Fixing the inconsistent rendering of haddocks across hackage

[MangoIV]

I think I have a pretty "simple" idea for a fix here. How about we

• remove all css from doc tarballs
• ship our own css that adheres with the rest of the style of hackage

That way we wouldn't get outdated styles.

[MangoIV]

So afaiu at the moment, how it works is that hackage-server just loads the tarball and then serves whatever file from the tarball that was requested. I guess to replace the css then, whenever we match on a css path, we would serve our own css :3.

hackage-server/src/Distribution/Server/Features/Documentation.hs

Lines 296 to 298 in 962b6d7

	ServerTarball.serveTarball (display pkgid ++ " documentation")
	[{-no index-}] (display pkgid ++ "-docs")
	tarball index [Public, maxAge] etag (Just rewriteDocs)

Also, it appears hackage-server already does something like this:
https://github.com/haskell/hackage-server/blob/962b6d77c54e4cb2491c7be3fe84797c60471782/src/Distribution/Server/Features/Documentation.hs#L300C1-L304

[ulysses4ever]

I agree it's annoying to have to look at the outdated haddock styles. I wondered if it's possible to do something along the proposed lines.

OTOH, it won't be easy to build a consensus behind what appears to be a rather drastic measure -- to override the contents of user-generated archives...

[MangoIV]

In my opinion user generated archives shouldn't be a thing at all. I think it would be even be a good idea to throw away everything that isn't enclosed in the html type and then some tags that may be dangerous. (like <script> etc.)

But I guess this ship has sailed anyways cf package tarball uploads / malicious template Haskell / safe Haskell kinda not being a thing anymore etc.

[peterbecich]

Good idea, duplicate to #1329

[peterbecich]

For the simplest solution, cannot all these tarballs just be re-generated with the latest CSS? This would not require an architectural change. Perhaps an "invisible" revision published for every package.