02-19 18:39:42]

The CQ bit was checked by jlklein@chromium.org

[commit-bot: I haz the power, 2015-02-19 18:40:27]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/917523002/200001

[commit-bot: I haz the power, 2015-02-19 20:16:41]

Committed patchset #11 (id:200001)

[commit-bot: I haz the power, 2015-02-19 20:17:18]

Patchset 11 (id:??) landed as
https://crrev.com/bcadd727094404da8b8db634f24ca3c92d4ffa59
Cr-Commit-Position: refs/heads/master@{#317119}